<#
.SYNOPSIS
    Install a SecurityInsight Pro licence into the ONE SI Key Vault (#173).

.DESCRIPTION
    SecurityInsight Pro reads its licence at run time from the Key Vault secret 'SI-License' in the vault
    Get-SIVaultName resolves (SI_KeyVaultName, or SpnKeyVaultName on an install that predates that name). Until
    now nothing put it there -- it was stored by hand, and a paying customer without it silently ran the free
    edition. This is how it gets there:

      1. VERIFY with the real verifier, before anything is written: the signature and dates must verify
         (Valid, Grace or NotYetValid), every feature it grants must be one SecurityInsight has, and when
         the licence is bound to tenants this tenant must be one of them.
      2. WRITE the secret (the licence file's JSON, unchanged).
      3. READ IT BACK and verify the stored value again, then print the edition, features and dates.

    The licence file's content is never printed. -WhatIf shows the vault, the secret name and the verdict,
    and writes nothing.

.PARAMETER Path
    The licence file you received (.silicense / .aitlicense).
.PARAMETER VaultName
    Override the vault. Normally resolved from config\SecurityInsight.custom.ps1.
.PARAMETER TenantId
    The tenant this install runs in, for the tenant-binding check. Default: the tenant of the signed-in account.
.EXAMPLE
    .\Set-SILicense.ps1 -Path .\contoso.silicense
.EXAMPLE
    .\Set-SILicense.ps1 -Path .\contoso.silicense -WhatIf
.NOTES
    Requirements:
      PowerShell 7 (pwsh). Windows PowerShell 5.1 is refused at once (#Requires -Version 7.0).
      Role: Key Vault Secrets Officer -- on the SecurityInsight Key Vault
      Hosts: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics.io, api.msrc.microsoft.com, api.security.microsoft.com, api.securitycenter.microsoft.com, api.securityplatform.microsoft.com, database.windows.net, entra.microsoft.com, graph.microsoft.com, invardia.com, licenses.nuget.org, login.microsoftonline.com, management.azure.com, monitor.azure.com, nvd.nist.gov, outlook.office.com, outlook.office365.com, portal.invardia.com, storage.azure.com, vault.azure.net
    Without a licence SecurityInsight runs the Community edition: every free engine works, and each Pro engine
    prints one line and publishes nothing. A licence can also be placed as config\*.silicense instead of in
    Key Vault; the vault is preferred because it survives a rebuilt machine and is read by container hosting.

.LINK
    https://invardia.com/docs/si/scripts/Set-SILicense/
#>
[CmdletBinding(SupportsShouldProcess)]
param(
    [Parameter(Mandatory)][string]$Path,
    [Parameter()][string]$VaultName,
    [Parameter()][string]$TenantId
)

#Requires -Version 7.0
# SecurityInsight 3.0.79 -- Set-SILicense.ps1, standalone (Pro edition). Built 2026-11-09T20:28:39Z from commit c1472e2f4c240c971c9559f07eef7e794b322001, source SOLUTIONS/SecurityInsight/setup/Set-SILicense.ps1,
# by release/Build-SISupportScripts.ps1 (framework SUPPORT-DL-1). Download: Invoke-WebRequest https://invardia.com/support/si/Set-SILicense.ps1 -OutFile Set-SILicense.ps1
# It carries the 107 SecurityInsight file(s) the script loads (listed in $__siSupportFiles below, readable, each line
# prefixed with "|"); at run time it writes them to a private temporary folder, checks each SHA-256, runs the original
# script from there with your parameters, and removes the folder. No PowerShell modules are needed.
$script:SIScriptVersion = '3.0.79'   # SI #547: the version this copy reports first (stamped into its embedded setup/_shared/SI-ScriptRun.ps1 too)
$__siSupportVersion = '3.0.79'
$__siSupportEntry = 'setup/Set-SILicense.ps1'
$__siSupportFiles = [ordered]@{}
$__siSupportFiles['setup/Set-SILicense.ps1'] = @{ Sha256 = 'b5b935b20c2997644cc9da2f34ebd12d1c4fa6b91201bba380d263cef62fcae6'; Text = @'
|<#
|.SYNOPSIS
|    Install a SecurityInsight Pro licence into the ONE SI Key Vault (#173).
|
|.DESCRIPTION
|    SecurityInsight Pro reads its licence at run time from the Key Vault secret 'SI-License' in the vault
|    Get-SIVaultName resolves (SI_KeyVaultName, or SpnKeyVaultName on an install that predates that name). Until
|    now nothing put it there -- it was stored by hand, and a paying customer without it silently ran the free
|    edition. This is how it gets there:
|
|      1. VERIFY with the real verifier, before anything is written: the signature and dates must verify
|         (Valid, Grace or NotYetValid), every feature it grants must be one SecurityInsight has, and when
|         the licence is bound to tenants this tenant must be one of them.
|      2. WRITE the secret (the licence file's JSON, unchanged).
|      3. READ IT BACK and verify the stored value again, then print the edition, features and dates.
|
|    The licence file's content is never printed. -WhatIf shows the vault, the secret name and the verdict,
|    and writes nothing.
|
|.PARAMETER Path
|    The licence file you received (.silicense / .aitlicense).
|.PARAMETER VaultName
|    Override the vault. Normally resolved from config\SecurityInsight.custom.ps1.
|.PARAMETER TenantId
|    The tenant this install runs in, for the tenant-binding check. Default: the tenant of the signed-in account.
|.EXAMPLE
|    .\Set-SILicense.ps1 -Path .\contoso.silicense
|.EXAMPLE
|    .\Set-SILicense.ps1 -Path .\contoso.silicense -WhatIf
|.NOTES
|    Without a licence SecurityInsight runs the Community edition: every free engine works, and each Pro engine
|    prints one line and publishes nothing. A licence can also be placed as config\*.silicense instead of in
|    Key Vault; the vault is preferred because it survives a rebuilt machine and is read by container hosting.
|
|.LINK
|    https://invardia.com/docs/si/scripts/Set-SILicense/
|#>
|[CmdletBinding(SupportsShouldProcess)]
|param(
|    [Parameter(Mandatory)][string]$Path,
|    [Parameter()][string]$VaultName,
|    [Parameter()][string]$TenantId
|)
|
|#Requires -Version 7.0   # after the help and the param block: before the help, it hides the help from Get-Help
|# framework section 12.7 / 12.10: the documentation link first, a transcript of the run, -WhatIf writes nothing
|. ([IO.Path]::Combine($PSScriptRoot, '_shared', 'SI-ScriptRun.ps1'))
|$siRun = Start-SIScriptRun -Script 'Set-SILicense' -Quiet:($false)
|try {
|$ErrorActionPreference = 'Stop'
|$siRoot = Split-Path -Parent $PSScriptRoot
|. (Join-Path $siRoot 'auth\Get-SIVaultName.ps1')
|. (Join-Path $siRoot 'engine\SI-FeatureCatalog.ps1')
|function Info([string]$m) { Write-Host "[INFO]  $m" -ForegroundColor Gray }
|function Ok  ([string]$m) { Write-Host "[OK]    $m" -ForegroundColor Green }
|
|# Load the customer's config for the vault name, the way every launcher does -- unless one was given.
|if (-not $VaultName) {
|    $cfg = Join-Path $siRoot 'config\SecurityInsight.custom.ps1'
|    if (Test-Path -LiteralPath $cfg) { try { . $cfg 3>$null } catch { Write-Warning ("config\SecurityInsight.custom.ps1 did not load cleanly: {0}" -f $_.Exception.Message) } }
|}
|$vault = Get-SIVaultName -VaultName $VaultName
|Info ("vault    : {0}   secret: SI-License" -f $vault)
|
|if (-not (Test-Path -LiteralPath $Path)) { throw "Licence file not found: $Path" }
|$text = [IO.File]::ReadAllText((Resolve-Path -LiteralPath $Path).Path).Trim()
|# Azure over native REST, no PowerShell module (#305), no az CLI (#521). An existing sign-in in this process (the guided
|# install, the licence request of the updater job) is reused; otherwise a person signs in here (Azure Cloud Shell, or the browser).
|if (-not (Get-Command -Name Get-SISetupAzureContext -ErrorAction SilentlyContinue)) { . ([IO.Path]::Combine($PSScriptRoot, '_shared', 'SI-SetupAzure.ps1')) }
|if (-not "$TenantId".Trim()) {
|    $azCtx = Get-SISetupAzureContext
|    if (-not $azCtx) { try { $azCtx = Connect-SISetupAzure } catch { Write-Warning ("not signed in to Azure: {0}" -f $_.Exception.Message) } }
|    if ($azCtx) { $TenantId = [string]$azCtx.Tenant.Id }
|}
|
|# ---- 1. verify BEFORE writing ----------------------------------------------------------------------
|$lic = Get-SILicense -SecretText $text
|$known = @(Get-SIFeatureCatalog | ForEach-Object { $_.Name })
|$check = Test-SILicenseForInstall -License $lic -KnownFeatures $known -TenantId $TenantId
|if (-not $check.Ok) {
|    $check.Problems | ForEach-Object { Write-Host "[ERROR] $_" -ForegroundColor Red }
|    throw 'The licence was NOT installed -- nothing was written. Contact Invardia support (support@invardia.com) with the lines above.'
|}
|Ok ("verified : {0}" -f $check.Summary)
|@($check.Notes) | Where-Object { $_ } | ForEach-Object { Write-Host "[INFO] $_" }
|if ($lic.Status -eq 'Grace')       { Write-Warning ("the licence is in its grace period: {0}" -f $lic.Reason) }
|if ($lic.Status -eq 'NotYetValid') { Write-Warning ("the licence is not active yet: {0}" -f $lic.Reason) }
|
|if (-not $PSCmdlet.ShouldProcess("$vault/SI-License", 'write the SecurityInsight Pro licence')) { return }
|
|# ---- 2. write ----------------------------------------------------------------------------------------
|if (-not (Get-SISetupAzureContext)) { $null = Connect-SISetupAzure -TenantId $TenantId }
|$sec = ConvertTo-SecureString -String $text -AsPlainText -Force
|$null = Set-SIAzKeyVaultSecret -VaultName $vault -Name 'SI-License' -SecretValue $sec -ContentType 'application/json' -ErrorAction Stop
|
|# ---- 3. read back and verify the STORED value ---------------------------------------------------------
|$back = Get-SIAzKeyVaultSecret -VaultName $vault -Name 'SI-License' -AsPlainText -ErrorAction Stop
|$again = Get-SILicense -SecretText $back
|$check2 = Test-SILicenseForInstall -License $again -KnownFeatures $known -TenantId $TenantId
|if (-not $check2.Ok -or "$back".Trim() -ne $text) { throw 'The stored licence did not read back identical and valid -- check the vault and re-run.' }
|Ok ("installed and read back: SecurityInsight Pro for {0}; {1}" -f $again.Customer, $again.Reason)
|Info 'Pro engines pick it up on their next run. Nothing else to do.'
|
|# ---- 4. the audit trail (#260): when this install has a Pro database, the install is recorded there -----------------
|# Never the licence content -- the customer, the edition, the dates and the vault. Best effort: the licence is installed
|# whether or not the row can be written (it says so).
|if ([string]$global:SI_ProSqlServer -and [string]$global:SI_ProSqlDatabase) {
|    try {
|        . (Join-Path $siRoot 'engine\pro-settings\SI-ProSettings.ps1')
|        $first = { param([object[]]$v) foreach ($x in $v) { if (-not [string]::IsNullOrWhiteSpace([string]$x)) { return [string]$x } }; '' }
|        $store = New-SIProSettingsStore -Server ([string]$global:SI_ProSqlServer) -Database ([string]$global:SI_ProSqlDatabase) `
|            -AppId (& $first @($global:SI_SPN_AppId)) -TenantId (& $first @($global:SI_SPN_TenantId, $TenantId)) `
|            -CertThumbprint (& $first @($global:SI_SPN_CertThumbprint))   # #524: no fallback to the retired platform globals
|        $okRow = Write-SIAuditEvent -Store $store -Action 'licence.licence.install' -Actor (Get-SIAuditActor) -ActorSource 'setup' -Target ("{0}/SI-License" -f $vault) `
|            -After ([ordered]@{ customer = [string]$again.Customer; status = [string]$again.Status; summary = [string]$check2.Summary })
|        if ($okRow) { Info 'recorded on the audit trail of the Pro database.' }
|    } catch { Write-Warning ("the licence is installed, but it could not be recorded on the audit trail: {0}" -f $_.Exception.Message) }
|}
|} finally { Stop-SIScriptRun -Run $siRun }
'@ }
$__siSupportFiles['setup/_shared/SI-ScriptRun.ps1'] = @{ Sha256 = 'a5c4d788d516521639611af43e1b88458216ce58bdb455885cac8e2a568afbd2'; Text = @'
|#Requires -Version 5.1
|<#
|    EVERY SCRIPT A PERSON RUNS (framework DOCS/REQUIREMENTS.md section 12.7 SCRIPT-DOC-1 + section 12.10 SECURITY-PACK-1; SI #481 / #484).
|    One helper, called first by each such script:
|
|      $siRun = Start-SIScriptRun -Script '<Script>'
|      try { ...the script... } finally { Stop-SIScriptRun -Run $siRun }
|
|    Start-SIScriptRun prints, as the script's FIRST line (SI #547, owner 2026-10-10: "do you provide the version in all
|    scripts, so i can troubleshoot better"):
|        <Script> version <version> - documentation: https://invardia.com/docs/si/scripts/<Script>/
|    (the page Invardia renders from the script's <Script>.doc.json). The transcript is started BEFORE that line is printed,
|    so the same line is also the first line of the transcript. The version (Get-SIScriptVersion), in this order:
|        1. the version stamped into a PUBLISHED copy: release\Build-SISupportScripts.ps1 rewrites the
|           $script:SIScriptVersionStamp line below in the copy of this file each self-contained script embeds;
|        2. the install / package / checkout this file sits in: BUILD.json (its display, e.g. 3.0.0-rc.12), else VERSION;
|        3. "unknown (not a released copy)".
|    It then says plainly when -WhatIf is on (nothing is changed). The transcript is a local file in ONE known folder:
|        Windows : %LOCALAPPDATA%\SecurityInsight\script-logs\<Script>-<yyyyMMdd-HHmmss>.log
|        others  : ~/.securityinsight/script-logs/<Script>-<yyyyMMdd-HHmmss>.log
|    Stop-SIScriptRun ends the transcript and prints its path. The transcript holds what the script printed -- the scripts
|    never print a secret value (section 12.10 "no secrets in, no secrets out"). A transcript that cannot be started (a host
|    without transcription, a read-only profile) is said and the script goes on: it never blocks the work.
|    The transcript and its folder are written even under -WhatIf (-WhatIf:$false): they are the record of what was
|    previewed, not a change to the customer's environment.
|    PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|# SI #547 -- the PUBLISH STAMP. Empty in the repository and the package; release\Build-SISupportScripts.ps1 writes the release
|# version here (Set-SIScriptVersionStamp) in the copy a self-contained script embeds. Keep this line's shape: the build
|# refuses to publish when it cannot find it.
|$script:SIScriptVersionStamp = '3.0.79'
|# the folder this helper lives in (setup\_shared) -- the solution root is two levels up
|$script:SIScriptRunHome = $PSScriptRoot
|
|function Get-SIScriptVersion {
|    <#
|        The version a person-run script reports. -Stamp (default: the publish stamp above) wins; else -SolutionRoot's
|        BUILD.json display / version, else its VERSION file; else 'unknown (not a released copy)'. Never throws.
|    #>
|    param([AllowEmptyString()][string]$Stamp = [string]$script:SIScriptVersionStamp, [AllowEmptyString()][string]$SolutionRoot = '')
|    if ("$Stamp".Trim()) { return "$Stamp".Trim() }
|    if (-not "$SolutionRoot".Trim() -and "$($script:SIScriptRunHome)".Trim()) {
|        try { $SolutionRoot = [IO.Path]::GetFullPath([IO.Path]::Combine([string]$script:SIScriptRunHome, '..', '..')) } catch { $SolutionRoot = '' }
|    }
|    if ("$SolutionRoot".Trim()) {
|        try {
|            # not [IO.Path]::Combine(..., 'BUILD.json'): the support-script builder embeds every data file a helper names that
|            # way, and a published copy must never carry the build machine's BUILD.json (its version comes from the stamp)
|            $bj = $SolutionRoot.TrimEnd('\', '/') + [IO.Path]::DirectorySeparatorChar + 'BUILD.json'
|            if ([IO.File]::Exists($bj)) {
|                $j = [IO.File]::ReadAllText($bj) | ConvertFrom-Json
|                if ("$($j.display)".Trim()) { return "$($j.display)".Trim() }
|                if ("$($j.version)".Trim()) { return "$($j.version)".Trim() }
|            }
|        } catch { }
|        try {
|            $vf = [IO.Path]::Combine($SolutionRoot, 'VERSION')
|            if ([IO.File]::Exists($vf)) { $v = ([IO.File]::ReadAllText($vf)).Trim(); if ($v) { return $v } }
|        } catch { }
|    }
|    'unknown (not a released copy)'
|}
|
|function Get-SIScriptFirstLine {
|    <# PURE. The first line of every person-run script: "<Script> version <v> - documentation: <link>". #>
|    param([Parameter(Mandatory)][string]$Script, [Parameter(Mandatory)][string]$Version)
|    $n = [IO.Path]::GetFileNameWithoutExtension($Script.Trim())
|    '{0} version {1} - documentation: {2}' -f $n, $Version, (Get-SIScriptDocUrl -Script $n)
|}
|
|function Get-SIScriptDocUrl {
|    <# PURE. The documentation page of a script (no .ps1, trailing slash -- confirmed by Invardia 2026-10-09). #>
|    param([Parameter(Mandatory)][string]$Script)
|    $n = ([IO.Path]::GetFileNameWithoutExtension($Script.Trim()))
|    'https://invardia.com/docs/si/scripts/{0}/' -f $n
|}
|
|function Get-SIScriptLogFolder {
|    <# PURE apart from reading the environment. The one known folder every script's transcript goes to. #>
|    if ($env:SI_SCRIPT_LOG_DIR) { return [string]$env:SI_SCRIPT_LOG_DIR }
|    if ($env:LOCALAPPDATA) { return [IO.Path]::Combine($env:LOCALAPPDATA, 'SecurityInsight', 'script-logs') }
|    $h = $HOME; if (-not $h) { $h = [Environment]::GetFolderPath('UserProfile') }
|    [IO.Path]::Combine($h, '.securityinsight', 'script-logs')
|}
|
|function Start-SIScriptRun {
|    <#
|        The first thing a script does. Returns the run (pass it to Stop-SIScriptRun). -WhatIf comes from the caller's
|        $WhatIfPreference; -Quiet (tests) prints nothing and starts no transcript.
|    #>
|    param([Parameter(Mandatory)][string]$Script, [switch]$Quiet, [bool]$WhatIfOn = [bool]$WhatIfPreference)
|    if ($env:SI_SCRIPT_RUN_QUIET -eq '1') { $Quiet = [switch]$true }      # tests: no banner, no transcript
|    $name = [IO.Path]::GetFileNameWithoutExtension($Script.Trim())
|    $ver = Get-SIScriptVersion
|    $run = [pscustomobject]@{ Script = $name; DocUrl = (Get-SIScriptDocUrl -Script $name); Version = $ver; FirstLine = (Get-SIScriptFirstLine -Script $name -Version $ver)
|                              Transcript = ''; Started = $false; WhatIf = $WhatIfOn; Quiet = [bool]$Quiet }
|    if ($Quiet) { return $run }
|    # the transcript FIRST (silently), so the version line below is the first line of the console AND of the transcript
|    $noTranscript = ''
|    try {
|        $dir = Get-SIScriptLogFolder
|        if (-not [IO.Directory]::Exists($dir)) { [void][IO.Directory]::CreateDirectory($dir) }
|        $path = [IO.Path]::Combine($dir, ('{0}-{1:yyyyMMdd-HHmmss}.log' -f $name, [datetime]::Now))
|        $null = Start-Transcript -LiteralPath $path -WhatIf:$false -ErrorAction Stop
|        $run.Transcript = $path; $run.Started = $true
|    } catch {
|        $noTranscript = $_.Exception.Message
|    }
|    Write-Host $run.FirstLine
|    if ($noTranscript) { Write-Host ('(no transcript of this run: {0})' -f $noTranscript) -ForegroundColor DarkGray }
|    if ($WhatIfOn) { Write-Host '-WhatIf: this run only reads and shows what it would change -- nothing is changed.' -ForegroundColor Yellow }
|    $run
|}
|
|function Stop-SIScriptRun {
|    <# The last thing a script does (in its finally block): ends the transcript and prints where it is. #>
|    param($Run)
|    if ($null -eq $Run -or $Run.Quiet) { return }
|    if ($Run.Started) {
|        try { $null = Stop-Transcript -ErrorAction Stop } catch { }
|        Write-Host ('Transcript of this run: {0}' -f $Run.Transcript)
|    }
|}
'@ }
$__siSupportFiles['auth/Get-SIVaultName.ps1'] = @{ Sha256 = 'ebb0663efe664c2aa019929e268a8c6d5ec287211ac9e0a35a1b82f7d95422c8'; Text = @'
|#Requires -Version 5.1
|<#
|    SI -- ONE KEY VAULT, RESOLVED IN ONE PLACE.
|
|    🔒 Operator, 2026-08-31: *"use the keyvault for the SI instance, so it is captured into one SI
|    keyvault."*
|
|    🔴 THE PROBLEM THIS FIXES IS THAT SI ALREADY NAMED ITS VAULT THREE WAYS, and each caller picked
|    one:
|      $global:SI_KeyVaultName        written by the Config Wizard (Write-SICustomConfig.ps1)
|      $global:SpnKeyVaultName        the name the config reference shows (Connect-SIAzCli read it; deleted)
|      $env:SI_DIAGNOSTICS_VAULT      the diagnostics scripts' own resolution
|    A customer who set one and not the others got a component that could not find the vault -- and the
|    failure surfaces as "no credential", which reads like a permissions problem and is not. Three
|    spellings of one fact is the same defect class as `EgNodeId`/`ExposureGraphNodeId`, which cost a
|    silent correlation split.
|
|    ✅ SO: every SI component resolves the vault through HERE, in a fixed order, and any one of the
|    three globals being set is enough. Nothing is renamed and no existing install breaks -- the
|    resolution simply stops depending on which name the customer happened to use.
|
|    ⛔ NO DEFAULT, EVER. There is no sensible fallback vault name: guessing one would send a secret
|    read at some other customer's vault, or at an internal one. Unresolved is an error with a message
|    that says what to set.
|
|    NO Set-StrictMode here -- it leaks into the caller's scope (measured 2026-08-12).
|#>
|
|function Get-SIVaultName {
|    <#
|        The SI Key Vault for this install.
|
|          -VaultName  an explicit override, which always wins (a CLI parameter, a test)
|
|        Order after that: SI_KeyVaultName -> SpnKeyVaultName -> SI_DIAGNOSTICS_VAULT env ->
|        SI_DiagnosticsVaultName. The diagnostics names come LAST on purpose: they exist so a
|        developer's sandbox vault is reachable, and they must never take precedence over a customer's
|        configured vault on a real run.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter()][string]$VaultName,
|        # Return $null instead of throwing. For callers that treat "no vault" as a supported state --
|        # the CMDB connector's plan-only path needs no secrets at all.
|        [Parameter()][switch]$AllowMissing
|    )
|
|    if (-not [string]::IsNullOrWhiteSpace($VaultName))                       { return $VaultName.Trim() }
|    if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_KeyVaultName))  { return ([string]$global:SI_KeyVaultName).Trim() }
|    if (-not [string]::IsNullOrWhiteSpace([string]$global:SpnKeyVaultName))  { return ([string]$global:SpnKeyVaultName).Trim() }
|    if (-not [string]::IsNullOrWhiteSpace([string]$env:SI_DIAGNOSTICS_VAULT)){ return ([string]$env:SI_DIAGNOSTICS_VAULT).Trim() }
|    if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_DiagnosticsVaultName)) { return ([string]$global:SI_DiagnosticsVaultName).Trim() }
|
|    if ($AllowMissing) { return $null }
|    throw ('SI: no Key Vault is configured. Set $global:SI_KeyVaultName in config\SecurityInsight.custom.ps1 ' +
|           '(the Config Wizard writes it for you). $global:SpnKeyVaultName is also accepted for installs ' +
|           'that predate that name. The vault holds the SPN secret and any integration credentials, and ' +
|           'there is deliberately no default -- guessing a vault name would send a secret read somewhere ' +
|           'it does not belong.')
|}
|
|# ---------------------------------------------------------------------------------------------------
|# THE SERVICENOW SECRET NAMES, in one place so the connector and the diagnostics cannot drift.
|#
|# 🔑 CANONICAL NAMES FIRST, LEGACY SECOND. The diagnostics scripts seeded `servicenow-pdi-*` while the
|# connector was being proven against a developer instance. Those keep working -- an operator should not
|# have to re-seed a vault to pick up a rename -- but a new install gets the `SI-ServiceNow-*` names,
|# which say which SOLUTION owns them in a vault that may hold secrets for several.
|# ---------------------------------------------------------------------------------------------------
|$script:SIServiceNowSecretNames = [ordered]@{
|    Instance = @('SI-ServiceNow-Instance', 'servicenow-pdi-instance')
|    User     = @('SI-ServiceNow-User',     'servicenow-pdi-user')
|    Password = @('SI-ServiceNow-Password', 'servicenow-pdi-password')
|}
|
|function Get-SIServiceNowSecretName {
|    <# The candidate secret names for one part, canonical first. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][ValidateSet('Instance','User','Password')][string]$Part)
|    @($script:SIServiceNowSecretNames[$Part])
|}
|
|function Get-SIServiceNowCredentialFromVault {
|    <#
|        The ServiceNow instance URL and integration credential, from the ONE SI vault.
|
|        Returns @{ Instance; Credential; InstanceSecretName } or $null when the vault holds none of
|        them -- which is a supported state for a plan-only run and must not throw there.
|
|        🪤 A PARTIAL SET IS AN ERROR, NOT A DEGRADED SUCCESS. An instance URL with no credential would
|        build a connection that fails on the first call with a 401, which reads like a permissions
|        problem at the customer's end. Say which secret is missing instead.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter()][string]$VaultName,
|        # Injectable so this is testable without a vault. Takes (vault, secretName), returns the value
|        # or $null.
|        [Parameter()][scriptblock]$Reader
|    )
|
|    $vault = Get-SIVaultName -VaultName $VaultName -AllowMissing
|    if ([string]::IsNullOrWhiteSpace($vault)) { return $null }
|
|    if (-not $Reader) {
|        $Reader = {
|            param($v, $n)
|            try { Get-SIKvSecret -VaultName $v -SecretName $n } catch { $null }
|        }
|    }
|
|    $found = @{}
|    foreach ($part in @('Instance','User','Password')) {
|        foreach ($name in (Get-SIServiceNowSecretName -Part $part)) {
|            $val = & $Reader $vault $name
|            if (-not [string]::IsNullOrWhiteSpace([string]$val)) {
|                $found[$part] = [string]$val
|                if ($part -eq 'Instance') { $found['InstanceSecretName'] = $name }
|                break
|            }
|        }
|    }
|
|    if ($found.Count -eq 0) { return $null }
|
|    $missing = @()
|    foreach ($part in @('Instance','User','Password')) { if (-not $found.ContainsKey($part)) { $missing += $part } }
|    if ($missing.Count -gt 0) {
|        throw ("SI: the ServiceNow credential in Key Vault '{0}' is INCOMPLETE -- missing {1}. Expected {2}. " -f `
|                $vault, ($missing -join ', '),
|                (@('Instance','User','Password') | ForEach-Object { (Get-SIServiceNowSecretName -Part $_)[0] }) -join ' / ') +
|              'A partial set would build a connection that fails on the first call with a 401, which reads like a permissions problem at the customer end.'
|    }
|
|    $sec = New-Object System.Security.SecureString
|    foreach ($ch in ([string]$found['Password']).ToCharArray()) { $sec.AppendChar($ch) }
|    $sec.MakeReadOnly()
|
|    [pscustomobject]@{
|        Instance           = [string]$found['Instance']
|        Credential         = (New-Object System.Management.Automation.PSCredential([string]$found['User'], $sec))
|        InstanceSecretName = [string]$found['InstanceSecretName']
|        VaultName          = $vault
|    }
|}
'@ }
$__siSupportFiles['engine/SI-FeatureCatalog.ps1'] = @{ Sha256 = '1313bf7e4404e75c99a4fb424b68453af1d0f95327314b438742b0dd7050d13a'; Text = @'
|#Requires -Version 5.1
|<#
|.SYNOPSIS
|    LIC-1 -- SecurityInsight's feature catalog and the one gate its engines call.
|
|.DESCRIPTION
|    The licence FORMAT, signature and validity rules are FRAMEWORK-level (sync/_AitLicense.ps1 -- one
|    implementation, every solution). This file owns only the half that is genuinely SecurityInsight's:
|    WHICH FEATURES ARE PAID, where an install's licence comes from, and what a refused feature does.
|
|    🔒 THE RULE THIS FILE EXISTS TO ENFORCE (operator, 2026-09-08):
|        "license is only needed if not free" / "so license req is not for all a req"
|    A FREE feature never touches the licence path at all -- Test-SIFeatureAvailable returns for a free
|    feature BEFORE any licence is loaded, so a missing, expired, corrupt or wrong-tenant licence cannot
|    affect anything free. Community users hold no licence and must never be able to notice licensing.
|
|    🔒 v3 EDITIONS (operator rulings 2026-09-29, SI #159):
|      * Pro = the ServiceNow connector, the CMDB in SQL and its connectors, governance (departments, governance mails,
|        the task digest). Everything else is the Community edition: profilers, tier classifier, cross-engine
|        correlation and the full asset properties (owner 2026-10-27, #750 (1)), every Risk Analysis report, the AI
|        summary, trend, all outputs, the generic CSV CMDB, VM and container hosting, Shodan, asset tagging (#750 (2)),
|        verification and data health (#750 (8)).
|      * ENFORCED from v3 launch -- SI Pro is PAID. This replaces the 2026-09-08 ship-OFF default on
|        purpose. There is deliberately no customer switch: the only config an install has is the
|        customer's own, and a switch there would be a free Pro edition. (-Enforce stays for tests.)
|      * THE DATABASE AND THE WEB APP ARE IN BOTH VERSIONS (owner 2026-10-18, #750 (a); #477, #480, #678): the settings
|        database ('settings-database') and the data backend ('data-backend' -- the data sync, the Risk Analysis store, the
|        CIs in SQL) are no longer paid. They are not in the catalog any more, so they are free by the rule below (their
|        call sites keep their gate call: a no-op for a free feature). The paid features of the database chain are named
|        instead: 'governance' (departments, governance mails, the task digest) and 'cmdb-connectors' (the CMDB in SQL).
|      * Delivered as the Key Vault secret 'SI-License' (the signed file as JSON or base64), read at runtime
|        on VM and container alike; a licence file in config\ is the fallback.
|
|    🔑 TWO GATES, DIFFERENT QUESTIONS (LIC-3). ring = WHEN a version reaches you; licence = WHETHER you may
|    run a feature. And a CAPABILITY is not a FEATURE: capabilities in solution.deploy.json are ring-gated
|    INSTALL units; features here are licence-gated BEHAVIOUR. A required capability may never be Pro.
|
|    🔑 THE VERIFIER IS LOADED FROM SI's OWN COPY (engine/_shared/AitLicense.ps1, byte-identical to
|    sync/_AitLicense.ps1 -- a test fails on drift). sync/ is not in a container image or the public mirror,
|    so the previous "search upward for sync/" found nothing there and would have refused every Pro feature.
|
|    🔒 THE EDITION DECIDES, NOT features[] (framework §12.6a LICENCE-FEATURES, SI #510; owner 2026-10-09: "but does that
|    mean we have to sign licenses when new features are released, that is not smart"). The signed licence names the
|    EDITION in its `sku`; THIS file maps edition -> features:
|      * a Pro edition (sku Pro / Pro-Business / Pro-DesignPartner / Trial / any Pro-*) = EVERY catalog entry with
|        Edition 'Pro', current and future -- a Pro licence issued before a feature existed already covers it;
|      * an MSP edition (sku naming MSP) = the Pro features + the entries with Edition 'MSP' (multi-tenant; none today);
|      * Pro Business vs Pro Enterprise differ by the signed `limits`, never by features;
|      * features[] is informational, and counts ONLY for an entry marked AddOn = $true (an explicit paid add-on, which
|        needs its own id in features[]; '*' does not cover an add-on). There are NO add-ons today.
|    A licence that is not valid / in grace, not bound to this tenant, or whose sku names no Pro edition (Community,
|    Core, empty) gives Community. The shared verifier (AitLicense.ps1) is unchanged: SI asks it for the status and the
|    tenant binding, and applies the edition rule here, at its own call site.
|
|    🔴 ABSENCE IS NOT REMEDIATION (working rule 4). A refused Pro engine SKIPS and says why; it never
|    publishes an empty result, and no close path acts on the absence of its output.
|#>
|
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '_shared/SI-AzRest.ps1') }
|
|Set-StrictMode -Off
|
|# ---------------------------------------------------------------------------
|# THE CATALOG. Everything not listed here is FREE -- the default is free, so a
|# feature can never become paid by omission or typo, only by a deliberate entry.
|#
|# 🪤 NAME THE CONNECTOR PRECISELY. SI's INBOUND CSV provider was called
|# `servicenow-cmdb` until v2.2.421, it is FREE, and ~510 report references depend on
|# it. A loosely worded "ServiceNow = Pro" would gate the free CSV importer.
|#
|# Edition = 'Pro' (every Pro edition has it) | 'MSP' (multi-tenant; the MSP edition only).
|# AddOn   = $true only for an explicit paid add-on that the licence must LIST in features[] (#510). None today.
|# ---------------------------------------------------------------------------
|$script:SIFeatureCatalog = @(
|    [pscustomobject]@{
|        Name        = 'servicenow-connector'
|        Edition     = 'Pro'
|        Built       = $true
|        Title       = 'The ServiceNow CMDB connector'   # short name for the one-line skip message customers see
|        Description = 'ServiceNow CMDB connector (match and create CIs, vulnerability close-loop). Distinct from the free inbound CMDB CSV import.'
|    }
|    # 'correlation' (cross-engine correlation and the full asset properties) is NOT here any more: it is in the Community
|    # edition (owner 2026-10-27, SI #750 (1) / #678 -- "data in, data correlation, ra + data out to excel are part of
|    # community"). Unknown = free, so every call site that still names it runs in both editions.
|    [pscustomobject]@{
|        Name        = 'governance'
|        Edition     = 'Pro'
|        Built       = $true
|        Title       = 'Departments, governance and follow-up tasks'
|        Description = 'Asset responsibility put to work: the department reports, the governance mails (exemptions, remediation flows, vendor escalation) and the daily task digest.'
|    }
|    [pscustomobject]@{
|        Name        = 'cmdb-connectors'
|        Edition     = 'Pro'
|        Built       = $true
|        Title       = 'The CMDB in SQL and its connectors'
|        Description = 'The CMDB kept in the SecurityInsight database: the SQL CMDB connector and the CMDB import. Distinct from the free inbound CMDB CSV file.'
|    }
|)
|
|function Get-SIFeatureCatalog {
|    <# .SYNOPSIS Every PAID feature SI knows about. Everything else is free by default. #>
|    [CmdletBinding()] param()
|    return @($script:SIFeatureCatalog)
|}
|
|function Test-SIFeatureIsPaid {
|    <#
|    .SYNOPSIS
|        PURE. Is this feature paid? Unknown names are FREE.
|    .DESCRIPTION
|        🔒 UNKNOWN => FREE, deliberately. Guessing the other way means a typo in a call site silently
|        gates a shipped free feature for every customer at once. A typo in a PAID call site costs an
|        ungated paid feature -- recoverable, and the wiring tests name every paid call site.
|    #>
|    [CmdletBinding()] param([Parameter(Mandatory)][string]$Feature)
|    foreach ($f in $script:SIFeatureCatalog) {
|        if ("$($f.Name)" -ieq "$Feature".Trim()) { return ("$($f.Edition)" -in @('Pro', 'MSP')) }
|    }
|    return $false
|}
|
|function Get-SILicenceEdition {
|    <#
|    .SYNOPSIS
|        PURE. The EDITION a licence's signed sku names: 'MSP' | 'Pro' | 'Community' (framework §12.6a, SI #510).
|    .DESCRIPTION
|        Reads only the sku -- not the status, the tenant or features[] (Test-SIFeatureAvailable checks those).
|        Pro = a sku that starts with 'Pro' or 'Trial' as a word: Pro, Pro-Business, Pro Enterprise, Pro-DesignPartner,
|        pro-single-tenant, Trial. MSP = a sku naming 'msp' as a word (Pro-MSP, pro-msp). Anything else -- Community,
|        the verifier's 'Core' for no licence, an empty sku -- is Community.
|    #>
|    param([AllowNull()]$License)
|    if ($null -eq $License) { return 'Community' }
|    $sku = "$($License.Sku)".Trim()
|    if ($sku -match '(?i)(^|[^a-z])msp([^a-z]|$)') { return 'MSP' }
|    if ($sku -match '(?i)^(pro|trial)([^a-z]|$)') { return 'Pro' }
|    return 'Community'
|}
|
|function Test-SILicenceCoversFeature {
|    <#
|    .SYNOPSIS
|        PURE. Does a licence that is ALREADY valid/grace and bound to this tenant cover this paid catalog entry?
|        Returns @{ Allowed; Reason }. The edition decides; features[] only for an add-on (#510).
|    #>
|    param([AllowNull()]$License, [Parameter(Mandatory)][object]$Entry)
|    $name = "$($Entry.Name)"
|    if ([bool]$Entry.AddOn) {
|        foreach ($f in @($License.Features | Where-Object { $_ })) {
|            if ("$f".Trim() -ieq $name) { return [pscustomobject]@{ Allowed = $true; Reason = "the licence lists the add-on '$name'" } }
|        }
|        return [pscustomobject]@{ Allowed = $false; Reason = "'$name' is an add-on and the licence does not list it" }
|    }
|    $ed = Get-SILicenceEdition -License $License
|    $need = if ("$($Entry.Edition)" -ieq 'MSP') { 'MSP' } else { 'Pro' }
|    if ($ed -eq 'MSP' -or ($need -eq 'Pro' -and $ed -eq 'Pro')) {
|        return [pscustomobject]@{ Allowed = $true; Reason = "the $ed edition covers '$name'" }
|    }
|    $skuText = "$($License.Sku)".Trim(); if (-not $skuText) { $skuText = 'none' }
|    if ($need -eq 'MSP' -and $ed -eq 'Pro') { return [pscustomobject]@{ Allowed = $false; Reason = "'$name' is part of the MSP edition; this licence is $skuText" } }
|    return [pscustomobject]@{ Allowed = $false; Reason = "the licence names no SecurityInsight Pro edition (sku $skuText)" }
|}
|
|function Get-SIFrameworkLicensePath {
|    <#
|    .SYNOPSIS
|        The framework licence verifier for this install: SI's own copy first, then sync/ upward.
|    .DESCRIPTION
|        Returns $null when neither exists rather than throwing -- a free feature must still run.
|    #>
|    [CmdletBinding()] param([string]$StartPath)
|    $own = [IO.Path]::Combine($PSScriptRoot, '_shared', 'AitLicense.ps1')
|    if (-not "$StartPath".Trim() -and (Test-Path -LiteralPath $own)) { return $own }
|    $p = if ("$StartPath".Trim()) { $StartPath } elseif ($PSScriptRoot) { $PSScriptRoot } else { (Get-Location).Path }
|    for ($i = 0; $i -lt 6; $i++) {
|        # [IO.Path]::Combine, not Join-Path: Join-Path throws on a missing drive.
|        $cand = [IO.Path]::Combine($p, 'sync', '_AitLicense.ps1')
|        if (Test-Path -LiteralPath $cand) { return $cand }
|        $parent = Split-Path -Parent $p
|        if (-not $parent -or $parent -eq $p) { break }
|        $p = $parent
|    }
|    return $null
|}
|
|function ConvertFrom-SILicenseText {
|    <# The secret holds the licence file as raw JSON or base64 of it. Returns the parsed document or $null. #>
|    param([AllowNull()][string]$Text)
|    if ([string]::IsNullOrWhiteSpace($Text)) { return $null }
|    $t = $Text.Trim()
|    if (-not $t.StartsWith('{')) {
|        try { $t = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($t)).Trim() } catch { return $null }
|    }
|    try { return ($t | ConvertFrom-Json -ErrorAction Stop) } catch { return $null }
|}
|
|function Get-SILicenseSecretText {
|    <# The SI-License secret, without the customer having to edit their config. Never throws. #>
|    if ($global:SI_License) { return [string]$global:SI_License }
|    # an internal install: the platform Key Vault (signed in by SecurityInsight itself -- auth/SI-PlatformConnect.ps1)
|    if ($global:Context -and $global:KV_HighPriv_KeyVaultName) {
|        try {
|            if (-not (Get-Command -Name Get-SIPlatformSecret -ErrorAction SilentlyContinue)) { . ([IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'auth', 'SI-PlatformConnect.ps1')) }
|            return [string](Get-SIPlatformSecret -Context $global:Context -Name 'SI-License' -AsPlainText -ErrorAction Stop)
|        } catch { }
|    }
|    # The vault is resolved the way every other SI component resolves it (#173): SI_KeyVaultName, then the
|    # 2.2.x name SpnKeyVaultName, ... -- an upgraded install carrying only the older name was otherwise
|    # "unlicensed" while its licence sat in the vault it already uses for its SPN secret.
|    if (-not (Get-Command -Name Get-SIVaultName -ErrorAction SilentlyContinue)) {
|        $vaultHelper = [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'auth', 'Get-SIVaultName.ps1')
|        if (Test-Path -LiteralPath $vaultHelper) { . $vaultHelper }
|    }
|    $vault = $null
|    if (Get-Command -Name Get-SIVaultName -ErrorAction SilentlyContinue) { try { $vault = Get-SIVaultName -AllowMissing } catch { } }
|    elseif ($global:SI_KeyVaultName) { $vault = [string]$global:SI_KeyVaultName }
|    if ($vault) {
|        if (-not (Get-Command -Name Get-SIKvSecret -ErrorAction SilentlyContinue)) {
|            $kvHelper = [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'auth', 'Get-SIKvSecret.ps1')
|            if (Test-Path -LiteralPath $kvHelper) { . $kvHelper }
|        }
|        if (Get-Command -Name Get-SIKvSecret -ErrorAction SilentlyContinue) {
|            try { return [string](Get-SIKvSecret -VaultName $vault -SecretName 'SI-License') } catch { }
|        }
|    }
|    return $null
|}
|
|# Load the framework verifier ONCE, at file scope, so its functions outlive any one call. (Dot-sourcing it
|# inside a function defines them in that function's scope, and they vanish when it returns.) Loading the
|# verifier's CODE is not consulting a licence: a free feature still never reads one.
|$script:SIFrameworkLicensePath = Get-SIFrameworkLicensePath
|if ($script:SIFrameworkLicensePath) { . $script:SIFrameworkLicensePath }
|
|$script:SILicenseCache  = $null
|$script:SILicenseWarned = @{}
|
|# Framework LICENCE-DIMENSION (owner 2026-10-08): Pro has two dimensions, decided by the SIGNED licence -- Pro Business =
|# the payload carries a `limits` object (SecurityInsight reads `devices`), Pro Enterprise = no `limits`. Community has no
|# limits. A limit is a WARNING, never a stop: nothing here gates a feature or a run (the web app shows the banner).
|function ConvertTo-SILicenceLimits {
|    <#
|        PURE. The payload's `limits` value -> an ordered map name (lower-case) -> whole number, or $null when it is not an
|        object (absent / null / text / a number = no limits = Pro Enterprise). A value that is not a whole number is dropped,
|        never guessed; an empty object stays an empty map (the licence IS Business, without a SecurityInsight limit).
|    #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or $Value -isnot [System.Management.Automation.PSCustomObject]) { return $null }
|    $m = [ordered]@{}
|    foreach ($p in $Value.PSObject.Properties) {
|        $v = $p.Value
|        if (($v -is [int] -or $v -is [long]) -and $v -ge 0 -and $v -le [int]::MaxValue) { $m[$p.Name.ToLowerInvariant()] = [int]$v }
|    }
|    return $m
|}
|
|function Get-SILicenceLimitsOf {
|    <#
|        The limits of a VERIFIED licence, read ONLY from its signed payload bytes (payloadB64): a `limits` on the outer
|        document is not signed and is never read. $null for a licence that did not verify, or that names no limits.
|    #>
|    param([AllowNull()]$Document, [AllowNull()]$License)
|    if ($null -eq $Document -or $null -eq $License) { return $null }
|    if ("$($License.Status)" -notin @('Valid', 'Grace', 'NotYetValid', 'Expired')) { return $null }
|    try {
|        $p = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("$($Document.payloadB64)")) | ConvertFrom-Json -ErrorAction Stop
|        if ("$($p.licenseId)" -ne "$($License.LicenseId)") { return $null }
|        if ($p.PSObject.Properties.Name -contains 'limits') { return (ConvertTo-SILicenceLimits -Value $p.limits) }
|    } catch { }
|    return $null
|}
|
|function Get-SILicenceDimension {
|    <# PURE. 'Pro Business' | 'Pro Enterprise' | 'Community' for a licence: Pro while it is valid or in grace. #>
|    param([AllowNull()]$License)
|    if ($null -eq $License -or "$($License.Status)" -notin @('Valid', 'Grace')) { return 'Community' }
|    if ((Get-SILicenceEdition -License $License) -eq 'Community') { return 'Community' }   # #510: the sku names the edition
|    if ($License.PSObject.Properties['Limits'] -and $null -ne $License.Limits) { return 'Pro Business' }
|    return 'Pro Enterprise'
|}
|
|function Get-SILicense {
|    <#
|    .SYNOPSIS
|        This install's licence status (cached per process): Key Vault secret first, then config\.
|        Always a status object (Missing / Invalid / NotYetValid / Valid / Grace / Expired), never a throw.
|    #>
|    [CmdletBinding()]
|    param(
|        [AllowNull()][string]$SecretText,          # tests inject; absent = read the real sources
|        [AllowNull()][string]$LicenseDirectory,    # tests inject; absent = the solution's config\
|        [AllowNull()][string[]]$TrustedCertsB64,   # tests inject a throwaway signer
|        [AllowNull()][object]$Now,
|        [switch]$Refresh
|    )
|    $injected = $PSBoundParameters.ContainsKey('SecretText') -or $PSBoundParameters.ContainsKey('LicenseDirectory') -or
|                $PSBoundParameters.ContainsKey('TrustedCertsB64') -or $PSBoundParameters.ContainsKey('Now')
|    if ($script:SILicenseCache -and -not $Refresh -and -not $injected) { return $script:SILicenseCache }
|
|    if (-not (Get-Command -Name Resolve-AitLicenseStatus -ErrorAction SilentlyContinue)) {
|        return [pscustomobject]@{ Status = 'Missing'; Reason = 'the framework licence verifier is not installed'; Customer = ''; Features = @(); TenantIds = @(); Source = 'none'; Limits = $null }
|    }
|
|    $text = if ($PSBoundParameters.ContainsKey('SecretText')) { $SecretText } else { Get-SILicenseSecretText }
|    if (-not [string]::IsNullOrWhiteSpace($text)) {
|        $doc = ConvertFrom-SILicenseText -Text $text
|        $lic = Resolve-AitLicenseStatus -Document $doc -TrustedCertsB64 $TrustedCertsB64 -Now $Now
|        if ($null -eq $doc) { $lic.Status = 'Invalid'; $lic.Reason = 'the SI-License secret is neither licence JSON nor base64 of it' }
|        Add-Member -InputObject $lic -NotePropertyName Source -NotePropertyValue 'Key Vault secret SI-License' -Force
|        Add-Member -InputObject $lic -NotePropertyName Limits -NotePropertyValue (Get-SILicenceLimitsOf -Document $doc -License $lic) -Force
|    } else {
|        $dir = if ("$LicenseDirectory".Trim()) { $LicenseDirectory } else { [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'config') }
|        $lic = Get-AitLicense -Directory $dir -TrustedCertsB64 $TrustedCertsB64 -Now $Now
|        Add-Member -InputObject $lic -NotePropertyName Source -NotePropertyValue $(if ($lic.Path) { "file $($lic.Path)" } else { 'none' }) -Force
|        # the file is read again for its limits -- and verified again, so a file swapped in between gives none
|        $limits = $null
|        if ($lic.Path) {
|            try {
|                $fdoc = Get-Content -LiteralPath $lic.Path -Raw -Encoding UTF8 | ConvertFrom-Json -ErrorAction Stop
|                $again = Resolve-AitLicenseStatus -Document $fdoc -TrustedCertsB64 $TrustedCertsB64 -Now $Now
|                if ($again.Status -eq $lic.Status) { $limits = Get-SILicenceLimitsOf -Document $fdoc -License $again }
|            } catch { $limits = $null }
|        }
|        Add-Member -InputObject $lic -NotePropertyName Limits -NotePropertyValue $limits -Force
|    }
|    if (-not $injected) { $script:SILicenseCache = $lic }
|    return $lic
|}
|
|function Get-SIRunTenantId {
|    # #232 (operator: "validate license against the tenant so license can not be copied to other tenants" -- "must also
|    # work if customer use spn"). A MANAGED IDENTITY's token always comes from its home tenant, so the tenant is the
|    # 'tid' of the identity's own token (recorded by Get-SIManagedIdentityToken), never a configured value the customer
|    # controls. Unprovable = a value no licence names, so a tenant-bound licence fails CLOSED.
|    # An SPN's token is issued by the configured tenant, so for an SPN the configured tenant IS where the engine runs.
|    if ([bool]$global:SI_UseManagedIdentity) {
|        if (-not $global:SI_IdentityTokenTenantId -and (Get-Command -Name Get-SIManagedIdentityToken -ErrorAction SilentlyContinue)) {
|            try { $null = Get-SIManagedIdentityToken -Resource 'https://management.azure.com/' } catch { }
|        }
|        if ($global:SI_IdentityTokenTenantId) { return [string]$global:SI_IdentityTokenTenantId }
|        return 'unproven-managed-identity-tenant'
|    }
|    $t = @($global:SI_SPN_TenantId, $global:AzureTenantId, $global:TenantId) | Where-Object { $_ } | Select-Object -First 1
|    if (-not $t) { try { $t = [string](Get-SIAzContext -ErrorAction Stop).Tenant.Id } catch { } }
|    return [string]$t
|}
|
|function Test-SIFeatureAvailable {
|    <#
|    .SYNOPSIS
|        THE call-site gate. May this feature run? Returns @{ Allowed; Edition; Reason }.
|    .DESCRIPTION
|        🔒 ORDER IS THE CONTRACT, and it is asserted in tests:
|          1. FREE feature          -> allowed IMMEDIATELY. No licence is loaded, looked for, or consulted.
|          2. paid, -Enforce $false -> allowed (TESTS ONLY -- production has no such switch).
|          3. paid                  -> the framework verifier gives the status and the tenant binding (valid or
|                                      grace, bound to this tenant); then the EDITION the sku names decides
|                                      (§12.6a, #510): a Pro edition runs every Pro entry, current and future,
|                                      whatever features[] says. features[] counts only for an AddOn entry.
|        Grace runs, with one warning per feature per process.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$Feature,
|        [Parameter()][AllowNull()][string]$TenantId,
|        [Parameter()][AllowNull()][string]$LicenseDirectory,
|        [Parameter()][AllowNull()][object]$License,
|        [Parameter()][AllowNull()][object]$Enforce
|    )
|
|    # 1. FREE -- return before anything licence-shaped happens.
|    if (-not (Test-SIFeatureIsPaid -Feature $Feature)) {
|        return [pscustomobject]@{ Allowed = $true; Edition = 'Free'; Reason = "'$Feature' is a free feature -- no licence is required or consulted" }
|    }
|    if ($null -ne $Enforce -and -not [bool]$Enforce) {
|        return [pscustomobject]@{ Allowed = $true; Edition = 'Pro'; Reason = "enforcement is OFF for this call -- '$Feature' runs unlicensed" }
|    }
|
|    if ($null -eq $License) {
|        $License = if ("$LicenseDirectory".Trim()) { Get-SILicense -LicenseDirectory $LicenseDirectory -SecretText '' } else { Get-SILicense }
|    }
|    if (-not (Get-Command -Name Test-AitLicenseTenant -ErrorAction SilentlyContinue)) {
|        return [pscustomobject]@{ Allowed = $false; Edition = 'Pro'; Reason = "the framework licence verifier is not installed -- cannot establish entitlement for '$Feature'" }
|    }
|    if (-not "$TenantId".Trim()) { $TenantId = Get-SIRunTenantId }
|    # the verifier's status + tenant binding, then the edition (never features[] for an edition feature -- #510)
|    if ($null -eq $License -or "$($License.Status)" -notin @('Valid', 'Grace')) {
|        $st = if ($License) { "$($License.Status)" } else { 'Missing' }
|        $res = [pscustomobject]@{ Allowed = $false; Reason = "no entitlement: licence status is $st" }
|    } elseif (-not (Test-AitLicenseTenant -License $License -TenantId $TenantId)) {
|        $res = [pscustomobject]@{ Allowed = $false; Reason = "licence '$($License.Customer)' is not valid for tenant $TenantId" }
|    } else {
|        $entry = $script:SIFeatureCatalog | Where-Object { "$($_.Name)" -ieq "$Feature".Trim() } | Select-Object -First 1
|        $res = Test-SILicenceCoversFeature -License $License -Entry $entry
|    }
|    if ($res.Allowed -and "$($License.Status)" -eq 'Grace' -and -not $script:SILicenseWarned[$Feature]) {
|        $script:SILicenseWarned[$Feature] = $true
|        Write-Warning ("Your SecurityInsight Pro licence {0}. '{1}' keeps running until the grace period ends." -f $License.Reason, $Feature)
|    }
|    return [pscustomobject]@{ Allowed = [bool]$res.Allowed; Edition = 'Pro'; Reason = "$($res.Reason)" }
|}
|
|function Get-SIEdition {
|    <# 'Pro' when the licence entitles any paid EDITION feature for this tenant, else 'Community'. An add-on alone (#510)
|       does not make an install Pro. #>
|    param([AllowNull()][object]$License, [AllowNull()][string]$TenantId)
|    foreach ($f in @($script:SIFeatureCatalog | Where-Object { -not [bool]$_.AddOn })) {
|        if ((Test-SIFeatureAvailable -Feature $f.Name -License $License -TenantId $TenantId).Allowed) { return 'Pro' }
|    }
|    return 'Community'
|}
|
|function Assert-SIFeatureOrSkip {
|    <#
|    .SYNOPSIS
|        The one call a paid engine makes at its start. $true = run. $false = one plain line saying the feature
|        is part of SecurityInsight Pro and why it did not run; the engine then ends successfully WITHOUT
|        producing output, so nothing downstream reads an empty result as "everything was resolved".
|    #>
|    param([Parameter(Mandatory)][string]$Feature, [AllowNull()][string]$TenantId)
|    $r = Test-SIFeatureAvailable -Feature $Feature -TenantId $TenantId
|    # #277: a licence in its grace period, or an installed licence that does not let a Pro job run, is a guard trip
|    # (mail + telemetry, once per feature per process). No licence at all is the Community edition -- not a trip.
|    if ((Get-Command -Name Send-SIGuardEvent -ErrorAction SilentlyContinue) -and (Test-SIFeatureIsPaid -Feature $Feature)) {
|        if ($null -eq $script:SILicenseGuardSent) { $script:SILicenseGuardSent = @{} }
|        if (-not $script:SILicenseGuardSent.ContainsKey($Feature)) {
|            try {
|                $lic = Get-SILicense 3>$null
|                $st = if ($lic) { [string]$lic.Status } else { 'Missing' }
|                if ($r.Allowed -and $st -eq 'Grace') {
|                    $script:SILicenseGuardSent[$Feature] = $true
|                    $null = Send-SIGuardEvent -GuardId 'licence.state.grace' -Outcome 'warning' -Subject $Feature -Detail ('The SecurityInsight Pro licence {0}.' -f $lic.Reason)
|                } elseif (-not $r.Allowed -and $st -notin @('Missing', '')) {
|                    $script:SILicenseGuardSent[$Feature] = $true
|                    $null = Send-SIGuardEvent -GuardId 'licence.state.invalid' -Outcome 'refused' -Subject $Feature -Detail ('{0} did not run: {1}' -f $Feature, $r.Reason)
|                }
|            } catch { }
|        }
|    }
|    if ($r.Allowed) { return $true }
|    $entry = $script:SIFeatureCatalog | Where-Object { $_.Name -ieq $Feature } | Select-Object -First 1
|    $what = $null
|    if ($entry) { $what = $entry.Title; if (-not $what) { $what = $entry.Description } }
|    if (-not $what) { $what = $Feature }
|    Write-Host (" [INFO] {0} is part of SecurityInsight Pro and did not run ({1}). Nothing was changed or published; the previous results stay as they were." -f $what, $r.Reason)
|    return $false
|}
|
|function Test-SILicenseForInstall {
|    <#
|      PURE (#173). May this licence be INSTALLED? Checked by setup\Set-SILicense.ps1 before anything is written,
|      so a bad licence is refused at the desk instead of discovered as "Pro silently skipped" on the next run.
|        * the signature/dates must verify: Valid, Grace (renew now) or NotYetValid (starts later) -- never
|          Invalid / Expired / Missing;
|        * it must unlock something (#510, framework §12.6a): its sku names a Pro edition, or it lists an add-on
|          SecurityInsight has. features[] is informational for an edition licence, so a Pro licence with an empty or
|          old features[] installs; feature ids SecurityInsight does not have are a NOTE, never a refusal. (The first
|          licence issued granted 'SI.ServiceNow' / 'SI.Correlation' -- under the edition rule its sku Pro covers SI.)
|        * when it is bound to tenants and the tenant is known, this tenant must be one of them.
|      Returns @{ Ok; Problems; Notes; Edition; Summary }.
|    #>
|    param(
|        [Parameter(Mandatory)][object]$License,          # Get-SILicense / Resolve-AitLicenseStatus output
|        [AllowEmptyCollection()][string[]]$KnownFeatures = @(),
|        [AllowNull()][string]$TenantId
|    )
|    $problems = New-Object System.Collections.Generic.List[string]
|    $notes = New-Object System.Collections.Generic.List[string]
|    $st = "$($License.Status)"
|    if ($st -notin 'Valid', 'Grace', 'NotYetValid') { $problems.Add(("the licence does not verify: {0} ({1})" -f $st, $License.Reason)) }
|    $feats = @($License.Features | Where-Object { $_ } | ForEach-Object { "$_".Trim() })
|    $edition = Get-SILicenceEdition -License $License
|    $addOns = @($script:SIFeatureCatalog | Where-Object { [bool]$_.AddOn } | ForEach-Object { "$($_.Name)" })
|    $listedAddOns = @($feats | Where-Object { $addOns -contains $_ })
|    if ($edition -eq 'Community' -and -not $listedAddOns.Count) {
|        $skuText = "$($License.Sku)".Trim(); if (-not $skuText) { $skuText = 'none' }
|        $problems.Add(("the licence names no SecurityInsight Pro edition (sku {0}) and lists no add-on, so it unlocks nothing" -f $skuText))
|    }
|    $unknown = @($feats | Where-Object { $_ -ne '*' -and ($KnownFeatures -notcontains $_) })
|    if ($unknown.Count) { $notes.Add(("features[] names ids SecurityInsight does not have: {0} -- informational only, the edition decides" -f ($unknown -join ', '))) }
|    $ids = @($License.TenantIds | Where-Object { $_ })
|    if ($ids.Count -and "$TenantId".Trim() -and -not (@($ids | Where-Object { "$_".Trim() -ieq "$TenantId".Trim() }).Count)) {
|        $problems.Add(("it is bound to tenant(s) {0}, not to this tenant {1}" -f ($ids -join ', '), $TenantId))
|    }
|    $summary = "{0} -- {1}; edition: {2}; features: {3}; tenants: {4}" -f $License.Customer, $License.Reason, $edition, $(if ($feats.Count) { $feats -join ', ' } else { 'none listed' }), $(if ($ids.Count) { $ids -join ', ' } else { 'any' })
|    [pscustomobject]@{ Ok = ($problems.Count -eq 0); Problems = $problems.ToArray(); Notes = $notes.ToArray(); Edition = $edition; Summary = $summary }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-AzRest.ps1'] = @{ Sha256 = 'ab77e822fccc463f44911a2b47f52d56e82bdaac4b48f605f2252ecd332bfd5f'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- Azure over plain REST, without the Az.* PowerShell modules (REQUIREMENTS 9.3, decision 2:
|    "no PS module dependencies ... go pure REST").
|
|    SecurityInsight runs with NO PowerShell modules: every Azure call is plain REST with tokens from SecurityInsight's
|    own sign-in (managed identity, certificate client assertion, client secret -- the run's decision). There is no
|    switch and no module path: no Az module is loaded, installed or needed anywhere in the runtime.
|
|    The call sites keep the familiar names with 'SIAz' in place of 'Az' (Invoke-SIAzOperationalInsightsQuery,
|    Search-SIAzGraph, ...). Each wrapper takes the arguments the call sites pass and does the job over REST (its *Rest
|    twin), returning objects with the properties the call sites read. Connect-SIAzAccount only RECORDS which identity to
|    sign in as; each REST call mints its token when it needs one.
|    The REST building blocks are public and usable directly:
|        Get-SIAzureToken -Audience Arm|LaQuery|Storage|KeyVault|Graph      one token function per audience
|        Invoke-SILaQuery                                                   Log Analytics data plane (api.loganalytics.io)
|        Invoke-SIArm                                                       ARM GET/PUT/PATCH/DELETE, list with nextLink
|        Search-SIResourceGraph                                             Resource Graph, every page ($skipToken)
|        Get-SIKeyVaultSecretValue                                          one secret, as plain text
|        Get-SIBlobContent / Set-SIBlobContent / Get-SIBlobList / ...       blob data plane (OAuth, x-ms-version)
|        Send-SIQueueMessage / Receive-SIQueueMessage / Remove-SIQueueMessage
|        Get-SITableEntity / Set-SITableEntity                              table data plane (upsert)
|
|    HTTP: every call of this file goes through Invoke-SIAzRestHttp. Token requests (client secret) go through
|    SI-LogIngest.ps1's Invoke-SILogIngestHttp -- the same HttpWebRequest shape; tests mock both seams.
|    Token hook: $global:SI_TokenProvider = { param($Resource) ... } (a scriptblock returning a bearer token) is consulted
|    first by Get-SIAzureToken and Get-SILogIngestToken when set -- for a host with its own sign-in, e.g. setup.
|
|    Retry rule (CLAUDE.md working rule 4): 429 / 408 / 5xx / no response -> wait (Retry-After when sent) and retry
|    in-run; 401 once -> refresh the token and repeat once; any other 4xx -> FAIL FAST with the service's own body.
|
|    PS 5.1 safe (no ?. / ??, no RSA.ImportFromPem); works on pwsh 7 and in a Linux container (no Cert: drive needed).
|    Ships in both editions and never references a Pro path.
|#>
|
|# NO Set-StrictMode HERE -- a dot-sourced file that sets it leaks into the caller's scope.
|
|# #730: the streaming Log Analytics reader (Invoke-SILaQuery reads Risk Analysis' answers with it; compiled on first use)
|if (-not (Get-Command -Name Get-SILaStreamReaderType -ErrorAction Ignore)) {
|    $__siLaStream = [System.IO.Path]::Combine($PSScriptRoot, 'SI-LaStreamRead.ps1')
|    if ([System.IO.File]::Exists($__siLaStream)) { . $__siLaStream }
|}
|
|# ONE connect path (#524, owner 2026-10-09 "modern single connect only"): SecurityInsight's own REST token client --
|# managed identity, certificate, client secret (and, in setup, a person's own sign-in). The old sign-in mode "AzContext"
|# (#413: borrow the current Azure / Invardia Support session of the process) and its file SI-AzSession.ps1 are gone.
|#
|# ONE TOKEN SOURCE more for that same path (#524, owner 2026-10-09 via Invardia: "support installs use TOKENS, never the
|# secret"): in a shell where Invardia's Connect-InvardiaSupport is open, its function Get-InvardiaSupportToken -Resource <r>
|# returns a bearer token as the customer's Invardia support app (cached by Invardia, tid + appid verified there). SI takes
|# EVERY token from it -- Mode 'Support' -- and still checks each token's tenant against the tenant it works in. No session
|# state is read (only the token), no Az / Graph cmdlet is called. Outside a support session nothing changes.
|#
|# THE SESSION ITSELF IS USED (owner 2026-10-12: a change in an environment is made inside its Invardia Support session, so
|# it is recorded in that environment's audit log). Get-SISupportSession is the ONE place that says whether a session is
|# open: Invardia's $global:InvardiaSupportState names a tenant AND its recording command Invoke-InvardiaSupportRequest is
|# in the shell. With a session, who SecurityInsight works as (tenant, app, subscriptions) is read from it -- no sign-in of
|# SecurityInsight's own and no token request -- and every HTTP call goes through the recording command (Invoke-SISupportHttp).
|
|function Get-SISupportedSignInText {
|    <# PURE. The sign-ins SecurityInsight supports, for an error message. #>
|    'a managed identity (SI_AuthMethod = ManagedIdentity), an app with a certificate (SI_SPN_AppId + SI_SPN_TenantId + SI_SPN_CertThumbprint), an app with a client secret (SI_SPN_AppId + SI_SPN_TenantId + SI_SPN_Secret), or the tokens of an Invardia support session (Get-InvardiaSupportToken). An Azure session of this PowerShell process (Connect-AzAccount, az login) is never used'
|}
|
|function Get-SISupportSession {
|    <#
|        THE ONE PLACE that says whether an Invardia Support session is open in this PowerShell session, and what it names.
|        Open = Invardia's $global:InvardiaSupportState is a hashtable that names a tenant AND its recording command
|        Invoke-InvardiaSupportRequest is here (Test-Path Function: -- never Get-Command, which can load a module).
|        $null when there is none (Disconnect-InvardiaSupport empties the state). Never guessed: a state WITHOUT the
|        recording command is said and stops the caller -- nothing could be recorded.
|        Returns TenantId, AppId, Environment (the handle), EnvironmentId, SessionId, Subscriptions (lower case; the ones the
|        environment names), SubscriptionId (the first of them, '' when it names none), SubscriptionName.
|    #>
|    $s = Get-Variable -Scope Global -Name InvardiaSupportState -ValueOnly -ErrorAction Ignore
|    if (-not ($s -is [hashtable])) { return $null }
|    $tid = [string]$s['TenantId']
|    if ([string]::IsNullOrWhiteSpace($tid)) { return $null }
|    if (-not (Test-Path -LiteralPath 'Function:\Invoke-InvardiaSupportRequest')) {
|        throw ('An Invardia Support session is noted in this PowerShell session (tenant {0}), but its recording command Invoke-InvardiaSupportRequest is not here, so nothing SecurityInsight does could be recorded. Nothing was done. Open the session again (Connect-InvardiaSupport -Environment <handle> -Reason ''<why>''), or end it (Disconnect-InvardiaSupport) and work with your own sign-in.' -f $tid)
|    }
|    $subs = @(@($s['Subscriptions']) | Where-Object { $_ } | ForEach-Object { ([string]$_).Trim().ToLowerInvariant() } | Where-Object { $_ })
|    $first = ''
|    if ($subs.Count) { $first = [string]$subs[0] }
|    return [pscustomobject]@{
|        TenantId = $tid.Trim(); AppId = [string]$s['AppId']; Environment = [string]$s['Environment']; EnvironmentId = [string]$s['EnvironmentId']
|        SessionId = [string]$s['SessionId']; Subscriptions = [string[]]$subs; SubscriptionId = $first; SubscriptionName = [string]$s['SubscriptionName']
|    }
|}
|
|function Get-SISupportSessionName {
|    <# PURE. How a Support session is named in a message: its environment handle, else its tenant. #>
|    param($Session)
|    if ($Session -and [string]$Session.Environment) { return [string]$Session.Environment }
|    if ($Session) { return ('tenant {0}' -f $Session.TenantId) }
|    return ''
|}
|
|function Assert-SISupportSubscription {
|    <# In a Support session only a subscription the environment names is worked in: any other is REFUSED (throws). A session
|       whose environment names no subscription refuses none (Invardia's own rule). No session = nothing to check. #>
|    param([string]$SubscriptionId, $Session)
|    if ([string]::IsNullOrWhiteSpace($SubscriptionId)) { return }
|    if (-not $Session) { $Session = Get-SISupportSession }
|    if (-not $Session) { return }
|    $named = @($Session.Subscriptions)
|    if ($named.Count -and $named -notcontains $SubscriptionId.Trim().ToLowerInvariant()) {
|        throw ('Subscription {0} is not one the Invardia Support session for {1} names ({2}) -- refused, nothing was done there. Use a subscription of this environment, or open the Support session of the environment that owns {0}.' -f $SubscriptionId, (Get-SISupportSessionName $Session), ($named -join ', '))
|    }
|}
|
|function Test-SISupportTokenSource {
|    <# Is an Invardia Support session open in this shell? (Get-SISupportSession decides -- the one place.) #>
|    return [bool](Get-SISupportSession)
|}
|
|function Get-SISupportExpectedTenantId {
|    <# The tenant SI works in, which the Support session must be for: -TenantId, else the configured one. Empty = the
|       session's own. #>
|    param([string]$TenantId)
|    if ($TenantId) { return $TenantId }
|    return [string](Get-SIAzRestValue 'SI_SPN_TenantId', 'SpnTenantId', 'AzureTenantId', 'TenantId')
|}
|
|function Get-SISupportToken {
|    <#
|        A bearer token for -Resource from the Invardia Support session; its 'tid' must be -TenantId (refused otherwise).
|        ONLY for what has no HTTP request the recording command can send -- the SQL sign-in of a database step, the
|        container registry's own token exchange, reading who the Support app is from its token. Invardia records that the
|        token was issued; what is done with it is not recorded. Every HTTP call goes through Invoke-SISupportHttp instead
|        and asks for no token here.
|    #>
|    param([Parameter(Mandatory)][string]$Resource, [string]$TenantId, [switch]$ForceRefresh)
|    if (-not (Get-SISupportSession)) { throw 'No Invardia Support session is open in this PowerShell session (Connect-InvardiaSupport -Environment <handle> -Reason ''<why>'').' }
|    if (-not (Test-Path -LiteralPath 'Function:\Get-InvardiaSupportToken')) { throw ('The Invardia Support session in this PowerShell session has no token command (Get-InvardiaSupportToken), so no token for {0} can be taken from it. Open the session again (Connect-InvardiaSupport).' -f $Resource) }
|    $p = @{ Resource = $Resource.TrimEnd('/') }
|    if ($ForceRefresh) { $p['ForceRefresh'] = $true }
|    $tok = [string](Get-InvardiaSupportToken @p)
|    if ([string]::IsNullOrWhiteSpace($tok)) { throw ('The Invardia support session returned no token for {0}.' -f $Resource) }
|    $c = ConvertFrom-SIJwtPayload $tok
|    if (-not $c -or -not [string]$c.tid) { throw ('The Invardia support token for {0} could not be read (no tenant in it) -- refused.' -f $Resource) }
|    if ($TenantId -and [string]$c.tid -ne $TenantId) {
|        throw ('The Invardia support token for {0} is for tenant {1}, not {2} -- refused. Connect the support session of tenant {2}.' -f $Resource, $c.tid, $TenantId)
|    }
|    return $tok
|}
|
|function Get-SISupportAuth {
|    <# The Auth hashtable of the Invardia Support session: Mode 'Support', app + tenant + first subscription read from the
|       SESSION (Get-SISupportSession) -- no token is asked for. Refused when the session is for another tenant than
|       -TenantId / the configured one. ObjectId is not known here (Get-SISetupSignedInObjectId finds it when asked). #>
|    param([string]$TenantId)
|    $sess = Get-SISupportSession
|    if (-not $sess) { throw 'No Invardia Support session is open in this PowerShell session (Connect-InvardiaSupport -Environment <handle> -Reason ''<why>'').' }
|    $want = Get-SISupportExpectedTenantId -TenantId $TenantId
|    if ($want -and $want -ne $sess.TenantId) {
|        throw ('The Invardia Support session for {0} is for tenant {1}, not {2} -- refused. Connect the support session of tenant {2}.' -f (Get-SISupportSessionName $sess), $sess.TenantId, $want)
|    }
|    return @{ Mode = 'Support'; AppId = [string]$sess.AppId; TenantId = [string]$sess.TenantId; ObjectId = $null; SubscriptionId = [string]$sess.SubscriptionId
|              Environment = [string]$sess.Environment; EnvironmentId = [string]$sess.EnvironmentId; SessionId = [string]$sess.SessionId }
|}
|
|function Sync-SISupportConnection {
|    <#
|        Keeps the recorded sign-in of this process in step with the Invardia Support session, and returns the session
|        ($null = none):
|          * no session, but the recorded sign-in is a Support one  -> the session was closed: the sign-in is dropped
|          * a session and no recorded sign-in (or one of ANOTHER session) -> the session becomes the sign-in
|          * a session and a recorded sign-in of SecurityInsight's own -> kept, unless -TakeOver (setup: a Support session
|            in the shell always wins there -- setup never works beside it with a sign-in of its own)
|        Says ONE plain line the first time a session is used. Throws what Get-SISupportSession / Get-SISupportAuth refuse.
|    #>
|    param([switch]$TakeOver)
|    $sess = Get-SISupportSession
|    $st = Get-SIAzRestState
|    $c = $st.Connection
|    $isSupport = ($c -is [hashtable]) -and ([string]$c.Mode -eq 'Support')
|    if (-not $sess) {
|        if ($isSupport) { $st.Connection = $null; $st.TenantId = $null; $st.SubscriptionId = $null; $st.Cache = @{} }
|        return $null
|    }
|    $same = $isSupport -and ([string]$c.TenantId -eq $sess.TenantId) -and ([string]$c.SessionId -eq $sess.SessionId) -and ([string]$c.EnvironmentId -eq $sess.EnvironmentId)
|    if ($same) { return $sess }
|    if (($c -is [hashtable]) -and -not $isSupport -and -not $TakeOver) { return $sess }
|    $st.Connection = Get-SISupportAuth
|    $st.TenantId = [string]$sess.TenantId
|    $st.Cache = @{}
|    if ($st.SubscriptionId -and @($sess.Subscriptions).Count -and @($sess.Subscriptions) -notcontains ([string]$st.SubscriptionId).Trim().ToLowerInvariant()) { $st.SubscriptionId = $null }
|    $key = '{0}|{1}|{2}' -f $sess.TenantId, $sess.EnvironmentId, $sess.SessionId
|    if ([string]$st['SupportSaid'] -ne $key) {
|        $st['SupportSaid'] = $key
|        Write-Host ('using the Invardia Support session for {0} -- every change is recorded there' -f (Get-SISupportSessionName $sess))
|    }
|    return $sess
|}
|
|function Test-SISupportRecorderPresent {
|    <# #548: is an Invardia Support session, with its RECORDING wrapper, open in this shell? (Get-SISupportSession decides.) #>
|    return [bool](Get-SISupportSession)
|}
|
|function Test-SISupportRequestRoute {
|    <#
|        #548 (Invardia, 2026-10-10: every Support app action is recorded in the customer's audit log): does a request for
|        -Audience, as -Auth (none = the run's own sign-in), go through Invardia's recording wrapper? Yes when a Support
|        session is open (Get-SISupportSession) AND the call is made as the support session (Mode 'Support' -- the recorded
|        sign-in, or no recorded sign-in at all) AND no host token provider ($global:SI_TokenProvider) answers instead.
|        Every audience SecurityInsight signs in to: Arm, Graph, Log Analytics, Storage, Exchange Online's admin API, Key
|        Vault and Azure Monitor -- on any host (a host the wrapper does not know by itself gets its token audience named,
|        Get-SISupportTokenResource). A URL that is none of these (-Audience Other: another service with its own key) is
|        not a call as the support app and never goes through it. -Uri is accepted for callers that pass it.
|    #>
|    param([string]$Audience = 'Arm', [hashtable]$Auth, [string]$Uri)
|    if ($Audience -notin 'Arm', 'Graph', 'LaQuery', 'Storage', 'Exchange', 'KeyVault', 'Monitor') { return $false }
|    if ($Auth) {
|        if ([string]$Auth.Mode -ne 'Support') { return $false }
|        return [bool](Get-SISupportSession)
|    }
|    $tp = Get-Variable -Scope Global -Name SI_TokenProvider -ValueOnly -ErrorAction Ignore
|    if ($tp -is [scriptblock]) { return $false }
|    # a caller that loaded only part of this file (a script's own fakes, a lifted function) has no state helpers -- and no
|    # support session either
|    if (-not (Test-Path -LiteralPath 'Function:\Get-SIAzRestState')) { return $false }
|    if (-not (Test-Path -LiteralPath 'Function:\Sync-SISupportConnection')) { return $false }
|    if (-not (Sync-SISupportConnection)) { return $false }
|    $c = (Get-SIAzRestState).Connection
|    return (($c -is [hashtable]) -and ([string]$c.Mode -eq 'Support'))
|}
|
|function Get-SISupportTokenResource {
|    <# PURE. The token audience to NAME to the recording wrapper for a request it cannot name from the URL's host by
|       itself: a Key Vault or Azure Monitor URL on another host than <vault>.vault.azure.net /
|       <endpoint>.ingest.monitor.azure.com. '' = the wrapper names it (Arm, Graph, Log Analytics, Storage, Exchange). #>
|    param([string]$Audience, [string]$Uri)
|    $h = ''
|    try { $h = ([uri]$Uri).Host } catch { $h = '' }
|    if ($Audience -eq 'KeyVault' -and $h -notmatch '(?i)\.vault\.azure\.net$') { return 'https://vault.azure.net' }
|    if ($Audience -eq 'Monitor' -and $h -notmatch '(?i)\.ingest\.monitor\.azure\.com$') { return 'https://monitor.azure.com' }
|    return ''
|}
|
|function Test-SISupportReadOnlyPost {
|    <#
|        PURE. Is this POST a READ (recorded as a read, not as a change)? Only the POSTs known to change nothing:
|          ARM    Resource Graph (/providers/Microsoft.ResourceGraph/resources), a provider's checkNameAvailability, a
|                 workspace query (.../workspaces/<name>/query, /api/query)
|          Log Analytics   /v1/workspaces/<id>/query
|          Graph  getByIds, getMemberObjects, getMemberGroups, checkMemberObjects, checkMemberGroups, security/runHuntingQuery
|                 (a KQL hunting query), and a $batch whose
|                 requests are ALL GET
|        Anything else -- and anything not understood -- is a CHANGE. A GET / HEAD is a read by its method (not asked here).
|    #>
|    param([string]$Method, [string]$Uri, $Body)
|    if (([string]$Method).ToUpperInvariant() -ne 'POST') { return $false }
|    $u = $null
|    try { $u = [uri]$Uri } catch { return $false }
|    if (-not $u -or -not $u.IsAbsoluteUri) { return $false }
|    $h = $u.Host.ToLowerInvariant(); $p = $u.AbsolutePath
|    if ($h -match '^management\.(azure\.com|core\.windows\.net)$') {
|        if ($p -match '(?i)^/providers/Microsoft\.ResourceGraph/resources/?$') { return $true }
|        if ($p -match '(?i)/providers/[^/]+/checkNameAvailability/?$') { return $true }
|        if ($p -match '(?i)/providers/Microsoft\.OperationalInsights/workspaces/[^/]+/(api/)?query/?$') { return $true }
|        return $false
|    }
|    if ($h -eq 'api.loganalytics.io' -or $h -eq 'api.loganalytics.azure.com') { return [bool]($p -match '(?i)^/v1/workspaces/[^/]+/query/?$') }
|    if ($h -eq 'graph.microsoft.com') {
|        if ($p -match '(?i)/(getByIds|getMemberObjects|getMemberGroups|checkMemberObjects|checkMemberGroups)/?$') { return $true }
|        # Defender advanced hunting: a KQL query, which can only read
|        if ($p -match '(?i)^/(v1\.0|beta)/security/runHuntingQuery/?$') { return $true }
|        if ($p -match '(?i)^/(v1\.0|beta)/\$batch/?$') {
|            try {
|                $text = ''
|                if ($Body -is [byte[]]) { $text = [System.Text.Encoding]::UTF8.GetString($Body) } else { $text = [string]$Body }
|                $reqs = @(($text | ConvertFrom-Json).requests | Where-Object { $null -ne $_ })
|                if (-not $reqs.Count) { return $false }
|                return (-not @($reqs | Where-Object { ([string]$_.method).ToUpperInvariant() -ne 'GET' }).Count)
|            } catch { return $false }
|        }
|        return $false
|    }
|    return $false
|}
|
|function Test-SISupportBodyIsText {
|    <# PURE. Can -Body go through Invardia's recording wrapper? Yes for every body: the wrapper sends a [byte[]] body
|       unchanged (Invardia, 2026-10-10). Kept as the one place to say otherwise. #>
|    param($Body, [string]$ContentType)
|    return $true
|}
|
|function Invoke-SISupportHttp {
|    <#
|        #548: ONE HTTP exchange through Invardia's recording wrapper, in the shape of Invoke-SIAzRestHttp (StatusCode,
|        Content, Bytes, Headers, RetryAfter) so Invoke-SIAzRestRequest's retry and error rules stay exactly as they are
|        (an HTTP status >= 400 becomes SecurityInsight's own error there). The wrapper adds the support app's token: an
|        Authorization header of the caller is dropped. No answer = StatusCode 0 (retried like any network failure); a
|        refusal to record the action in the customer's audit log is RETHROWN (fail-closed: the action was not made).
|        A GET / HEAD is a read by its method; a POST that only reads (Test-SISupportReadOnlyPost) is sent -ReadOnly;
|        everything else is recorded as a change. An Azure Resource Manager URL of a subscription the session's environment
|        does not name is REFUSED before anything is sent (Assert-SISupportSubscription). -Audience names the token audience
|        for a host the wrapper does not know (Get-SISupportTokenResource); -TimeoutSec is passed on.
|    #>
|    param([Parameter(Mandatory)][string]$Method, [Parameter(Mandatory)][string]$Uri, [hashtable]$Headers, $Body, [string]$ContentType, [switch]$AsBytes,
|          [string]$Audience, [int]$TimeoutSec = 0)
|    $sess = Get-SISupportSession
|    if (-not $sess) { throw 'No Invardia support session is open in this PowerShell session, so this request cannot be sent through it.' }
|    $target = $null
|    try { $target = [uri]$Uri } catch { $target = $null }
|    if ($target -and $target.IsAbsoluteUri -and $target.Host -match '(?i)^management\.(azure\.com|core\.windows\.net)$' -and
|        $target.AbsolutePath -match '(?i)^/subscriptions/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(/|$)') {
|        Assert-SISupportSubscription -SubscriptionId $Matches[1] -Session $sess
|    }
|    $h = @{}
|    if ($Headers) { foreach ($k in @($Headers.Keys)) { if ([string]$k -ine 'Authorization' -and [string]$k -ine 'Content-Type') { $h[[string]$k] = $Headers[$k] } elseif ([string]$k -ieq 'Content-Type' -and -not $ContentType) { $ContentType = [string]$Headers[$k] } } }
|    $p = @{ Method = $Method.ToUpperInvariant(); Uri = $Uri }
|    if ($h.Count) { $p.Headers = $h }
|    if ($null -ne $Body) {
|        # bytes go unchanged (a source package upload). NOT $(if ...): a subexpression ENUMERATES the byte array into an
|        # object[] -- the wrapper then sent it as JSON numbers instead of the file
|        if ($Body -is [byte[]]) { $p.Body = $Body } else { $p.Body = [string]$Body }
|        if ($ContentType) { $p.ContentType = $ContentType }
|    }
|    $o = $null
|    if ($AsBytes) { $p.AsBytes = $true }   # the raw answer as ContentBytes (a download)
|    if (Test-SISupportReadOnlyPost -Method $Method -Uri $Uri -Body $Body) { $p.ReadOnly = $true }   # a POST that only reads
|    if ($TimeoutSec -gt 0) { $p.TimeoutSec = $TimeoutSec }
|    $tokenResource = Get-SISupportTokenResource -Audience $Audience -Uri $Uri
|    if ($tokenResource) { $p.TokenResource = $tokenResource }
|    try { $o = Invoke-InvardiaSupportRequest @p }
|    catch {
|        $m = [string]$_.Exception.Message
|        if ($m -match '(?i)audit log|fail-closed|could not be recorded|No Invardia support session') { throw }
|        return [pscustomobject]@{ StatusCode = 0; Content = $m; Bytes = $null; Headers = @{}; RetryAfter = $null }
|    }
|    $hh = New-Object 'System.Collections.Hashtable' ([System.StringComparer]::OrdinalIgnoreCase)
|    if ($o -and $o.Headers) {
|        try {
|            if ($o.Headers -is [System.Collections.IDictionary]) { foreach ($k in @($o.Headers.Keys)) { $hh[[string]$k] = (@($o.Headers[$k]) | ForEach-Object { [string]$_ }) -join ',' } }
|            else { foreach ($k in @($o.Headers.AllKeys)) { $hh[[string]$k] = [string]$o.Headers[$k] } }
|        } catch { }
|    }
|    $text = if ($o) { [string]$o.Content } else { '' }
|    # the raw answer as [byte[]] -- assigned in statements, never through $( ... ), which would enumerate it into object[]
|    [byte[]]$raw = $null
|    if ($AsBytes) {
|        if ($o -and $o.PSObject.Properties['ContentBytes'] -and $o.ContentBytes) { $raw = [byte[]]$o.ContentBytes } else { $raw = [System.Text.Encoding]::UTF8.GetBytes($text) }
|    }
|    $out = [pscustomobject]@{
|        StatusCode = $(if ($o) { [int]$o.StatusCode } else { 0 }); Content = $(if ($AsBytes) { '' } else { $text })
|        Bytes = $null; Headers = $hh; RetryAfter = [string]$hh['Retry-After']
|    }
|    $out.Bytes = $raw
|    $out
|}
|
|function Invoke-SIRestMethod {
|    <#
|        #548: the drop-in for Invoke-RestMethod that setup's own Graph / ARM calls use (-Method, -Uri, -Headers with the
|        caller's bearer token, -Body, -ContentType): inside an Invardia support session the call goes through the recording
|        wrapper (the caller's Authorization header is dropped -- the wrapper signs as the support app); otherwise exactly
|        Invoke-RestMethod. Throws on HTTP >= 400 like Invoke-RestMethod, with the service's answer in the message; returns
|        the parsed JSON (or the text when it is not JSON).
|    #>
|    [CmdletBinding()]   # -ErrorAction and the other common parameters, as Invoke-RestMethod callers pass them
|    param([string]$Method = 'GET', [Parameter(Mandatory)][string]$Uri, [hashtable]$Headers, $Body, [string]$ContentType, [int]$TimeoutSec = 120)
|    $host_ = ([uri]$Uri).Host
|    $aud = if ($host_ -eq 'graph.microsoft.com') { 'Graph' } elseif ($host_ -match '^management\.(azure\.com|core\.windows\.net)$') { 'Arm' } elseif ($host_ -eq 'api.loganalytics.io') { 'LaQuery' } elseif ($host_ -eq 'outlook.office365.com') { 'Exchange' } else { 'Other' }
|    # this function is published GLOBALLY: a caller that never loaded this file (a script run on its own, a test with its
|    # own fakes) has no routing helpers -- and then no support session either: plain Invoke-RestMethod
|    if ((Test-Path -LiteralPath 'Function:\Test-SISupportRequestRoute') -and (Test-SISupportRequestRoute -Audience $aud)) {
|        $b = $Body
|        if ($null -ne $b -and -not ($b -is [string]) -and -not ($b -is [byte[]])) { $b = ConvertTo-Json -InputObject $b -Depth 30 -Compress }
|        $ct = if ($ContentType) { $ContentType } elseif ($null -ne $b) { 'application/json' } else { '' }
|        $r = Invoke-SISupportHttp -Method $Method -Uri $Uri -Headers $Headers -Body $b -ContentType $ct -Audience $aud -TimeoutSec $TimeoutSec
|        $code = [int]$r.StatusCode
|        if ($code -lt 200 -or $code -ge 300) {
|            throw (New-SIAzRestError -Message ('{0} {1} failed. HTTP Status: {2} ({3}) Response: {4}' -f $Method.ToUpperInvariant(), ($Uri -replace '\?.*$', ''), $code, (Get-SIAzRestStatusName $code), $r.Content) -Response $r)
|        }
|        $t = [string]$r.Content
|        if (-not $t.Trim()) { return $null }
|        try { return ($t | ConvertFrom-Json) } catch { return $t }
|    }
|    $a = @{ Method = $Method; Uri = $Uri; ErrorAction = 'Stop'; TimeoutSec = $TimeoutSec }
|    if ($Headers) { $a.Headers = $Headers }
|    if ($null -ne $Body) { $a.Body = $Body }
|    if ($ContentType) { $a.ContentType = $ContentType }
|    Invoke-RestMethod @a
|}
|# published globally: a product script the install runs (in this process) finds it even when it loaded only part of the layer
|Set-Item -Path 'function:global:Invoke-SIRestMethod' -Value ${function:Invoke-SIRestMethod}
|
|# =====================================================================================================================
|#  The wrapper map, shared state
|# =====================================================================================================================
|
|function Get-SIAzRestWrapperMap {
|    <# wrapper -> the Az cmdlet it replaces -> its REST twin, as data. The wiring tests read it. #>
|    $m = [ordered]@{}
|    foreach ($az in @(
|        'Connect-AzAccount', 'Disconnect-AzAccount', 'Disable-AzContextAutosave', 'Get-AzContext', 'Set-AzContext',
|        'Get-AzAccessToken', 'Get-AzSubscription', 'Invoke-AzRestMethod',
|        'Invoke-AzOperationalInsightsQuery', 'Get-AzOperationalInsightsWorkspace', 'New-AzOperationalInsightsWorkspace',
|        'Search-AzGraph', 'Get-AzKeyVaultSecret', 'Set-AzKeyVaultSecret',
|        'Get-AzResourceGroup', 'New-AzResourceGroup', 'Get-AzRoleAssignment', 'New-AzRoleAssignment', 'Get-AzRoleDefinition',
|        'Get-AzTag', 'Update-AzTag', 'Get-AzADServicePrincipal',
|        'Get-AzDataCollectionEndpoint', 'New-AzDataCollectionEndpoint', 'Get-AzDataCollectionRule',
|        'New-AzStorageContext', 'Get-AzStorageAccount', 'New-AzStorageAccount',
|        'Get-AzStorageContainer', 'New-AzStorageContainer', 'Get-AzStorageBlob', 'Get-AzStorageBlobContent',
|        'Set-AzStorageBlobContent', 'Remove-AzStorageBlob', 'Start-AzStorageBlobCopy',
|        'Get-AzStorageQueue', 'New-AzStorageQueue')) {
|        $w = $az -replace '-Az', '-SIAz'
|        $m[$w] = @{ Replaces = $az; Rest = ($w + 'Rest') }
|    }
|    return $m
|}
|
|function Get-SIAzRestState {
|    <# Per-process state: the recorded sign-in, the current subscription, token / lookup caches. Global because this
|       file is dot-sourced at different depths by different engines. #>
|    # StrictMode-safe: an unset global is read through Get-Variable, never directly (a caller may run Set-StrictMode).
|    if (-not ((Get-Variable -Scope Global -Name SI_AzRestState -ValueOnly -ErrorAction Ignore) -is [hashtable])) {
|        $global:SI_AzRestState = @{ Connection = $null; SubscriptionId = $null; TenantId = $null; Cache = @{} }
|    }
|    return $global:SI_AzRestState
|}
|
|function Initialize-SIAzRestHelpers {
|    <# The token functions (SI-LogIngest.ps1), the KQL error reader (SI-KqlError.ps1) and the certificate helpers
|       (auth/Find-SICertificate.ps1). Loaded on first need; only what is MISSING is loaded and published globally, so a
|       caller's own copy or a test's mock is never replaced. #>
|    $want = @(
|        @{ Path = (Join-Path $PSScriptRoot 'SI-LogIngest.ps1'); Fns = @('Get-SILogIngestToken', 'Invoke-SILogIngestHttp', 'Get-SILogIngestRunCache', 'Get-SILogIngestRetryDelay', 'Initialize-SILogIngestAuthHelpers') }
|        @{ Path = (Join-Path $PSScriptRoot 'SI-KqlError.ps1');   Fns = @('Get-SIKqlErrorText', 'Get-SIKqlErrorSummary', 'Test-SIKqlTableMissing') }
|        @{ Path = (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'auth/Find-SICertificate.ps1'); Fns = @('Get-SICertificateClientToken', 'Get-SICertificateFromStore', 'Test-SICertDriveAvailable') }
|    )
|    foreach ($w in $want) {
|        $missing = @($w.Fns | Where-Object { -not (Get-Command -Name $_ -ErrorAction Ignore) })
|        if ($missing.Count -eq 0) { continue }
|        if (-not (Test-Path -LiteralPath $w.Path)) { continue }
|        . $w.Path
|        foreach ($n in $missing) {
|            $f = Get-Command -Name $n -CommandType Function -ErrorAction Ignore
|            if ($f) { Set-Item -Path ("function:global:{0}" -f $n) -Value $f.ScriptBlock }
|        }
|    }
|}
|
|# =====================================================================================================================
|#  HTTP seam, sign-in, tokens
|# =====================================================================================================================
|
|function Remove-SIAzRestCaughtError {
|    <# Takes a HANDLED error record back out of $global:Error (newest entries only). PS 5.1 safe. #>
|    param($Record)
|    if ($null -eq $Record) { return }
|    $errs = $global:Error
|    for ($i = 0; $i -lt [Math]::Min(3, $errs.Count); $i++) {
|        $e = $errs[$i]
|        if ([object]::ReferenceEquals($e, $Record) -or ($e -is [System.Management.Automation.ErrorRecord] -and $Record -is [System.Management.Automation.ErrorRecord] -and [object]::ReferenceEquals($e.Exception, $Record.Exception))) {
|            $errs.RemoveAt($i); return
|        }
|    }
|}
|
|function Invoke-SIAzRestHttp {
|    <#
|        THE ONE HTTP SEAM of this file (tests Mock it). Never throws on an HTTP status: returns
|        @{ StatusCode; Content; Bytes; Headers; RetryAfter }. A network failure (no response) is StatusCode 0.
|        HttpWebRequest, not Invoke-WebRequest: the 4xx body and headers read the same way on PS 5.1 and pwsh 7.
|        -AsBytes keeps the body as bytes (blob downloads); Content is then ''.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$Method,
|        [Parameter(Mandatory)][string]$Uri,
|        [hashtable]$Headers,
|        $Body,
|        [string]$ContentType,
|        [int]$TimeoutSec = 300,
|        [switch]$AsBytes,
|        # A 2xx body read AS IT ARRIVES (SI-LaStreamRead.ps1): { param([IO.Stream]$Stream) <the parsed answer> } -- the body
|        # is never held whole; the answer is returned as .Parsed (Content '', Bytes $null). Any other status: as without it.
|        [scriptblock]$ReadStream
|    )
|    if ($PSVersionTable.PSEdition -ne 'Core') {
|        [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
|    }
|    $req = [System.Net.HttpWebRequest]::Create($Uri)
|    $req.Method = $Method.ToUpperInvariant()
|    $req.Timeout = $TimeoutSec * 1000
|    $req.ReadWriteTimeout = $TimeoutSec * 1000
|    $req.Accept = 'application/json'
|    if ($Headers) {
|        foreach ($k in $Headers.Keys) {
|            if ($k -eq 'Content-Type') { $req.ContentType = [string]$Headers[$k] }
|            elseif ($k -eq 'Accept')   { $req.Accept = [string]$Headers[$k] }
|            else { $req.Headers[$k] = [string]$Headers[$k] }
|        }
|    }
|    if ($ContentType) { $req.ContentType = $ContentType }
|    if ($null -ne $Body) {
|        # statements, never `= if (...) { $Body }`: an if-expression ENUMERATES a byte array into object[] (one boxed object
|        # per byte) -- a build context of tens of MB became gigabytes and the updater ran out of memory
|        [byte[]]$bytes = $null
|        if ($Body -is [byte[]]) { $bytes = $Body } else { $bytes = [System.Text.Encoding]::UTF8.GetBytes([string]$Body) }
|        $req.ContentLength = $bytes.Length
|        # A connection that fails while the BODY is sent (connect, DNS, reset) is "no answer" (StatusCode 0), which the caller
|        # retries -- for a request that is safe to send again (PUT / PATCH / DELETE / MERGE: idempotent, as an ARM or table PUT
|        # is). A POST that failed here is thrown as before: it is not repeated blindly. (The sweep of 2026-10-22: this threw
|        # past every retry loop on blob, table and ARM writes.)
|        try {
|            $s = $req.GetRequestStream()
|            try { $s.Write($bytes, 0, $bytes.Length) } finally { $s.Close() }
|        } catch {
|            if ($req.Method -eq 'POST') { throw }
|            return [pscustomobject]@{ StatusCode = 0; Content = [string]$_.Exception.Message; Bytes = $null; Headers = @{}; RetryAfter = $null }
|        }
|    } elseif ($req.Method -in 'POST', 'PUT', 'PATCH', 'MERGE') {
|        $req.ContentLength = 0
|    }
|    $resp = $null
|    try { $resp = $req.GetResponse() }
|    catch {
|        $we = $_.Exception
|        while ($we -and -not ($we -is [System.Net.WebException])) { $we = $we.InnerException }
|        if ($we -and $we.Response) {
|            $resp = $we.Response
|            # An HTTP status is an ANSWER, returned to the caller (who decides whether a 404 is "not there" or a failure)
|            # -- not an error of this process. PowerShell still records the caught exception in $Error, and setup shows
|            # every new $Error entry: each "does it exist?" probe printed "(404) Not Found" (live 2026-10-06). Drop it.
|            Remove-SIAzRestCaughtError -Record $_
|        }
|        else { return [pscustomobject]@{ StatusCode = 0; Content = [string]$_.Exception.Message; Bytes = $null; Headers = @{}; RetryAfter = $null } }
|    }
|    try {
|        $h = New-Object 'System.Collections.Hashtable' ([System.StringComparer]::OrdinalIgnoreCase)
|        foreach ($k in $resp.Headers.AllKeys) { $h[$k] = [string]$resp.Headers[$k] }
|        $text = ''; $raw = $null
|        $rs = $resp.GetResponseStream()
|        $sc = [int]$resp.StatusCode
|        if ($rs -and $ReadStream -and $sc -ge 200 -and $sc -lt 300) {
|            $parsed = $null
|            try { $parsed = & $ReadStream $rs } finally { $rs.Close() }
|            return [pscustomobject]@{ StatusCode = $sc; Content = ''; Bytes = $null; Headers = $h; RetryAfter = [string]$h['Retry-After']; Parsed = $parsed }
|        }
|        if ($rs) {
|            # #639: the body is read ONCE into an array of its own length when the service says how long it is -- not into a
|            # growing buffer that is then copied again (a large answer was held two or three times before it was parsed)
|            try {
|                $len = [long]$resp.ContentLength
|                if ($len -gt 0 -and $len -lt [int]::MaxValue) {
|                    $raw = [byte[]]::new([int]$len); $off = 0
|                    while ($off -lt $len) { $n = $rs.Read($raw, $off, [int]($len - $off)); if ($n -le 0) { break }; $off += $n }
|                    if ($off -lt $len) { $part = [byte[]]::new($off); [Array]::Copy($raw, $part, $off); $raw = $part; $part = $null }
|                } else {
|                    $ms = New-Object System.IO.MemoryStream
|                    $rs.CopyTo($ms); $raw = $ms.ToArray(); $ms.Dispose(); $ms = $null
|                }
|            } finally { $rs.Close() }
|            if (-not $AsBytes) { $text = [System.Text.Encoding]::UTF8.GetString($raw); $raw = $null }
|        }
|        return [pscustomobject]@{ StatusCode = [int]$resp.StatusCode; Content = $text; Bytes = $raw; Headers = $h; RetryAfter = [string]$h['Retry-After'] }
|    } finally { $resp.Close() }
|}
|
|function Get-SIAzRestValue {
|    <# The first non-empty global of -Names. #>
|    param([string[]]$Names)
|    foreach ($n in $Names) {
|        $v = Get-Variable -Scope Global -Name $n -ValueOnly -ErrorAction Ignore
|        if ($null -ne $v -and -not [string]::IsNullOrWhiteSpace([string]$v)) { return [string]$v }
|    }
|    return $null
|}
|
|function Resolve-SIAzRestAuth {
|    <#
|        WHO this run signs in as, for the REST path:
|          1. what Connect-SIAzAccount recorded in this process (the launcher / container entry point decided)
|          1b. an Invardia Support session open in this shell (Mode 'Support', read from the session)
|          2. the run's managed-identity switch (SI_UseManagedIdentity / UseManagedIdentity, #222)
|          3. an SPN certificate   (SI_SPN_AppId | SpnClientId | HighPriv_* + SI_SPN_CertThumbprint | SpnCertificateThumbprint)
|          4. an SPN client secret (SI_SPN_Secret | SpnClientSecret | HighPriv_*)
|        Certificate before secret, as everywhere in SecurityInsight. Returns the Auth hashtable Get-SILogIngestToken
|        takes. Throws when nothing is configured -- the REST path never falls back to an Az session.
|    #>
|    # An Invardia Support session in this shell: it IS the sign-in when nothing else was recorded (and a Support sign-in
|    # whose session was closed is dropped) -- Sync-SISupportConnection, read from the session, no token asked for.
|    $null = Sync-SISupportConnection
|    $st = Get-SIAzRestState
|    if ($st.Connection -is [hashtable]) { return $st.Connection }
|    # #524: the retired sign-in mode "AzContext" (borrow this process's Azure session) is refused by name
|    if ([string](Get-Variable -Scope Global -Name SI_AuthMethod -ValueOnly -ErrorAction Ignore) -eq 'AzContext') {
|        throw ('SI_AuthMethod = AzContext (use the current Azure session of this PowerShell process) is no longer supported: SecurityInsight signs in itself. Supported sign-ins: {0}.' -f (Get-SISupportedSignInText))
|    }
|    if ([bool](Get-Variable -Scope Global -Name SI_UseManagedIdentity -ValueOnly -ErrorAction Ignore) -or [bool](Get-Variable -Scope Global -Name UseManagedIdentity -ValueOnly -ErrorAction Ignore)) {
|        return @{ Mode = 'ManagedIdentity'; ClientId = [string](Get-SIAzRestValue 'SI_UAMI_ClientId', 'SI_ManagedIdentityClientId') }
|    }
|    $tid   = Get-SIAzRestValue 'SI_SPN_TenantId', 'SpnTenantId', 'HighPriv_Modern_TenantID', 'AzureTenantId', 'TenantId'
|    $app   = Get-SIAzRestValue 'SI_SPN_AppId', 'SpnClientId', 'HighPriv_Modern_ApplicationID_Azure'
|    $thumb = Get-SIAzRestValue 'SI_SPN_CertThumbprint', 'SpnCertificateThumbprint', 'HighPriv_Modern_CertificateThumbprint_Azure'
|    $sec   = Get-SIAzRestValue 'SI_SPN_Secret', 'SpnClientSecret', 'HighPriv_Modern_Secret_Azure', 'HighPriv_Modern_ApplicationSecret_Azure'
|    if ($app -and $thumb -and $tid) { return @{ Mode = 'Certificate'; AppId = $app; TenantId = $tid; Thumbprint = ($thumb -replace '\s', '') } }
|    if ($app -and $sec -and $tid)   { return @{ Mode = 'Secret'; AppId = $app; TenantId = $tid; Secret = $sec } }
|    throw ('No sign-in is configured for Azure access over REST. Supported sign-ins: {0}.' -f (Get-SISupportedSignInText))
|}
|
|function Get-SIAzureAudience {
|    <# The token resource of each audience the REST path talks to. #>
|    param([Parameter(Mandatory)][ValidateSet('Arm', 'LaQuery', 'Storage', 'KeyVault', 'Graph', 'Monitor')][string]$Audience)
|    switch ($Audience) {
|        'Arm'      { 'https://management.azure.com/' }
|        'LaQuery'  { 'https://api.loganalytics.io/' }
|        'Storage'  { 'https://storage.azure.com/' }
|        'KeyVault' { 'https://vault.azure.net/' }
|        'Graph'    { 'https://graph.microsoft.com/' }
|        'Monitor'  { 'https://monitor.azure.com/' }
|    }
|}
|
|function Get-SIAzureToken {
|    <#
|        ONE token function for every audience: a bearer token as the identity Resolve-SIAzRestAuth names, minted by
|        Get-SILogIngestToken (managed identity endpoint / certificate client assertion / client secret), cached per
|        identity + audience until 5 minutes before expiry. -Audience or a raw -Resource; -Auth overrides the identity.
|    #>
|    param(
|        [ValidateSet('Arm', 'LaQuery', 'Storage', 'KeyVault', 'Graph', 'Monitor')][string]$Audience = 'Arm',
|        [string]$Resource,
|        [hashtable]$Auth,
|        [switch]$ForceRefresh
|    )
|    if (-not $Resource) { $Resource = Get-SIAzureAudience -Audience $Audience }
|    # A host that signs in its own way (setup, a test) can supply tokens: $global:SI_TokenProvider = { param($Resource) <token> }.
|    # Consulted first, only when no explicit -Auth was passed; an empty answer falls through to SecurityInsight's own sign-in.
|    if (-not $Auth) {
|        $tp = Get-Variable -Scope Global -Name SI_TokenProvider -ValueOnly -ErrorAction Ignore
|        if ($tp -is [scriptblock]) { $pt = [string](& $tp $Resource); if (-not [string]::IsNullOrWhiteSpace($pt)) { return $pt } }
|    }
|    Initialize-SIAzRestHelpers
|    if (-not $Auth) { $Auth = Resolve-SIAzRestAuth }
|    return (Get-SILogIngestToken -Resource $Resource -Auth $Auth -ForceRefresh:$ForceRefresh)
|}
|
|function ConvertFrom-SIJwtPayload {
|    <# PURE. The claims of a JWT (no signature check -- only used to read tid / exp / appid of our own token). #>
|    param([string]$Token)
|    $parts = ([string]$Token) -split '\.'
|    if ($parts.Count -lt 2) { return $null }
|    $p = $parts[1].Replace('-', '+').Replace('_', '/')
|    switch ($p.Length % 4) { 2 { $p += '==' } 3 { $p += '=' } }
|    try { return ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($p)) | ConvertFrom-Json) } catch { return $null }
|}
|
|function New-SIAzRestError {
|    <# An exception carrying the service's response (Response.StatusCode / Content / Headers), so the existing readers
|       (Get-SIKqlErrorText, the ledger's 412 match, ...) find what the service said. #>
|    param([string]$Message, $Response)
|    $ex = New-Object System.Exception($Message)
|    if ($Response) {
|        $r = [pscustomobject]@{ StatusCode = [int]$Response.StatusCode; Content = [string]$Response.Content; Headers = $Response.Headers }
|        Add-Member -InputObject $ex -NotePropertyName Response -NotePropertyValue $r -Force
|    }
|    return $ex
|}
|
|function Get-SIAzRestStatusName {
|    param([int]$Code)
|    if ($Code -le 0) { return 'NoResponse' }
|    try { return [string][System.Net.HttpStatusCode]$Code } catch { return [string]$Code }
|}
|
|function Invoke-SIAzRestRequest {
|    <#
|        One authenticated REST call with the retry rule:
|          429 / 408 / 5xx / no response -> PLATFORM: wait (Retry-After when sent) and retry in-run
|          401 once                      -> refresh the token, repeat once
|          404 with -AllowNotFound       -> $null
|          any other 4xx                 -> FAIL FAST with the body
|        Returns the response (StatusCode / Content / Bytes / Headers).
|    #>
|    param(
|        [string]$Method = 'GET',
|        [Parameter(Mandatory)][string]$Uri,
|        [ValidateSet('Arm', 'LaQuery', 'Storage', 'KeyVault', 'Graph', 'Monitor')][string]$Audience = 'Arm',
|        $Body,
|        [string]$ContentType = 'application/json',
|        [hashtable]$Headers,
|        [switch]$AllowNotFound,
|        [int[]]$AllowStatus = @(),
|        [switch]$AsBytes,
|        [int]$TimeoutSec = 300,
|        [int]$MaxAttempts = 6,
|        [string]$What = 'Azure request',
|        [hashtable]$Auth,  # another identity than the run's (the platform sign-in reads its Key Vault as the bootstrap identity)
|        # a 2xx body read as it arrives (Invoke-SIAzRestHttp -ReadStream); not through an Invardia support session, whose
|        # recording wrapper hands the answer back whole
|        [scriptblock]$ReadStream
|    )
|    $refreshed = $false; $force = $false
|    # #548: inside an Invardia support session every call SecurityInsight makes as the support app goes through Invardia's
|    # RECORDING wrapper (Invoke-InvardiaSupportRequest: the customer's audit log, fail-closed) -- never a raw token + HTTP.
|    # Every body and every answer goes through the wrapper: a binary body is sent unchanged, a binary answer (a download)
|    # comes back as its ContentBytes (Invardia, 2026-10-10).
|    $viaSupport = (Test-SISupportBodyIsText -Body $Body -ContentType $ContentType) -and (Test-SISupportRequestRoute -Audience $Audience -Auth $Auth -Uri $Uri)
|    for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
|        if ($viaSupport) {
|            $h = @{}
|            if ($Headers) { foreach ($k in $Headers.Keys) { $h[$k] = $Headers[$k] } }
|            $r = Invoke-SISupportHttp -Method $Method -Uri $Uri -Headers $h -Body $Body -ContentType $ContentType -AsBytes:$AsBytes -Audience $Audience -TimeoutSec $TimeoutSec
|        } else {
|            $token = Get-SIAzureToken -Audience $Audience -Auth $Auth -ForceRefresh:$force
|            $force = $false
|            $h = @{ 'Authorization' = ('Bearer ' + $token) }
|            if ($Headers) { foreach ($k in $Headers.Keys) { $h[$k] = $Headers[$k] } }
|            if ($ReadStream) { $r = Invoke-SIAzRestHttp -Method $Method -Uri $Uri -Headers $h -Body $Body -ContentType $ContentType -TimeoutSec $TimeoutSec -AsBytes:$AsBytes -ReadStream $ReadStream }
|            else { $r = Invoke-SIAzRestHttp -Method $Method -Uri $Uri -Headers $h -Body $Body -ContentType $ContentType -TimeoutSec $TimeoutSec -AsBytes:$AsBytes }
|        }
|        $code = [int]$r.StatusCode
|        if ($code -ge 200 -and $code -lt 300) { return $r }
|        if ($AllowStatus -contains $code) { return $r }
|        if ($code -eq 404 -and $AllowNotFound) { return $null }
|        if ($code -eq 401 -and -not $refreshed) { $refreshed = $true; $force = $true; continue }
|        $transient = ($code -eq 0 -or $code -eq 408 -or $code -eq 429 -or $code -ge 500)
|        if ($transient -and $attempt -lt $MaxAttempts) {
|            Initialize-SIAzRestHelpers
|            $wait = Get-SILogIngestRetryDelay -RetryAfter ([string]$r.RetryAfter) -Attempt $attempt
|            Write-Verbose ("{0}: HTTP {1}, retrying in {2}s (attempt {3}/{4})" -f $What, $code, $wait, $attempt, $MaxAttempts)
|            Start-Sleep -Seconds $wait
|            continue
|        }
|        $body = [string]$r.Content
|        if ($AsBytes -and $r.Bytes) { try { $body = [System.Text.Encoding]::UTF8.GetString($r.Bytes) } catch { } }
|        $errCode = ''
|        if ($r.Headers -and $r.Headers['x-ms-error-code']) { $errCode = ' ' + [string]$r.Headers['x-ms-error-code'] }
|        $resp = [pscustomobject]@{ StatusCode = $code; Content = $body; Headers = $r.Headers }
|        throw (New-SIAzRestError -Message ("{0} failed. HTTP Status: {1} ({2}){3} Response: {4}" -f $What, $code, (Get-SIAzRestStatusName $code), $errCode, $body) -Response $resp)
|    }
|    throw ("{0} failed after {1} attempts." -f $What, $MaxAttempts)
|}
|
|# =====================================================================================================================
|#  ARM, Resource Graph, Key Vault, Log Analytics
|# =====================================================================================================================
|
|function Test-SIArmBusyError {
|    <# PURE. #564: an ARM refusal that means "another operation on this resource is still running" (HTTP 409
|       OperationInProgress and its per-service names) -- a wait, not a failure. A plain 409 Conflict ("already exists") is NOT. #>
|    param([AllowEmptyString()][string]$Message)
|    [bool]("$Message" -match '(?i)\w*OperationInProgress|operation is (still )?in progress|another operation is (in progress|ongoing|running)|active provisioning operation|is currently being (updated|provisioned)')
|}
|
|function Invoke-SIArmWriteBusyRetry {
|    <#
|        #564 (PIM's install at customer I, 2026-10-10): ONE ARM write (PUT / PATCH / POST / DELETE) with a BOUNDED wait for a busy
|        resource: a write seconds after another change to the same resource is refused "409 OperationInProgress". Waits
|        $global:SI_ArmBusyWaits (default 6 x 20 s) between attempts, RE-READS the resource before each retry (PUT / PATCH /
|        DELETE: what Azure has now), and after a write that had to wait READS IT BACK until it is provisioned (about 60 s).
|        Any other failure is rethrown at once WITH ITS OWN ERROR; the last busy failure is rethrown after the last wait.
|        NOT a closure (a GetNewClosure() block cannot see the functions this file defines). $global:SI_ArmBusySleep
|        { param($Seconds) } is the test seam for the waits. Returns the response (Invoke-SIAzRestRequest's shape).
|    #>
|    param([Parameter(Mandatory)][string]$Method, [Parameter(Mandatory)][string]$Uri, $Json, [switch]$AllowNotFound, [string]$What = 'Azure Resource Manager write')
|    $waits = @(20, 20, 20, 20, 20, 20)
|    $gw = Get-Variable -Scope Global -Name SI_ArmBusyWaits -ValueOnly -ErrorAction Ignore
|    if ($null -ne $gw) { $waits = @($gw | ForEach-Object { [int]$_ }) }
|    $sleep = Get-Variable -Scope Global -Name SI_ArmBusySleep -ValueOnly -ErrorAction Ignore
|    $verb = $Method.ToUpperInvariant()
|    $resourceUri = if ($verb -in 'PUT', 'PATCH', 'DELETE') { $Uri } else { $null }
|    $try = 0; $waited = $false
|    while ($true) {
|        try { $r = Invoke-SIAzRestRequest -Method $Method -Uri $Uri -Body $Json -AllowNotFound:$AllowNotFound -What $What; break }
|        catch {
|            if (-not (Test-SIArmBusyError -Message ([string]$_.Exception.Message)) -or $try -ge $waits.Count) { throw }
|            $w = [int]$waits[$try]; $try++; $waited = $true
|            Write-Host ('       Azure is still busy with another change to {0} -- waiting {1} s, then trying again ({2}/{3}) ...' -f (($Uri -replace '\?.*$', '') -split '/')[-1], $w, $try, $waits.Count) -ForegroundColor DarkYellow
|            if ($w -gt 0) { if ($sleep -is [scriptblock]) { & $sleep $w } else { Start-Sleep -Seconds $w } }
|            # re-read before the retry: what Azure has now (never fails the write -- the retry decides)
|            if ($resourceUri) { try { $null = Invoke-SIAzRestRequest -Method GET -Uri $resourceUri -AllowNotFound -What ('Reading ' + $What) } catch { } }
|        }
|    }
|    if ($waited -and $verb -in 'PUT', 'PATCH') {
|        # read back: the write that waited is followed until Azure has provisioned it (bounded, about 60 s)
|        for ($i = 0; $i -lt 6; $i++) {
|            $back = $null
|            try { $back = Invoke-SIAzRestRequest -Method GET -Uri $resourceUri -AllowNotFound -What ('Reading back ' + $What) } catch { break }
|            $ps = ''
|            try { $ps = [string](($back.Content | ConvertFrom-Json).properties.provisioningState) } catch { $ps = '' }
|            if (-not $ps -or $ps -in 'Succeeded', 'Failed', 'Canceled', 'Cancelled') { break }
|            if ($sleep -is [scriptblock]) { & $sleep 10 } else { Start-Sleep -Seconds 10 }
|        }
|    }
|    $r
|}
|
|function Invoke-SIArm {
|    <#
|        Azure Resource Manager. -Path is '/subscriptions/...' (or a full https:// URL, e.g. a nextLink); -ApiVersion is
|        appended when the path has none. Returns the parsed body ($null for a 404 with -AllowNotFound).
|        -List returns every item of a list, following nextLink.
|    #>
|    param(
|        [string]$Method = 'GET',
|        [Parameter(Mandatory)][string]$Path,
|        [string]$ApiVersion,
|        $Body,
|        [switch]$AllowNotFound,
|        [switch]$List
|    )
|    $uri = if ($Path -match '^https://') { $Path } else { 'https://management.azure.com' + $Path }
|    if ($ApiVersion -and $uri -notmatch '[?&]api-version=') { $uri += $(if ($uri -match '\?') { '&' } else { '?' }) + 'api-version=' + $ApiVersion }
|    $json = if ($null -ne $Body -and -not ($Body -is [string])) { $Body | ConvertTo-Json -Depth 50 -Compress } else { $Body }
|    # #564 (PIM's install at customer I, 2026-10-10): an ARM POST ACTION with no body (listSecrets, listCredentials, listKeys,
|    # sharedKeys, a revision restart, a provider register) sends '{}' -- an empty body with a JSON content type was
|    # refused with HTTP 415.
|    if ($Method.ToUpperInvariant() -eq 'POST' -and ($null -eq $json -or ([string]$json) -eq '')) { $json = '{}' }
|    $what = 'Azure Resource Manager {0} {1}' -f $Method, ($uri -replace '\?.*$', '')
|    if (-not $List) {
|        if ($Method.ToUpperInvariant() -eq 'GET') { $r = Invoke-SIAzRestRequest -Method $Method -Uri $uri -Body $json -AllowNotFound:$AllowNotFound -What $what }
|        else { $r = Invoke-SIArmWriteBusyRetry -Method $Method -Uri $uri -Json $json -AllowNotFound:$AllowNotFound -What $what }
|        if (-not $r -or [string]::IsNullOrWhiteSpace([string]$r.Content)) { return $null }
|        return ($r.Content | ConvertFrom-Json)
|    }
|    $items = [System.Collections.Generic.List[object]]::new()
|    $next = $uri
|    while ($next) {
|        $r = Invoke-SIAzRestRequest -Method 'GET' -Uri $next -AllowNotFound:$AllowNotFound -What $what
|        if (-not $r) { break }
|        $page = $r.Content | ConvertFrom-Json
|        foreach ($v in @($page.value)) { if ($null -ne $v) { [void]$items.Add($v) } }
|        $next = [string]$page.nextLink
|    }
|    return $items.ToArray()
|}
|
|function Search-SIResourceGraph {
|    <# Resource Graph: EVERY row of -Query, following $skipToken. -Subscription / -ManagementGroup scope it; neither =
|       every subscription the identity can read (as Search-AzGraph without them). #>
|    param(
|        [Parameter(Mandatory)][string]$Query,
|        [string[]]$Subscription,
|        [string[]]$ManagementGroup,
|        [int]$PageSize = 1000
|    )
|    $rows = [System.Collections.Generic.List[object]]::new()
|    $skip = $null
|    do {
|        $page = Invoke-SIResourceGraphPage -Query $Query -Subscription $Subscription -ManagementGroup $ManagementGroup -First $PageSize -SkipToken $skip
|        foreach ($d in @($page.Data)) { if ($null -ne $d) { [void]$rows.Add($d) } }
|        $skip = [string]$page.SkipToken
|    } while ($skip)
|    return $rows.ToArray()
|}
|
|function Invoke-SIResourceGraphPage {
|    <# ONE Resource Graph page: @{ Data; SkipToken; TotalRecords }. #>
|    param([string]$Query, [string[]]$Subscription, [string[]]$ManagementGroup, [int]$First = 1000, [int]$Skip = 0, [string]$SkipToken)
|    $opt = [ordered]@{ resultFormat = 'objectArray'; '$top' = $First }
|    if ($Skip -gt 0) { $opt['$skip'] = $Skip }
|    if ($SkipToken) { $opt['$skipToken'] = $SkipToken }
|    $body = [ordered]@{ query = $Query; options = $opt }
|    $subs = @(@($Subscription) | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) })
|    $mgs  = @(@($ManagementGroup) | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) })
|    if ($subs.Count) { $body['subscriptions'] = [string[]]$subs }
|    if ($mgs.Count) { $body['managementGroups'] = [string[]]$mgs }
|    $r = Invoke-SIAzRestRequest -Method POST -Uri 'https://management.azure.com/providers/Microsoft.ResourceGraph/resources?api-version=2022-10-01' `
|             -Body ($body | ConvertTo-Json -Depth 10 -Compress) -What 'Resource Graph query'
|    $j = $r.Content | ConvertFrom-Json
|    $tok = $null
|    if ($j.PSObject.Properties['$skipToken']) { $tok = [string]$j.'$skipToken' }
|    return [pscustomobject]@{ Data = @($j.data); SkipToken = $tok; TotalRecords = $j.totalRecords }
|}
|
|function Get-SIKeyVaultSecretValue {
|    <# One Key Vault secret as plain text; $null when the secret does not exist. #>
|    param([Parameter(Mandatory)][string]$VaultName, [Parameter(Mandatory)][string]$Name, [string]$Version, [hashtable]$Auth)
|    $j = Get-SIKeyVaultSecretRaw -VaultName $VaultName -Name $Name -Version $Version -Auth $Auth
|    if (-not $j) { return $null }
|    return [string]$j.value
|}
|
|function Get-SIKeyVaultSecretRaw {
|    param([string]$VaultName, [string]$Name, [string]$Version, [hashtable]$Auth)
|    $v = if ($Version) { '/' + $Version } else { '' }
|    $uri = 'https://{0}.vault.azure.net/secrets/{1}{2}?api-version=7.4' -f $VaultName, [uri]::EscapeDataString($Name), $v
|    $r = Invoke-SIAzRestRequest -Method GET -Uri $uri -Audience KeyVault -AllowNotFound -Auth $Auth -What ("Key Vault secret '{0}' in '{1}'" -f $Name, $VaultName)
|    if (-not $r) { return $null }
|    return ($r.Content | ConvertFrom-Json)
|}
|
|function ConvertTo-SIAzLaCellString {
|    <# One Log Analytics cell, as Az.OperationalInsights hands it to callers: TEXT. Strings and dates stay as the
|       service sent them, numbers keep their JSON spelling, booleans are 'true' / 'false', null stays null, nested
|       values are JSON text. #>
|    param($Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [string]) { return $Value }
|    if ($Value -is [bool]) { if ($Value) { return 'true' } else { return 'false' } }
|    if ($Value -is [datetime]) { return $Value.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.FFFFFFFZ', [System.Globalization.CultureInfo]::InvariantCulture) }
|    if ($Value -is [System.IFormattable]) { return $Value.ToString($null, [System.Globalization.CultureInfo]::InvariantCulture) }
|    return (ConvertTo-Json -InputObject $Value -Depth 20 -Compress)
|}
|
|function ConvertFrom-SILaQueryJson {
|    <#
|        The Log Analytics query response -> @{ Tables = @( @{ Name; Columns = @(@{name;type}); Rows = @(@(cells as text)) } ); Error }.
|        pwsh 7: System.Text.Json, so a date stays the exact text the service sent (ConvertFrom-Json would turn it into a
|        local DateTime). Windows PowerShell 5.1: ConvertFrom-Json, which leaves dates as text.
|    #>
|    param([Parameter(Mandatory)][string]$Json)
|    $tables = [System.Collections.Generic.List[object]]::new()
|    $err = $null
|    if ($PSVersionTable.PSEdition -eq 'Core') {
|        $doc = [System.Text.Json.JsonDocument]::Parse($Json)
|        try {
|            $root = $doc.RootElement
|            $tEl = [System.Text.Json.JsonElement]::new()
|            if ($root.TryGetProperty('tables', [ref]$tEl)) {
|                foreach ($t in $tEl.EnumerateArray()) {
|                    $cols = [System.Collections.Generic.List[object]]::new()
|                    foreach ($c in $t.GetProperty('columns').EnumerateArray()) {
|                        $ty = [System.Text.Json.JsonElement]::new(); $tyS = ''
|                        if ($c.TryGetProperty('type', [ref]$ty)) { $tyS = $ty.GetString() }
|                        [void]$cols.Add([pscustomobject]@{ name = $c.GetProperty('name').GetString(); type = $tyS })
|                    }
|                    $rows = [System.Collections.Generic.List[object]]::new()
|                    foreach ($row in $t.GetProperty('rows').EnumerateArray()) {
|                        $cells = [System.Collections.Generic.List[object]]::new()
|                        foreach ($cell in $row.EnumerateArray()) {
|                            switch ($cell.ValueKind.ToString()) {
|                                'String' { [void]$cells.Add($cell.GetString()) }
|                                'Null'   { [void]$cells.Add($null) }
|                                'True'   { [void]$cells.Add('true') }
|                                'False'  { [void]$cells.Add('false') }
|                                default  { [void]$cells.Add($cell.GetRawText()) }
|                            }
|                        }
|                        [void]$rows.Add($cells.ToArray())
|                    }
|                    $nm = [System.Text.Json.JsonElement]::new(); $nmS = ''
|                    if ($t.TryGetProperty('name', [ref]$nm)) { $nmS = $nm.GetString() }
|                    [void]$tables.Add([pscustomobject]@{ Name = $nmS; Columns = $cols.ToArray(); Rows = $rows.ToArray() })
|                }
|            }
|            $eEl = [System.Text.Json.JsonElement]::new()
|            if ($root.TryGetProperty('error', [ref]$eEl) -and $eEl.ValueKind.ToString() -ne 'Null') { $err = ($eEl.GetRawText() | ConvertFrom-Json) }
|        } finally { $doc.Dispose() }
|    } else {
|        $j = $Json | ConvertFrom-Json
|        foreach ($t in @($j.tables)) {
|            if ($null -eq $t) { continue }
|            $rows = [System.Collections.Generic.List[object]]::new()
|            foreach ($row in @($t.rows)) {
|                $cells = [System.Collections.Generic.List[object]]::new()
|                foreach ($cell in @($row)) { [void]$cells.Add((ConvertTo-SIAzLaCellString $cell)) }
|                [void]$rows.Add($cells.ToArray())
|            }
|            [void]$tables.Add([pscustomobject]@{ Name = [string]$t.name; Columns = @($t.columns); Rows = $rows.ToArray() })
|        }
|        if ($j.PSObject.Properties['error'] -and $j.error) { $err = $j.error }
|    }
|    return [pscustomobject]@{ Tables = $tables.ToArray(); Error = $err }
|}
|
|function Get-SILaCompactRowType {
|    <#
|        #711. A .NET class for one column list: one public text property per column, in the column order, built from the
|        row's values in one call (new(string[])). Built once per column list and process (Add-Type, pwsh 7 / .NET 8) and
|        reused. $null when it cannot be built -- a column name that is not a plain identifier, two names that differ only in
|        case (PowerShell reads properties without case), Windows PowerShell -- and the caller keeps PSCustomObject rows.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][string[]]$Names)
|    if ($PSVersionTable.PSEdition -ne 'Core' -or $Names.Count -eq 0) { return $null }
|    if ($null -eq $script:SILaCompactRowTypes) { $script:SILaCompactRowTypes = @{} }
|    $key = ($Names -join "`n")
|    if ($script:SILaCompactRowTypes.ContainsKey($key)) { return $script:SILaCompactRowTypes[$key] }
|    $type = $null
|    try {
|        $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([System.StringComparer]::OrdinalIgnoreCase)
|        foreach ($n in $Names) { if ($n -notmatch '^[A-Za-z_][A-Za-z0-9_]*$' -or -not $seen.Add($n)) { throw ('not a plain column name: {0}' -f $n) } }
|        $sha = [System.Security.Cryptography.SHA256]::Create()
|        try { $h = ([System.BitConverter]::ToString($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($key))) -replace '-', '').Substring(0, 20) } finally { $sha.Dispose() }
|        $cls = 'R' + $h
|        $full = 'SecurityInsight.LaRows.' + $cls
|        $type = $full -as [type]
|        if ($null -eq $type) {
|            $sb = New-Object System.Text.StringBuilder
|            [void]$sb.Append('namespace SecurityInsight.LaRows { public sealed class ').Append($cls).Append(' { ')
|            foreach ($n in $Names) { [void]$sb.Append('public string @').Append($n).Append(' { get; set; } ') }
|            [void]$sb.Append('public ').Append($cls).Append('(string[] v) { ')
|            for ($i = 0; $i -lt $Names.Count; $i++) { [void]$sb.Append('this.@').Append($Names[$i]).Append(' = v[').Append($i).Append(']; ') }
|            [void]$sb.Append('} } }')
|            Add-Type -TypeDefinition $sb.ToString() -Language CSharp -ErrorAction Stop
|            $type = $full -as [type]
|        }
|    } catch { $type = $null }
|    $script:SILaCompactRowTypes[$key] = $type
|    return $type
|}
|
|function ConvertFrom-SILaQueryRows {
|    <#
|        The Log Analytics query response AS THE BYTES THE SERVICE SENT -> @{ Rows; Error }: the primary table's rows, one
|        object per row, one TEXT property per column -- the same rows Invoke-SILaQuery hands out as .Results.
|        For large answers (Invoke-SILaQuery -RowsOnly): the bytes are parsed where they are. The answer is never also held
|        as one text (twice its size), as a second copy of every table, or as a list of cells per row -- on a large install
|        those copies together ran a job out of memory. pwsh 7 only (System.Text.Json).
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][byte[]]$Bytes)
|    $rows = [System.Collections.Generic.List[object]]::new()
|    $cols = [System.Collections.Generic.List[object]]::new()
|    $err = $null
|    $doc = [System.Text.Json.JsonDocument]::Parse([System.ReadOnlyMemory[byte]]::new($Bytes))
|    try {
|        $root = $doc.RootElement
|        $tEl = [System.Text.Json.JsonElement]::new()
|        if ($root.TryGetProperty('tables', [ref]$tEl)) {
|            # the table named PrimaryResult, else the first one -- as .Results has always been chosen
|            $have = $false
|            $pick = [System.Text.Json.JsonElement]::new()
|            foreach ($t in $tEl.EnumerateArray()) {
|                $nm = [System.Text.Json.JsonElement]::new(); $nmS = ''
|                if ($t.TryGetProperty('name', [ref]$nm)) { $nmS = [string]$nm.GetString() }
|                if (-not $have) { $pick = $t; $have = $true }
|                if ($nmS -eq 'PrimaryResult') { $pick = $t; break }
|            }
|            if ($have) {
|                $names = [System.Collections.Generic.List[string]]::new()
|                foreach ($c in $pick.GetProperty('columns').EnumerateArray()) {
|                    $names.Add([string]$c.GetProperty('name').GetString())
|                    $ty = [System.Text.Json.JsonElement]::new(); $tyS = $null
|                    if ($c.TryGetProperty('type', [ref]$ty)) { $tyS = $ty.GetString() }
|                    $cols.Add([pscustomobject]@{ name = $names[$names.Count - 1]; type = $tyS })
|                }
|                $nCols = $names.Count
|                # #711: a caller that keeps the rows for long (Risk Analysis' lookups) asks for COMPACT rows -- one small
|                # .NET object per row with one text property per column (Get-SILaCompactRowType), not a PSCustomObject
|                # (measured on the test VM: ~6 KB per row of 11 columns as a PSCustomObject). Read the same way by
|                # every reader ($row.Col, $row.PSObject.Properties['Col'].Value). Not available -> the rows as always.
|                $compactType = $null
|                if ([bool]$global:SI_LaCompactRows) { $compactType = Get-SILaCompactRowType -Names $names.ToArray() }
|                if ($null -ne $compactType) {
|                    # a short value that repeats (a tier, a flag, an empty text, a short factor list) is held once per read
|                    $pool = [System.Collections.Generic.Dictionary[string, string]]::new([System.StringComparer]::Ordinal)
|                    foreach ($row in $pick.GetProperty('rows').EnumerateArray()) {
|                        # a null cell is left as the array's own null (assigning $null to a [string] element would make it '')
|                        $vals = [string[]]::new($nCols)
|                        $i = 0
|                        foreach ($cell in $row.EnumerateArray()) {
|                            if ($i -ge $nCols) { break }
|                            $kind = $cell.ValueKind.ToString()
|                            if ($kind -ne 'Null') {
|                                $s = if ($kind -eq 'String') { $cell.GetString() } elseif ($kind -eq 'True') { 'true' } elseif ($kind -eq 'False') { 'false' } else { $cell.GetRawText() }
|                                if ($s.Length -le 32) { $p0 = $null; if ($pool.TryGetValue($s, [ref]$p0)) { $s = $p0 } else { $pool[$s] = $s } }
|                                $vals[$i] = $s
|                            }
|                            $i++
|                        }
|                        [void]$rows.Add($compactType::new($vals))
|                    }
|                    $nCols = -1
|                }
|                if ($nCols -ge 0) {
|                foreach ($row in $pick.GetProperty('rows').EnumerateArray()) {
|                    $o = [ordered]@{}
|                    $i = 0
|                    foreach ($cell in $row.EnumerateArray()) {
|                        if ($i -ge $nCols) { break }
|                        $name = $names[$i]
|                        $kind = $cell.ValueKind.ToString()
|                        if ($kind -eq 'String') { $o[$name] = $cell.GetString() }
|                        elseif ($kind -eq 'Null') { $o[$name] = $null }
|                        elseif ($kind -eq 'True') { $o[$name] = 'true' }
|                        elseif ($kind -eq 'False') { $o[$name] = 'false' }
|                        else { $o[$name] = $cell.GetRawText() }
|                        $i++
|                    }
|                    # a row shorter than its columns: the missing ones are empty, as before
|                    for (; $i -lt $nCols; $i++) { $o[$names[$i]] = $null }
|                    [void]$rows.Add([pscustomobject]$o)
|                }
|                }
|            }
|        }
|        $eEl = [System.Text.Json.JsonElement]::new()
|        if ($root.TryGetProperty('error', [ref]$eEl) -and $eEl.ValueKind.ToString() -ne 'Null') { $err = ($eEl.GetRawText() | ConvertFrom-Json) }
|    } finally { $doc.Dispose() }
|    return [pscustomobject]@{ Rows = $rows.ToArray(); Columns = $cols.ToArray(); Error = $err }
|}
|
|function Get-SILaServiceRowLimit {
|    <# The most rows ONE Log Analytics query answer carries (the service's own limit). An answer holding exactly that many
|       rows cannot be told from an answer the service cut there. $global:SI_LaServiceRowLimit overrides it (tests). #>
|    $v = 0L
|    try { $v = [long]$global:SI_LaServiceRowLimit } catch { $v = 0L }
|    if ($v -gt 0) { return $v }
|    return 500000L
|}
|
|function Get-SILaPartialVerdict {
|    <#
|        PURE. What a Log Analytics partial answer (the "error" object beside the rows of an HTTP 200 answer) says, read from
|        its LEAVES (the innermost error objects -- the outer ones are generic). Returns @{ Kind; Code; Detail; Tables }:
|          Unresolved  every leaf is "Failed to resolve table or column expression named 'SI_..._CL'": a `union isfuzzy=true`
|                      leg over a SecurityInsight table this workspace does not have yet. The answer IS the whole result (the
|                      missing table has no rows) -- the one partial answer that is not a cut one.
|          Limit       a leaf names a limit (rows / size / time / memory): the answer is CUT; a smaller read fixes it.
|          Other       anything else: the answer is short, and a smaller read does not fix it.
|        The same reading as Risk Analysis' own (RA-LaPartedRead.ps1 Get-RALaPartialVerdict); kept here so every reader of
|        Log Analytics refuses a cut answer, not only Risk Analysis.
|        -MayBeMissing (2026-10-23): other tables the CALLER names that this workspace may not have (the capability probe's
|        SecurityIncident / SecurityAlert in a workspace without Sentinel): a leaf that cannot resolve one of them is
|        Unresolved too -- the answer is whole, the table has no rows. Only the tables named; never any other.
|    #>
|    param([AllowNull()][object]$ErrorObject, [string[]]$MayBeMissing = @())
|    $leaves = New-Object System.Collections.Generic.List[string]
|    $all = New-Object System.Collections.Generic.List[string]
|    $codes = New-Object System.Collections.Generic.List[string]
|    $get = {
|        param($o, $n)
|        if ($null -eq $o) { return $null }
|        if ($o -is [System.Collections.IDictionary]) { if ($o.Contains($n)) { return $o[$n] }; return $null }
|        $p = $o.PSObject.Properties[$n]; if ($p) { return $p.Value }; return $null
|    }
|    $stack = New-Object System.Collections.Stack
|    if ($null -ne $ErrorObject -and $ErrorObject -isnot [string]) { $stack.Push($ErrorObject) }
|    $visited = 0
|    while ($stack.Count -gt 0 -and $visited -lt 256) {
|        $o = $stack.Pop(); $visited++
|        if ($null -eq $o -or $o -is [string]) { continue }
|        $m = [string](& $get $o 'message'); $c = [string](& $get $o 'code')
|        if ($c -and $codes.Count -lt 3 -and -not $codes.Contains($c)) { $codes.Add($c) }
|        if ($m) { $all.Add($m) }
|        $children = New-Object System.Collections.Generic.List[object]
|        $ie = & $get $o 'innererror'; if ($null -ne $ie -and $ie -isnot [string]) { $children.Add($ie) }
|        $ds = & $get $o 'details'
|        if ($null -ne $ds) { foreach ($d in @($ds)) { if ($null -ne $d -and $d -isnot [string]) { $children.Add($d) } } }
|        if ($children.Count -eq 0) { if ($m) { $leaves.Add($m) } }
|        else { for ($i = $children.Count - 1; $i -ge 0; $i--) { $stack.Push($children[$i]) } }
|    }
|    if ($null -ne $ErrorObject -and $ErrorObject -is [string]) { $leaves.Add([string]$ErrorObject); $all.Add([string]$ErrorObject) }
|    $generic = '^(There were some errors when processing your query\.?|Something went wrong processing your query on the server\.?)$'
|    $specific = @($all | Where-Object { $_ -notmatch $generic } | Select-Object -Unique)
|    $detail = (@($specific) -join '; ')
|    if (-not $detail) { $detail = (@($all | Select-Object -Unique) -join '; ') }
|    if ($detail.Length -gt 400) { $detail = $detail.Substring(0, 400) + '...' }
|    $code = (@($codes) -join '/')
|    # a 'union' leaf says "table expression", a 'where' leaf "table or column expression" (both: the table is not there)
|    $rx = "Failed to resolve table (?:or column )?expression named '(?<t>[A-Za-z0-9_]+)'"
|    $okMissing = { param($t) ($t -match '^SI_[A-Za-z0-9_]+_CL$') -or (@($MayBeMissing | Where-Object { $_ -and [string]$_ -ieq $t }).Count -gt 0) }
|    $tables = New-Object System.Collections.Generic.List[string]
|    $leafSpecific = @($leaves | Where-Object { $_ -notmatch $generic })
|    $allResolve = ($leafSpecific.Count -gt 0)
|    foreach ($l in $leafSpecific) {
|        $mm = [regex]::Match($l, $rx)
|        if (-not $mm.Success -or -not (& $okMissing $mm.Groups['t'].Value)) { $allResolve = $false; break }
|        if (-not $tables.Contains($mm.Groups['t'].Value)) { $tables.Add($mm.Groups['t'].Value) }
|    }
|    if ($allResolve) { return @{ Kind = 'Unresolved'; Code = $code; Detail = $detail; Tables = $tables.ToArray() } }
|    $limitRx = '(?i)limit|exceeded|too large|E_QUERY_RESULT_SET_TOO_LARGE|timed out|timeout|E_RUNAWAY|out of memory|memory|truncat|cancell?ed|preempted'
|    if (@($all | Where-Object { $_ -match $limitRx }).Count -gt 0) { return @{ Kind = 'Limit'; Code = $code; Detail = $detail; Tables = @() } }
|    return @{ Kind = 'Other'; Code = $code; Detail = $detail; Tables = @() }
|}
|
|function Test-SILaAnswerWhole {
|    <#
|        PURE. Is a Log Analytics answer the WHOLE result? -ErrorObject: the partial-error object beside the rows; -Rows: how
|        many rows the answer held. Returns @{ Whole; Kind; Code; Detail; Tables; Rows }:
|          no error and fewer rows than the service's own row limit   -> whole
|          an Unresolved partial error (a missing SI table in a fuzzy union)  -> whole (the missing table has no rows)
|          a Limit / Other partial error                              -> NOT whole
|          no error, but exactly as many rows as the service's limit  -> NOT whole (Limit): it cannot be told from a cut answer
|    #>
|    # -MayBeMissing: as Get-SILaPartialVerdict (the tables the caller names that the workspace may not have)
|    param([AllowNull()][object]$ErrorObject, [long]$Rows = 0, [string[]]$MayBeMissing = @())
|    if ($null -ne $ErrorObject) {
|        $v = Get-SILaPartialVerdict -ErrorObject $ErrorObject -MayBeMissing $MayBeMissing
|        return @{ Whole = ($v.Kind -eq 'Unresolved'); Kind = $v.Kind; Code = $v.Code; Detail = $v.Detail; Tables = $v.Tables; Rows = $Rows }
|    }
|    $cap = Get-SILaServiceRowLimit
|    if ($Rows -ge $cap) {
|        $d = [string]::Format([System.Globalization.CultureInfo]::InvariantCulture, 'the answer holds {0:N0} rows, the most one answer carries (the service''s limit of {1:N0} rows) -- it cannot be told from a cut answer', $Rows, $cap)
|        return @{ Whole = $false; Kind = 'Limit'; Code = 'RowLimit'; Detail = $d; Tables = @(); Rows = $Rows }
|    }
|    return @{ Whole = $true; Kind = ''; Code = ''; Detail = ''; Tables = @(); Rows = $Rows }
|}
|
|function New-SILaCutAnswerError {
|    <#
|        The error a refused cut answer becomes (Invoke-SILaQuery without -AllowPartial). An ErrorRecord whose exception
|        carries the service's own words three ways, so every classifier that reads a failed query finds them:
|          * the message: "Log Analytics returned a PARTIAL answer (<code>: <detail>) -- ..."; a Limit also says "Query
|            execution has exceeded the allowed limits" (the text Risk Analysis' bucket logic makes a slice smaller on);
|          * Exception.Response.Content and ErrorDetails: the error object as JSON (Get-SIKqlErrorText -> the data sync's
|            "too large" check, Test-SIDataResponseTooLarge, cuts that page in two);
|          * Exception.Data: SILaPartial / SIRALaPartial = the kind, SIRALaPartialRows = the rows the short answer held (Risk
|            Analysis' parted reader measures with them).
|    #>
|    param([Parameter(Mandatory)][hashtable]$Verdict, [AllowNull()][object]$ErrorObject, [string]$WorkspaceId = '')
|    $msg = if ($Verdict.Kind -eq 'Limit') {
|        "Log Analytics returned a PARTIAL answer ({0}: {1}) -- Query execution has exceeded the allowed limits; the rows it returned are not the whole result and were not used" -f $Verdict.Code, $Verdict.Detail
|    } else {
|        "Log Analytics returned a PARTIAL answer ({0}: {1}) -- the rows it returned are not the whole result and were not used" -f $Verdict.Code, $Verdict.Detail
|    }
|    $json = ''
|    if ($null -ne $ErrorObject) { try { $json = ConvertTo-Json -InputObject ([pscustomobject]@{ error = $ErrorObject }) -Depth 12 -Compress } catch { $json = [string]$ErrorObject } }
|    else { $json = ConvertTo-Json -InputObject ([pscustomobject]@{ error = [pscustomobject]@{ code = [string]$Verdict.Code; message = [string]$Verdict.Detail } }) -Depth 4 -Compress }
|    $ex = New-SIAzRestError -Message $msg -Response ([pscustomobject]@{ StatusCode = 200; Content = $json; Headers = @{} })
|    $ex.Data['SILaPartial'] = [string]$Verdict.Kind
|    $ex.Data['SIRALaPartial'] = [string]$Verdict.Kind
|    $ex.Data['SIRALaPartialRows'] = [long]$Verdict.Rows
|    $er = New-Object System.Management.Automation.ErrorRecord($ex, 'SILaQueryPartial', [System.Management.Automation.ErrorCategory]::LimitsExceeded, $WorkspaceId)
|    $er.ErrorDetails = New-Object System.Management.Automation.ErrorDetails($json)
|    return $er
|}
|
|function Test-SILaCutAnswerError {
|    <# PURE. Was this failure a cut answer Invoke-SILaQuery refused (New-SILaCutAnswerError)? -Kind: only that kind. #>
|    param([AllowNull()][object]$Err, [string]$Kind = '')
|    $ex = $null
|    if ($Err -is [System.Management.Automation.ErrorRecord]) { $ex = $Err.Exception } elseif ($Err -is [System.Exception]) { $ex = $Err }
|    while ($null -ne $ex) {
|        if ($ex.Data -and $ex.Data.Contains('SILaPartial')) { return ((-not $Kind) -or ([string]$ex.Data['SILaPartial'] -eq $Kind)) }
|        $ex = $ex.InnerException
|    }
|    return $false
|}
|
|function Invoke-SILaQuery {
|    <#
|        A KQL query on the Log Analytics DATA PLANE: POST https://api.loganalytics.io/v1/workspaces/{id}/query. Not the
|        ARM /api/query route, which hides the semantic error behind a generic one.
|        Returns the shape Invoke-AzOperationalInsightsQuery returns and every caller reads:
|            .Results   the primary table's rows, one object per row, one TEXT property per column (as Az hands them)
|            .Columns   the primary table's columns (name / type) -- what the workbooks type their columns from
|            .Tables    ONE entry: the primary table's Name and Columns, NO rows (RowsOmitted). The rows are in .Results only;
|                       the answer is never held a second time as tables beside them (#639). No caller reads table rows.
|            .Error     the partial-error object (or $null) -- only ever set beside rows that ARE the whole result (a missing SI
|                       table in a fuzzy union), or with -AllowPartial
|            .RowCount  the rows the answer held (with -OnPage: the rows handed to it)
|        A CUT ANSWER IS REFUSED (#639, working rule 4). Log Analytics answers HTTP 200 with the rows it got to AND an error
|        object when it stopped early (a result over its row / size limit, a part that timed out); an answer with exactly as
|        many rows as the service's own row limit cannot be told from one cut there. Such an answer THROWS
|        (New-SILaCutAnswerError: the service's words, the kind, the rows it held) -- a cut answer is never handed out as
|        whole. -AllowPartial: the caller reads .Error itself and decides (the rows and the error come back as before, and
|        .Partial says the kind). A read that pages (its query keys the rows) catches the "too large" refusal and reads that
|        page again in smaller pages -- the refusal carries the same words the cut answer did.
|        -OnPage { param($Rows) }: the rows are handed on a PAGE at a time as they arrive (about -PageBytes of answer each,
|        the size measured from the answer's own bytes) and never collected -- memory is one page, whatever the size of the
|        answer. .Results is then empty. The pages are PROVISIONAL until this call returns: a cut answer (said at the END of
|        the answer) or a read that fails half-way throws AFTER pages were handed on, so a caller stages the pages and keeps
|        them only when the call returned. Without the streaming reader (Windows PowerShell, or it cannot be built) the
|        answer is read the older way and then handed on in pages of the same size.
|        THE LEAN READ IS THE DEFAULT (#639): on pwsh 7 the answer arrives as bytes and its rows are read from those bytes
|        (ConvertFrom-SILaQueryRows) -- never also held as one text (twice its size) or as a list of cells per row. The same
|        rows and the same text values as before. Windows PowerShell (no System.Text.Json) reads the text, as always.
|        -WorkspaceId is the workspace's customer id (GUID). -Wait = server timeout in seconds (Prefer: wait=N).
|        -RowsOnly is kept for the callers that name it; it is what every read does now.
|        A refused query throws with the service's own code and message, e.g.
|            "Operation returned an invalid status code 'BadRequest' -- BadArgumentError/SemanticError/SEM0100: ..."
|        and carries the body in Exception.Response.Content and ErrorDetails -- what SI-KqlError.ps1 reads.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$WorkspaceId,
|        [Parameter(Mandatory)][string]$Query,
|        [int]$Wait = 0,
|        [timespan]$Timespan = [timespan]::Zero,
|        [int]$MaxAttempts = 4,
|        [switch]$RowsOnly,
|        # the caller reads .Error itself and decides what a cut answer means (never the default)
|        [switch]$AllowPartial,
|        # the rows a page at a time, never collected (see above)
|        [scriptblock]$OnPage,
|        [long]$PageBytes = 4MB
|    )
|    Initialize-SIAzRestHelpers
|    if ($OnPage) {
|        return (Invoke-SILaQueryPaged -WorkspaceId $WorkspaceId -Query $Query -Wait $Wait -Timespan $Timespan -MaxAttempts $MaxAttempts -AllowPartial:$AllowPartial -OnPage $OnPage -PageBytes $PageBytes)
|    }
|    $uri = 'https://api.loganalytics.io/v1/workspaces/{0}/query' -f $WorkspaceId.Trim()
|    $body = [ordered]@{ query = $Query }
|    if ($Timespan -gt [timespan]::Zero) { $body['timespan'] = [System.Xml.XmlConvert]::ToString($Timespan) }
|    $headers = @{}
|    $timeout = 300
|    # #882 (A4): Log Analytics stops a query at 3 minutes unless asked to wait -- every query asks for its maximum (10 minutes)
|    if ($Wait -le 0) { $Wait = 600 }
|    if ($Wait -gt 0) { $headers['Prefer'] = ('wait={0}' -f $Wait); $timeout = $Wait + 60 }
|    # the answer as bytes wherever it can be read from them (pwsh 7) -- the lean read is the default (#639)
|    $asBytes = ([bool]$RowsOnly -or $PSVersionTable.PSEdition -eq 'Core')
|    # #730: Risk Analysis' reads (its lookups -- SI_LaCompactRows -- and its Log Analytics answers -- SI_LaStreamRows) are
|    # read AS THEY ARRIVE (SI-LaStreamRead.ps1): the same rows, the answer never held whole. Everything else reads as before.
|    $readStream = $null
|    if ($PSVersionTable.PSEdition -eq 'Core' -and ([bool]$global:SI_LaCompactRows -or [bool]$global:SI_LaStreamRows) -and
|        (Get-Command -Name Get-SILaStreamReaderType -ErrorAction Ignore)) {
|        if (Get-SILaStreamReaderType) {
|            $__lsCompact = [bool]$global:SI_LaCompactRows
|            # (no closure: it runs inside this call, so $__lsCompact is seen; a closure would not see this file's functions)
|            # #836: a failed stream read answers a marker -- read again below the older way, never an error of the query
|            $readStream = { param($s) Read-SILaQueryStreamSafe -Stream $s -Compact:$__lsCompact }
|        } else {
|            # #836: never silent -- one line on the run log says the older read is used and why
|            Write-SILaStreamFallback -Once -Reason ([string]$global:SI_LaStreamReaderOff)
|        }
|    }
|    $rq = @{ Method = 'POST'; Uri = $uri; Audience = 'LaQuery'; Body = ($body | ConvertTo-Json -Compress -Depth 5); Headers = $headers
|             TimeoutSec = $timeout; MaxAttempts = $MaxAttempts; AllowStatus = @(400, 403, 404, 409, 413, 422); What = 'Log Analytics query'; AsBytes = $asBytes }
|    if ($readStream) { $rq['ReadStream'] = $readStream }
|    $r = Invoke-SIAzRestRequest @rq
|    if ($readStream -and $r -and $r.PSObject.Properties['Parsed'] -and $null -ne $r.Parsed -and $r.Parsed.PSObject.Properties['SILaStreamFailed']) {
|        # #836: the stream read of this answer failed -- the same query again, read the older way (data first), and said
|        Write-SILaStreamFallback -Reason ('reading this answer as it arrived failed (' + [string]$r.Parsed.SILaStreamFailed + '), so it was read again')
|        $r = $null
|        [void]$rq.Remove('ReadStream')
|        $r = Invoke-SIAzRestRequest @rq
|    }
|    if ($r -and $r.PSObject.Properties['Parsed'] -and $null -ne $r.Parsed -and [int]$r.StatusCode -lt 400) {
|        $streamed = $r.Parsed
|        $r = $null
|        return (Complete-SILaQueryAnswer -Results $streamed.Rows -Columns $streamed.Columns -QueryError $streamed.Error -AllowPartial:$AllowPartial -WorkspaceId $WorkspaceId)
|    }
|    $code = [int]$r.StatusCode
|    # A refusal (always small) is read as text, as is every answer on Windows PowerShell (no System.Text.Json there); an
|    # answer on pwsh 7 is parsed from its bytes below.
|    $content = [string]$r.Content
|    $hasBytes = ($asBytes -and $null -ne $r.Bytes -and $r.Bytes.Length -gt 0)
|    $lean = ($hasBytes -and $code -lt 400 -and $PSVersionTable.PSEdition -eq 'Core')
|    if ($hasBytes -and -not $lean) { $content = [System.Text.Encoding]::UTF8.GetString($r.Bytes) }
|    if ($code -ge 400) { throw (New-SILaQueryRefusedError -Code $code -Content $content -Headers $r.Headers -WorkspaceId $WorkspaceId) }
|    if ($lean) {
|        # a plain statement, never through $( ... ): a subexpression would enumerate the byte array into object[]
|        [byte[]]$answer = $r.Bytes
|        $r = $null
|        $leanAnswer = ConvertFrom-SILaQueryRows -Bytes $answer
|        $answer = $null
|        return (Complete-SILaQueryAnswer -Results $leanAnswer.Rows -Columns $leanAnswer.Columns -QueryError $leanAnswer.Error -AllowPartial:$AllowPartial -WorkspaceId $WorkspaceId)
|    }
|    $parsed = ConvertFrom-SILaQueryJson -Json $content
|    $content = $null
|    $results = [System.Collections.Generic.List[object]]::new()
|    $first = @($parsed.Tables | Where-Object { $_.Name -eq 'PrimaryResult' }) + @($parsed.Tables) | Select-Object -First 1
|    $cols = @()
|    if ($first) {
|        $names = @($first.Columns | ForEach-Object { [string]$_.name })
|        $cols = @($first.Columns | ForEach-Object { [pscustomobject]@{ name = [string]$_.name; type = $(if ($_.PSObject.Properties['type']) { [string]$_.type } else { $null }) } })
|        foreach ($row in $first.Rows) {
|            $o = [ordered]@{}
|            for ($i = 0; $i -lt $names.Count; $i++) { $o[$names[$i]] = $row[$i] }
|            [void]$results.Add([pscustomobject]$o)
|        }
|    }
|    $err = $parsed.Error
|    $parsed = $null; $first = $null
|    return (Complete-SILaQueryAnswer -Results $results.ToArray() -Columns $cols -QueryError $err -AllowPartial:$AllowPartial -WorkspaceId $WorkspaceId)
|}
|
|function New-SILaQueryRefusedError {
|    <# The error a refused query (HTTP 4xx) becomes: the service's own code and message, the body for SI-KqlError. #>
|    param([int]$Code, [AllowNull()][AllowEmptyString()][string]$Content, $Headers, [string]$WorkspaceId = '')
|    $base = "Operation returned an invalid status code '{0}'" -f (Get-SIAzRestStatusName $Code)
|    $resp = [pscustomobject]@{ StatusCode = $Code; Content = $Content; Headers = $Headers }
|    $probe = New-SIAzRestError -Message $base -Response $resp
|    $msg = Get-SIKqlErrorSummary -ErrorRecord $probe
|    if ($msg -eq $base) {
|        # no innererror chain: the top-level error code + message
|        try { $e = ($Content | ConvertFrom-Json).error; if ($e) { $msg = ('{0} -- {1}: {2}' -f $base, [string]$e.code, [string]$e.message) } } catch { }
|    }
|    $ex = New-SIAzRestError -Message $msg -Response $resp
|    $er = New-Object System.Management.Automation.ErrorRecord($ex, 'SILaQueryFailed', [System.Management.Automation.ErrorCategory]::InvalidOperation, $WorkspaceId)
|    $er.ErrorDetails = New-Object System.Management.Automation.ErrorDetails($Content)
|    $er
|}
|
|function Complete-SILaQueryAnswer {
|    <#
|        The end of every Invoke-SILaQuery read: a cut answer (Test-SILaAnswerWhole) THROWS (New-SILaCutAnswerError) unless
|        -AllowPartial; otherwise the answer (New-SILaQueryAnswer), with .Partial = the kind of a partial answer handed out
|        under -AllowPartial ('' when whole).
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Results = @(), [AllowNull()][AllowEmptyCollection()][object[]]$Columns = @(), $QueryError,
|          [switch]$AllowPartial, [string]$WorkspaceId = '', [long]$RowCount = -1)
|    $n = $RowCount
|    if ($n -lt 0) { $n = 0L; if ($null -ne $Results) { $n = [long]$Results.Count } }
|    $v = Test-SILaAnswerWhole -ErrorObject $QueryError -Rows $n
|    if (-not $v.Whole -and -not $AllowPartial) { throw (New-SILaCutAnswerError -Verdict $v -ErrorObject $QueryError -WorkspaceId $WorkspaceId) }
|    $a = New-SILaQueryAnswer -Results $Results -Columns $Columns -QueryError $QueryError
|    $kind = ''; if (-not $v.Whole) { $kind = [string]$v.Kind }
|    $a | Add-Member -NotePropertyName Partial -NotePropertyValue $kind -Force
|    $a | Add-Member -NotePropertyName RowCount -NotePropertyValue $n -Force
|    $a
|}
|
|function Invoke-SILaQueryPaged {
|    <#
|        Invoke-SILaQuery -OnPage: the rows handed on a page at a time, never collected (see Invoke-SILaQuery). The streaming
|        reader (SI-LaStreamRead.ps1) delivers each page as soon as about -PageBytes of the answer's own bytes are in; the
|        compact rows of $global:SI_LaCompactRows apply. A cut answer is refused at the end, after the pages (they are
|        provisional until this returns). A stream read that fails BEFORE any page was handed on is read again the older way;
|        one that fails AFTER a page was handed on throws (handing the pages on again would hand some rows twice).
|        Without the streaming reader: the older read, then the rows in pages of the same measured size.
|        Returns the answer shape with no rows in .Results; .RowCount = the rows handed on, .Pages = the pages.
|    #>
|    param([Parameter(Mandatory)][string]$WorkspaceId, [Parameter(Mandatory)][string]$Query, [int]$Wait = 0,
|          [timespan]$Timespan = [timespan]::Zero, [int]$MaxAttempts = 4, [switch]$AllowPartial,
|          [Parameter(Mandatory)][scriptblock]$OnPage, [long]$PageBytes = 4MB)
|    if ($PageBytes -lt 1KB) { $PageBytes = 1KB }
|    $uri = 'https://api.loganalytics.io/v1/workspaces/{0}/query' -f $WorkspaceId.Trim()
|    $body = [ordered]@{ query = $Query }
|    if ($Timespan -gt [timespan]::Zero) { $body['timespan'] = [System.Xml.XmlConvert]::ToString($Timespan) }
|    $headers = @{}
|    $timeout = 300
|    # #882 (A4): Log Analytics stops a query at 3 minutes unless asked to wait -- every query asks for its maximum (10 minutes)
|    if ($Wait -le 0) { $Wait = 600 }
|    if ($Wait -gt 0) { $headers['Prefer'] = ('wait={0}' -f $Wait); $timeout = $Wait + 60 }
|    $rq = @{ Method = 'POST'; Uri = $uri; Audience = 'LaQuery'; Body = ($body | ConvertTo-Json -Compress -Depth 5); Headers = $headers
|             TimeoutSec = $timeout; MaxAttempts = $MaxAttempts; AllowStatus = @(400, 403, 404, 409, 413, 422); What = 'Log Analytics query'
|             AsBytes = ($PSVersionTable.PSEdition -eq 'Core') }
|    $streamable = ($PSVersionTable.PSEdition -eq 'Core' -and (Get-Command -Name Get-SILaStreamReaderType -ErrorAction Ignore) -and (Get-SILaStreamReaderType))
|    $state = @{ Pages = 0; Rows = 0L }
|    if ($streamable) {
|        $__lpCompact = [bool]$global:SI_LaCompactRows
|        $__lpOn = $OnPage; $__lpBytes = $PageBytes; $__lpState = $state
|        $rq['ReadStream'] = { param($s) Read-SILaQueryStreamSafe -Stream $s -Compact:$__lpCompact -OnPage $__lpOn -PageBytes $__lpBytes -PageState $__lpState }
|    } elseif ($PSVersionTable.PSEdition -eq 'Core') {
|        Write-SILaStreamFallback -Once -Reason ([string]$global:SI_LaStreamReaderOff)
|    }
|    $r = Invoke-SIAzRestRequest @rq
|    if ($r -and $r.PSObject.Properties['Parsed'] -and $null -ne $r.Parsed -and $r.Parsed.PSObject.Properties['SILaStreamFailed']) {
|        if ([int]$state.Pages -gt 0) {
|            throw ('Log Analytics: the answer could not be read to its end ({0}) after {1} page(s) had been handed on -- the read is not whole and its pages must not be used' -f [string]$r.Parsed.SILaStreamFailed, $state.Pages)
|        }
|        Write-SILaStreamFallback -Reason ('reading this answer as it arrived failed (' + [string]$r.Parsed.SILaStreamFailed + '), so it was read again')
|        $r = $null
|        [void]$rq.Remove('ReadStream')
|        $r = Invoke-SIAzRestRequest @rq
|    }
|    if ($r -and $r.PSObject.Properties['Parsed'] -and $null -ne $r.Parsed -and [int]$r.StatusCode -lt 400) {
|        $p = $r.Parsed; $r = $null
|        $a = Complete-SILaQueryAnswer -Results @() -Columns $p.Columns -QueryError $p.Error -AllowPartial:$AllowPartial -WorkspaceId $WorkspaceId -RowCount ([long]$p.RowCount)
|        $a | Add-Member -NotePropertyName Pages -NotePropertyValue ([int]$p.Pages) -Force
|        return $a
|    }
|    # the older read (no streaming reader, or read again): the same refusal of a 4xx and of a cut answer, then the pages
|    [void]$rq.Remove('ReadStream')
|    if ($null -eq $r) { $r = Invoke-SIAzRestRequest @rq }
|    $code = [int]$r.StatusCode
|    $content = [string]$r.Content
|    if ($null -ne $r.Bytes -and $r.Bytes.Length -gt 0 -and ($code -ge 400 -or $PSVersionTable.PSEdition -ne 'Core')) { $content = [System.Text.Encoding]::UTF8.GetString($r.Bytes) }
|    if ($code -ge 400) { throw (New-SILaQueryRefusedError -Code $code -Content $content -Headers $r.Headers -WorkspaceId $WorkspaceId) }
|    $lean = $null
|    if ($null -ne $r.Bytes -and $r.Bytes.Length -gt 0 -and $PSVersionTable.PSEdition -eq 'Core') {
|        [byte[]]$bytes = $r.Bytes
|        $total = [long]$bytes.Length
|        $r = $null
|        $lean = ConvertFrom-SILaQueryRows -Bytes $bytes
|        $bytes = $null
|    } else {
|        $total = [long][System.Text.Encoding]::UTF8.GetByteCount($content)
|        $parsed = ConvertFrom-SILaQueryJson -Json $content
|        $content = $null
|        $first = @($parsed.Tables | Where-Object { $_.Name -eq 'PrimaryResult' }) + @($parsed.Tables) | Select-Object -First 1
|        $rowsL = [System.Collections.Generic.List[object]]::new(); $colsL = @()
|        if ($first) {
|            $names = @($first.Columns | ForEach-Object { [string]$_.name })
|            $colsL = @($first.Columns | ForEach-Object { [pscustomobject]@{ name = [string]$_.name; type = $(if ($_.PSObject.Properties['type']) { [string]$_.type } else { $null }) } })
|            foreach ($row in $first.Rows) { $o = [ordered]@{}; for ($i = 0; $i -lt $names.Count; $i++) { $o[$names[$i]] = $row[$i] }; [void]$rowsL.Add([pscustomobject]$o) }
|        }
|        $lean = [pscustomobject]@{ Rows = $rowsL.ToArray(); Columns = $colsL; Error = $parsed.Error }
|        $parsed = $null; $first = $null
|    }
|    $all = @($lean.Rows); $n = $all.Count
|    # a cut answer is refused BEFORE a page is handed on (the whole answer is in hand on this path)
|    $v = Test-SILaAnswerWhole -ErrorObject $lean.Error -Rows $n
|    if (-not $v.Whole -and -not $AllowPartial) { throw (New-SILaCutAnswerError -Verdict $v -ErrorObject $lean.Error -WorkspaceId $WorkspaceId) }
|    # pages of about -PageBytes of the answer: the measured bytes per row of this answer decide the rows per page
|    $per = $n
|    if ($n -gt 0 -and $total -gt $PageBytes) { $per = [int][Math]::Max(1, [Math]::Floor($n * ([double]$PageBytes / [double]$total))) }
|    $pages = 0
|    for ($i = 0; $i -lt $n; $i += [Math]::Max(1, $per)) {
|        $len = [Math]::Min([Math]::Max(1, $per), $n - $i)
|        $pg = [object[]]::new($len); [Array]::Copy($all, $i, $pg, 0, $len)
|        $null = & $OnPage $pg
|        $pages++
|        for ($k = $i; $k -lt $i + $len; $k++) { $all[$k] = $null }
|    }
|    $a = Complete-SILaQueryAnswer -Results @() -Columns $lean.Columns -QueryError $lean.Error -AllowPartial:$AllowPartial -WorkspaceId $WorkspaceId -RowCount ([long]$n)
|    $a | Add-Member -NotePropertyName Pages -NotePropertyValue $pages -Force
|    $a
|}
|
|function New-SILaQueryAnswer {
|    <#
|        PURE. The one shape Invoke-SILaQuery answers (#639): .Results (the rows), .Columns (name / type), .Tables = the
|        primary table's SCHEMA only (Name, Columns, no rows -- RowsOmitted), .Error. The rows are never held twice.
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Results = @(), [AllowNull()][AllowEmptyCollection()][object[]]$Columns = @(), $QueryError)
|    $c = @($Columns | Where-Object { $null -ne $_ })
|    $schema = [pscustomobject]@{ Name = 'PrimaryResult'; Columns = $c; Rows = @(); RowsOmitted = $true }
|    # plain statements: an if used as a value would unroll the rows (one row would come back as that row, not a list)
|    $rows = $Results
|    if ($null -eq $rows) { $rows = [object[]]@() }
|    [pscustomobject]@{ Results = $rows; Columns = $c; Tables = @($schema); Error = $QueryError; Statistics = $null; Render = $null }
|}
|
|# =====================================================================================================================
|#  Storage data plane: blob, queue, table (OAuth bearer, x-ms-version)
|# =====================================================================================================================
|
|function Get-SIStorageApiVersion { '2021-08-06' }
|
|function Get-SIStorageUri {
|    param([Parameter(Mandatory)][string]$Account, [ValidateSet('blob', 'queue', 'table')][string]$Service = 'blob', [string]$Path = '', [string]$Query = '')
|    $p = (($Path -split '/') | ForEach-Object { [uri]::EscapeDataString($_) }) -join '/'
|    $u = 'https://{0}.{1}.core.windows.net/{2}' -f $Account, $Service, $p
|    if ($Query) { $u += '?' + $Query }
|    return $u
|}
|
|function Invoke-SIStorageRequest {
|    param([string]$Method = 'GET', [Parameter(Mandatory)][string]$Uri, $Body, [string]$ContentType, [hashtable]$Headers, [switch]$AllowNotFound, [int[]]$AllowStatus = @(), [switch]$AsBytes, [string]$What = 'Azure Storage request')
|    $h = @{ 'x-ms-version' = (Get-SIStorageApiVersion); 'x-ms-date' = [datetime]::UtcNow.ToString('R') }
|    if ($Headers) { foreach ($k in $Headers.Keys) { $h[$k] = $Headers[$k] } }
|    if (-not $ContentType) { $ContentType = 'application/octet-stream' }
|    return (Invoke-SIAzRestRequest -Method $Method -Uri $Uri -Audience Storage -Body $Body -ContentType $ContentType -Headers $h -AllowNotFound:$AllowNotFound -AllowStatus $AllowStatus -AsBytes:$AsBytes -What $What)
|}
|
|function ConvertTo-SIStorageDate {
|    param([string]$Text)
|    $d = [DateTimeOffset]::MinValue
|    if ($Text -and [DateTimeOffset]::TryParse($Text, [System.Globalization.CultureInfo]::InvariantCulture, [System.Globalization.DateTimeStyles]::AssumeUniversal, [ref]$d)) { return $d }
|    return $null
|}
|
|function Get-SIBlobProperties {
|    <# HEAD of one blob: @{ Name; Length; LastModified; ETag; ContentType } or $null when it does not exist. #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Container, [Parameter(Mandatory)][string]$Blob)
|    $r = Invoke-SIStorageRequest -Method HEAD -Uri (Get-SIStorageUri -Account $Account -Path ("$Container/$Blob")) -AllowNotFound -What ("Blob '{0}/{1}'" -f $Container, $Blob)
|    if (-not $r) { return $null }
|    $len = 0L; [void][long]::TryParse([string]$r.Headers['Content-Length'], [ref]$len)
|    return [pscustomobject]@{ Name = $Blob; Container = $Container; Length = $len; LastModified = (ConvertTo-SIStorageDate $r.Headers['Last-Modified']); ETag = [string]$r.Headers['ETag']; ContentType = [string]$r.Headers['Content-Type'] }
|}
|
|function Get-SIBlobList {
|    <# Every blob in -Container under -Prefix (List Blobs, following the marker). #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Container, [string]$Prefix)
|    $out = [System.Collections.Generic.List[object]]::new()
|    $marker = $null
|    do {
|        $q = 'restype=container&comp=list&maxresults=5000'
|        if ($Prefix) { $q += '&prefix=' + [uri]::EscapeDataString($Prefix) }
|        if ($marker) { $q += '&marker=' + [uri]::EscapeDataString($marker) }
|        $r = Invoke-SIStorageRequest -Method GET -Uri (Get-SIStorageUri -Account $Account -Path $Container -Query $q) -Headers @{ Accept = 'application/xml' } -What ("List blobs in '{0}'" -f $Container)
|        # The listing is XML (EnumerationResults). A cast `[xml]$text` that fails puts the WHOLE listing (up to 5,000 blobs)
|        # into its error text -- customer B 2026-10-15: "Cannot convert value "<?xml ... EnumerationResults ..." to type
|        # System.Xml.XmlDocument. Error: OutOfMemoryException" as the run's end text. Parsed here; a failure says what failed
|        # and why, in one short line, never the payload.
|        $x = New-Object System.Xml.XmlDocument
|        try { $x.LoadXml((([string]$r.Content) -replace '^\uFEFF', '')) }
|        catch {
|            $why = $_.Exception.Message; if ($_.Exception.InnerException) { $why = $_.Exception.InnerException.Message }
|            if ($why.Length -gt 300) { $why = $why.Substring(0, 300) }
|            throw ("The blob list of '{0}' (prefix '{1}') could not be read: {2}" -f $Container, $Prefix, $why)
|        }
|        foreach ($b in @($x.EnumerationResults.Blobs.Blob)) {
|            if ($null -eq $b) { continue }
|            $len = 0L; [void][long]::TryParse([string]$b.Properties.'Content-Length', [ref]$len)
|            [void]$out.Add([pscustomobject]@{ Name = [string]$b.Name; Container = $Container; Length = $len; LastModified = (ConvertTo-SIStorageDate ([string]$b.Properties.'Last-Modified')); ETag = [string]$b.Properties.Etag; ContentType = [string]$b.Properties.'Content-Type' })
|        }
|        $marker = [string]$x.EnumerationResults.NextMarker
|    } while ($marker)
|    return $out.ToArray()
|}
|
|function Get-SIBlobContent {
|    <# Download one blob: the bytes, or -Destination writes them to a file (returns the path). -AllowMissing: a blob that
|       does not exist (404) returns $null -- no error is raised or logged (2026-10-23: the pipeline's poll of a run's
|       records marker logged a TerminatingError 404 every 30 s, hiding the real errors). #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Container, [Parameter(Mandatory)][string]$Blob, [string]$Destination, [switch]$AllowMissing)
|    $r = Invoke-SIStorageRequest -Method GET -Uri (Get-SIStorageUri -Account $Account -Path ("$Container/$Blob")) -AsBytes -AllowNotFound:$AllowMissing -What ("Download blob '{0}/{1}'" -f $Container, $Blob)
|    if ($AllowMissing -and $null -eq $r) { return $null }
|    # PLAIN statements, never `$bytes = if (...) { [byte[]]... }`: an `if` used as a value sends the array through the
|    # pipeline ONE BYTE AT A TIME into an object[] -- about 30 times the blob's size in memory. A new customer install
|    # 2026-10-12: the Azure collection's 13,562 assets made one large part, and reading it back ended in
|    # "System.OutOfMemoryException" on a job with 4 GiB and again with 8 GiB.
|    $bytes = $r.Bytes
|    if ($null -eq $bytes) { $bytes = [byte[]]::new(0) }
|    if (-not $Destination) { return ,$bytes }
|    [System.IO.File]::WriteAllBytes($Destination, $bytes)
|    return $Destination
|}
|
|function Set-SIBlobContent {
|    <# Upload one block blob (create or overwrite) from -File or -Bytes. -IfMatchETag makes it conditional (412 when
|       another writer got there first); -IfNoneMatch creates it only when it does not exist yet (409 / 412 when it does --
|       a claim exactly one writer wins). Returns the new ETag. #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Container, [Parameter(Mandatory)][string]$Blob,
|          [string]$File, [byte[]]$Bytes, [string]$IfMatchETag, [string]$ContentType = 'application/octet-stream', [switch]$IfNoneMatch)
|    if ($File) { $Bytes = [System.IO.File]::ReadAllBytes($File) }
|    if ($null -eq $Bytes) { $Bytes = [byte[]]@() }
|    $h = @{ 'x-ms-blob-type' = 'BlockBlob' }
|    if ($IfMatchETag) { $h['If-Match'] = $IfMatchETag }
|    if ($IfNoneMatch) { $h['If-None-Match'] = '*' }
|    $r = Invoke-SIStorageRequest -Method PUT -Uri (Get-SIStorageUri -Account $Account -Path ("$Container/$Blob")) -Body $Bytes -ContentType $ContentType -Headers $h -What ("Upload blob '{0}/{1}'" -f $Container, $Blob)
|    return [string]$r.Headers['ETag']
|}
|
|function Remove-SIBlob {
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Container, [Parameter(Mandatory)][string]$Blob)
|    $null = Invoke-SIStorageRequest -Method DELETE -Uri (Get-SIStorageUri -Account $Account -Path ("$Container/$Blob")) -AllowNotFound -What ("Delete blob '{0}/{1}'" -f $Container, $Blob)
|}
|
|function Test-SIBlobContainer {
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Container)
|    $r = Invoke-SIStorageRequest -Method HEAD -Uri (Get-SIStorageUri -Account $Account -Path $Container -Query 'restype=container') -AllowNotFound -What ("Container '{0}'" -f $Container)
|    if (-not $r) { return $null }
|    return [pscustomobject]@{ Name = $Container; LastModified = (ConvertTo-SIStorageDate $r.Headers['Last-Modified']); ETag = [string]$r.Headers['ETag'] }
|}
|
|function New-SIBlobContainer {
|    <# Create a private container; an existing one is not an error. #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Container)
|    $null = Invoke-SIStorageRequest -Method PUT -Uri (Get-SIStorageUri -Account $Account -Path $Container -Query 'restype=container') -AllowStatus @(409) -What ("Create container '{0}'" -f $Container)
|    return [pscustomobject]@{ Name = $Container }
|}
|
|function Test-SIQueue {
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Queue)
|    $r = Invoke-SIStorageRequest -Method GET -Uri (Get-SIStorageUri -Account $Account -Service queue -Path $Queue -Query 'comp=metadata') -AllowNotFound -What ("Queue '{0}'" -f $Queue)
|    return [bool]$r
|}
|
|function New-SIQueue {
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Queue)
|    $null = Invoke-SIStorageRequest -Method PUT -Uri (Get-SIStorageUri -Account $Account -Service queue -Path $Queue) -AllowStatus @(409) -What ("Create queue '{0}'" -f $Queue)
|}
|
|function Send-SIQueueMessage {
|    <# Put one message. The text is sent as-is (XML-escaped), the encoding the Az.Storage 9 queue client uses. #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Queue, [Parameter(Mandatory)][AllowEmptyString()][string]$Text)
|    $body = '<QueueMessage><MessageText>{0}</MessageText></QueueMessage>' -f [System.Security.SecurityElement]::Escape($Text)
|    $r = Invoke-SIStorageRequest -Method POST -Uri (Get-SIStorageUri -Account $Account -Service queue -Path ("$Queue/messages")) -Body $body -ContentType 'application/xml' -What ("Send to queue '{0}'" -f $Queue)
|    $x = [xml]($r.Content -replace '^\uFEFF', '')
|    return [pscustomobject]@{ MessageId = [string]$x.QueueMessagesList.QueueMessage.MessageId; PopReceipt = [string]$x.QueueMessagesList.QueueMessage.PopReceipt }
|}
|
|function Receive-SIQueueMessage {
|    <# Lease one message for -VisibilityTimeoutSeconds: @{ MessageId; PopReceipt; MessageText; DequeueCount } or $null
|       when the queue is empty. #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Queue, [int]$VisibilityTimeoutSeconds = 30)
|    $q = 'numofmessages=1&visibilitytimeout={0}' -f $VisibilityTimeoutSeconds
|    $r = Invoke-SIStorageRequest -Method GET -Uri (Get-SIStorageUri -Account $Account -Service queue -Path ("$Queue/messages") -Query $q) -Headers @{ Accept = 'application/xml' } -What ("Receive from queue '{0}'" -f $Queue)
|    $x = [xml]($r.Content -replace '^\uFEFF', '')
|    $m = @($x.QueueMessagesList.QueueMessage) | Where-Object { $_ } | Select-Object -First 1
|    if (-not $m) { return $null }
|    return [pscustomobject]@{ MessageId = [string]$m.MessageId; PopReceipt = [string]$m.PopReceipt; MessageText = [string]$m.MessageText; DequeueCount = [int]$m.DequeueCount }
|}
|
|function Update-SIQueueMessage {
|    <#
|        RENEW the hold on one leased message: its visibility timeout is set to -VisibilityTimeoutSeconds from now (Update
|        Message). The message text goes back unchanged (-Text: as it was received). NEVER THROWS -- the answer says which:
|          @{ Ok = $true;  PopReceipt = <the NEW receipt: the old one is no longer valid> }
|          @{ Ok = $false; Lost = $true;  Why }   the message is gone (404) or another worker holds it (400 PopReceiptMismatch)
|          @{ Ok = $false; Lost = $false; Why }   anything else (network, sign-in, a 5xx): not known -- try again
|        Short timeouts and two attempts: this is called from a heartbeat, which must not hang on one request.
|        -Auth: the identity to sign in as (a second thread has no sign-in of its own; Resolve-SIAzRestAuth's answer).
|    #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Queue, [Parameter(Mandatory)][string]$MessageId, [Parameter(Mandatory)][string]$PopReceipt,
|          [Parameter(Mandatory)][int]$VisibilityTimeoutSeconds, [AllowEmptyString()][string]$Text = '', [hashtable]$Auth, [int]$TimeoutSec = 30)
|    try {
|        $q = 'popreceipt={0}&visibilitytimeout={1}' -f [uri]::EscapeDataString($PopReceipt), $VisibilityTimeoutSeconds
|        $body = '<QueueMessage><MessageText>{0}</MessageText></QueueMessage>' -f [System.Security.SecurityElement]::Escape($Text)
|        $h = @{ 'x-ms-version' = (Get-SIStorageApiVersion); 'x-ms-date' = [datetime]::UtcNow.ToString('R') }
|        $r = Invoke-SIAzRestRequest -Method PUT -Uri (Get-SIStorageUri -Account $Account -Service queue -Path ("$Queue/messages/$MessageId") -Query $q) -Audience Storage -Body $body `
|                -ContentType 'application/xml' -Headers $h -AllowStatus @(400, 404) -TimeoutSec $TimeoutSec -MaxAttempts 2 -Auth $Auth -What ("Renew the hold on a message of queue '{0}'" -f $Queue)
|        $code = 0; try { $code = [int]$r.StatusCode } catch { }
|        if ($code -ge 200 -and $code -lt 300) {
|            $new = [string]$r.Headers['x-ms-popreceipt']
|            if (-not $new) { return [pscustomobject]@{ Ok = $false; Lost = $false; PopReceipt = $PopReceipt; Why = 'the queue answered without a new receipt' } }
|            return [pscustomobject]@{ Ok = $true; Lost = $false; PopReceipt = $new; Why = '' }
|        }
|        if ($code -eq 404) { return [pscustomobject]@{ Ok = $false; Lost = $true; PopReceipt = $PopReceipt; Why = 'the message is no longer in the queue' } }
|        $said = [string]$r.Content; try { if ($r.Headers -and $r.Headers['x-ms-error-code']) { $said += ' ' + [string]$r.Headers['x-ms-error-code'] } } catch { }
|        if ($code -eq 400 -and $said -match '(?i)PopReceiptMismatch|MessageNotFound') { return [pscustomobject]@{ Ok = $false; Lost = $true; PopReceipt = $PopReceipt; Why = 'another worker holds the message now' } }
|        return [pscustomobject]@{ Ok = $false; Lost = $false; PopReceipt = $PopReceipt; Why = ('HTTP {0}: {1}' -f $code, (([string]$r.Content -replace '\s+', ' ').Trim() -replace '^(.{200}).*$', '$1...')) }
|    } catch {
|        return [pscustomobject]@{ Ok = $false; Lost = $false; PopReceipt = $PopReceipt; Why = [string]$_.Exception.Message }
|    }
|}
|
|function Remove-SIQueueMessage {
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Queue, [Parameter(Mandatory)][string]$MessageId, [Parameter(Mandatory)][string]$PopReceipt)
|    $q = 'popreceipt=' + [uri]::EscapeDataString($PopReceipt)
|    $null = Invoke-SIStorageRequest -Method DELETE -Uri (Get-SIStorageUri -Account $Account -Service queue -Path ("$Queue/messages/$MessageId") -Query $q) -AllowNotFound -What ("Delete from queue '{0}'" -f $Queue)
|}
|
|function Get-SITableEntity {
|    <# One table entity (PartitionKey + RowKey) or $null; without -RowKey, every entity of the partition (following the
|       continuation headers). #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Table, [Parameter(Mandatory)][string]$PartitionKey, [string]$RowKey)
|    $h = @{ Accept = 'application/json;odata=nometadata' }
|    $esc = { param($s) ([string]$s).Replace("'", "''") }
|    if ($RowKey) {
|        $path = "{0}(PartitionKey='{1}',RowKey='{2}')" -f $Table, [uri]::EscapeDataString((& $esc $PartitionKey)), [uri]::EscapeDataString((& $esc $RowKey))
|        $r = Invoke-SIStorageRequest -Method GET -Uri ('https://{0}.table.core.windows.net/{1}' -f $Account, $path) -Headers $h -ContentType 'application/json' -AllowNotFound -What ("Table '{0}' entity" -f $Table)
|        if (-not $r) { return $null }
|        return ($r.Content | ConvertFrom-Json)
|    }
|    $out = [System.Collections.Generic.List[object]]::new()
|    $filter = [uri]::EscapeDataString(("PartitionKey eq '{0}'" -f (& $esc $PartitionKey)))
|    $np = $null; $nr = $null
|    do {
|        $q = '$filter=' + $filter
|        if ($np) { $q += '&NextPartitionKey=' + [uri]::EscapeDataString($np) }
|        if ($nr) { $q += '&NextRowKey=' + [uri]::EscapeDataString($nr) }
|        $r = Invoke-SIStorageRequest -Method GET -Uri ('https://{0}.table.core.windows.net/{1}()?{2}' -f $Account, $Table, $q) -Headers $h -ContentType 'application/json' -What ("Table '{0}' query" -f $Table)
|        foreach ($e in @(($r.Content | ConvertFrom-Json).value)) { if ($e) { [void]$out.Add($e) } }
|        $np = [string]$r.Headers['x-ms-continuation-NextPartitionKey']; $nr = [string]$r.Headers['x-ms-continuation-NextRowKey']
|    } while ($np)
|    return $out.ToArray()
|}
|
|function Set-SITableEntity {
|    <# UPSERT one entity (Insert Or Replace; -Merge = Insert Or Merge). -Entity is a hashtable of properties. #>
|    param([Parameter(Mandatory)][string]$Account, [Parameter(Mandatory)][string]$Table, [Parameter(Mandatory)][string]$PartitionKey,
|          [Parameter(Mandatory)][string]$RowKey, [hashtable]$Entity = @{}, [switch]$Merge)
|    $e = [ordered]@{ PartitionKey = $PartitionKey; RowKey = $RowKey }
|    foreach ($k in $Entity.Keys) { if ($k -notin 'PartitionKey', 'RowKey') { $e[$k] = $Entity[$k] } }
|    $esc = { param($s) ([string]$s).Replace("'", "''") }
|    $path = "{0}(PartitionKey='{1}',RowKey='{2}')" -f $Table, [uri]::EscapeDataString((& $esc $PartitionKey)), [uri]::EscapeDataString((& $esc $RowKey))
|    $bytes = [System.Text.Encoding]::UTF8.GetBytes(($e | ConvertTo-Json -Depth 5 -Compress))
|    $null = Invoke-SIStorageRequest -Method $(if ($Merge) { 'MERGE' } else { 'PUT' }) -Uri ('https://{0}.table.core.windows.net/{1}' -f $Account, $path) -Body $bytes `
|                -ContentType 'application/json' -Headers @{ Accept = 'application/json;odata=nometadata' } -What ("Table '{0}' upsert" -f $Table)
|}
|
|# =====================================================================================================================
|#  The wrappers -- each forwards to its REST twin below
|# =====================================================================================================================
|# Each declares the parameters SecurityInsight's call sites use, UNTYPED except switches, and forwards @PSBoundParameters
|# -- never @args (measured: @args splits -Name:$value into a switch plus a positional value).
|function Connect-SIAzAccount {
|    [CmdletBinding()]
|    param([switch]$Identity, $AccountId, [switch]$ServicePrincipal, $ApplicationId, $CertificateThumbprint,
|          $CertificatePath, $CertificatePassword, $Credential,
|          [Alias('TenantId')]$Tenant, [Alias('SubscriptionId')]$Subscription, $Scope)
|    return (Connect-SIAzAccountRest @PSBoundParameters)
|}
|function Disconnect-SIAzAccount {
|    [CmdletBinding()] param($Scope)
|    return (Disconnect-SIAzAccountRest @PSBoundParameters)
|}
|function Disable-SIAzContextAutosave {
|    [CmdletBinding()] param($Scope)
|    return (Disable-SIAzContextAutosaveRest @PSBoundParameters)
|}
|function Get-SIAzContext {
|    [CmdletBinding()] param()
|    return (Get-SIAzContextRest @PSBoundParameters)
|}
|function Set-SIAzContext {
|    [CmdletBinding()]
|    param([Alias('SubscriptionId', 'SubscriptionName')]$Subscription, [Alias('TenantId', 'Domain')]$Tenant, $Context, $Scope)
|    return (Set-SIAzContextRest @PSBoundParameters)
|}
|function Get-SIAzAccessToken {
|    [CmdletBinding()] param($ResourceUrl, $TenantId)
|    return (Get-SIAzAccessTokenRest @PSBoundParameters)
|}
|function Get-SIAzSubscription {
|    [CmdletBinding()] param($TenantId, $SubscriptionId)
|    return (Get-SIAzSubscriptionRest @PSBoundParameters)
|}
|function Invoke-SIAzRestMethod {
|    [CmdletBinding()] param($Path, $Method, $Payload)
|    return (Invoke-SIAzRestMethodRest @PSBoundParameters)
|}
|function Invoke-SIAzOperationalInsightsQuery {
|    # -AllowPartial: the caller reads .Error itself (Invoke-SILaQuery refuses a cut answer otherwise); -OnPage / -PageBytes:
|    # the rows a page at a time (Invoke-SILaQuery)
|    [CmdletBinding()] param($WorkspaceId, $Query, $Wait, $Timespan, [switch]$AllowPartial, [scriptblock]$OnPage, [long]$PageBytes)
|    return (Invoke-SIAzOperationalInsightsQueryRest @PSBoundParameters)
|}
|function Get-SIAzOperationalInsightsWorkspace {
|    [CmdletBinding()] param($ResourceGroupName, $Name)
|    return (Get-SIAzOperationalInsightsWorkspaceRest @PSBoundParameters)
|}
|function New-SIAzOperationalInsightsWorkspace {
|    [CmdletBinding()] param($ResourceGroupName, $Name, $Location, $Sku, $RetentionInDays)
|    return (New-SIAzOperationalInsightsWorkspaceRest @PSBoundParameters)
|}
|function Search-SIAzGraph {
|    [CmdletBinding()] param($Query, $First, $Skip, $Subscription, $ManagementGroup, $SkipToken)
|    return ,(Search-SIAzGraphRest @PSBoundParameters)   # one page object, not its rows
|}
|function Get-SIAzKeyVaultSecret {
|    [CmdletBinding()] param($VaultName, $Name, [switch]$AsPlainText)
|    return (Get-SIAzKeyVaultSecretRest @PSBoundParameters)
|}
|function Set-SIAzKeyVaultSecret {
|    [CmdletBinding()] param($VaultName, $Name, $SecretValue, $ContentType)
|    return (Set-SIAzKeyVaultSecretRest @PSBoundParameters)
|}
|function Get-SIAzResourceGroup {
|    [CmdletBinding()] param($Name)
|    return (Get-SIAzResourceGroupRest @PSBoundParameters)
|}
|function New-SIAzResourceGroup {
|    [CmdletBinding()] param($Name, $Location, $Tag)
|    return (New-SIAzResourceGroupRest @PSBoundParameters)
|}
|function Get-SIAzRoleAssignment {
|    [CmdletBinding()] param($ObjectId, $Scope, $RoleDefinitionName)
|    return (Get-SIAzRoleAssignmentRest @PSBoundParameters)
|}
|function New-SIAzRoleAssignment {
|    [CmdletBinding()] param($ObjectId, $Scope, $RoleDefinitionName, $Description)
|    return (New-SIAzRoleAssignmentRest @PSBoundParameters)
|}
|function Get-SIAzRoleDefinition {
|    [CmdletBinding()] param([switch]$Custom, $Name, $Scope)
|    return (Get-SIAzRoleDefinitionRest @PSBoundParameters)
|}
|function Get-SIAzTag {
|    [CmdletBinding()] param($ResourceId)
|    return (Get-SIAzTagRest @PSBoundParameters)
|}
|function Update-SIAzTag {
|    [CmdletBinding()] param($ResourceId, $Tag, $Operation)
|    return (Update-SIAzTagRest @PSBoundParameters)
|}
|function Get-SIAzADServicePrincipal {
|    [CmdletBinding()] param($ApplicationId, $ObjectId)
|    return (Get-SIAzADServicePrincipalRest @PSBoundParameters)
|}
|function Get-SIAzDataCollectionEndpoint {
|    [CmdletBinding()] param($Name, $ResourceGroupName)
|    return (Get-SIAzDataCollectionEndpointRest @PSBoundParameters)
|}
|function New-SIAzDataCollectionEndpoint {
|    [CmdletBinding()] param($Name, $ResourceGroupName, $Location, $NetworkAclsPublicNetworkAccess)
|    return (New-SIAzDataCollectionEndpointRest @PSBoundParameters)
|}
|function Get-SIAzDataCollectionRule {
|    [CmdletBinding()] param($Name, $ResourceGroupName)
|    return (Get-SIAzDataCollectionRuleRest @PSBoundParameters)
|}
|function New-SIAzStorageContext {
|    [CmdletBinding()] param($StorageAccountName, [switch]$UseConnectedAccount)
|    return (New-SIAzStorageContextRest @PSBoundParameters)
|}
|function Get-SIAzStorageAccount {
|    [CmdletBinding()] param($ResourceGroupName, $Name)
|    return (Get-SIAzStorageAccountRest @PSBoundParameters)
|}
|function New-SIAzStorageAccount {
|    [CmdletBinding()]
|    param($ResourceGroupName, $Name, $Location, $SkuName, $Kind, $EnableHttpsTrafficOnly,
|          $MinimumTlsVersion, $AllowBlobPublicAccess, $PublicNetworkAccess)
|    return (New-SIAzStorageAccountRest @PSBoundParameters)
|}
|function Get-SIAzStorageContainer {
|    [CmdletBinding()] param($Name, $Context)
|    return (Get-SIAzStorageContainerRest @PSBoundParameters)
|}
|function New-SIAzStorageContainer {
|    [CmdletBinding()] param($Name, $Context, $Permission)
|    return (New-SIAzStorageContainerRest @PSBoundParameters)
|}
|function Get-SIAzStorageBlob {
|    [CmdletBinding()] param($Container, $Blob, $Prefix, $Context)
|    return (Get-SIAzStorageBlobRest @PSBoundParameters)
|}
|function Get-SIAzStorageBlobContent {
|    [CmdletBinding()] param($Container, $Blob, $CloudBlob, $Destination, $Context, [switch]$Force)
|    return (Get-SIAzStorageBlobContentRest @PSBoundParameters)
|}
|function Set-SIAzStorageBlobContent {
|    [CmdletBinding()] param($File, $Container, $Blob, $Context, [switch]$Force)
|    return (Set-SIAzStorageBlobContentRest @PSBoundParameters)
|}
|function Remove-SIAzStorageBlob {
|    [CmdletBinding()] param($Container, $Blob, $Context, [switch]$Force)
|    return (Remove-SIAzStorageBlobRest @PSBoundParameters)
|}
|function Start-SIAzStorageBlobCopy {
|    [CmdletBinding()] param($SrcContainer, $SrcBlob, $DestContainer, $DestBlob, $Context, [switch]$Force)
|    return (Start-SIAzStorageBlobCopyRest @PSBoundParameters)
|}
|function Get-SIAzStorageQueue {
|    [CmdletBinding()] param($Name, $Context)
|    return (Get-SIAzStorageQueueRest @PSBoundParameters)
|}
|function New-SIAzStorageQueue {
|    [CmdletBinding()] param($Name, $Context)
|    return (New-SIAzStorageQueueRest @PSBoundParameters)
|}
|
|function Set-SIAzStorageBlobContentIfMatch {
|    <# The ledger's CONDITIONAL write (only when the blob still has -IfMatchETag): PUT with If-Match. A lost race fails
|       with '412 ConditionNotMet'. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$File, [Parameter(Mandatory)][string]$Container, [Parameter(Mandatory)][string]$Blob,
|          [Parameter(Mandatory)][object]$Context, [Parameter(Mandatory)][string]$IfMatchETag)
|    $acct = Get-SIAzRestStorageAccountName -Context $Context
|    $null = Set-SIBlobContent -Account $acct -Container $Container -Blob $Blob -File $File -IfMatchETag $IfMatchETag
|}
|# =====================================================================================================================
|#  The REST twins -- what each wrapper does with no Az module
|# =====================================================================================================================
|
|function Write-SIAzRestNotFound {
|    <# A lookup that found nothing, the way the Az cmdlet reports it: a NON-terminating error, so -ErrorAction
|       SilentlyContinue yields $null and -ErrorAction Stop throws. #>
|    param([Parameter(Mandatory)]$Cmdlet, [Parameter(Mandatory)][string]$Message, [string]$Target)
|    $er = New-Object System.Management.Automation.ErrorRecord((New-Object System.Exception($Message)), 'SIAzRestNotFound', [System.Management.Automation.ErrorCategory]::ObjectNotFound, $Target)
|    $Cmdlet.WriteError($er)
|}
|
|function Get-SIAzRestSubscriptionId {
|    <# The current subscription: Set-SIAzContext / Connect -Subscription, else the install's workspace subscription,
|       else the first enabled subscription the identity sees (what Connect-AzAccount selects). #>
|    param([switch]$NoLookup)
|    $st = Get-SIAzRestState
|    if ($st.SubscriptionId) { return [string]$st.SubscriptionId }
|    $s = [string](Get-SIAzRestValue 'SI_AzSubscriptionId')
|    if (-not $s -and [string](Get-SIAzRestValue 'SI_WorkspaceResourceId') -match '/subscriptions/([^/]+)/') { $s = $Matches[1] }
|    if (-not $s) { $s = [string](Get-SIAzRestValue 'SubscriptionId') }
|    # in an Invardia Support session, the first subscription the environment names
|    if (-not $s) { $sess = Get-SISupportSession; if ($sess -and $sess.SubscriptionId) { $s = [string]$sess.SubscriptionId } }
|    if (-not $s -and -not $NoLookup) {
|        try {
|            $first = @(Invoke-SIArm -Path '/subscriptions' -ApiVersion '2022-12-01' -List | Where-Object { [string]$_.state -eq 'Enabled' }) | Select-Object -First 1
|            if ($first) { $s = [string]$first.subscriptionId }
|        } catch { }
|    }
|    if ($s) { $st.SubscriptionId = $s }
|    return $s
|}
|
|function Get-SIAzRestTenantId {
|    $st = Get-SIAzRestState
|    if ($st.TenantId) { return [string]$st.TenantId }
|    $a = Resolve-SIAzRestAuth
|    $t = [string]$a.TenantId
|    if (-not $t) {
|        # a managed identity knows its tenant: read it from its own ARM token
|        try { $c = ConvertFrom-SIJwtPayload (Get-SIAzureToken -Audience Arm); if ($c) { $t = [string]$c.tid } } catch { }
|    }
|    if ($t) { $st.TenantId = $t }
|    return $t
|}
|
|function Connect-SIAzAccountRest {
|    <# RECORDS the identity; no sign-in happens here (each REST call mints its token when it needs one). #>
|    [CmdletBinding()]
|    param([switch]$Identity, [string]$AccountId, [switch]$ServicePrincipal, [string]$ApplicationId, [string]$CertificateThumbprint,
|          [string]$CertificatePath, [securestring]$CertificatePassword, [pscredential]$Credential,
|          [Alias('TenantId')][string]$Tenant, [Alias('SubscriptionId')][string]$Subscription, [string]$Scope)
|    $st = Get-SIAzRestState
|    $conn = $null
|    if ($Identity) {
|        $cid = if ($AccountId) { $AccountId } else { [string](Get-SIAzRestValue 'SI_UAMI_ClientId', 'SI_ManagedIdentityClientId') }
|        $conn = @{ Mode = 'ManagedIdentity'; ClientId = $cid }
|    } elseif ($Credential) {
|        $conn = @{ Mode = 'Secret'; AppId = [string]$Credential.UserName; TenantId = $Tenant; Secret = $Credential.GetNetworkCredential().Password }
|    } elseif ($CertificateThumbprint -or $CertificatePath) {
|        $thumb = $CertificateThumbprint
|        if ($CertificatePath) {
|            # the PFX the container wrote: the token signer looks a certificate up by thumbprint in the X509 store, so
|            # it goes into CurrentUser\My (the only store a Linux container has) unless it is already there
|            $pw = if ($CertificatePassword) { [System.Net.NetworkCredential]::new('', $CertificatePassword).Password } else { '' }
|            $flags = [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable -bor [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::PersistKeySet
|            $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new([System.IO.File]::ReadAllBytes($CertificatePath), $pw, $flags)
|            $thumb = [string]$cert.Thumbprint
|            Initialize-SIAzRestHelpers
|            if (-not (Get-SICertificateFromStore -Thumbprint $thumb)) {
|                $store = New-Object System.Security.Cryptography.X509Certificates.X509Store('My', 'CurrentUser')
|                try { $store.Open('ReadWrite'); $store.Add($cert) } finally { $store.Close() }
|            }
|        }
|        $conn = @{ Mode = 'Certificate'; AppId = $ApplicationId; TenantId = $Tenant; Thumbprint = ($thumb -replace '\s', '') }
|    } else {
|        throw 'Connect-SIAzAccount (REST): name the identity -- -Identity, -Credential, or -ApplicationId with -CertificateThumbprint / -CertificatePath.'
|    }
|    $st.Connection = $conn
|    $st.TenantId = if ($Tenant) { $Tenant } else { $null }
|    $st.SubscriptionId = if ($Subscription) { $Subscription } else { $null }
|    $st.Cache = @{}
|    return (Get-SIAzContextRest)
|}
|
|function Disconnect-SIAzAccountRest {
|    [CmdletBinding()] param([string]$Scope)
|    $st = Get-SIAzRestState
|    $st.Connection = $null; $st.SubscriptionId = $null; $st.TenantId = $null; $st.Cache = @{}
|    $rc = Get-Variable -Scope Global -Name SI_LogIngestRunCache -ValueOnly -ErrorAction Ignore
|    if ($rc -is [hashtable]) { $rc.Tokens = @{} }
|}
|
|function Disable-SIAzContextAutosaveRest { [CmdletBinding()] param([string]$Scope) }
|
|function Get-SIAzContextRest {
|    <# The context object the call sites read (Subscription.Id / .Name, Tenant.Id, Account.Id / .Type), or $null when
|       no identity is configured. #>
|    [CmdletBinding()] param()
|    try { $a = Resolve-SIAzRestAuth } catch { return $null }
|    $sub = Get-SIAzRestSubscriptionId
|    $tid = Get-SIAzRestTenantId
|    $acct = switch ($a.Mode) { 'ManagedIdentity' { [pscustomobject]@{ Id = $(if ($a.ClientId) { $a.ClientId } else { 'MSI' }); Type = 'ManagedService' } } default { [pscustomobject]@{ Id = $a.AppId; Type = 'ServicePrincipal' } } }
|    return [pscustomobject]@{
|        PSTypeName   = 'SI.AzRest.Context'
|        Name         = ('{0} ({1})' -f $sub, $acct.Id)
|        Account      = $acct
|        Subscription = $(if ($sub) { [pscustomobject]@{ Id = $sub; SubscriptionId = $sub; Name = $sub; TenantId = $tid; ExtendedProperties = @{} } } else { $null })
|        Tenant       = [pscustomobject]@{ Id = $tid; TenantId = $tid }
|        Environment  = [pscustomobject]@{ Name = 'AzureCloud' }
|    }
|}
|
|function Set-SIAzContextRest {
|    [CmdletBinding()]
|    param([Alias('SubscriptionId', 'SubscriptionName')][string]$Subscription, [Alias('TenantId', 'Domain')][string]$Tenant, [object]$Context, [string]$Scope)
|    $st = Get-SIAzRestState
|    if ($Context -and $Context.Subscription) { $Subscription = [string]$Context.Subscription.Id }
|    if ($Subscription) { $st.SubscriptionId = $Subscription }
|    if ($Tenant) { $st.TenantId = $Tenant }
|    return (Get-SIAzContextRest)
|}
|
|function Get-SIAzAccessTokenRest {
|    [CmdletBinding()] param([string]$ResourceUrl, [string]$TenantId)
|    $res = if ($ResourceUrl) { $ResourceUrl } else { 'https://management.azure.com/' }
|    $tok = Get-SIAzureToken -Resource $res
|    $c = ConvertFrom-SIJwtPayload $tok
|    $exp = [DateTimeOffset]::UtcNow.AddMinutes(45)
|    if ($c -and $c.exp) { try { $exp = [DateTimeOffset]::FromUnixTimeSeconds([long]$c.exp) } catch { } }
|    return [pscustomobject]@{ Token = $tok; ExpiresOn = $exp; Type = 'Bearer'; TenantId = $(if ($c) { [string]$c.tid } else { $null }); UserId = $(if ($c) { [string]$c.appid } else { $null }) }
|}
|
|function Get-SIAzSubscriptionRest {
|    [CmdletBinding()] param([string]$TenantId, [string]$SubscriptionId)
|    foreach ($s in @(Invoke-SIArm -Path '/subscriptions' -ApiVersion '2022-12-01' -List)) {
|        if ($TenantId -and [string]$s.tenantId -and [string]$s.tenantId -ne $TenantId) { continue }
|        if ($SubscriptionId -and [string]$s.subscriptionId -ne $SubscriptionId) { continue }
|        [pscustomobject]@{ Id = [string]$s.subscriptionId; SubscriptionId = [string]$s.subscriptionId; Name = [string]$s.displayName; State = [string]$s.state; TenantId = [string]$s.tenantId; HomeTenantId = [string]$s.tenantId }
|    }
|}
|
|function Invoke-SIAzRestMethodRest {
|    <# As Invoke-AzRestMethod: never throws on an HTTP status; returns StatusCode / Content / Headers / Method. #>
|    [CmdletBinding()] param([string]$Path, [string]$Method = 'GET', [string]$Payload)
|    if (-not $Method) { $Method = 'GET' }
|    $uri = if ($Path -match '^https://') { $Path } else { 'https://management.azure.com' + $Path }
|    $body = if ($Payload) { $Payload } else { $null }
|    # #564: a POST action with no body sends '{}' (an empty JSON body was refused with HTTP 415)
|    if ($Method.ToUpperInvariant() -eq 'POST' -and $null -eq $body) { $body = '{}' }
|    # #548: inside an Invardia support session through the recording wrapper, never a raw token
|    if (Test-SISupportRequestRoute -Audience Arm) { $r = Invoke-SISupportHttp -Method $Method -Uri $uri -Body $body -ContentType 'application/json' -Audience Arm }
|    else {
|        $tok = Get-SIAzureToken -Audience Arm
|        $r = Invoke-SIAzRestHttp -Method $Method -Uri $uri -Headers @{ Authorization = ('Bearer ' + $tok) } -Body $body -ContentType 'application/json'
|    }
|    return [pscustomobject]@{ StatusCode = [int]$r.StatusCode; Content = [string]$r.Content; Headers = $r.Headers; Method = $Method.ToUpperInvariant() }
|}
|
|function Invoke-SIAzOperationalInsightsQueryRest {
|    [CmdletBinding()] param([string]$WorkspaceId, [string]$Query, [int]$Wait, [timespan]$Timespan, [switch]$AllowPartial, [scriptblock]$OnPage, [long]$PageBytes)
|    $p = @{ WorkspaceId = $WorkspaceId; Query = $Query }
|    if ($PSBoundParameters.ContainsKey('Wait')) { $p['Wait'] = $Wait }
|    if ($PSBoundParameters.ContainsKey('Timespan')) { $p['Timespan'] = $Timespan }
|    if ($AllowPartial) { $p['AllowPartial'] = $true }
|    if ($OnPage) { $p['OnPage'] = $OnPage }
|    if ($PSBoundParameters.ContainsKey('PageBytes') -and $PageBytes -gt 0) { $p['PageBytes'] = $PageBytes }
|    return (Invoke-SILaQuery @p)
|}
|
|function ConvertTo-SIAzWorkspaceObject {
|    param($Ws)
|    $cid = [guid]::Empty
|    [void][guid]::TryParse([string]$Ws.properties.customerId, [ref]$cid)
|    $rg = if ([string]$Ws.id -match '/resourceGroups/([^/]+)/') { $Matches[1] } else { $null }
|    [pscustomobject]@{
|        Name = [string]$Ws.name; ResourceId = [string]$Ws.id; ResourceGroupName = $rg; Location = [string]$Ws.location
|        CustomerId = $cid; Sku = [string]$Ws.properties.sku.name; RetentionInDays = $Ws.properties.retentionInDays
|        ProvisioningState = [string]$Ws.properties.provisioningState; Tags = $Ws.tags
|    }
|}
|
|function Get-SIAzOperationalInsightsWorkspaceRest {
|    [CmdletBinding()] param([string]$ResourceGroupName, [string]$Name)
|    $sub = Get-SIAzRestSubscriptionId
|    if ($ResourceGroupName -and $Name) {
|        $ws = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.OperationalInsights/workspaces/$Name") -ApiVersion '2022-10-01' -AllowNotFound
|        if (-not $ws) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The Log Analytics workspace '{0}' was not found in resource group '{1}'." -f $Name, $ResourceGroupName) -Target $Name; return }
|        return (ConvertTo-SIAzWorkspaceObject $ws)
|    }
|    $path = if ($ResourceGroupName) { "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.OperationalInsights/workspaces" } else { "/subscriptions/$sub/providers/Microsoft.OperationalInsights/workspaces" }
|    foreach ($w in @(Invoke-SIArm -Path $path -ApiVersion '2022-10-01' -List)) {
|        if ($Name -and [string]$w.name -ne $Name) { continue }
|        ConvertTo-SIAzWorkspaceObject $w
|    }
|}
|
|function New-SIAzOperationalInsightsWorkspaceRest {
|    [CmdletBinding()] param([string]$ResourceGroupName, [string]$Name, [string]$Location, [string]$Sku = 'PerGB2018', [int]$RetentionInDays = 30)
|    if (-not $Sku) { $Sku = 'PerGB2018' }
|    $sub = Get-SIAzRestSubscriptionId
|    $body = @{ location = $Location; properties = @{ sku = @{ name = $Sku } } }
|    if ($PSBoundParameters.ContainsKey('RetentionInDays')) { $body.properties['retentionInDays'] = $RetentionInDays }
|    $wsPath = "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.OperationalInsights/workspaces/$Name"
|    $ws = Invoke-SIArm -Method PUT -Path $wsPath -ApiVersion '2022-10-01' -Body $body
|    # the create is asynchronous (its answer can be empty, or a workspace still being made): wait until the workspace is
|    # THERE and provisioned -- its id and customer id are used right after this returns. Not ready in time = a clear stop.
|    $sleep = Get-Variable -Scope Global -Name SI_ArmBusySleep -ValueOnly -ErrorAction Ignore
|    $state = ''
|    for ($i = 0; $i -lt 60; $i++) {
|        $state = if ($ws -and $ws.properties) { [string]$ws.properties.provisioningState } else { '' }
|        if ($ws -and [string]$ws.id -and ($state -eq 'Succeeded' -or -not $state)) { return (ConvertTo-SIAzWorkspaceObject $ws) }
|        if ($state -in 'Failed', 'Canceled') { throw ("The Log Analytics workspace '{0}' was not created: Azure reports it {1} -- see the activity log of resource group '{2}' for its reason." -f $Name, $state, $ResourceGroupName) }
|        if ($sleep -is [scriptblock]) { & $sleep 5 } else { Start-Sleep -Seconds 5 }
|        $ws = Invoke-SIArm -Path $wsPath -ApiVersion '2022-10-01' -AllowNotFound
|    }
|    throw ("The Log Analytics workspace '{0}' is not ready 5 minutes after it was created (Azure shows: {1})." -f $Name, $(if ($state) { $state } else { 'not there yet' }))
|}
|
|function New-SIAzGraphPage {
|    <# A page shaped like Search-AzGraph's response: enumerates as the rows, with .Data and .SkipToken. #>
|    param([object[]]$Rows, [string]$SkipToken)
|    $list = [System.Collections.Generic.List[object]]::new()
|    foreach ($r in @($Rows)) { if ($null -ne $r) { [void]$list.Add($r) } }
|    Add-Member -InputObject $list -NotePropertyName Data -NotePropertyValue $list.ToArray() -Force
|    Add-Member -InputObject $list -NotePropertyName SkipToken -NotePropertyValue $(if ($SkipToken) { $SkipToken } else { $null }) -Force
|    return ,$list
|}
|
|function Search-SIAzGraphRest {
|    [CmdletBinding()] param([string]$Query, [int]$First = 100, [int]$Skip, [string[]]$Subscription, [string[]]$ManagementGroup, [string]$SkipToken)
|    if (-not $PSBoundParameters.ContainsKey('First') -or $First -le 0) { $First = 100 }
|    $page = Invoke-SIResourceGraphPage -Query $Query -Subscription $Subscription -ManagementGroup $ManagementGroup -First $First -Skip $Skip -SkipToken $SkipToken
|    $p = New-SIAzGraphPage -Rows $page.Data -SkipToken $page.SkipToken
|    return ,$p
|}
|
|function Get-SIAzKeyVaultSecretRest {
|    [CmdletBinding()] param([string]$VaultName, [string]$Name, [switch]$AsPlainText)
|    $j = Get-SIKeyVaultSecretRaw -VaultName $VaultName -Name $Name
|    if (-not $j) { return }
|    if ($AsPlainText) { return [string]$j.value }
|    $sec = New-Object System.Security.SecureString
|    foreach ($ch in ([string]$j.value).ToCharArray()) { $sec.AppendChar($ch) }
|    $sec.MakeReadOnly()
|    return [pscustomobject]@{ VaultName = $VaultName; Name = $Name; Id = [string]$j.id; SecretValue = $sec; ContentType = [string]$j.contentType; Enabled = $j.attributes.enabled; Tags = $j.tags }
|}
|
|function Set-SIAzKeyVaultSecretRest {
|    <# PUT secrets/{name}: a new version of the secret. -SecretValue is a SecureString (as for the cmdlet) or plain text. #>
|    [CmdletBinding()] param([string]$VaultName, [string]$Name, $SecretValue, [string]$ContentType)
|    $plain = if ($SecretValue -is [System.Security.SecureString]) { [System.Net.NetworkCredential]::new('', $SecretValue).Password } else { [string]$SecretValue }
|    $body = @{ value = $plain }
|    if ($ContentType) { $body.contentType = $ContentType }
|    $uri = 'https://{0}.vault.azure.net/secrets/{1}?api-version=7.4' -f $VaultName, [uri]::EscapeDataString($Name)
|    $r = Invoke-SIAzRestRequest -Method PUT -Uri $uri -Audience KeyVault -Body ($body | ConvertTo-Json -Compress) -What ("Key Vault secret '{0}' in '{1}'" -f $Name, $VaultName)
|    $j = $r.Content | ConvertFrom-Json
|    return [pscustomobject]@{ VaultName = $VaultName; Name = $Name; Id = [string]$j.id; ContentType = [string]$j.contentType; Enabled = $j.attributes.enabled }
|}
|
|function ConvertTo-SIAzResourceGroupObject {
|    param($Rg)
|    [pscustomobject]@{ ResourceGroupName = [string]$Rg.name; Location = [string]$Rg.location; ResourceId = [string]$Rg.id; ProvisioningState = [string]$Rg.properties.provisioningState; Tags = $Rg.tags }
|}
|
|function Get-SIAzResourceGroupRest {
|    [CmdletBinding()] param([string]$Name)
|    $sub = Get-SIAzRestSubscriptionId
|    if ($Name) {
|        $rg = Invoke-SIArm -Path ("/subscriptions/$sub/resourcegroups/$Name") -ApiVersion '2021-04-01' -AllowNotFound
|        if (-not $rg) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("Provided resource group '{0}' does not exist." -f $Name) -Target $Name; return }
|        return (ConvertTo-SIAzResourceGroupObject $rg)
|    }
|    foreach ($rg in @(Invoke-SIArm -Path ("/subscriptions/$sub/resourcegroups") -ApiVersion '2021-04-01' -List)) { ConvertTo-SIAzResourceGroupObject $rg }
|}
|
|function New-SIAzResourceGroupRest {
|    [CmdletBinding()] param([string]$Name, [string]$Location, [hashtable]$Tag)
|    $sub = Get-SIAzRestSubscriptionId
|    $body = @{ location = $Location }
|    if ($Tag) { $body['tags'] = $Tag }
|    $rg = Invoke-SIArm -Method PUT -Path ("/subscriptions/$sub/resourcegroups/$Name") -ApiVersion '2021-04-01' -Body $body
|    return (ConvertTo-SIAzResourceGroupObject $rg)
|}
|
|function Get-SIAzRestRoleDefinitions {
|    <# Role definitions visible at -Scope (built-in + custom), cached per scope for the run. #>
|    param([string]$Scope, [switch]$CustomOnly)
|    $st = Get-SIAzRestState
|    $key = 'roledefs|' + $Scope.ToLowerInvariant() + '|' + [string][bool]$CustomOnly
|    if ($st.Cache.ContainsKey($key)) { return $st.Cache[$key] }
|    $path = $Scope.TrimEnd('/') + '/providers/Microsoft.Authorization/roleDefinitions'
|    if ($CustomOnly) { $path += '?$filter=' + [uri]::EscapeDataString("type eq 'CustomRole'") }
|    $defs = @(Invoke-SIArm -Path $path -ApiVersion '2022-04-01' -List)
|    $st.Cache[$key] = $defs
|    return $defs
|}
|
|function Get-SIAzRestRoleDefinitionNames {
|    <#
|        The role NAME of every role definition visible at -Scope, by its id (lowercase): @{ <id> = <roleName> }. For the
|        role-assignment read, which needs only the name. Built-in roles are the same at every scope: they are read ONCE per
|        run and kept as names only; a scope's custom roles are read per scope, names only. The full definitions (every
|        permission of ~800 built-in roles) are never kept. customer B 2026-10-15: the identity producer read the role
|        assignments of 1,195 subscriptions and kept the WHOLE definition list of every one of them (Get-SIAzRestRoleDefinitions
|        caches per scope) -- the process ran out of memory in its sixth minute and every read after that failed.
|        -Fetch (tests): { param($Path) } -> the ARM rows of that list.
|    #>
|    param([Parameter(Mandatory)][string]$Scope, [scriptblock]$Fetch)
|    $st = Get-SIAzRestState
|    $read = { param($p) if ($Fetch) { @(& $Fetch $p) } else { @(Invoke-SIArm -Path $p -ApiVersion '2022-04-01' -List) } }
|    $base = $Scope.TrimEnd('/') + '/providers/Microsoft.Authorization/roleDefinitions?$filter='
|    $bk = 'roledefnames|builtin'
|    if (-not $st.Cache.ContainsKey($bk)) {
|        $m = @{}
|        foreach ($d in (& $read ($base + [uri]::EscapeDataString("type eq 'BuiltInRole'")))) { if ($d -and $d.name) { $m[([string]$d.name).ToLowerInvariant()] = [string]$d.properties.roleName } }
|        $st.Cache[$bk] = $m
|    }
|    $ck = 'roledefnames|custom|' + $Scope.ToLowerInvariant()
|    if (-not $st.Cache.ContainsKey($ck)) {
|        $m = @{}
|        foreach ($d in (& $read ($base + [uri]::EscapeDataString("type eq 'CustomRole'")))) { if ($d -and $d.name) { $m[([string]$d.name).ToLowerInvariant()] = [string]$d.properties.roleName } }
|        $st.Cache[$ck] = $m
|    }
|    [pscustomobject]@{ BuiltIn = $st.Cache[$bk]; Custom = $st.Cache[$ck] }
|}
|
|function ConvertTo-SIAzRoleDefinitionObject {
|    param($D)
|    $perm = @($D.properties.permissions) | Select-Object -First 1
|    [pscustomobject]@{
|        Name = [string]$D.properties.roleName; Id = [string]$D.name; IsCustom = ([string]$D.properties.type -eq 'CustomRole')
|        Description = [string]$D.properties.description
|        Actions = @($perm.actions); NotActions = @($perm.notActions); DataActions = @($perm.dataActions); NotDataActions = @($perm.notDataActions)
|        AssignableScopes = @($D.properties.assignableScopes)
|    }
|}
|
|function Get-SIAzRoleDefinitionRest {
|    [CmdletBinding()] param([switch]$Custom, [string]$Name, [string]$Scope)
|    if (-not $Scope) { $Scope = '/subscriptions/' + (Get-SIAzRestSubscriptionId) }
|    $out = @(Get-SIAzRestRoleDefinitions -Scope $Scope -CustomOnly:$Custom | ForEach-Object { ConvertTo-SIAzRoleDefinitionObject $_ })
|    if ($Name) { $out = @($out | Where-Object { $_.Name -eq $Name }) }
|    return $out
|}
|
|function Resolve-SIAzRestPrincipalNames {
|    <# DisplayName per object id, best effort (Microsoft Graph directoryObjects/getByIds). Empty on any failure: a name
|       is informational, never a reason to fail the read. #>
|    param([string[]]$Ids)
|    $map = @{}
|    $ids = @($Ids | Where-Object { $_ } | Select-Object -Unique)
|    for ($i = 0; $i -lt $ids.Count; $i += 1000) {
|        $chunk = @($ids[$i..([Math]::Min($i + 999, $ids.Count - 1))])
|        try {
|            $r = Invoke-SIAzRestRequest -Method POST -Uri 'https://graph.microsoft.com/v1.0/directoryObjects/getByIds' -Audience Graph `
|                     -Body (@{ ids = $chunk } | ConvertTo-Json -Compress) -What 'Microsoft Graph getByIds' -MaxAttempts 3
|            foreach ($o in @(($r.Content | ConvertFrom-Json).value)) { if ($o.id) { $map[[string]$o.id] = [string]$o.displayName } }
|        } catch { Write-Verbose ('principal names not resolved: {0}' -f $_.Exception.Message) }
|    }
|    return $map
|}
|
|function Get-SIAzRoleAssignmentRest {
|    [CmdletBinding()] param([string]$ObjectId, [string]$Scope, [string]$RoleDefinitionName)
|    $explicitScope = [bool]$Scope
|    if (-not $Scope) { $Scope = '/subscriptions/' + (Get-SIAzRestSubscriptionId) }
|    $path = $Scope.TrimEnd('/') + '/providers/Microsoft.Authorization/roleAssignments'
|    if ($ObjectId) { $path += '?$filter=' + [uri]::EscapeDataString(("principalId eq '{0}'" -f $ObjectId)) }
|    elseif ($explicitScope) { $path += '?$filter=' + [uri]::EscapeDataString('atScope()') }
|    $items = @(Invoke-SIArm -Path $path -ApiVersion '2022-04-01' -List)
|    $subScope = if ($Scope -match '^(/subscriptions/[^/]+)') { $Matches[1] } else { $Scope }
|    # names only, built-ins read once per run (Get-SIAzRestRoleDefinitionNames) -- never the whole definition list per scope
|    $defs = Get-SIAzRestRoleDefinitionNames -Scope $subScope
|    $names = Resolve-SIAzRestPrincipalNames -Ids @($items | ForEach-Object { [string]$_.properties.principalId })
|    foreach ($a in $items) {
|        $rdId = ([string]$a.properties.roleDefinitionId -split '/')[-1]
|        $rdKey = $rdId.ToLowerInvariant()
|        $rdName = if ($defs.BuiltIn.ContainsKey($rdKey)) { $defs.BuiltIn[$rdKey] } else { $defs.Custom[$rdKey] }
|        if ($RoleDefinitionName -and $rdName -ne $RoleDefinitionName) { continue }
|        $oid = [string]$a.properties.principalId
|        [pscustomobject]@{
|            RoleAssignmentId = [string]$a.id; RoleAssignmentName = [string]$a.name; Scope = [string]$a.properties.scope
|            DisplayName = $(if ($names.ContainsKey($oid)) { $names[$oid] } else { $null }); SignInName = $null
|            RoleDefinitionName = $rdName; RoleDefinitionId = $rdId; ObjectId = $oid; ObjectType = [string]$a.properties.principalType
|            CanDelegate = $false; Condition = $a.properties.condition; Description = [string]$a.properties.description
|        }
|    }
|}
|
|function New-SIAzRoleAssignmentRest {
|    # -Description (optional): stored on the assignment itself -- who gave it and why survives on Azure's side, so a later
|    # run can find an assignment it gave even when its own record of that is gone
|    [CmdletBinding()] param([string]$ObjectId, [string]$Scope, [string]$RoleDefinitionName, [string]$Description)
|    $subScope = if ($Scope -match '^(/subscriptions/[^/]+)') { $Matches[1] } else { $Scope }
|    $def = @(Get-SIAzRestRoleDefinitions -Scope $subScope | Where-Object { [string]$_.properties.roleName -eq $RoleDefinitionName }) | Select-Object -First 1
|    if (-not $def) { throw ("The role definition '{0}' was not found at scope '{1}'." -f $RoleDefinitionName, $subScope) }
|    $name = [guid]::NewGuid().ToString()
|    $body = @{ properties = @{ roleDefinitionId = [string]$def.id; principalId = $ObjectId } }
|    if ("$Description".Trim()) { $body.properties['description'] = "$Description".Trim() }
|    $a = Invoke-SIArm -Method PUT -Path ($Scope.TrimEnd('/') + '/providers/Microsoft.Authorization/roleAssignments/' + $name) -ApiVersion '2022-04-01' -Body $body
|    return [pscustomobject]@{ RoleAssignmentId = [string]$a.id; RoleAssignmentName = [string]$a.name; Scope = $Scope; RoleDefinitionName = $RoleDefinitionName; RoleDefinitionId = [string]$def.name; ObjectId = $ObjectId; ObjectType = [string]$a.properties.principalType }
|}
|
|function Get-SIAzTagRest {
|    [CmdletBinding()] param([string]$ResourceId)
|    $t = Invoke-SIArm -Path ($ResourceId.TrimEnd('/') + '/providers/Microsoft.Resources/tags/default') -ApiVersion '2021-04-01'
|    $h = @{}
|    if ($t -and $t.properties -and $t.properties.tags) { foreach ($p in $t.properties.tags.PSObject.Properties) { $h[$p.Name] = [string]$p.Value } }
|    return [pscustomobject]@{ Id = [string]$t.id; Name = 'default'; Properties = [pscustomobject]@{ TagsProperty = $h } }
|}
|
|function Update-SIAzTagRest {
|    [CmdletBinding()] param([string]$ResourceId, [hashtable]$Tag, [string]$Operation = 'Merge')
|    if (-not $Operation) { $Operation = 'Merge' }
|    $t = Invoke-SIArm -Method PATCH -Path ($ResourceId.TrimEnd('/') + '/providers/Microsoft.Resources/tags/default') -ApiVersion '2021-04-01' -Body @{ operation = $Operation; properties = @{ tags = $Tag } }
|    $h = @{}
|    if ($t -and $t.properties -and $t.properties.tags) { foreach ($p in $t.properties.tags.PSObject.Properties) { $h[$p.Name] = [string]$p.Value } }
|    return [pscustomobject]@{ Id = [string]$t.id; Name = 'default'; Properties = [pscustomobject]@{ TagsProperty = $h } }
|}
|
|function Get-SIAzADServicePrincipalRest {
|    [CmdletBinding()] param([string]$ApplicationId, [string]$ObjectId)
|    $uri = if ($ObjectId) { 'https://graph.microsoft.com/v1.0/servicePrincipals/{0}?$select=id,appId,displayName,servicePrincipalNames' -f $ObjectId }
|           else { 'https://graph.microsoft.com/v1.0/servicePrincipals?$filter={0}&$select=id,appId,displayName,servicePrincipalNames' -f [uri]::EscapeDataString(("appId eq '{0}'" -f $ApplicationId)) }
|    $r = Invoke-SIAzRestRequest -Method GET -Uri $uri -Audience Graph -AllowNotFound -What 'Microsoft Graph service principal'
|    if (-not $r) { return }
|    $j = $r.Content | ConvertFrom-Json
|    $items = if ($j.PSObject.Properties['value']) { @($j.value) } else { @($j) }
|    foreach ($s in $items) { if ($s) { [pscustomobject]@{ Id = [string]$s.id; AppId = [string]$s.appId; DisplayName = [string]$s.displayName; ServicePrincipalName = @($s.servicePrincipalNames) } } }
|}
|
|function ConvertTo-SIAzDceObject {
|    param($D)
|    [pscustomobject]@{
|        Name = [string]$D.name; Id = [string]$D.id; Location = [string]$D.location
|        LogIngestionEndpoint = [string]$D.properties.logsIngestion.endpoint; ConfigurationAccessEndpoint = [string]$D.properties.configurationAccess.endpoint
|        NetworkAclsPublicNetworkAccess = [string]$D.properties.networkAcls.publicNetworkAccess; ProvisioningState = [string]$D.properties.provisioningState
|    }
|}
|
|function Get-SIAzDataCollectionEndpointRest {
|    [CmdletBinding()] param([string]$Name, [string]$ResourceGroupName)
|    $sub = Get-SIAzRestSubscriptionId
|    if ($Name -and $ResourceGroupName) {
|        $d = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Insights/dataCollectionEndpoints/$Name") -ApiVersion '2022-06-01' -AllowNotFound
|        if (-not $d) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The data collection endpoint '{0}' was not found in resource group '{1}'." -f $Name, $ResourceGroupName) -Target $Name; return }
|        return (ConvertTo-SIAzDceObject $d)
|    }
|    $path = if ($ResourceGroupName) { "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Insights/dataCollectionEndpoints" } else { "/subscriptions/$sub/providers/Microsoft.Insights/dataCollectionEndpoints" }
|    foreach ($d in @(Invoke-SIArm -Path $path -ApiVersion '2022-06-01' -List)) { if (-not $Name -or [string]$d.name -eq $Name) { ConvertTo-SIAzDceObject $d } }
|}
|
|function New-SIAzDataCollectionEndpointRest {
|    [CmdletBinding()] param([string]$Name, [string]$ResourceGroupName, [string]$Location, [string]$NetworkAclsPublicNetworkAccess = 'Enabled')
|    if (-not $NetworkAclsPublicNetworkAccess) { $NetworkAclsPublicNetworkAccess = 'Enabled' }
|    $sub = Get-SIAzRestSubscriptionId
|    $d = Invoke-SIArm -Method PUT -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Insights/dataCollectionEndpoints/$Name") -ApiVersion '2022-06-01' `
|             -Body @{ location = $Location; properties = @{ networkAcls = @{ publicNetworkAccess = $NetworkAclsPublicNetworkAccess } } }
|    return (ConvertTo-SIAzDceObject $d)
|}
|
|function Get-SIAzDataCollectionRuleRest {
|    [CmdletBinding()] param([string]$Name, [string]$ResourceGroupName)
|    $sub = Get-SIAzRestSubscriptionId
|    $path = if ($ResourceGroupName) { "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Insights/dataCollectionRules" } else { "/subscriptions/$sub/providers/Microsoft.Insights/dataCollectionRules" }
|    foreach ($d in @(Invoke-SIArm -Path $path -ApiVersion '2022-06-01' -List)) {
|        if ($Name -and [string]$d.name -ne $Name) { continue }
|        [pscustomobject]@{ Name = [string]$d.name; Id = [string]$d.id; Location = [string]$d.location; ImmutableId = [string]$d.properties.immutableId; DataCollectionEndpointId = [string]$d.properties.dataCollectionEndpointId }
|    }
|}
|
|function New-SIAzStorageContextRest {
|    <# The storage "context" the REST path needs: the account name (and its endpoints). Every call
|       signs in with the run's identity (OAuth); there is no account-key form. #>
|    [CmdletBinding()] param([string]$StorageAccountName, [switch]$UseConnectedAccount)
|    return [pscustomobject]@{
|        PSTypeName = 'SI.AzRest.StorageContext'; SIRest = $true; StorageAccountName = $StorageAccountName
|        BlobEndPoint = ('https://{0}.blob.core.windows.net/' -f $StorageAccountName)
|        QueueEndPoint = ('https://{0}.queue.core.windows.net/' -f $StorageAccountName)
|        TableEndPoint = ('https://{0}.table.core.windows.net/' -f $StorageAccountName)
|    }
|}
|
|function Get-SIAzRestStorageAccountName {
|    param($Context)
|    if ($null -eq $Context) { throw 'No storage context was given.' }
|    $n = [string]$Context.StorageAccountName
|    if (-not $n) { throw 'The storage context does not name a storage account.' }
|    return $n
|}
|
|function ConvertTo-SIAzStorageAccountObject {
|    param($S)
|    $rg = if ([string]$S.id -match '/resourceGroups/([^/]+)/') { $Matches[1] } else { $null }
|    [pscustomobject]@{
|        StorageAccountName = [string]$S.name; ResourceGroupName = $rg; Id = [string]$S.id; Location = [string]$S.location
|        Kind = [string]$S.kind; Sku = $S.sku; PrimaryEndpoints = $S.properties.primaryEndpoints; ProvisioningState = [string]$S.properties.provisioningState
|        Context = (New-SIAzStorageContextRest -StorageAccountName ([string]$S.name) -UseConnectedAccount)
|    }
|}
|
|function Get-SIAzStorageAccountRest {
|    [CmdletBinding()] param([string]$ResourceGroupName, [string]$Name)
|    $sub = Get-SIAzRestSubscriptionId
|    if ($ResourceGroupName -and $Name) {
|        $s = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Storage/storageAccounts/$Name") -ApiVersion '2023-01-01' -AllowNotFound
|        if (-not $s) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The storage account '{0}' was not found in resource group '{1}'." -f $Name, $ResourceGroupName) -Target $Name; return }
|        return (ConvertTo-SIAzStorageAccountObject $s)
|    }
|    $path = if ($ResourceGroupName) { "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Storage/storageAccounts" } else { "/subscriptions/$sub/providers/Microsoft.Storage/storageAccounts" }
|    foreach ($s in @(Invoke-SIArm -Path $path -ApiVersion '2023-01-01' -List)) { if (-not $Name -or [string]$s.name -eq $Name) { ConvertTo-SIAzStorageAccountObject $s } }
|}
|
|function Get-SIStorageAccountCreateProperties {
|    <#
|        PURE. The properties EVERY storage account SecurityInsight creates gets: shared-key access OFF (no account key
|        and no key-signed SAS works -- a user-delegation SAS still does), Entra ID the default in the portal, HTTPS only,
|        TLS 1.2 at least, no public blob access. Every SecurityInsight host reaches its storage with its own identity
|        (Storage Blob / Queue / Table Data roles), so nothing needs a key. An EXISTING account is never changed here;
|        setup\Set-SIStorageSharedKey.ps1 -Disable switches one off after checking nothing still uses a key.
|    #>
|    return @{
|        supportsHttpsTrafficOnly     = $true
|        allowBlobPublicAccess        = $false
|        allowSharedKeyAccess         = $false
|        defaultToOAuthAuthentication = $true
|        minimumTlsVersion            = 'TLS1_2'
|    }
|}
|
|function New-SIAzStorageAccountRest {
|    [CmdletBinding()]
|    param([string]$ResourceGroupName, [string]$Name, [string]$Location, [string]$SkuName, [string]$Kind, [bool]$EnableHttpsTrafficOnly = $true,
|          [string]$MinimumTlsVersion, [bool]$AllowBlobPublicAccess = $false,
|          # #866 (a private install): 'Disabled' CREATES the account with no public access -- only its private endpoints
|          [ValidateSet('', 'Disabled')][string]$PublicNetworkAccess = '')
|    $sub = Get-SIAzRestSubscriptionId
|    # -EnableHttpsTrafficOnly / -MinimumTlsVersion / -AllowBlobPublicAccess keep the Az cmdlet's shape, but a NEW
|    # account is always created locked down (Get-SIStorageAccountCreateProperties): no caller can weaken it.
|    $props = Get-SIStorageAccountCreateProperties
|    if ($PublicNetworkAccess -eq 'Disabled') { $props['publicNetworkAccess'] = 'Disabled' }
|    $path = "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Storage/storageAccounts/$Name"
|    $null = Invoke-SIArm -Method PUT -Path $path -ApiVersion '2023-01-01' -Body @{ location = $Location; sku = @{ name = $SkuName }; kind = $Kind; properties = $props }
|    # the create is asynchronous: wait until the account is THERE AND PROVISIONED (10 minutes at most) -- what follows
|    # (its roles, its containers) is refused "operation in progress" on an account Azure is still making. A "not found"
|    # in between is "not yet"; an account that is not ready in time is a clear stop, never handed on as if it were.
|    $s = $null; $state = ''
|    $sleep = Get-Variable -Scope Global -Name SI_ArmBusySleep -ValueOnly -ErrorAction Ignore
|    for ($i = 0; $i -lt 120; $i++) {
|        $s = Invoke-SIArm -Path $path -ApiVersion '2023-01-01' -AllowNotFound
|        $state = if ($s -and $s.properties) { [string]$s.properties.provisioningState } else { '' }
|        if ($s -and ($state -eq 'Succeeded' -or -not $state)) { return (ConvertTo-SIAzStorageAccountObject $s) }
|        if ($state -in 'Failed', 'Canceled') { throw ("The storage account '{0}' was not created: Azure reports it {1} -- see the activity log of resource group '{2}' for its reason." -f $Name, $state, $ResourceGroupName) }
|        if ($sleep -is [scriptblock]) { & $sleep 5 } else { Start-Sleep -Seconds 5 }
|    }
|    if (-not $s) { throw ("The storage account '{0}' was requested but did not appear." -f $Name) }
|    throw ("The storage account '{0}' is not ready 10 minutes after it was created (Azure shows: {1})." -f $Name, $(if ($state) { $state } else { 'no state' }))
|}
|
|function Get-SIAzStorageContainerRest {
|    [CmdletBinding()] param([string]$Name, [object]$Context)
|    $acct = Get-SIAzRestStorageAccountName -Context $Context
|    $c = Test-SIBlobContainer -Account $acct -Container $Name
|    if (-not $c) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("Can not find the container '{0}' (ContainerNotFound)." -f $Name) -Target $Name; return }
|    return $c
|}
|
|function New-SIAzStorageContainerRest {
|    [CmdletBinding()] param([string]$Name, [object]$Context, [string]$Permission)
|    $acct = Get-SIAzRestStorageAccountName -Context $Context
|    return (New-SIBlobContainer -Account $acct -Container $Name)
|}
|
|function ConvertTo-SIAzBlobObject {
|    <# A blob shaped like Get-AzStorageBlob's: Name / Length / LastModified / ETag, and the ICloudBlob members the call
|       sites read (Name, Container.Name, Properties.ETag / LastModified / Length). #>
|    param($B, [string]$Account)
|    $cloud = [pscustomobject]@{
|        Name = $B.Name; SIAccount = $Account
|        Container = [pscustomobject]@{ Name = $B.Container }
|        Properties = [pscustomobject]@{ ETag = $B.ETag; LastModified = $B.LastModified; Length = $B.Length; ContentType = $B.ContentType }
|    }
|    [pscustomobject]@{ Name = $B.Name; Length = $B.Length; LastModified = $B.LastModified; ETag = $B.ETag; ContentType = $B.ContentType; BlobType = 'BlockBlob'; ICloudBlob = $cloud }
|}
|
|function Get-SIAzStorageBlobRest {
|    [CmdletBinding()] param([string]$Container, [string]$Blob, [string]$Prefix, [object]$Context)
|    $acct = Get-SIAzRestStorageAccountName -Context $Context
|    if ($Blob) {
|        $b = Get-SIBlobProperties -Account $acct -Container $Container -Blob $Blob
|        if (-not $b) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("Can not find blob '{0}' in container '{1}' (BlobNotFound)." -f $Blob, $Container) -Target $Blob; return }
|        return (ConvertTo-SIAzBlobObject $b $acct)
|    }
|    foreach ($b in @(Get-SIBlobList -Account $acct -Container $Container -Prefix $Prefix)) { ConvertTo-SIAzBlobObject $b $acct }
|}
|
|function Get-SIAzStorageBlobContentRest {
|    [CmdletBinding()] param([string]$Container, [string]$Blob, [object]$CloudBlob, [string]$Destination, [object]$Context, [switch]$Force)
|    if ($CloudBlob) { $Blob = [string]$CloudBlob.Name; $Container = [string]$CloudBlob.Container.Name }
|    $acct = if ($Context) { Get-SIAzRestStorageAccountName -Context $Context } else { [string]$CloudBlob.SIAccount }
|    $target = $Destination
|    if (-not $target) { $target = (Get-Location).Path }
|    if (Test-Path -LiteralPath $target -PathType Container) { $target = [System.IO.Path]::Combine($target, ($Blob -replace '/', [System.IO.Path]::DirectorySeparatorChar)) }
|    $dir = Split-Path -Parent $target
|    if ($dir -and -not (Test-Path -LiteralPath $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null }
|    $null = Get-SIBlobContent -Account $acct -Container $Container -Blob $Blob -Destination $target
|    $b = Get-SIBlobProperties -Account $acct -Container $Container -Blob $Blob
|    if ($b) { return (ConvertTo-SIAzBlobObject $b $acct) }
|}
|
|function Set-SIAzStorageBlobContentRest {
|    [CmdletBinding()] param([string]$File, [string]$Container, [string]$Blob, [object]$Context, [switch]$Force)
|    $acct = Get-SIAzRestStorageAccountName -Context $Context
|    if (-not $Blob) { $Blob = Split-Path -Leaf $File }
|    $etag = Set-SIBlobContent -Account $acct -Container $Container -Blob $Blob -File $File
|    $len = (Get-Item -LiteralPath $File).Length
|    return (ConvertTo-SIAzBlobObject ([pscustomobject]@{ Name = $Blob; Container = $Container; Length = $len; LastModified = [DateTimeOffset]::UtcNow; ETag = $etag; ContentType = 'application/octet-stream' }) $acct)
|}
|
|function Remove-SIAzStorageBlobRest {
|    [CmdletBinding()] param([string]$Container, [string]$Blob, [object]$Context, [switch]$Force)
|    Remove-SIBlob -Account (Get-SIAzRestStorageAccountName -Context $Context) -Container $Container -Blob $Blob
|}
|
|function Start-SIAzStorageBlobCopyRest {
|    <# A copy within the account: download and upload (the files SI copies are small exports), so no SAS and no
|       copy-source authorization is needed. #>
|    [CmdletBinding()] param([string]$SrcContainer, [string]$SrcBlob, [string]$DestContainer, [string]$DestBlob, [object]$Context, [switch]$Force)
|    $acct = Get-SIAzRestStorageAccountName -Context $Context
|    $bytes = Get-SIBlobContent -Account $acct -Container $SrcContainer -Blob $SrcBlob
|    $null = Set-SIBlobContent -Account $acct -Container $DestContainer -Blob $DestBlob -Bytes $bytes
|    return [pscustomobject]@{ Name = $DestBlob; Container = $DestContainer }
|}
|
|function New-SIAzQueueObject {
|    <# A queue shaped like Get-AzStorageQueue's: .QueueClient with SendMessage / ReceiveMessage / DeleteMessage, as the
|       worker queue calls them. #>
|    param([string]$Account, [string]$Name)
|    $client = [pscustomobject]@{ Name = $Name; SIAccount = $Account }
|    $client | Add-Member -MemberType ScriptMethod -Name SendMessage -Value { param($Text) Send-SIQueueMessage -Account $this.SIAccount -Queue $this.Name -Text ([string]$Text) }
|    $client | Add-Member -MemberType ScriptMethod -Name ReceiveMessage -Value {
|        param($VisibilityTimeout)
|        $secs = if ($VisibilityTimeout -is [timespan]) { [int]$VisibilityTimeout.TotalSeconds } elseif ($VisibilityTimeout) { [int]$VisibilityTimeout } else { 30 }
|        [pscustomobject]@{ Value = (Receive-SIQueueMessage -Account $this.SIAccount -Queue $this.Name -VisibilityTimeoutSeconds $secs) }
|    }
|    $client | Add-Member -MemberType ScriptMethod -Name DeleteMessage -Value { param($Id, $PopReceipt) Remove-SIQueueMessage -Account $this.SIAccount -Queue $this.Name -MessageId ([string]$Id) -PopReceipt ([string]$PopReceipt) }
|    return [pscustomobject]@{ Name = $Name; QueueClient = $client }
|}
|
|function Get-SIAzStorageQueueRest {
|    [CmdletBinding()] param([string]$Name, [object]$Context)
|    $acct = Get-SIAzRestStorageAccountName -Context $Context
|    if (-not (Test-SIQueue -Account $acct -Queue $Name)) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("Can not find queue '{0}' (QueueNotFound)." -f $Name) -Target $Name; return }
|    return (New-SIAzQueueObject -Account $acct -Name $Name)
|}
|
|function New-SIAzStorageQueueRest {
|    [CmdletBinding()] param([string]$Name, [object]$Context)
|    $acct = Get-SIAzRestStorageAccountName -Context $Context
|    New-SIQueue -Account $acct -Queue $Name
|    return (New-SIAzQueueObject -Account $acct -Name $Name)
|}
|
|# #639 lane 4: a read in parts when one answer cannot carry it (Read-SILaParts) -- for every reader of a large result.
|# Loaded LAST: it reads through this file's Invoke-SIAzOperationalInsightsQuery (and loads this file itself when it is
|# dot-sourced alone, guarded on Invoke-SIArm -- defined by now, so never twice).
|if (-not (Get-Command -Name Read-SILaParts -ErrorAction Ignore)) {
|    $__siLaParts = [System.IO.Path]::Combine($PSScriptRoot, 'SI-LaParts.ps1')
|    if ([System.IO.File]::Exists($__siLaParts)) { . $__siLaParts }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-LaStreamRead.ps1'] = @{ Sha256 = '76262967b7a09e5713b4687cf62f9267864ddcc0f3f11e678958f17226738511'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- A LOG ANALYTICS ANSWER READ AS IT ARRIVES, NEVER HELD WHOLE (Risk Analysis' lookups and answers;
|    owner rule "same method, all sizes; stream always").
|
|    The lean read (#639, SI-AzRest.ps1 ConvertFrom-SILaQueryRows) reads the answer's BYTES into one array of their full
|    length, parses them into a JsonDocument (an index of every token beside them), and only then builds the rows -- so
|    while a lookup is read the process holds the whole answer about three times (bytes + index + rows). A Risk Analysis
|    lookup at a large install is a tenant-sized answer (the identity CI lookup of a 153,000-user tenant: every key of every
|    identity), read in parts of up to the service's own answer limit; the large install's Risk Analysis job ran out of
|    memory on 2 CPU / 4 GiB (#730).
|
|    Here the response stream is read through a small buffer: each ROW is parsed when its bytes are in, turned into the row
|    object at once, and its bytes are let go. Only the rows are held -- the same rows the lean read builds: the same
|    columns in the same order, the same TEXT values (strings as sent, numbers in the service's own spelling, true / false,
|    null stays null, a nested value as its raw JSON text), the table named PrimaryResult else the first, the column list
|    (name / type) and the partial-error object. Compact rows (SI_LaCompactRows, Get-SILaCompactRowType) when the caller
|    asks for them, PSCustomObject rows otherwise.
|
|    pwsh 7 only (System.Text.Json's Utf8JsonReader, compiled once per process with Add-Type). Windows PowerShell, or a
|    process where the reader cannot be compiled: Get-SILaStreamReaderType answers $null and the caller keeps the lean read.
|
|    #836 (found 2026-10-20): NOTHING HERE LIVES ONLY IN THIS FILE'S SCRIPT SCOPE. A function reads $script: of its CALLER's
|    script, and in a container the entry point (container\Start-SIInContainer.ps1) dot-sources SI-AzRest.ps1 -> this file
|    in ITS scope while every engine runs as its own script and skips reloading it -- so a $script: source was $null there,
|    Add-Type failed, the failure was swallowed and no container engine ever streamed. The C# source comes from a FUNCTION
|    (Get-SILaStreamReaderSource), the compiled type is found by its name, and the state a run must share (the reader is off
|    and why, the last read's numbers) is $global:. The older read stays the fallback, but it is never silent: one plain line
|    on the run log says the older read is used and why (Write-SILaStreamFallback).
|#>
|
|function Get-SILaStreamReaderSource {
|    <# The reader's C# source. A FUNCTION, never a $script: variable (#836): callable from any script's scope. #>
|    @'
|using System;
|using System.Collections.Generic;
|using System.IO;
|using System.Management.Automation;
|using System.Reflection;
|using System.Text;
|using System.Text.Json;
|
|namespace SecurityInsight.LaStream
|{
|    public sealed class LaStreamAnswer
|    {
|        public object[] Rows { get; set; }
|        public string[] ColumnNames { get; set; }
|        public string[] ColumnTypes { get; set; }
|        public string ErrorJson { get; set; }
|        public long BytesRead { get; set; }
|        public int LargestBuffer { get; set; }
|        // with a page callback: the rows handed on and in how many pages (Rows is then empty)
|        public long RowsDelivered { get; set; }
|        public int Pages { get; set; }
|    }
|
|    // the caller's own page callback failed -- not a fault of the reader or of the answer
|    public sealed class LaStreamPageException : Exception
|    {
|        public LaStreamPageException(Exception inner) : base("the page callback failed: " + (inner == null ? "" : inner.Message), inner) { }
|    }
|
|    public static class LaStreamReader
|    {
|        // the rows handed on a page at a time: the table being handed on, the answer bytes of the rows waiting, the totals
|        private sealed class PageSink
|        {
|            public Action<object[]> On;
|            public long Limit;
|            public long Bytes;
|            public object Table;
|            public bool FromNonPrimary;
|            public long Rows;
|            public int Pages;
|        }
|
|        private static void Flush(PageSink sink, List<object> rows)
|        {
|            if (sink == null || rows == null || rows.Count == 0) { if (sink != null) sink.Bytes = 0; return; }
|            object[] page = rows.ToArray();
|            rows.Clear();
|            sink.Bytes = 0;
|            try { sink.On(page); }
|            catch (Exception e) { throw new LaStreamPageException(e); }
|            sink.Rows += page.Length;
|            sink.Pages++;
|        }
|
|        public static LaStreamAnswer Read(Stream stream, bool compact, Func<string[], ConstructorInfo> compactCtorFor, int bufferSize, Func<string[], string[], object> plainRowFor)
|        {
|            return Read(stream, compact, compactCtorFor, bufferSize, plainRowFor, null, 0);
|        }
|
|        // onPage: the primary table's rows are handed on a page at a time (about pageBytes of the answer each) and never
|        // collected; the answer's Rows is then empty, RowsDelivered / Pages say what was handed on
|        public static LaStreamAnswer Read(Stream stream, bool compact, Func<string[], ConstructorInfo> compactCtorFor, int bufferSize, Func<string[], string[], object> plainRowFor, Action<object[]> onPage, long pageBytes)
|        {
|            PageSink sink = onPage == null ? null : new PageSink { On = onPage, Limit = Math.Max(1024, pageBytes) };
|            return ReadCore(stream, compact, compactCtorFor, bufferSize, plainRowFor, sink);
|        }
|
|        private enum Ctx { Root, Tables, Table, Columns, Rows, Done }
|
|        private sealed class TableAcc
|        {
|            public int Index;
|            public string Name = "";
|            public List<string> Names = new List<string>();
|            public List<string> Types = new List<string>();
|            public bool ColumnsDone;
|            public bool Keep = true;
|            public ConstructorInfo Ctor;
|            public bool CtorAsked;
|            public Dictionary<string, string> Pool;
|            public List<object> Rows = new List<object>();
|            public List<string[]> Early;   // rows met before the column list (kept as values, built at the end)
|            public Func<string[], string[], object> Plain;   // names that differ only in case: the row is built as the lean read builds it
|            public bool PlainChecked;
|        }
|
|        private static LaStreamAnswer ReadCore(Stream stream, bool compact, Func<string[], ConstructorInfo> compactCtorFor, int bufferSize, Func<string[], string[], object> plainRowFor, PageSink sink)
|        {
|            if (stream == null) throw new ArgumentNullException("stream");
|            byte[] buf = new byte[Math.Max(1024, bufferSize)];
|            int filled = 0, start = 0;
|            bool final = false;
|            long total = 0;
|            int largest = buf.Length;
|            JsonReaderState state = new JsonReaderState();
|            var stack = new List<Ctx>();
|            string prop = null;
|            TableAcc cur = null, first = null, primary = null;
|            int tableCount = 0;
|            string errorJson = null;
|            bool bomChecked = false;
|
|            while (true)
|            {
|                // fill: keep what is not consumed, grow only when one unit does not fit
|                if (start > 0) { Buffer.BlockCopy(buf, start, buf, 0, filled - start); filled -= start; start = 0; }
|                if (!final)
|                {
|                    if (filled == buf.Length)
|                    {
|                        var bigger = new byte[buf.Length * 2]; Buffer.BlockCopy(buf, 0, bigger, 0, filled); buf = bigger;
|                        if (buf.Length > largest) largest = buf.Length;
|                    }
|                    int n = stream.Read(buf, filled, buf.Length - filled);
|                    if (n <= 0) final = true; else { filled += n; total += n; }
|                    if (!bomChecked && (filled >= 3 || final))
|                    {
|                        bomChecked = true;
|                        if (filled >= 3 && buf[0] == 0xEF && buf[1] == 0xBB && buf[2] == 0xBF) start = 3;
|                    }
|                    if (!final && filled < buf.Length && n > 0) continue;   // read until the buffer is full or the stream ends
|                }
|
|                var reader = new Utf8JsonReader(new ReadOnlySpan<byte>(buf, start, filled - start), final, state);
|                bool more = false;
|                while (true)
|                {
|                    JsonReaderState before = reader.CurrentState;
|                    long beforeAt = reader.BytesConsumed;
|                    if (!reader.Read()) { more = true; break; }
|                    JsonTokenType tt = reader.TokenType;
|                    Ctx ctx = stack.Count == 0 ? Ctx.Root : stack[stack.Count - 1];
|                    if (stack.Count == 0)
|                    {
|                        if (tt == JsonTokenType.StartObject) { stack.Add(Ctx.Root); continue; }
|                        throw new JsonException("the Log Analytics answer is not a JSON object");
|                    }
|                    if (tt == JsonTokenType.PropertyName) { prop = reader.GetString(); continue; }
|
|                    // a UNIT: a value that is read whole (a row, a column, the error, anything skipped) -- its bytes must all be
|                    // in the buffer; when they are not, everything goes back to before its first token and more is read
|                    bool container = (tt == JsonTokenType.StartObject || tt == JsonTokenType.StartArray);
|                    switch (ctx)
|                    {
|                        case Ctx.Root:
|                            if (tt == JsonTokenType.EndObject) { stack[stack.Count - 1] = Ctx.Done; continue; }
|                            if (prop == "tables" && tt == JsonTokenType.StartArray) { stack.Add(Ctx.Tables); prop = null; continue; }
|                            {
|                                int us = start + (int)reader.TokenStartIndex;
|                                if (container && !reader.TrySkip()) { state = before; start += (int)beforeAt; more = true; goto Refill; }
|                                int ue = start + (int)reader.BytesConsumed;
|                                if (prop == "error")
|                                {
|                                    errorJson = (tt == JsonTokenType.Null) ? null : Encoding.UTF8.GetString(buf, us, ue - us);
|                                }
|                                prop = null;
|                                continue;
|                            }
|                        case Ctx.Tables:
|                            if (tt == JsonTokenType.EndArray) { stack.RemoveAt(stack.Count - 1); continue; }
|                            if (tt == JsonTokenType.StartObject)
|                            {
|                                cur = new TableAcc { Index = tableCount++, Plain = plainRowFor };
|                                // a later table's rows are kept only while no PrimaryResult was found before it
|                                cur.Keep = (primary == null);
|                                if (compact) cur.Pool = new Dictionary<string, string>(StringComparer.Ordinal);
|                                stack.Add(Ctx.Table); prop = null; continue;
|                            }
|                            if (container && !reader.TrySkip()) { state = before; start += (int)beforeAt; more = true; goto Refill; }
|                            continue;
|                        case Ctx.Table:
|                            if (tt == JsonTokenType.EndObject)
|                            {
|                                stack.RemoveAt(stack.Count - 1);
|                                FinishTable(cur, compact, compactCtorFor);
|                                if (sink != null && object.ReferenceEquals(sink.Table, cur)) Flush(sink, cur.Rows);
|                                if (cur.Index == 0) first = cur;
|                                if (primary == null && cur.Name == "PrimaryResult") { primary = cur; if (first != null && first != cur) first.Rows = null; }
|                                else if (cur.Index != 0) cur.Rows = null;
|                                cur = null; prop = null; continue;
|                            }
|                            if (prop == "name" && !container)
|                            {
|                                cur.Name = (tt == JsonTokenType.String) ? (reader.GetString() ?? "") : "";
|                                prop = null; continue;
|                            }
|                            if (prop == "columns" && tt == JsonTokenType.StartArray) { stack.Add(Ctx.Columns); prop = null; continue; }
|                            if (prop == "rows" && tt == JsonTokenType.StartArray) { stack.Add(Ctx.Rows); prop = null; continue; }
|                            if (container && !reader.TrySkip()) { state = before; start += (int)beforeAt; more = true; goto Refill; }
|                            prop = null; continue;
|                        case Ctx.Columns:
|                            if (tt == JsonTokenType.EndArray) { stack.RemoveAt(stack.Count - 1); cur.ColumnsDone = true; continue; }
|                            {
|                                int us = start + (int)reader.TokenStartIndex;
|                                if (container && !reader.TrySkip()) { state = before; start += (int)beforeAt; more = true; goto Refill; }
|                                int ue = start + (int)reader.BytesConsumed;
|                                if (tt == JsonTokenType.StartObject) ReadColumn(buf, us, ue - us, cur);
|                                continue;
|                            }
|                        case Ctx.Rows:
|                            if (tt == JsonTokenType.EndArray) { stack.RemoveAt(stack.Count - 1); continue; }
|                            {
|                                int us = start + (int)reader.TokenStartIndex;
|                                if (container && !reader.TrySkip()) { state = before; start += (int)beforeAt; more = true; goto Refill; }
|                                int ue = start + (int)reader.BytesConsumed;
|                                if (tt == JsonTokenType.StartArray && cur.Keep)
|                                {
|                                    if (sink == null) AddRow(buf, us, ue - us, cur, compact, compactCtorFor);
|                                    else if (SinkTakes(sink, cur))
|                                    {
|                                        AddRow(buf, us, ue - us, cur, compact, compactCtorFor);
|                                        sink.Bytes += (ue - us);
|                                        if (sink.Bytes >= sink.Limit) Flush(sink, cur.Rows);
|                                    }
|                                }
|                                continue;
|                            }
|                        default:
|                            if (container && !reader.TrySkip()) { state = before; start += (int)beforeAt; more = true; goto Refill; }
|                            continue;
|                    }
|                }
|                state = reader.CurrentState;
|                start += (int)reader.BytesConsumed;
|            Refill:
|                if (final)
|                {
|                    if (stack.Count == 0 || stack[0] != Ctx.Done) throw new JsonException("the Log Analytics answer ended before it was complete");
|                    break;
|                }
|                if (!more) continue;
|            }
|
|            TableAcc pick = primary ?? first;
|            var ans = new LaStreamAnswer { ErrorJson = errorJson, BytesRead = total, LargestBuffer = largest };
|            if (sink != null) { ans.RowsDelivered = sink.Rows; ans.Pages = sink.Pages; }
|            if (pick != null)
|            {
|                ans.Rows = (pick.Rows == null || sink != null) ? new object[0] : pick.Rows.ToArray();
|                ans.ColumnNames = pick.Names.ToArray();
|                ans.ColumnTypes = pick.Types.ToArray();
|            }
|            else { ans.Rows = new object[0]; ans.ColumnNames = new string[0]; ans.ColumnTypes = new string[0]; }
|            return ans;
|        }
|
|        // with a page callback: does this table's row go to the pages? The table named PrimaryResult, else the first table --
|        // as the whole read picks it. A PrimaryResult that comes after another table's rows were handed on cannot be read in
|        // pages (those rows are gone): the read fails, never a wrong set handed on.
|        private static bool SinkTakes(PageSink sink, TableAcc cur)
|        {
|            if (object.ReferenceEquals(sink.Table, cur)) return true;
|            if (sink.Table == null)
|            {
|                if (cur.Name == "PrimaryResult" || cur.Index == 0) { sink.Table = cur; sink.FromNonPrimary = (cur.Name != "PrimaryResult"); return true; }
|                return false;
|            }
|            if (cur.Name == "PrimaryResult" && sink.FromNonPrimary)
|            {
|                if (sink.Rows > 0) throw new InvalidOperationException("the Log Analytics answer names its primary table after another table whose rows were already handed on -- it cannot be read in pages");
|                ((TableAcc)sink.Table).Rows.Clear();
|                sink.Table = cur; sink.FromNonPrimary = false; sink.Bytes = 0;
|                return true;
|            }
|            return false;
|        }
|
|        private static void ReadColumn(byte[] buf, int off, int len, TableAcc t)
|        {
|            var r = new Utf8JsonReader(new ReadOnlySpan<byte>(buf, off, len), true, new JsonReaderState());
|            r.Read();   // StartObject
|            string name = null, type = null; bool hasName = false;
|            while (r.Read())
|            {
|                if (r.TokenType == JsonTokenType.EndObject && r.CurrentDepth == 0) break;
|                if (r.TokenType != JsonTokenType.PropertyName) continue;
|                string p = r.GetString();
|                r.Read();
|                if (r.TokenType == JsonTokenType.StartObject || r.TokenType == JsonTokenType.StartArray) { r.Skip(); continue; }
|                if (p == "name") { name = (r.TokenType == JsonTokenType.String || r.TokenType == JsonTokenType.Null) ? r.GetString() : Encoding.UTF8.GetString(r.ValueSpan.ToArray()); hasName = true; }
|                else if (p == "type") { type = (r.TokenType == JsonTokenType.String || r.TokenType == JsonTokenType.Null) ? r.GetString() : Encoding.UTF8.GetString(r.ValueSpan.ToArray()); }
|            }
|            if (!hasName) throw new KeyNotFoundException("a column of the Log Analytics answer has no name");
|            t.Names.Add(name); t.Types.Add(type);
|        }
|
|        private static string[] ReadCells(byte[] buf, int off, int len, int nCols, Dictionary<string, string> pool)
|        {
|            var r = new Utf8JsonReader(new ReadOnlySpan<byte>(buf, off, len), true, new JsonReaderState());
|            r.Read();   // StartArray
|            var cells = nCols >= 0 ? new string[nCols] : null;
|            var open = nCols < 0 ? new List<string>() : null;
|            int i = 0;
|            while (r.Read())
|            {
|                if (r.TokenType == JsonTokenType.EndArray && r.CurrentDepth == 0) break;
|                string s;
|                switch (r.TokenType)
|                {
|                    case JsonTokenType.String: s = r.GetString(); break;
|                    case JsonTokenType.Null: s = null; break;
|                    case JsonTokenType.True: s = "true"; break;
|                    case JsonTokenType.False: s = "false"; break;
|                    case JsonTokenType.StartObject:
|                    case JsonTokenType.StartArray:
|                        {
|                            int ts = (int)r.TokenStartIndex;
|                            r.Skip();
|                            s = Encoding.UTF8.GetString(buf, off + ts, (int)r.BytesConsumed - ts);
|                            break;
|                        }
|                    default: s = Encoding.UTF8.GetString(r.ValueSpan.ToArray()); break;
|                }
|                if (s != null && pool != null && s.Length <= 32)
|                {
|                    string p0;
|                    if (pool.TryGetValue(s, out p0)) s = p0; else pool[s] = s;
|                }
|                if (open != null) open.Add(s);
|                else if (i < nCols) cells[i] = s;
|                i++;
|            }
|            return open != null ? open.ToArray() : cells;
|        }
|
|        private static object MakeRow(string[] cells, TableAcc t)
|        {
|            if (t.Ctor != null) return t.Ctor.Invoke(new object[] { cells });
|            if (!t.PlainChecked)
|            {
|                t.PlainChecked = true;
|                var seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase); bool dup = false;
|                foreach (var nm in t.Names) { if (nm != null && !seen.Add(nm)) { dup = true; break; } }
|                if (!dup) t.Plain = null;
|            }
|            if (t.Plain != null) return t.Plain(t.Names.ToArray(), cells);
|            var o = new PSObject();
|            int n = t.Names.Count;
|            for (int i = 0; i < n; i++)
|            {
|                string v = i < cells.Length ? cells[i] : null;
|                var existing = o.Properties[t.Names[i]];
|                if (existing != null) existing.Value = v; else o.Properties.Add(new PSNoteProperty(t.Names[i], v));
|            }
|            return o;
|        }
|
|        private static void AddRow(byte[] buf, int off, int len, TableAcc t, bool compact, Func<string[], ConstructorInfo> compactCtorFor)
|        {
|            if (!t.ColumnsDone && t.Names.Count == 0)
|            {
|                if (t.Early == null) t.Early = new List<string[]>();
|                t.Early.Add(ReadCells(buf, off, len, -1, null));
|                return;
|            }
|            if (compact && !t.CtorAsked) { MakeRowPrepare(t, compactCtorFor); }
|            var cells = ReadCells(buf, off, len, t.Names.Count, t.Ctor != null ? t.Pool : null);
|            t.Rows.Add(MakeRow(cells, t));
|        }
|
|        private static void MakeRowPrepare(TableAcc t, Func<string[], ConstructorInfo> compactCtorFor)
|        {
|            // the compact type for these columns, asked once; none -> PSCustomObject rows without pooling, as the lean read
|            t.CtorAsked = true;
|            if (compactCtorFor != null) t.Ctor = compactCtorFor(t.Names.ToArray());
|            if (t.Ctor == null) t.Pool = null;
|        }
|
|        private static void FinishTable(TableAcc t, bool compact, Func<string[], ConstructorInfo> compactCtorFor)
|        {
|            if (t.Early == null) return;
|            if (!t.Keep) { t.Early = null; return; }
|            var built = new List<object>(t.Early.Count + t.Rows.Count);
|            if (compact && !t.CtorAsked) MakeRowPrepare(t, compactCtorFor);
|            int n = t.Names.Count;
|            foreach (var raw in t.Early)
|            {
|                var cells = new string[n];
|                for (int i = 0; i < n && i < raw.Length; i++) cells[i] = raw[i];
|                built.Add(MakeRow(cells, t));
|            }
|            built.AddRange(t.Rows);
|            t.Rows = built; t.Early = null;
|        }
|    }
|}
|'@
|}
|
|function Get-SILaStreamReaderType {
|    <# The compiled reader ([SecurityInsight.LaStream.LaStreamReader]), built once per process; $null where it cannot be
|       (Windows PowerShell, or a compile that fails -- the caller then keeps the lean read). Scope-independent (#836): the
|       compiled type is found by its NAME (a type is per process), the source comes from a function, and a compile that
|       failed is remembered for the whole process in $global:SI_LaStreamReaderOff (its reason) -- tried once, not per read. #>
|    if ($PSVersionTable.PSEdition -ne 'Core') { return $null }
|    # off for this process (it could not be built, or it failed on an answer -- Read-SILaQueryStreamSafe): the older read
|    if ($global:SI_LaStreamReaderOff) { return $null }
|    $t = 'SecurityInsight.LaStream.LaStreamReader' -as [type]
|    if ($null -ne $t) { return $t }
|    try {
|        $src = Get-SILaStreamReaderSource
|        if ([string]::IsNullOrWhiteSpace([string]$src)) { throw 'its source is empty' }
|        Add-Type -TypeDefinition $src -Language CSharp -ErrorAction Stop
|        $t = 'SecurityInsight.LaStream.LaStreamReader' -as [type]
|        if ($null -eq $t) { throw 'the compiled type was not found' }
|        return $t
|    } catch {
|        $global:SI_LaStreamReaderOff = 'the reader could not be built in this process: ' + (Get-SILaStreamShortReason $_.Exception.Message)
|        return $null
|    }
|}
|
|function Get-SILaStreamShortReason {
|    <# PURE. The first line of an error text, at most 300 characters (a compiler error lists every line it refused). #>
|    param([AllowNull()][AllowEmptyString()][string]$Text)
|    $s = ([string]$Text -split "`r?`n" | Where-Object { $_.Trim() } | Select-Object -First 1)
|    if (-not $s) { return 'no reason given' }
|    $s = $s.Trim()
|    if ($s.Length -gt 300) { $s = $s.Substring(0, 300) + ' ...' }
|    return $s
|}
|
|function Write-SILaStreamFallback {
|    <#
|        #836: the older read is used instead of the streaming one -- ONE plain line on the run log (the transcript) saying
|        so and why. -Once: said once per process for that reason (the reader cannot be built: every later read is the
|        older one too, and saying it per read would flood the log). Without -Once (one read whose stream failed and was
|        read again the older way) it is said every time it happens. The results are the same either way.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Reason, [switch]$Once)
|    if ([string]::IsNullOrWhiteSpace($Reason)) { $Reason = 'the streaming reader is not available in this process' }
|    if ($Once) {
|        if ($null -eq $global:SI_LaStreamFallbackSaid) { $global:SI_LaStreamFallbackSaid = @{} }
|        if ($global:SI_LaStreamFallbackSaid.ContainsKey($Reason)) { return }
|        $global:SI_LaStreamFallbackSaid[$Reason] = $true
|    }
|    Write-Host ('Log Analytics answers are read the older way (whole, then parsed) instead of as they arrive -- {0}. The rows are the same; the read uses more memory.' -f $Reason) -ForegroundColor DarkYellow
|}
|
|function Read-SILaQueryStreamSafe {
|    <#
|        #836: ConvertFrom-SILaQueryStream for Invoke-SILaQuery's -ReadStream -- DATA FIRST: a read that fails (the reader
|        throws, the answer is not valid JSON, the connection drops mid-answer) is NOT an error of the query: it answers a
|        marker (.SILaStreamFailed = why) and Invoke-SILaQuery reads the same query again the older way and says so in one
|        line. A failure that is not the network's (IOException / a socket error) turns streaming off for the rest of the
|        process ($global:SI_LaStreamReaderOff) so a reader fault never doubles every read.
|    #>
|    param([Parameter(Mandatory)][System.IO.Stream]$Stream, [switch]$Compact,
|          # the rows a page at a time (ConvertFrom-SILaQueryStream -OnPage); -PageState counts the pages handed on so far
|          [scriptblock]$OnPage, [long]$PageBytes = 4MB, [hashtable]$PageState)
|    try {
|        if ($OnPage) { return (ConvertFrom-SILaQueryStream -Stream $Stream -Compact:$Compact -OnPage $OnPage -PageBytes $PageBytes -PageState $PageState) }
|        return (ConvertFrom-SILaQueryStream -Stream $Stream -Compact:$Compact)
|    }
|    catch {
|        $ex = $_.Exception
|        # the CALLER's page callback failed (a page could not be stored): its own failure, passed on as it is -- never a
|        # reader fault, never read again
|        for ($e = $ex; $null -ne $e; $e = $e.InnerException) {
|            if ($e.GetType().FullName -eq 'SecurityInsight.LaStream.LaStreamPageException') {
|                $cause = $e.InnerException
|                while ($cause -is [System.Management.Automation.MethodInvocationException] -and $null -ne $cause.InnerException) { $cause = $cause.InnerException }
|                if ($cause -is [System.Management.Automation.RuntimeException] -and $cause.ErrorRecord) { throw $cause.ErrorRecord }
|                if ($null -ne $cause) { throw $cause }
|                throw $e
|            }
|        }
|        $net = $false
|        for ($e = $ex; $null -ne $e; $e = $e.InnerException) {
|            if ($e -is [System.IO.IOException] -or $e -is [System.Net.WebException] -or $e -is [System.Net.Sockets.SocketException]) { $net = $true; break }
|        }
|        $inner = $ex; while ($null -ne $inner.InnerException) { $inner = $inner.InnerException }
|        $why = Get-SILaStreamShortReason $inner.Message
|        if (-not $net) { $global:SI_LaStreamReaderOff = 'the streaming reader failed on an answer: ' + $why }
|        return [pscustomobject]@{ SILaStreamFailed = $why; Network = $net }
|    }
|}
|
|function ConvertFrom-SILaQueryStream {
|    <#
|        The Log Analytics query response READ FROM ITS STREAM -> @{ Rows; Columns; Error } -- the shape and the rows of
|        ConvertFrom-SILaQueryRows (SI-AzRest.ps1), without the answer ever being held whole. -Compact: compact rows
|        (Get-SILaCompactRowType) where a compact type can be built for the columns; PSCustomObject rows otherwise.
|        -BufferBytes: the first buffer (it grows only when one row does not fit). Throws on an answer that is not valid
|        JSON or ends early (as the lean read does).
|        -OnPage { param($Rows) }: FOR EVERY READER, not only Risk Analysis -- the primary table's rows are handed on a page
|        at a time, as soon as about -PageBytes of the answer's own bytes are in, and are never collected: memory is one
|        page. .Rows is then empty; .RowCount / .Pages say what was handed on; -PageState (a hashtable) is kept up to date
|        as pages go out (Pages, Rows). The error object (a cut answer) comes at the END of the answer, after the pages: a
|        caller keeps its pages only once the whole read returned (Invoke-SILaQuery -OnPage refuses a cut answer there).
|    #>
|    param([Parameter(Mandatory)][System.IO.Stream]$Stream, [switch]$Compact, [int]$BufferBytes = 65536,
|          [scriptblock]$OnPage, [long]$PageBytes = 4MB, [hashtable]$PageState)
|    $t = Get-SILaStreamReaderType
|    if ($null -eq $t) { throw 'the streaming Log Analytics reader is not available in this process' }
|    $ctorFor = $null
|    if ($Compact) {
|        $ctorFor = [Func[string[], System.Reflection.ConstructorInfo]] {
|            param([string[]]$names)
|            $ct = $null
|            if (Get-Command -Name Get-SILaCompactRowType -ErrorAction SilentlyContinue) { $ct = Get-SILaCompactRowType -Names $names }
|            if ($null -eq $ct) { return $null }
|            return $ct.GetConstructor([type[]]@([string[]]))
|        }
|    }
|    # column names that differ only in case (never in a real answer): the row is built exactly as the lean read builds it
|    # [[string[]]] -- the spelling Windows PowerShell 5.1 can parse too: setup scripts a customer runs there load this file
|    # through SI-AzRest.ps1 (the same type as [Func[string[], string[], object]], which 5.1 refuses as a parse error)
|    $plainFor = [Func[[string[]], [string[]], object]] {
|        param([string[]]$names, [string[]]$cells)
|        $o = [ordered]@{}
|        for ($i = 0; $i -lt $names.Length; $i++) { $o[$names[$i]] = $(if ($i -lt $cells.Length) { $cells[$i] } else { $null }) }
|        [pscustomobject]$o
|    }
|    if ($OnPage) {
|        if ($null -eq $PageState) { $PageState = @{} }
|        $PageState['Pages'] = 0; $PageState['Rows'] = 0L
|        $__psOn = $OnPage; $__psState = $PageState
|        $pageAction = [Action[object[]]] {
|            param([object[]]$page)
|            $null = & $__psOn $page
|            $__psState['Pages'] = [int]$__psState['Pages'] + 1
|            $__psState['Rows'] = [long]$__psState['Rows'] + $page.Length
|        }
|        $a = $t::Read($Stream, [bool]$Compact, $ctorFor, $BufferBytes, $plainFor, $pageAction, [long]$PageBytes)
|    } else {
|        $a = $t::Read($Stream, [bool]$Compact, $ctorFor, $BufferBytes, $plainFor)
|    }
|    $cols = [System.Collections.Generic.List[object]]::new()
|    for ($i = 0; $i -lt $a.ColumnNames.Length; $i++) { $cols.Add([pscustomobject]@{ name = $a.ColumnNames[$i]; type = $a.ColumnTypes[$i] }) }
|    $err = $null
|    if ($null -ne $a.ErrorJson) { $err = ($a.ErrorJson | ConvertFrom-Json) }
|    $count = [long]$a.Rows.Length; if ($OnPage) { $count = [long]$a.RowsDelivered }
|    # (#836: $global:, never $script: -- a function's $script: is its caller's)
|    $global:SI_LaStreamLast = [pscustomobject]@{ BytesRead = $a.BytesRead; LargestBuffer = $a.LargestBuffer; Rows = $count; Pages = [int]$a.Pages }
|    return [pscustomobject]@{ Rows = $a.Rows; Columns = $cols.ToArray(); Error = $err; RowCount = $count; Pages = [int]$a.Pages }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-LaParts.ps1'] = @{ Sha256 = 'd6068eb409f171257cf45624fee0eea678cadb739bc63f8b366afc3f9b7b1edd'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- a Log Analytics read IN PARTS, so a large install never meets the service's limit on one answer
|    (#639 lane 4, owner 2026-10-21: "memory issues must not be a problem in any step. env must work in millions of assets
|    env"). Loaded by SI-AzRest.ps1, and guarded by every caller, so it loads on its own (tests).
|
|    WHY. One Log Analytics answer carries at most ~500,000 rows / ~64 MB. Invoke-SILaQuery REFUSES an answer the service
|    cut (New-SILaCutAnswerError) -- a cut answer is never taken as whole. A reader whose result can outgrow one answer
|    (a profile snapshot, the correlation map, a customer's rule query) therefore reads in PARTS:
|
|      * The query is first asked AS IT IS -- a small result costs exactly what it cost before (one query, unchanged).
|      * Refused as cut (or too large, or this process ran out of memory on it): the query is MEASURED once (rows and
|        bytes of its result) and read again in that many parts: each part is the query's own result, filtered on a hash
|        of each result row (or of a key the caller names). The parts never overlap and together are every row --
|        whatever the query does, because the filter is applied to its RESULT.
|      * A part still refused is cut in two (only that part; on a hash of its own, so the pieces never overlap); a part
|        far larger than planned cuts every part still to read by the measured factor. The size of a part follows what
|        was measured, never a fixed number (working rule 5).
|      * MEASURED stop, never a cap: a refused part that held NO row at all, twice in a row, is the query's own work
|        hitting a limit (every part repeats it) -- more parts cannot help, and the read fails saying so.
|      * A part that fails for any other reason fails THE READ: what was read is not the whole, so it is UNKNOWN -- never
|        handed out as the result (working rule 4). The caller's own handling of a failed read applies unchanged.
|
|    A query whose rows differ between two runs of it (take / limit / sample) is never cut into parts: its refusal is passed
|    on as it is. The rows of a read in parts come in no particular order.
|
|    PowerShell 5.1-safe: no ternary, no null-conditional. NO Set-StrictMode here (it leaks into the caller's scope).
|    A caller's -Read / -OnRows / -Log block runs INSIDE Read-SILaParts: a variable it reads must not share a name with
|    this function's own (Query, WorkspaceId, Wait, Key, Read, OnRows, What, Log, rows, got, page, queue ...).
|#>
|
|# Azure access: plain REST, no PowerShell modules (SI-AzRest.ps1 loads this file last, so this never loads it twice).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot './SI-AzRest.ps1') }
|
|function Get-SILaPartFilter {
|    <#
|        PURE. The KQL that keeps ONE part of a query's result: -Cuts = @( @{ Parts; Part } ...) -- the first cut is the
|        planned part ("bucket Part of Parts" of the row's hash); each later cut divides that part again on a hash of its own
|        (the depth in front of the value), so the pieces of a part never overlap and together are that part. -Key: a KQL
|        expression on the result's columns to hash (e.g. 'SI_AssetId'); '' = the whole result row (pack_all()). '' = no cut.
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Cuts = @(), [string]$Key = '')
|    $terms = New-Object System.Collections.Generic.List[string]
|    for ($d = 0; $d -lt @($Cuts).Count; $d++) {
|        $parts = [long]$Cuts[$d].Parts; $part = [long]$Cuts[$d].Part
|        if ($parts -lt 1 -or $part -lt 0 -or $part -ge $parts) { throw ('Get-SILaPartFilter: part {0} is outside 0..{1}' -f $part, ($parts - 1)) }
|        if ($parts -eq 1) { continue }
|        if ($d -eq 0) { $terms.Add(('hash(_siPart, {0}) == {1}' -f $parts, $part)) }
|        else { $terms.Add(('hash(strcat("{0}|", _siPart), {1}) == {2}' -f $d, $parts, $part)) }
|    }
|    if ($terms.Count -eq 0) { return '' }
|    $k = 'tostring(pack_all())'
|    if ($Key) { $k = 'tostring({0})' -f $Key }
|    ('| extend _siPart = {0} | where {1} | project-away _siPart' -f $k, ($terms -join ' and '))
|}
|
|function Get-SILaPartQuery {
|    <#
|        PURE. -Query with -Filter after its LAST tabular statement: trailing blank / comment lines and semicolons are taken
|        off first, so the filter follows the result. '' -Filter = the query unchanged.
|    #>
|    param([Parameter(Mandatory)][string]$Query, [AllowEmptyString()][string]$Filter = '')
|    if (-not $Filter) { return $Query }
|    $lines = New-Object System.Collections.Generic.List[string]
|    foreach ($l in ($Query -split "`r?`n")) { $lines.Add($l) }
|    while ($lines.Count -gt 0) {
|        $t = $lines[$lines.Count - 1].Trim()
|        if ($t -eq '' -or $t.StartsWith('//')) { $lines.RemoveAt($lines.Count - 1); continue }
|        if ($t.EndsWith(';')) { $lines[$lines.Count - 1] = $lines[$lines.Count - 1].TrimEnd().TrimEnd(';'); continue }
|        break
|    }
|    (($lines -join "`n") + "`n" + $Filter)
|}
|
|function Get-SILaMeasureQuery {
|    <# PURE. How many rows -Query's result holds and about how many bytes (one small answer: SIRows, SIBytes). #>
|    param([Parameter(Mandatory)][string]$Query)
|    Get-SILaPartQuery -Query $Query -Filter '| summarize SIRows = count(), SIBytes = sum(estimate_data_size(*))'
|}
|
|function Test-SILaQueryPartable {
|    <# PURE. May -Query be read in parts? Not when its rows differ between two runs of it (take / limit / sample): the parts
|       of two runs would not be one result. #>
|    param([AllowEmptyString()][string]$Query)
|    -not ([string]$Query -match '(?im)\|\s*(take|limit|sample|sample-distinct)\b')
|}
|
|function Get-SILaPartFailure {
|    <#
|        PURE. What a failed read of one part says: @{ Cut = $true when a SMALLER part fixes it -- an answer the service cut
|        for a limit (Invoke-SILaQuery's refusal, Risk Analysis' own), an answer refused as too large, or this process out of
|        memory on it; Rows = the rows the short answer held (-1 unknown) }. Anything else: Cut = $false (passed on as it is).
|    #>
|    param([AllowNull()][object]$Err)
|    $ex = $null; $texts = New-Object System.Collections.Generic.List[string]
|    if ($Err -is [System.Management.Automation.ErrorRecord]) {
|        $ex = $Err.Exception
|        if ($Err.ErrorDetails -and $Err.ErrorDetails.Message) { $texts.Add([string]$Err.ErrorDetails.Message) }
|    } elseif ($Err -is [System.Exception]) { $ex = $Err }
|    elseif ($null -ne $Err) { $texts.Add([string]$Err) }
|    $e = $ex
|    while ($null -ne $e) {
|        if ($e -is [System.OutOfMemoryException] -or $e -is [System.InsufficientExecutionStackException]) { return @{ Cut = $true; Rows = -1L; Why = 'too large for this job''s memory' } }
|        if ($e.Data) {
|            foreach ($k in 'SILaPartial', 'SIRALaPartial') {
|                if ($e.Data.Contains($k)) {
|                    $rows = -1L
|                    if ($e.Data.Contains('SIRALaPartialRows')) { try { $rows = [long]$e.Data['SIRALaPartialRows'] } catch { $rows = -1L } }
|                    return @{ Cut = ([string]$e.Data[$k] -eq 'Limit'); Rows = $rows; Why = 'cut by the service''s limit' }
|                }
|            }
|        }
|        $texts.Add([string]$e.Message)
|        try { if ($e.PSObject.Properties['Response'] -and $e.Response -and $e.Response.PSObject.Properties['Content']) { $texts.Add([string]$e.Response.Content) } } catch { }
|        $e = $e.InnerException
|    }
|    $all = ($texts -join ' ')
|    if ($all -match '(?i)E_QUERY_RESULT_SET_TOO_LARGE|ResponsePayloadTooLarge|ResponseSizeError|result set (is )?too large|exceeds? the (maximum )?(response|result) size|response size .*exceed') {
|        return @{ Cut = $true; Rows = -1L; Why = 'too large to read in one answer' }
|    }
|    @{ Cut = $false; Rows = -1L; Why = '' }
|}
|
|function ConvertTo-SILaPartRows {
|    <# PURE. Rows however a reader handed them over -- one array (`, @(rows)`), an array holding that array, or rows on the
|       pipeline -- as ONE flat object[] without nulls. #>
|    param([AllowNull()][object]$Answer)
|    $l = New-Object System.Collections.Generic.List[object]
|    foreach ($x in @($Answer)) {
|        if ($null -eq $x) { continue }
|        if ($x -is [array]) { foreach ($y in $x) { if ($null -ne $y) { $l.Add($y) } } } else { $l.Add($x) }
|    }
|    , $l.ToArray()
|}
|
|function Get-SILaPartPlan {
|    <#
|        PURE. How many parts a result of -Rows rows / about -Bytes bytes is read in: each part well under one answer's
|        limits -- at most half the service's own row limit, and -TargetBytes of answer (the JSON answer is -Expansion times
|        the data's own size). At least 2 (the result was refused whole). Follows the measurement; no ceiling.
|    #>
|    param([long]$Rows = -1, [double]$Bytes = -1, [long]$TargetRows = 0, [double]$TargetBytes = 16MB, [double]$Expansion = 2.5)
|    if ($TargetRows -le 0) {
|        $limit = 500000L
|        if (Get-Command -Name Get-SILaServiceRowLimit -ErrorAction SilentlyContinue) { $limit = [long](Get-SILaServiceRowLimit) }
|        $TargetRows = [long][Math]::Max(1, [Math]::Floor($limit / 2))
|    }
|    $n = 2L
|    if ($Rows -gt 0) { $n = [long][Math]::Max($n, [Math]::Ceiling([double]$Rows / [double]$TargetRows)) }
|    if ($Bytes -gt 0 -and $TargetBytes -gt 0) { $n = [long][Math]::Max($n, [Math]::Ceiling(($Bytes * $Expansion) / $TargetBytes)) }
|    $n
|}
|
|function Read-SILaParts {
|    <#
|        ONE Log Analytics read, in parts when one answer cannot carry it (see the header of this file). Every row once.
|          -Query      the KQL (asked as it is first)
|          -Key        a KQL expression on the result's columns that the parts hash on ('' = the whole result row). A key
|                      that is the same for many rows cannot divide them -- '' always can.
|          -Read       { param($Kql) rows } -- the reader (the seam for tests). Default: Invoke-SIAzOperationalInsightsQuery
|                      on -WorkspaceId (with -Wait), its .Results.
|          -OnRows     { param($Rows) } -- each part's rows as soon as that part is read whole (then not collected; memory is
|                      one part). The parts handed on are only the result when this call RETURNS: a later part that fails
|                      throws, and the caller treats the whole read as failed. Without -OnRows the rows are collected.
|          -What       what is read, for the lines it says; -Log { param($Level, $Message) }
|        Returns @{ Rows (without -OnRows); RowCount; Pages; Parts (planned); Cuts }. Throws when the read is not whole.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$Query,
|        [string]$WorkspaceId = '',
|        [int]$Wait = 0,
|        [string]$Key = '',
|        [scriptblock]$Read,
|        [scriptblock]$OnRows,
|        [string]$What = 'the Log Analytics read',
|        [scriptblock]$Log,
|        [long]$TargetRows = 0,
|        [double]$TargetBytes = 16MB,
|        [int]$MaxDepth = 24
|    )
|    if (-not $Read) {
|        if (-not $WorkspaceId) { throw 'Read-SILaParts: -WorkspaceId or -Read is needed' }
|        # (-Wait only when given: the same call the readers made before, so a reader's own stand-in still answers it)
|        $Read = {
|            param($k)
|            $__p = @{ WorkspaceId = $WorkspaceId; Query = $k; ErrorAction = 'Stop' }
|            if ($Wait -gt 0) { $__p['Wait'] = $Wait }
|            $__a = Invoke-SIAzOperationalInsightsQuery @__p
|            if ($__a) { , @($__a.Results) } else { , @() }
|        }
|    }
|    if (-not $Log) { $Log = { param($l, $m) Write-Host ('[{0}] {1}' -f $l, $m) } }
|    if ($TargetRows -le 0) {
|        $limit = 500000L
|        if (Get-Command -Name Get-SILaServiceRowLimit -ErrorAction SilentlyContinue) { $limit = [long](Get-SILaServiceRowLimit) }
|        $TargetRows = [long][Math]::Max(1, [Math]::Floor($limit / 2))
|    }
|    $partable = Test-SILaQueryPartable -Query $Query
|    $acc = $null
|    if (-not $OnRows) { $acc = New-Object System.Collections.Generic.List[object] }
|    $queue = New-Object 'System.Collections.Generic.Queue[object]'
|    $queue.Enqueue([pscustomobject]@{ Cuts = @() })
|    $pages = 0L; $rowsRead = 0L; $cutsMade = 0L; $planned = 1L; $measured = $false; $emptyRefusals = 0
|    while ($queue.Count -gt 0) {
|        $page = $queue.Dequeue()
|        $kql = Get-SILaPartQuery -Query $Query -Filter (Get-SILaPartFilter -Cuts @($page.Cuts) -Key $Key)
|        $rows = $null; $fail = $null
|        try {
|            # assigned first: the reader answers ONE array (`, @(rows)`) -- @() around the call would hold it as one row
|            $got = & $Read $kql
|            $rows = ConvertTo-SILaPartRows $got
|            $got = $null
|        } catch {
|            $f = Get-SILaPartFailure -Err $_
|            if (-not $f.Cut -or -not $partable) { throw }
|            $fail = $f; $failErr = $_
|        }
|        if ($fail) {
|            $rows = $null
|            if (@($page.Cuts).Count -ge $MaxDepth) {
|                throw ('{0} is more than Log Analytics can answer: a part cut {1} times is still {2} -- the read is not whole and nothing of it is used' -f $What, @($page.Cuts).Count, $fail.Why)
|            }
|            if ([long]$fail.Rows -eq 0) { $emptyRefusals++ } else { $emptyRefusals = 0 }
|            if ($emptyRefusals -ge 2) {
|                throw ('{0} is more than Log Analytics can answer: a part stopped at the service''s limit before it returned a row, twice, so reading it in more parts cannot make it fit -- the read is not whole and nothing of it is used ({1})' -f $What, (([string]$failErr.Exception.Message -split "`n") | Select-Object -First 1))
|            }
|            if (@($page.Cuts).Count -eq 0 -and -not $measured) {
|                # the whole query was refused: measured ONCE, then read in that many parts
|                $measured = $true
|                $mRows = -1L; $mBytes = -1.0
|                try {
|                    $mr = ConvertTo-SILaPartRows (& $Read (Get-SILaMeasureQuery -Query $Query)); $m = $null; if ($mr.Count -gt 0) { $m = $mr[0] }
|                    if ($m) {
|                        if ($m.PSObject.Properties['SIRows'] -and "$($m.SIRows)" -ne '') { $mRows = [long][double]::Parse([string]$m.SIRows, [Globalization.CultureInfo]::InvariantCulture) }
|                        if ($m.PSObject.Properties['SIBytes'] -and "$($m.SIBytes)" -ne '') { $mBytes = [double]::Parse([string]$m.SIBytes, [Globalization.CultureInfo]::InvariantCulture) }
|                    }
|                } catch { $mRows = -1L; $mBytes = -1.0 }
|                $planned = Get-SILaPartPlan -Rows $mRows -Bytes $mBytes -TargetRows $TargetRows -TargetBytes $TargetBytes
|                for ($p = 0L; $p -lt $planned; $p++) { $queue.Enqueue([pscustomobject]@{ Cuts = @([pscustomobject]@{ Parts = $planned; Part = $p }) }) }
|                $cutsMade++
|                $sizeText = ''
|                if ($mRows -ge 0) { $sizeText = [string]::Format([Globalization.CultureInfo]::InvariantCulture, ' (measured: {0:N0} row(s){1})', $mRows, $(if ($mBytes -ge 0) { [string]::Format([Globalization.CultureInfo]::InvariantCulture, ', about {0:N0} MB', ($mBytes / 1MB)) } else { '' })) }
|                & $Log 'INFO' ('{0} is larger than one Log Analytics answer can carry ({1}) -- it is read in {2} parts{3}; nothing of the short answer is kept' -f $What, $fail.Why, $planned, $sizeText)
|            } else {
|                foreach ($half in 0, 1) { $queue.Enqueue([pscustomobject]@{ Cuts = @($page.Cuts) + @([pscustomobject]@{ Parts = 2L; Part = [long]$half }) }) }
|                $cutsMade++
|                & $Log 'INFO' ('{0}: a part was {1} -- it is read again in two smaller parts' -f $What, $fail.Why)
|            }
|            continue
|        }
|        $emptyRefusals = 0
|        $n = $rows.Count
|        $pages++; $rowsRead += $n
|        if ($OnRows) { $null = & $OnRows $rows } else { $acc.AddRange([object[]]$rows) }
|        $rows = $null
|        # measured, not assumed: a part far larger than planned -> every part still to read is cut by that factor
|        if (@($page.Cuts).Count -gt 0 -and $n -gt (2 * $TargetRows) -and $queue.Count -gt 0) {
|            $factor = [long][Math]::Ceiling([double]$n / [double]$TargetRows)
|            $rest = $queue.ToArray(); $queue.Clear()
|            foreach ($rp in $rest) { for ($piece = 0L; $piece -lt $factor; $piece++) { $queue.Enqueue([pscustomobject]@{ Cuts = @($rp.Cuts) + @([pscustomobject]@{ Parts = $factor; Part = $piece }) }) } }
|            $cutsMade++
|            & $Log 'INFO' ('{0}: its parts are larger than measured -- the {1} part(s) still to read are read as {2}' -f $What, $rest.Count, $queue.Count)
|        }
|    }
|    if ($pages -gt 1) { & $Log 'INFO' ([string]::Format([Globalization.CultureInfo]::InvariantCulture, '{0}: read whole in {1} part(s), {2:N0} row(s)', $What, $pages, $rowsRead)) }
|    $out = [ordered]@{ Rows = @(); RowCount = $rowsRead; Pages = $pages; Parts = $planned; Cuts = $cutsMade }
|    if ($acc) { $out.Rows = $acc.ToArray() }
|    [pscustomobject]$out
|}
'@ }
$__siSupportFiles['engine/_shared/SI-LogIngest.ps1'] = @{ Sha256 = '877c581ac6adda5fa7951afb09db3fefd7fbe77742dfbc686cf9037255224f6f'; Text = @'
|#Requires -Version 5.1
|<#
|    SI -- publish rows to a Log Analytics custom table through the normal DCR path.
|
|    Moved here from engine/asset-correlation/_shared/SI-CorrelationIngest.ps1 because a FREE stage uses
|    it too: the azure profiler's Defender for Cloud recommendations stage publishes with
|    Send-SIObjectMapRows. The correlation engine is part of SecurityInsight Pro and is not in the
|    Community edition, so a free engine must never load a file from its folder. The function names are
|    unchanged, so every caller and test keeps working.
|#>
|
|# NO Set-StrictMode HERE -- a dot-sourced file that sets it leaks into the caller's scope.
|
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction Ignore)) { . (Join-Path $PSScriptRoot './SI-AzRest.ps1') }
|
|function Initialize-SIIngestGlobals {
|    <#
|      Fill the three names the DCR/DCE pinning and the LogIngest role grant need, from what an install
|      actually has (#174). The profiling orchestrator backfills them at its entry; the stages and engines that
|      publish WITHOUT it (trend, Defender recommendations, the Pro engines) did not -- and the CLI setup wrote
|      only the older names -- so pinning was skipped and a new DCR got no LogIngest principal.
|        SI_AzSubscriptionId  <- the subscription in SI_WorkspaceResourceId, else the 2.2.x SubscriptionId
|        SI_DceResourceGroup  <- the 2.2.x DceResourceGroup, else SI_DcrResourceGroup (same RG by default)
|        SI_SPN_ObjectId      <- SpnObjectId, else SI_LogIngest_ObjectId
|      Only EMPTY names are filled; a value the customer set always stands. Never throws.
|    #>
|    if (-not $global:SI_AzSubscriptionId) {
|        if ("$($global:SI_WorkspaceResourceId)" -match '/subscriptions/([^/]+)/') { $global:SI_AzSubscriptionId = $Matches[1] }
|        elseif ($global:SubscriptionId) { $global:SI_AzSubscriptionId = [string]$global:SubscriptionId }
|    }
|    if (-not $global:SI_DceResourceGroup) {
|        # SI_DcrResourceGroup FIRST: the unprefixed DceResourceGroup is ALWAYS set by the solution-wide shared
|        # defaults ('rg-dce-securityinsight'), so after loading it cannot tell a customer value from the default.
|        # The DCE normally lives with the DCRs (the sample: "leave unset, same RG as workspace").
|        if ($global:SI_DcrResourceGroup) { $global:SI_DceResourceGroup = [string]$global:SI_DcrResourceGroup }
|        elseif ($global:DceResourceGroup) { $global:SI_DceResourceGroup = [string]$global:DceResourceGroup }
|    }
|    if (-not $global:SI_SPN_ObjectId) {
|        if ($global:SpnObjectId) { $global:SI_SPN_ObjectId = [string]$global:SpnObjectId }
|        elseif ($global:SI_LogIngest_ObjectId) { $global:SI_SPN_ObjectId = [string]$global:SI_LogIngest_ObjectId }
|    }
|}
|
|function Get-SILogIngestObjectId {
|    <#
|      The object id that gets the ingest role on a new or updated data collection rule: SI_SPN_ObjectId (what setup
|      writes), else the older SI_LogIngest_ObjectId -- the same order Send-SIObjectMapRows, trend, asset properties and
|      the run-health row use. Three output stages passed SI_LogIngest_ObjectId alone, so an install with only
|      SI_SPN_ObjectId got a rule nobody could post to (#257). Empty when neither is set.
|    #>
|    if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_SPN_ObjectId)) { return [string]$global:SI_SPN_ObjectId }
|    return [string]$global:SI_LogIngest_ObjectId
|}
|
|function Select-SIIngestTarget {
|    <#
|        #199 -- make the endpoint AzLogDcrIngestPS will use the RIGHT one, before it touches the rule and again
|        before the post. The module resolves the endpoint by NAME ONLY -- the first match in $global:AzDceDetails,
|        or in a tenant-wide Resource Graph query when that cache is empty. Measured 2026-10-01: three endpoints
|        named dce-securityinsight in two subscriptions; a rule created on the right one was re-bound to another
|        one minute later by the engine's own post (#198); four rules on this tenant were bound to the other
|        subscription's endpoint.
|        The endpoint is chosen as follows:
|          - a rule that EXISTS posts through the endpoint it is bound to, when that endpoint has the configured
|            name. Ingestion accepts a post only through the rule's own endpoint, and moving a rule is not an
|            option -- measured 2026-10-01, a re-bound rule was still refused (HTTP 403) more than 10 minutes later.
|          - otherwise (a new rule) this install's endpoint -- subscription + resource group + name -- so the
|            module creates the rule there and not on a same-named endpoint elsewhere.
|          - ONE endpoint of that name anywhere is unambiguous and used (an endpoint outside the rules' resource
|            group has always worked that way). Several and none here: refused, nothing is posted.
|        The DCR cache is narrowed to this install's rule (or, before it exists, cleared of same-named rules
|        elsewhere). An empty cache is built first. Without a subscription id there is nothing to pin to.
|    #>
|    param([hashtable]$AuthParams, [Parameter(Mandatory)][string]$DcrName)
|    $sub = [string]$global:SI_AzSubscriptionId
|    if (-not $sub -or -not $global:SI_DceName) { return }
|    $dceRg = if ($global:SI_DceResourceGroup) { [string]$global:SI_DceResourceGroup } else { [string]$global:SI_DcrResourceGroup }
|    $dcrRg = [string]$global:SI_DcrResourceGroup
|    $rebuilt = $false
|    $rebuild = {
|        if ($rebuilt -or -not $AuthParams) { return }
|        try { $global:AzDceDetails = Get-SIDceList @AuthParams -Verbose:$false 4>$null } catch { }
|        try { $global:AzDcrDetails = Get-SIDcrList @AuthParams -Verbose:$false 4>$null } catch { }
|        $rebuilt = $true   # dot-sourced: this IS the function's scope
|    }
|    $findHere = { @($global:AzDceDetails | Where-Object { $_ -and $_.name -eq $global:SI_DceName -and [string]$_.id -like "/subscriptions/$sub/resourceGroups/$dceRg/*" }) | Select-Object -First 1 }
|    $findRule = { if ($dcrRg) { @($global:AzDcrDetails | Where-Object { $_ -and $_.name -eq $DcrName -and [string]$_.id -like "/subscriptions/$sub/resourceGroups/$dcrRg/*" }) | Select-Object -First 1 } }
|
|    if (-not $global:AzDceDetails) { . $rebuild }
|    $dce = . $findHere
|    $dcr = . $findRule
|    if (-not $dce -or ($dcrRg -and -not $dcr)) { . $rebuild; $dce = . $findHere; $dcr = . $findRule }
|    if (-not $dce) {
|        $same = @($global:AzDceDetails | Where-Object { $_ -and $_.name -eq $global:SI_DceName })
|        if ($same.Count -ne 1) {
|            throw ("Data collection endpoint '{0}' was not found in resource group '{1}' of subscription '{2}'. {3} endpoint(s) of that name exist elsewhere, so nothing was posted -- set SI_DceResourceGroup to the one this install uses." -f $global:SI_DceName, $dceRg, $sub, $same.Count)
|        }
|        $dce = $same[0]
|    }
|    $bound = if ($dcr -and $dcr.properties) { [string]$dcr.properties.dataCollectionEndpointId } else { '' }
|    if ($bound -and $bound -ne [string]$dce.id) {
|        $b = @($global:AzDceDetails | Where-Object { $_ -and [string]$_.id -eq $bound }) | Select-Object -First 1
|        if (-not $b) { . $rebuild; $b = @($global:AzDceDetails | Where-Object { $_ -and [string]$_.id -eq $bound }) | Select-Object -First 1 }
|        if ($b -and $b.name -eq $global:SI_DceName) {
|            Write-Verbose ("Data collection rule '{0}' is bound to {1}; posting through it." -f $DcrName, $bound)
|            $dce = $b
|        }
|    }
|    $global:AzDceDetails = @($dce)
|    if ($dcr) { $global:AzDcrDetails = @($dcr) }
|    elseif ($global:AzDcrDetails) { $global:AzDcrDetails = @($global:AzDcrDetails | Where-Object { $_ -and $_.name -ne $DcrName }) }
|}
|function Resolve-SICorrelationAuthParams {
|    <#
|        MI > SPN+cert > SPN+secret, resolved into the splat AzLogDcrIngestPS wants.
|        Mirrors Send-SIRunHealthRow deliberately -- see this file's header for why it is not shared.
|    #>
|    $spnAppId     = if ($global:SI_SPN_AppId)    { $global:SI_SPN_AppId }    else { $global:SI_LogIngest_AppId }
|    $spnSecret    = if ($global:SI_SPN_Secret)   { $global:SI_SPN_Secret }   else { $global:SI_LogIngest_Secret }
|    $spnTenantId  = if ($global:SI_SPN_TenantId) { $global:SI_SPN_TenantId } else { $global:SI_LogIngest_TenantId }
|    $spnCertThumb = [string]$global:SI_SPN_CertThumbprint
|
|    # Auto-detect which store actually holds the private key. A thumbprint in the wrong store reads as
|    # "no cert" and falls through to the secret branch, which then fails on a tenant that has no secret.
|    $spnCertStore = if ($global:SI_SPN_CertStoreLocation) { [string]$global:SI_SPN_CertStoreLocation }
|                    elseif ($spnCertThumb) {
|                        $clean = $spnCertThumb -replace '\s',''
|                        if (Get-PSDrive -Name Cert -ErrorAction SilentlyContinue) {
|                            $resolved = 'LocalMachine'
|                            foreach ($s in 'LocalMachine','CurrentUser') {
|                                $c = Get-ChildItem "Cert:\$s\My" -ErrorAction SilentlyContinue |
|                                     Where-Object { $_.Thumbprint -eq $clean -and $_.HasPrivateKey } |
|                                     Select-Object -First 1
|                                if ($c) { $resolved = $s; break }
|                            }
|                            $resolved
|                        } else {
|                            # #209: no Cert: drive (a Linux container) -- read the X509Store instead.
|                            if (-not (Get-Command Get-SICertStoreLocation -ErrorAction Ignore)) {
|                                . (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'auth/Find-SICertificate.ps1')
|                            }
|                            Get-SICertStoreLocation -Thumbprint $clean
|                        }
|                    } else { 'LocalMachine' }
|
|    $useMi   = $global:SI_PreferUami -and -not [string]::IsNullOrWhiteSpace($global:SI_UAMI_ClientId)
|    $useCert = -not $useMi -and -not [string]::IsNullOrWhiteSpace($spnCertThumb)
|
|    if ($useMi) {
|        return @{ UseManagedIdentity = $true; ManagedIdentityClientId = $global:SI_UAMI_ClientId }
|    }
|    if ($useCert) {
|        return @{
|            AzAppId                       = $spnAppId
|            AzAppCertificateThumbprint    = $spnCertThumb
|            AzAppCertificateStoreLocation = $spnCertStore
|            TenantId                      = $spnTenantId
|        }
|    }
|    @{ AzAppId = $spnAppId; AzAppSecret = $spnSecret; TenantId = $spnTenantId }
|}
|
|function Send-SIObjectMapRows {
|    <#
|        Publish the map to SI_ObjectMap_CL through the normal DCR path.
|
|        SQL COMPUTES AND HOLDS, LA PUBLISHES -- and there is no SQL yet, so today this IS the store.
|
|        🔴 CORRECTED 2026-08-13. This header used to say the deterministic seed means "an object's id is
|        recomputed identically every run", and that key-stability memory was "an OPTIMISATION over a
|        correctness property the core already has". THAT WAS WRONG, and believing it is what would ship
|        duplicate CIs. The property the core has is `same INPUT -> same id`. The property a connector
|        needs is `same OBJECT -> same id`. They diverge whenever group membership changes:
|
|          * Measured: adding one member carrying a lower-sorting exposure-graph id moved a group from
|            `exposuregraphnodeid:aaa` to `exposuregraphnodeid:000`. The seed is the ordinally-lowest
|            value of the highest-priority type PRESENT IN THE GROUP, so any arrival or departure moves
|            it.
|          * Departures are routine: the same day, EndpointEG returned 0 rows on a timeout and 51 assets
|            left the snapshot.
|          * Anchors churn independently -- MDE ids rotate, a rebuilt VM gets a new ARM path, a
|            re-enrolled device gets a new AadDeviceId.
|
|        So SQL key-stability is a CORRECTNESS PREREQUISITE before the connector may create CIs, not an
|        optimisation. Publishing to LA without it is fine -- reading a map is harmless. CREATING a
|        ServiceNow CI from an id that can move is not.
|
|        Decided 2026-08-13 (V3-ARCHITECTURE 2.3a): a minted UUIDv5-from-birth-anchor id, stored, with an
|        anchor ledger and a superseded table. Until that exists, ids emitted here are PROVISIONAL and a
|        connector must not create CIs from them.
|
|        NOT best-effort. Unlike the run-health heartbeat, this IS the output -- a swallowed failure
|        would leave consumers reading a stale map while every run reported success.
|    #>
|    param(
|        [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Rows,
|        [string]$TableName = 'SI_ObjectMap',
|        [string]$DcrName
|    )
|
|    if (@($Rows).Count -eq 0) {
|        Write-Warning 'correlation: nothing to publish -- 0 map rows. Not posting.'
|        return 0
|    }
|    if ([string]::IsNullOrWhiteSpace($DcrName)) {
|        $DcrName = if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_ObjectMap_DcrName)) {
|            [string]$global:SI_ObjectMap_DcrName
|        } else { 'dcr-si-objectmap' }
|    }
|
|    $savedVerbose = $global:VerbosePreference
|    $global:VerbosePreference = 'SilentlyContinue'
|    $lock = $null
|    try {
|        $authParams = Resolve-SICorrelationAuthParams
|        Initialize-SIIngestGlobals
|        $spnObjectId = if ($global:SI_SPN_ObjectId) { $global:SI_SPN_ObjectId } else { $global:SI_LogIngest_ObjectId }
|
|        # #475 -- A TABLE + RULE ALREADY MADE READY IN THIS PROCESS FOR THESE COLUMNS IS NOT CHECKED AGAIN. The steps below
|        # (endpoint + rule selection twice, the table / rule update with its coverage check, the cache refresh) are several
|        # Azure calls; they ran for every batch, and a run collected in parts posts its records in dozens of batches
|        # (customer H 2026-10-09: 96,551 records). A batch whose columns were all made ready earlier in this process posts
|        # through the same pinned endpoint and rule; a batch with a NEW column takes the full path again.
|        $readyKey = ('{0}|{1}' -f $TableName, $DcrName).ToLowerInvariant()
|        $batchCols = Get-SIObjectMapColumns -Rows @($Rows)
|        # in the run cache (global, like the tokens: this file is dot-sourced at different depths, so $script: differs)
|        $rcache = Get-SILogIngestRunCache
|        if (-not ($rcache.ObjectMapReady -is [hashtable])) { $rcache.ObjectMapReady = @{} }
|        $ready = $rcache.ObjectMapReady[$readyKey]
|        if ($ready -and (Test-SIObjectMapColumnsReady -Ready $ready.Columns -Columns $batchCols)) {
|            $global:AzDceDetails = @($ready.Dce); $global:AzDcrDetails = @($ready.Dcr)
|            $data = @($Rows)
|            $data = Repair-SILogColumnName -Data $data 4>$null
|            $data = Format-SILogRowsToSchema -Data $data 4>$null
|            $null = Send-SILogData -DceName $global:SI_DceName -DcrName $DcrName -Data $data -TableName $TableName @authParams 4>$null
|            return @($data).Count
|        }
|        # several processes of one run publish at once (the records of a run collected in parts): the table / rule update
|        # is done by one at a time (SI_INGEST_LOCK_FILE), so two never update the same rule over each other
|        $lock = Enter-SIIngestLock
|
|        # 🔴 THE WHOLE SET, NOT ONE ROW -- CORRECTED 2026-08-31. `-Data` was
|        # `@($Rows | Select-Object -First 1)`. AzLogDcrIngestPS INFERS the table + DCR column set
|        # from what it is handed, so one row defined the schema for the entire table: a row lacking
|        # an optional field meant that column was never created, and every other row's value for it
|        # was DROPPED AT INGEST, silently, for the life of the table.
|        # 🪤 Nothing errors. The engine reports rows posted, the table exists, and the field is
|        # simply absent -- indistinguishable from "no object had a value".
|        # 📌 The four profilers already got this right (Invoke-Output.ps1's `$schemaSample` is the
|        # FULL dataset, commented "full dataset for type inference"). Only the engines that publish
|        # their own v3 tables carried the shortcut.
|        #
|        # 🔴 AND THIS COMMENT MUST STAY *ABOVE* THE CALL, NOT INSIDE IT (audit #102, 2026-09-02).
|        # It was written between two backtick-continued argument lines, and **a comment TERMINATES a
|        # backtick continuation**: everything after it was dropped, including the `-Data @($Rows)` this
|        # very comment was added to introduce. Correlation then failed at publish on every run --
|        # `missing mandatory parameters: Data AzDcrSetLogIngestApiAppPermissionsDcrLevel
|        # AzLogDcrTableCreateFromReferenceMachine`, which is exactly the arguments that follow it here.
|        # #199 -- pin BEFORE the create/update, not only before the post.
|        Select-SIIngestTarget -AuthParams $authParams -DcrName $DcrName
|        $null = Update-SILogTableSchema `
|            -AzLogWorkspaceResourceId                   $global:SI_WorkspaceResourceId `
|            @authParams `
|            -DceName                                    $global:SI_DceName `
|            -DcrName                                    $DcrName `
|            -DcrResourceGroup                           $global:SI_DcrResourceGroup `
|            -TableName                                  $TableName `
|            -Data                                       @($Rows) `
|            -LogIngestServicePricipleObjectId           $spnObjectId `
|            -AzDcrSetLogIngestApiAppPermissionsDcrLevel $false `
|            -AzLogDcrTableCreateFromAnyMachine          $true `
|            -AzLogDcrTableCreateFromReferenceMachine    @() 4>$null
|
|        # Re-sync the DCE/DCR cache so a freshly created DCR's immutableId is known before the
|        # name-only lookup inside Post-*. Without it the module falls back to the DCE's location
|        # field as a bogus immutableId and the ingestion API answers 404 'westeurope'.
|        try {
|            $ensureFn = Get-Command -Name 'Ensure-SecurityInsightAzDceDcrCache' -ErrorAction Ignore
|            if ($ensureFn) {
|                & $ensureFn @authParams `
|                    -SubscriptionId   $global:SI_AzSubscriptionId `
|                    -DceResourceGroup $global:SI_DceResourceGroup `
|                    -DcrResourceGroup $global:SI_DcrResourceGroup `
|                    -Force 4>$null
|            }
|        } catch { }
|
|        # 📌 SUPERSEDED 2026-10-01 (#199): Select-SIIngestTarget above now builds and pins the caches BEFORE the
|        # create/update -- the module resolves the endpoint by name inside CheckCreateUpdate too, so pinning only
|        # here was too late. The history below is kept for the BlockCopy lesson.
|        # 🪤 DO NOT PRE-POPULATE THE CACHES HERE. Tried on 2026-08-30, mirroring the profiler's
|        # `$global:AzDceDetails = Get-AzDceListAll @authParams`, on the reasoning that filtering a
|        # cache that does not exist yet would be a silent no-op. It is not a no-op -- by this point
|        # `CheckCreateUpdate-TableDcr-Structure` (called above) has already built both caches, which
|        # is why the DCR pin below has always worked. The rebuild is redundant work, nothing more.
|        # 📌 It was briefly believed to have CAUSED the "BlockCopy ... Object must be an array of
|        # primitives" error that appeared once the 403 was gone. It did not, and the wrong version of
|        # this note lived here for an hour. That error was a real defect in AzLogDcrIngestPS 1.7.1 --
|        # `return $bytes` enumerates the array, so the caller binds object[] and [Buffer]::BlockCopy
|        # rejects it -- which broke the UNCOMPRESSED path for every caller of the module. Fixed
|        # upstream in 1.7.2 (SI finding #81). Removing these lines did not make it go away; only the
|        # module fix did.
|
|        # DCR name-collision guard. One SPN can see same-named DCRs in several subscriptions -- there
|        # are already three DCEs called dce-securityinsight in this tenant -- and the module's name-only
|        # lookup then picks one at random. Pin to (sub + RG + name) before posting.
|        if ($global:AzDcrDetails -and $global:SI_AzSubscriptionId -and $global:SI_DcrResourceGroup) {
|            $picked = @($global:AzDcrDetails | Where-Object {
|                $_.name -eq $DcrName -and
|                $_.id   -like "*/subscriptions/$($global:SI_AzSubscriptionId)/resourceGroups/$($global:SI_DcrResourceGroup)/*"
|            }) | Select-Object -First 1
|            if ($picked) { $global:AzDcrDetails = @($picked) }
|        }
|
|        # 🔴 AND THE SAME GUARD FOR THE **DCE** -- its absence is why this engine could never publish.
|        # The comment above names the hazard exactly ("three DCEs called dce-securityinsight") and then
|        # pins only the DCR. `Post-*` resolves the DCE by NAME-ONLY against $global:AzDceDetails, so it
|        # could pick an endpoint in a DIFFERENT subscription and post this workspace's DCR immutableId
|        # to it -- which the Log Ingestion API answers with **HTTP 403**.
|        # MEASURED 2026-08-30: three DCEs named `dce-securityinsight` exist across this tenant (one in
|        # the workspace's own subscription, two in a sibling), and every correlation run ended
|        # `[ERROR] Engine failed: Log Ingestion API request failed. HTTP Status: 403` AFTER doing all
|        # of its real work -- 1296 rows read, 1291 objects correlated, ledger updated, 2228 map rows
|        # built -- and losing the lot at the final POST. That is why the handoff records correlation as
|        # "built + run on real data, never published": it was never a correlation defect at all.
|        # 🔑 THE PROFILER ALREADY SOLVES THIS. `Apply-SIDcrScopeFilter` (asset-profiling/stages/
|        # Invoke-Output.ps1) filters BOTH caches to the configured sub + RG, which is exactly why the
|        # four profilers ingest happily while this engine 403s on the same credentials. Operator,
|        # 2026-08-30: *"it must use same auth as the design is using to send data to la in the
|        # profiler"* -- so this mirrors that filter rather than inventing a third variant.
|        # 📌 Same auth params, same scope pin. The DCE RG falls back to the DCR RG, matching the
|        # profiler's own default of 'rg-securityinsight' when SI_DceResourceGroup is unset.
|        $_dceRg = if ($global:SI_DceResourceGroup) { [string]$global:SI_DceResourceGroup }
|                  else { [string]$global:SI_DcrResourceGroup }
|        if ($global:AzDceDetails -and $global:SI_AzSubscriptionId -and $_dceRg) {
|            $_pickedDce = @($global:AzDceDetails | Where-Object {
|                $_.id -like "*/subscriptions/$($global:SI_AzSubscriptionId)/resourceGroups/$_dceRg/*"
|            })
|            if ($_pickedDce.Count -gt 0) { $global:AzDceDetails = @($_pickedDce) }
|        }
|
|        # #199 -- again before the post: the cache refresh above narrowed it to this install's endpoint, which is
|        # not the rule's own when the rule is bound elsewhere.
|        Select-SIIngestTarget -AuthParams $authParams -DcrName $DcrName
|        # ready for these columns in this process (#475): the next batch with no new column posts straight away
|        $known = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|        if ($ready) { foreach ($c in $ready.Columns) { [void]$known.Add($c) } }
|        foreach ($c in $batchCols) { [void]$known.Add($c) }
|        $rcache.ObjectMapReady[$readyKey] = [pscustomobject]@{ Columns = $known; Dce = @($global:AzDceDetails); Dcr = @($global:AzDcrDetails) }
|        Exit-SIIngestLock -Lock $lock; $lock = $null
|        $data = @($Rows)
|        $data = Repair-SILogColumnName -Data $data 4>$null
|        $data = Format-SILogRowsToSchema -Data $data 4>$null
|        $null = Send-SILogData `
|            -DceName   $global:SI_DceName `
|            -DcrName   $DcrName `
|            -Data      $data `
|            -TableName $TableName `
|            @authParams 4>$null
|
|        @($data).Count
|    }
|    finally {
|        if ($lock) { Exit-SIIngestLock -Lock $lock }
|        if ($null -ne $savedVerbose) { $global:VerbosePreference = $savedVerbose }
|    }
|}
|
|function Get-SIObjectMapColumns {
|    <# PURE. Every column name of a batch of rows (PSObject properties or dictionary keys), once. #>
|    param([AllowEmptyCollection()][object[]]$Rows = @())
|    $set = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($r in $Rows) {
|        if ($null -eq $r) { continue }
|        if ($r -is [System.Collections.IDictionary]) { foreach ($k in $r.Keys) { [void]$set.Add([string]$k) } }
|        else { foreach ($p in $r.PSObject.Properties) { [void]$set.Add($p.Name) } }
|    }
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($c in $set) { $out.Add($c) }
|    , $out.ToArray()
|}
|
|function Test-SIObjectMapColumnsReady {
|    <# PURE. $true when every column of the batch is among the columns already made ready. #>
|    param($Ready, [AllowEmptyCollection()][string[]]$Columns = @())
|    if ($null -eq $Ready) { return $false }
|    foreach ($c in $Columns) { if (-not $Ready.Contains($c)) { return $false } }
|    $true
|}
|
|function Enter-SIIngestLock {
|    <#
|        The cross-process lock of the table / rule update (SI_INGEST_LOCK_FILE, set by a parent that runs several publishing
|        processes at once). No variable = no lock ($null). Waits up to 20 minutes; then goes on without it, said once -- a
|        lock that cannot be taken never stops a publish (the coverage check before every post still guards the rule).
|    #>
|    param([int]$WaitSeconds = 1200)
|    $path = [string][Environment]::GetEnvironmentVariable('SI_INGEST_LOCK_FILE')
|    if ([string]::IsNullOrWhiteSpace($path)) { return $null }
|    $until = [datetime]::UtcNow.AddSeconds($WaitSeconds)
|    while ([datetime]::UtcNow -lt $until) {
|        try { return [System.IO.File]::Open($path, [System.IO.FileMode]::OpenOrCreate, [System.IO.FileAccess]::ReadWrite, [System.IO.FileShare]::None) }
|        catch { Start-Sleep -Milliseconds 500 }
|    }
|    Write-Warning ('the table update lock ({0}) was not free for {1} seconds -- this process goes on without it' -f $path, $WaitSeconds)
|    $null
|}
|
|function Exit-SIIngestLock {
|    param($Lock)
|    if ($Lock) { try { $Lock.Dispose() } catch { } }
|}
|
|# =====================================================================================================================
|#  LOG INGESTION OVER PLAIN REST -- SecurityInsight needs no PowerShell module (no AzLogDcrIngestPS, no Az.*).
|# =====================================================================================================================
|<#
|    Every SI call site calls the SI wrapper of the job; each wrapper does it over plain REST (its *Rest function):
|
|        SI wrapper                  replaces (AzLogDcrIngestPS)                            SI REST function
|        Get-SIDceList               Get-AzDceListAll                                       Get-SIDceListRest
|        Get-SIDcrList               Get-AzDcrListAll                                       Get-SIDcrListRest
|        Update-SILogTableSchema     CheckCreateUpdate-TableDcr-Structure                   Update-SILogTableSchemaRest
|        Send-SILogData              Post-AzLogAnalyticsLogIngestCustomLogDcrDce-Output     Send-SILogDataRest
|        Add-SICollectionTime        Add-CollectionTimeToAllEntriesInArray                  Add-SICollectionTimeRest
|        Add-SIColumnData            Add-ColumnDataToAllEntriesInArray                      Add-SIColumnDataRest
|        Repair-SILogColumnName      ValidateFix-AzLogAnalyticsTableSchemaColumnNames       Repair-SILogColumnNameRest
|        Format-SILogRowsToSchema    Build-DataArrayToAlignWithSchema                       Format-SILogRowsToSchemaRest
|        Get-SILogSchemaArray        Get-ObjectSchemaAsArray                                Get-SILogSchemaRest -As Array
|        Get-SILogSchemaHash         Get-ObjectSchemaAsHash                                 Get-SILogSchemaRest -As Hash
|        Test-SILogTableDcrStatus    Get-AzLogAnalyticsTableAzDataCollectionRuleStatus      Test-SILogTableDcrStatusRest
|        Set-SILogTable              CreateUpdate-AzLogAnalyticsCustomLogTableDcr           Set-SILogTableRest
|        Set-SILogDcr                CreateUpdate-AzDataCollectionRuleLogIngestCustomLog    Set-SILogDcrRest
|
|    The wrappers keep the parameter names and types the call sites were written against, so no call site changed.
|
|    PS 5.1 safe: no ?. / ??, no RSA.ImportFromPem. Works on pwsh 7 / Linux (no Cert: drive needed). Community + Pro:
|    this file never references a Pro path.
|#>
|
|function Get-SILogIngestWrapperMap {
|    <# The wrapper -> replaced function -> REST function table above, as data (the wiring tests read it). #>
|    [ordered]@{
|        'Get-SIDceList'            = @{ Replaces = 'Get-AzDceListAll';                                   Rest = 'Get-SIDceListRest' }
|        'Get-SIDcrList'            = @{ Replaces = 'Get-AzDcrListAll';                                   Rest = 'Get-SIDcrListRest' }
|        'Update-SILogTableSchema'  = @{ Replaces = 'CheckCreateUpdate-TableDcr-Structure';               Rest = 'Update-SILogTableSchemaRest' }
|        'Send-SILogData'           = @{ Replaces = 'Post-AzLogAnalyticsLogIngestCustomLogDcrDce-Output'; Rest = 'Send-SILogDataRest' }
|        'Add-SICollectionTime'     = @{ Replaces = 'Add-CollectionTimeToAllEntriesInArray';              Rest = 'Add-SICollectionTimeRest' }
|        'Add-SIColumnData'         = @{ Replaces = 'Add-ColumnDataToAllEntriesInArray';                  Rest = 'Add-SIColumnDataRest' }
|        'Repair-SILogColumnName'   = @{ Replaces = 'ValidateFix-AzLogAnalyticsTableSchemaColumnNames';   Rest = 'Repair-SILogColumnNameRest' }
|        'Format-SILogRowsToSchema' = @{ Replaces = 'Build-DataArrayToAlignWithSchema';                   Rest = 'Format-SILogRowsToSchemaRest' }
|        'Get-SILogSchemaArray'     = @{ Replaces = 'Get-ObjectSchemaAsArray';                            Rest = 'Get-SILogSchemaRest' }
|        'Get-SILogSchemaHash'      = @{ Replaces = 'Get-ObjectSchemaAsHash';                             Rest = 'Get-SILogSchemaRest' }
|        'Test-SILogTableDcrStatus' = @{ Replaces = 'Get-AzLogAnalyticsTableAzDataCollectionRuleStatus';  Rest = 'Test-SILogTableDcrStatusRest' }
|        'Set-SILogTable'           = @{ Replaces = 'CreateUpdate-AzLogAnalyticsCustomLogTableDcr';       Rest = 'Set-SILogTableRest' }
|        'Set-SILogDcr'             = @{ Replaces = 'CreateUpdate-AzDataCollectionRuleLogIngestCustomLog'; Rest = 'Set-SILogDcrRest' }
|    }
|}
|
|# ---- the wrappers ------------------------------------------------------------------------------------------------
|# Each declares the parameters the call sites pass (names + types) and forwards @PSBoundParameters: only what the call
|# site bound, with the value it bound, including -Verbose:$false. NOT `@args`: measured 2026-10-03 on PS 5.1 and 7.6,
|# `@args` splits `-Name:$value` into a bare switch plus a positional value.
|
|function Get-SIDceList {
|    [CmdletBinding()]
|    param([string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation,
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    return (Get-SIDceListRest @PSBoundParameters)
|}
|
|function Get-SIDcrList {
|    [CmdletBinding()]
|    param([string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation,
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    return (Get-SIDcrListRest @PSBoundParameters)
|}
|
|function Get-SIDcrCreateRefusal {
|    <# PURE. The line of a DCR / table create's captured output in which Azure (or the create itself) REFUSED it -- the
|       Microsoft answer to surface, '' when there is none. A refused create never makes the rule appear, so it is not waited for.
|       'skipping create' / 'already exists in' (a rule of that name in ANOTHER resource group) is a refusal too: the create did nothing. #>
|    param([AllowNull()][AllowEmptyString()][string]$CreateOutput)
|    if ([string]::IsNullOrWhiteSpace($CreateOutput)) { return '' }
|    $re = '(?i)AuthorizationFailed|LinkedAuthorizationFailed|\(Forbidden\)|\b403\b|\(Unauthorized\)|\b401\b|InvalidPayload|InvalidTemplate|InvalidRequestContent|BadRequest|ResourceGroupNotFound|SubscriptionNotFound|WorkspaceNotFound|Step 3 threw|skipping create|already exists in'
|    foreach ($l in ($CreateOutput -split '\r?\n')) { if ($l -match $re) { return $l.Trim() } }
|    ''
|}
|
|function Wait-SIDcrReady {
|    <#
|        Fix request 2a40d950 (owner 2026-10-22: no fixed limits on SI's own work): after the table / rule create, WAIT UNTIL
|        THE RULE IS READY and read it back -- never a fixed number of seconds that gives up while Azure is still making it
|        (it was 240 s). A not-found / no-immutableId answer right after a create means "not yet" (REQUIREMENTS #619). It stops
|        only on EVIDENCE that waiting cannot help, and says Microsoft's answer:
|          * the create's own output carries a refusal (Get-SIDcrCreateRefusal) -- before any wait;
|          * Azure says the rule's provisioning FAILED;
|          * reading the rule is refused (401 / 403 -- the identity may not read it);
|          * the create has RETURNED and two read-backs in a row, spaced by the progress pace (-MaxPauseSeconds), find NO rule
|            at all: the create did nothing, so waiting cannot help (review S1: it polled until the job died). A rule that IS
|            there but still provisioning is waited for without a deadline.
|        Any other failed read is a transient answer: said, and read again. Progress is said on every read (elapsed, what was
|        seen); the first read is at once (a rule that is already there costs no wait); the pause between reads grows from -FirstPauseSeconds to -MaxPauseSeconds (a pace, never a deadline).
|        -Probe { } -> @{ ImmutableId; State } of the rule as SI's own lists see it now ($null = not there yet); it throws
|        when the read fails. -Sleep { param($s) } / -Log { param($m) } are seams. Returns @{ Ready; ImmutableId; Waited; Why }.
|    #>
|    param([Parameter(Mandatory)][string]$DcrName, [Parameter(Mandatory)][scriptblock]$Probe, [AllowNull()][AllowEmptyString()][string]$CreateOutput,
|          [scriptblock]$Sleep = { param($s) Start-Sleep -Seconds $s }, [scriptblock]$Log = { param($m) Write-Host $m },
|          [int]$FirstPauseSeconds = 15, [int]$MaxPauseSeconds = 60, [AllowEmptyString()][string]$Location = '')
|    $refused = Get-SIDcrCreateRefusal -CreateOutput $CreateOutput
|    if ($refused) {
|        # read back ONCE: a refusal of a later part (the table, a role) can come after the rule itself was made -- then it is used
|        $r = $null; try { $r = & $Probe } catch { $r = $null }
|        if ($null -ne $r -and [string]$r.ImmutableId -and [string]$r.ImmutableId -notlike '*location*' -and [string]$r.ImmutableId -ne $Location -and [string]$r.State -notmatch '(?i)^failed$') {
|            & $Log ("DCR '{0}' is ready although the create reported: {1}" -f $DcrName, $refused)
|            return @{ Ready = $true; ImmutableId = [string]$r.ImmutableId; Waited = 0; Why = '' }
|        }
|        return @{ Ready = $false; ImmutableId = ''; Waited = 0; Why = ("the create of DCR '{0}' was refused -- {1}" -f $DcrName, $refused) }
|    }
|    $waited = 0; $pause = [Math]::Max(1, $FirstPauseSeconds); $absent = 0
|    while ($true) {
|        $seen = 'not there yet'
|        try {
|            $r = & $Probe
|            if ($null -ne $r) {
|                $imm = [string]$r.ImmutableId; $st = [string]$r.State
|                if ($st -match '(?i)^failed$') { return @{ Ready = $false; ImmutableId = ''; Waited = $waited; Why = ("Azure reports DCR '{0}' with provisioning state Failed" -f $DcrName) } }
|                if ($imm -and $imm -notlike '*location*' -and $imm -ne $Location) { & $Log ("DCR immutableId resolved after {0}s: {1}" -f $waited, $imm); return @{ Ready = $true; ImmutableId = $imm; Waited = $waited; Why = '' } }
|                $seen = $(if ($st) { "there, provisioning state $st, no immutableId yet" } else { 'there, no immutableId yet' })
|                $absent = 0
|            } else {
|                $absent++
|                if ($absent -ge 2) {
|                    $said = @(([string]$CreateOutput) -split '\r?\n' | ForEach-Object { $_.Trim() } | Where-Object { $_ })
|                    $answer = $(if ($said.Count) { $said[-1] } else { 'nothing (the create returned no output)' })
|                    return @{ Ready = $false; ImmutableId = ''; Waited = $waited; Why = ("the rule was not created; Azure answered: {0} -- DCR '{1}' was not found on two read-backs {2}s apart after the create returned" -f $answer, $DcrName, [Math]::Max(1, $MaxPauseSeconds)) }
|                }
|            }
|        } catch {
|            $m = ("$($_.Exception.Message)" -replace '\s+', ' ').Trim()
|            if ($m -match '(?i)\b401\b|\b403\b|AuthorizationFailed|Forbidden|Unauthorized') { return @{ Ready = $false; ImmutableId = ''; Waited = $waited; Why = ("reading DCR '{0}' was refused -- {1}" -f $DcrName, $m) } }
|            $seen = "the read failed ($m) -- read again"
|        }
|        & $Log ("waiting for DCR '{0}' to be ready ({1}s so far; {2}) ..." -f $DcrName, $waited, $seen)
|        # after a read that found no rule at all, the next read is a full progress pace later (the second read-back of the stop rule)
|        $nap = $(if ($absent -ge 1) { [Math]::Max($pause, [Math]::Max(1, $MaxPauseSeconds)) } else { $pause })
|        & $Sleep $nap
|        $waited += $nap
|        $pause = [Math]::Min([Math]::Max(1, $MaxPauseSeconds), $pause * 2)
|    }
|}
|
|function Update-SILogTableSchema {
|    [CmdletBinding()]
|    param([Array]$Data, [string]$AzLogWorkspaceResourceId, [string]$TableName, [string]$DcrName, [string]$DcrResourceGroup, [string]$DceName,
|          [AllowEmptyCollection()][string]$LogIngestServicePricipleObjectId, [boolean]$AzDcrSetLogIngestApiAppPermissionsDcrLevel,
|          [boolean]$AzLogDcrTableCreateFromAnyMachine, [string]$SchemaMode, [boolean]$EnableUploadViaLogHub,
|          [AllowEmptyCollection()][array]$AzLogDcrTableCreateFromReferenceMachine,
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation,
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    # A rule that already feeds ANOTHER table is never repurposed, and columns this call adds to an existing rule are
|    # noted so the post can check that they are stored (Start-SILogDcrWatch / Complete-SILogDcrWatch, below).
|    $watch = Start-SILogDcrWatch -DcrName $DcrName -DcrResourceGroup $DcrResourceGroup -TableName $TableName -WorkspaceResourceId $AzLogWorkspaceResourceId -Bound $PSBoundParameters
|    # A NEW rule for a table that already exists is declared from the TABLE (its columns, with their types):
|    # Set-SILogDcrRest does this itself.
|    $out = Update-SILogTableSchemaRest @PSBoundParameters
|    # The rule this install posts through must declare EVERY column of the data -- a column it does not declare is
|    # dropped by Azure without an error. Missing ones are added from the table; any still missing refuses the post.
|    # Before Complete-SILogDcrWatch, so columns added here are checked after the post like any other new column.
|    $null = Assert-SILogDcrCoversData -DcrName $DcrName -DcrResourceGroup $DcrResourceGroup -TableName $TableName -WorkspaceResourceId $AzLogWorkspaceResourceId -DceName $DceName -Data $Data -Bound $PSBoundParameters
|    Complete-SILogDcrWatch -Watch $watch
|    $out
|}
|
|function Send-SILogData {
|    [CmdletBinding()]
|    param([array]$Data, [AllowEmptyString()][string]$DcrName, [AllowEmptyString()][string]$DceName, [string]$TableName,
|          [string]$BatchAmount, [bool]$EnableUploadViaLogHub, [string]$LogHubPath,
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation, [string]$TenantId,
|          [Nullable[bool]]$EnableCompression, [Nullable[bool]]$UseManagedIdentity, [string]$ManagedIdentityClientId)
|    $out = Send-SILogDataRest @PSBoundParameters
|    # Columns added to this rule earlier in the run: check that Log Analytics really stores their values.
|    Confirm-SILogNewColumns -DcrName $DcrName -TableName $TableName -Data $Data -Bound $PSBoundParameters
|    $out
|}
|
|function Add-SICollectionTime {
|    [CmdletBinding()]
|    param([Array]$Data)
|    return (Add-SICollectionTimeRest @PSBoundParameters)
|}
|
|function Add-SIColumnData {
|    [CmdletBinding()]
|    param([Array]$Data, [string]$Column1Name, [string]$Column1Data, [string]$Column2Name, [string]$Column2Data, [string]$Column3Name, [string]$Column3Data)
|    return (Add-SIColumnDataRest @PSBoundParameters)
|}
|
|function Repair-SILogColumnName {
|    [CmdletBinding()]
|    param([Array]$Data)
|    return (Repair-SILogColumnNameRest @PSBoundParameters)
|}
|
|function Format-SILogRowsToSchema {
|    [CmdletBinding()]
|    param([Array]$Data)
|    return (Format-SILogRowsToSchemaRest @PSBoundParameters)
|}
|
|function Get-SILogSchemaArray {
|    [CmdletBinding()]
|    param([Array]$Data, [string[]]$ReturnType)
|    return (Get-SILogSchemaRest -As Array @PSBoundParameters)
|}
|
|function Get-SILogSchemaHash {
|    [CmdletBinding()]
|    param([Array]$Data, [string[]]$ReturnType)
|    return (Get-SILogSchemaRest -As Hash @PSBoundParameters)
|}
|
|function Test-SILogTableDcrStatus {
|    [CmdletBinding()]
|    param([string]$AzLogWorkspaceResourceId, [string]$TableName, [string]$DcrName, [array]$SchemaSourceObject,
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation,
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    return (Test-SILogTableDcrStatusRest @PSBoundParameters)
|}
|
|function Set-SILogTable {
|    [CmdletBinding()]
|    param([string]$TableName, [array]$SchemaSourceObject, [string]$AzLogWorkspaceResourceId, [string]$SchemaMode,
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation,
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    return (Set-SILogTableRest @PSBoundParameters)
|}
|
|function Set-SILogDcr {
|    [CmdletBinding()]
|    param([array]$SchemaSourceObject, [string]$AzLogWorkspaceResourceId, [string]$DceName, [string]$DcrResourceGroup, [string]$DcrName, [string]$TableName,
|          [boolean]$AzDcrSetLogIngestApiAppPermissionsDcrLevel, [AllowEmptyCollection()][string]$LogIngestServicePricipleObjectId, [string]$SchemaMode,
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation,
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    $watch = Start-SILogDcrWatch -DcrName $DcrName -DcrResourceGroup $DcrResourceGroup -TableName $TableName -WorkspaceResourceId $AzLogWorkspaceResourceId -Bound $PSBoundParameters
|    $out = Set-SILogDcrRest @PSBoundParameters
|    Complete-SILogDcrWatch -Watch $watch
|    $out
|}
|
|# =====================================================================================================================
|#  A RULE IS NEVER REPURPOSED, AND NEW COLUMNS ARE CHECKED -- both engines (these run around the wrappers above)
|#
|#  1. A data collection rule that already feeds ANOTHER table is never changed to feed this one. Measured in the 2.2 ->
|#     3.0 upgrade test: a setup-written 2.2 config named its public-IP rule 'dcr-si-publicip-profile' (feeding the 2.2
|#     public-IP table); 3.0's own default uses the same name for its new table, and the module REWROTE the rule -- the
|#     old flow was gone and the first post failed. Start-SILogDcrWatch refuses before anything is written.
|#  2. Columns added to an EXISTING rule land empty for a while: Azure accepts the post, but drops the new columns'
|#     values until the change has reached the ingestion pipeline (measured: the first 3.0 run after the upgrade wrote
|#     SI_AssetName / SI_AssetId empty on 134 of 134 rows; empty again 4 and 18 minutes after a column was added; filled
|#     hours later). The rule shows the new column at once, so the rule itself is no signal. Complete-SILogDcrWatch
|#     notes what was added; Confirm-SILogNewColumns, after the post, asks Log Analytics whether this run's values were
|#     STORED, and when they were not, the run says so and records it (Get-SILogIngestNotes -> the run's outcome is
|#     success-partial, so nothing downstream reads the snapshot as whole).
|#  Every read here is best effort: a rule that cannot be read is never a reason to stop a publish -- only a rule that IS
|#  read and feeds another table is.
|# =====================================================================================================================
|
|function Get-SILogDcrStreams {
|    <# PURE. The streams an existing rule writes: each data flow's outputStream, else the flow's streams; a rule with
|       no data flows -> its declared streams. #>
|    param([AllowNull()]$Dcr)
|    $out = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Dcr -or $null -eq $Dcr.properties) { return @() }
|    foreach ($f in @($Dcr.properties.dataFlows)) {
|        if ($null -eq $f) { continue }
|        $names = if ($f.PSObject.Properties['outputStream'] -and $f.outputStream) { @([string]$f.outputStream) } else { @(@($f.streams) | ForEach-Object { [string]$_ }) }
|        foreach ($n in $names) { if ($n -and -not $out.Contains($n)) { [void]$out.Add($n) } }
|    }
|    if ($out.Count -eq 0 -and $Dcr.properties.streamDeclarations) {
|        foreach ($p in $Dcr.properties.streamDeclarations.PSObject.Properties) { [void]$out.Add([string]$p.Name) }
|    }
|    return $out.ToArray()
|}
|
|function Test-SILogDcrFeedsOtherTable {
|    <# PURE. $true when the rule exists, writes at least one stream, and none of its streams is this table's. #>
|    param([AllowNull()]$Dcr, [Parameter(Mandatory)][string]$TableName)
|    $streams = @(Get-SILogDcrStreams -Dcr $Dcr)
|    if ($streams.Count -eq 0) { return $false }
|    $t = $TableName -replace '_CL$', ''
|    $mine = @(('Custom-' + $t + '_CL'), (Get-SILogStreamName -TableName $t))
|    foreach ($s in $streams) { if ($mine -contains $s) { return $false } }
|    return $true
|}
|
|function Get-SILogDcrStreamColumns {
|    <# PURE. The column names the rule declares for this table's stream (empty when it declares none). #>
|    param([AllowNull()]$Dcr, [Parameter(Mandatory)][string]$TableName)
|    if ($null -eq $Dcr -or $null -eq $Dcr.properties -or -not $Dcr.properties.streamDeclarations) { return @() }
|    $t = $TableName -replace '_CL$', ''
|    foreach ($s in @(('Custom-' + $t + '_CL'), (Get-SILogStreamName -TableName $t))) {
|        $p = $Dcr.properties.streamDeclarations.PSObject.Properties[$s]
|        if ($p) { return @(@($p.Value.columns) | Where-Object { $_ } | ForEach-Object { [string]$_.name }) }
|    }
|    return @()
|}
|
|function Get-SILogAddedColumns {
|    <# PURE. Columns in -After that -Before did not have. #>
|    param([AllowEmptyCollection()][string[]]$Before = @(), [AllowEmptyCollection()][string[]]$After = @())
|    return @(@($After) | Where-Object { $_ -and (@($Before) -notcontains $_) })
|}
|
|function Get-SILogAlternateDcrName {
|    <# PURE. A distinct, deterministic rule name for this install: '<name>-<resource group>', or '<name>-<8-character
|       hash of the resource group>' when that would pass 60 characters -- the rule the profilers' collision rename
|       already uses, so every run derives the same name. #>
|    param([Parameter(Mandatory)][string]$DcrName, [Parameter(Mandatory)][string]$ResourceGroup)
|    $rgClean = ($ResourceGroup -replace '[^a-zA-Z0-9-]', '-').ToLowerInvariant().Trim('-')
|    $name = "$DcrName-$rgClean"
|    if ($name.Length -gt 60) {
|        $sha = [System.Security.Cryptography.SHA1]::Create()
|        try { $h = $sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($ResourceGroup.ToLowerInvariant())) } finally { $sha.Dispose() }
|        $name = "$DcrName-" + (([BitConverter]::ToString($h) -replace '-', '').Substring(0, 8).ToLowerInvariant())
|    }
|    return $name
|}
|
|function Get-SILogDcrRepurposeMessage {
|    <# The one sentence a refused rule produces. #>
|    param([string]$DcrName, [string]$ResourceGroup, [string[]]$Streams, [string]$TableName)
|    $feeds = (@($Streams) | ForEach-Object { $_ -replace '^Custom-', '' }) -join ', '
|    ("The data collection rule '{0}' (resource group '{1}') already sends data to {2}. It is left unchanged -- changing it to send {3}_CL would stop the data it carries now. Give {3}_CL a rule of its own: set this table's data collection rule name in config\SecurityInsight.custom.ps1 to a new name (it is created automatically)." -f `
|        $DcrName, $ResourceGroup, $feeds, ($TableName -replace '_CL$', ''))
|}
|
|function Get-SILogDcrState {
|    <#
|        The rule as Azure has it NOW (never from the run cache): Known = $false when it cannot be read (no subscription /
|        resource group configured, or the read failed); else Dcr = the rule, or $null when it does not exist.
|    #>
|    param([string]$DcrName, [string]$DcrResourceGroup, [string]$WorkspaceResourceId, $Bound)
|    $scope = Get-SILogIngestScope -WorkspaceResourceId $WorkspaceResourceId -DcrResourceGroup $DcrResourceGroup
|    if (-not $DcrName -or -not $scope.Subscription -or -not $scope.DcrRg) { return [pscustomobject]@{ Known = $false; Dcr = $null; ResourceGroup = $scope.DcrRg } }
|    try {
|        $auth = Resolve-SILogIngestAuth -Bound $Bound
|        $d = Invoke-SILogArm -Path "/subscriptions/$($scope.Subscription)/resourceGroups/$($scope.DcrRg)/providers/Microsoft.Insights/dataCollectionRules/$DcrName" `
|                 -ApiVersion (Get-SILogArmApiVersion Dcr) -Auth $auth -AllowNotFound -NoCache
|        return [pscustomobject]@{ Known = $true; Dcr = $d; ResourceGroup = $scope.DcrRg }
|    } catch {
|        Write-Verbose ("data collection rule '{0}' could not be read before the update: {1}" -f $DcrName, $_.Exception.Message)
|        return [pscustomobject]@{ Known = $false; Dcr = $null; ResourceGroup = $scope.DcrRg }
|    }
|}
|
|function Resolve-SILogDcrNameForTable {
|    <#
|        The rule name this table should post through: -DcrName, unless that rule exists and feeds ANOTHER table -- then
|        Get-SILogAlternateDcrName (when that one is free or already this table's). When the alternate is taken too, the
|        original name is returned and the wrapper refuses it with a clear message. Unknown (cannot be read) -> unchanged.
|        Returns Name + Reason (empty when unchanged).
|    #>
|    param([Parameter(Mandatory)][string]$DcrName, [string]$DcrResourceGroup, [Parameter(Mandatory)][string]$TableName, [string]$WorkspaceResourceId, $Bound)
|    $st = Get-SILogDcrState -DcrName $DcrName -DcrResourceGroup $DcrResourceGroup -WorkspaceResourceId $WorkspaceResourceId -Bound $Bound
|    if (-not $st.Known -or -not $st.Dcr -or -not (Test-SILogDcrFeedsOtherTable -Dcr $st.Dcr -TableName $TableName)) {
|        return [pscustomobject]@{ Name = $DcrName; Reason = '' }
|    }
|    $alt = Get-SILogAlternateDcrName -DcrName $DcrName -ResourceGroup ([string]$st.ResourceGroup)
|    $st2 = Get-SILogDcrState -DcrName $alt -DcrResourceGroup $DcrResourceGroup -WorkspaceResourceId $WorkspaceResourceId -Bound $Bound
|    if ($st2.Known -and $st2.Dcr -and (Test-SILogDcrFeedsOtherTable -Dcr $st2.Dcr -TableName $TableName)) {
|        return [pscustomobject]@{ Name = $DcrName; Reason = '' }
|    }
|    $feeds = (@(Get-SILogDcrStreams -Dcr $st.Dcr) | ForEach-Object { $_ -replace '^Custom-', '' }) -join ', '
|    [pscustomobject]@{
|        Name   = $alt
|        Reason = ("the data collection rule '{0}' already sends data to {1} and is left unchanged; {2}_CL uses its own rule '{3}'." -f $DcrName, $feeds, ($TableName -replace '_CL$', ''), $alt)
|    }
|}
|
|function Start-SILogDcrWatch {
|    <# Before a rule is created / updated: refuse a rule that feeds another table; remember the columns it declares. #>
|    param([string]$DcrName, [string]$DcrResourceGroup, [string]$TableName, [string]$WorkspaceResourceId, $Bound)
|    if (-not $DcrName -or -not $TableName) { return $null }
|    $b = @{}; if ($Bound) { foreach ($k in @($Bound.Keys)) { if ($k -notin 'Data', 'SchemaSourceObject') { $b[$k] = $Bound[$k] } } }
|    $st = Get-SILogDcrState -DcrName $DcrName -DcrResourceGroup $DcrResourceGroup -WorkspaceResourceId $WorkspaceResourceId -Bound $b
|    if (-not $st.Known) { return $null }
|    if ($st.Dcr -and (Test-SILogDcrFeedsOtherTable -Dcr $st.Dcr -TableName $TableName)) {
|        throw (Get-SILogDcrRepurposeMessage -DcrName $DcrName -ResourceGroup ([string]$st.ResourceGroup) -Streams @(Get-SILogDcrStreams -Dcr $st.Dcr) -TableName $TableName)
|    }
|    [pscustomobject]@{
|        DcrName = $DcrName; DcrResourceGroup = $DcrResourceGroup; TableName = ($TableName -replace '_CL$', ''); WorkspaceResourceId = $WorkspaceResourceId
|        Bound = $b; Existed = [bool]$st.Dcr; Before = @(Get-SILogDcrStreamColumns -Dcr $st.Dcr -TableName $TableName)
|    }
|}
|
|function Complete-SILogDcrWatch {
|    <# After the update: columns an EXISTING rule gained are noted for Confirm-SILogNewColumns. Never throws. #>
|    param($Watch)
|    if (-not $Watch -or -not $Watch.Existed) { return }
|    # The run-health record does not check itself: it is the record a check would report into.
|    if ($Watch.TableName -ieq 'SI_RunHealth') { return }
|    try {
|        $st = Get-SILogDcrState -DcrName $Watch.DcrName -DcrResourceGroup $Watch.DcrResourceGroup -WorkspaceResourceId $Watch.WorkspaceResourceId -Bound $Watch.Bound
|        if (-not $st.Known -or -not $st.Dcr) { return }
|        $added = @(Get-SILogAddedColumns -Before $Watch.Before -After @(Get-SILogDcrStreamColumns -Dcr $st.Dcr -TableName $Watch.TableName))
|        if ($added.Count -eq 0) { return }
|        if (-not ($global:SI_LogIngestNewColumns -is [hashtable])) { $global:SI_LogIngestNewColumns = @{} }
|        $key = $Watch.DcrName.ToLowerInvariant()
|        $ws = if ($Watch.WorkspaceResourceId) { $Watch.WorkspaceResourceId } else { [string]$global:SI_WorkspaceResourceId }
|        if ($global:SI_LogIngestNewColumns.ContainsKey($key)) {
|            $prev = $global:SI_LogIngestNewColumns[$key]
|            $added = @(@($prev.Columns) + @($added) | Select-Object -Unique)
|        }
|        $global:SI_LogIngestNewColumns[$key] = [pscustomobject]@{ Table = $Watch.TableName; Columns = $added; WorkspaceResourceId = $ws; AddedAt = [datetime]::UtcNow }
|    } catch { Write-Verbose ("new-column check skipped: {0}" -f $_.Exception.Message) }
|}
|
|function Get-SILogColumnsWithValues {
|    <# PURE. Of -Columns, those holding a non-empty value in at least one row (only those can be checked). #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [AllowEmptyCollection()][string[]]$Columns = @())
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($c in @($Columns)) {
|        foreach ($r in @($Rows)) {
|            if ($null -eq $r) { continue }
|            $v = if ($r -is [System.Collections.IDictionary]) { $r[$c] } elseif ($r.PSObject.Properties[$c]) { $r.$c } else { $null }
|            if ($null -ne $v -and -not [string]::IsNullOrWhiteSpace([string]$v)) { [void]$out.Add($c); break }
|        }
|    }
|    return $out.ToArray()
|}
|
|function Get-SILogRowColumnNames {
|    <# PURE. Every column name the rows carry (first-seen order, TimeGenerated left out: Azure sets it). #>
|    param([AllowEmptyCollection()][object[]]$Rows = @())
|    $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($r in @($Rows)) {
|        if ($null -eq $r) { continue }
|        $names = if ($r -is [System.Collections.IDictionary]) { @($r.Keys | ForEach-Object { [string]$_ }) } else { @($r.PSObject.Properties | ForEach-Object { $_.Name }) }
|        foreach ($n in $names) { if ($n -and $n -ne 'TimeGenerated' -and $seen.Add($n)) { [void]$out.Add($n) } }
|    }
|    return $out.ToArray()
|}
|
|function Get-SILogRowsCollectionTime {
|    <# PURE. The run's CollectionTime from the first row that carries one, as UTC; $null when no row does. #>
|    param([AllowEmptyCollection()][object[]]$Rows = @())
|    foreach ($r in @($Rows)) {
|        if ($null -eq $r) { continue }
|        $v = if ($r -is [System.Collections.IDictionary]) { $r['CollectionTime'] } elseif ($r.PSObject.Properties['CollectionTime']) { $r.CollectionTime } else { $null }
|        if ($null -eq $v -or [string]::IsNullOrWhiteSpace([string]$v)) { continue }
|        if ($v -is [datetime]) { if ($v.Kind -eq [DateTimeKind]::Local) { return $v.ToUniversalTime() }; return [datetime]::SpecifyKind($v, [DateTimeKind]::Utc) }
|        $d = [datetime]::MinValue
|        $styles = [Globalization.DateTimeStyles]::AssumeUniversal -bor [Globalization.DateTimeStyles]::AdjustToUniversal
|        if ([datetime]::TryParse([string]$v, [Globalization.CultureInfo]::InvariantCulture, $styles, [ref]$d)) { return $d }
|    }
|    return $null
|}
|
|function Get-SILogColumnCheckKql {
|    <# PURE. Rows of this run in the table, and how many carry a value in each new column (C0, C1, ... in -Columns order). #>
|    param([Parameter(Mandatory)][string]$TableName, [Parameter(Mandatory)][string[]]$Columns, [AllowNull()]$CollectionTime, [AllowNull()]$PostedSince)
|    $t = ($TableName -replace '_CL$', '') -replace '[^A-Za-z0-9_]', ''
|    $agg = for ($i = 0; $i -lt $Columns.Count; $i++) {
|        'C{0} = countif(isnotempty(tostring(column_ifexists("{1}", ""))))' -f $i, ($Columns[$i] -replace '[^A-Za-z0-9_]', '')
|    }
|    $filter = if ($CollectionTime) {
|        $ct = ([datetime]$CollectionTime).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ', [Globalization.CultureInfo]::InvariantCulture)
|        "| where TimeGenerated > ago(2d)`n| where CollectionTime between (datetime($ct) - 2s .. datetime($ct) + 2s)"
|    } else {
|        $since = ([datetime]$PostedSince).ToUniversalTime().AddMinutes(-1).ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture)
|        "| where TimeGenerated >= datetime($since)"
|    }
|    "{0}_CL`n{1}`n| summarize Rows = count(), {2}" -f $t, $filter, ($agg -join ', ')
|}
|
|function Get-SILogColumnCheckVerdict {
|    <#
|        PURE. One result row of Get-SILogColumnCheckKql -> Verdict:
|          stored      -- rows arrived and every new column holds values
|          not-stored  -- rows arrived and a new column is empty on all of them (Missing names which)
|          not-landed  -- no row of this run is queryable yet
|    #>
|    param([AllowNull()]$Result, [Parameter(Mandatory)][string[]]$Columns)
|    $get = { param($n) if ($null -eq $Result) { 0 } elseif ($Result -is [System.Collections.IDictionary]) { [long]$Result[$n] } elseif ($Result.PSObject.Properties[$n]) { [long]$Result.$n } else { 0 } }
|    $rows = & $get 'Rows'
|    if ($rows -le 0) { return [pscustomobject]@{ Verdict = 'not-landed'; Rows = 0; Missing = @($Columns) } }
|    $missing = @(for ($i = 0; $i -lt $Columns.Count; $i++) { if ((& $get ('C' + $i)) -le 0) { $Columns[$i] } })
|    if ($missing.Count -gt 0) { return [pscustomobject]@{ Verdict = 'not-stored'; Rows = $rows; Missing = $missing } }
|    [pscustomobject]@{ Verdict = 'stored'; Rows = $rows; Missing = @() }
|}
|
|function Invoke-SILogLaQuery {
|    <# One Log Analytics query as the run's identity (the workspace's id read through ARM). Returns the first table's
|       rows as objects. Throws on failure. #>
|    param([Parameter(Mandatory)][string]$WorkspaceResourceId, [Parameter(Mandatory)][string]$Query, $Bound)
|    $auth = Resolve-SILogIngestAuth -Bound $Bound
|    $ws = Invoke-SILogArm -Path $WorkspaceResourceId -ApiVersion (Get-SILogArmApiVersion Table) -Auth $auth
|    $cid = if ($ws -and $ws.properties) { [string]$ws.properties.customerId } else { '' }
|    if (-not $cid) { throw 'the Log Analytics workspace id could not be read' }
|    $r = Invoke-SILogIngestRequest -Method POST -Uri ('https://api.loganalytics.io/v1/workspaces/{0}/query' -f $cid) -Body (@{ query = $Query } | ConvertTo-Json -Compress) `
|             -Resource 'https://api.loganalytics.io/' -Auth $auth -MaxAttempts 3 -What 'Log Analytics query'
|    $j = $r.Content | ConvertFrom-Json
|    $tbl = @($j.tables)[0]
|    if (-not $tbl) { return @() }
|    $names = @(@($tbl.columns) | ForEach-Object { [string]$_.name })
|    foreach ($row in @($tbl.rows)) {
|        $o = [ordered]@{}
|        for ($i = 0; $i -lt $names.Count; $i++) { $o[$names[$i]] = @($row)[$i] }
|        [pscustomobject]$o
|    }
|}
|
|function Wait-SILogColumnsStored {
|    <#
|        Asks Log Analytics, until this run's rows have arrived, whether the new columns hold their values. Polls at 30 s,
|        then 60 s, then every 120 s; stops as soon as the answer is known (stored, or every row arrived with a column
|        empty) or after -WindowSec (default 900: Azure's ingestion delay is normally seconds to a few minutes, so rows
|        that are still missing after 15 minutes are reported, not waited for). A query that fails ends the check.
|    #>
|    param([Parameter(Mandatory)][string]$WorkspaceResourceId, [Parameter(Mandatory)][string]$TableName, [Parameter(Mandatory)][string[]]$Columns,
|          [AllowNull()]$CollectionTime, [AllowNull()]$PostedSince, [int]$ExpectedRows = 1, $Bound, [int]$WindowSec = 0)
|    if ($WindowSec -le 0) { $WindowSec = 900; $o = 0; if ([int]::TryParse([string]$global:SI_LogIngest_NewColumnCheckSec, [ref]$o) -and $o -gt 0) { $WindowSec = $o } }
|    $kql = Get-SILogColumnCheckKql -TableName $TableName -Columns $Columns -CollectionTime $CollectionTime -PostedSince $PostedSince
|    $waited = 0; $step = 30
|    $last = [pscustomobject]@{ Verdict = 'not-landed'; Rows = 0; Missing = @($Columns) }
|    while ($true) {
|        Start-Sleep -Seconds $step
|        $waited += $step
|        try {
|            $res = @(Invoke-SILogLaQuery -WorkspaceResourceId $WorkspaceResourceId -Query $kql -Bound $Bound)
|            $last = Get-SILogColumnCheckVerdict -Result $(if ($res.Count) { $res[0] } else { $null }) -Columns $Columns
|        } catch {
|            $last = [pscustomobject]@{ Verdict = 'unverified'; Rows = 0; Missing = @($Columns); Detail = $_.Exception.Message }
|            break
|        }
|        if ($last.Verdict -eq 'stored') { break }
|        if ($last.Verdict -eq 'not-stored' -and $last.Rows -ge $ExpectedRows) { break }
|        if ($waited -ge $WindowSec) { break }
|        $step = [Math]::Min(120, $step * 2)
|    }
|    $last | Add-Member -NotePropertyName WaitedSec -NotePropertyValue $waited -Force
|    return $last
|}
|
|function Add-SILogIngestNote {
|    <# Something a publish could not deliver in full, for the run's outcome (Get-SIRunOutcome). #>
|    # -Kind 'column-lag' (#414): only NEW, non-key columns were not stored yet (Azure's propagation delay) -- the rows and
|    # their key columns are there, so a Risk Analysis run says it as a warning and is NOT partial for it.
|    param([Parameter(Mandatory)][string]$Table, [string[]]$Columns = @(), [Parameter(Mandatory)][string]$Message, [string]$Kind = 'incomplete')
|    if (-not ($global:SI_LogIngestNotes -is [System.Collections.Generic.List[object]])) { $global:SI_LogIngestNotes = New-Object System.Collections.Generic.List[object] }
|    [void]$global:SI_LogIngestNotes.Add([pscustomobject]@{ Table = $Table; Columns = @($Columns); Message = $Message; Kind = $Kind })
|}
|
|function Get-SILogIngestNoteKind {
|    <#
|        PURE. 'column-lag' when a 'not-stored' verdict misses only non-key columns; else 'incomplete'.
|        #414 / #294: the KEY columns are the ones a row cannot be placed or read without. A new key column that was not
|        stored is a real loss (the data sync refuses such rows); any other new column not stored yet is propagation lag.
|    #>
|    param([string]$Verdict, [string[]]$Missing = @())
|    $keys = @('CollectionTime', 'ConfigurationId', 'AssetId', 'AssetName', 'ReportName', 'SecuritySeverity', 'CriticalityTier', 'RiskScoreTotal', 'SolutionVersion')
|    if ($Verdict -ne 'not-stored' -or -not @($Missing).Count) { return 'incomplete' }
|    foreach ($m in @($Missing)) { if ($keys -contains ([string]$m).Trim()) { return 'incomplete' } }
|    'column-lag'
|}
|
|function Get-SILogIngestNotes {
|    if ($global:SI_LogIngestNotes -is [System.Collections.Generic.List[object]]) { return $global:SI_LogIngestNotes.ToArray() }
|    return @()
|}
|
|function Reset-SILogIngestNotes {
|    <# At the start of a run: notes and pending column checks belong to ONE run. #>
|    $global:SI_LogIngestNotes = New-Object System.Collections.Generic.List[object]
|    $global:SI_LogIngestNewColumns = @{}
|}
|
|function Confirm-SILogNewColumns {
|    <#
|        After a post through a rule that gained columns earlier in this run: were this run's values for them STORED?
|        Not stored (or not confirmable) -> one warning that says what is missing and that the next run fills it, and a
|        note that makes the run's outcome success-partial. Never throws: the rows themselves were posted.
|    #>
|    param([string]$DcrName, [string]$TableName, [AllowNull()][array]$Data, $Bound)
|    if (-not $DcrName -or -not ($global:SI_LogIngestNewColumns -is [hashtable])) { return }
|    $key = $DcrName.ToLowerInvariant()
|    if (-not $global:SI_LogIngestNewColumns.ContainsKey($key)) { return }
|    $chg = $global:SI_LogIngestNewColumns[$key]
|    $global:SI_LogIngestNewColumns.Remove($key)
|    $table = if ($TableName) { $TableName -replace '_CL$', '' } else { [string]$chg.Table }
|    try {
|        $rows = @($Data)
|        $newCols = @(Get-SILogColumnsWithValues -Rows $rows -Columns @($chg.Columns))
|        # ring 1, 2026-10-11 -- a rule CHANGED right before the post can drop values of columns it had already (added by an
|        # earlier run or job inside Azure's propagation window), not only of the columns this run added. So once this run
|        # changed the rule, EVERY column that carries a value in the posted rows is checked; the new ones first.
|        $cols = @(Get-SILogColumnsWithValues -Rows $rows -Columns @(@($newCols) + @(Get-SILogRowColumnNames -Rows $rows) | Select-Object -Unique))
|        if ($newCols.Count -eq 0 -or $cols.Count -eq 0) { return }
|        # #475: the wait (half a minute or more) is spent ONCE per table per process -- a run that posts its records in
|        # dozens of batches gained new columns batch after batch and waited every time (customer H 2026-10-09)
|        $rcache = Get-SILogIngestRunCache
|        if (-not ($rcache.ConfirmedTables -is [hashtable])) { $rcache.ConfirmedTables = @{} }
|        $tk = $table.ToLowerInvariant()
|        if ($rcache.ConfirmedTables.ContainsKey($tk)) {
|            Write-Host (" [INFO] {0}_CL gained {1} more new column(s) ({2}); this run checked the table's new columns once already, so these are not waited for -- the next run stores them in any case." -f $table, $newCols.Count, ($newCols -join ', '))
|            return
|        }
|        $rcache.ConfirmedTables[$tk] = $true
|        $b = @{}; if ($Bound) { foreach ($k in @($Bound.Keys)) { if ($k -ne 'Data') { $b[$k] = $Bound[$k] } } }
|        Write-Host (" [INFO] {0}_CL gained {1} new column(s) in this run ({2}). Azure takes a while to start storing a new column, so this run checks that the values of every column it posted ({3}) arrived ..." -f $table, $newCols.Count, ($newCols -join ', '), $cols.Count)
|        $res = Wait-SILogColumnsStored -WorkspaceResourceId ([string]$chg.WorkspaceResourceId) -TableName $table -Columns $cols `
|                   -CollectionTime (Get-SILogRowsCollectionTime -Rows $rows) -PostedSince ([datetime]::UtcNow.AddSeconds(-60)) -ExpectedRows $rows.Count -Bound $b
|        if ($res.Verdict -eq 'stored') {
|            Write-Host (" [OK]   {0}_CL: the new column(s) hold this run's values." -f $table)
|            return
|        }
|        $msg = switch ($res.Verdict) {
|            'not-stored' { "{0}_CL: the data collection rule was changed in this run and Azure was not yet storing every column when the rows arrived: this run's values for {1} are missing. The rows are there; the next run stores these columns." -f $table, (@($res.Missing) -join ', ') }
|            'not-landed' { "{0}_CL gained new column(s) in this run ({1}) and this run's rows were not queryable within {2} minutes, so it is not known whether those columns were stored." -f $table, ($cols -join ', '), [int]($res.WaitedSec / 60) }
|            default      { "{0}_CL gained new column(s) in this run ({1}) and it could not be checked whether this run's values were stored ({2})." -f $table, ($cols -join ', '), $res.Detail }
|        }
|        Write-Warning $msg
|        # the run's outcome is judged on the columns this run ADDED (as before); a column the rule already had that read
|        # back empty is said (the warning above) but only ever counts as propagation lag
|        $missNew = @(@($res.Missing) | Where-Object { $newCols -contains $_ })
|        $kind = 'column-lag'
|        if ([string]$res.Verdict -ne 'not-stored') { $kind = 'incomplete' }
|        elseif ($missNew.Count -gt 0) { $kind = Get-SILogIngestNoteKind -Verdict 'not-stored' -Missing $missNew }
|        Add-SILogIngestNote -Table $table -Columns $cols -Message $msg -Kind $kind
|    } catch {
|        $msg = ("{0}_CL gained new column(s) in this run and it could not be checked whether this run's values were stored ({1})." -f $table, $_.Exception.Message)
|        Write-Warning $msg
|        Add-SILogIngestNote -Table $table -Message $msg
|    }
|}
|
|# =====================================================================================================================
|#  THE RULE MUST DECLARE EVERY COLUMN OF THE DATA -- both engines (#294)
|#
|#  Azure stores only the columns a data collection rule DECLARES: every other value of a posted row is dropped, and the
|#  post still answers 204. Found live 2026-10-05 on ring 1: a Risk Analysis Detailed run posted 14,624 rows and only
|#  AssetName, AssetId, the report name and 8 more columns arrived -- CollectionTime, ConfigurationId, SecuritySeverity,
|#  CriticalityTier, RiskScoreTotal and SolutionVersion were EMPTY on every row, and the run logged SUCCESS. The chain:
|#    1. the run used the default rule name (its configuration had not reached the job), a rule that did not exist yet;
|#    2. AzLogDcrIngestPS creates a new rule in two steps -- first with the data's FIRST 11 columns, then with all of
|#       them. The second step was refused (InvalidTransformOutput: a column the data reads as an object, the existing
|#       table holds as text), so the rule was left with 11 columns;
|#    3. on the next run the module looked the rule up BY NAME across the tenant, found another install's same-named
|#       rule with every column, concluded nothing was missing, and the rows went through the 11-column rule.
|#  Set-SILogDcrRest stops step 2 (a new rule for an existing table is declared from the TABLE, with its
|#  types); Assert-SILogDcrCoversData stops step 3 for good: after every table/rule update it reads THE rule this install
|#  posts through (in the configured scope, never by name across the tenant), adds from the table any column of the data
|#  the rule does not declare, and REFUSES the post when a column of the data still is not declared.
|# =====================================================================================================================
|
|function Get-SILogBoundAuth {
|    <# The sign-in arguments of a wrapper call (what Set-SILogDcrRest / Resolve-SILogIngestAuth take), nothing else. #>
|    param($Bound)
|    $b = @{}
|    if ($null -eq $Bound) { return $b }
|    foreach ($k in 'AzAppId', 'AzAppSecret', 'AzAppCertificateThumbprint', 'AzAppCertificateStoreLocation', 'UseManagedIdentity', 'ManagedIdentityClientId', 'TenantId') {
|        if ($Bound.ContainsKey($k) -and $null -ne $Bound[$k] -and "$($Bound[$k])" -ne '') { $b[$k] = $Bound[$k] }
|    }
|    $b
|}
|
|function Get-SILogDataColumnNames {
|    <#
|        PURE. The columns a set of rows carries: the union over EVERY row (first-seen order, names compared without
|        letter case), without TimeGenerated and Log Analytics' own standard columns, and only names a Log Analytics
|        column can have (a name the ingest path drops before posting is not a column of the posted data).
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Rows = @())
|    $std = @('TimeGenerated', 'TenantId', 'Type', '_ResourceId', '_SubscriptionId', 'SourceSystem', 'MG', 'ManagementGroupName', '_BilledSize', '_IsBillable', '_ItemId', '_TimeReceived')
|    $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($r in @($Rows)) {
|        if ($null -eq $r) { continue }
|        $names = if ($r -is [System.Collections.IDictionary]) { @($r.Keys) } else { @($r.PSObject.Properties | ForEach-Object { $_.Name }) }
|        foreach ($n in $names) {
|            $s = [string]$n
|            if (-not $s -or $s -notmatch '^[A-Za-z][A-Za-z0-9_]*$' -or ($std -contains $s)) { continue }
|            if ($s.Length -gt 45) { $s = $s.Substring(0, 45) }   # the column name repair cuts a longer name to 45
|            if ($seen.Add($s)) { [void]$out.Add($s) }
|        }
|    }
|    return $out.ToArray()
|}
|
|function Get-SILogNewRuleColumns {
|    <#
|        PURE. The stream declaration of a NEW rule: the table's columns with the table's types when the table exists (then
|        each column of -SchemaSourceObject the table does not have, with its own type); else -SchemaSourceObject.
|        TimeGenerated is never declared (the rule's transform sets it).
|    #>
|    param([AllowNull()]$Table, [AllowNull()][AllowEmptyCollection()][object[]]$SchemaSourceObject = @())
|    $out = New-Object System.Collections.Generic.List[object]
|    $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $add = { param($n, $t) $s = [string]$n; if ($s -and $s -ne 'TimeGenerated' -and $seen.Add($s)) { [void]$out.Add([ordered]@{ name = $s; type = [string]$t }) } }
|    if ($null -ne $Table -and $Table.properties -and $Table.properties.schema) {
|        foreach ($c in @($Table.properties.schema.columns)) { if ($c) { & $add $c.name $c.type } }
|    }
|    foreach ($c in @($SchemaSourceObject)) { if ($c) { & $add $c.name $c.type } }
|    return $out.ToArray()
|}
|
|function Get-SILogDcrCoverageGap {
|    <#
|        PURE. Which of -Columns the rule does NOT declare for this table's stream: Missing (all of them), InTable (those
|        the table has -- the rule can be given them from the table) and NotInTable (those the table does not have).
|    #>
|    param([AllowNull()]$Dcr, [Parameter(Mandatory)][string]$TableName, [AllowEmptyCollection()][string[]]$Columns = @(), [AllowNull()]$Table)
|    $declared = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($n in @(Get-SILogDcrStreamColumns -Dcr $Dcr -TableName $TableName)) { [void]$declared.Add([string]$n) }
|    $inTable = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    if ($null -ne $Table -and $Table.properties -and $Table.properties.schema) {
|        foreach ($c in @($Table.properties.schema.columns)) { if ($c) { [void]$inTable.Add([string]$c.name) } }
|    }
|    $missing = @(@($Columns) | Where-Object { $_ -and -not $declared.Contains([string]$_) })
|    [pscustomobject]@{
|        Missing    = $missing
|        InTable    = @($missing | Where-Object { $inTable.Contains([string]$_) })
|        NotInTable = @($missing | Where-Object { -not $inTable.Contains([string]$_) })
|    }
|}
|
|function Assert-SILogDcrCoversData {
|    <#
|        After a table/rule update: THE rule this install posts through (read in the configured scope) must declare every
|        column of -Data. Columns it lacks that the table has are added from the table (Set-SILogDcrRest, additive); a
|        column still not declared after that REFUSES the post -- throws System.IO.InvalidDataException, because Azure
|        would store the rows without it and answer success. Columns the TABLE does not have either are said and noted
|        (the run is partial), not refused: the table update is what failed there, and it says so itself.
|        Nothing is checked when schema management is off for this machine (the same rule the module applies) or the
|        rule cannot be read (said with -Verbose; Known = $false). Returns @{ Verdict; Added; Missing }.
|    #>
|    param([string]$DcrName, [string]$DcrResourceGroup, [string]$TableName, [string]$WorkspaceResourceId, [string]$DceName, [AllowNull()][array]$Data, $Bound)
|    $res = [pscustomobject]@{ Verdict = 'skipped'; Added = @(); Missing = @() }
|    if (-not $DcrName -or -not $TableName) { return $res }
|    if ($Bound) {
|        if ($Bound.ContainsKey('EnableUploadViaLogHub') -and [bool]$Bound['EnableUploadViaLogHub']) { return $res }
|        if ($Bound.ContainsKey('AzLogDcrTableCreateFromAnyMachine') -and -not [bool]$Bound['AzLogDcrTableCreateFromAnyMachine']) {
|            $ref = if ($Bound.ContainsKey('AzLogDcrTableCreateFromReferenceMachine')) { @($Bound['AzLogDcrTableCreateFromReferenceMachine']) } else { @() }
|            if (-not ($env:COMPUTERNAME -and ($ref -contains $env:COMPUTERNAME))) { return $res }
|        }
|    }
|    $cols = @(Get-SILogDataColumnNames -Rows @($Data))
|    if (-not $cols.Count) { return $res }
|    $t = $TableName -replace '_CL$', ''
|    $b = Get-SILogBoundAuth -Bound $Bound
|    $st = Get-SILogDcrState -DcrName $DcrName -DcrResourceGroup $DcrResourceGroup -WorkspaceResourceId $WorkspaceResourceId -Bound $b
|    if (-not $st.Known) { $res.Verdict = 'unknown'; Write-Verbose ("data collection rule '{0}' could not be read -- its columns are not checked" -f $DcrName); return $res }
|    if (-not $st.Dcr) {
|        throw (New-Object System.IO.InvalidDataException(("The data collection rule '{0}' does not exist in resource group '{1}' after the table and rule update, so nothing is posted to {2}_CL." -f $DcrName, $st.ResourceGroup, $t)))
|    }
|    $auth = Resolve-SILogIngestAuth -Bound $b
|    $readTable = { try { Get-SILogTableRest -WorkspaceResourceId $WorkspaceResourceId -TableName $t -Auth $auth -NoCache } catch { $null } }
|    $table = & $readTable
|    $gap = Get-SILogDcrCoverageGap -Dcr $st.Dcr -TableName $t -Columns $cols -Table $table
|    if (-not @($gap.Missing).Count) { $res.Verdict = 'covered'; return $res }
|    if (@($gap.InTable).Count) {
|        Write-Host (" [WARN] the data collection rule '{0}' does not declare {1} column(s) of {2}_CL that this data carries ({3}) -- Azure would drop their values. Adding them to the rule from the table." -f `
|            $DcrName, @($gap.InTable).Count, $t, ((@($gap.InTable) | Select-Object -First 12) -join ', ')) -ForegroundColor Yellow
|        $null = Set-SILogDcrRest -SchemaSourceObject @(@($gap.InTable) | ForEach-Object { @{ name = [string]$_; type = 'string' } }) -AzLogWorkspaceResourceId $WorkspaceResourceId `
|                    -DceName $DceName -DcrResourceGroup ([string]$st.ResourceGroup) -DcrName $DcrName -TableName $t @b
|        $res.Added = @($gap.InTable)
|        $st = Get-SILogDcrState -DcrName $DcrName -DcrResourceGroup $DcrResourceGroup -WorkspaceResourceId $WorkspaceResourceId -Bound $b
|        $gap = Get-SILogDcrCoverageGap -Dcr $st.Dcr -TableName $t -Columns $cols -Table $table
|    }
|    $res.Missing = @($gap.Missing)
|    if (@($gap.InTable).Count) {
|        throw (New-Object System.IO.InvalidDataException(("The data collection rule '{0}' does not declare {1} column(s) of {2}_CL that this data carries ({3}) and they could not be added to it. Posting through it would store the rows WITHOUT those values, so nothing is posted." -f `
|            $DcrName, @($gap.InTable).Count, $t, ((@($gap.InTable) | Select-Object -First 20) -join ', '))))
|    }
|    if (@($gap.NotInTable).Count) {
|        $msg = ("{0}_CL does not have {1} column(s) this data carries ({2}), so their values are not stored by this run." -f $t, @($gap.NotInTable).Count, ((@($gap.NotInTable) | Select-Object -First 20) -join ', '))
|        Write-Warning $msg
|        Add-SILogIngestNote -Table $t -Columns @($gap.NotInTable) -Message $msg
|        $res.Verdict = 'partial'
|        return $res
|    }
|    $res.Verdict = 'repaired'
|    return $res
|}
|
|# =====================================================================================================================
|#  REST: run cache, HTTP seam, tokens
|# =====================================================================================================================
|
|function Get-SILogIngestRunCache {
|    <# Per-run (per-process) cache: tokens, ARM reads, DCR ids. Global because this file is dot-sourced at different
|       depths by different engines, and `$script:` would then be a different scope per caller. #>
|    if (-not ($global:SI_LogIngestRunCache -is [hashtable])) {
|        $global:SI_LogIngestRunCache = @{ Tokens = @{}; Arm = @{}; DcrIds = @{} }
|    }
|    return $global:SI_LogIngestRunCache
|}
|
|function Reset-SILogIngestArmCache {
|    <# After any create/update: the next read must see what was just written. #>
|    $c = Get-SILogIngestRunCache
|    $c.Arm = @{}
|}
|
|function Invoke-SILogIngestHttp {
|    <#
|        THE ONE HTTP SEAM. Every REST call in this file goes through here (tests Mock it). Never throws on an HTTP status:
|        returns @{ StatusCode; Content; RetryAfter }. A network failure (no response at all) is StatusCode 0.
|        HttpWebRequest, not Invoke-WebRequest: its error shape is the same on PS 5.1 and pwsh 7, so the body of a 4xx
|        and the Retry-After of a 429 are read the same way on both.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$Method,
|        [Parameter(Mandatory)][string]$Uri,
|        [hashtable]$Headers,
|        $Body,
|        [string]$ContentType,
|        [int]$TimeoutSec = 300
|    )
|    if ($PSVersionTable.PSEdition -ne 'Core') {
|        # Windows PowerShell 5.1 on an older .NET Framework may not offer TLS 1.2 by default; Azure requires it.
|        [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
|    }
|    $req = [System.Net.HttpWebRequest]::Create($Uri)
|    $req.Method = $Method.ToUpperInvariant()
|    $req.Timeout = $TimeoutSec * 1000
|    $req.ReadWriteTimeout = $TimeoutSec * 1000
|    $req.Accept = 'application/json'
|    if ($Headers) {
|        foreach ($k in $Headers.Keys) {
|            if ($k -eq 'Content-Type') { $req.ContentType = [string]$Headers[$k] }
|            elseif ($k -eq 'Accept')   { $req.Accept = [string]$Headers[$k] }
|            else { $req.Headers[$k] = [string]$Headers[$k] }
|        }
|    }
|    if ($ContentType) { $req.ContentType = $ContentType }
|    if ($null -ne $Body) {
|        # statements, never `= if (...) { $Body }`: an if-expression enumerates a byte array into object[]
|        [byte[]]$bytes = $null
|        if ($Body -is [byte[]]) { $bytes = $Body } else { $bytes = [System.Text.Encoding]::UTF8.GetBytes([string]$Body) }
|        $req.ContentLength = $bytes.Length
|        $s = $req.GetRequestStream()
|        try { $s.Write($bytes, 0, $bytes.Length) } finally { $s.Close() }
|    } elseif ($req.Method -in 'POST', 'PUT', 'PATCH') {
|        $req.ContentLength = 0
|    }
|    $resp = $null
|    try { $resp = $req.GetResponse() }
|    catch {
|        $we = $_.Exception
|        while ($we -and -not ($we -is [System.Net.WebException])) { $we = $we.InnerException }
|        if ($we -and $we.Response) {
|            $resp = $we.Response
|            # An HTTP status is an answer returned to the caller, not an error of this process: take the caught record
|            # back out of $Error (setup shows every new entry -- each probe printed "(404) Not Found", 2026-10-06).
|            if ($global:Error.Count -gt 0 -and [object]::ReferenceEquals($global:Error[0], $_)) { $global:Error.RemoveAt(0) }
|        }
|        else { return [pscustomobject]@{ StatusCode = 0; Content = [string]$_.Exception.Message; RetryAfter = $null } }
|    }
|    try {
|        $text = ''
|        $rs = $resp.GetResponseStream()
|        if ($rs) { $sr = New-Object System.IO.StreamReader($rs); try { $text = $sr.ReadToEnd() } finally { $sr.Close() } }
|        return [pscustomobject]@{ StatusCode = [int]$resp.StatusCode; Content = $text; RetryAfter = [string]$resp.Headers['Retry-After'] }
|    } finally { $resp.Close() }
|}
|
|function Initialize-SILogIngestAuthHelpers {
|    <# The managed-identity and certificate token helpers live in auth/. Loaded on first need, never at file load. #>
|    # Only what is MISSING is loaded, and only that is published to the global scope (it was dot-sourced inside this
|    # function, so it would vanish on return). Something already visible -- the engine's own copy, a test's mock -- is
|    # never replaced.
|    $authDir = Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'auth'
|    # The managed-identity helper is NOT loaded here: the run's entry point loads it (the launcher config on a VM / Arc
|    # server, the container entry in a job) -- an engine never does (SIv3-ContainerIdentity). Get-SILogIngestToken
|    # says so when it is missing.
|    $want = @(
|        @{ File = 'Find-SICertificate.ps1'; Fns = @('Get-SICertificateClientToken', 'Get-SICertificateFromStore', 'Test-SICertDriveAvailable') }
|    )
|    foreach ($w in $want) {
|        $missing = @($w.Fns | Where-Object { -not (Get-Command -Name $_ -ErrorAction Ignore) })
|        if ($missing.Count -eq 0) { continue }
|        $p = Join-Path $authDir $w.File
|        if (-not (Test-Path -LiteralPath $p)) { continue }
|        . $p
|        foreach ($n in $missing) {
|            $f = Get-Command -Name $n -CommandType Function -ErrorAction Ignore
|            if ($f) { Set-Item -Path ("function:global:{0}" -f $n) -Value $f.ScriptBlock }
|        }
|    }
|}
|
|function Resolve-SILogIngestAuth {
|    <#
|        The sign-in the call site handed over (the same splat AzLogDcrIngestPS takes), as one decision:
|          ManagedIdentity -- UseManagedIdentity = $true
|          Certificate     -- AzAppId + AzAppCertificateThumbprint + TenantId
|          Secret          -- AzAppId + AzAppSecret + TenantId
|          then the run's own decision: $global:SI_UseManagedIdentity (#222) -> ManagedIdentity, else the run's own
|          sign-in (Resolve-SIAzRestAuth: what Connect-SIAzAccount recorded, else the configured identity).
|        Same precedence as the module: managed identity, then certificate, then secret.
|    #>
|    param($Bound = @{})   # a hashtable or $PSBoundParameters
|    if ($null -eq $Bound) { $Bound = @{} }
|    $g = { param($k) if ($Bound.ContainsKey($k)) { $Bound[$k] } else { $null } }
|    $mi = & $g 'UseManagedIdentity'
|    if ($null -eq $mi -and $null -ne (Get-Variable -Scope Global -Name UseManagedIdentityDefault -ValueOnly -ErrorAction Ignore)) { $mi = (Get-Variable -Scope Global -Name UseManagedIdentityDefault -ValueOnly -ErrorAction Ignore) }
|    $app = [string](& $g 'AzAppId'); $tid = [string](& $g 'TenantId')
|    $thumb = [string](& $g 'AzAppCertificateThumbprint'); $sec = [string](& $g 'AzAppSecret')
|    if ([bool]$mi) {
|        $cid = [string](& $g 'ManagedIdentityClientId'); if (-not $cid) { $cid = [string](Get-Variable -Scope Global -Name SI_UAMI_ClientId -ValueOnly -ErrorAction Ignore) }
|        return @{ Mode = 'ManagedIdentity'; ClientId = $cid }
|    }
|    if ($app -and $thumb -and $tid) { return @{ Mode = 'Certificate'; AppId = $app; TenantId = $tid; Thumbprint = ($thumb -replace '\s', '') } }
|    if ($app -and $sec -and $tid)   { return @{ Mode = 'Secret'; AppId = $app; TenantId = $tid; Secret = $sec } }
|    if ((Get-Variable -Scope Global -Name SI_UseManagedIdentity -ValueOnly -ErrorAction Ignore) -eq $true) { return @{ Mode = 'ManagedIdentity'; ClientId = [string](Get-Variable -Scope Global -Name SI_UAMI_ClientId -ValueOnly -ErrorAction Ignore) } }
|    return @{ Mode = 'Run' }
|}
|
|function Get-SILogIngestToken {
|    <#
|        A bearer token for -Resource (https://monitor.azure.com/ for ingestion, https://management.azure.com/ for ARM),
|        as the identity -Auth (Resolve-SILogIngestAuth) names:
|          ManagedIdentity -- Get-SIManagedIdentityToken (container / Azure VM / Azure Arc endpoint; its own cache)
|          Certificate     -- Get-SICertificateClientToken (JWT client assertion signed from the X509Store; no Cert: drive)
|          Secret          -- client_credentials with the secret
|          Support         -- the Invardia support session's Get-InvardiaSupportToken (#524; SI-AzRest.ps1 Get-SISupportToken)
|          Run             -- the run's own sign-in (Resolve-SIAzRestAuth, over REST; #524: never an Azure session)
|        Cached per identity + resource until 5 minutes before expiry.
|    #>
|    param([Parameter(Mandatory)][string]$Resource, [hashtable]$Auth, [switch]$ForceRefresh)
|    # the supported token hook (see SI-AzRest.ps1): consulted first when set and no explicit sign-in was handed over
|    if (-not $Auth) {
|        $tp = Get-Variable -Scope Global -Name SI_TokenProvider -ValueOnly -ErrorAction Ignore
|        if ($tp -is [scriptblock]) { $pt = [string](& $tp $Resource); if (-not [string]::IsNullOrWhiteSpace($pt)) { return $pt } }
|        $Auth = Resolve-SILogIngestAuth
|    }
|    $res = $Resource.TrimEnd('/') + '/'
|    # #524: the Invardia support session's tokens (Resolve-SIAzRestAuth's Mode 'Support') -- Invardia caches them; the
|    # tenant of each is checked against the one SI works in
|    if ($Auth.Mode -eq 'Support') { return (Get-SISupportToken -Resource $res -TenantId ([string]$Auth.TenantId) -ForceRefresh:$ForceRefresh) }
|    $cache = (Get-SILogIngestRunCache).Tokens
|    $who = switch ($Auth.Mode) { 'Certificate' { $Auth.AppId } 'Secret' { $Auth.AppId } 'ManagedIdentity' { $Auth.ClientId } default { '' } }
|    $key = '{0}|{1}|{2}' -f $Auth.Mode, $who, $res
|    if (-not $ForceRefresh -and $cache.ContainsKey($key) -and $cache[$key].ExpiresAt -gt [datetime]::UtcNow) { return $cache[$key].Token }
|
|    $token = $null; $expiresAt = [datetime]::UtcNow.AddMinutes(45)
|    # A TRANSIENT failure of the token endpoint (the managed-identity endpoint of a container, Entra) is waited out and asked
|    # again, a bounded number of times -- Microsoft's errors (Get-SITransientKind: throttled / timeout / unavailable). Any
|    # other answer (a refused sign-in, a missing certificate) fails at once, as before. The sweep of 2026-10-22: one
|    # IDENTITY_ENDPOINT blip threw through every helper's retry and failed the run.
|    if (-not (Get-Command -Name Get-SITransientKind -ErrorAction Ignore)) { . (Join-Path $PSScriptRoot 'SI-ErrorClass.ps1') }
|    $tokenAttempts = 4
|    for ($tokenTry = 1; $tokenTry -le $tokenAttempts; $tokenTry++) {
|    try {
|    switch ($Auth.Mode) {
|        'ManagedIdentity' {
|            if (-not (Get-Command -Name Get-SIManagedIdentityToken -ErrorAction Ignore)) {
|                throw 'Sign-in as a managed identity was asked for, but the managed-identity sign-in helper is not loaded in this run (its entry point loads it: the launcher configuration or the container entry).'
|            }
|            $token = Get-SIManagedIdentityToken -Resource $res -ClientId ([string]$Auth.ClientId) -ForceRefresh:$ForceRefresh
|        }
|        'Certificate' {
|            Initialize-SILogIngestAuthHelpers
|            $token = Get-SICertificateClientToken -TenantId $Auth.TenantId -ClientId $Auth.AppId -Thumbprint $Auth.Thumbprint -Resource $res
|        }
|        'Secret' {
|            $body = 'client_id={0}&scope={1}&client_secret={2}&grant_type=client_credentials' -f `
|                [uri]::EscapeDataString($Auth.AppId), [uri]::EscapeDataString($res.TrimEnd('/') + '/.default'), [uri]::EscapeDataString($Auth.Secret)
|            $r = Invoke-SILogIngestHttp -Method POST -Uri ('https://login.microsoftonline.com/{0}/oauth2/v2.0/token' -f $Auth.TenantId) `
|                     -Body $body -ContentType 'application/x-www-form-urlencoded'
|            if ([int]$r.StatusCode -lt 200 -or [int]$r.StatusCode -ge 300) {
|                throw ("Sign-in with the client secret failed for {0}. HTTP Status: {1} Response: {2}" -f $res, $r.StatusCode, $r.Content)
|            }
|            $j = $r.Content | ConvertFrom-Json
|            $token = [string]$j.access_token
|            $secs = 0
|            if ([int]::TryParse([string]$j.expires_in, [ref]$secs) -and $secs -gt 600) { $expiresAt = [datetime]::UtcNow.AddSeconds($secs - 300) }
|        }
|        default {
|            $t = Get-SIAzAccessToken -ResourceUrl $res -ErrorAction Stop
|            $token = if ($t.Token -is [System.Security.SecureString]) { [System.Net.NetworkCredential]::new('', $t.Token).Password } else { [string]$t.Token }
|            try { if ($t.ExpiresOn) { $e = ([DateTimeOffset]$t.ExpiresOn).UtcDateTime.AddMinutes(-5); if ($e -lt $expiresAt) { $expiresAt = $e } } } catch { }
|        }
|    }
|    break
|    } catch {
|        $kind = Get-SITransientKind -Message ([string]$_.Exception.Message)
|        if ($kind -eq 'error' -or $tokenTry -ge $tokenAttempts) { throw }
|        $wait = Get-SILogIngestRetryDelay -RetryAfter '' -Attempt $tokenTry
|        Write-Verbose ("The token for {0} ({1} sign-in) was not issued ({2}: {3}) -- asked again in {4} s ({5}/{6})." -f $res, $Auth.Mode, $kind, $_.Exception.Message, $wait, $tokenTry, $tokenAttempts)
|        Start-Sleep -Seconds $wait
|    }
|    }
|    if ([string]::IsNullOrWhiteSpace($token)) { throw ("No access token for {0} ({1} sign-in)." -f $res, $Auth.Mode) }
|    $cache[$key] = @{ Token = $token; ExpiresAt = $expiresAt }
|    return $token
|}
|
|function Get-SILogIngestRetryDelay {
|    <# Seconds to wait before retry -Attempt: the server's Retry-After (seconds or an HTTP date) when it sent one,
|       else exponential (2, 4, 8 ... capped at 60). Never more than 10 minutes: a wait the server asks for had no upper
|       limit, and a run that waits says nothing meanwhile (the retry after it either works or is the answer). #>
|    param([string]$RetryAfter, [int]$Attempt)
|    $s = 0
|    if ($RetryAfter) {
|        if ([int]::TryParse($RetryAfter.Trim(), [ref]$s)) { return [Math]::Min(600, [Math]::Max(1, $s)) }
|        $d = [datetime]::MinValue
|        if ([datetime]::TryParse($RetryAfter, [System.Globalization.CultureInfo]::InvariantCulture, [System.Globalization.DateTimeStyles]::AdjustToUniversal, [ref]$d)) {
|            return [int][Math]::Min(600, [Math]::Max(1, [Math]::Ceiling(($d - [datetime]::UtcNow).TotalSeconds)))
|        }
|    }
|    return [int][Math]::Min(60, [Math]::Pow(2, $Attempt))
|}
|
|function Invoke-SILogIngestRequest {
|    <#
|        One authenticated REST call with the retry rule (CLAUDE.md working rule 4):
|          429 / 408 / 5xx / no response -> PLATFORM: wait (Retry-After when sent) and retry in-run
|          401 once                      -> the token is refreshed and the call repeated once
|          404 with -AllowNotFound       -> $null (a lookup that found nothing)
|          any other 4xx                 -> FAIL FAST, the response body in the error: re-sending an invalid request
|                                           burns time and fails identically
|        Returns the response object (StatusCode / Content).
|    #>
|    param(
|        [string]$Method = 'GET',
|        [Parameter(Mandatory)][string]$Uri,
|        $Body,
|        [string]$ContentType = 'application/json',
|        [hashtable]$Headers,
|        [string]$Resource = 'https://management.azure.com/',
|        [hashtable]$Auth,
|        [switch]$AllowNotFound,
|        [int]$MaxAttempts = 6,
|        [string]$What = 'Azure Resource Manager request'
|    )
|    $refreshed = $false; $forceNext = $false
|    for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
|        $token = Get-SILogIngestToken -Resource $Resource -Auth $Auth -ForceRefresh:$forceNext
|        $forceNext = $false
|        $h = @{ 'Authorization' = ('Bearer ' + $token) }
|        if ($Headers) { foreach ($k in $Headers.Keys) { $h[$k] = $Headers[$k] } }
|        $r = Invoke-SILogIngestHttp -Method $Method -Uri $Uri -Headers $h -Body $Body -ContentType $ContentType
|        $code = [int]$r.StatusCode
|        if ($code -ge 200 -and $code -lt 300) { return $r }
|        if ($code -eq 404 -and $AllowNotFound) { return $null }
|        if ($code -eq 401 -and -not $refreshed) { $refreshed = $true; $forceNext = $true; continue }
|        $transient = ($code -eq 0 -or $code -eq 408 -or $code -eq 429 -or $code -ge 500)
|        if ($transient -and $attempt -lt $MaxAttempts) {
|            $wait = Get-SILogIngestRetryDelay -RetryAfter ([string]$r.RetryAfter) -Attempt $attempt
|            Write-Verbose ("{0}: HTTP {1}, retrying in {2}s (attempt {3}/{4})" -f $What, $code, $wait, $attempt, $MaxAttempts)
|            # SAID, not only in the verbose stream (which the publish path switches off): a call that got no answer can
|            # have taken 5 minutes already, and six of them in a row were half an hour without one line in the run log
|            if ($code -eq 0 -or $wait -ge 30) {
|                Write-Host (" [INFO] {0}: {1} -- trying again in {2} second(s) (attempt {3} of {4})" -f $What, $(if ($code -eq 0) { 'no answer from Azure' } else { 'Azure answered HTTP {0}' -f $code }), $wait, $attempt, $MaxAttempts)
|            }
|            Start-Sleep -Seconds $wait
|            continue
|        }
|        throw ("{0} failed. HTTP Status: {1} Response: {2}" -f $What, $code, $r.Content)
|    }
|    throw ("{0} failed after {1} attempts." -f $What, $MaxAttempts)
|}
|
|# =====================================================================================================================
|#  REST: ARM reads/writes, scoped lookups
|# =====================================================================================================================
|
|function Get-SILogArmApiVersion {
|    <# ARM api-versions this file uses (a function, not a variable: the file is dot-sourced at different depths). #>
|    param([Parameter(Mandatory)][ValidateSet('Dce', 'Dcr', 'Table', 'Role')][string]$Kind)
|    switch ($Kind) { 'Dce' { '2022-06-01' } 'Dcr' { '2022-06-01' } 'Table' { '2022-10-01' } 'Role' { '2022-04-01' } }
|}
|
|function Invoke-SILogArm {
|    <# ARM call -> parsed JSON (or $null for a 404 with -AllowNotFound). GETs are cached per run; any write clears it. #>
|    param([string]$Method = 'GET', [Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$ApiVersion, $Body, [hashtable]$Auth, [switch]$AllowNotFound, [switch]$NoCache)
|    $uri = if ($Path -match '^https://') { $Path } else { 'https://management.azure.com' + $Path + $(if ($Path -match '\?') { '&' } else { '?' }) + 'api-version=' + $ApiVersion }
|    $cache = (Get-SILogIngestRunCache).Arm
|    if ($Method -eq 'GET' -and -not $NoCache -and $cache.ContainsKey($uri)) { return $cache[$uri] }
|    $json = if ($null -ne $Body -and -not ($Body -is [string])) { $Body | ConvertTo-Json -Depth 50 -Compress } else { $Body }
|    $r = Invoke-SILogIngestRequest -Method $Method -Uri $uri -Body $json -Auth $Auth -AllowNotFound:$AllowNotFound -What ('Azure Resource Manager {0} {1}' -f $Method, ($uri -replace '\?.*$', ''))
|    $obj = $null
|    if ($r -and -not [string]::IsNullOrWhiteSpace([string]$r.Content)) { $obj = $r.Content | ConvertFrom-Json }
|    if ($Method -eq 'GET') { if (-not $NoCache) { $cache[$uri] = $obj } } else { Reset-SILogIngestArmCache }
|    return $obj
|}
|
|function Get-SILogArmList {
|    <# Every item of an ARM list, following nextLink. #>
|    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$ApiVersion, [hashtable]$Auth)
|    $items = New-Object 'System.Collections.Generic.List[object]'
|    $page = Invoke-SILogArm -Path $Path -ApiVersion $ApiVersion -Auth $Auth
|    while ($page) {
|        foreach ($v in @($page.value)) { if ($null -ne $v) { [void]$items.Add($v) } }
|        if ([string]::IsNullOrWhiteSpace([string]$page.nextLink)) { break }
|        $page = Invoke-SILogArm -Path ([string]$page.nextLink) -ApiVersion $ApiVersion -Auth $Auth
|    }
|    foreach ($i in $items) {
|        # the Resource Graph shape callers already read (subscriptionId / resourceGroup) -- ARM omits them
|        if ([string]$i.id -match '^/subscriptions/([^/]+)/resourceGroups/([^/]+)/') {
|            if (-not $i.PSObject.Properties['subscriptionId']) { $i | Add-Member -NotePropertyName subscriptionId -NotePropertyValue $Matches[1] }
|            if (-not $i.PSObject.Properties['resourceGroup'])  { $i | Add-Member -NotePropertyName resourceGroup -NotePropertyValue $Matches[2] }
|        }
|    }
|    return $items.ToArray()   # enumerated, like the module's list; callers wrap in @()
|}
|
|function Get-SILogIngestScope {
|    <#
|        WHERE this install's endpoint and rules live: subscription + resource groups. Lookups are by NAME within this
|        scope, never tenant-wide -- the same name exists in other environments (measured 2026-10-01: three endpoints
|        named dce-securityinsight in two subscriptions).
|          Subscription  -SubscriptionId, else -WorkspaceResourceId's, else SI_AzSubscriptionId, else SI_WorkspaceResourceId's,
|                        else the 2.2.x SubscriptionId (a new rule is created in the workspace's subscription, as the
|                        module did; SI_AzSubscriptionId is filled from the workspace by Initialize-SIIngestGlobals)
|          DcrRg         -DcrResourceGroup, else SI_DcrResourceGroup
|          DceRg         -DceResourceGroup, else SI_DceResourceGroup, else the DCR resource group
|    #>
|    param([string]$SubscriptionId, [string]$WorkspaceResourceId, [string]$DcrResourceGroup, [string]$DceResourceGroup)
|    $sub = $SubscriptionId
|    if (-not $sub -and $WorkspaceResourceId -match '/subscriptions/([^/]+)/') { $sub = $Matches[1] }
|    if (-not $sub) { $sub = [string]$global:SI_AzSubscriptionId }
|    if (-not $sub -and "$($global:SI_WorkspaceResourceId)" -match '/subscriptions/([^/]+)/') { $sub = $Matches[1] }
|    if (-not $sub) { $sub = [string]$global:SubscriptionId }
|    $dcrRg = if ($DcrResourceGroup) { $DcrResourceGroup } else { [string]$global:SI_DcrResourceGroup }
|    $dceRg = if ($DceResourceGroup) { $DceResourceGroup } elseif ($global:SI_DceResourceGroup) { [string]$global:SI_DceResourceGroup } else { $dcrRg }
|    [pscustomobject]@{ Subscription = $sub; DcrRg = $dcrRg; DceRg = $dceRg }
|}
|
|function Get-SILogScopedList {
|    param([ValidateSet('Dce', 'Dcr')][string]$Kind, [string]$SubscriptionId, [string]$ResourceGroup, [hashtable]$Auth)
|    if ([string]::IsNullOrWhiteSpace($SubscriptionId)) {
|        throw ("No subscription is configured for the data collection {0} lookup (SI_AzSubscriptionId / SI_WorkspaceResourceId). It is never read tenant-wide, because the same name exists in other environments." -f $(if ($Kind -eq 'Dce') { 'endpoint' } else { 'rule' }))
|    }
|    $type = if ($Kind -eq 'Dce') { 'dataCollectionEndpoints' } else { 'dataCollectionRules' }
|    $path = if ($ResourceGroup) { "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroup/providers/Microsoft.Insights/$type" }
|            else { "/subscriptions/$SubscriptionId/providers/Microsoft.Insights/$type" }
|    return (Get-SILogArmList -Path $path -ApiVersion (Get-SILogArmApiVersion $Kind) -Auth $Auth)
|}
|
|function Get-SIDceListRest {
|    <# REST twin of Get-AzDceListAll -- but SCOPED: the configured subscription only (never tenant-wide). Same auth
|       arguments as the module; -SubscriptionId / -ResourceGroup narrow further. #>
|    [CmdletBinding()]
|    param([string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation = 'LocalMachine',
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId, [string]$SubscriptionId, [string]$ResourceGroup)
|    $auth = Resolve-SILogIngestAuth -Bound $PSBoundParameters
|    $scope = Get-SILogIngestScope -SubscriptionId $SubscriptionId
|    return (Get-SILogScopedList -Kind Dce -SubscriptionId $scope.Subscription -ResourceGroup $ResourceGroup -Auth $auth)
|}
|
|function Get-SIDcrListRest {
|    <# REST twin of Get-AzDcrListAll -- scoped to the configured subscription, like Get-SIDceListRest. #>
|    [CmdletBinding()]
|    param([string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation = 'LocalMachine',
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId, [string]$SubscriptionId, [string]$ResourceGroup)
|    $auth = Resolve-SILogIngestAuth -Bound $PSBoundParameters
|    $scope = Get-SILogIngestScope -SubscriptionId $SubscriptionId
|    return (Get-SILogScopedList -Kind Dcr -SubscriptionId $scope.Subscription -ResourceGroup $ResourceGroup -Auth $auth)
|}
|
|function Find-SILogResourceByName {
|    <#
|        A DCR or DCE by NAME in the configured scope:
|          resource group known  -> exactly that resource (GET by its id); nothing else is considered
|          resource group absent -> the subscription's list; one match is used, several refuse (the name is ambiguous)
|        -AnyResourceGroupWhenMissing (endpoints only): not in the resource group, but exactly ONE of that name in the
|        subscription -> that one (an endpoint outside the rules' resource group has always worked); several refuse.
|        Returns $null when there is none.
|    #>
|    param([ValidateSet('Dce', 'Dcr')][string]$Kind, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId, [string]$ResourceGroup, [hashtable]$Auth, [switch]$AnyResourceGroupWhenMissing)
|    $label = if ($Kind -eq 'Dce') { 'data collection endpoint' } else { 'data collection rule' }
|    if ([string]::IsNullOrWhiteSpace($SubscriptionId)) { throw ("No subscription is configured to look up {0} '{1}' in (SI_AzSubscriptionId / SI_WorkspaceResourceId)." -f $label, $Name) }
|    $type = if ($Kind -eq 'Dce') { 'dataCollectionEndpoints' } else { 'dataCollectionRules' }
|    if ($ResourceGroup) {
|        $hit = Invoke-SILogArm -Path "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroup/providers/Microsoft.Insights/$type/$Name" -ApiVersion (Get-SILogArmApiVersion $Kind) -Auth $Auth -AllowNotFound
|        if ($hit -or -not $AnyResourceGroupWhenMissing) { return $hit }
|    }
|    $same = @(Get-SILogScopedList -Kind $Kind -SubscriptionId $SubscriptionId -Auth $Auth | Where-Object { $_ -and $_.name -eq $Name })
|    if ($same.Count -eq 1) { return $same[0] }
|    if ($same.Count -gt 1) {
|        throw ("{0} '{1}' exists {2} times in subscription '{3}'{4}, so nothing was posted -- set the resource group this install uses ({5})." -f `
|            $label, $Name, $same.Count, $SubscriptionId, $(if ($ResourceGroup) { " (none in resource group '$ResourceGroup')" } else { '' }),
|            $(if ($Kind -eq 'Dce') { 'SI_DceResourceGroup' } else { 'SI_DcrResourceGroup' }))
|    }
|    return $null
|}
|
|# =====================================================================================================================
|#  REST: data shape -- exact twins of the module's pre-processing (so 'Rest' declares and posts the same columns)
|# =====================================================================================================================
|
|function Add-SICollectionTimeRest {
|    <#
|        CollectionTime on every row, IDENTICAL across all shards and batches of one run:
|          * a row that already carries a CollectionTime keeps it -- the engines stamp the run's own value upstream
|            ($RunContext.CollectionTime / $global:RA_CollectionTime), and that is the value every shard shares;
|          * a row without one gets this process's run value, minted once and reused by every later call.
|        Same value format as the module ([datetime] from "yyyy-MM-ddTHH:mm:ssK", UTC).
|        DIFFERS FROM THE MODULE ON PURPOSE: Add-CollectionTimeToAllEntriesInArray overwrites every row with the time
|        of THAT call, so a "safety net" call after the upstream stamp replaced the shared run value.
|    #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][Array]$Data)
|    if (-not ($global:SI_LogIngestRunCollectionTime -is [datetime])) {
|        [datetime]$ct = (Get-Date ([datetime]::Now.ToUniversalTime()) -Format 'yyyy-MM-ddTHH:mm:ssK')
|        $global:SI_LogIngestRunCollectionTime = $ct
|    }
|    $out = New-Object 'System.Collections.Generic.List[object]'
|    foreach ($e in $Data) {
|        $p = $e.PSObject.Properties['CollectionTime']
|        if (-not $p -or $null -eq $p.Value -or [string]::IsNullOrWhiteSpace([string]$p.Value)) {
|            $e | Add-Member -MemberType NoteProperty -Name CollectionTime -Value $global:SI_LogIngestRunCollectionTime -Force | Out-Null
|        }
|        [void]$out.Add($e)
|    }
|    return [array]$out.ToArray()
|}
|
|function Add-SIColumnDataRest {
|    <# Twin of Add-ColumnDataToAllEntriesInArray: up to three columns with one value each, on every row. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][Array]$Data, [Parameter(Mandatory)][string]$Column1Name, [Parameter(Mandatory)][AllowEmptyString()][string]$Column1Data,
|          [string]$Column2Name, [string]$Column2Data, [string]$Column3Name, [string]$Column3Data)
|    $out = New-Object 'System.Collections.Generic.List[object]'
|    foreach ($e in $Data) {
|        if ($Column1Name) { $e | Add-Member -MemberType NoteProperty -Name $Column1Name -Value $Column1Data -Force }
|        if ($Column2Name) { $e | Add-Member -MemberType NoteProperty -Name $Column2Name -Value $Column2Data -Force }
|        if ($Column3Name) { $e | Add-Member -MemberType NoteProperty -Name $Column3Name -Value $Column3Data -Force }
|        [void]$out.Add($e)
|    }
|    return [array]$out.ToArray()
|}
|
|function Repair-SILogColumnNameRest {
|    <# Twin of ValidateFix-AzLogAnalyticsTableSchemaColumnNames (1.7.x): prohibited names get '_', ':' '-' '.' are
|       removed, leading '_' trimmed, leading whitespace trimmed, >45 characters cut; renamed columns move to the end
|       of the row with their own values. Rows are rebuilt only when a name needs fixing. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][Array]$Data)
|    $prohibited = @('_ResourceId', 'id', '_ResourceId', '_SubscriptionId', 'TenantId', 'Type', 'UniqueId', 'Title', 'Date')
|    $checked = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $rename = @{}
|    foreach ($e in $Data) {
|        foreach ($p in $e.PSObject.Properties) {
|            $n = $p.Name
|            if (-not $checked.Add($n)) { continue }
|            if ($n -in $prohibited)     { $rename[$n] = $n + '_' }
|            elseif ($n -like '*:*')     { $rename[$n] = $n.Replace(':', '') }
|            elseif ($n -like '*-*')     { $rename[$n] = $n.Replace('-', '') }
|            elseif ($n -like '*.*')     { $rename[$n] = $n.Replace('.', '') }
|            elseif ($n -like '_*')      { $rename[$n] = $n.TrimStart('_') }
|            elseif ($n -like '* *')     { $rename[$n] = $n.TrimStart() }
|            elseif ($n.Length -gt 45)   { $rename[$n] = $n.Substring(0, 45) }
|        }
|    }
|    if ($rename.Count -eq 0) { return [array]$Data }
|    # #639: only a row that CARRIES a name to fix is rebuilt (a copy of that row); every other row is passed on as it is --
|    # never a copy of the whole post. (Not in place: the caller may still read the row by its own names.)
|    $out = New-Object 'System.Collections.Generic.List[object]'
|    foreach ($row in $Data) {
|        $needs = $false
|        foreach ($p in $row.PSObject.Properties) { if ($rename.ContainsKey($p.Name)) { $needs = $true; break } }
|        if (-not $needs) { [void]$out.Add($row); continue }
|        $rebuilt = [ordered]@{}
|        $moved = New-Object 'System.Collections.Generic.List[object]'
|        foreach ($p in $row.PSObject.Properties) {
|            if ($rename.ContainsKey($p.Name)) { [void]$moved.Add($p) } else { $rebuilt[$p.Name] = $p.Value }
|        }
|        foreach ($p in $moved) { $rebuilt[[string]$rename[$p.Name]] = $p.Value }
|        [void]$out.Add([pscustomobject]$rebuilt)
|    }
|    return [array]$out.ToArray()
|}
|
|function Get-SILogSchemaRest {
|    <#
|        Twin of Get-ObjectSchemaAsArray (-As Array) and Get-ObjectSchemaAsHash (-As Hash): the column list of the
|        WHOLE set, each column's type from the first row that carries it, read the way the module reads it -- the row
|        is round-tripped through JSON and the type taken from Get-Member's definition:
|            int* / real* -> int    long* -> long    guid* -> dynamic    string* -> string    datetime* -> datetime
|            bool* -> boolean       object* / PSCustomObject -> dynamic
|        DIFFERENCES FROM THE MODULE (2026-10-11, both made Log Analytics discard values):
|          * a fractional number is `real` -- the module matched none of its patterns and INHERITED the type of the column
|            read just before it (alphabetically), which is how LastSignInDays became datetime;
|          * an empty (null) value does not decide the type: the first row with a value does, 'dynamic' if none has one.
|        KNOWN TRAP KEPT:
|          * 'int' vs 'long' follows the value's size in the first row that has the column.
|        -ReturnType Table adds TimeGenerated (datetime) first and a description per column; DCR (the default for Array)
|        has name + type only. -As Hash returns hashtables and, like the module, nothing without -ReturnType.
|    #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][Array]$Data, [ValidateSet('Array', 'Hash')][string]$As = 'Array', [ValidateSet('Table', 'DCR')][string[]]$ReturnType)
|    $table = New-Object 'System.Collections.Generic.List[object]'
|    $dcr   = New-Object 'System.Collections.Generic.List[object]'
|    $seen  = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    [void]$seen.Add('TimeGenerated')
|    # the module's shapes: Array -> PSCustomObject, Hash -> plain hashtable
|    $mk = { param($n, $t, [switch]$Desc)
|        if ($As -eq 'Hash') { if ($Desc) { @{ name = $n; type = $t; description = '' } } else { @{ name = $n; type = $t } } }
|        elseif ($Desc) { [pscustomobject]@{ name = $n; type = $t; description = '' } }
|        else { [pscustomobject]@{ name = $n; type = $t } }
|    }
|    [void]$table.Add((& $mk 'TimeGenerated' 'datetime' -Desc))
|    # columns seen so far only EMPTY (null): typed from the first row that has a value, 'dynamic' when none has
|    $nullOnly = New-Object 'System.Collections.Generic.List[string]'
|    $nullSet  = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($entry in $Data) {
|        $hasNew = $false
|        foreach ($p in $entry.PSObject.Properties) { if (-not $seen.Contains($p.Name) -and ($null -ne $p.Value -or -not $nullSet.Contains($p.Name))) { $hasNew = $true; break } }
|        if (-not $hasNew) { continue }
|        $cols = $entry | ConvertTo-Json -Depth 100 | ConvertFrom-Json | Get-Member -MemberType NoteProperty
|        foreach ($c in $cols) {
|            if ($seen.Contains($c.Name)) { continue }
|            $d = [string]$c.Definition
|            # ring 1, 2026-10-11 -- THE TYPE IS DECIDED PER COLUMN, NEVER INHERITED. The module's mapping kept the previous
|            # column's type for a definition it did not know (a double), and Get-Member lists the columns alphabetically,
|            # so LastSignInDays (a double) was declared after LastSignInDateTime: datetime -- and every value of it was then
|            # discarded by Log Analytics. A fractional number is `real`; an empty value waits for a row that has one.
|            $objType = $null
|            if ($d -match '^(?i)(System\.)?Object\s') {   # a null value round-trips as "object <name>=null"
|                if ($nullSet.Add($c.Name)) { [void]$nullOnly.Add($c.Name) }
|                continue
|            }
|            if     ($d -like 'int*')      { $objType = 'int' }
|            elseif ($d -like 'real*')     { $objType = 'int' }
|            elseif ($d -like 'long*')     { $objType = 'long' }
|            elseif ($d -like 'double*' -or $d -like 'decimal*' -or $d -like 'float*' -or $d -like 'single*') { $objType = 'real' }
|            elseif ($d -like 'guid*')     { $objType = 'dynamic' }
|            elseif ($d -like 'string*')   { $objType = 'string' }
|            elseif ($d -like 'datetime*') { $objType = 'datetime' }
|            elseif ($d -like 'bool*')     { $objType = 'boolean' }
|            elseif ($d -like 'object*')   { $objType = 'dynamic' }
|            elseif ($d -like 'System.Management.Automation.PSCustomObject*') { $objType = 'dynamic' }
|            else { $objType = 'dynamic' }
|            [void]$seen.Add($c.Name)
|            [void]$table.Add((& $mk $c.Name $objType -Desc))
|            [void]$dcr.Add((& $mk $c.Name $objType))
|        }
|    }
|    foreach ($n in $nullOnly) {
|        if ($seen.Contains($n)) { continue }
|        [void]$seen.Add($n)
|        [void]$table.Add((& $mk $n 'dynamic' -Desc))
|        [void]$dcr.Add((& $mk $n 'dynamic'))
|    }
|    if ($ReturnType -eq 'Table') { return $table.ToArray() }
|    if ($ReturnType -eq 'DCR' -or $As -eq 'Array') { return $dcr.ToArray() }
|}
|
|function Format-SILogRowsToSchemaRest {
|    <# Twin of Build-DataArrayToAlignWithSchema (1.7.x): every row gets every schema column (missing = $null), in
|       schema order; a property the schema does not list (a literal TimeGenerated) is kept, after them.
|       #639: IN PLACE, never a padded copy of the whole post. A PSCustomObject row is aligned on itself (its properties
|       re-ordered, the missing ones added as $null) -- the same row, the same JSON as the copy made before; a row of another
|       kind (a hashtable, a compact .NET row) is replaced in the array by its aligned copy, one row at a time. The post
|       then serialises a batch at a time (Send-SILogDataRest), so nothing of the post is ever held twice. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][Array]$Data)
|    $schema = Get-SILogSchemaRest -Data $Data -As Array
|    if (@($Data).Count -eq 0) { return $Data }
|    $names = New-Object 'System.Collections.Generic.List[string]'
|    foreach ($c in $schema) { [void]$names.Add([string]$c.name) }
|    $nm = $names.ToArray()
|    for ($i = 0; $i -lt $Data.Count; $i++) { $Data[$i] = Format-SILogRowToNamesInPlace -Row $Data[$i] -Names $nm }
|    return $Data
|}
|
|function Format-SILogRowToNamesInPlace {
|    <# ONE row aligned to -Names (missing = $null, in that order, the other properties after them) -- the row itself when
|       it is a PSCustomObject (its properties re-ordered in place; nothing done when it already is aligned), else its
|       aligned copy (Format-SILogRowsToNames). The JSON of the result equals the JSON of Format-SILogRowsToNames. #>
|    param($Row, [Parameter(Mandatory)][AllowEmptyCollection()][string[]]$Names)
|    if ($null -eq $Row) { return $Row }
|    if ($Row.PSObject.BaseObject -isnot [System.Management.Automation.PSCustomObject]) {
|        return @(Format-SILogRowsToNames -Data @($Row) -Names $Names)[0]
|    }
|    $props = $Row.PSObject.Properties
|    # already aligned: the names first, in order, every one present -- nothing to do
|    $all = @($props)
|    $aligned = ($all.Count -ge $Names.Count)
|    if ($aligned) { for ($k = 0; $k -lt $Names.Count; $k++) { if ($all[$k].Name -cne $Names[$k] -or $all[$k] -isnot [System.Management.Automation.PSNoteProperty]) { $aligned = $false; break } } }
|    if ($aligned) { return $Row }
|    foreach ($p in $all) { if ($p -isnot [System.Management.Automation.PSNoteProperty]) { return @(Format-SILogRowsToNames -Data @($Row) -Names $Names)[0] } }
|    $set = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($n in $Names) { [void]$set.Add($n) }
|    # the values, then the properties rebuilt on the same object: the names in order, then the others as they were
|    $vals = @{}
|    $rest = New-Object 'System.Collections.Generic.List[object]'
|    foreach ($p in $all) {
|        if ($set.Contains($p.Name)) { if (-not $vals.ContainsKey($p.Name)) { $vals[$p.Name] = $p } }
|        else { $rest.Add($p) }
|    }
|    foreach ($p in $all) { $props.Remove($p.Name) }
|    foreach ($n in $Names) {
|        $v = $null; if ($vals.ContainsKey($n)) { $v = $vals[$n].Value }
|        $props.Add([System.Management.Automation.PSNoteProperty]::new($n, $v))
|    }
|    foreach ($p in $rest) { $props.Add([System.Management.Automation.PSNoteProperty]::new($p.Name, $p.Value)) }
|    return $Row
|}
|
|function Format-SILogRowsToNames {
|    <# PURE. Format-SILogRowsToSchemaRest's second half: every row gets every column of -Names (missing = $null), in that
|       order; a property not in -Names is kept, after them. Each row on its own -- the names are the whole set's schema, read
|       before (Risk Analysis prepares the rows of one chunk on several cores with it, #744). #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][Array]$Data, [Parameter(Mandatory)][AllowEmptyCollection()][string[]]$Names)
|    $out = New-Object 'System.Collections.Generic.List[object]'
|    foreach ($row in $Data) {
|        $props = $row.PSObject.Properties
|        $a = [ordered]@{}
|        foreach ($n in $Names) { $p = $props[$n]; if ($null -ne $p) { $a[$n] = $p.Value } else { $a[$n] = $null } }
|        foreach ($p in $props) { if (-not $a.Contains($p.Name)) { $a[$p.Name] = $p.Value } }
|        [void]$out.Add([pscustomobject]$a)
|    }
|    return $out.ToArray()
|}
|
|# =====================================================================================================================
|#  REST: table + DCR create / update -- ADDITIVE only
|# =====================================================================================================================
|
|function Get-SILogStreamName {
|    <# 'Custom-<table>_CL', cut to 52 characters (the stream name limit) -- the module's rule. #>
|    param([Parameter(Mandatory)][string]$TableName)
|    $s = 'Custom-' + $TableName + '_CL'
|    if ($s.Length -gt 52) { $s = $s.Substring(0, 52) }
|    return $s
|}
|
|function Get-SILogTableRest {
|    param([Parameter(Mandatory)][string]$WorkspaceResourceId, [Parameter(Mandatory)][string]$TableName, [hashtable]$Auth, [switch]$NoCache)
|    return (Invoke-SILogArm -Path ($WorkspaceResourceId + '/tables/' + $TableName + '_CL') -ApiVersion (Get-SILogArmApiVersion Table) -Auth $Auth -AllowNotFound -NoCache:$NoCache)
|}
|
|function Resolve-SILogDcrForTable {
|    <# The rule this install posts through: the one recorded this run when it was created/updated, else by name in the
|       configured scope (Find-SILogResourceByName). #>
|    param([Parameter(Mandatory)][string]$DcrName, [string]$SubscriptionId, [string]$ResourceGroup, [hashtable]$Auth)
|    $ids = (Get-SILogIngestRunCache).DcrIds
|    $key = $DcrName.ToLowerInvariant()   # the rule created / updated / found THIS run, wherever the caller put it
|    if ($ids.ContainsKey($key)) {
|        $hit = Invoke-SILogArm -Path $ids[$key] -ApiVersion (Get-SILogArmApiVersion Dcr) -Auth $Auth -AllowNotFound
|        if ($hit) { return $hit }
|    }
|    return (Find-SILogResourceByName -Kind Dcr -Name $DcrName -SubscriptionId $SubscriptionId -ResourceGroup $ResourceGroup -Auth $Auth)
|}
|
|function Test-SILogTableDcrStatusRest {
|    <# Twin of Get-AzLogAnalyticsTableAzDataCollectionRuleStatus: $true when the table or the rule must be created or
|       given columns. The rule is looked up in the configured scope, not by name across the tenant. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$AzLogWorkspaceResourceId, [Parameter(Mandatory)][string]$TableName, [Parameter(Mandatory)][string]$DcrName,
|          [Parameter(Mandatory)][array]$SchemaSourceObject, [string]$DcrResourceGroup,
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation = 'LocalMachine',
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    $auth = Resolve-SILogIngestAuth -Bound $PSBoundParameters
|    $scope = Get-SILogIngestScope -WorkspaceResourceId $AzLogWorkspaceResourceId -DcrResourceGroup $DcrResourceGroup
|    $needs = $false
|    $t = Get-SILogTableRest -WorkspaceResourceId $AzLogWorkspaceResourceId -TableName $TableName -Auth $auth -NoCache
|    $cols = @(); $std = @()
|    if (-not $t) { $needs = $true }
|    else {
|        $cols = @($t.properties.schema.columns); $std = @($t.properties.schema.standardColumns)
|        foreach ($e in $SchemaSourceObject) {
|            if (-not ($cols | Where-Object { $_.name -eq $e.name }) -and -not ($std | Where-Object { $_.name -eq $e.name })) { $needs = $true }
|        }
|    }
|    $dcr = Resolve-SILogDcrForTable -DcrName $DcrName -SubscriptionId $scope.Subscription -ResourceGroup $scope.DcrRg -Auth $auth
|    if (-not $dcr) { return $true }
|    (Get-SILogIngestRunCache).DcrIds[$DcrName.ToLowerInvariant()] = [string]$dcr.id   # the post uses THIS rule
|    $stream = Get-SILogStreamName -TableName $TableName
|    $dcrCols = @()
|    if ($dcr.properties.streamDeclarations -and $dcr.properties.streamDeclarations.PSObject.Properties[$stream]) { $dcrCols = @($dcr.properties.streamDeclarations.$stream.columns) }
|    $tableCols = @($cols | Where-Object { $_.name -ne 'TimeGenerated' })
|    if ($dcrCols.Count -lt $tableCols.Count) { return $true }
|    foreach ($c in $tableCols) { if (-not ($dcrCols | Where-Object { $_.name -eq $c.name })) { $needs = $true } }
|    return $needs
|}
|
|function Set-SILogTableRest {
|    <#
|        Twin of CreateUpdate-AzLogAnalyticsCustomLogTableDcr, ADDITIVE ONLY:
|          no table   -> PUT it with the schema of the data (TimeGenerated + every column)
|          table      -> the columns it does not have yet are added (PATCH: retention and plan are left as they are); an
|                        existing column is never changed or removed, whatever type the data now suggests
|        A refused write FAILS with Azure's answer. The module's fallback -- DELETE the table and re-create it -- is not
|        copied: it discards data.
|        -SchemaSourceObject: the Table-format schema (Get-SILogSchemaRest -ReturnType Table / Get-ObjectSchemaAsHash).
|    #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$TableName, [Parameter(Mandatory)][array]$SchemaSourceObject, [Parameter(Mandatory)][string]$AzLogWorkspaceResourceId,
|          [string]$SchemaMode = 'Merge',
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation = 'LocalMachine',
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    $auth = Resolve-SILogIngestAuth -Bound $PSBoundParameters
|    $table = $TableName + '_CL'
|    if ($table.Length -gt 45) { Write-Error ("ERROR - Reduce length of tablename, as it has a maximum of 45 characters (current length: {0})" -f $table.Length) }
|    $path = $AzLogWorkspaceResourceId + '/tables/' + $table
|    $cur = Get-SILogTableRest -WorkspaceResourceId $AzLogWorkspaceResourceId -TableName $TableName -Auth $auth -NoCache
|    $toCol = { param($c) [ordered]@{ name = [string]$c.name; type = [string]$c.type; description = '' } }
|    if (-not $cur) {
|        $columns = @($SchemaSourceObject | ForEach-Object { & $toCol $_ })
|        $null = Invoke-SILogArm -Method PUT -Path $path -ApiVersion (Get-SILogArmApiVersion Table) -Auth $auth -Body @{ properties = @{ schema = @{ name = $table; columns = $columns } } }
|        Write-Output ("table {0}: created with {1} column(s)" -f $table, $columns.Count)
|        return
|    }
|    $std = @($cur.properties.schema.standardColumns | ForEach-Object { [string]$_.name })
|    $merged = New-Object 'System.Collections.Generic.List[object]'
|    foreach ($c in @($cur.properties.schema.columns)) { if ($c -and ([string]$c.name -notin $std)) { [void]$merged.Add((& $toCol $c)) } }
|    $added = New-Object 'System.Collections.Generic.List[string]'
|    foreach ($s in $SchemaSourceObject) {
|        if ([string]$s.name -in $std) { continue }
|        if (@($merged | Where-Object { $_.name -eq [string]$s.name }).Count) { continue }
|        [void]$merged.Add((& $toCol $s)); [void]$added.Add([string]$s.name)
|    }
|    if ($added.Count -eq 0) { Write-Output ("table {0}: has every column" -f $table); return }
|    $null = Invoke-SILogArm -Method PATCH -Path $path -ApiVersion (Get-SILogArmApiVersion Table) -Auth $auth -Body @{ properties = @{ schema = @{ name = $table; columns = @($merged.ToArray()) } } }
|    Write-Output ("table {0}: {1} column(s) added ({2})" -f $table, $added.Count, ($added -join ', '))
|}
|
|function Resolve-SILogEndpointForNewRule {
|    <# This install's endpoint, for a NEW rule: by name in SI_DceResourceGroup (else the rules' group) of the
|       subscription; one of that name elsewhere in the subscription is unambiguous; several refuse. #>
|    param([Parameter(Mandatory)][string]$DceName, $Scope, [hashtable]$Auth)
|    $dce = Find-SILogResourceByName -Kind Dce -Name $DceName -SubscriptionId $Scope.Subscription -ResourceGroup $Scope.DceRg -Auth $Auth -AnyResourceGroupWhenMissing
|    if (-not $dce) {
|        throw ("Data collection endpoint '{0}' was not found in resource group '{1}' of subscription '{2}', so nothing was created or posted." -f $DceName, $Scope.DceRg, $Scope.Subscription)
|    }
|    return $dce
|}
|
|function Set-SILogDcrRest {
|    <#
|        Twin of CreateUpdate-AzDataCollectionRuleLogIngestCustomLog, ADDITIVE ONLY:
|          no rule -> PUT one in the configured subscription + resource group, bound to THIS install's endpoint, with the
|                     stream declaration (the data's columns), the workspace destination and the default transform
|          rule    -> the columns the table has and the stream does not are ADDED to the stream declaration; everything
|                     else the rule carries (its endpoint, transform, destinations, other streams) is kept as it is. The
|                     module rebuilt the whole rule instead, re-binding it to the endpoint it found by name (#198).
|        A new rule waits 15 seconds for Azure to settle, as the module did.
|    #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][array]$SchemaSourceObject, [Parameter(Mandatory)][string]$AzLogWorkspaceResourceId, [string]$DceName,
|          [Parameter(Mandatory)][string]$DcrResourceGroup, [Parameter(Mandatory)][string]$DcrName, [Parameter(Mandatory)][string]$TableName,
|          [boolean]$AzDcrSetLogIngestApiAppPermissionsDcrLevel = $false, [AllowEmptyString()][string]$LogIngestServicePricipleObjectId, [string]$SchemaMode = 'Merge',
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation = 'LocalMachine',
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    $auth = Resolve-SILogIngestAuth -Bound $PSBoundParameters
|    $scope = Get-SILogIngestScope -WorkspaceResourceId $AzLogWorkspaceResourceId -DcrResourceGroup $DcrResourceGroup
|    $stream = Get-SILogStreamName -TableName $TableName
|    $wsName = ($AzLogWorkspaceResourceId -split '/')[-1]
|    $dcrPath = "/subscriptions/$($scope.Subscription)/resourceGroups/$DcrResourceGroup/providers/Microsoft.Insights/dataCollectionRules/$DcrName"
|    $ids = (Get-SILogIngestRunCache).DcrIds
|    $key = $DcrName.ToLowerInvariant()
|    $dcr = Invoke-SILogArm -Path $dcrPath -ApiVersion (Get-SILogArmApiVersion Dcr) -Auth $auth -AllowNotFound -NoCache
|    $toCol = { param($c) [ordered]@{ name = [string]$c.name; type = [string]$c.type } }
|
|    if (-not $dcr) {
|        $dce = Resolve-SILogEndpointForNewRule -DceName $DceName -Scope $scope -Auth $auth
|        # #294: a new rule for a table that EXISTS declares the table's columns with the TABLE's types (then any column of
|        # the data the table does not have yet). Declared from the data instead, a type that differs from the table's
|        # (a column the data reads as an object, the table holds as text) makes Azure refuse the rule.
|        $tNew = Get-SILogTableRest -WorkspaceResourceId $AzLogWorkspaceResourceId -TableName $TableName -Auth $auth -NoCache
|        $cols = @(Get-SILogNewRuleColumns -Table $tNew -SchemaSourceObject $SchemaSourceObject)
|        $body = [ordered]@{
|            location   = [string]$dce.location
|            properties = [ordered]@{
|                dataCollectionEndpointId = [string]$dce.id
|                streamDeclarations       = @{ $stream = @{ columns = $cols } }
|                destinations             = @{ logAnalytics = @(@{ workspaceResourceId = $AzLogWorkspaceResourceId; name = $wsName }) }
|                dataFlows                = @(@{ streams = @($stream); destinations = @($wsName); transformKql = 'source | extend TimeGenerated = now()'; outputStream = $stream })
|            }
|        }
|        $created = Invoke-SILogArm -Method PUT -Path $dcrPath -ApiVersion (Get-SILogArmApiVersion Dcr) -Auth $auth -Body $body
|        $ids[$key] = $dcrPath
|        Write-Output ("data collection rule {0}: created on endpoint {1} with {2} column(s)" -f $DcrName, $dce.id, $cols.Count)
|        if ($AzDcrSetLogIngestApiAppPermissionsDcrLevel -and $LogIngestServicePricipleObjectId) {
|            $roleDef = "/subscriptions/$($scope.Subscription)/providers/Microsoft.Authorization/roleDefinitions/3913510d-42f4-4e42-8a64-420c390055eb"
|            try {
|                $null = Invoke-SILogArm -Method PUT -Path ($dcrPath + '/providers/Microsoft.Authorization/roleAssignments/' + [guid]::NewGuid().ToString()) -ApiVersion (Get-SILogArmApiVersion Role) -Auth $auth `
|                    -Body @{ properties = @{ roleDefinitionId = $roleDef; principalId = $LogIngestServicePricipleObjectId; principalType = 'ServicePrincipal' } }
|            } catch { Write-Warning ("Monitoring Metrics Publisher on {0} was not granted: {1}" -f $DcrName, $_.Exception.Message) }
|        }
|        Start-Sleep -Seconds 15
|        return
|    }
|
|    $ids[$key] = [string]$dcr.id
|    # the columns the stream must carry: the table's (after Set-SILogTableRest), plus Computer/RawData when they are
|    # standard columns of a table migrated from v1 -- the module's rule
|    $t = Get-SILogTableRest -WorkspaceResourceId $AzLogWorkspaceResourceId -TableName $TableName -Auth $auth -NoCache
|    $want = New-Object 'System.Collections.Generic.List[object]'
|    if ($t) {
|        foreach ($c in @($t.properties.schema.columns)) { if ($c -and $c.name -ne 'TimeGenerated') { [void]$want.Add((& $toCol $c)) } }
|        foreach ($n in 'Computer', 'RawData') {
|            if (-not @($want | Where-Object { $_.name -eq $n }).Count -and @($t.properties.schema.standardColumns | Where-Object { $_.name -eq $n }).Count) { [void]$want.Add([ordered]@{ name = $n; type = 'string' }) }
|        }
|    } else {
|        foreach ($c in $SchemaSourceObject) { if ($c.name -ne 'TimeGenerated') { [void]$want.Add((& $toCol $c)) } }
|    }
|    $p = $dcr.properties
|    if (-not $p.streamDeclarations) { $p | Add-Member -NotePropertyName streamDeclarations -NotePropertyValue ([pscustomobject]@{}) -Force }
|    $hasStream = [bool]$p.streamDeclarations.PSObject.Properties[$stream]
|    $have = if ($hasStream) { @($p.streamDeclarations.$stream.columns) } else { @() }
|    $merged = New-Object 'System.Collections.Generic.List[object]'
|    foreach ($c in $have) { if ($c) { [void]$merged.Add((& $toCol $c)) } }
|    $added = New-Object 'System.Collections.Generic.List[string]'
|    foreach ($c in $want) { if (-not @($merged | Where-Object { $_.name -eq $c.name }).Count) { [void]$merged.Add($c); [void]$added.Add([string]$c.name) } }
|    if ($added.Count -eq 0) { Write-Output ("data collection rule {0}: has every column" -f $DcrName); return }
|
|    if ($hasStream) { $p.streamDeclarations.$stream.columns = @($merged.ToArray()) }
|    else {
|        $p.streamDeclarations | Add-Member -NotePropertyName $stream -NotePropertyValue ([pscustomobject]@{ columns = @($merged.ToArray()) })
|        $flows = @($p.dataFlows)
|        if (-not @($flows | Where-Object { @($_.streams) -contains $stream }).Count) {
|            $dest = @($p.destinations.logAnalytics)[0]
|            $p.dataFlows = @($flows) + @([pscustomobject]@{ streams = @($stream); destinations = @([string]$dest.name); transformKql = 'source | extend TimeGenerated = now()'; outputStream = $stream })
|        }
|    }
|    $props = [ordered]@{}
|    foreach ($q in $p.PSObject.Properties) { if ($q.Name -notin 'immutableId', 'provisioningState', 'endpoints', 'metadata') { $props[$q.Name] = $q.Value } }
|    $body = [ordered]@{ location = [string]$dcr.location; properties = $props }
|    if ($dcr.PSObject.Properties['kind'] -and $dcr.kind) { $body['kind'] = $dcr.kind }
|    if ($dcr.PSObject.Properties['tags'] -and $dcr.tags) { $body['tags'] = $dcr.tags }
|    $null = Invoke-SILogArm -Method PUT -Path ([string]$dcr.id) -ApiVersion (Get-SILogArmApiVersion Dcr) -Auth $auth -Body $body
|    Write-Output ("data collection rule {0}: {1} column(s) added to {2} ({3})" -f $DcrName, $added.Count, $stream, ($added -join ', '))
|}
|
|function Update-SILogTableSchemaRest {
|    <#
|        Twin of CheckCreateUpdate-TableDcr-Structure: the table and the rule carry every column of the data (the WHOLE
|        set decides the schema). Same arguments as the module. Additive only (Set-SILogTableRest / Set-SILogDcrRest).
|        A table name with '_' first, '-', ':', '.' or a space is refused as the module refuses it (nothing is done).
|    #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][Array]$Data, [Parameter(Mandatory)][string]$AzLogWorkspaceResourceId, [Parameter(Mandatory)][string]$TableName,
|          [Parameter(Mandatory)][string]$DcrName, [string]$DcrResourceGroup, [string]$DceName,
|          [AllowEmptyString()][AllowEmptyCollection()][string]$LogIngestServicePricipleObjectId, [boolean]$AzDcrSetLogIngestApiAppPermissionsDcrLevel = $false,
|          [boolean]$AzLogDcrTableCreateFromAnyMachine, [string]$SchemaMode = 'Merge', [boolean]$EnableUploadViaLogHub = $false,
|          [AllowEmptyCollection()][array]$AzLogDcrTableCreateFromReferenceMachine,
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation = 'LocalMachine',
|          [switch]$UseManagedIdentity, [string]$ManagedIdentityClientId, [string]$TenantId)
|    if ($TableName -like '_*' -or $TableName -like '*-*' -or $TableName -like '*:*' -or $TableName -like '*.*' -or $TableName -like '* *') {
|        Write-Verbose ("ISSUE - Table name [ {0} ] is not a valid Log Analytics table name" -f $TableName)
|        return
|    }
|    if ($EnableUploadViaLogHub) { return }
|    if (-not ($AzLogDcrTableCreateFromAnyMachine -or ($env:COMPUTERNAME -and $env:COMPUTERNAME -in @($AzLogDcrTableCreateFromReferenceMachine)))) { return }
|    if (-not $DcrResourceGroup) { $DcrResourceGroup = (Get-SILogIngestScope -WorkspaceResourceId $AzLogWorkspaceResourceId).DcrRg }
|    $authArgs = @{}
|    foreach ($k in 'AzAppId', 'AzAppSecret', 'AzAppCertificateThumbprint', 'AzAppCertificateStoreLocation', 'UseManagedIdentity', 'ManagedIdentityClientId', 'TenantId') {
|        if ($PSBoundParameters.ContainsKey($k)) { $authArgs[$k] = $PSBoundParameters[$k] }
|    }
|    $schema = Get-SILogSchemaRest -Data $Data -As Array
|    $needs = Test-SILogTableDcrStatusRest -AzLogWorkspaceResourceId $AzLogWorkspaceResourceId -TableName $TableName -DcrName $DcrName -SchemaSourceObject $schema -DcrResourceGroup $DcrResourceGroup @authArgs
|    if (-not $needs) { Write-Output ("table {0}_CL and rule {1}: every column is declared" -f $TableName, $DcrName); return }
|    Set-SILogTableRest -AzLogWorkspaceResourceId $AzLogWorkspaceResourceId -TableName $TableName -SchemaSourceObject (Get-SILogSchemaRest -Data $Data -As Hash -ReturnType Table) -SchemaMode $SchemaMode @authArgs
|    Set-SILogDcrRest -AzLogWorkspaceResourceId $AzLogWorkspaceResourceId -SchemaSourceObject (Get-SILogSchemaRest -Data $Data -As Hash -ReturnType DCR) `
|        -DceName $DceName -DcrName $DcrName -DcrResourceGroup $DcrResourceGroup -TableName $TableName -SchemaMode $SchemaMode `
|        -LogIngestServicePricipleObjectId $LogIngestServicePricipleObjectId -AzDcrSetLogIngestApiAppPermissionsDcrLevel $AzDcrSetLogIngestApiAppPermissionsDcrLevel @authArgs
|}
|
|# =====================================================================================================================
|#  REST: upload
|# =====================================================================================================================
|
|function ConvertTo-SILogGzip {
|    param([Parameter(Mandatory)][byte[]]$Bytes)
|    $ms = New-Object System.IO.MemoryStream
|    try {
|        $gz = New-Object System.IO.Compression.GZipStream($ms, [System.IO.Compression.CompressionMode]::Compress, $true)
|        try { $gz.Write($Bytes, 0, $Bytes.Length) } finally { $gz.Dispose() }
|        return , $ms.ToArray()
|    } finally { $ms.Dispose() }
|}
|
|function Send-SILogIngestBatch {
|    <# Posts rows [List of row JSON bytes] as one JSON array. Measured: when the payload (compressed when -State says
|       so) exceeds the limit, the batch is split in two and each half measured again. #>
|    param([Parameter(Mandatory)]$Rows, [Parameter(Mandatory)][hashtable]$State)
|    $raw = New-Object System.IO.MemoryStream
|    try {
|        $raw.WriteByte(0x5B)
|        for ($i = 0; $i -lt $Rows.Count; $i++) { if ($i -gt 0) { $raw.WriteByte(0x2C) }; $b = $Rows[$i]; $raw.Write($b, 0, $b.Length) }
|        $raw.WriteByte(0x5D)
|        $rawBytes = $raw.ToArray()
|    } finally { $raw.Dispose() }
|    $payload = if ($State.Compress) { ConvertTo-SILogGzip -Bytes $rawBytes } else { $rawBytes }
|    if ($payload.Length -gt $State.MaxBytes) {
|        if ($Rows.Count -eq 1) { throw ("A single record ({0} bytes) is larger than the {1}-byte limit of the Log Ingestion API, so it cannot be posted." -f $payload.Length, $State.MaxBytes) }
|        $half = [int][Math]::Floor($Rows.Count / 2)
|        $a = New-Object 'System.Collections.Generic.List[byte[]]'; $z = New-Object 'System.Collections.Generic.List[byte[]]'
|        for ($i = 0; $i -lt $Rows.Count; $i++) { if ($i -lt $half) { [void]$a.Add($Rows[$i]) } else { [void]$z.Add($Rows[$i]) } }
|        Send-SILogIngestBatch -Rows $a -State $State
|        Send-SILogIngestBatch -Rows $z -State $State
|        return
|    }
|    if ($State.Compress -and $rawBytes.Length -gt 0) { $State.Ratio = [Math]::Max(0.01, $payload.Length / $rawBytes.Length) }
|    $from = $State.Posted + 1; $to = $State.Posted + $Rows.Count
|    Write-Host ''
|    Write-Host ("  Posting data to LogAnalytics table [ {0}_CL ]" -f $State.Table)
|    Write-Host ("    Rows       : {0}..{1} / {2}" -f $from, $to, $State.Total)
|    Write-Host ("    {0} | {1}" -f $(if ($State.Compress) { 'Compression=ON' } else { 'Compression=OFF' }), $State.AuthText)
|    Write-Host ''
|    $h = @{}
|    if ($State.Compress) { $h['Content-Encoding'] = 'gzip' }
|    $null = Invoke-SILogIngestRequest -Method POST -Uri $State.Uri -Body ([byte[]]$payload) -ContentType 'application/json' -Headers $h `
|        -Resource 'https://monitor.azure.com/' -Auth $State.Auth -What 'Log Ingestion API request'
|    $State.Posted += $Rows.Count
|    $State.Bytes += [long]$rawBytes.Length
|    $State.Batches++
|    Write-Host '  SUCCESS - data uploaded to LogAnalytics' -ForegroundColor Green
|}
|
|# =====================================================================================================================
|#  REST: the PARALLEL SENDER (#738) -- for a caller that posts one large result in many calls (Risk Analysis)
|#
|#  A large install, 2026-10-17: 1,138,554 Risk Analysis rows reached Log Analytics at ~2,200 rows a minute (~8.5 hours). Every post
|#  was made, and waited for, in line with the work that builds the rows: the page read, the preparation, the JSON, then one
|#  POST at a time, each ~half full (the batch split in two whenever the compressed size went over the limit).
|#  A sender changes only HOW the rows travel, never WHICH rows or their JSON (the rows are serialised exactly as before, by
|#  Send-SILogDataRest, in the order given):
|#    * each POST is filled close to the API's limit: the rows are compressed, the compressed size MEASURED, and a batch that
|#      comes out over the limit gives back its last rows to the next batch (no half batches); the compression ratio adapts
|#      from every measurement; a 413 from the service lowers the limit and the batch is split and sent again;
|#    * up to -Degree POSTs are in flight at once (a small fixed number, 4), each on its own worker; a 429 / 408 / 5xx / no
|#      answer is retried by its worker after the service's Retry-After, and a 429 holds EVERY worker until then;
|#    * the endpoint, the rule and the token are resolved once per sender (the token from the run's cache, refreshed on 401);
|#    * the rows confirmed by the service (2xx) are COUNTED; Complete-SILogIngestSender throws when they are fewer than the
|#      rows handed over -- the same verdict as before. A failed post stops the next hand-over at once (the error is the
|#      same text as a failed synchronous post).
|#  Started by the caller (Start-SILogIngestSender -TableName), then every Send-SILogData for that table goes through it;
|#  any other table, and every caller that never starts one, posts synchronously exactly as before.
|# =====================================================================================================================
|
|function Get-SILogIngestSenderWorkerScript {
|    <# The worker: one POST with the retry rule (working rule 4), holding while the service asked every worker to wait. #>
|    @'
|param([string]$Uri, [byte[]]$Body, [hashtable]$Headers, [int]$MaxAttempts, $Gate)
|$notes = New-Object 'System.Collections.Generic.List[string]'
|for ($attempt = 1; ; $attempt++) {
|    while ($true) {
|        $until = [long]$Gate['PauseUntil']; $now = [datetime]::UtcNow.Ticks
|        if ($until -le $now) { break }
|        Start-Sleep -Milliseconds ([int][Math]::Min(60000, [Math]::Ceiling(($until - $now) / 10000.0)) + 1)
|    }
|    $r = Invoke-SILogIngestHttp -Method POST -Uri $Uri -Headers $Headers -Body $Body -ContentType 'application/json'
|    $code = [int]$r.StatusCode
|    if ($code -ge 200 -and $code -lt 300) { return @{ Code = $code; Attempts = $attempt; Content = ''; Notes = $notes.ToArray() } }
|    $transient = ($code -eq 0 -or $code -eq 408 -or $code -eq 429 -or $code -ge 500)
|    if (-not $transient -or $attempt -ge $MaxAttempts) { return @{ Code = $code; Attempts = $attempt; Content = [string]$r.Content; Notes = $notes.ToArray() } }
|    $wait = Get-SILogIngestRetryDelay -RetryAfter ([string]$r.RetryAfter) -Attempt $attempt
|    if ($code -eq 429) {
|        [System.Threading.Monitor]::Enter($Gate.SyncRoot)
|        try { $t = [datetime]::UtcNow.AddSeconds($wait).Ticks; if ($t -gt [long]$Gate['PauseUntil']) { $Gate['PauseUntil'] = $t } } finally { [System.Threading.Monitor]::Exit($Gate.SyncRoot) }
|    }
|    if ($code -eq 0 -or $wait -ge 30) {
|        $notes.Add((" [INFO] Log Ingestion API request: {0} -- trying again in {1} second(s) (attempt {2} of {3})" -f $(if ($code -eq 0) { 'no answer from Azure' } else { 'Azure answered HTTP {0}' -f $code }), $wait, $attempt, $MaxAttempts))
|    }
|    [System.Threading.Monitor]::Enter($Gate.SyncRoot)
|    try { $Gate['Retries'] = 1 + [int]$Gate['Retries'] } finally { [System.Threading.Monitor]::Exit($Gate.SyncRoot) }
|    Start-Sleep -Seconds $wait
|}
|'@
|}
|
|function Get-SILogIngestSender {
|    <# The sender started for -TableName in this run ($null when none). #>
|    param([Parameter(Mandatory)][string]$TableName)
|    $c = Get-SILogIngestRunCache
|    if (-not ($c.Senders -is [hashtable])) { return $null }
|    $k = ($TableName -replace '_CL$', '').ToLowerInvariant()
|    if ($c.Senders.ContainsKey($k)) { return $c.Senders[$k] }
|    $null
|}
|
|function Get-SILogIngestPostDegree {
|    <# PURE over the setting. POSTs in flight at once: 4 (a small fixed number). SI_LogIngest_ParallelPosts (global) or the
|       environment variable SI_LOGINGEST_PARALLELPOSTS: 1 / 0 / off = one at a time; a number = that many, at most 8. #>
|    param($Setting = $(Get-Variable -Scope Global -Name SI_LogIngest_ParallelPosts -ValueOnly -ErrorAction Ignore), [AllowNull()][AllowEmptyString()][string]$EnvValue = $env:SI_LOGINGEST_PARALLELPOSTS)
|    $s = if ($null -ne $Setting -and ([string]$Setting).Trim() -ne '') { ([string]$Setting).Trim() } elseif ($EnvValue) { $EnvValue.Trim() } else { '' }
|    if ($s -match '^(?i)(off|false|no|disabled?)$') { return 1 }
|    $n = 0
|    if ($s -ne '' -and [int]::TryParse($s, [ref]$n)) { if ($n -le 1) { return 1 }; return [Math]::Min(8, $n) }
|    4
|}
|
|function Start-SILogIngestSender {
|    <# Starts the sender for -TableName (see the block above). -Degree: POSTs in flight at once (Get-SILogIngestPostDegree).
|       -MaxPayloadBytes: the API's limit per call; each POST is filled to -Fill of it (measured after compression). #>
|    param([Parameter(Mandatory)][string]$TableName, [int]$Degree = 0, [long]$MaxPayloadBytes = 1MB, [double]$Fill = 0.95, [int]$MaxAttempts = 6)
|    if ($Degree -le 0) { $Degree = Get-SILogIngestPostDegree }
|    $c = Get-SILogIngestRunCache
|    if (-not ($c.Senders -is [hashtable])) { $c.Senders = @{} }
|    $k = ($TableName -replace '_CL$', '').ToLowerInvariant()
|    if ($c.Senders.ContainsKey($k)) { Stop-SILogIngestSender -TableName $TableName }
|    $s = @{
|        Table = ($TableName -replace '_CL$', ''); Degree = $Degree; MaxBytes = [long]$MaxPayloadBytes; Fill = $Fill; MaxAttempts = $MaxAttempts
|        Uri = $null; Auth = $null; AuthText = ''; Compress = $true; Ratio = 1.0
|        Pending = (New-Object 'System.Collections.Generic.List[byte[]]'); PendingBytes = 2L
|        InFlight = (New-Object 'System.Collections.Generic.List[object]')
|        Accepted = 0L; Dispatched = 0L; Confirmed = 0L; Bytes = 0L; SentBytes = 0L; Posts = 0; Split413 = 0; MaxSent = 0L
|        Failed = $null; Pool = $null; Gate = [hashtable]::Synchronized(@{ PauseUntil = 0L; Retries = 0 }); Script = (Get-SILogIngestSenderWorkerScript)
|    }
|    if ($Degree -gt 1) {
|        # the worker's environment: the HTTP seam and the retry delay AS THEY ARE in this run (a test's fake service
|        # included), and $SILogSeam (the test seam's shared state, $null in a real run). Never a script block of this
|        # runspace: a worker runs only text it was given.
|        $iss = [System.Management.Automation.Runspaces.InitialSessionState]::CreateDefault2()
|        foreach ($fn in 'Invoke-SILogIngestHttp', 'Get-SILogIngestRetryDelay') {
|            $def = (Get-Command -Name $fn -CommandType Function -ErrorAction Stop).Definition
|            $iss.Commands.Add((New-Object System.Management.Automation.Runspaces.SessionStateFunctionEntry($fn, $def)))
|        }
|        $seam = Get-Variable -Scope Global -Name SILogSeam -ValueOnly -ErrorAction Ignore
|        $iss.Variables.Add((New-Object System.Management.Automation.Runspaces.SessionStateVariableEntry('SILogSeam', $seam, '')))
|        $pool = [System.Management.Automation.Runspaces.RunspaceFactory]::CreateRunspacePool(1, $Degree, $iss, $Host)
|        $pool.Open()
|        $s.Pool = $pool
|    }
|    $c.Senders[$k] = $s
|    $s
|}
|
|function Send-SILogIngestSenderBatch {
|    <# Hands one payload to a worker (or posts it here when the sender has no workers), waiting first while -Degree are in flight. #>
|    param([Parameter(Mandatory)][hashtable]$Sender, [Parameter(Mandatory)][byte[]]$Payload, [Parameter(Mandatory)][hashtable]$Batch)
|    while ($Sender.InFlight.Count -ge [Math]::Max(1, $Sender.Degree)) { Receive-SILogIngestSenderResults -Sender $Sender -WaitOne }
|    # once a post has failed, nothing more goes out (the run fails; the rows not posted are counted as not confirmed)
|    if ($Sender.Failed) { return }
|    $token = Get-SILogIngestToken -Resource 'https://monitor.azure.com/' -Auth $Sender.Auth -ForceRefresh:([bool]$Batch.Refresh)
|    $h = @{ 'Authorization' = ('Bearer ' + $token) }
|    if ($Sender.Compress) { $h['Content-Encoding'] = 'gzip' }
|    $Batch.Payload = $Payload
|    $Sender.Posts++
|    if ($null -eq $Sender.Pool) {
|        $res = & ([scriptblock]::Create($Sender.Script)) $Sender.Uri $Payload $h $Sender.MaxAttempts $Sender.Gate
|        Complete-SILogIngestSenderBatch -Sender $Sender -Batch $Batch -Result $res
|        return
|    }
|    $ps = [powershell]::Create()
|    $ps.RunspacePool = $Sender.Pool
|    [void]$ps.AddScript($Sender.Script).AddArgument($Sender.Uri).AddArgument($Payload).AddArgument($h).AddArgument($Sender.MaxAttempts).AddArgument($Sender.Gate)
|    $Batch.PS = $ps
|    $Batch.Handle = $ps.BeginInvoke()
|    [void]$Sender.InFlight.Add($Batch)
|}
|
|function Complete-SILogIngestSenderBatch {
|    <# One post's answer: 2xx = its rows confirmed (said as before); 401 = sent once more with a fresh token; 413 = the limit
|       is lowered and the batch split and sent again; anything else = the sender has FAILED (same text as a failed post). #>
|    param([Parameter(Mandatory)][hashtable]$Sender, [Parameter(Mandatory)][hashtable]$Batch, $Result)
|    $r = $Result
|    if ($r -is [System.Collections.IEnumerable] -and -not ($r -is [hashtable])) { $r = @($r | Where-Object { $_ -is [hashtable] }) | Select-Object -Last 1 }
|    if (-not ($r -is [hashtable])) { $r = @{ Code = 0; Content = 'the post''s worker returned no answer'; Notes = @() } }
|    foreach ($n in @($r.Notes)) { if ($n) { Write-Host $n } }
|    $code = [int]$r.Code
|    if ($code -ge 200 -and $code -lt 300) {
|        $Sender.Confirmed += $Batch.Rows.Count
|        $Sender.Bytes += [long]$Batch.Raw
|        $Sender.SentBytes += [long]$Batch.Payload.Length
|        if ($Batch.Payload.Length -gt $Sender.MaxSent) { $Sender.MaxSent = [long]$Batch.Payload.Length }
|        Write-Host ''
|        Write-Host ("  Posting data to LogAnalytics table [ {0}_CL ]" -f $Sender.Table)
|        Write-Host ("    Rows       : {0}..{1} / {2}" -f $Batch.From, ($Batch.From + $Batch.Rows.Count - 1), $Sender.Accepted)
|        Write-Host ("    {0} | {1} | {2:n0} bytes" -f $(if ($Sender.Compress) { 'Compression=ON' } else { 'Compression=OFF' }), $Sender.AuthText, $Batch.Payload.Length)
|        Write-Host ''
|        Write-Host '  SUCCESS - data uploaded to LogAnalytics' -ForegroundColor Green
|        return
|    }
|    if ($code -eq 401 -and -not $Batch.Refresh -and -not $Sender.Failed) {
|        $Batch.Refresh = $true
|        Send-SILogIngestSenderBatch -Sender $Sender -Payload $Batch.Payload -Batch $Batch
|        return
|    }
|    if ($code -eq 413 -and $Batch.Rows.Count -gt 1 -and -not $Sender.Failed) {
|        # the service's own limit is lower than ours: lower it under this payload and send the rows again in two
|        $Sender.MaxBytes = [long][Math]::Max(65536, [Math]::Floor($Batch.Payload.Length * 0.9))
|        $Sender.Split413++
|        $half = [int][Math]::Floor($Batch.Rows.Count / 2)
|        $a = New-Object 'System.Collections.Generic.List[byte[]]'; $z = New-Object 'System.Collections.Generic.List[byte[]]'
|        for ($i = 0; $i -lt $Batch.Rows.Count; $i++) { if ($i -lt $half) { [void]$a.Add($Batch.Rows[$i]) } else { [void]$z.Add($Batch.Rows[$i]) } }
|        $Sender.Dispatched -= $Batch.Rows.Count
|        Send-SILogIngestSenderRows -Sender $Sender -Rows $a -From $Batch.From
|        Send-SILogIngestSenderRows -Sender $Sender -Rows $z -From ($Batch.From + $half)
|        return
|    }
|    if (-not $Sender.Failed) { $Sender.Failed = ("Log Ingestion API request failed. HTTP Status: {0} Response: {1}" -f $code, $r.Content) }
|}
|
|function Receive-SILogIngestSenderResults {
|    <# Collects the answers of the posts that finished; -WaitOne waits for at least one (when any is in flight); -All for all. #>
|    param([Parameter(Mandatory)][hashtable]$Sender, [switch]$WaitOne, [switch]$All)
|    while ($Sender.InFlight.Count -gt 0) {
|        $done = @($Sender.InFlight | Where-Object { $_.Handle.IsCompleted })
|        if ($done.Count -eq 0) {
|            if (-not $WaitOne -and -not $All) { return }
|            $handles = [System.Threading.WaitHandle[]]@($Sender.InFlight | ForEach-Object { $_.Handle.AsyncWaitHandle } | Select-Object -First 64)
|            [void][System.Threading.WaitHandle]::WaitAny($handles, 1000)
|            continue
|        }
|        # out of the list first: answering one post can send another (401, 413) and wait for the workers again
|        foreach ($b in $done) { [void]$Sender.InFlight.Remove($b) }
|        # each answer on its own: one that throws (a token fetch for a 401 resend, a record too large in a 413 split) is the
|        # sender's FIRST error -- every other finished post is still counted and its worker disposed
|        foreach ($b in $done) {
|            $res = $null
|            try { $res = @($b.PS.EndInvoke($b.Handle)) | ForEach-Object { $_.psobject.BaseObject } | Where-Object { $_ -is [hashtable] } | Select-Object -Last 1 }
|            catch { $res = @{ Code = 0; Content = $_.Exception.Message; Notes = @() } }
|            finally { try { $b.PS.Dispose() } catch { }; $b.PS = $null; $b.Handle = $null }
|            try { Complete-SILogIngestSenderBatch -Sender $Sender -Batch $b -Result $res }
|            catch { if (-not $Sender.Failed) { $Sender.Failed = [string]$_.Exception.Message } }
|        }
|        if ($WaitOne -and -not $All) { return }
|    }
|}
|
|function Send-SILogIngestSenderCut {
|    <# Makes ONE post from the rows waiting: compressed and MEASURED; over the limit -> the last rows wait for the next post
|       (as many as the measurement says), never a half-empty post: a post that measures under 60% of the limit is not
|       sent yet (the ratio is learnt from it and the rows keep coming) -- unless -Final (the rows left at the end). #>
|    param([Parameter(Mandatory)][hashtable]$Sender, [switch]$Final)
|    $rows = $Sender.Pending
|    if ($rows.Count -eq 0) { return }
|    $take = $rows.Count
|    $limit = [long][Math]::Floor($Sender.MaxBytes * $Sender.Fill)
|    while ($true) {
|        $raw = New-Object System.IO.MemoryStream
|        try {
|            $raw.WriteByte(0x5B)
|            for ($i = 0; $i -lt $take; $i++) { if ($i -gt 0) { $raw.WriteByte(0x2C) }; $b = $rows[$i]; $raw.Write($b, 0, $b.Length) }
|            $raw.WriteByte(0x5D)
|            $rawBytes = $raw.ToArray()
|        } finally { $raw.Dispose() }
|        $payload = if ($Sender.Compress) { ConvertTo-SILogGzip -Bytes $rawBytes } else { $rawBytes }
|        if ($Sender.Compress -and $rawBytes.Length -gt 0) { $Sender.Ratio = [Math]::Max(0.005, $payload.Length / [double]$rawBytes.Length) }
|        if (-not $Final -and $take -eq $rows.Count -and $payload.Length -lt [long]($limit * 0.6)) { return }   # too empty yet: wait for more rows
|        if ($payload.Length -le $limit -or ($payload.Length -le $Sender.MaxBytes -and $take -eq 1)) { break }
|        if ($take -eq 1) { throw ("A single record ({0} bytes) is larger than the {1}-byte limit of the Log Ingestion API, so it cannot be posted." -f $payload.Length, $Sender.MaxBytes) }
|        # as many rows as the measured bytes per row allow, a little under (the next post takes the rest)
|        $take = [int][Math]::Max(1, [Math]::Min($take - 1, [Math]::Floor($take * ($limit * 0.98) / [double]$payload.Length)))
|    }
|    $batchRows = $rows.GetRange(0, $take)
|    $rows.RemoveRange(0, $take)
|    $Sender.PendingBytes = 2L; foreach ($b in $rows) { $Sender.PendingBytes += $b.Length + 1 }
|    $from = $Sender.Dispatched + 1
|    $Sender.Dispatched += $take
|    Send-SILogIngestSenderBatch -Sender $Sender -Payload $payload -Batch @{ Rows = $batchRows; Raw = $rawBytes.Length; From = $from; Refresh = $false }
|}
|
|function Send-SILogIngestSenderRows {
|    <# Adds serialised rows to the sender, in order; a post is made each time the rows waiting reach the measured size of a
|       full one. -From: re-sent rows (a 413 split) keep their numbers and go out at once. #>
|    param([Parameter(Mandatory)][hashtable]$Sender, [Parameter(Mandatory)]$Rows, [long]$From = 0)
|    if ($From -gt 0) {
|        # a split batch: these rows go out as they are (each half measured again), ahead of the rows waiting
|        $keep = $Sender.Pending; $keepBytes = $Sender.PendingBytes
|        $Sender.Pending = New-Object 'System.Collections.Generic.List[byte[]]'; foreach ($b in $Rows) { [void]$Sender.Pending.Add($b) }
|        $saved = $Sender.Dispatched; $Sender.Dispatched = $From - 1
|        while ($Sender.Pending.Count -gt 0) { Send-SILogIngestSenderCut -Sender $Sender -Final }
|        $Sender.Dispatched = $saved + $Rows.Count
|        $Sender.Pending = $keep; $Sender.PendingBytes = $keepBytes
|        return
|    }
|    foreach ($b in $Rows) {
|        if (-not $Sender.Compress -and ($b.Length + 2) -gt $Sender.MaxBytes) {
|            throw ("A single record ({0} bytes) is larger than the {1}-byte limit of the Log Ingestion API, so it cannot be posted." -f ($b.Length + 2), $Sender.MaxBytes)
|        }
|        # raw-bytes ceiling: the limit itself uncompressed; compressed, the fill level over the measured ratio
|        $ceiling = if ($Sender.Compress) { [long][Math]::Min(64MB, [Math]::Floor($Sender.MaxBytes * $Sender.Fill / $Sender.Ratio)) } else { [long][Math]::Floor($Sender.MaxBytes * $Sender.Fill) }
|        $add = $b.Length + $(if ($Sender.Pending.Count -gt 0) { 1 } else { 0 })
|        if ($Sender.Pending.Count -gt 0 -and ($Sender.PendingBytes + $add) -gt $ceiling) {
|            Send-SILogIngestSenderCut -Sender $Sender
|            if ($Sender.Failed) { throw $Sender.Failed }
|            $add = $b.Length + $(if ($Sender.Pending.Count -gt 0) { 1 } else { 0 })
|        }
|        [void]$Sender.Pending.Add($b); $Sender.PendingBytes += $add
|        $Sender.Accepted++
|    }
|    Receive-SILogIngestSenderResults -Sender $Sender
|    if ($Sender.Failed) { throw $Sender.Failed }
|}
|
|function Sync-SILogIngestSender {
|    <# Every row handed over is posted and answered (the rows waiting go out now). Throws when a post failed. #>
|    param([Parameter(Mandatory)][hashtable]$Sender)
|    while ($Sender.Pending.Count -gt 0 -and -not $Sender.Failed) { Send-SILogIngestSenderCut -Sender $Sender -Final }
|    Receive-SILogIngestSenderResults -Sender $Sender -All
|    if ($Sender.Failed) { throw $Sender.Failed }
|}
|
|function Invoke-SILogIngestGuardHeal {
|    <#
|        #733 (owner 2026-10-17: guards heal themselves): a table whose rows Log Analytics accepted IN FULL clears an earlier
|        "rows not accepted" of that table by itself. Once per table per process (the first full post), so the hot path pays one
|        state read per table, not one per post. Never throws; nothing when the guard code is not loaded.
|    #>
|    param([Parameter(Mandatory)][string]$Table)
|    try {
|        if (-not (Get-Command -Name Invoke-SIGuardHeal -ErrorAction Ignore)) { return }
|        if ($null -eq $script:SILogIngestHealed) { $script:SILogIngestHealed = @{} }
|        $t = $Table.ToLowerInvariant()
|        if ($script:SILogIngestHealed.ContainsKey($t)) { return }
|        $script:SILogIngestHealed[$t] = $true
|        $null = Invoke-SIGuardHeal -Checked @(@{ GuardId = 'ingest.rows.short-count'; Subject = $Table; Detail = ('Log Analytics accepted every row for {0}.' -f $Table) }) -Complete $true
|    } catch { }
|}
|
|function Complete-SILogIngestSender {
|    <#
|        The end of the hand-over: the rows waiting are posted, every post is answered, the workers are closed. The rows the
|        service CONFIRMED are counted against the rows handed over -- fewer throws (and is a guard event), as a short
|        synchronous post did. Returns @{ RowsPosted; RowsHandedOver; Posts; BytesPosted; BytesSent; MaxBytesSent; Retries; Split413 }.
|    #>
|    param([Parameter(Mandatory)][string]$TableName)
|    $s = Get-SILogIngestSender -TableName $TableName
|    if ($null -eq $s) { return $null }
|    try { Sync-SILogIngestSender -Sender $s }
|    finally { Close-SILogIngestSender -TableName $TableName }
|    if ($s.Confirmed -ne $s.Accepted) {
|        if (Get-Command -Name Send-SIGuardEvent -ErrorAction Ignore) { $null = Send-SIGuardEvent -GuardId 'ingest.rows.short-count' -Outcome 'refused' -Subject ($s.Table + '_CL') -Detail ("Log Analytics accepted {0} of {1} row(s) for {2}_CL." -f $s.Confirmed, $s.Accepted, $s.Table) -Values @(@{ Name = 'rowsPosted'; Label = 'Rows accepted'; Measured = [long]$s.Confirmed; Limit = [long]$s.Accepted }, @{ Name = 'rowsGiven'; Label = 'Rows sent'; Measured = [long]$s.Accepted }) -HeldCount ([long]$s.Accepted - [long]$s.Confirmed) }
|        throw ("Posted {0} of {1} row(s) to {2}_CL -- the other rows are UNKNOWN, not posted." -f $s.Confirmed, $s.Accepted, $s.Table)
|    }
|    if ([long]$s.Accepted -gt 0) { Invoke-SILogIngestGuardHeal -Table ($s.Table + '_CL') }
|    [pscustomobject]@{ RowsPosted = $s.Confirmed; RowsHandedOver = $s.Accepted; Posts = $s.Posts; BytesPosted = $s.Bytes; BytesSent = $s.SentBytes; MaxBytesSent = $s.MaxSent; Retries = [int]$s.Gate['Retries']; Split413 = $s.Split413 }
|}
|
|function Send-SILogDataToSender {
|    <#
|        Send-SILogDataRest's rows through a sender: serialised EXACTLY as the synchronous path does (ConvertTo-Json -Depth 100
|        -Compress per row, UTF-8, in the order given) and handed over. Returns the synchronous path's result shape: RowsPosted
|        = the rows handed over (the rows CONFIRMED are counted by Complete-SILogIngestSender), BytesPosted = their JSON bytes.
|        When this run added columns to the rule and their check is due (Confirm-SILogNewColumns, after this call), every row
|        handed over is posted and answered first -- the check reads the rows back from Log Analytics.
|    #>
|    param([Parameter(Mandatory)][hashtable]$Sender, [Parameter(Mandatory)][AllowEmptyCollection()][array]$Data, [string]$DcrName)
|    # #639: handed over a BATCH at a time -- the rows serialised so far are handed to the sender once they fill a post
|    # (its measured size), never the whole post serialised first and held as bytes beside the rows
|    $list = New-Object 'System.Collections.Generic.List[byte[]]'
|    $bytes = 1L; $count = 0L; $listBytes = 0L
|    $fill = 1.0; if ($Sender.ContainsKey('Fill') -and $Sender.Fill) { $fill = [double]$Sender.Fill }
|    $ratio = 1.0; if ($Sender.ContainsKey('Ratio') -and $Sender.Ratio) { $ratio = [double]$Sender.Ratio }
|    $max = 1MB; if ($Sender.ContainsKey('MaxBytes') -and $Sender.MaxBytes) { $max = [long]$Sender.MaxBytes }
|    $handAt = [long][Math]::Max(1, [Math]::Floor($max * $fill))
|    if ($Sender.Compress) { $handAt = [long][Math]::Min(64MB, [Math]::Floor($max * $fill / $ratio)) }
|    foreach ($row in $Data) {
|        $b = [System.Text.Encoding]::UTF8.GetBytes((ConvertTo-Json -Depth 100 -InputObject $row -Compress))
|        [void]$list.Add($b); $bytes += $b.Length + 1; $listBytes += $b.Length + 1; $count++
|        if ($listBytes -ge $handAt) {
|            Send-SILogIngestSenderRows -Sender $Sender -Rows $list
|            $list = New-Object 'System.Collections.Generic.List[byte[]]'; $listBytes = 0L
|        }
|    }
|    if ($list.Count -gt 0) { Send-SILogIngestSenderRows -Sender $Sender -Rows $list }
|    $list = $null
|    if ($DcrName -and ($global:SI_LogIngestNewColumns -is [hashtable]) -and $global:SI_LogIngestNewColumns.ContainsKey($DcrName.ToLowerInvariant())) {
|        Sync-SILogIngestSender -Sender $Sender
|    }
|    [pscustomobject]@{ StatusCode = 204; RowsPosted = $count; BytesPosted = $bytes; Batches = 0; Table = ($Sender.Table + '_CL'); Stream = '' }
|}
|
|function Stop-SILogIngestSender {
|    <# After a failure: nothing more is posted; the posts in flight are answered (their rows count), the workers closed.
|       Returns the rows the service confirmed (the rows that DID reach Log Analytics). Never throws. #>
|    param([Parameter(Mandatory)][string]$TableName)
|    $s = Get-SILogIngestSender -TableName $TableName
|    if ($null -eq $s) { return 0L }
|    try { $s.Pending.Clear(); Receive-SILogIngestSenderResults -Sender $s -All } catch { }
|    Close-SILogIngestSender -TableName $TableName
|    [long]$s.Confirmed
|}
|
|function Close-SILogIngestSender {
|    param([Parameter(Mandatory)][string]$TableName)
|    $c = Get-SILogIngestRunCache
|    $k = ($TableName -replace '_CL$', '').ToLowerInvariant()
|    if (-not ($c.Senders -is [hashtable]) -or -not $c.Senders.ContainsKey($k)) { return }
|    $s = $c.Senders[$k]
|    foreach ($b in $s.InFlight.ToArray()) { try { if ($b.PS) { $b.PS.Stop(); $b.PS.Dispose() } } catch { } }
|    $s.InFlight.Clear()
|    if ($s.Pool) { try { $s.Pool.Close(); $s.Pool.Dispose() } catch { }; $s.Pool = $null }
|    $c.Senders.Remove($k)
|}
|
|function Send-SILogDataRest {
|    <#
|        Twin of Post-AzLogAnalyticsLogIngestCustomLogDcrDce-Output, over plain REST:
|          * the rule is found by NAME in the configured subscription + SI_DcrResourceGroup (or the one created this run);
|          * the post goes through the endpoint the RULE is bound to -- ingestion accepts nothing else (#199);
|          * POST {endpoint}/dataCollectionRules/{immutableId}/streams/Custom-{table}_CL?api-version=2023-01-01;
|          * batches are sized from the MEASURED JSON bytes of the rows (working rule 5: no fixed row counts), each under
|            the 1 MB limit -- compressed when $global:EnableCompressionDefault says so, measured after compression and
|            split again if over;
|          * 429 / 5xx retried in-run with Retry-After; any other 4xx fails at once with the response body;
|          * the rows posted are COUNTED against the rows given -- a shortfall throws, it is never reported as done.
|        Rows are serialised exactly as the module serialised them (ConvertTo-Json -Depth 100 -Compress per row).
|        -BatchAmount is accepted and ignored: a fixed row count is what working rule 5 forbids.
|    #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][AllowEmptyCollection()][array]$Data, [Parameter(Mandatory)][AllowEmptyString()][string]$DcrName,
|          [AllowEmptyString()][string]$DceName, [Parameter(Mandatory)][string]$TableName,
|          [string]$BatchAmount, [bool]$EnableUploadViaLogHub = $false, [string]$LogHubPath,
|          [string]$AzAppId, [string]$AzAppSecret, [string]$AzAppCertificateThumbprint, [string]$AzAppCertificateStoreLocation = 'LocalMachine', [string]$TenantId,
|          [Nullable[bool]]$EnableCompression = $null, [Nullable[bool]]$UseManagedIdentity = $null, [string]$ManagedIdentityClientId,
|          [string]$SubscriptionId, [string]$DcrResourceGroup, [long]$MaxPayloadBytes = 1MB)
|    $total = @($Data).Count
|    if ($total -eq 0) { return }
|    if ($null -eq $EnableCompression) { $EnableCompression = if ($null -ne $global:EnableCompressionDefault) { [bool]$global:EnableCompressionDefault } else { $false } }
|    $bound = @{}; foreach ($k in $PSBoundParameters.Keys) { $bound[$k] = $PSBoundParameters[$k] }
|    $auth = Resolve-SILogIngestAuth -Bound $bound
|    # #738: a sender started for this table takes the rows (in order, serialised exactly as below); its endpoint, rule and
|    # sign-in are resolved on its first call and reused
|    $sender = Get-SILogIngestSender -TableName $TableName
|    if ($sender -and $sender.Uri) {
|        if ([bool]$EnableCompression -ne [bool]$sender.Compress) { $sender = $null }   # never mixed in one sender
|        else { return (Send-SILogDataToSender -Sender $sender -Data $Data -DcrName $DcrName) }
|    }
|    $scope = Get-SILogIngestScope -SubscriptionId $SubscriptionId -DcrResourceGroup $DcrResourceGroup
|
|    $dcr = Resolve-SILogDcrForTable -DcrName $DcrName -SubscriptionId $scope.Subscription -ResourceGroup $scope.DcrRg -Auth $auth
|    if (-not $dcr) { throw ("Data collection rule '{0}' was not found in resource group '{1}' of subscription '{2}', so nothing was posted." -f $DcrName, $scope.DcrRg, $scope.Subscription) }
|    $immutableId = [string]$dcr.properties.immutableId
|    if (-not $immutableId) { throw ("Data collection rule '{0}' has no immutable id yet, so nothing was posted." -f $DcrName) }
|    $stream = Get-SILogStreamName -TableName $TableName
|    if (-not ($dcr.properties.streamDeclarations -and $dcr.properties.streamDeclarations.PSObject.Properties[$stream])) {
|        $first = @(@($dcr.properties.dataFlows)[0].streams)[0]
|        if ($first) { $stream = [string]$first }
|    }
|    $endpoint = $null
|    $boundDce = [string]$dcr.properties.dataCollectionEndpointId
|    if ($boundDce) {
|        $dce = Invoke-SILogArm -Path $boundDce -ApiVersion (Get-SILogArmApiVersion Dce) -Auth $auth -AllowNotFound
|        if ($dce) { $endpoint = [string]$dce.properties.logsIngestion.endpoint }
|    }
|    if (-not $endpoint -and $dcr.properties.endpoints -and $dcr.properties.endpoints.logsIngestion) { $endpoint = [string]$dcr.properties.endpoints.logsIngestion }
|    if (-not $endpoint -and $DceName) {
|        $dce = Find-SILogResourceByName -Kind Dce -Name $DceName -SubscriptionId $scope.Subscription -ResourceGroup $scope.DceRg -Auth $auth -AnyResourceGroupWhenMissing
|        if ($dce) { $endpoint = [string]$dce.properties.logsIngestion.endpoint }
|    }
|    if (-not $endpoint) { throw ("No ingestion endpoint for data collection rule '{0}' (not bound to an endpoint, and '{1}' was not found), so nothing was posted." -f $DcrName, $DceName) }
|
|    $authText = switch ($auth.Mode) { 'ManagedIdentity' { 'Auth=ManagedIdentity' } 'Certificate' { 'Auth=SPN-Cert' } 'Secret' { 'Auth=SPN' } 'Support' { 'Auth=InvardiaSupport' } default { 'Auth=Run' } }
|    $state = @{
|        Uri = ('{0}/dataCollectionRules/{1}/streams/{2}?api-version=2023-01-01' -f $endpoint.TrimEnd('/'), $immutableId, $stream)
|        Auth = $auth; Compress = [bool]$EnableCompression; MaxBytes = $MaxPayloadBytes; Ratio = 1.0
|        Posted = 0; Bytes = 0L; Batches = 0; Total = $total; Table = $TableName; AuthText = $authText
|    }
|    if ($sender) {
|        $sender.Uri = $state.Uri; $sender.Auth = $auth; $sender.AuthText = $authText; $sender.Compress = [bool]$EnableCompression
|        $sender.MaxBytes = [long][Math]::Min([double]$sender.MaxBytes, [double]$MaxPayloadBytes)
|        return (Send-SILogDataToSender -Sender $sender -Data $Data -DcrName $DcrName)
|    }
|    $batch = New-Object 'System.Collections.Generic.List[byte[]]'
|    $batchBytes = 2
|    foreach ($row in $Data) {
|        $b = [System.Text.Encoding]::UTF8.GetBytes((ConvertTo-Json -Depth 100 -InputObject $row -Compress))
|        if (-not $state.Compress -and ($b.Length + 2) -gt $MaxPayloadBytes) {
|            throw ("A single record ({0} bytes) is larger than the {1}-byte limit of the Log Ingestion API, so it cannot be posted." -f ($b.Length + 2), $MaxPayloadBytes)
|        }
|        # raw-bytes ceiling: the limit itself uncompressed; compressed, the limit over the measured ratio (90% margin)
|        $ceiling = if ($state.Compress) { [long][Math]::Min(64MB, [Math]::Floor($MaxPayloadBytes / $state.Ratio * 0.9)) } else { $MaxPayloadBytes }
|        $add = $b.Length + $(if ($batch.Count -gt 0) { 1 } else { 0 })
|        if ($batch.Count -gt 0 -and ($batchBytes + $add) -gt $ceiling) {
|            Send-SILogIngestBatch -Rows $batch -State $state
|            $batch = New-Object 'System.Collections.Generic.List[byte[]]'; $batchBytes = 2; $add = $b.Length
|        }
|        [void]$batch.Add($b); $batchBytes += $add
|    }
|    if ($batch.Count -gt 0) { Send-SILogIngestBatch -Rows $batch -State $state }
|    if ($state.Posted -ne $total) {
|        # #277: the short count is a guard trip -- mailed and reported (never instead of the throw)
|        if (Get-Command -Name Send-SIGuardEvent -ErrorAction Ignore) { $null = Send-SIGuardEvent -GuardId 'ingest.rows.short-count' -Outcome 'refused' -Subject ($TableName + '_CL') -Detail ("Log Analytics accepted {0} of {1} row(s) for {2}_CL." -f $state.Posted, $total, $TableName) -Values @(@{ Name = 'rowsPosted'; Label = 'Rows accepted'; Measured = [long]$state.Posted; Limit = [long]$total }, @{ Name = 'rowsGiven'; Label = 'Rows sent'; Measured = [long]$total }) -HeldCount ([long]$total - [long]$state.Posted) }
|        throw ("Posted {0} of {1} row(s) to {2}_CL -- the other rows are UNKNOWN, not posted." -f $state.Posted, $total, $TableName)
|    }
|    if ([long]$total -gt 0) { Invoke-SILogIngestGuardHeal -Table ($TableName + '_CL') }
|    # BytesPosted: the uncompressed JSON bytes of the rows posted -- a caller that posts in parts sizes its next part from it
|    return [pscustomobject]@{ StatusCode = 204; RowsPosted = $state.Posted; BytesPosted = $state.Bytes; Batches = $state.Batches; Table = ($TableName + '_CL'); Stream = $stream }
|}
'@ }
$__siSupportFiles['auth/Find-SICertificate.ps1'] = @{ Sha256 = '3778fc328c239b499738360e6b4fb31eb3109db39c3a9a9d8f5a02a228ad58d8'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- find the engine SPN's certificate on ANY host, and bring one into a container (#209).
|
|    KEY POINT: THE `Cert:` DRIVE IS A WINDOWS CONVENIENCE; [X509Store] IS THE AUTHORITY. The drive does not exist
|    in a Linux container at all (pwsh on Linux has no certificate provider), and on Windows it can vanish
|    from a PS 5.1 child that inherited a pwsh 7 PSModulePath (framework finding AUTH-1). Five ingest sites
|    looked a thumbprint up through the drive ONLY, so in a container the lookup always "missed", the store
|    location fell back to LocalMachine, and certificate sign-in could not work there at all.
|
|    Every function here uses the drive when it exists -- exactly what the engines did before -- and the
|    X509Store only when it does not, so a Windows VM with its certificate in LocalMachine\My resolves the
|    same certificate, from the same store, as it always has.
|
|    Functions:
|      Get-SICertificateFromStore    -- one thumbprint -> @{ Certificate; StoreLocation } or $null
|      Get-SICertStoreLocation       -- 'LocalMachine' / 'CurrentUser' for the log-ingestion sign-in (default LocalMachine)
|      Get-SICertificateClientToken  -- client_credentials with a certificate-signed assertion (no Cert: drive)
|      Import-SIContainerCertificate -- a base64 PFX (Key Vault reference) -> CurrentUser\My + a PFX file
|
|    PS 5.1 safe: no ?. / ??, no ImportFromPem.
|#>
|
|function Test-SICertDriveAvailable {
|    <# The Windows certificate provider is loaded in this process. A seam for the tests. #>
|    return [bool](Get-PSDrive -Name Cert -ErrorAction SilentlyContinue)
|}
|
|function Get-SICertificateFromStore {
|    <#
|        Find a certificate WITH a private key by thumbprint, LocalMachine first, then CurrentUser -- the order
|        every SI engine already used. Returns @{ Certificate; StoreLocation } or $null.
|
|        -HasCertDrive and -OpenStore are test seams: -OpenStore takes a store location and returns the
|        certificates in its My store.
|    #>
|    param(
|        [Parameter(Mandatory)][AllowEmptyString()][string]$Thumbprint,
|        [string[]]$StoreLocations = @('LocalMachine', 'CurrentUser'),
|        [scriptblock]$HasCertDrive,
|        [scriptblock]$OpenStore
|    )
|    $clean = ($Thumbprint -replace '\s', '').ToUpperInvariant()
|    if ([string]::IsNullOrWhiteSpace($clean)) { return $null }
|    if (-not $HasCertDrive) { $HasCertDrive = { Test-SICertDriveAvailable } }
|    if (-not $OpenStore) {
|        $OpenStore = {
|            param([string]$Location)
|            $x = New-Object System.Security.Cryptography.X509Certificates.X509Store('My', $Location)
|            try {
|                $x.Open('ReadOnly')
|                return @($x.Certificates)
|            } finally { $x.Close() }
|        }
|    }
|    $drive = [bool](& $HasCertDrive)
|    foreach ($loc in $StoreLocations) {
|        $found = $null
|        if ($drive) {
|            $found = Get-ChildItem "Cert:\$loc\My" -ErrorAction SilentlyContinue |
|                     Where-Object { $_.Thumbprint -eq $clean -and $_.HasPrivateKey } |
|                     Select-Object -First 1
|        } else {
|            try {
|                $found = @(& $OpenStore $loc | Where-Object { $_ -and $_.Thumbprint -eq $clean -and $_.HasPrivateKey })[0]
|            } catch {
|                Write-Verbose ("certificate store {0}\My unreadable: {1}" -f $loc, $_.Exception.Message)
|            }
|        }
|        if ($found) { return [pscustomobject]@{ Certificate = $found; StoreLocation = $loc } }
|    }
|    return $null
|}
|
|function Get-SICertStoreLocation {
|    <#
|        The store the log-ingestion sign-in should be told to look in. Same answer the five ingest sites computed
|        through the Cert: drive (LocalMachine when nothing is found), now also right where the drive is
|        missing.
|    #>
|    param(
|        [Parameter(Mandatory)][AllowEmptyString()][string]$Thumbprint,
|        [scriptblock]$HasCertDrive,
|        [scriptblock]$OpenStore
|    )
|    $hit = Get-SICertificateFromStore -Thumbprint $Thumbprint -HasCertDrive $HasCertDrive -OpenStore $OpenStore
|    if ($hit) { return [string]$hit.StoreLocation }
|    return 'LocalMachine'
|}
|
|function Get-SICertificateClientToken {
|    <#
|        An access token for -Resource via client_credentials with a certificate-signed JWT assertion -- the
|        grant Get-SIGraphToken and the log ingestion already use, without the Cert: drive. Returns the
|        token string. -Invoke is a test seam: { param($Uri, $Body) } returning the token response.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$TenantId,
|        [Parameter(Mandatory)][string]$ClientId,
|        [Parameter(Mandatory)][string]$Thumbprint,
|        [Parameter(Mandatory)][string]$Resource,
|        [scriptblock]$Invoke
|    )
|    $hit = Get-SICertificateFromStore -Thumbprint $Thumbprint
|    if (-not $hit) { throw ("certificate '{0}' was not found with a private key in LocalMachine\My or CurrentUser\My." -f (($Thumbprint -replace '\s', '').ToUpperInvariant())) }
|    $cert = $hit.Certificate
|
|    $scope = if ($Resource -match '/\.default$') { $Resource } else { ($Resource.TrimEnd('/') + '/.default') }
|    $tokenUri = 'https://login.microsoftonline.com/{0}/oauth2/v2.0/token' -f $TenantId
|    $b64url = { param([byte[]]$Bytes) [Convert]::ToBase64String($Bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_') }
|    $now = [DateTimeOffset]::UtcNow.ToUnixTimeSeconds()
|    $header = @{ alg = 'RS256'; typ = 'JWT'; x5t = (& $b64url $cert.GetCertHash()) } | ConvertTo-Json -Compress
|    $claims = @{ aud = $tokenUri; iss = $ClientId; sub = $ClientId; jti = [guid]::NewGuid().ToString(); nbf = $now; exp = ($now + 600) } | ConvertTo-Json -Compress
|    $enc = [System.Text.Encoding]::UTF8
|    $unsigned = '{0}.{1}' -f (& $b64url $enc.GetBytes($header)), (& $b64url $enc.GetBytes($claims))
|    $rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
|    if (-not $rsa) { throw ("certificate '{0}' has no usable RSA private key." -f $cert.Thumbprint) }
|    $sig = $rsa.SignData($enc.GetBytes($unsigned), [System.Security.Cryptography.HashAlgorithmName]::SHA256, [System.Security.Cryptography.RSASignaturePadding]::Pkcs1)
|    $body = @{
|        client_id             = $ClientId
|        scope                 = $scope
|        client_assertion_type = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
|        client_assertion      = ('{0}.{1}' -f $unsigned, (& $b64url $sig))
|        grant_type            = 'client_credentials'
|    }
|    $resp = if ($Invoke) { & $Invoke $tokenUri $body }
|            # a time limit: without one this call waits for as long as the other side stays silent (PowerShell 7 has no default)
|            else { Invoke-RestMethod -Method Post -Uri $tokenUri -Body $body -ContentType 'application/x-www-form-urlencoded' -TimeoutSec 60 }
|    if (-not $resp.access_token) { throw 'the token endpoint returned no access_token.' }
|    return [string]$resp.access_token
|}
|
|function Get-SIContainerCertificateKeyFlags {
|    <# PURE. The key flags the container imports the SPN's PFX with: Exportable + PersistKeySet (the store keeps the key for
|       the life of the run). One place, so a test can pin them. #>
|    [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable -bor
|        [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::PersistKeySet
|}
|
|function Import-SIContainerCertificate {
|    <#
|        CONTAINER ONLY. The SPN's PFX arrives as a Key Vault-referenced secret (base64), exactly as the SI
|        updater receives its own. This puts it where every engine looks:
|          * CurrentUser\My, through [X509Store] (the only certificate store a Linux container has), so
|            Get-SIGraphToken, the ledger and the log ingestion find it by thumbprint;
|          * a PFX file (owner-only), so Connect-SIAzAccount -CertificatePath can sign in with it -- az and
|            the sign-in remember the PATH, not the key, so the file is kept for the life of the run.
|        Returns @{ Thumbprint; PfxPath }. Never prints the certificate or its password.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$PfxBase64,
|        [string]$Password,
|        [string]$Directory = [IO.Path]::GetTempPath(),
|        [switch]$SkipStore,
|        # TESTS ONLY: a Windows test session that cannot persist a private key (no DPAPI master key) imports with
|        # EphemeralKeySet instead. No caller in the product passes it: the container always uses Get-SIContainerCertificateKeyFlags.
|        [Parameter(DontShow)][AllowNull()][Nullable[System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]]$KeyStorageFlags = $null
|    )
|    $bytes = [Convert]::FromBase64String(($PfxBase64 -replace '\s', ''))
|    $flags = if ($null -ne $KeyStorageFlags) { [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]$KeyStorageFlags } else { Get-SIContainerCertificateKeyFlags }
|    # A Key Vault certificate's secret is a password-less PFX; '' opens those on both .NET hosts.
|    $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($bytes, [string]$Password, $flags)
|    if (-not $cert.HasPrivateKey) { throw 'the SPN certificate (SI_SPN_CERT_PFX_B64) carries no private key.' }
|
|    if (-not $SkipStore) {
|        $store = New-Object System.Security.Cryptography.X509Certificates.X509Store('My', 'CurrentUser')
|        try {
|            $store.Open('ReadWrite')
|            $store.Add($cert)
|        } finally { $store.Close() }
|    }
|
|    $pfxPath = Join-Path $Directory ('si-spn-' + [guid]::NewGuid().ToString('N') + '.pfx')
|    [IO.File]::WriteAllBytes($pfxPath, $bytes)
|    if ($PSVersionTable.PSVersion.Major -ge 6 -and -not $IsWindows) { try { & chmod 600 $pfxPath } catch { } }
|    return [pscustomobject]@{ Thumbprint = [string]$cert.Thumbprint; PfxPath = $pfxPath }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-ErrorClass.ps1'] = @{ Sha256 = 'ab3ed267218c640b0e672f593af5d33a61146cc96980f39dc70ee56e2f8bd92d'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- WHAT KIND OF FAILURE WAS IT: one error class per failed run, for the telemetry `run` record.
|
|    ExitReason says only success / success-partial / error / settings-error. A release-health view needs to tell "a
|    permission is missing" from "the service was throttling" from "the query is broken", without free text (anonymous
|    installs send no error text at all). Get-SIErrorClass maps an error to exactly ONE value of a CLOSED list -- the list
|    agreed with the receiving side; anything not recognised is 'unknown', never a guess.
|
|    It is built on the classifiers SecurityInsight already trusts:
|      * SI-KqlError.ps1 -- what a Log Analytics failure REALLY said (the response body, not "BadRequest") and whether
|        it was a missing table;
|      * working rule 4 / Risk Analysis' bucket classifier -- the recognised PLATFORM prefixes (a cancellation or a
|        service-side entity resolution carries the service's generic "Fix semantic errors" tail and is NOT a query
|        defect), then syntax / semantic / type errors = query defect, then throttle, then timeout / 5xx.
|
|    The order of the checks is the contract (first match wins):
|      settings-error > guard-refused > out-of-memory > database-full > licence-invalid > mi-unavailable > sql-login > config-missing > ingest-short-count >
|      table-missing > platform prefix (timeout / 5xx) > kql-query-defect > throttled > ingest-4xx >
|      401 / 403 by service > ai-error > platform-timeout > platform-5xx > unknown.
|    A 401 from Microsoft Graph is graph-401; a 401 from another service means the same thing as its 403 there (access
|    refused) and gets that service's -403 class.
|
|    PURE. No network. PS 5.1 safe.
|#>
|
|if (-not (Get-Command -Name Get-SIKqlErrorText -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-KqlError.ps1'))
|}
|
|# The closed list, exactly as agreed (#226). Get-SIErrorClass returns one of these and nothing else.
|function Get-SIErrorClassesState {
|    <# The value of $script:SIErrorClasses, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIErrorClasses) { $script:SIErrorClasses = @(
|    'graph-401', 'graph-403', 'defender-403', 'arm-403', 'kv-403', 'storage-403', 'sql-login', 'mi-unavailable',
|    'throttled', 'platform-timeout', 'platform-5xx', 'kql-query-defect', 'table-missing', 'ingest-4xx',
|    'ingest-short-count', 'settings-error', 'config-missing', 'licence-invalid', 'ai-error',
|    # UPLINK-FIX (Invardia, 2026-10-07): a run a guard REFUSED (nothing written, by design). The run's message is
|    # '<guard id> refused: <why>' (Get-SIGuardRefusalText) -- its own class, so a refusal never reads as 'unknown'.
|    'guard-refused',
|    # #641 (owner 2026-10-13): a Risk Analysis report that is NOT COMPLETE in its run (its rows do not match what the source
|    # holds, or it is not in the run at all) -- set by Risk Analysis itself, never derived from a message
|    'report-incomplete',
|    # #702 (1) (customer B 2026-10-15): the process ran out of memory. Its own class, never platform-timeout -- a platform
|    # class is retried in-run on the same size, which runs out again; the job-size rule raises the job one band instead.
|    # (Invardia's receiver takes any ^[a-z0-9-]{1,40}$ class -- packages/core/src/uplink.ts.)
|    'out-of-memory',
|    # #904 (a large install 2026-10-26): Azure SQL refused a write because the database reached its maximum size (1105,
|    # 40544, "has reached its size quota"). Its own class -- never 'unknown' -- so a part that failed on it opens a ticket.
|    'database-full',
|    # #913 (the ride test install 2026-10-27): an Azure SQL transient (9001 log not available, 40613 / 40501 / 40197 /
|    # 49918-49920, 4060 during a failover, 10928 / 10929, a reset connection) that did not pass within its bounded retry.
|    # Set by the caller that retried it (the pipeline runner's lock), never derived from a text: not a product defect.
|    'transient-sql',
|    # 3.0.30: the web app's identity has no grant on its Key Vault key (the updater only checks it; setup makes it) -- the
|    # customer's action with the command, never arm-403 (that is a real 403 answer). Set by the caller, never derived from a text.
|    'grant-missing',
|    'unknown'
|) }
|    , $script:SIErrorClasses
|}
|$script:SIErrorClasses = $null; $null = Get-SIErrorClassesState
|
|# #904: the numbers of Azure SQL's "the database is full" refusal (1105: no space in the filegroup; 40544: the database
|# reached its size quota; 1101: no new page could be allocated)
|function Get-SIDatabaseFullNumbersState {
|    <# The value of $script:SIDatabaseFullNumbers, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIDatabaseFullNumbers) { $script:SIDatabaseFullNumbers = @(1105, 40544, 1101) }
|    , $script:SIDatabaseFullNumbers
|}
|$script:SIDatabaseFullNumbers = $null; $null = Get-SIDatabaseFullNumbersState
|
|# Risk Analysis' recognised platform-failure prefixes (RA-GraphHunting.ps1, $script:RAPlatformFailurePrefixes). Read
|# from there when Risk Analysis is loaded, so the two can never disagree; this copy serves every other engine. A test
|# compares the two lists.
|function Get-SIErrorPlatformPrefixesState {
|    <# The value of $script:SIErrorPlatformPrefixes, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIErrorPlatformPrefixes) { $script:SIErrorPlatformPrefixes = @(
|    @{ Pattern = 'Query cancelled on creation'; Class = 'platform-timeout' }
|    @{ Pattern = 'ScalarEvaluator\.Evaluate failed'; Class = 'platform-timeout' }
|    @{ Pattern = 'Errors occurred while resolving remote entities'; Class = 'platform-5xx' }
|) }
|    , $script:SIErrorPlatformPrefixes
|}
|$script:SIErrorPlatformPrefixes = $null; $null = Get-SIErrorPlatformPrefixesState
|
|function Get-SIErrorClasses { (Get-SIErrorClassesState) }
|
|function Test-SIDatabaseFullError {
|    <#
|        PURE. #904: did Azure SQL refuse a write because the database is FULL? -Value: an ErrorRecord, an exception (its
|        SqlException numbers and inner exceptions are read) or a text. SQL 1105 / 40544 / 1101, "has reached its size quota",
|        "filegroup is full", "Could not allocate space" / "Could not allocate a new page".
|    #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $false }
|    $ex = if ($Value -is [System.Exception]) { $Value } elseif ($Value -is [System.Management.Automation.ErrorRecord]) { $Value.Exception } else { $null }
|    $texts = New-Object System.Collections.Generic.List[string]
|    while ($ex) {
|        if ($ex -is [System.Data.SqlClient.SqlException]) { foreach ($er in @($ex.Errors)) { if ((Get-SIDatabaseFullNumbersState) -contains [int]$er.Number) { return $true } } }
|        $texts.Add([string]$ex.Message); $ex = $ex.InnerException
|    }
|    if (-not $texts.Count) { $texts.Add([string]$Value) }
|    $t = $texts -join ' | '
|    return [bool]($t -match '(?i)has reached its size quota|filegroup is full|Could not allocate (space|a new page)|\b(Error|Msg|Number)[ :=]*(1105|40544)\b|\((1105|40544)\)')
|}
|
|function Get-SITransientKind {
|    <#
|        PURE. THE ONE DECISION of what a failed call or a failure text REALLY was (2026-10-22: a "Connection timed out" to
|        SI's own storage was reported to the owner as "Microsoft throttled this run"):
|          throttled    Microsoft asked us to slow down -- ONLY a real throttling answer: HTTP 429, "Too Many Requests", a
|                       rate limit, SQL 40501 / 10928 / 10929 (the service is busy / resource limit)
|          timeout      no answer in time: HTTP 408 / 504, SQL -2, "timed out" / "timeout" / a cancelled task
|          unavailable  the service could not be reached or failed: HTTP 500 / 502 / 503, no answer at all (status 0 without a
|                       timeout), a reset / refused / closed connection, a host that does not resolve, SQL 40613 / 40197 /
|                       49918-49920 / 10053 / 10054 / 233 / 64
|          error        anything else (a refusal, a bug, a bad request) -- never retried as transient
|        -StatusCode (an HTTP status; 0 = no answer; -1 = not known), -Message (the error text), -SqlNumber (SqlException numbers).
|        SecurityInsight's OWN customer sentence ("Microsoft throttled this run ...") is taken out of the text first, so a
|        re-read log never classifies itself.
|    #>
|    param([int]$StatusCode = -1, [AllowNull()][AllowEmptyString()][string]$Message = '', [AllowNull()][int[]]$SqlNumber = @())
|    $t = ([string]$Message) -replace '(?i)Microsoft throttled this run[^|]*', ''
|    $sql = @($SqlNumber | Where-Object { $null -ne $_ })
|    if ($StatusCode -eq 429 -or @($sql | Where-Object { $_ -in 40501, 10928, 10929 }).Count -gt 0) { return 'throttled' }
|    if ($t -match '(?i)\b429\b|Too ?Many ?Requests|\bthrottl|rate limit|RequestRateTooLarge') { return 'throttled' }
|    if ($StatusCode -in 408, 504 -or $sql -contains -2) { return 'timeout' }
|    if ($t -match '(?i)timed? ?out|timeout|TaskCanceledException|A task was canceled|operation was canceled|\b504\b|Gateway Time-?out|\b408\b') { return 'timeout' }
|    if ($StatusCode -in 500, 502, 503 -or $StatusCode -eq 0 -or @($sql | Where-Object { $_ -in 40613, 40197, 49918, 49919, 49920, 10053, 10054, 233, 64 }).Count -gt 0) { return 'unavailable' }
|    if ($t -match '(?i)\b50[0-3]\b|Internal ?Server ?Error|Bad Gateway|Service ?Unavailable|ServiceUnavailable|temporarily unavailable|is not currently available|forcibly closed|connection (was )?reset|Connection reset by peer|actively refused|No such host is known|Name or service not known|transport-level error|Unable to connect to the remote server') { return 'unavailable' }
|    'error'
|}
|
|function Test-SIOutOfMemoryText {
|    <# PURE. Does a failure text (or an exception / ErrorRecord, read with its inner exceptions) say the process ran out of
|       memory? .NET's OutOfMemoryException (also wrapped: "Exception calling ... : Exception of type
|       'System.OutOfMemoryException' was thrown", "Cannot process argument transformation on parameter 'TimeoutSec'. ..."),
|       Container Apps' OOMKilled, or SecurityInsight's own "out of memory" wording. #702 (1). #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $false }
|    $ex = if ($Value -is [System.Exception]) { $Value } elseif ($Value -is [System.Management.Automation.ErrorRecord]) { $Value.Exception } else { $null }
|    while ($ex) { if ($ex -is [System.OutOfMemoryException]) { return $true }; $ex = $ex.InnerException }
|    $t = if ($Value -is [System.Management.Automation.ErrorRecord]) { [string]$Value.Exception } else { [string]$Value }
|    return [bool]($t -match '(?i)OutOfMemoryException|\bOOMKilled\b|\bout of memory\b')
|}
|
|# WHO FIXES IT (framework §8.5 CLOSE-LOOP, Invardia 046): the classes whose fix is the CUSTOMER's configuration -- a
|# permission or consent the install's identity does not have (the five -403 classes), a licence or licensed feature it
|# lacks (licence-invalid), a setting the customer must set (config-missing, settings-error). Everything else -- sign-in
|# and token trouble, a missing table, ingestion, throttling, timeouts, service errors, guard refusals, unknown -- stays a
|# product defect: a class is put here only when its own definition above says the customer's configuration is the cause.
|function Get-SICustomerConfigClassesState {
|    <# The value of $script:SICustomerConfigClasses, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SICustomerConfigClasses) { $script:SICustomerConfigClasses = @('graph-403', 'defender-403', 'arm-403', 'kv-403', 'storage-403', 'licence-invalid', 'config-missing', 'settings-error', 'grant-missing') }
|    , $script:SICustomerConfigClasses
|}
|$script:SICustomerConfigClasses = $null; $null = Get-SICustomerConfigClassesState
|# #913: the classes that are nobody's fix -- an Azure SQL transient that did not pass within its bounded retry. No FixKind:
|# never a fix request, never a red alert (the next wake-up runs as usual).
|function Get-SINoFixClassesState {
|    <# The value of $script:SINoFixClasses, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SINoFixClasses) { $script:SINoFixClasses = @('transient-sql') }
|    , $script:SINoFixClasses
|}
|$script:SINoFixClasses = $null; $null = Get-SINoFixClassesState
|
|function Get-SICustomerConfigClasses { (Get-SICustomerConfigClassesState) }
|
|function Get-SIErrorFixKind {
|    <#
|        PURE. The FixKind of a failed report's error class: 'customer-config' for a class on the customer-configuration list,
|        'product-defect' for every other class of the closed list (and anything not on it), '' when there is no class.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$ErrorClass)
|    $c = "$ErrorClass".Trim().ToLowerInvariant()
|    if (-not $c) { return '' }
|    if ((Get-SINoFixClassesState) -contains $c) { return '' }
|    if ((Get-SICustomerConfigClassesState) -contains $c) { return 'customer-config' }
|    'product-defect'
|}
|
|function Get-SIErrorService {
|    <# PURE. Which service a failure came from, by the host or the wording it carries: graph | defender | arm | kv |
|       storage | sql | ingest | ai | loganalytics | ''. #>
|    param([AllowEmptyString()][string]$Text)
|    $t = [string]$Text
|    if ($t -match '(?i)ingest\.monitor\.azure\.com|Logs Ingestion|log ingestion|dataCollectionRules|\bDCR\b|\bDCE\b|InvalidTransformOutput') { return 'ingest' }
|    if ($t -match '(?i)openai\.azure\.com|\bOpenAI\b|content_filter|context_length_exceeded|DeploymentNotFound|chat/completions') { return 'ai' }
|    if ($t -match '(?i)api\.securitycenter\.microsoft\.com|api\.security\.microsoft\.com|security/runHuntingQuery|advanced hunting|Microsoft Defender|\bMachine\.Read\.All\b|\bThreatHunting\.Read\.All\b') { return 'defender' }
|    if ($t -match '(?i)\.vault\.azure\.net|Key ?Vault|ForbiddenByRbac|ForbiddenByPolicy|secrets get permission|getSecret/action') { return 'kv' }
|    if ($t -match '(?i)\.(blob|table|queue|file|dfs)\.core\.windows\.net|AuthorizationPermissionMismatch|AuthorizationFailure|storage account') { return 'storage' }
|    if ($t -match '(?i)database\.windows\.net|SqlException|SqlClient|\bLogin failed\b') { return 'sql' }
|    if ($t -match '(?i)management\.azure\.com|AuthorizationFailed|Microsoft\.[A-Za-z]+/[A-Za-z]+/[A-Za-z/]*(read|write|action)|\bAzure Resource Manager\b|LinkedAuthorizationFailed') { return 'arm' }
|    if ($t -match '(?i)graph\.microsoft\.com|Authorization_RequestDenied|Microsoft Graph|InvalidAuthenticationToken') { return 'graph' }
|    if ($t -match '(?i)api\.loganalytics|loganalytics\.io|Log Analytics|SEM\d{4}|SYN\d{4}') { return 'loganalytics' }
|    ''
|}
|
|function Get-SIErrorLines {
|    <#
|        PURE. A failed run's own words from its log (a run transcript, a console tail): the error that ENDED it -- the LAST
|        [ERROR] / exception / failed / refused / denied / status-code block (transcript TerminatingError markers and WARNING:
|        lines only when nothing else is there), and the lines after it up to -Max, else -- no such line --
|        the LAST -Max lines that carry text. Transcript headers / footers and the ******** frames are dropped. Never the whole
|        log: the uplink carries a few lines, and the caller redacts them (ConvertTo-AitUplinkRedacted). '' for no text.
|    #>
|    param([AllowNull()][AllowEmptyCollection()][string[]]$Lines = @(), [int]$Max = 8, [int]$MaxChars = 1800)
|    $keep = New-Object System.Collections.Generic.List[string]
|    $inHeader = $false
|    foreach ($raw in @($Lines)) {
|        $l = ([string]$raw).TrimEnd()
|        if (-not $l.Trim()) { continue }
|        if ($l -match '^\*{10,}$') { $inHeader = -not $inHeader; continue }
|        if ($inHeader) { continue }
|        if ($l -match '^(PowerShell|Windows PowerShell) transcript (start|end)|^(Start|End) time: \d{14}|^Transcript started, output file is') { continue }
|        $keep.Add($l.Trim())
|    }
|    if (-not $keep.Count) { return '' }
|    $err = '(?i)\[(ERROR|FAIL(ED)?|FATAL)\]|\bERROR\b|Exception|\bfailed\b|could not|cannot|refused|denied|Forbidden|Unauthorized|Login failed|\b(40[0-9]|429|50[0-4])\b|throttl|timed? ?out'
|    # The error that ENDED the run, not the first one in the log: every error-looking line is a candidate; the
|    # transcript's own "PS>TerminatingError(...)" / ">> TerminatingError(...)" markers (written for an error the code
|    # CAUGHT and went on after) and WARNING: lines count only when the log has no other error line. The LAST such line
|    # is taken, from the start of its block (the error lines right before it), and the lines after it up to -Max.
|    $isErr = { param($s) $s -match $err -and $s -notmatch '(?i)^\s*(VERBOSE|DEBUG)\b|\b0 (failed|errors?)\b' }
|    $isWeak = { param($s) $s -match '(?i)^\s*(PS>|>>\s*)TerminatingError\(|^\s*WARNING:' }
|    $strong = -1; $weak = -1
|    for ($i = 0; $i -lt $keep.Count; $i++) {
|        if (-not (& $isErr $keep[$i])) { continue }
|        if (& $isWeak $keep[$i]) { $weak = $i } else { $strong = $i }
|    }
|    $first = if ($strong -ge 0) { $strong } else { $weak }
|    if ($first -ge 0) {
|        $wantWeak = ($strong -lt 0)
|        while ($first -gt 0 -and (& $isErr $keep[$first - 1]) -and ($wantWeak -or -not (& $isWeak $keep[$first - 1]))) { $first-- }
|    }
|    $pick = if ($first -ge 0) { @($keep.GetRange($first, [Math]::Min($Max, $keep.Count - $first))) } else { @($keep.GetRange([Math]::Max(0, $keep.Count - $Max), [Math]::Min($Max, $keep.Count))) }
|    $t = ($pick -join "`n")
|    if ($t.Length -gt $MaxChars) { $t = $t.Substring(0, $MaxChars) }
|    $t
|}
|
|function Get-SIErrorRecordSummary {
|    <# PURE. The words of a caught error, never empty: its message, else its exception type + error id + where it was
|       raised (an exception thrown without a message reached Invardia as an empty text -- si-trend x5). #>
|    param([AllowNull()]$ErrorRecord)
|    if ($null -eq $ErrorRecord) { return '' }
|    $ex = if ($ErrorRecord -is [System.Exception]) { $ErrorRecord } elseif ($ErrorRecord.PSObject.Properties['Exception']) { $ErrorRecord.Exception } else { $null }
|    $m = if ($ex) { "$($ex.Message)".Trim() } else { "$ErrorRecord".Trim() }
|    if ($m) { return $m }
|    $parts = New-Object System.Collections.Generic.List[string]
|    if ($ex) { $parts.Add($ex.GetType().FullName) }
|    if ($ErrorRecord.PSObject.Properties['FullyQualifiedErrorId'] -and "$($ErrorRecord.FullyQualifiedErrorId)".Trim()) { $parts.Add("id $($ErrorRecord.FullyQualifiedErrorId)") }
|    if ($ErrorRecord.PSObject.Properties['InvocationInfo'] -and $ErrorRecord.InvocationInfo -and $ErrorRecord.InvocationInfo.ScriptName) { $parts.Add(('at {0}:{1}' -f (Split-Path -Leaf $ErrorRecord.InvocationInfo.ScriptName), $ErrorRecord.InvocationInfo.ScriptLineNumber)) }
|    if (-not $parts.Count) { return 'an error without a message' }
|    'an error without a message (' + ($parts -join ', ') + ')'
|}
|
|function Get-SIErrorClass {
|    <#
|        PURE. The error class of one failure -- exactly one value of Get-SIErrorClasses.
|          -ErrorRecord  an ErrorRecord or an exception (its message, response body, typed body and inner exceptions are
|                        all read -- Get-SIKqlErrorText)
|          -Message      a text (a run-health ErrorMessage, a log line)
|          -ExitReason   the run's ExitReason: 'settings-error' is its own class whatever the text says
|          -Service      a hint when the caller knows which service it called (graph, defender, arm, kv, storage, sql,
|                        ingest, ai) -- used when the text does not name one
|    #>
|    param([AllowNull()]$ErrorRecord, [AllowEmptyString()][AllowNull()][string]$Message, [AllowEmptyString()][string]$ExitReason, [AllowEmptyString()][string]$Service)
|    if ($ExitReason -eq 'settings-error') { return 'settings-error' }
|    if ("$Message" -match '^[a-z0-9][a-z0-9.-]{0,99} refused: ') { return 'guard-refused' }
|    $parts = New-Object System.Collections.Generic.List[string]
|    if ($null -ne $ErrorRecord) { $parts.Add((Get-SIKqlErrorText -ErrorRecord $ErrorRecord)) }
|    if ($Message) { $parts.Add($Message) }
|    $t = ($parts | Where-Object { $_ }) -join ' | '
|    # #702 (1): out of memory ANYWHERE in the text wins over every service / platform word around it (customer B's
|    # "... parameter 'TimeoutSec'. Exception of type 'System.OutOfMemoryException' was thrown" read as platform-timeout)
|    if ((Test-SIOutOfMemoryText $t) -or ($null -ne $ErrorRecord -and (Test-SIOutOfMemoryText $ErrorRecord))) { return 'out-of-memory' }
|    if ([string]::IsNullOrWhiteSpace($t)) { return 'unknown' }
|    # #904: the database is full -- before every service / platform word (its text names SQL and often a timeout)
|    if ((Test-SIDatabaseFullError $t) -or ($null -ne $ErrorRecord -and (Test-SIDatabaseFullError $ErrorRecord))) { return 'database-full' }
|    # 2026-10-29: a temporary Azure SQL error that outlasted SecurityInsight's own retry is TAGGED by the code that retried
|    # it -- its message ends "-- transient-sql" (SI-DataSql.ps1, the pipeline lock); the step's log carries that line, so the
|    # pipeline's report of the step names the platform's class, never a product defect
|    if ($t -match '(?i)--\s*transient-sql\b') { return 'transient-sql' }
|    $svc =Get-SIErrorService -Text $t
|    if (-not $svc -and $Service) { $svc = $Service.ToLowerInvariant() }
|
|    # ---- the run's own configuration ----------------------------------------------------------------------------------
|    if ($t -match '(?i)SecurityInsight Pro: .*settings database|in the settings database are not valid|settings documents could not be prepared') { return 'settings-error' }
|    if ($t -match '(?i)\blicen[cs]e\b.*\b(invalid|not valid|expired|signature verification FAILED|tampered|no entitlement|not readable|could not be read|does not include feature|names no SecurityInsight Pro edition|does not list it)\b|no \.(pimlicense|silicense|aitlicense)|not an AutomateIT licence|signature verification FAILED.*licensing key') { return 'licence-invalid' }
|
|    # ---- identity / sign-in -----------------------------------------------------------------------------------------
|    if ($t -match '(?i)ManagedIdentityCredential|No Managed Identity endpoint|169\.254\.169\.254|IDENTITY_ENDPOINT|\bIMDS\b|MSI endpoint|managed identity.*(unavailable|not available|not found|could not|failed|is not loaded)|identity token helper is not loaded') { return 'mi-unavailable' }
|    if ($t -match "(?i)Login failed for user|Cannot open (server|database) .* requested by the login|\b18456\b|token-identified principal") { return 'sql-login' }
|    if ($t -match "(?i)Cannot (bind|validate) argument (to|on) parameter '(Az)?(ApplicationId|AppId|TenantId|ClientId|CertificateThumbprint|Thumbprint|SubscriptionId|VaultName|WorkspaceId|DcrImmutableId|DceUri|ServicePrincipal\w*)' because it is (an empty string|null)|is not (set|configured)|not found in the configuration|the Pro database is not configured|certificate .* was not found") { return 'config-missing' }
|
|    # ---- ingestion --------------------------------------------------------------------------------------------------
|    if ($t -match '(?i)wrote fewer rows than it carried|fewer rows than (were )?(sent|posted|expected)|short count|rows? (were )?(lost|dropped) (at|during) ingest|accepted \d+ of \d+ rows') { return 'ingest-short-count' }
|
|    # ---- Log Analytics / advanced hunting: the query and the tables -------------------------------------------------
|    # #876: a 'union' leaf says "table expression", a 'where' leaf "table or column expression" -- both: the table is not there
|    if ($t -match "Failed to resolve table (?:or column )?expression named \\?['""]?([A-Za-z0-9_]+)") {
|        $name = $Matches[1]
|        if ($name -match '(?i)_CL$' -or $t -match '(?i)\btable\b.*(could not be found|does not exist)') { return 'table-missing' }
|    }
|    if ($t -match "(?i)\btable\b[^|]{0,120}\b(could not be found|does not exist)|unknown table|PathNotFoundError|not present in this tenant's advanced hunting schema") { return 'table-missing' }
|    foreach ($p in (Get-SIErrorPlatformPrefixesState)) { if ($t -match $p.Pattern) { return $p.Class } }
|    if ($t -match '(?i)Fix syntax errors in your query|Fix semantic errors in your query|SyntaxError|SemanticError|return types are not compatible|\bSEM\d{4}\b|\bSYN\d{4}\b|Expected: .* in query|Failed to resolve (scalar|table or column|table) expression') { return 'kql-query-defect' }
|
|    # ---- throttling -------------------------------------------------------------------------------------------------
|    # ONE decision (Get-SITransientKind): only a real throttling answer is 'throttled'. A Retry-After header alone is not
|    # (a 503 sends one too); SI's own "Microsoft throttled this run" sentence never classifies itself.
|    if ((Get-SITransientKind -Message $t) -eq 'throttled') { return 'throttled' }
|
|    # ---- status codes, by service -----------------------------------------------------------------------------------
|    $code = $null
|    if ($t -match '(?i)\((4\d\d)\)|status code (?:does not indicate success: )?(4\d\d)\b|\b(4\d\d) \((Bad Request|Unauthorized|Forbidden|Not Found|Request Entity Too Large|Conflict)\)|''(BadRequest|Unauthorized|Forbidden|NotFound|RequestEntityTooLarge)''') {
|        $code = @($Matches[1], $Matches[2], $Matches[3], $Matches[5]) | Where-Object { $_ } | Select-Object -First 1
|    }
|    $named = @{ BadRequest = '400'; Unauthorized = '401'; Forbidden = '403'; NotFound = '404'; RequestEntityTooLarge = '413' }
|    if ($code -and $named.ContainsKey($code)) { $code = $named[$code] }
|    $is401 = ($code -eq '401') -or ($t -match '(?i)\bUnauthorized\b|InvalidAuthenticationToken|token is expired|Lifetime validation failed')
|    $is403 = ($code -eq '403') -or ($t -match '(?i)\bForbidden\b|Authorization_RequestDenied|AuthorizationFailed|AuthorizationPermissionMismatch|Insufficient privileges|does not have authorization|does not have (any of )?the required|is not authorized to perform|ForbiddenByRbac|ForbiddenByPolicy|Access denied')
|    if ($svc -eq 'ingest' -and ($code -match '^4\d\d$' -or $is401 -or $is403 -or $t -match '(?i)InvalidTransformOutput|is not associated with DCR|DCE FQDN')) { return 'ingest-4xx' }
|    if ($is401 -or $is403) {
|        switch ($svc) {
|            'graph'    { if ($is401 -and -not $is403) { return 'graph-401' } else { return 'graph-403' } }
|            'defender' { return 'defender-403' }
|            'arm'      { return 'arm-403' }
|            'kv'       { return 'kv-403' }
|            'storage'  { return 'storage-403' }
|            'sql'      { return 'sql-login' }
|            'ai'       { return 'ai-error' }
|            default    { if ($is401 -and -not $is403) { return 'graph-401' } }
|        }
|    }
|
|    # ---- AI ---------------------------------------------------------------------------------------------------------
|    if ($svc -eq 'ai') { return 'ai-error' }
|
|    # ---- the platform -----------------------------------------------------------------------------------------------
|    switch (Get-SITransientKind -Message $t) {
|        'timeout'     { return 'platform-timeout' }
|        'unavailable' { return 'platform-5xx' }
|    }
|    'unknown'
|}
'@ }
$__siSupportFiles['engine/_shared/SI-KqlError.ps1'] = @{ Sha256 = 'ee8dfba0c796cb9c3a24f592a058e3b1223b4edff9a71df30d7bd65465d14221'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- what a failed Log Analytics query actually said (#221).
|
|    WHY. Az.OperationalInsights throws ErrorResponseException whose MESSAGE is only
|    "Operation returned an invalid status code 'BadRequest'". The reason -- e.g. SEM0100 "Failed to resolve table or
|    column expression named 'SI_PublicIP_Profile_CL'" -- is in the response body (Exception.Response.Content /
|    Exception.Body). Measured 2026-10-03 on 3.4.0 (container) and 3.4.1 (the development machine), PS 5.1 and pwsh 7 alike.
|    Readers that classified on the message therefore never recognised a MISSING table: on a fresh install, where a
|    profile or Risk Analysis table does not exist yet, correlation, trend and the close-loop failed outright.
|
|    A missing table is the ONLY error a reader may treat as "no data here yet". Everything else still fails loudly --
|    a throttle or timeout must never pass as an empty table (#132).
|
|    PS 5.1 safe: no ?. / ??.
|#>
|
|function Get-SIKqlErrorText {
|    <# PURE. Every text a Log Analytics query failure carries: the message, the response body, the typed body, inner
|       exceptions and ErrorDetails -- joined, so a caller can classify on what the service really said. #>
|    param([Parameter(Mandatory)][AllowNull()]$ErrorRecord)
|    if ($null -eq $ErrorRecord) { return '' }
|    $parts = New-Object System.Collections.Generic.List[string]
|    $ex = if ($ErrorRecord -is [System.Management.Automation.ErrorRecord]) { $ErrorRecord.Exception } else { $ErrorRecord }
|    if ($ErrorRecord -is [System.Management.Automation.ErrorRecord] -and $ErrorRecord.ErrorDetails -and $ErrorRecord.ErrorDetails.Message) {
|        $parts.Add([string]$ErrorRecord.ErrorDetails.Message)
|    }
|    $depth = 0
|    while ($ex -and $depth -lt 5) {
|        $parts.Add([string]$ex.Message)
|        if ($ex.PSObject.Properties['Response'] -and $ex.Response) {
|            $c = $null
|            if ($ex.Response.PSObject.Properties['Content']) { $c = $ex.Response.Content }
|            if ($c) { $parts.Add([string]$c) }
|        }
|        if ($ex.PSObject.Properties['Body'] -and $ex.Body) {
|            try { $parts.Add((ConvertTo-Json -InputObject $ex.Body -Depth 8 -Compress)) } catch { $parts.Add([string]$ex.Body) }
|        }
|        $ex = $ex.InnerException
|        $depth++
|    }
|    return (($parts | Where-Object { $_ }) -join ' | ')
|}
|
|function Get-SIKqlErrorSummary {
|    <# PURE. ONE log-ready line: the exception message plus the service's own error code(s) and the innermost
|       message, e.g. "Operation returned an invalid status code 'BadRequest' -- SemanticError/SEM0100: 'summarize'
|       operator: Failed to resolve scalar expression named 'AssetName'". Without it a query defect logs only
|       "BadRequest", which says nothing about what to fix. The bare message is kept at the front so classifiers that
|       match on it (BadRequest, TaskCanceledException, 502 ...) see exactly what they saw before. #>
|    param([Parameter(Mandatory)][AllowNull()]$ErrorRecord)
|    if ($null -eq $ErrorRecord) { return '' }
|    $ex = if ($ErrorRecord -is [System.Management.Automation.ErrorRecord]) { $ErrorRecord.Exception } else { $ErrorRecord }
|    $base = if ($ex -and $ex.PSObject.Properties['Message']) { [string]$ex.Message } else { [string]$ex }
|    $text = Get-SIKqlErrorText -ErrorRecord $ErrorRecord
|    if (-not $text) { return $base }
|    # The Log Analytics body nests the reason: error -> innererror (SemanticError / SyntaxError) -> innererror
|    # (SEM0100 ...). Collect the innererror chain of the first body found; the deepest message is the useful one.
|    $rx = '"innererror"\s*:\s*\{\s*"code"\s*:\s*"([^"]*)"\s*,\s*"message"\s*:\s*"((?:[^"\\]|\\.)*)"'
|    $ms = [regex]::Matches($text, $rx)
|    if ($ms.Count -eq 0) { return $base }
|    $codes = New-Object System.Collections.Generic.List[string]
|    $msg = ''
|    foreach ($m in $ms) {
|        $c = $m.Groups[1].Value
|        if ($codes.Contains($c)) { break }   # a second copy of the same body (typed body / ErrorDetails) starts here
|        $codes.Add($c)
|        $msg = $m.Groups[2].Value
|    }
|    try { $msg = [regex]::Unescape($msg) } catch { }
|    $detail = ('{0}: {1}' -f ($codes -join '/'), $msg)
|    if ($base -and $base.Contains($msg)) { return $base }
|    if (-not $base) { return $detail }
|    return ('{0} -- {1}' -f $base, $detail)
|}
|
|function Test-SIKqlTableMissing {
|    <# PURE. True only when the failure says THIS table does not exist in the workspace. #>
|    param([Parameter(Mandatory)][AllowNull()]$ErrorRecord, [Parameter(Mandatory)][string]$TableName)
|    $t = Get-SIKqlErrorText -ErrorRecord $ErrorRecord
|    if (-not $t) { return $false }
|    $name = [regex]::Escape($TableName)
|    # #876: a 'union' leaf says "table expression", a 'where' leaf "table or column expression" -- both: the table is not there
|    if ($t -match ("Failed to resolve table (?:or column )?expression named \\?['""]?{0}" -f $name)) { return $true }
|    if ($t -match $name -and $t -match '(?i)SEM0100|could not be found|does not exist|unknown table') { return $true }
|    return $false
|}
'@ }
$__siSupportFiles['auth/SI-PlatformConnect.ps1'] = @{ Sha256 = '2da078f5be28f13cdd78b27329c3e7d07ac19544dc3eabe9fe14c7ad53ae3d12'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- sign in on an INTERNAL (AutomateIT platform) install with no PowerShell module.
|
|    The platform framework's own sign-in lives in a PowerShell module that uses the Az / Microsoft Graph modules.
|    SecurityInsight runs with no modules, so it signs in to the platform itself, over plain REST, reading exactly what
|    the framework reads and setting exactly what the framework sets:
|
|      1. bootstrap\platform-config.json  (TenantId, SubscriptionId, KeyVaultName, BootstrapAppId, BootstrapThumbprint,
|                                          BootstrapAuth = Auto | ManagedIdentity | Certificate)
|      2. the BOOTSTRAP identity (managed identity when the host has one and it works, else its certificate) reads the
|         platform Key Vault: Modern-AppId, Modern-Thumbprint (optional), Modern-Secret (only when the certificate path
|         cannot be used)
|      3. the run signs in as the MODERN identity: certificate when its thumbprint is in Key Vault AND the certificate is
|         installed and valid here, else the secret
|      4. the framework's public contract is populated -- $global:HighPriv_Modern_* , $global:AzureTenantId,
|         $global:KV_HighPriv_*, $global:AutomationFramework, $global:Context, and the SI_SPN_* / Spn* aliases -- so every
|         consumer of those globals keeps working unchanged.
|
|    Get-SIPlatformSecret reads one platform Key Vault secret as the signed-in identity. A configuration file written for
|    the framework calls Get-PlatformSecret; when the framework's module is not loaded (it never is, in SecurityInsight)
|    a compatible Get-PlatformSecret is published that does the same over REST.
|
|    PS 5.1 safe (no ?. / ??, no RSA.ImportFromPem); works on pwsh 7. Internal installs only -- never in the Community
|    edition's code path (it runs only when bootstrap\platform-config.json exists).
|#>
|
|# NO Set-StrictMode HERE -- a dot-sourced file that sets it leaks into the caller's scope.
|
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '../engine/_shared/SI-AzRest.ps1') }
|# The managed-identity helper is loaded only when the bootstrap sign-in is a managed identity (inside Connect-SIPlatform):
|# the run's entry point owns that helper, and a run that never uses it never loads it.
|$__siCertFile = Join-Path $PSScriptRoot 'Find-SICertificate.ps1'
|if ((Test-Path -LiteralPath $__siCertFile) -and -not (Get-Command -Name Get-SICertificateFromStore -ErrorAction SilentlyContinue)) { . $__siCertFile }
|
|function Test-SIPlatformConfigDisabled {
|    <# True when this process must not use the machine's AutomateIT platform configuration: SI_PLATFORM_CONFIG = off
|       (the guided install sets it for its run -- live 2026-10-06 on the development machine the platform's subscription was used). #>
|    [string]([Environment]::GetEnvironmentVariable('SI_PLATFORM_CONFIG')) -match '^(?i)(off|0|false|no|disabled)$'
|}
|
|function Find-SIPlatformConfigPath {
|    <# bootstrap\platform-config.json, walking up from -Start (the framework's own rule). $null when there is none. #>
|    param([string]$Start = $PSScriptRoot)
|    # SI_PLATFORM_CONFIG=off: this run must not use the machine's platform (the guided install sets it for its run)
|    if (Test-SIPlatformConfigDisabled) { return $null }
|    $cur = $Start
|    while ($cur) {
|        $p = [System.IO.Path]::Combine($cur, 'bootstrap', 'platform-config.json')
|        if (Test-Path -LiteralPath $p) { return $p }
|        $parent = Split-Path -Parent $cur
|        if (-not $parent -or $parent -eq $cur) { break }
|        $cur = $parent
|    }
|    return $null
|}
|
|function Read-SIPlatformConfig {
|    <# The platform configuration; TenantId, SubscriptionId and KeyVaultName are required (as the framework requires). #>
|    param([Parameter(Mandatory)][string]$Path)
|    if (-not (Test-Path -LiteralPath $Path)) { throw ("The platform configuration was not found at {0}." -f $Path) }
|    try { $cfg = Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json }
|    catch { throw ("The platform configuration {0} could not be read: {1}" -f $Path, $_.Exception.Message) }
|    $missing = @('TenantId', 'SubscriptionId', 'KeyVaultName' | Where-Object { -not $cfg.PSObject.Properties[$_] -or [string]::IsNullOrWhiteSpace([string]$cfg.$_) })
|    if ($missing.Count) { throw ("The platform configuration {0} is missing: {1}." -f $Path, ($missing -join ', ')) }
|    return $cfg
|}
|
|function Test-SIPlatformManagedIdentityHost {
|    <# Does this host have a managed-identity endpoint (a container, an Azure Arc server, or an Azure VM whose metadata
|       endpoint answers within 3 seconds -- the framework's Auto probe)? -Probe is a test seam. #>
|    param([scriptblock]$Probe)
|    if ([Environment]::GetEnvironmentVariable('IDENTITY_ENDPOINT')) { return $true }
|    if ($Probe) { return [bool](& $Probe) }
|    try {
|        $req = [System.Net.HttpWebRequest]::Create('http://169.254.169.254/metadata/instance?api-version=2021-02-01')
|        $req.Method = 'GET'; $req.Timeout = 3000; $req.ReadWriteTimeout = 3000
|        $req.Headers['Metadata'] = 'true'
|        $resp = $req.GetResponse(); $resp.Close(); return $true
|    } catch {
|        $we = $_.Exception
|        while ($we -and -not ($we -is [System.Net.WebException])) { $we = $we.InnerException }
|        if ($we -and $we.Response) { try { $we.Response.Close() } catch { }; return $true }   # it answered: an endpoint exists
|        return $false
|    }
|}
|
|function Get-SIPlatformBootstrapAuths {
|    <# PURE (given -HasManagedIdentity). The bootstrap sign-ins to try, in order: BootstrapAuth = ManagedIdentity ->
|       the managed identity, then the certificate when the configuration has one (the framework's cross-tenant
|       fall-through); Certificate -> the certificate; Auto -> the managed identity when the host has one, then the
|       certificate. #>
|    param([Parameter(Mandatory)]$Config, [bool]$HasManagedIdentity)
|    $mode = if ($Config.PSObject.Properties['BootstrapAuth'] -and [string]$Config.BootstrapAuth) { [string]$Config.BootstrapAuth } else { 'Auto' }
|    $appId = [string]$Config.BootstrapAppId; $thumb = ([string]$Config.BootstrapThumbprint) -replace '\s', ''
|    $cert = if ($appId -and $thumb) { @{ Mode = 'Certificate'; AppId = $appId; TenantId = [string]$Config.TenantId; Thumbprint = $thumb } } else { $null }
|    $mi = @{ Mode = 'ManagedIdentity'; ClientId = '' }
|    $out = New-Object System.Collections.Generic.List[hashtable]
|    switch -Regex ($mode) {
|        '^(?i)managedidentity$' { [void]$out.Add($mi); if ($cert) { [void]$out.Add($cert) } }
|        '^(?i)certificate$'     { if ($cert) { [void]$out.Add($cert) } }
|        default                 { if ($HasManagedIdentity) { [void]$out.Add($mi) }; if ($cert) { [void]$out.Add($cert) } }
|    }
|    if ($out.Count -eq 0) {
|        throw ("The platform configuration names no usable bootstrap sign-in (BootstrapAuth = {0}; BootstrapAppId / BootstrapThumbprint {1})." -f $mode, $(if ($cert) { 'set' } else { 'missing' }))
|    }
|    return $out.ToArray()
|}
|
|function Test-SIPlatformCertificateUsable {
|    <# Is the certificate with -Thumbprint installed (LocalMachine\My or CurrentUser\My, read through X509Store -- no
|       Cert: drive needed), with its private key, and valid today? -Find is a test seam returning what
|       Get-SICertificateFromStore returns ({ Certificate; StoreLocation }) or a bare certificate, or $null.
|       #395: Get-SICertificateFromStore returns a WRAPPER. Reading NotAfter on the wrapper gave $null, `$null -le (Get-Date)`
|       is true, and every certificate -- valid until 2028 -- was reported EXPIRED: every internal install fell back to a
|       client secret it does not have, and every run failed. The certificate's own properties are read, never the wrapper's. #>
|    param([string]$Thumbprint, [scriptblock]$Find)
|    $tp = ([string]$Thumbprint).Trim() -replace '\s', ''
|    if (-not $tp) { return $false }
|    $found = if ($Find) { & $Find $tp } else { Get-SICertificateFromStore -Thumbprint $tp }
|    if (-not $found) { return $false }
|    $c = $found
|    if ($found.PSObject.Properties['Certificate'] -and $null -ne $found.Certificate) { $c = $found.Certificate }
|    if (-not ($c -is [System.Security.Cryptography.X509Certificates.X509Certificate2])) {
|        Write-Warning ("The platform certificate {0} could not be read from the certificate store. The client secret is used instead." -f $tp)
|        return $false
|    }
|    if (-not $c.HasPrivateKey) {
|        Write-Warning ("The platform certificate {0} is installed WITHOUT its private key, so it cannot sign in. Install it with the key; the client secret is used meanwhile." -f $tp)
|        return $false
|    }
|    $now = Get-Date
|    if ($c.NotAfter -le $now) {
|        Write-Warning ("The platform certificate {0} is installed but EXPIRED on {1:yyyy-MM-dd}. Renew it; the client secret is used meanwhile." -f $tp, $c.NotAfter)
|        return $false
|    }
|    if ($c.NotBefore -gt $now) {
|        Write-Warning ("The platform certificate {0} is installed but not valid before {1:yyyy-MM-dd}. The client secret is used meanwhile." -f $tp, $c.NotBefore)
|        return $false
|    }
|    return $true
|}
|
|function Read-SIPlatformBootstrapSecret {
|    <# One platform Key Vault secret read as the BOOTSTRAP identity; $null when it does not exist. #>
|    param([Parameter(Mandatory)][string]$VaultName, [Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][hashtable]$Auth)
|    $v = Get-SIKeyVaultSecretValue -VaultName $VaultName -Name $Name -Auth $Auth
|    if ($null -eq $v) { return $null }
|    return ([string]$v).Trim()
|}
|
|function New-SIPlatformContext {
|    <# The context object the framework's consumers read ($global:Context): Tenant.Id / SubscriptionId / KeyVaultName,
|       Providers.Secret = 'KeyVault', Host.Kind = 'VM'. #>
|    param([string]$TenantId, [string]$SubscriptionId, [string]$KeyVaultName)
|    [pscustomobject]@{
|        Schema       = 'AutomateIT.Context/1'
|        StartedUtc   = [datetime]::UtcNow
|        Host         = [pscustomobject]@{ Kind = 'VM'; ComputerName = $env:COMPUTERNAME; UserName = $env:USERNAME; PSVersion = $PSVersionTable.PSVersion.ToString() }
|        Tenant       = [pscustomobject]@{ Id = $TenantId; SubscriptionId = $SubscriptionId; KeyVaultName = $KeyVaultName }
|        Providers    = [pscustomobject]@{ Secret = 'KeyVault'; State = 'None'; Log = 'Stdout' }
|        SignedInBy   = 'SecurityInsight'
|    }
|}
|
|function Connect-SIPlatform {
|    <#
|        Sign in as the platform's Modern identity (see this file's header) and populate the framework's public globals.
|        -ConfigPath: bootstrap\platform-config.json (default: found walking up from -Start). Returns the context, or $null
|        when there is no platform configuration (a Community / standalone install -- nothing to do, as the framework's own
|        back-compat entry point did). Throws when the configuration exists but the sign-in cannot be completed.
|    #>
|    [CmdletBinding()]
|    param([string]$ConfigPath, [string]$Start = $PSScriptRoot, [scriptblock]$ProbeManagedIdentity)
|    if (Test-SIPlatformConfigDisabled) { return $null }
|    if (-not $ConfigPath) { $ConfigPath = Find-SIPlatformConfigPath -Start $Start }
|    if (-not $ConfigPath -or -not (Test-Path -LiteralPath $ConfigPath)) { return $null }
|    $cfg = Read-SIPlatformConfig -Path $ConfigPath
|    $tenantId = [string]$cfg.TenantId; $subId = [string]$cfg.SubscriptionId; $kv = [string]$cfg.KeyVaultName
|
|    $hasMi = Test-SIPlatformManagedIdentityHost -Probe $ProbeManagedIdentity
|    $candidates = @(Get-SIPlatformBootstrapAuths -Config $cfg -HasManagedIdentity $hasMi)
|    $boot = $null; $appId = $null; $errors = New-Object System.Collections.Generic.List[string]
|    $miFile = Join-Path (Split-Path -Parent $MyInvocation.MyCommand.ScriptBlock.File) 'SI-ManagedIdentity.ps1'
|    foreach ($a in $candidates) {
|        if ($a.Mode -eq 'ManagedIdentity' -and -not (Get-Command -Name Get-SIManagedIdentityToken -ErrorAction SilentlyContinue) -and (Test-Path -LiteralPath $miFile)) {
|            . $miFile
|        }
|        try {
|            $appId = Read-SIPlatformBootstrapSecret -VaultName $kv -Name 'Modern-AppId' -Auth $a
|            $boot = $a
|            break
|        } catch { [void]$errors.Add(('{0}: {1}' -f $a.Mode, $_.Exception.Message)) }
|    }
|    if (-not $boot) { throw ("The platform Key Vault '{0}' could not be read with the bootstrap sign-in ({1})." -f $kv, ($errors -join ' | ')) }
|    if ([string]::IsNullOrWhiteSpace($appId)) { throw ("The platform Key Vault '{0}' has no 'Modern-AppId' secret (or it is empty)." -f $kv) }
|
|    $thumb = $null
|    try { $thumb = Read-SIPlatformBootstrapSecret -VaultName $kv -Name 'Modern-Thumbprint' -Auth $boot } catch { Write-Verbose ("Modern-Thumbprint not read: {0}" -f $_.Exception.Message) }
|    $certOk = $false
|    if ($thumb) {
|        $certOk = Test-SIPlatformCertificateUsable -Thumbprint $thumb
|        if (-not $certOk) { Write-Warning ("Key Vault names the platform certificate {0}, but it is not installed (and valid) on this host; signing in with the client secret instead." -f $thumb) }
|    }
|    $secret = $null
|    if (-not $certOk) {
|        $secret = Read-SIPlatformBootstrapSecret -VaultName $kv -Name 'Modern-Secret' -Auth $boot
|        if ([string]::IsNullOrWhiteSpace($secret)) {
|            throw ("The platform identity cannot sign in on this host: no usable certificate, and the platform Key Vault '{0}' has no 'Modern-Secret'." -f $kv)
|        }
|    }
|
|    # sign in as the Modern identity (recorded; each REST call mints its token when it needs one)
|    if ($certOk) {
|        $null = Connect-SIAzAccount -ServicePrincipal -ApplicationId $appId -CertificateThumbprint $thumb -Tenant $tenantId -Subscription $subId
|    } else {
|        $cred = New-Object System.Management.Automation.PSCredential ($appId, ([System.Net.NetworkCredential]::new('', $secret).SecurePassword))
|        $null = Connect-SIAzAccount -ServicePrincipal -Credential $cred -Tenant $tenantId -Subscription $subId
|    }
|
|    $ctx = New-SIPlatformContext -TenantId $tenantId -SubscriptionId $subId -KeyVaultName $kv
|    # the framework's public contract -- the same names and values its own sign-in sets
|    $global:Context                                     = $ctx
|    $global:AzureTenantId                               = $tenantId
|    $global:HighPriv_Modern_ApplicationID_Azure         = $appId
|    $global:HighPriv_Modern_Secret_Azure                = $secret   # $null when the certificate signs in
|    $global:HighPriv_Modern_AuthMethod                  = $(if ($certOk) { 'Cert' } else { 'Secret' })
|    $global:HighPriv_Modern_CertificateThumbprint_Azure = $(if ($certOk) { $thumb } else { $null })
|    $global:KV_HighPriv_KeyVaultName                    = $kv
|    $global:KV_HighPriv_SubscriptionId                  = $subId
|    $global:AutomationFramework                         = $true
|    $global:SI_SPN_TenantId                             = $tenantId
|    $global:SI_SPN_AppId                                = $appId
|    $global:SI_SPN_Secret                               = $secret
|    $global:SpnTenantId                                 = $tenantId
|    $global:SpnClientId                                 = $appId
|    $global:SpnClientSecret                             = $secret
|    return $ctx
|}
|
|function Get-SIPlatformSecret {
|    <# One secret from the platform Key Vault ($global:Context / $global:KV_HighPriv_KeyVaultName), read as the signed-in
|       identity. THROWS when it does not exist (the framework's rule: a caller treats an optional secret as optional
|       with try/catch). -AsPlainText returns a string, else a SecureString. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$Name, [switch]$AsPlainText, $Context)
|    if (-not $Context) { $Context = $global:Context }
|    $kv = $null
|    if ($Context -and $Context.PSObject.Properties['Tenant'] -and $Context.Tenant) { $kv = [string]$Context.Tenant.KeyVaultName }
|    if (-not $kv) { $kv = [string]$global:KV_HighPriv_KeyVaultName }
|    if (-not $kv) { throw ("Get-PlatformSecret: no platform Key Vault is known in this run, so secret '{0}' was not found." -f $Name) }
|    $v = Get-SIKeyVaultSecretValue -VaultName $kv -Name $Name
|    if ($null -eq $v) { throw ("Get-PlatformSecret: secret '{0}' not found in vault '{1}'." -f $Name, $kv) }
|    if ($AsPlainText) { return [string]$v }
|    return [System.Net.NetworkCredential]::new('', [string]$v).SecurePassword
|}
|
|# A configuration file written for the framework calls Get-PlatformSecret -Context $global:Context -Name ... . The
|# framework's module is never loaded by SecurityInsight, so the same call is answered here, over REST. Published
|# globally and self-loading: configuration files are dot-sourced inside the launcher's configuration function, where
|# this file's other functions may not be visible.
|$global:SI_PlatformConnectFile = Join-Path $PSScriptRoot 'SI-PlatformConnect.ps1'
|if (-not (Get-Command -Name Get-PlatformSecret -ErrorAction SilentlyContinue)) {
|    function global:Get-PlatformSecret {
|        [CmdletBinding()]
|        param($Context, [Parameter(Mandatory)][string]$Name, [switch]$AsPlainText)
|        if (-not (Get-Command -Name Get-SIPlatformSecret -ErrorAction SilentlyContinue)) { . $global:SI_PlatformConnectFile }
|        Get-SIPlatformSecret -Name $Name -AsPlainText:$AsPlainText -Context $Context
|    }
|}
'@ }
$__siSupportFiles['auth/SI-ManagedIdentity.ps1'] = @{ Sha256 = '8198e8e891fb59de6e58fe9f8b08fe7f3f838586096d36758b85aa0e118f6673'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- sign in with a MANAGED IDENTITY: a container job's (#209), an Azure VM's or an Azure Arc
|    server's (#222).
|
|    WHY. An engine container could only sign in with an SPN client SECRET. Internal installs are certificate
|    only, and Pro is container only, so a certificate-only customer could not run Pro at all. PIM4EntraPS's
|    containers sign in as the job's managed identity; this copies that (PIM: Get-PimManagedIdentityToken).
|    #222 (operator 2026-10-03): the managed identity is the DEFAULT everywhere; an SPN stays supported.
|
|    THE ONE SWITCH. A run uses the managed identity when $global:SI_UseManagedIdentity = $true.
|        $global:SI_UAMI_ClientId = '<client id>'   optional: a USER-assigned identity; empty = the host's
|                                                    system-assigned identity
|    Who sets it: the container entry points (when the job has an identity endpoint), and on a VM the sign-in
|    decision in the config loader (auth/SI-AuthMethod.ps1). When it is off, every function below either is
|    never called or returns "not mine" -- the secret and certificate paths are exactly what they were.
|    The host decides the endpoint (Get-SIManagedIdentityHost): container IDENTITY_ENDPOINT + IDENTITY_HEADER;
|    Azure Arc IDENTITY_ENDPOINT + IMDS_ENDPOINT (401 challenge file); otherwise the Azure VM endpoint.
|
|    Log ingestion keeps its existing switch ($global:SI_PreferUami + SI_UAMI_ClientId -> -UseManagedIdentity on
|    SI's REST ingestion, which mints the token here); the container sets that from the same decision. No second
|    identity switch.
|
|    PS 5.1 safe: no ?. / ??.
|#>
|
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '../engine/_shared/SI-AzRest.ps1') }
|
|$__siFindCert = Join-Path $PSScriptRoot 'Find-SICertificate.ps1'
|if ((Test-Path -LiteralPath $__siFindCert) -and -not (Get-Command Get-SICertificateFromStore -ErrorAction SilentlyContinue)) { . $__siFindCert }
|
|if (-not (Get-Variable -Name SIManagedIdentityTokenCache -Scope Script -ErrorAction SilentlyContinue)) {
|    $script:SIManagedIdentityTokenCache = @{}   # '<clientId>|<resource>' -> @{ Token; ExpiresAt }
|}
|
|function Test-SIUseManagedIdentity {
|    <# THE switch: this run signs in as a managed identity (a container job's, an Azure VM's or an Azure Arc
|       server's -- #222). The client id is optional: empty = the host's SYSTEM-assigned identity. #>
|    return [bool]$global:SI_UseManagedIdentity
|}
|
|function Get-SIManagedIdentityHost {
|    <#
|        PURE (reads env only). Which managed-identity endpoint this host has (#222):
|          Container -- Azure Container Apps / App Service: IDENTITY_ENDPOINT + IDENTITY_HEADER
|          Arc       -- an Azure Arc-enabled server: IDENTITY_ENDPOINT + IMDS_ENDPOINT, no IDENTITY_HEADER (the Arc
|                       agent sets both machine-wide); the token needs a challenge-file handshake
|          AzureVm   -- an Azure VM (and anything else): the instance metadata endpoint 169.254.169.254
|    #>
|    param([scriptblock]$GetEnv)
|    if (-not $GetEnv) { $GetEnv = { param($n) [Environment]::GetEnvironmentVariable($n) } }
|    $ep = [string](& $GetEnv 'IDENTITY_ENDPOINT'); $hd = [string](& $GetEnv 'IDENTITY_HEADER'); $imds = [string](& $GetEnv 'IMDS_ENDPOINT')
|    if ($ep -and $hd) { return 'Container' }
|    if ($ep -and $imds) { return 'Arc' }
|    return 'AzureVm'
|}
|
|function Get-SIManagedIdentityToken {
|    <#
|        A token for -Resource as this host's managed identity (#209 container, #222 Azure VM + Azure Arc):
|          Container -- IDENTITY_ENDPOINT + X-IDENTITY-HEADER, api-version 2019-08-01, client_id when known
|          AzureVm   -- http://169.254.169.254/metadata/identity/oauth2/token, Metadata: true, client_id when known
|          Arc       -- IDENTITY_ENDPOINT (api-version 2020-06-01, Metadata: true): the first call answers 401 with
|                       'WWW-Authenticate: Basic realm=<file>'; the file's content is the secret for the second call.
|                       Reading it needs local Administrators or the 'Hybrid agent extension applications' group. Arc
|                       has the SYSTEM-assigned identity only, so no client_id.
|
|        TRAP: THE client_id IS NOT OPTIONAL IN PRACTICE for a user-assigned identity. PIM4EntraPS measured it: with a
|        user-assigned identity only, the endpoint has nothing to default to and the failure surfaces far away as
|        "Login failed" / 401. So it is always sent when known.
|
|        Cached per identity + resource until 5 minutes before the token's own expiry. -Invoke is a test seam:
|        { param($Uri, $Headers) } returning the endpoint's response (Arc: the @{Status;Body;WwwAuthenticate} shape).
|        -ReadFile is a test seam for the Arc challenge file.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$Resource,
|        [string]$ClientId,
|        [switch]$ForceRefresh,
|        [scriptblock]$Invoke,
|        [scriptblock]$ReadFile
|    )
|    # A guided install's own sign-in wins (live 2026-10-06, an AzContext install on an Azure VM got the VM's IMDS token for
|    # SQL): while $global:SI_InstallTokenProvider is set, the token comes from it and NO identity endpoint is called.
|    $installProvider = Get-Variable -Scope Global -Name SI_InstallTokenProvider -ValueOnly -ErrorAction Ignore
|    # Re-entry = the install's sign-in itself IS this host's managed identity (sign-in mode ManagedIdentity): then, and only
|    # then, the identity endpoint below answers.
|    if (($installProvider -is [scriptblock]) -and -not $global:SI_InstallTokenProviderBusy) {
|        $global:SI_InstallTokenProviderBusy = $true
|        try { $pt = [string](& $installProvider $Resource) } finally { $global:SI_InstallTokenProviderBusy = $false }
|        if ([string]::IsNullOrWhiteSpace($pt)) { throw ("the install's sign-in returned no token for '{0}'." -f $Resource) }
|        return $pt
|    }
|    # SELF-CONTAINED on purpose: it is published to the global scope and may run where this file's other functions are
|    # not visible. The host rule is Get-SIManagedIdentityHost's, repeated here.
|    $endpoint = [Environment]::GetEnvironmentVariable('IDENTITY_ENDPOINT')
|    $header   = [Environment]::GetEnvironmentVariable('IDENTITY_HEADER')
|    $imdsEp   = [Environment]::GetEnvironmentVariable('IMDS_ENDPOINT')
|    $hostKind = if ($endpoint -and $header) { 'Container' } elseif ($endpoint -and $imdsEp) { 'Arc' } else { 'AzureVm' }
|    $arcGet = {
|        param([string]$U, [hashtable]$H)
|        $req = [System.Net.HttpWebRequest]::Create($U)
|        $req.Method = 'GET'; $req.Timeout = 60000
|        foreach ($k in $H.Keys) { if ($k -eq 'Authorization') { $req.Headers['Authorization'] = [string]$H[$k] } else { $req.Headers.Add($k, [string]$H[$k]) } }
|        try { $r = $req.GetResponse() }
|        catch [System.Net.WebException] { $r = $_.Exception.Response; if (-not $r) { throw } }
|        try {
|            $sr = New-Object System.IO.StreamReader($r.GetResponseStream()); $b = $sr.ReadToEnd(); $sr.Close()
|            [pscustomobject]@{ Status = [int]$r.StatusCode; Body = $b; WwwAuthenticate = [string]$r.Headers['WWW-Authenticate'] }
|        } finally { $r.Close() }
|    }
|    if ([string]::IsNullOrWhiteSpace($ClientId)) { $ClientId = [string]$global:SI_UAMI_ClientId }
|    # The cache is created HERE, not only when this file loads: when this function runs from another scope, `$script:` is
|    # that scope and the file-level cache does not exist.
|    # Measured live 2026-10-02 (first container run on the identity): "You cannot call a method on a null-valued
|    # expression" on every token, and every Log Analytics post failed.
|    if ($null -eq $script:SIManagedIdentityTokenCache) { $script:SIManagedIdentityTokenCache = @{} }
|    $res = ($Resource -replace '/\.default$', '')
|    $key = '{0}|{1}' -f $ClientId, $res
|    if (-not $ForceRefresh -and $script:SIManagedIdentityTokenCache.ContainsKey($key)) {
|        $c = $script:SIManagedIdentityTokenCache[$key]
|        if ($c.ExpiresAt -gt [datetime]::UtcNow) { return $c.Token }
|    }
|
|    $resp = $null
|    switch ($hostKind) {
|        'Container' {
|            $uri = '{0}?resource={1}&api-version=2019-08-01' -f $endpoint, [uri]::EscapeDataString($res)
|            if (-not [string]::IsNullOrWhiteSpace($ClientId)) { $uri += '&client_id=' + [uri]::EscapeDataString($ClientId) }
|            $headers = @{ 'X-IDENTITY-HEADER' = $header }
|            $resp = if ($Invoke) { & $Invoke $uri $headers }
|                    else { Invoke-RestMethod -Method Get -Uri $uri -Headers $headers -TimeoutSec 60 }
|        }
|        'AzureVm' {
|            $uri = 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource={0}' -f [uri]::EscapeDataString($res)
|            if (-not [string]::IsNullOrWhiteSpace($ClientId)) { $uri += '&client_id=' + [uri]::EscapeDataString($ClientId) }
|            $headers = @{ 'Metadata' = 'true' }
|            $resp = if ($Invoke) { & $Invoke $uri $headers }
|                    else { Invoke-RestMethod -Method Get -Uri $uri -Headers $headers -TimeoutSec 60 }
|        }
|        'Arc' {
|            $uri = '{0}?api-version=2020-06-01&resource={1}' -f $endpoint, [uri]::EscapeDataString($res)
|            $first = if ($Invoke) { & $Invoke $uri @{ 'Metadata' = 'true' } } else { & $arcGet $uri @{ 'Metadata' = 'true' } }
|            if ([int]$first.Status -ne 401 -or [string]$first.WwwAuthenticate -notmatch '(?i)realm=(.+)$') {
|                throw ("managed identity (Azure Arc): expected a 401 challenge from {0}, got {1}. Is the Arc agent running?" -f $endpoint, $first.Status)
|            }
|            $keyFile = $Matches[1].Trim().Trim('"')
|            $secret = $null
|            try { $secret = if ($ReadFile) { & $ReadFile $keyFile } else { [System.IO.File]::ReadAllText($keyFile) } }
|            catch { throw ("managed identity (Azure Arc): cannot read the challenge file {0} -- the run must be a local Administrator or in the 'Hybrid agent extension applications' group. {1}" -f $keyFile, $_.Exception.Message) }
|            $second = if ($Invoke) { & $Invoke $uri @{ 'Metadata' = 'true'; 'Authorization' = ('Basic ' + $secret) } }
|                      else { & $arcGet $uri @{ 'Metadata' = 'true'; 'Authorization' = ('Basic ' + $secret) } }
|            if ([int]$second.Status -ne 200) { throw ("managed identity (Azure Arc): the identity endpoint refused the token request ({0})." -f $second.Status) }
|            $resp = $second.Body | ConvertFrom-Json
|        }
|    }
|    $token = [string]$resp.access_token
|    if ([string]::IsNullOrWhiteSpace($token)) {
|        throw ("managed identity ({2}): the identity endpoint returned no token for '{0}' (client id {1}). Is that identity assigned to this host / job?" -f $res, $ClientId, $hostKind)
|    }
|
|    $expiresAt = [datetime]::UtcNow.AddMinutes(50)
|    $epoch = 0L
|    if ([long]::TryParse([string]$resp.expires_on, [ref]$epoch) -and $epoch -gt 0) {
|        $expiresAt = [DateTimeOffset]::FromUnixTimeSeconds($epoch).UtcDateTime.AddMinutes(-5)
|    } else {
|        $secs = 0
|        if ([int]::TryParse([string]$resp.expires_in, [ref]$secs) -and $secs -gt 600) { $expiresAt = [datetime]::UtcNow.AddSeconds($secs - 300) }
|    }
|    $script:SIManagedIdentityTokenCache[$key] = @{ Token = $token; ExpiresAt = $expiresAt }
|    # #232 -- the licence is checked against the tenant the identity REALLY lives in. A managed identity's token always
|    # comes from its home tenant, whatever the configuration claims, so its 'tid' claim is the proof; a configured tenant
|    # id is not (a copied licence plus an edited config would otherwise pass). Recorded from every real token.
|    try {
|        $seg = $token.Split('.')
|        if ($seg.Count -ge 2) {
|            $p = $seg[1].Replace('-', '+').Replace('_', '/'); while ($p.Length % 4) { $p += '=' }
|            $tid = [string](([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($p))) | ConvertFrom-Json).tid
|            if ($tid -match '^[0-9a-fA-F-]{36}$') { $global:SI_IdentityTokenTenantId = $tid.ToLowerInvariant() }
|        }
|    } catch { }
|    try { [System.Console]::Out.WriteLine(("  [mi] token for {0} via the {2} identity endpoint (len {1})" -f $res, $token.Length, $hostKind)) } catch { }
|    return $token
|}
|
|function Get-SIAccessToken {
|    <#
|        "A token for resource X as the identity this run uses." The managed identity when the switch is on;
|        otherwise the run's own sign-in (Get-SIAzAccessToken, over REST).
|    #>
|    param([Parameter(Mandatory)][string]$Resource, [switch]$ForceRefresh)
|    if (Test-SIUseManagedIdentity) { return (Get-SIManagedIdentityToken -Resource $Resource -ForceRefresh:$ForceRefresh) }
|    $t = Get-SIAzAccessToken -ResourceUrl $Resource -ErrorAction Stop
|    if ($t.Token -is [System.Security.SecureString]) { return [System.Net.NetworkCredential]::new('', $t.Token).Password }
|    return [string]$t.Token
|}
'@ }
$__siSupportFiles['auth/Get-SIKvSecret.ps1'] = @{ Sha256 = '0072740691d0711931706bdd1e2b18434a4d090557226e5b0a3a496d6f3715ec'; Text = @'
|#Requires -Version 5.1
|<#
|    Get-SIKvSecret -- runtime KV secret fetch for SecurityInsight engines.
|
|    Designed to be called from config/SecurityInsight.custom.ps1 at config-
|    load time so high-value secrets (Storage account keys, Shodan API key,
|    Azure OpenAI key) live ONLY in Key Vault and are pulled fresh into
|    in-memory globals on every launcher run -- never persisted to disk.
|
|    Auth strategy (in order) -- plain REST, no PowerShell module:
|      1. The run's own sign-in (what the launcher recorded with Connect-SIAzAccount, else the configured
|         SPN certificate / secret)
|      2. Otherwise a Managed Identity: user-assigned via $global:SI_ManagedIdentityClientId /
|         SI_KvMiClientId / SI_UAMI_ClientId when set, else the system-assigned one (typical internal VM)
|
|    Returns the secret as a plain string. Caller assigns it to a $global:
|    variable that the engines read.
|
|    Example use in config/SecurityInsight.custom.ps1:
|        . "$PSScriptRoot\..\auth\Get-SIKvSecret.ps1"
|        $kv = '<your-key-vault-name>'
|        $global:SI_Shodan_ApiKey = Get-SIKvSecret -VaultName $kv -SecretName 'SI-Shodan-ApiKey'
|        $global:OpenAI_apiKey    = Get-SIKvSecret -VaultName $kv -SecretName 'OpenAI-ApiKey'
|
|    Storage needs no secret: it is reached with the signed-in identity's Storage
|    Blob/Table/Queue Data Contributor roles.
|
|    Notes
|    -----
|    * PS 5.1 safe (no -AsPlainText switch which is PS 7+).
|    * No PowerShell module needed: the secret is read over REST (engine/_shared/SI-AzRest.ps1).
|    * No fallback to plaintext globals -- this helper is opt-in. If the
|      customer prefers plaintext, just don't call it.
|    * Returns $null (NOT throws) when the secret doesn't exist OR the
|      caller lacks Get-Secret RBAC -- engines will throw their own missing-
|      value error which is more actionable than a KV stack trace.
|#>
|
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '../engine/_shared/SI-AzRest.ps1') }
|
|function Get-SIKvSecret {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$VaultName,
|        [Parameter(Mandatory)][string]$SecretName
|    )
|
|    # ---- 1. Make sure a sign-in is known (recorded; the token is minted over REST on the read) ----
|    $ctx = Get-SIAzContext -ErrorAction SilentlyContinue
|    if (-not $ctx) {
|        # Try managed identity first (system-assigned, then user-assigned via global)
|        try {
|            # #222: the install's one managed-identity client id; SI_KvMiClientId is the older name.
|            $kvMi = if ($global:SI_ManagedIdentityClientId) { [string]$global:SI_ManagedIdentityClientId }
|                    elseif ($global:SI_KvMiClientId) { [string]$global:SI_KvMiClientId }
|                    else { [string]$global:SI_UAMI_ClientId }
|            if ($kvMi) {
|                Connect-SIAzAccount -Identity -AccountId $kvMi -WarningAction SilentlyContinue -ErrorAction Stop | Out-Null
|            } else {
|                Connect-SIAzAccount -Identity -WarningAction SilentlyContinue -ErrorAction Stop | Out-Null
|            }
|        } catch {
|            throw "Get-SIKvSecret: no sign-in is configured and the managed identity could not be used. Either run on an Azure VM with a managed identity assigned, or configure the SecurityInsight sign-in before loading custom.ps1. Inner: $($_.Exception.Message)"
|        }
|    }
|
|    # ---- 2. Pull the secret ----
|    try {
|        $sec = Get-SIAzKeyVaultSecret -VaultName $VaultName -Name $SecretName -ErrorAction Stop
|    } catch {
|        Write-Warning ("Get-SIKvSecret: failed to read '{0}' from KV '{1}': {2}" -f $SecretName, $VaultName, $_.Exception.Message)
|        return $null
|    }
|    if (-not $sec) { return $null }
|
|    # PS 5.1: convert SecureString -> plain text via NetworkCredential
|    return [System.Net.NetworkCredential]::new('', $sec.SecretValue).Password
|}
'@ }
$__siSupportFiles['engine/_shared/AitLicense.ps1'] = @{ Sha256 = 'b430fd4a5f8850e5ef0439b66c4b1f2e6798f0f5a563a2c195d15c1ec0e357f3'; Text = @'
|#Requires -Version 5.1
|<#
|.SYNOPSIS
|    LIC-1 -- the FRAMEWORK licence verifier. One implementation, every solution.
|
|.DESCRIPTION
|    The licence FORMAT is framework-wide by design: a customer holding one file for two
|    products must get identical semantics from both. LIC-1 therefore rules out the obvious
|    shortcut -- "Not chosen: copying PIM's verifier into SI ... two verifiers would drift
|    into two meanings of the same file" -- and LIC-3 places the verifier here, "beside
|    sync/_AitRings.ps1 as shared code that PIM and SI both call, with each solution keeping
|    only its own feature list."
|
|    So this file owns VERIFICATION. It deliberately owns nothing else:
|
|      here (framework)     : signature, validity window, grace, tenant binding, feature match
|      per solution         : the feature CATALOG, and what a gated feature does when refused
|
|    File format, as emitted by TOOLS/New-AitLicense.ps1:
|      { "product": "...", "payloadB64": "<b64 payload JSON>", "signature": "<b64 RSA sig>" }
|      payload: { licenseId, customer, sku, features[], tenantIds[], validFrom, validTo, graceDays }
|
|    Signature is RSA-SHA256 / PKCS#1 over the RAW PAYLOAD BYTES -- verified against the exact
|    payloadB64 bytes, never a re-serialised object, so JSON canonicalisation can never change
|    the answer.
|
|    🔒 OFFLINE. No activation, no call-home, no endpoint. Customers on locked-down automation
|    servers need nothing but the file. Only the PUBLIC certificate is embedded; the private key
|    never leaves the development machine.
|
|    🪤 SIGNED != FOUND (LIC-1 first issuance, 2026-09-05). The crypto half of a migration can
|    land while the DISCOVERY half does not, and the symptom -- Status=Missing -- is EXACTLY the
|    quiet resting state of an unlicensed install. The failure mode of a licensing system is
|    indistinguishable from its correct idle state, so discovery is treated as a first-class
|    concern here and tested on its own.
|
|.NOTES
|    PS 5.1: the certificate is loaded from raw bytes (X509Certificate2) and RSA comes via
|    RSACertificateExtensions. NOT RSA.ImportFromPem -- that is .NET Core 3.0+ / PS 7 only and
|    would break every customer engine, which run on 5.1.
|#>
|
|Set-StrictMode -Off
|
|# Public certificate of the framework licensing signer, CN=AutomateIT-Licensing-Service.
|# PUBLIC half only. Byte-identical to the copy PIM embeds, so a licence issued by
|# TOOLS/New-AitLicense.ps1 verifies the same under either until PIM migrates onto this file.
|$script:AitLicenseSignerCertB64 = 'MIIFFzCCAv+gAwIBAgIQNY8l3/KZOoxF7K1nXIXwazANBgkqhkiG9w0BAQsFADAnMSUwIwYDVQQDDBxBdXRvbWF0ZUlULUxpY2Vuc2luZy1TZXJ2aWNlMB4XDTI2MDgxMTEzMDY0NloXDTQ2MDgxMTEzMTE0NlowJzElMCMGA1UEAwwcQXV0b21hdGVJVC1MaWNlbnNpbmctU2VydmljZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALuth8WywLfudbaoZ6eR570apvs5LXzOeGfl5Z14z6Nl6DQgvwMLXG/8lZEHOCKsHWVtEnjZOZigsh4c16owJVhuW67OgY0Iy6OjmfeXzu+kcTICSdZ+Qj3ecsGp1Cz6Xo1AjYbgIORdqUBncy4BAuA1bxH0E+V+1zT+ltEk840xpLdWde+m7W8q7BrG9klh+xQl8xJTjeliyV0JN2mvBjI0JwB9t9vL2/luMWWtHp752/ZG4Icd9u6HyqSR/xEmlZIjkZwI7LEPLTICXV1iA3c3nFUEHkLhLlpDW6EQn3cip0Sijr7SVWEBH1fCA8vCo+PxIEgJc3RXaeRhqD4UOwPJIziHtrpy8+9L15zrhXnhIGZv2mUAHKiamUIOmKl9vj31vFp/vJx1chE0XA358T09HGu0jKgSbbC4afKQPKf3v+BHPU42T/xIOPMxDJWuFqKvr4anL7P5PEkTjycBRCkXnIPC5PlrXR/ZZz4oit4WKhbdzONYwb8CKnsF2Z9IVL9yviVJxAIr7kiGqRme9+H0t5A+hzAydxdFMQnop+R8Q02a0sei9WrdtCbwLempVVrXIS6N4hh5kvLqMouDi62b0h645UNk2cWahDIZWTKd/MYdlcdrtRt5muy2LOasHByVxUrZKwH7IetCmv+Kkm1BfMF6Fvi1Jh2Qgz4bo5XJAgMBAAGjPzA9MA4GA1UdDwEB/wQEAwIHgDAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBT+IiWP1iqSIwaRLiV1somJAQ+ELjANBgkqhkiG9w0BAQsFAAOCAgEAFiDfl7nhDNIywkCZgu9iw0RtJUyJqiq8y+fXomucqowAQZKPhkpuHftZZjtDe09WM35TqjRgL7hqmJiEgqPlRrAv78FjE41RwMcANN2PVCrdcMcuDVdRbS40rObpp0B6+uVUiWY4+8MW6G8Wv+7CIBUEP8ypo3BhxQJZLpyJDKLNiPqnTVKOmYXe7BivfVz63F2Pg2dNXic1poQ7S6JTi/8FM4AV2Ge/zVQF+LaiIuBDJX3JjHnKXxNf1Zhk8PF6DeWaVSNyXtjESlaUfsz0U2Ue87UUZ8ELIuqjHTpG66HPInblBZme6VvR13n5QxmnvjPXdtmXAJzDzCf+76labSGQu9fMFxUoKwjAwT9vHrdFw8JEStappW7urXj+Oafp1wVafJOXzjd9utr8WT3AhaPeqMx3FYH20e2b7QNCI3owtm0ogHRg36neahe78PikiMe15AUpD3+BD6pKeLV7tsExeXZjxDxhFUSpScD0TrCOUEJdKL2Cfx8rM3ceISSiTTYmuJmU7fznQ122A6GNW58mpSk8miPYb3MzbLW0JFPRrEDiyT8dW1M9s98DL+7VR0z2QxgxhNMKyrVgBM7YgQtbtPLz26NBqAQsqG50rOdn7XmprzvnTmnb+r2PUQuqb6rCTAQFTJ3MjH7BviP3GkwJyvzMZ+S6OnUAGB2Fn3Y='
|
|# LIC-4 (operator 2026-10-03): the Invardia licence signer, CN=Invardia-Licensing (thumbprint BA65E6AA62128EBE89A743722E404980F6D2878D,
|# RSA 4096, valid to 2036-10-03). PUBLIC half only. Trusted ALONGSIDE the AutomateIT signer above -- never instead of it -- so
|# every licence already issued keeps verifying, and Invardia switches its signer only after this release is rolled out.
|# Byte-identical to the copy PIM embeds (engine/_shared/PIM-License.ps1) and to SI's copy of this file.
|$script:AitLicenseInvardiaCertB64 = 'MIIFQDCCAyigAwIBAgIQXXs1IY0ZQE2MwtugYutXwDANBgkqhkiG9w0BAQsFADAdMRswGQYDVQQDExJJbnZhcmRpYS1MaWNlbnNpbmcwHhcNMjYxMDAzMTY1NDMxWhcNMzYxMDAzMTcwNDMxWjAdMRswGQYDVQQDExJJbnZhcmRpYS1MaWNlbnNpbmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCn9X21WYLer9r3ojq9lCP3eGV5YK8UMHoyyGT/q8carwQK+ztBRweKAgHyg8rr67utZ1zZBDRei64T/63nXGZpC666efzNZjIU+Og7vtO0bTNjQm/yVD/Q4KFZachYbE5orU+99HQcgRrcwnmmltyazyun2MV2CTk2nUDeMX5IIFD/1yIT8SLNFa6b6Gy4Ms/TIlc4u3lEH3zjbTSF+phSrbv7J6ytz5Eq1ahRkKHWcdBoF9GJo2ynWP0vTGHWvvjNdeVpXP1rkGnLt9MAQj2Us/2XiTgZzf26QLNiXX9YeJeUA9IVdPWczJav+YYkcICyG4ynwhPCudI6S2iDeu8jyL54gfVT871/+RFebzKHq9teY2vB0aGsbaW9VOmV5dDQ2mVfQLFTkNd1ByeZKv9tR0vPfaiZCza+DedApF2LfoAa7Y34pb9WHGRJFAPVmG2WMSsTY90Y0VBYrktF4g4q712W2ZdQc+QIxtvP5nsz6bk1QBvJ1Hcsr/euiysxmkFxcl3NH7WM1EKzdzUaYDJpysoE9e0jkjdJpb9bNNmSE7V9IMTk7r/XOiYJ+8qOALTgwUIEyOLi/hfOihJDRn31aJ6aPvzCEYikueJV5oALrDxquiXbPi8z10aMuXLL4hfi6B7U0qo2kOTPQ9Qh/cJFVkV9pEXjtY+NwwI9EtxgaQIDAQABo3wwejAOBgNVHQ8BAf8EBAMCB4AwCQYDVR0TBAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHwYDVR0jBBgwFoAUuZzWkYh3hkE0oJH42LneYVKXIzowHQYDVR0OBBYEFLmc1pGId4ZBNKCR+Ni53mFSlyM6MA0GCSqGSIb3DQEBCwUAA4ICAQCluVZnotzEyS5ux+4hMuz9mOfpSJCNg5nkS8XxIHySiE2AEjVT4ZFEyykZUFoROv5clLBkO5icvDDRBitkeKHvioZruRPtVGy0fs0VxJ4VMcOU/i5cVdJXBQeyUFE8o//4+7FXZp10ToVNv/drjdO7adcNHRVjsddm2mXPNyHmE07ErV6eInPj+r0/1dogPBW1knF+T53RTwT2O0Ppe5qK0QEdBfo5sf4nvjg7ONNXYlW38SzXGLsXy6TZphRWqxLq7u31HAwujQGy9syO+TPIzusH1WHkCsvjDDRXNI8iYhKcS2wq/P/O6O4Ebt/PFN0hxyzyuYx4kreXKKhqrfsEMDxzMUQNnUEjFgU4/4atLVJpBvoDmb/MuQDIzlhxz8obAJi5BuxyjyemR9jg6XMIE2IAhe1v+MN0ZY58tbZR3t5rF30tp541NRaJfn4DBpqNmAIFyDQMdM2FogkFoOV+Mo0IBmGzV/jyv/2z+sre1P5MncLP2qZhfFmu595gWnNoOsMdUZmEWMkbISMGvGzfpPRF3IBan+fymCZSsKNB00E3W50Sh/t2sopEYc3eSwpu6bhvPUgB2ZKU6KN49Al4Pf41uldHVY0aVVp+kpLmRntDFzkTNXUG4OWOwF5gHuGY8jIrwDR7pCPSNzDWrUf857O6DyWEsHXERWg5OPLNUg=='
|
|# Every trusted signer, in the order they are tried (a licence is valid if ANY of them verifies it).
|$script:AitLicenseTrustedCertsB64 = @($script:AitLicenseSignerCertB64, $script:AitLicenseInvardiaCertB64)
|
|# Extensions a licence may use, MOST SPECIFIC FIRST. A solution-specific file wins a tie so an
|# existing per-solution licence keeps precedence over a framework-wide one in the same folder.
|$script:AitLicenseExtensions = @('.pimlicense', '.silicense', '.aitlicense')
|
|<#
|.SYNOPSIS
|    PURE. Verify an RSA-SHA256/PKCS#1 signature over raw payload bytes.
|
|.DESCRIPTION
|    Returns $true only on a genuine match. Every failure path -- malformed certificate,
|    unusable key, bad signature -- returns $false rather than throwing, because a verifier
|    that throws on a tampered file turns "refuse this licence" into "crash the engine".
|#>
|function Test-AitLicenseSignature {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][byte[]]$PayloadBytes,
|        [Parameter(Mandatory)][byte[]]$SignatureBytes,
|        [Parameter(Mandatory)][string]$PublicCertB64
|    )
|    try {
|        $certBytes = [Convert]::FromBase64String($PublicCertB64)
|        $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2(, $certBytes)
|        $rsa  = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPublicKey($cert)
|        if (-not $rsa) { return $false }
|        return $rsa.VerifyData(
|            $PayloadBytes,
|            $SignatureBytes,
|            [System.Security.Cryptography.HashAlgorithmName]::SHA256,
|            [System.Security.Cryptography.RSASignaturePadding]::Pkcs1)
|    } catch { return $false }
|}
|
|<#
|.SYNOPSIS
|    PURE. Turn a licence document + a clock into a status. No disk, no network.
|
|.DESCRIPTION
|    Split out from any file handling deliberately: this is where every rule that matters
|    lives, so it must be testable without writing a file. `Get-AitLicense` is the thin
|    impure wrapper that finds a file and calls this.
|
|.PARAMETER Document
|    The parsed licence object ({ payloadB64, signature }).
|
|.PARAMETER TrustedCertsB64
|    Accepted signers, in order. A caller mid-migration passes its legacy key as a second
|    entry so anything already issued keeps verifying -- there is no cutover and no reissue.
|
|.PARAMETER Now
|    Injected clock. A licence verifier whose tests cannot control time can only be tested
|    on the day the fixtures happen to be valid.
|
|.OUTPUTS
|    Status: Missing | Invalid | NotYetValid | Valid | Grace | Expired
|    Core is NEVER affected by any of them -- see Test-AitLicenseFeature.
|#>
|function Resolve-AitLicenseStatus {
|    [CmdletBinding()]
|    param(
|        [Parameter()][AllowNull()][object]$Document,
|        [Parameter()][AllowNull()][string[]]$TrustedCertsB64,
|        [Parameter()][AllowNull()][object]$Now
|    )
|
|    $result = [pscustomobject]@{
|        Status     = 'Missing'; Reason = 'no licence document supplied'
|        Customer   = ''; Sku = 'Core'; LicenseId = ''
|        Features   = @(); TenantIds = @()
|        ValidFrom  = $null; ValidTo = $null; GraceUntil = $null
|    }
|    if ($null -eq $Document) { return $result }
|
|    $today = if ($Now) { ([datetime]$Now).Date } else { (Get-Date).Date }
|    $certs = @($TrustedCertsB64 | Where-Object { $_ })
|    if (-not $certs.Count) { $certs = @($script:AitLicenseTrustedCertsB64) }
|
|    try {
|        if (-not $Document.payloadB64 -or -not $Document.signature) {
|            throw "not an AutomateIT licence (payloadB64/signature missing)"
|        }
|        $payloadBytes = [Convert]::FromBase64String("$($Document.payloadB64)")
|        $sigBytes     = [Convert]::FromBase64String("$($Document.signature)")
|
|        # Try every trusted signer. Order matters only for speed -- a licence is valid if ANY
|        # trusted key verifies it, which is what makes a signer migration a non-event.
|        $ok = $false
|        foreach ($c in $certs) {
|            if (Test-AitLicenseSignature -PayloadBytes $payloadBytes -SignatureBytes $sigBytes -PublicCertB64 $c) { $ok = $true; break }
|        }
|        if (-not $ok) {
|            $result.Status = 'Invalid'
|            $result.Reason = 'signature verification FAILED (file tampered, or not issued by a trusted AutomateIT licensing key)'
|            return $result
|        }
|
|        $p = [System.Text.Encoding]::UTF8.GetString($payloadBytes) | ConvertFrom-Json
|        $result.Customer  = "$($p.customer)"
|        $result.Sku       = "$($p.sku)"
|        $result.LicenseId = "$($p.licenseId)"
|        $result.Features  = @($p.features  | Where-Object { $_ })
|        $result.TenantIds = @($p.tenantIds | Where-Object { $_ })
|        # InvariantCulture, always. On da-DK "08/27/2026" parses as day 8 of month 27 and throws;
|        # the same locale bug already ate a promotedUtc stamp once (RING-7).
|        $result.ValidFrom = [datetime]::Parse("$($p.validFrom)", [System.Globalization.CultureInfo]::InvariantCulture).Date
|        $result.ValidTo   = [datetime]::Parse("$($p.validTo)",   [System.Globalization.CultureInfo]::InvariantCulture).Date
|
|        $graceDays = 30
|        if ($p.PSObject.Properties.Name -contains 'graceDays' -and "$($p.graceDays)" -match '^\d+$') { $graceDays = [int]$p.graceDays }
|        $result.GraceUntil = $result.ValidTo.AddDays($graceDays)
|
|        if     ($today -lt $result.ValidFrom)  { $result.Status = 'NotYetValid'; $result.Reason = "licence starts $($result.ValidFrom.ToString('yyyy-MM-dd'))" }
|        elseif ($today -le $result.ValidTo)    { $result.Status = 'Valid';       $result.Reason = "valid until $($result.ValidTo.ToString('yyyy-MM-dd'))" }
|        elseif ($today -le $result.GraceUntil) { $result.Status = 'Grace';       $result.Reason = "EXPIRED $($result.ValidTo.ToString('yyyy-MM-dd')) -- grace until $($result.GraceUntil.ToString('yyyy-MM-dd')), renew now" }
|        else                                   { $result.Status = 'Expired';     $result.Reason = "expired $($result.ValidTo.ToString('yyyy-MM-dd')) (grace ended $($result.GraceUntil.ToString('yyyy-MM-dd')))" }
|    } catch {
|        $result.Status = 'Invalid'
|        $result.Reason = "licence could not be read: $($_.Exception.Message)"
|    }
|    return $result
|}
|
|<#
|.SYNOPSIS
|    PURE. Is this licence bound to the tenant we are actually running against?
|
|.DESCRIPTION
|    An EMPTY or absent tenantIds list means "any tenant" -- that is the deliberate shape for
|    a site licence. A non-empty list binds, and the binding is the Entra tenant GUID.
|
|    🔒 A licence that names other tenants is NOT a licence for this one. That is the whole
|    point of binding, and it is why LIC-2 refuses to let a per-tenant licence be baked into a
|    build context shared by three tenants' images.
|#>
|function Test-AitLicenseTenant {
|    [CmdletBinding()]
|    param(
|        [Parameter()][AllowNull()][object]$License,
|        [Parameter()][AllowNull()][string]$TenantId
|    )
|    if ($null -eq $License) { return $false }
|    $ids = @($License.TenantIds | Where-Object { $_ })
|    # LIC anti-copy (operator 2026-10-03): a licence that names NO tenant is valid in NO tenant -- it used to be valid in
|    # every tenant, which made a copied file work anywhere. Every licence ever issued names its tenant(s).
|    if (-not $ids.Count) { return $false }
|    if (-not "$TenantId".Trim()) { return $false }      # bound, but we do not know who we are
|    foreach ($i in $ids) { if ("$i".Trim() -ieq "$TenantId".Trim()) { return $true } }
|    return $false
|}
|
|<#
|.SYNOPSIS
|    PURE. May this feature run?
|
|.DESCRIPTION
|    🔒 THE INVARIANT (LIC-1): a REQUIRED capability must never be Pro, and Core is never
|    affected by licence state. So this answers only for features a catalog has declared Pro;
|    everything else is free and must never be routed through here.
|
|    Grace counts as entitled -- that is what a grace window is for. Expired and Invalid do not.
|    '*' in the feature list means every Pro feature, which is how a site licence is expressed.
|
|.PARAMETER Enforce
|    🔒 ENFORCEMENT SHIPS OFF (LIC-1). With -Enforce absent, this returns $true with a reason
|    saying so: every feature behaves as though licensed, with no nag. That is what makes it
|    safe to issue licences to all ~30 customers and populate the registry BEFORE anything is
|    gated -- the rollout and the enforcement are separate events, and only the second one can
|    break somebody.
|#>
|function Test-AitLicenseFeature {
|    [CmdletBinding()]
|    param(
|        [Parameter()][AllowNull()][object]$License,
|        [Parameter(Mandatory)][string]$Feature,
|        [Parameter()][AllowNull()][string]$TenantId,
|        [switch]$Enforce
|    )
|
|    if (-not $Enforce) {
|        return [pscustomobject]@{ Allowed = $true; Reason = 'enforcement is OFF -- every feature runs (LIC-1 default posture)' }
|    }
|    if ($null -eq $License -or $License.Status -notin @('Valid', 'Grace')) {
|        $st = if ($License) { "$($License.Status)" } else { 'Missing' }
|        return [pscustomobject]@{ Allowed = $false; Reason = "no entitlement: licence status is $st" }
|    }
|    if (-not (Test-AitLicenseTenant -License $License -TenantId $TenantId)) {
|        return [pscustomobject]@{ Allowed = $false; Reason = "licence '$($License.Customer)' is not valid for tenant $TenantId" }
|    }
|    $feats = @($License.Features | Where-Object { $_ })
|    if ($feats -contains '*')       { return [pscustomobject]@{ Allowed = $true; Reason = "site licence ('*') covers '$Feature'" } }
|    foreach ($f in $feats) { if ("$f".Trim() -ieq "$Feature".Trim()) { return [pscustomobject]@{ Allowed = $true; Reason = "licensed for '$Feature'" } } }
|    return [pscustomobject]@{ Allowed = $false; Reason = "licence does not include feature '$Feature'" }
|}
|
|<#
|.SYNOPSIS
|    Find a licence file in a directory. IMPURE (disk), and separated for exactly that reason.
|
|.DESCRIPTION
|    🪤 THIS FUNCTION IS WHY LIC-1's FIRST ISSUANCE FAILED. The issuer wrote
|    `<customer>.aitlicense` while discovery globbed `*.pimlicense` only, so a correctly signed
|    licence reported Status=Missing -- indistinguishable from having no licence at all.
|    Accept EVERY known extension, most specific first.
|#>
|function Find-AitLicenseFile {
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$Directory)
|
|    if (-not (Test-Path -LiteralPath $Directory)) { return $null }
|    $rank = @{}
|    for ($i = 0; $i -lt $script:AitLicenseExtensions.Count; $i++) { $rank[$script:AitLicenseExtensions[$i]] = $i }
|
|    $f = Get-ChildItem -LiteralPath $Directory -File -ErrorAction SilentlyContinue |
|             Where-Object { $script:AitLicenseExtensions -contains $_.Extension.ToLowerInvariant() } |
|             Sort-Object @{ Expression = { $rank[$_.Extension.ToLowerInvariant()] } }, Name |
|             Select-Object -First 1
|    if ($f) { return $f.FullName }
|    return $null
|}
|
|<#
|.SYNOPSIS
|    Load + verify a licence. The thin impure wrapper over Resolve-AitLicenseStatus.
|
|.PARAMETER Path
|    A specific licence file. Wins over -Directory, and is what tests use.
|
|.PARAMETER Directory
|    Where to look when no -Path is given.
|#>
|function Get-AitLicense {
|    [CmdletBinding()]
|    param(
|        [Parameter()][AllowNull()][string]$Path,
|        [Parameter()][AllowNull()][string]$Directory,
|        [Parameter()][AllowNull()][string[]]$TrustedCertsB64,
|        [Parameter()][AllowNull()][object]$Now
|    )
|
|    $file = if ("$Path".Trim()) { $Path } elseif ("$Directory".Trim()) { Find-AitLicenseFile -Directory $Directory } else { $null }
|
|    if (-not $file -or -not (Test-Path -LiteralPath $file)) {
|        $r = Resolve-AitLicenseStatus -Document $null -TrustedCertsB64 $TrustedCertsB64 -Now $Now
|        $r.Reason = 'no .pimlicense / .silicense / .aitlicense file found'
|        Add-Member -InputObject $r -NotePropertyName Path -NotePropertyValue '' -Force
|        return $r
|    }
|
|    $doc = $null
|    try { $doc = Get-Content -LiteralPath $file -Raw -Encoding UTF8 | ConvertFrom-Json } catch { $doc = $null }
|    $res = Resolve-AitLicenseStatus -Document $doc -TrustedCertsB64 $TrustedCertsB64 -Now $Now
|    if ($null -eq $doc) { $res.Status = 'Invalid'; $res.Reason = 'licence file is not readable JSON' }
|    Add-Member -InputObject $res -NotePropertyName Path -NotePropertyValue $file -Force
|    return $res
|}
'@ }
$__siSupportFiles['setup/_shared/SI-SetupAzure.ps1'] = @{ Sha256 = 'c54979b69ba2b3fabde3641cf7fb820bf6ed4e956a2acc43d2c0c5d980144200'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight SETUP -- Azure with NO PowerShell modules: native REST, ARM and .NET only.
|
|    Dot-source this ONE file at the top of a setup script (setup\, setup\ConfigWizard\backend\, Bootstrap-*, Setup-*):
|
|        . (Join-Path $PSScriptRoot 'setup\_shared\SI-SetupAzure.ps1')      # from the solution root
|        . (Join-Path $PSScriptRoot '_shared\SI-SetupAzure.ps1')            # from setup\
|        Connect-SISetupAzure -TenantId $tid -SubscriptionId $sub           # a person, or an app (see below)
|
|    It loads the engine's REST layer (engine/_shared/SI-AzRest.ps1: Invoke-SIArm, Resource Graph, Key Vault secrets,
|    storage data plane, the *-SIAz* REST twins), switches this process to REST (SI_AzureAccess_Engine = 'Rest'), adds the
|    sign-in of a PERSON (SI-SetupSignIn.ps1: Azure Cloud Shell token endpoint, or the browser with code + PKCE), and adds
|    what setup needs that the engines never did: Key Vault vaults and certificates, resource providers, deleting a role
|    assignment, typed ARM reads (resources, VMs, managed identities, SQL, Azure OpenAI, tenants, Log Analytics tables)
|    and storage management (tables, containers and queues through ARM, the lifecycle policy, name availability --
|    never an account key).
|
|    Every call goes through Invoke-SIAzRestHttp (the engine's one HTTP seam), so the offline tests run it against a fake.
|
|    INSIDE AN INVARDIA SUPPORT SESSION (owner 2026-10-12) setup signs in to NOTHING itself: Connect-SISetupAzure and
|    Get-SISetupAzureContext answer from the session (engine/_shared/SI-AzRest.ps1, Get-SISupportSession -- the one place
|    that detects it), and every call goes through the session's recording command, so each change is in the
|    environment's audit log. A subscription the session does not name is refused.
|    PS 5.1 safe; pwsh 7 on Windows, Linux (Azure Cloud Shell) and macOS.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope.
|
|$__siSetupAzureRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|. ([IO.Path]::Combine($__siSetupAzureRoot, 'engine', '_shared', 'SI-AzRest.ps1'))
|. ([IO.Path]::Combine($__siSetupAzureRoot, 'engine', '_shared', 'SI-LogIngest.ps1'))
|. ([IO.Path]::Combine($__siSetupAzureRoot, 'auth', 'Find-SICertificate.ps1'))
|. ([IO.Path]::Combine($__siSetupAzureRoot, 'auth', 'SI-ManagedIdentity.ps1'))
|. ([IO.Path]::Combine($PSScriptRoot, 'SI-SetupSignIn.ps1'))
|Remove-Variable -Name __siSetupAzureRoot -ErrorAction SilentlyContinue
|
|# Setup never loads an Az module: every *-SIAz* wrapper takes its REST twin, and log ingestion its REST path.
|$global:SI_AzureAccess_Engine = 'Rest'
|$global:SI_LogIngest_Engine   = 'Rest'
|
|function Get-SIAzureToken {
|    <#
|        THE token function of the REST layer, as setup needs it: a signed-in PERSON (Connect-SISetupUser) is answered
|        from the setup sign-in; an app or a managed identity exactly as engine/_shared/SI-AzRest.ps1 does. Defined here,
|        after that file, so every REST helper -- Invoke-SIArm, the *-SIAz* twins, Key Vault, storage, Graph -- runs as
|        whoever signed in.
|    #>
|    param(
|        [ValidateSet('Arm', 'LaQuery', 'Storage', 'KeyVault', 'Graph', 'Monitor')][string]$Audience = 'Arm',
|        [string]$Resource,
|        [hashtable]$Auth,
|        [switch]$ForceRefresh
|    )
|    if (-not $Resource) { $Resource = Get-SIAzureAudience -Audience $Audience }
|    if (-not $Auth) {
|        # an Invardia Support session in the shell is setup's sign-in (never a person's or an app's beside it)
|        $null = Sync-SISupportConnection -TakeOver
|        $st = Get-SIAzRestState
|        if ($st.Connection -is [hashtable] -and $st.Connection.Mode -eq 'User') { $Auth = $st.Connection }
|    }
|    if ($Auth -and $Auth.Mode -eq 'User') { return (Get-SISetupUserToken -Resource $Resource -ForceRefresh:$ForceRefresh) }
|    # the engine's own hook ($global:SI_TokenProvider), exactly as engine/_shared/SI-AzRest.ps1 consults it
|    if (-not $Auth) {
|        $tp = Get-Variable -Scope Global -Name SI_TokenProvider -ValueOnly -ErrorAction Ignore
|        if ($tp -is [scriptblock]) { $pt = [string](& $tp $Resource); if (-not [string]::IsNullOrWhiteSpace($pt)) { return $pt } }
|    }
|    Initialize-SIAzRestHelpers
|    if (-not $Auth) { $Auth = Resolve-SIAzRestAuth }
|    return (Get-SILogIngestToken -Resource $Resource -Auth $Auth -ForceRefresh:$ForceRefresh)
|}
|# published globally too: a child script that loads only the engine file still finds the setup sign-in
|Set-Item -Path 'function:global:Get-SIAzureToken' -Value ${function:Get-SIAzureToken}
|
|# =====================================================================================================================
|#  Sign-in: one entry point for a person, an app or a managed identity
|# =====================================================================================================================
|
|function Connect-SISetupAzure {
|    <#
|        Signs this PowerShell process in to Azure for setup. No module, no Connect-AzAccount.
|          -ApplicationId + -CertificateThumbprint   an app with a certificate (LocalMachine\My or CurrentUser\My)
|          -ApplicationId + -ClientSecret            an app with a client secret (string or SecureString)
|          -Identity [-ManagedIdentityClientId]      this host's managed identity
|          (none of these)                           a PERSON: Azure Cloud Shell, else the browser (-UserSignIn)
|        AN INVARDIA SUPPORT SESSION open in this shell IS the sign-in: nothing is signed in here (no browser, no
|        certificate, no token request) -- the context is the session's: its tenant, and -SubscriptionId when the session
|        names it, else its first subscription. A subscription or tenant the session does not name is refused, and so is
|        -ApplicationId / -Identity (a sign-in beside the session would not be recorded there). One plain line says so.
|        ONE connect path (#524): an existing Azure session of this process (Connect-AzAccount, az login) is never used.
|        An existing sign-in in this process is REUSED (same tenant) unless -Force. -SubscriptionId selects the
|        subscription every following call works in. The app/identity is proven by asking for an ARM token at once, so a
|        wrong secret or certificate fails here, not three steps later. Returns Get-SISetupAzureContext.
|    #>
|    [CmdletBinding()]
|    param(
|        [string]$TenantId,
|        [string]$SubscriptionId,
|        [string]$ApplicationId,
|        [string]$CertificateThumbprint,
|        $ClientSecret,
|        [switch]$Identity,
|        [string]$ManagedIdentityClientId,
|        [ValidateSet('Auto', 'CloudShell', 'Browser')][string]$UserSignIn = 'Auto',
|        [string]$LoginHint,
|        [int]$TimeoutSec = 300,
|        [switch]$Force
|    )
|    $st = Get-SIAzRestState
|    $app = ($ApplicationId -and ($CertificateThumbprint -or $ClientSecret))
|    $sess = Get-SISupportSession
|    if ($sess) {
|        $name = Get-SISupportSessionName $sess
|        if ($app -or $Identity) {
|            $who = if ($Identity) { 'a managed identity' } else { 'the app {0}' -f $ApplicationId }
|            throw ('An Invardia Support session for {0} is open in this PowerShell session: SecurityInsight setup works through it, so every change is recorded there. Signing in here as {1} would not be recorded -- refused. Run the same command without the sign-in parameters, or end the session first (Disconnect-InvardiaSupport).' -f $name, $who)
|        }
|        if ($TenantId -and $TenantId -ne $sess.TenantId) {
|            throw ('The Invardia Support session for {0} is for tenant {1}, not {2} -- refused. Connect the support session of tenant {2}.' -f $name, $sess.TenantId, $TenantId)
|        }
|        if ($SubscriptionId) { Assert-SISupportSubscription -SubscriptionId $SubscriptionId -Session $sess }
|        if (Test-SISetupUserSignedIn) { Disconnect-SISetupUser }
|        return (Get-SISetupAzureContext -SubscriptionId $SubscriptionId)
|    }
|    $null = Sync-SISupportConnection   # a Support sign-in whose session was closed is dropped
|    $existing = $st.Connection
|    $reuse = (-not $Force) -and ($existing -is [hashtable]) -and (-not $app) -and (-not $Identity) -and
|             ((-not $TenantId) -or ([string]$existing.TenantId -eq $TenantId) -or ($existing.Mode -eq 'ManagedIdentity'))
|    # 2026-11-03 (a customer install, a second run in one window): a person's connection left by an earlier run whose sign-in this run does
|    # not hold is NEVER reused -- the person is signed in again (else Get-SISetupAzureContext answers $null and the install
|    # stops "not signed in")
|    if ($reuse -and [string]$existing.Mode -eq 'User' -and -not $existing['IsApp'] -and -not (Test-SISetupUserSignedIn)) { $reuse = $false; $st.Connection = $null }
|    if (-not $reuse) {
|        if ($app -or $Identity) {
|            if (Test-SISetupUserSignedIn) { Disconnect-SISetupUser }
|            $c = @{}
|            if ($Identity) {
|                $c['Identity'] = $true
|                if ($ManagedIdentityClientId) { $c['AccountId'] = $ManagedIdentityClientId }
|            } elseif ($CertificateThumbprint) {
|                $c['ServicePrincipal'] = $true; $c['ApplicationId'] = $ApplicationId; $c['CertificateThumbprint'] = $CertificateThumbprint; $c['Tenant'] = $TenantId
|            } else {
|                $sec = if ($ClientSecret -is [System.Security.SecureString]) { $ClientSecret } else { ConvertTo-SISecureString -Text ([string]$ClientSecret) }
|                $c['ServicePrincipal'] = $true; $c['Credential'] = New-Object System.Management.Automation.PSCredential($ApplicationId, $sec); $c['Tenant'] = $TenantId
|            }
|            if ($SubscriptionId) { $c['Subscription'] = $SubscriptionId }
|            $null = Connect-SIAzAccountRest @c
|            if ($global:SI_LogIngestRunCache -is [hashtable]) { $global:SI_LogIngestRunCache.Tokens = @{} }
|            try { $null = Get-SIAzureToken -Audience Arm -ForceRefresh }
|            catch {
|                $st.Connection = $null
|                $who = if ($Identity) { 'the managed identity of this host' } else { 'app {0}' -f $ApplicationId }
|                throw ('Signing in to Azure as {0} failed: {1}' -f $who, $_.Exception.Message)
|            }
|        } elseif ([string](Get-Variable -Scope Global -Name SI_AuthMethod -ValueOnly -ErrorAction Ignore) -eq 'AzContext') {
|            # #524: the retired sign-in mode "AzContext" (borrow this process's Azure session) is refused -- never a silent fallback
|            throw ('SI_AuthMethod = AzContext (use the current Azure session of this PowerShell process) is no longer supported: setup signs in itself -- a person (Azure Cloud Shell or the browser), or an app with -ApplicationId and -CertificateThumbprint or -ClientSecret, or -Identity. Supported sign-ins: {0}.' -f (Get-SISupportedSignInText))
|        } else {
|            $u = Connect-SISetupUser -TenantId $TenantId -Method $UserSignIn -LoginHint $LoginHint -TimeoutSec $TimeoutSec
|            # #876: a sign-in handed over by the installation page may be an APPLICATION's (IsApp): it is then a service
|            # principal for every check that asks who installs -- its object id is the service principal's
|            $isApp = [bool]($u.PSObject.Properties['IsApp'] -and $u.IsApp)
|            $st.Connection = @{ Mode = 'User'; AppId = $u.Account; TenantId = $u.TenantId; ObjectId = $u.ObjectId; Method = $u.Method; IsApp = $isApp }
|            $st.TenantId = $u.TenantId
|            $st.SubscriptionId = $null
|            $st.Cache = @{}
|        }
|    }
|    if ($SubscriptionId) { $st.SubscriptionId = $SubscriptionId }
|    return (Get-SISetupAzureContext)
|}
|
|function ConvertTo-SISecureString {
|    param([string]$Text)
|    $s = New-Object System.Security.SecureString
|    foreach ($ch in ([string]$Text).ToCharArray()) { $s.AppendChar($ch) }
|    $s.MakeReadOnly()
|    return $s
|}
|
|function Get-SISetupAzureContext {
|    <#
|        Who this process is signed in as -- the shape setup read from Get-AzContext: Account.Id / .Type ('User',
|        'ServicePrincipal', 'ManagedService'), Account.ObjectId, Tenant.Id, Subscription.Id / .Name, SignInMethod.
|        $null when nobody is signed in.
|        In an Invardia Support session the context IS the session's (SignInMethod 'Support', read from the session -- no
|        sign-in and no token request): its tenant, and -SubscriptionId when the session names it, else the install's
|        configured subscription, else the session's first. THROWS only what a Support session refuses: a subscription it
|        does not name, another tenant than the configured one, a session without its recording command.
|        -SubscriptionId selects the subscription the following calls work in (as Connect-SISetupAzure -SubscriptionId).
|    #>
|    param([string]$SubscriptionId)
|    $st = Get-SIAzRestState
|    $sess = Sync-SISupportConnection -TakeOver
|    $c = $st.Connection
|    if (-not ($c -is [hashtable])) {
|        # an app configured through the SI_SPN_* globals counts as signed in (the engines' own rule)
|        try { $c = Resolve-SIAzRestAuth } catch { return $null }
|    }
|    # 2026-11-03 (an install run twice in ONE PowerShell window, the second from a newer package): a person's connection left
|    # by the earlier run while this run holds no sign-in of that person (its tokens live with the earlier run) is NOT a
|    # sign-in -- $null, so the install signs the person in again instead of failing at its first Azure call
|    if (-not $sess -and [string]$c.Mode -eq 'User' -and -not $c['IsApp'] -and (Get-Command -Name Test-SISetupUserSignedIn -ErrorAction SilentlyContinue) -and -not (Test-SISetupUserSignedIn)) { return $null }
|    if ($SubscriptionId) {
|        if ($sess) { Assert-SISupportSubscription -SubscriptionId $SubscriptionId -Session $sess }
|        $st.SubscriptionId = $SubscriptionId
|    }
|    $type = switch ([string]$c.Mode) { 'User' { $(if ($c['IsApp']) { 'ServicePrincipal' } else { 'User' }) } 'ManagedIdentity' { 'ManagedService' } default { 'ServicePrincipal' } }
|    $id = switch ([string]$c.Mode) { 'ManagedIdentity' { $(if ($c.ClientId) { [string]$c.ClientId } else { 'MSI' }) } default { [string]$c.AppId } }
|    $tid = [string]$st.TenantId
|    if (-not $tid) { $tid = [string]$c.TenantId }
|    if (-not $tid -and $c.Mode -ne 'User') { try { $tid = Get-SIAzRestTenantId } catch { } }
|    $sub = $null
|    try { $sub = Get-SIAzRestSubscriptionId } catch { }
|    if ($sess -and $sub) {
|        Assert-SISupportSubscription -SubscriptionId $sub -Session $sess
|        # the session already knows its first subscription's name: no call for it
|        if ($sess.SubscriptionName -and ([string]$sub).Trim().ToLowerInvariant() -eq $sess.SubscriptionId -and -not $st.Cache.ContainsKey('subname|' + $sub)) { $st.Cache['subname|' + $sub] = [string]$sess.SubscriptionName }
|    }
|    $subName = $sub
|    if ($sub) {
|        $k = 'subname|' + $sub
|        if ($st.Cache.ContainsKey($k)) { $subName = $st.Cache[$k] }
|        else {
|            try { $s = Invoke-SIArm -Path ('/subscriptions/' + $sub) -ApiVersion '2022-12-01' -AllowNotFound; if ($s -and $s.displayName) { $subName = [string]$s.displayName } } catch { }
|            $st.Cache[$k] = $subName
|        }
|    }
|    return [pscustomobject]@{
|        PSTypeName   = 'SI.Setup.AzureContext'
|        Name         = ('{0} ({1})' -f $subName, $id)
|        Account      = [pscustomobject]@{ Id = $id; Type = $type; ObjectId = $(if ($c.ObjectId) { [string]$c.ObjectId } else { $null }) }
|        Tenant       = [pscustomobject]@{ Id = $tid; TenantId = $tid }
|        Subscription = $(if ($sub) { [pscustomobject]@{ Id = $sub; SubscriptionId = $sub; Name = $subName; TenantId = $tid } } else { $null })
|        SignInMethod = $(if ($c.Mode -eq 'User') { [string]$c.Method } else { [string]$c.Mode })
|    }
|}
|
|function Disconnect-SISetupAzure {
|    Disconnect-SISetupUser
|    Disconnect-SIAzAccountRest
|}
|
|function Get-SISetupSignedInObjectId {
|    <# The object id of whoever is signed in: the person (from their token), else the app's service principal. #>
|    $st = Get-SIAzRestState
|    $c = $st.Connection
|    if ($c -is [hashtable] -and $c.ObjectId) { return [string]$c.ObjectId }
|    try {
|        $claims = ConvertFrom-SIJwtPayload (Get-SIAzureToken -Audience Arm)
|        if ($claims -and $claims.oid) { return [string]$claims.oid }
|    } catch { }
|    return $null
|}
|
|# =====================================================================================================================
|#  Small ARM helpers
|# =====================================================================================================================
|
|function Get-SISetupSubscriptionId {
|    param([string]$SubscriptionId)
|    if ($SubscriptionId) { return $SubscriptionId }
|    $s = Get-SIAzRestSubscriptionId
|    if (-not $s) { throw 'No Azure subscription is selected. Pass the subscription id (or sign in with access to one) and run the same command again.' }
|    return $s
|}
|
|function Get-SIArmResourceGroupFromId {
|    param([string]$Id)
|    if ([string]$Id -match '/resourceGroups/([^/]+)/') { return $Matches[1] }
|    return $null
|}
|
|# =====================================================================================================================
|#  (2) Key Vault: vaults (ARM) and certificates (data plane)
|# =====================================================================================================================
|
|function ConvertTo-SIKeyVaultObject {
|    param($V)
|    [pscustomobject]@{
|        VaultName                 = [string]$V.name
|        ResourceId                = [string]$V.id
|        ResourceGroupName         = (Get-SIArmResourceGroupFromId $V.id)
|        Location                  = [string]$V.location
|        VaultUri                  = [string]$V.properties.vaultUri
|        TenantId                  = [string]$V.properties.tenantId
|        Sku                       = [string]$V.properties.sku.name
|        EnableRbacAuthorization   = [bool]$V.properties.enableRbacAuthorization
|        EnableSoftDelete          = [bool]$V.properties.enableSoftDelete
|        EnablePurgeProtection     = [bool]$V.properties.enablePurgeProtection
|        PublicNetworkAccess       = [string]$V.properties.publicNetworkAccess
|        ProvisioningState         = [string]$V.properties.provisioningState
|        Tags                      = $V.tags
|    }
|}
|
|function Get-SIKeyVault {
|    <#
|        A Key Vault by name, the way Get-AzKeyVault found it: in -ResourceGroupName, else anywhere in the subscription.
|        -InRemovedState -Location: the soft-deleted vault of that name (DeletionDate, ScheduledPurgeDate). Not found is a
|        non-terminating error (so -ErrorAction SilentlyContinue gives $null), as for the cmdlet.
|    #>
|    [CmdletBinding()]
|    param([Alias('Name')][string]$VaultName, [string]$ResourceGroupName, [switch]$InRemovedState, [string]$Location, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    if ($InRemovedState) {
|        if (-not $Location) { throw 'Get-SIKeyVault -InRemovedState needs -Location.' }
|        $d = Invoke-SIArm -Path ("/subscriptions/$sub/providers/Microsoft.KeyVault/locations/$Location/deletedVaults/$VaultName") -ApiVersion '2023-07-01' -AllowNotFound
|        if (-not $d) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("No deleted Key Vault '{0}' in {1}." -f $VaultName, $Location) -Target $VaultName; return }
|        return [pscustomobject]@{
|            VaultName = [string]$d.name; Id = [string]$d.id; Location = [string]$d.properties.location; ResourceId = [string]$d.properties.vaultId
|            DeletionDate = $d.properties.deletionDate; ScheduledPurgeDate = $d.properties.scheduledPurgeDate; EnablePurgeProtection = [bool]$d.properties.purgeProtectionEnabled
|        }
|    }
|    if ($VaultName -and $ResourceGroupName) {
|        $v = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.KeyVault/vaults/$VaultName") -ApiVersion '2023-07-01' -AllowNotFound
|        if (-not $v) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The Key Vault '{0}' was not found in resource group '{1}'." -f $VaultName, $ResourceGroupName) -Target $VaultName; return }
|        return (ConvertTo-SIKeyVaultObject $v)
|    }
|    $path = if ($ResourceGroupName) { "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.KeyVault/vaults" } else { "/subscriptions/$sub/providers/Microsoft.KeyVault/vaults" }
|    $found = $false
|    foreach ($v in @(Invoke-SIArm -Path $path -ApiVersion '2023-07-01' -List)) {
|        if ($VaultName -and [string]$v.name -ne $VaultName) { continue }
|        $found = $true
|        ConvertTo-SIKeyVaultObject $v
|    }
|    if ($VaultName -and -not $found) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The Key Vault '{0}' was not found in subscription {1}." -f $VaultName, $sub) -Target $VaultName }
|}
|
|function New-SIKeyVault {
|    <# Creates (PUT) a Key Vault: soft delete on, Azure RBAC authorization by default, and waits until it is ready. #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][Alias('Name')][string]$VaultName,
|        [Parameter(Mandatory)][string]$ResourceGroupName,
|        [Parameter(Mandatory)][string]$Location,
|        [ValidateSet('standard', 'premium', 'Standard', 'Premium')][string]$Sku = 'standard',
|        [bool]$EnableRbacAuthorization = $true,
|        [switch]$EnablePurgeProtection,
|        [int]$SoftDeleteRetentionInDays = 90,
|        [hashtable]$Tag,
|        [string]$SubscriptionId,
|        [string]$TenantId,
|        # #866 (a private install; owner: "we will not allow fw option or exceptions"): 'Disabled' CREATES the vault with no
|        # public access at all (its firewall Deny, trusted Microsoft services allowed) -- a policy that refuses a public
|        # vault never sees one. Empty: Azure's default, as before.
|        [ValidateSet('', 'Disabled')][string]$PublicNetworkAccess = ''
|    )
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    if (-not $TenantId) { $TenantId = Get-SIAzRestTenantId }
|    $props = [ordered]@{
|        tenantId                  = $TenantId
|        sku                       = @{ family = 'A'; name = $Sku.ToLowerInvariant() }
|        enableRbacAuthorization   = $EnableRbacAuthorization
|        enableSoftDelete          = $true
|        softDeleteRetentionInDays = $SoftDeleteRetentionInDays
|        accessPolicies            = @()
|    }
|    if ($EnablePurgeProtection) { $props['enablePurgeProtection'] = $true }
|    if ($PublicNetworkAccess -eq 'Disabled') {
|        $props['publicNetworkAccess'] = 'Disabled'
|        $props['networkAcls'] = [ordered]@{ defaultAction = 'Deny'; bypass = 'AzureServices'; ipRules = @(); virtualNetworkRules = @() }
|    }
|    $body = [ordered]@{ location = $Location; properties = $props }
|    if ($Tag) { $body['tags'] = $Tag }
|    $path = "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.KeyVault/vaults/$VaultName"
|    $v = Invoke-SIArm -Method PUT -Path $path -ApiVersion '2023-07-01' -Body $body
|    for ($i = 0; $i -lt 30 -and $v -and [string]$v.properties.provisioningState -and [string]$v.properties.provisioningState -notin 'Succeeded', 'Failed'; $i++) {
|        Start-Sleep -Seconds 5
|        $v = Invoke-SIArm -Path $path -ApiVersion '2023-07-01' -AllowNotFound
|    }
|    if (-not $v) { throw ("The Key Vault '{0}' was requested but did not appear." -f $VaultName) }
|    return (ConvertTo-SIKeyVaultObject $v)
|}
|
|# ---------------------------------------------------------------------------------------------------------------------
|#  FRAMEWORK INSTALLER RULE 11 -- the install's Key Vault network shape, set and READ BACK every run.
|#  Rule 11 (framework REQUIREMENTS, installer rules, 3 Nov): "a PRIVATE install's Key Vault: publicNetworkAccess Disabled +
|#  networkAcls { defaultAction Deny, bypass AzureServices, no ipRules, no virtualNetworkRules } ... bypass AzureServices is
|#  REQUIRED: ARM key / secret operations ... are refused with ForbiddenByConnection under bypass None ... ENFORCE IT EVERY
|#  RUN: a re-install RECOVERS a soft-deleted vault (purge protection), and a recover IGNORES networkAcls (it comes back with
|#  bypass None) - so set the vault to this shape and READ IT BACK before any key / secret step, whether the vault was made,
|#  recovered or found." Rule 11 names only the private shape; a PUBLIC install takes the one part that is not about being
|#  private -- bypass AzureServices -- and nothing else is changed (its public access and firewall stay the customer's).
|# ---------------------------------------------------------------------------------------------------------------------
|
|function Get-SIKeyVaultNetworkShape {
|    <# PURE. The network settings of a vault as ARM returns it (PSCustomObject or hashtable): PublicNetworkAccess,
|       DefaultAction, Bypass, IpRules, VirtualNetworkRules (the rule lists, empty when there are none). #>
|    param($Vault)
|    $get = { param($o, [string]$n) if ($null -eq $o) { return $null }; if ($o -is [System.Collections.IDictionary]) { if ($o.Contains($n)) { return $o[$n] }; return $null }; $p = $o.PSObject.Properties[$n]; if ($p) { $p.Value } else { $null } }
|    $props = & $get $Vault 'properties'
|    $acl = & $get $props 'networkAcls'
|    [pscustomobject]@{
|        PublicNetworkAccess = [string](& $get $props 'publicNetworkAccess')
|        DefaultAction       = [string](& $get $acl 'defaultAction')
|        Bypass              = [string](& $get $acl 'bypass')
|        IpRules             = @(@(& $get $acl 'ipRules') | Where-Object { $null -ne $_ })
|        VirtualNetworkRules = @(@(& $get $acl 'virtualNetworkRules') | Where-Object { $null -ne $_ })
|    }
|}
|
|function Get-SIKeyVaultRule11Patch {
|    <# PURE. The PATCH body that brings -Vault to the rule-11 shape -- ONLY what differs -- or $null when it has it.
|         -Private  publicNetworkAccess Disabled + networkAcls { Deny, AzureServices, no IP rules, no network rules }
|         public    a vault open to all networks (default action Allow, or no firewall at all) already lets trusted Microsoft
|                   services in: nothing to set -- Azure does not keep a bypass on a vault without a firewall, so asking for
|                   one can never read back. Only a vault whose firewall DENIES gets bypass AzureServices; its default action
|                   and rules are kept, publicNetworkAccess is not touched -- a public install never opens or closes a vault. #>
|    param($Vault, [switch]$Private)
|    $s = Get-SIKeyVaultNetworkShape -Vault $Vault
|    $p = [ordered]@{}
|    if ($Private) {
|        if ($s.PublicNetworkAccess -ne 'Disabled') { $p['publicNetworkAccess'] = 'Disabled' }
|        if ($s.DefaultAction -ne 'Deny' -or $s.Bypass -ne 'AzureServices' -or $s.IpRules.Count -or $s.VirtualNetworkRules.Count) {
|            $p['networkAcls'] = [ordered]@{ defaultAction = 'Deny'; bypass = 'AzureServices'; ipRules = @(); virtualNetworkRules = @() }
|        }
|    } elseif ($s.DefaultAction -eq 'Deny' -and $s.Bypass -ne 'AzureServices') {
|        $p['networkAcls'] = [ordered]@{ defaultAction = 'Deny'; bypass = 'AzureServices'
|                                        ipRules = @($s.IpRules); virtualNetworkRules = @($s.VirtualNetworkRules) }
|    }
|    if (-not $p.Count) { return $null }
|    [ordered]@{ properties = $p }
|}
|
|function Test-SIKeyVaultRule11Shape {
|    <# PURE. Does -Vault read back in the rule-11 shape (private or public, as above)? #>
|    param($Vault, [switch]$Private)
|    [bool]($Vault -and $null -eq (Get-SIKeyVaultRule11Patch -Vault $Vault -Private:$Private))
|}
|
|function Get-SIKeyVaultShapeText {
|    <# PURE. One line for the log: public access, default action, bypass, rule counts. #>
|    param($Vault)
|    $s = Get-SIKeyVaultNetworkShape -Vault $Vault
|    'publicNetworkAccess {0}, defaultAction {1}, bypass {2}, ipRules {3}, virtualNetworkRules {4}' -f $(if ($s.PublicNetworkAccess) { $s.PublicNetworkAccess } else { '(not set)' }),
|        $(if ($s.DefaultAction) { $s.DefaultAction } else { '(not set)' }), $(if ($s.Bypass) { $s.Bypass } else { '(not set)' }), $s.IpRules.Count, $s.VirtualNetworkRules.Count
|}
|
|function Set-SIKeyVaultRule11 {
|    <# Sets the vault to the rule-11 shape (PATCH, only what differs) and READS IT BACK. Throws plainly when it does not read
|       back in that shape -- nothing writes a key or secret to it before it does. Returns Changed, Shape (the read-back line),
|       Vault (the read-back vault as Get-SIKeyVault returns it). #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$VaultName, [Parameter(Mandatory)][string]$ResourceGroupName, [string]$SubscriptionId,
|          [switch]$Private, [int]$Tries = 12, [int]$PauseSeconds = 5)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $path = "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.KeyVault/vaults/$VaultName"
|    $have = Invoke-SIArm -Path $path -ApiVersion '2023-07-01' -AllowNotFound
|    if (-not $have) { throw ("The Key Vault '{0}' was not found in resource group '{1}' -- its network shape (framework installer rule 11) cannot be set." -f $VaultName, $ResourceGroupName) }
|    $patch = Get-SIKeyVaultRule11Patch -Vault $have -Private:$Private
|    $back = $have
|    if ($patch) {
|        $null = Invoke-SIArm -Method PATCH -Path $path -ApiVersion '2023-07-01' -Body $patch
|        for ($i = 1; $i -le $Tries; $i++) {
|            $back = Invoke-SIArm -Path $path -ApiVersion '2023-07-01' -AllowNotFound
|            if (Test-SIKeyVaultRule11Shape -Vault $back -Private:$Private) { break }
|            if ($i -lt $Tries) { Start-Sleep -Seconds $PauseSeconds }
|        }
|    }
|    if (-not (Test-SIKeyVaultRule11Shape -Vault $back -Private:$Private)) {
|        # Framework rule 17: the advice names ONLY the one setting that is missing -- never "set the networking", which on
|        # a public install invites "selected networks" and locks the jobs out of their own vault.
|        throw ("The Key Vault '{0}' does not read back in the shape it must have ({1}); it reads: {2}. Nothing writes a key or secret to it until it does -- run the same command again; if it stays like this, {3}, change nothing else there, and run again." -f $VaultName,
|            $(if ($Private) { 'public access Disabled, firewall Deny, trusted Microsoft services allowed (bypass AzureServices), no IP or network rules' } else { 'trusted Microsoft services allowed (bypass AzureServices)' }), (Get-SIKeyVaultShapeText -Vault $back),
|            $(if ($Private) { "in the Azure portal (Key vaults > $VaultName > Networking) choose 'Disable public access' and tick 'Allow trusted Microsoft services to bypass this firewall'" } else { "in the Azure portal (Key vaults > $VaultName > Networking > Exceptions) tick only 'Allow trusted Microsoft services to bypass this firewall'" }))
|    }
|    [pscustomobject]@{ Changed = [bool]$patch; Shape = (Get-SIKeyVaultShapeText -Vault $back); Vault = (ConvertTo-SIKeyVaultObject $back) }
|}
|
|function Get-SIKeyVaultEnsureAction {
|    <# PURE. What the install does with its vault: 'found' (it is there), 'recover' (absent, but soft-deleted in the install's
|       location FROM THE INSTALL'S OWN resource group -- a re-install; with purge protection it can neither be purged nor
|       made again under that name), 'create' (also when the deleted vault was another resource group's: the create then
|       fails with Azure's own "exists in deleted state", as before -- another install's vault is never taken over). #>
|    param($Found, $Deleted, [string]$ResourceGroupName)
|    if ($Found) { return 'found' }
|    if ($Deleted) {
|        $rg = if ([string]$Deleted.ResourceId -match '(?i)/resourceGroups/([^/]+)/') { $Matches[1] } else { '' }
|        if (-not $rg -or -not $ResourceGroupName -or $rg -eq $ResourceGroupName) { return 'recover' }
|    }
|    'create'
|}
|
|function Get-SIKeyVaultRecoverBody {
|    <# PURE. The PUT body that RECOVERS a soft-deleted vault (properties.createMode 'recover'; Azure restores its settings --
|       but NOT its networkAcls, hence Set-SIKeyVaultRule11 right after). tenantId and sku are required by the schema. #>
|    param([Parameter(Mandatory)][string]$Location, [Parameter(Mandatory)][string]$TenantId, [string]$Sku = 'standard')
|    [ordered]@{ location = $Location; properties = [ordered]@{ tenantId = $TenantId; sku = [ordered]@{ family = 'A'; name = $Sku.ToLowerInvariant() }; createMode = 'recover' } }
|}
|
|function Restore-SIKeyVault {
|    <# RECOVERS the soft-deleted vault -Deleted (Get-SIKeyVault -InRemovedState) into the resource group it was deleted from
|       (or -ResourceGroupName when that is not known), and waits until it is ready. Returns it as Get-SIKeyVault does. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)]$Deleted, [Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Location,
|          [string]$SubscriptionId, [string]$TenantId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    if (-not $TenantId) { $TenantId = Get-SIAzRestTenantId }
|    $rg = Get-SIArmResourceGroupFromId ([string]$Deleted.ResourceId)
|    if (-not $rg) { $rg = $ResourceGroupName }
|    $name = [string]$Deleted.VaultName
|    $path = "/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.KeyVault/vaults/$name"
|    $v = Invoke-SIArm -Method PUT -Path $path -ApiVersion '2023-07-01' -Body (Get-SIKeyVaultRecoverBody -Location $Location -TenantId $TenantId)
|    for ($i = 0; $i -lt 30 -and (-not $v -or ([string]$v.properties.provisioningState -and [string]$v.properties.provisioningState -notin 'Succeeded', 'Failed')); $i++) {
|        Start-Sleep -Seconds 5
|        $v = Invoke-SIArm -Path $path -ApiVersion '2023-07-01' -AllowNotFound
|    }
|    if (-not $v) { throw ("The soft-deleted Key Vault '{0}' was recovered but did not appear." -f $name) }
|    return (ConvertTo-SIKeyVaultObject $v)
|}
|
|function Initialize-SIKeyVault {
|    <# The install's vault, FOUND, RECOVERED or CREATED -- and in every case set to the rule-11 shape and READ BACK before
|       anything writes a key or secret to it. -PublicNetworkAccess 'Disabled' = a private install (created private from
|       birth, converged to the private shape); '' = a public one. Returns Action (found | recovered | created), Vault,
|       Changed (the shape had to be set), Shape (the read-back line), Deleted (what was recovered). #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$VaultName, [Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Location,
|          [string]$SubscriptionId, [string]$TenantId, [switch]$EnablePurgeProtection,
|          [ValidateSet('', 'Disabled')][string]$PublicNetworkAccess = '', [int]$PauseSeconds = 5)
|    $isPrivate = ($PublicNetworkAccess -eq 'Disabled')
|    $kv = Get-SIKeyVault -VaultName $VaultName -SubscriptionId $SubscriptionId -ErrorAction SilentlyContinue
|    $deleted = $null
|    if (-not $kv) { $deleted = Get-SIKeyVault -VaultName $VaultName -InRemovedState -Location $Location -SubscriptionId $SubscriptionId -ErrorAction SilentlyContinue }
|    $action = Get-SIKeyVaultEnsureAction -Found $kv -Deleted $deleted -ResourceGroupName $ResourceGroupName
|    switch ($action) {
|        'create' {
|            # Azure RBAC authorization (not access policies); a private install is private from birth (no public moment)
|            $kv = New-SIKeyVault -VaultName $VaultName -ResourceGroupName $ResourceGroupName -Location $Location -SubscriptionId $SubscriptionId -TenantId $TenantId -EnableRbacAuthorization $true -EnablePurgeProtection:$EnablePurgeProtection -PublicNetworkAccess $PublicNetworkAccess
|            $action = 'created'
|        }
|        'recover' { $kv = Restore-SIKeyVault -Deleted $deleted -ResourceGroupName $ResourceGroupName -Location $Location -SubscriptionId $SubscriptionId -TenantId $TenantId; $action = 'recovered' }
|    }
|    $rg = if ([string]$kv.ResourceGroupName) { [string]$kv.ResourceGroupName } else { $ResourceGroupName }
|    $c = Set-SIKeyVaultRule11 -VaultName $VaultName -ResourceGroupName $rg -SubscriptionId $SubscriptionId -Private:$isPrivate -PauseSeconds $PauseSeconds
|    # the vault's own facts (RBAC, purge protection) from the create / recover answer; its network from the read-back
|    $out = $c.Vault
|    if (-not [string]$out.VaultUri -and $kv) { $out = $kv }
|    [pscustomobject]@{ Action = $action; Vault = $out; Changed = $c.Changed; Shape = $c.Shape; Deleted = $deleted }
|}
|
|function Test-SIKeyVaultNameAvailability {
|    <# Microsoft.KeyVault checkNameAvailability: NameAvailable, Reason, Message. #>
|    param([Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $r = Invoke-SIArm -Method POST -Path ("/subscriptions/$sub/providers/Microsoft.KeyVault/checkNameAvailability") -ApiVersion '2022-07-01' -Body @{ name = $Name; type = 'Microsoft.KeyVault/vaults' }
|    return [pscustomobject]@{ NameAvailable = [bool]$r.nameAvailable; Reason = [string]$r.reason; Message = [string]$r.message }
|}
|
|function ConvertFrom-SIBase64UrlToHex {
|    param([string]$Text)
|    if (-not $Text) { return $null }
|    $p = $Text.Replace('-', '+').Replace('_', '/')
|    switch ($p.Length % 4) { 2 { $p += '==' } 3 { $p += '=' } }
|    return (([Convert]::FromBase64String($p) | ForEach-Object { $_.ToString('X2') }) -join '')
|}
|
|function ConvertTo-SIKeyVaultCertificateObject {
|    param($J, [string]$VaultName, [string]$Name)
|    $x = $null
|    if ($J.cer) { try { $x = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2(,[Convert]::FromBase64String([string]$J.cer)) } catch { } }
|    $thumb = if ($x) { [string]$x.Thumbprint } else { ConvertFrom-SIBase64UrlToHex ([string]$J.x5t) }
|    $exp = $null
|    if ($J.attributes -and $J.attributes.exp) { try { $exp = [DateTimeOffset]::FromUnixTimeSeconds([long]$J.attributes.exp).UtcDateTime } catch { } }
|    [pscustomobject]@{
|        VaultName = $VaultName; Name = $Name; Id = [string]$J.id; SecretId = [string]$J.sid; KeyId = [string]$J.kid
|        Thumbprint = $thumb; Certificate = $x; Enabled = $(if ($J.attributes) { [bool]$J.attributes.enabled } else { $null }); Expires = $exp
|    }
|}
|
|function Get-SIKeyVaultCertificate {
|    <# One certificate (current version) from a vault's data plane; $null (non-terminating error) when absent. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$VaultName, [Parameter(Mandatory)][string]$Name)
|    $uri = 'https://{0}.vault.azure.net/certificates/{1}?api-version=7.4' -f $VaultName, [uri]::EscapeDataString($Name)
|    $r = Invoke-SIAzRestRequest -Method GET -Uri $uri -Audience KeyVault -AllowNotFound -What ("Key Vault certificate '{0}' in '{1}'" -f $Name, $VaultName)
|    if (-not $r) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The certificate '{0}' was not found in Key Vault '{1}'." -f $Name, $VaultName) -Target $Name; return }
|    return (ConvertTo-SIKeyVaultCertificateObject -J ($r.Content | ConvertFrom-Json) -VaultName $VaultName -Name $Name)
|}
|
|function Import-SIKeyVaultCertificate {
|    <# Imports a PFX (-FilePath or -CertificateBytes, optional -Password) into a vault as certificate -Name. #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$VaultName,
|        [Parameter(Mandatory)][string]$Name,
|        [string]$FilePath,
|        [byte[]]$CertificateBytes,
|        $Password
|    )
|    if (-not $CertificateBytes) {
|        if (-not $FilePath) { throw 'Import-SIKeyVaultCertificate needs -FilePath or -CertificateBytes.' }
|        $CertificateBytes = [System.IO.File]::ReadAllBytes($FilePath)
|    }
|    $pw = if ($Password -is [System.Security.SecureString]) { [System.Net.NetworkCredential]::new('', $Password).Password } else { [string]$Password }
|    $body = [ordered]@{ value = [Convert]::ToBase64String($CertificateBytes); policy = @{ secret_props = @{ contentType = 'application/x-pkcs12' } } }
|    if ($pw) { $body['pwd'] = $pw }
|    $uri = 'https://{0}.vault.azure.net/certificates/{1}/import?api-version=7.4' -f $VaultName, [uri]::EscapeDataString($Name)
|    $r = Invoke-SIAzRestRequest -Method POST -Uri $uri -Audience KeyVault -Body ($body | ConvertTo-Json -Depth 5 -Compress) -What ("Importing certificate '{0}' into Key Vault '{1}'" -f $Name, $VaultName)
|    return (ConvertTo-SIKeyVaultCertificateObject -J ($r.Content | ConvertFrom-Json) -VaultName $VaultName -Name $Name)
|}
|
|# =====================================================================================================================
|#  (3) Resource providers
|# =====================================================================================================================
|
|function Get-SIResourceProvider {
|    <# A resource provider's registration in the subscription: ProviderNamespace, RegistrationState, ResourceTypes. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ProviderNamespace, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $p = Invoke-SIArm -Path ("/subscriptions/$sub/providers/$ProviderNamespace") -ApiVersion '2021-04-01' -AllowNotFound
|    if (-not $p) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The resource provider '{0}' was not found." -f $ProviderNamespace) -Target $ProviderNamespace; return }
|    return [pscustomobject]@{ ProviderNamespace = [string]$p.namespace; RegistrationState = [string]$p.registrationState; ResourceTypes = @($p.resourceTypes); Id = [string]$p.id }
|}
|
|function Get-SISetupResourceProviderList {
|    <#
|        PURE. #564: EVERY resource provider a SecurityInsight install WRITES to -- the guided install checks and registers
|        these before the first resource. Container Apps (Microsoft.App), the registry, the workspace, diagnostic settings and
|        data collection (Microsoft.Insights), the managed identities, the Key Vault, the storage account; Pro adds Azure SQL.
|        Microsoft.Network is NOT listed: SecurityInsight creates no network resource (no virtual network, private endpoint
|        or public IP; the Container Apps environment is a consumption one without a virtual network).
|    #>
|    param([switch]$Pro)
|    $l = @('Microsoft.App', 'Microsoft.OperationalInsights', 'Microsoft.Insights', 'Microsoft.ContainerRegistry', 'Microsoft.ManagedIdentity', 'Microsoft.KeyVault', 'Microsoft.Storage')
|    if ($Pro) { $l += 'Microsoft.Sql' }
|    $l
|}
|
|function Register-SIResourceProvider {
|    <# Registers a resource provider in the subscription (idempotent; Azure finishes it in the background). #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ProviderNamespace, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $p = Invoke-SIArm -Method POST -Path ("/subscriptions/$sub/providers/$ProviderNamespace/register") -ApiVersion '2021-04-01'
|    return [pscustomobject]@{ ProviderNamespace = $ProviderNamespace; RegistrationState = $(if ($p) { [string]$p.registrationState } else { 'Registering' }) }
|}
|
|function Get-SIArmApiVersion {
|    <# The newest non-preview api-version ARM offers for -ResourceType ('Microsoft.Sql/servers', 'Microsoft.Sql/servers/databases'). Cached. #>
|    param([Parameter(Mandatory)][string]$ResourceType, [string]$SubscriptionId)
|    $st = Get-SIAzRestState
|    $key = 'apiver|' + $ResourceType.ToLowerInvariant()
|    if ($st.Cache.ContainsKey($key)) { return $st.Cache[$key] }
|    $ns, $rest = $ResourceType -split '/', 2
|    $p = Get-SIResourceProvider -ProviderNamespace $ns -SubscriptionId $SubscriptionId -ErrorAction SilentlyContinue
|    $rt = @($p.ResourceTypes | Where-Object { [string]$_.resourceType -eq $rest }) | Select-Object -First 1
|    $v = @(@($rt.apiVersions) | Where-Object { $_ -and $_ -notmatch 'preview' } | Sort-Object -Descending) | Select-Object -First 1
|    if (-not $v) { $v = @(@($rt.apiVersions) | Sort-Object -Descending) | Select-Object -First 1 }
|    if (-not $v) { throw ("Azure does not offer the resource type '{0}' in this subscription." -f $ResourceType) }
|    $st.Cache[$key] = [string]$v
|    return [string]$v
|}
|
|# =====================================================================================================================
|#  (4) Role assignments: delete, and "what does this principal hold, through its groups too"
|# =====================================================================================================================
|
|function Remove-SIRoleAssignment {
|    <#
|        Deletes a role assignment: -RoleAssignmentId, or every assignment of -RoleDefinitionName to -ObjectId exactly at
|        -Scope. Returns what was removed. Absent = nothing to do (idempotent).
|    #>
|    [CmdletBinding()]
|    param([string]$RoleAssignmentId, [string]$ObjectId, [string]$RoleDefinitionName, [string]$Scope)
|    $ids = @()
|    if ($RoleAssignmentId) { $ids = @($RoleAssignmentId) }
|    else {
|        if (-not ($ObjectId -and $RoleDefinitionName -and $Scope)) { throw 'Remove-SIRoleAssignment needs -RoleAssignmentId, or -ObjectId with -RoleDefinitionName and -Scope.' }
|        $ids = @(Get-SIAzRoleAssignmentRest -ObjectId $ObjectId -Scope $Scope -RoleDefinitionName $RoleDefinitionName |
|                 Where-Object { ([string]$_.Scope).TrimEnd('/') -ieq $Scope.TrimEnd('/') } | ForEach-Object { [string]$_.RoleAssignmentId })
|    }
|    foreach ($id in $ids) {
|        $null = Invoke-SIArm -Method DELETE -Path $id -ApiVersion '2022-04-01' -AllowNotFound
|        [pscustomobject]@{ RoleAssignmentId = $id; ObjectId = $ObjectId; RoleDefinitionName = $RoleDefinitionName; Scope = $Scope }
|    }
|}
|
|function New-SIRoleAssignment {
|    <#
|        Assigns -RoleDefinitionName to -ObjectId at -Scope, with the principal's type stated (-PrincipalType, default
|        ServicePrincipal) -- what New-AzRoleAssignment -ObjectType did: ARM then accepts a principal that was created
|        seconds ago and has not replicated yet. Same output shape as New-SIAzRoleAssignment.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$ObjectId,
|        [Parameter(Mandatory)][string]$Scope,
|        [Parameter(Mandatory)][string]$RoleDefinitionName,
|        [ValidateSet('ServicePrincipal', 'User', 'Group', 'ForeignGroup', 'Device')][string]$PrincipalType = 'ServicePrincipal'
|    )
|    $subScope = if ($Scope -match '^(/subscriptions/[^/]+)') { $Matches[1] } else { $Scope }
|    $def = @(Get-SIAzRestRoleDefinitions -Scope $subScope | Where-Object { [string]$_.properties.roleName -eq $RoleDefinitionName }) | Select-Object -First 1
|    if (-not $def) { throw ("The role definition '{0}' was not found at scope '{1}'." -f $RoleDefinitionName, $subScope) }
|    $body = @{ properties = @{ roleDefinitionId = [string]$def.id; principalId = $ObjectId; principalType = $PrincipalType } }
|    $a = Invoke-SIArm -Method PUT -Path ($Scope.TrimEnd('/') + '/providers/Microsoft.Authorization/roleAssignments/' + [guid]::NewGuid().ToString()) -ApiVersion '2022-04-01' -Body $body
|    return [pscustomobject]@{ RoleAssignmentId = [string]$a.id; RoleAssignmentName = [string]$a.name; Scope = $Scope; RoleDefinitionName = $RoleDefinitionName; RoleDefinitionId = [string]$def.name; ObjectId = $ObjectId; ObjectType = $PrincipalType }
|}
|
|function Get-SIRoleAssignmentAssignedTo {
|    <#
|        The role assignments that apply to -ObjectId at or above -Scope, INCLUDING those it holds through a group
|        (ARM's assignedTo() filter -- what Get-AzRoleAssignment -ExpandPrincipalGroups returned). Same object shape as
|        Get-SIAzRoleAssignment.
|    #>
|    param([Parameter(Mandatory)][string]$ObjectId, [string]$Scope, [string]$RoleDefinitionName)
|    if (-not $Scope) { $Scope = '/subscriptions/' + (Get-SISetupSubscriptionId) }
|    $path = $Scope.TrimEnd('/') + '/providers/Microsoft.Authorization/roleAssignments?$filter=' + [uri]::EscapeDataString(("assignedTo('{0}')" -f $ObjectId))
|    $items = @(Invoke-SIArm -Path $path -ApiVersion '2022-04-01' -List)
|    $subScope = if ($Scope -match '^(/subscriptions/[^/]+)') { $Matches[1] } else { $Scope }
|    $defs = @{}
|    foreach ($d in @(Get-SIAzRestRoleDefinitions -Scope $subScope)) { $defs[([string]$d.name).ToLowerInvariant()] = [string]$d.properties.roleName }
|    foreach ($a in $items) {
|        $rdId = ([string]$a.properties.roleDefinitionId -split '/')[-1]
|        $rdName = $defs[$rdId.ToLowerInvariant()]
|        if ($RoleDefinitionName -and $rdName -ne $RoleDefinitionName) { continue }
|        [pscustomobject]@{
|            RoleAssignmentId = [string]$a.id; RoleAssignmentName = [string]$a.name; Scope = [string]$a.properties.scope
|            RoleDefinitionName = $rdName; RoleDefinitionId = $rdId; ObjectId = [string]$a.properties.principalId; ObjectType = [string]$a.properties.principalType
|        }
|    }
|}
|
|# =====================================================================================================================
|#  (5) Typed ARM reads
|# =====================================================================================================================
|
|function Get-SIArmResource {
|    <#
|        One resource by -ResourceId (api-version given, or the newest ARM offers for its type), or every resource of
|        -ResourceType (and -Name / -ResourceGroupName) in the subscription -- what Get-AzResource did. Objects carry
|        ResourceId, Id, Name, ResourceGroupName, ResourceType, Location, Tags, Properties, Identity.
|    #>
|    [CmdletBinding()]
|    param([string]$ResourceId, [string]$ResourceType, [string]$Name, [string]$ResourceGroupName, [string]$ApiVersion, [string]$SubscriptionId)
|    $conv = {
|        param($R)
|        [pscustomobject]@{
|            ResourceId = [string]$R.id; Id = [string]$R.id; Name = [string]$R.name; ResourceGroupName = (Get-SIArmResourceGroupFromId $R.id)
|            ResourceType = [string]$R.type; Type = [string]$R.type; Location = [string]$R.location; Tags = $R.tags; Kind = [string]$R.kind
|            Sku = $R.sku; Properties = $R.properties; Identity = $R.identity
|        }
|    }
|    if ($ResourceId) {
|        if (-not $ApiVersion) {
|            $t = if ($ResourceId -match '/providers/([^/]+)/(.+)$') {
|                $segs = $Matches[2] -split '/'
|                $Matches[1] + '/' + ((0..($segs.Count - 1) | Where-Object { $_ % 2 -eq 0 } | ForEach-Object { $segs[$_] }) -join '/')
|            } else { $null }
|            if (-not $t) { throw ("Not an Azure resource id: {0}" -f $ResourceId) }
|            $ApiVersion = Get-SIArmApiVersion -ResourceType $t
|        }
|        $r = Invoke-SIArm -Path $ResourceId -ApiVersion $ApiVersion -AllowNotFound
|        if (-not $r) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The resource '{0}' was not found." -f $ResourceId) -Target $ResourceId; return }
|        return (& $conv $r)
|    }
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $f = @()
|    if ($ResourceType) { $f += ("resourceType eq '{0}'" -f $ResourceType) }
|    if ($Name) { $f += ("name eq '{0}'" -f $Name) }
|    $base = if ($ResourceGroupName) { "/subscriptions/$sub/resourceGroups/$ResourceGroupName/resources" } else { "/subscriptions/$sub/resources" }
|    if ($f.Count) { $base += '?$filter=' + [uri]::EscapeDataString(($f -join ' and ')) }
|    foreach ($r in @(Invoke-SIArm -Path $base -ApiVersion '2021-04-01' -List)) {
|        if ($Name -and [string]$r.name -ne $Name) { continue }
|        & $conv $r
|    }
|}
|
|function Get-SIVirtualMachine {
|    <# A VM: Name, Id, ResourceGroupName, Location, Identity (type, principalId, userAssignedIdentities), VmId. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $v = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Compute/virtualMachines/$Name") -ApiVersion '2023-09-01' -AllowNotFound
|    if (-not $v) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The virtual machine '{0}' was not found in resource group '{1}'." -f $Name, $ResourceGroupName) -Target $Name; return }
|    [pscustomobject]@{ Name = [string]$v.name; Id = [string]$v.id; ResourceGroupName = $ResourceGroupName; Location = [string]$v.location; VmId = [string]$v.properties.vmId; Identity = $v.identity; Tags = $v.tags }
|}
|
|function Get-SIUserAssignedIdentity {
|    <# A user-assigned managed identity: Name, Id, ClientId, PrincipalId, TenantId, Location. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $u = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$Name") -ApiVersion '2023-01-31' -AllowNotFound
|    if (-not $u) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The managed identity '{0}' was not found in resource group '{1}'." -f $Name, $ResourceGroupName) -Target $Name; return }
|    [pscustomobject]@{
|        Name = [string]$u.name; Id = [string]$u.id; ResourceGroupName = $ResourceGroupName; Location = [string]$u.location
|        ClientId = [string]$u.properties.clientId; PrincipalId = [string]$u.properties.principalId; TenantId = [string]$u.properties.tenantId
|    }
|}
|
|function New-SIUserAssignedIdentity {
|    <# Creates (or returns) a user-assigned managed identity. Idempotent: an existing one is returned unchanged. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string]$Location,
|          [string]$SubscriptionId, [hashtable]$Tag)
|    $have = Get-SIUserAssignedIdentity -ResourceGroupName $ResourceGroupName -Name $Name -SubscriptionId $SubscriptionId -ErrorAction SilentlyContinue
|    if ($have) { return $have }
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $body = @{ location = $Location }
|    if ($Tag -and $Tag.Count) { $body.tags = $Tag }
|    $path = "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$Name"
|    # The create's own answer carries the two ids; a read right after it can still say "not found", or come without them.
|    # So: the answer first, then the identity re-read (6 x 5 s) until BOTH ids are there -- and a clear stop when they
|    # never come: everything after this (role assignments, the jobs' sign-in) needs them.
|    $u = Invoke-SIArm -Method PUT -Path $path -ApiVersion '2023-01-31' -Body $body
|    $sleep = Get-Variable -Scope Global -Name SI_ArmBusySleep -ValueOnly -ErrorAction Ignore
|    for ($i = 0; $i -lt 6; $i++) {
|        if ($u -and $u.properties -and [string]$u.properties.clientId -and [string]$u.properties.principalId) { break }
|        if ($sleep -is [scriptblock]) { & $sleep 5 } else { Start-Sleep -Seconds 5 }
|        $u = Invoke-SIArm -Path $path -ApiVersion '2023-01-31' -AllowNotFound
|    }
|    if (-not $u -or -not $u.properties -or -not [string]$u.properties.clientId -or -not [string]$u.properties.principalId) {
|        throw ("The managed identity '{0}' was created in resource group '{1}', but Azure does not show its client id and principal id yet -- run the same command again in a minute." -f $Name, $ResourceGroupName)
|    }
|    [pscustomobject]@{
|        Name = [string]$u.name; Id = [string]$u.id; ResourceGroupName = $ResourceGroupName; Location = [string]$u.location
|        ClientId = [string]$u.properties.clientId; PrincipalId = [string]$u.properties.principalId; TenantId = [string]$u.properties.tenantId
|    }
|}
|
|function Get-SIVmIdentityPatchBody {
|    <#
|        PURE. The 'identity' body that ADDS a user-assigned identity to a VM and keeps every identity it already has: a
|        system-assigned identity stays (type 'SystemAssigned, UserAssigned'), other user-assigned ones stay listed.
|        Returns $null when the identity is already attached (nothing to change).
|    #>
|    param([AllowNull()]$CurrentIdentity, [Parameter(Mandatory)][string]$IdentityResourceId)
|    $type = if ($CurrentIdentity -and $CurrentIdentity.PSObject.Properties['type']) { [string]$CurrentIdentity.type } else { '' }
|    $ids = [ordered]@{}
|    if ($CurrentIdentity -and $CurrentIdentity.PSObject.Properties['userAssignedIdentities'] -and $CurrentIdentity.userAssignedIdentities) {
|        foreach ($p in $CurrentIdentity.userAssignedIdentities.PSObject.Properties) { $ids[$p.Name] = @{} }
|    }
|    if (@($ids.Keys | Where-Object { "$_" -ieq $IdentityResourceId }).Count) { return $null }
|    $ids[$IdentityResourceId] = @{}
|    $newType = if ($type -match '(?i)SystemAssigned') { 'SystemAssigned, UserAssigned' } else { 'UserAssigned' }
|    @{ identity = @{ type = $newType; userAssignedIdentities = $ids } }
|}
|
|function Add-SIVmUserAssignedIdentity {
|    <# Attaches a user-assigned identity to an Azure VM, keeping the identities it has. Returns $true when it changed. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$VmName,
|          [Parameter(Mandatory)][string]$IdentityResourceId, [string]$SubscriptionId)
|    $vm = Get-SIVirtualMachine -ResourceGroupName $ResourceGroupName -Name $VmName -SubscriptionId $SubscriptionId -ErrorAction Stop
|    $body = Get-SIVmIdentityPatchBody -CurrentIdentity $vm.Identity -IdentityResourceId $IdentityResourceId
|    if (-not $body) { return $false }
|    $null = Invoke-SIArm -Method PATCH -Path $vm.Id -ApiVersion '2023-09-01' -Body $body
|    $true
|}
|
|function Get-SISqlServer {
|    <# Azure SQL logical servers: ServerName, ResourceId, ResourceGroupName, Location, FullyQualifiedDomainName, Administrators. #>
|    [CmdletBinding()]
|    param([string]$ResourceGroupName, [string]$ServerName, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $conv = {
|        param($S)
|        [pscustomobject]@{
|            ServerName = [string]$S.name; ResourceId = [string]$S.id; ResourceGroupName = (Get-SIArmResourceGroupFromId $S.id); Location = [string]$S.location
|            FullyQualifiedDomainName = [string]$S.properties.fullyQualifiedDomainName; Administrators = $S.properties.administrators
|            PublicNetworkAccess = [string]$S.properties.publicNetworkAccess; Tags = $S.tags
|        }
|    }
|    if ($ResourceGroupName -and $ServerName) {
|        $s = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Sql/servers/$ServerName") -ApiVersion '2021-11-01' -AllowNotFound
|        if (-not $s) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The SQL server '{0}' was not found in resource group '{1}'." -f $ServerName, $ResourceGroupName) -Target $ServerName; return }
|        return (& $conv $s)
|    }
|    $path = if ($ResourceGroupName) { "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Sql/servers" } else { "/subscriptions/$sub/providers/Microsoft.Sql/servers" }
|    foreach ($s in @(Invoke-SIArm -Path $path -ApiVersion '2021-11-01' -List)) { if (-not $ServerName -or [string]$s.name -eq $ServerName) { & $conv $s } }
|}
|
|function Get-SISqlDatabase {
|    <# Databases of an Azure SQL server: DatabaseName, ResourceId, ServerName, Status, SkuName. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$ServerName, [string]$DatabaseName, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $base = "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Sql/servers/$ServerName/databases"
|    $conv = { param($D) [pscustomobject]@{ DatabaseName = [string]$D.name; ResourceId = [string]$D.id; ServerName = $ServerName; ResourceGroupName = $ResourceGroupName; Location = [string]$D.location; Status = [string]$D.properties.status; SkuName = [string]$D.sku.name } }
|    if ($DatabaseName) {
|        $d = Invoke-SIArm -Path ($base + '/' + $DatabaseName) -ApiVersion '2021-11-01' -AllowNotFound
|        if (-not $d) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The database '{0}' was not found on SQL server '{1}'." -f $DatabaseName, $ServerName) -Target $DatabaseName; return }
|        return (& $conv $d)
|    }
|    foreach ($d in @(Invoke-SIArm -Path $base -ApiVersion '2021-11-01' -List)) { & $conv $d }
|}
|
|function Get-SICognitiveServicesAccount {
|    <# Azure OpenAI / Cognitive Services accounts: AccountName, Id, ResourceGroupName, Kind, Endpoint, Location. #>
|    [CmdletBinding()]
|    param([string]$ResourceGroupName, [string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $conv = { param($A) [pscustomobject]@{ AccountName = [string]$A.name; Id = [string]$A.id; ResourceGroupName = (Get-SIArmResourceGroupFromId $A.id); Kind = [string]$A.kind; Location = [string]$A.location; Endpoint = [string]$A.properties.endpoint; Sku = [string]$A.sku.name } }
|    if ($ResourceGroupName -and $Name) {
|        $a = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.CognitiveServices/accounts/$Name") -ApiVersion '2023-05-01' -AllowNotFound
|        if (-not $a) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The Azure AI account '{0}' was not found in resource group '{1}'." -f $Name, $ResourceGroupName) -Target $Name; return }
|        return (& $conv $a)
|    }
|    $path = if ($ResourceGroupName) { "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.CognitiveServices/accounts" } else { "/subscriptions/$sub/providers/Microsoft.CognitiveServices/accounts" }
|    foreach ($a in @(Invoke-SIArm -Path $path -ApiVersion '2023-05-01' -List)) { if (-not $Name -or [string]$a.name -eq $Name) { & $conv $a } }
|}
|
|function Get-SITenant {
|    <# The tenants the signed-in account can see: Id, TenantId, Name, DefaultDomain, Domains. -TenantId picks one. #>
|    [CmdletBinding()]
|    param([string]$TenantId)
|    $found = $false
|    foreach ($t in @(Invoke-SIArm -Path '/tenants' -ApiVersion '2022-12-01' -List)) {
|        if ($TenantId -and [string]$t.tenantId -ne $TenantId) { continue }
|        $found = $true
|        [pscustomobject]@{ Id = [string]$t.tenantId; TenantId = [string]$t.tenantId; Name = [string]$t.displayName; DefaultDomain = [string]$t.defaultDomain; Domains = @($t.domains); TenantCategory = [string]$t.tenantCategory }
|    }
|    if ($TenantId -and -not $found) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The tenant '{0}' is not visible to the signed-in account." -f $TenantId) -Target $TenantId }
|}
|
|function Get-SILogAnalyticsTable {
|    <# One Log Analytics table (or all): Name, Id, Plan, RetentionInDays, TotalRetentionInDays, Schema (columns). #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$WorkspaceName, [string]$TableName, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $base = "/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.OperationalInsights/workspaces/$WorkspaceName/tables"
|    $conv = { param($T) [pscustomobject]@{ Name = [string]$T.name; Id = [string]$T.id; Plan = [string]$T.properties.plan; RetentionInDays = $T.properties.retentionInDays; TotalRetentionInDays = $T.properties.totalRetentionInDays; Schema = $T.properties.schema; ProvisioningState = [string]$T.properties.provisioningState } }
|    if ($TableName) {
|        $t = Invoke-SIArm -Path ($base + '/' + $TableName) -ApiVersion '2022-10-01' -AllowNotFound
|        if (-not $t) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The table '{0}' was not found in workspace '{1}'." -f $TableName, $WorkspaceName) -Target $TableName; return }
|        return (& $conv $t)
|    }
|    foreach ($t in @(Invoke-SIArm -Path $base -ApiVersion '2022-10-01' -List)) { & $conv $t }
|}
|
|# =====================================================================================================================
|#  (7) Storage management through ARM (no data-plane role and no account key needed)
|# =====================================================================================================================
|
|function Get-SIStorageArmChildPath {
|    param([string]$SubscriptionId, [string]$ResourceGroupName, [string]$AccountName, [ValidateSet('Table', 'Container', 'Queue')][string]$Kind, [string]$Name)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $svc = switch ($Kind) { 'Table' { 'tableServices/default/tables' } 'Container' { 'blobServices/default/containers' } 'Queue' { 'queueServices/default/queues' } }
|    return ('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Storage/storageAccounts/{2}/{3}/{4}' -f $sub, $ResourceGroupName, $AccountName, $svc, $Name)
|}
|
|function Get-SIStorageArmChild {
|    <# A table / blob container / queue of a storage account, read through ARM; non-terminating not-found. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$AccountName,
|          [Parameter(Mandatory)][ValidateSet('Table', 'Container', 'Queue')][string]$Kind, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $p = Get-SIStorageArmChildPath -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName -AccountName $AccountName -Kind $Kind -Name $Name
|    $r = Invoke-SIArm -Path $p -ApiVersion '2023-01-01' -AllowNotFound
|    if (-not $r) { Write-SIAzRestNotFound -Cmdlet $PSCmdlet -Message ("The {0} '{1}' was not found in storage account '{2}'." -f $Kind.ToLowerInvariant(), $Name, $AccountName) -Target $Name; return }
|    return [pscustomobject]@{ Name = [string]$r.name; Id = [string]$r.id; Kind = $Kind; Properties = $r.properties }
|}
|
|function New-SIStorageArmChild {
|    <# Creates (PUT, idempotent) a table / private blob container / queue through ARM. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$AccountName,
|          [Parameter(Mandatory)][ValidateSet('Table', 'Container', 'Queue')][string]$Kind, [Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $p = Get-SIStorageArmChildPath -SubscriptionId $SubscriptionId -ResourceGroupName $ResourceGroupName -AccountName $AccountName -Kind $Kind -Name $Name
|    $body = if ($Kind -eq 'Container') { @{ properties = @{ publicAccess = 'None' } } } else { @{ properties = @{} } }
|    $r = Invoke-SIArm -Method PUT -Path $p -ApiVersion '2023-01-01' -Body $body
|    return [pscustomobject]@{ Name = $(if ($r) { [string]$r.name } else { $Name }); Id = $(if ($r) { [string]$r.id } else { $p }); Kind = $Kind }
|}
|
|function Get-SIStorageLifecyclePolicy {
|    <# The account's lifecycle management policy: .Rules (the raw ARM rules: name, enabled, type, definition); $null when there is none. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$AccountName, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $p = Invoke-SIArm -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Storage/storageAccounts/$AccountName/managementPolicies/default") -ApiVersion '2023-01-01' -AllowNotFound
|    if (-not $p) { return $null }
|    return [pscustomobject]@{ Id = [string]$p.id; Rules = @($p.properties.policy.rules | Where-Object { $_ }); LastModifiedTime = $p.properties.lastModifiedTime }
|}
|
|function Set-SIStorageLifecyclePolicy {
|    <# REPLACES the account's lifecycle policy with -Rules (raw ARM rule objects). Callers merge, see New-SIStorageLifecycleDeleteRule. #>
|    param([Parameter(Mandatory)][string]$ResourceGroupName, [Parameter(Mandatory)][string]$AccountName, [Parameter(Mandatory)][object[]]$Rules, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $p = Invoke-SIArm -Method PUT -Path ("/subscriptions/$sub/resourceGroups/$ResourceGroupName/providers/Microsoft.Storage/storageAccounts/$AccountName/managementPolicies/default") -ApiVersion '2023-01-01' `
|             -Body @{ properties = @{ policy = @{ rules = @($Rules) } } }
|    return [pscustomobject]@{ Id = [string]$p.id; Rules = @($p.properties.policy.rules | Where-Object { $_ }) }
|}
|
|function New-SIStorageLifecycleDeleteRule {
|    <# PURE. A lifecycle rule that deletes block blobs under -PrefixMatch N days after their last modification. #>
|    param([Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string[]]$PrefixMatch, [Parameter(Mandatory)][int]$DaysAfterModification)
|    return [ordered]@{
|        enabled    = $true
|        name       = $Name
|        type       = 'Lifecycle'
|        definition = [ordered]@{
|            actions = @{ baseBlob = @{ delete = @{ daysAfterModificationGreaterThan = $DaysAfterModification } } }
|            filters = [ordered]@{ blobTypes = @('blockBlob'); prefixMatch = @($PrefixMatch) }
|        }
|    }
|}
|
|function Get-SIStorageLifecycleRuleDeleteDays {
|    <# PURE. The delete-after-modification days of a raw lifecycle rule ($null when it has none). #>
|    param($Rule)
|    try { return $Rule.definition.actions.baseBlob.delete.daysAfterModificationGreaterThan } catch { return $null }
|}
|
|function Test-SIStorageAccountNameAvailability {
|    <# Microsoft.Storage checkNameAvailability: NameAvailable, Reason, Message. #>
|    param([Parameter(Mandatory)][string]$Name, [string]$SubscriptionId)
|    $sub = Get-SISetupSubscriptionId -SubscriptionId $SubscriptionId
|    $r = Invoke-SIArm -Method POST -Path ("/subscriptions/$sub/providers/Microsoft.Storage/checkNameAvailability") -ApiVersion '2023-01-01' -Body @{ name = $Name; type = 'Microsoft.Storage/storageAccounts' }
|    return [pscustomobject]@{ NameAvailable = [bool]$r.nameAvailable; Reason = [string]$r.reason; Message = [string]$r.message }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-SetupSignIn.ps1'] = @{ Sha256 = 'f679aeea5410c99712147634239b38093e6d3973996f57bd67db46f4f947596c'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight SETUP -- signing in to Azure with NO PowerShell modules (native REST and .NET only).
|
|    WHO SIGNS IN, AND HOW
|      A person (the guided install, the wizard, Setup-SecurityInsight, Bootstrap-*, Grant-*, Validate-* ...):
|        * Azure Cloud Shell  -- the Cloud Shell token endpoint ($env:MSI_ENDPOINT, else $env:IDENTITY_ENDPOINT). It hands
|                                out tokens for the person who opened Cloud Shell, per resource, with no prompt.
|        * a workstation      -- OAuth 2.0 authorization code + PKCE in the person's own browser, answered on a loopback
|                                listener (System.Net.HttpListener on http://localhost:<free port>/). The client is the
|                                public Azure PowerShell client, so the same consent and the same Microsoft Graph rights
|                                (Directory.AccessAsUser.All) setup always had. NO device code: it is blocked by
|                                Conditional Access in many tenants and is deliberately not offered.
|        Tokens for the other resources (Graph, Key Vault, Storage, Log Analytics, SQL ...) come from the refresh token
|        (browser) or the Cloud Shell endpoint, on first use. EXCEPT Exchange Online (https://outlook.office365.com): its
|        admin API accepts only a token of the Exchange Online PowerShell client (Get-SISignInExchangeClientId), so the first
|        Exchange token is one more browser sign-in with that client (same flow, the account pre-filled), then its own
|        refresh token. Everything is kept IN MEMORY in this PowerShell process --
|        nothing is written to disk.
|      An app (unattended setup, CI): a certificate or a client secret -- recorded by Connect-SIAzAccount (REST), tokens
|        minted by engine/_shared (client assertion / client credentials). A managed identity likewise.
|
|    HOW THE REST LAYER USES IT
|      engine/_shared/SI-AzRest.ps1 asks Get-SIAzureToken for every token. setup/_shared/SI-SetupAzure.ps1 loads that file
|      and then defines Get-SIAzureToken once more, here: a USER sign-in is answered from this file, anything else exactly
|      as the engine does. So Invoke-SIArm, the *-SIAz* REST twins, Key Vault, Graph and storage all run as the signed-in
|      person without knowing it.
|
|    TEST SEAMS: every HTTP call goes through Invoke-SIAzRestHttp (engine); the browser through Open-SISignInBrowser; the
|    loopback wait through Wait-SILoopbackAuthCode. Pure helpers (PKCE pair, authorize URL, redirect parsing) are public.
|
|    PS 5.1 safe (no ?. / ??), pwsh 7 on Windows, Linux (Cloud Shell) and macOS.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope.
|
|
|function Get-SISignInClientId {
|    <# The public client the browser sign-in uses: $global:SI_SetupSignInClientId (an organisation's own public app
|       registration with an http://localhost redirect) when set, else the Azure PowerShell client. #>
|    $c = "$(Get-Variable -Scope Global -Name SI_SetupSignInClientId -ValueOnly -ErrorAction Ignore)"
|    if ($c.Trim()) { return $c.Trim() }
|    return '1950a258-227b-4e31-a9cf-717495945fc2'
|}
|
|function Get-SISignInExchangeClientId {
|    <# The public client the Exchange Online admin API (https://outlook.office365.com/adminapi/...) is signed in with:
|       "Microsoft Exchange REST API Based Powershell", the client the Exchange Online PowerShell V3 module itself uses
|       (PIM4EntraPS does the same). A delegated token for Exchange must carry Exchange.Manage; the Azure PowerShell client
|       is not consented for it, so Exchange answered its token with 401 Unauthorized (customer ticket 2026-10-15).
|       $global:SI_SetupExchangeClientId overrides it (an organisation's own public app with Exchange.Manage). #>
|    $c = "$(Get-Variable -Scope Global -Name SI_SetupExchangeClientId -ValueOnly -ErrorAction Ignore)"
|    if ($c.Trim()) { return $c.Trim() }
|    return 'fb78d390-0c51-40cd-8e17-fdbfab77341b'
|}
|
|function Test-SISignInExchangeResource {
|    <# PURE. True for the Exchange Online resource (its admin API takes only a token of the Exchange client). #>
|    param([string]$Resource)
|    $r = ("$Resource" -replace '/\.default$', '').TrimEnd('/').ToLowerInvariant()
|    return ($r -eq 'https://outlook.office365.com' -or $r -eq 'https://outlook.office.com')
|}
|
|function Get-SISignInState {
|    <# The in-memory sign-in of this process: the user session (method, tenant, account, refresh token) and its tokens. #>
|    if (-not ((Get-Variable -Scope Global -Name SI_SetupSignInState -ValueOnly -ErrorAction Ignore) -is [hashtable])) {
|        $global:SI_SetupSignInState = @{ Session = $null; Tokens = @{} }
|    }
|    return $global:SI_SetupSignInState
|}
|
|function Test-SICloudShell {
|    <# True in Azure Cloud Shell: the Cloud Shell markers AND a token endpoint. #>
|    $marker = ([string]$env:AZUREPS_HOST_ENVIRONMENT) -like 'cloud-shell*' -or [bool]$env:ACC_CLOUD -or [bool]$env:ACC_TERM_ID
|    return ($marker -and [bool](Get-SICloudShellEndpoint))
|}
|
|function Get-SICloudShellEndpoint {
|    $e = [string]$env:MSI_ENDPOINT
|    if (-not $e.Trim()) { $e = [string]$env:IDENTITY_ENDPOINT }
|    return $e.Trim()
|}
|
|# ---------------------------------------------------------------------------------------------------------------
|# PURE helpers: PKCE, state, the authorize URL, the redirect, token claims
|# ---------------------------------------------------------------------------------------------------------------
|function ConvertTo-SIBase64Url {
|    param([Parameter(Mandatory)][byte[]]$Bytes)
|    return ([Convert]::ToBase64String($Bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_'))
|}
|
|function New-SIRandomBase64Url {
|    param([int]$ByteCount = 32)
|    $b = New-Object byte[] $ByteCount
|    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
|    try { $rng.GetBytes($b) } finally { $rng.Dispose() }
|    return (ConvertTo-SIBase64Url -Bytes $b)
|}
|
|function Get-SIPkceChallenge {
|    <# RFC 7636 S256: BASE64URL(SHA256(ASCII(verifier))). #>
|    param([Parameter(Mandatory)][string]$Verifier)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $h = $sha.ComputeHash([System.Text.Encoding]::ASCII.GetBytes($Verifier)) } finally { $sha.Dispose() }
|    return (ConvertTo-SIBase64Url -Bytes $h)
|}
|
|function New-SIPkcePair {
|    <# A fresh verifier (43 chars from 32 random bytes, inside RFC 7636's 43..128 unreserved set) and its S256 challenge. #>
|    $v = New-SIRandomBase64Url -ByteCount 32
|    return [pscustomobject]@{ Verifier = $v; Challenge = (Get-SIPkceChallenge -Verifier $v); Method = 'S256' }
|}
|
|function Get-SISignInScope {
|    <# The v2 scope of a resource: 'https://graph.microsoft.com/' -> 'https://graph.microsoft.com/.default'. #>
|    param([Parameter(Mandatory)][string]$Resource)
|    $r = ($Resource -replace '/\.default$', '').TrimEnd('/')
|    return ($r + '/.default')
|}
|
|function Get-SIAuthorizeUrl {
|    <# The Microsoft Entra authorize URL for the code + PKCE flow. #>
|    param(
|        [string]$TenantId,
|        [Parameter(Mandatory)][string]$ClientId,
|        [Parameter(Mandatory)][string]$RedirectUri,
|        [Parameter(Mandatory)][string]$Scope,
|        [Parameter(Mandatory)][string]$CodeChallenge,
|        [Parameter(Mandatory)][string]$State,
|        [string]$LoginHint,
|        [string]$Prompt = 'select_account'
|    )
|    $t = if ([string]::IsNullOrWhiteSpace($TenantId)) { 'organizations' } else { $TenantId.Trim() }
|    $q = [ordered]@{
|        client_id             = $ClientId
|        response_type         = 'code'
|        redirect_uri          = $RedirectUri
|        response_mode         = 'query'
|        scope                 = $Scope
|        state                 = $State
|        code_challenge        = $CodeChallenge
|        code_challenge_method = 'S256'
|    }
|    if ($Prompt) { $q['prompt'] = $Prompt }
|    if ($LoginHint) { $q['login_hint'] = $LoginHint }
|    $pairs = foreach ($k in $q.Keys) { '{0}={1}' -f $k, [uri]::EscapeDataString([string]$q[$k]) }
|    return ('https://login.microsoftonline.com/{0}/oauth2/v2.0/authorize?{1}' -f [uri]::EscapeDataString($t), ($pairs -join '&'))
|}
|
|function ConvertFrom-SIQueryString {
|    <# '?a=1&b=x%20y' -> @{ a = '1'; b = 'x y' } (case-insensitive keys). #>
|    param([string]$Query)
|    $h = New-Object 'System.Collections.Hashtable' ([System.StringComparer]::OrdinalIgnoreCase)
|    $q = ([string]$Query).TrimStart('?')
|    foreach ($p in ($q -split '&')) {
|        if (-not $p) { continue }
|        $i = $p.IndexOf('=')
|        $k = if ($i -ge 0) { $p.Substring(0, $i) } else { $p }
|        $v = if ($i -ge 0) { $p.Substring($i + 1) } else { '' }
|        $h[[uri]::UnescapeDataString($k.Replace('+', ' '))] = [uri]::UnescapeDataString($v.Replace('+', ' '))
|    }
|    return $h
|}
|
|function Resolve-SIAuthRedirect {
|    <#
|        The browser's redirect back to the loopback listener -> the authorization code. Throws in customer language when
|        Entra returned an error, when the state does not match (a response this sign-in did not ask for), or when no
|        code came back.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Query, [Parameter(Mandatory)][string]$ExpectedState)
|    $q = ConvertFrom-SIQueryString -Query $Query
|    if ($q['error']) {
|        $d = [string]$q['error_description']
|        throw ("The Microsoft sign-in did not complete: {0}{1}" -f $q['error'], $(if ($d) { ' -- ' + $d } else { '' }))
|    }
|    if ([string]$q['state'] -ne $ExpectedState) {
|        throw 'The sign-in answer did not belong to this sign-in (the state value does not match). Nothing was signed in; run the same command again.'
|    }
|    if (-not $q['code']) { throw 'The sign-in answer carried no authorization code. Run the same command again.' }
|    return [string]$q['code']
|}
|
|function ConvertFrom-SISignInJwt {
|    <# The claims of a JWT (no signature check -- only read to learn the tenant, the account and the expiry). #>
|    param([string]$Token)
|    $parts = ([string]$Token) -split '\.'
|    if ($parts.Count -lt 2) { return $null }
|    $p = $parts[1].Replace('-', '+').Replace('_', '/')
|    switch ($p.Length % 4) { 2 { $p += '==' } 3 { $p += '=' } }
|    try { return ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($p)) | ConvertFrom-Json) } catch { return $null }
|}
|
|function Get-SISignInAccountName {
|    param($Claims)
|    if (-not $Claims) { return $null }
|    foreach ($n in 'upn', 'preferred_username', 'unique_name', 'email', 'oid') {
|        if ($Claims.PSObject.Properties[$n] -and [string]$Claims.$n) { return [string]$Claims.$n }
|    }
|    return $null
|}
|
|function Get-SITokenExpiry {
|    <# When a token response expires (5 minutes early): expires_in (seconds) or expires_on (unix seconds / a date). #>
|    param($Response)
|    $now = [datetime]::UtcNow
|    $s = 0
|    if ($Response.PSObject.Properties['expires_in'] -and [int]::TryParse([string]$Response.expires_in, [ref]$s) -and $s -gt 0) {
|        return $now.AddSeconds([Math]::Max(60, $s - 300))
|    }
|    if ($Response.PSObject.Properties['expires_on']) {
|        $l = 0L
|        if ([long]::TryParse([string]$Response.expires_on, [ref]$l) -and $l -gt 0) {
|            return ([DateTimeOffset]::FromUnixTimeSeconds($l).UtcDateTime.AddMinutes(-5))
|        }
|        $d = [datetime]::MinValue
|        if ([datetime]::TryParse([string]$Response.expires_on, [System.Globalization.CultureInfo]::InvariantCulture, [System.Globalization.DateTimeStyles]::AdjustToUniversal, [ref]$d)) {
|            return $d.AddMinutes(-5)
|        }
|    }
|    return $now.AddMinutes(30)
|}
|
|# ---------------------------------------------------------------------------------------------------------------
|# HANDED-OVER TOKENS (#876, owner 2026-10-21 "test trial with support app today"): Invardia's bootstrap may hand the
|# install the access tokens it already holds, in $env:SI_HANDOFF_TOKENS -- the same shape as PIM_HANDOFF_TOKENS:
|#   { "https://management.azure.com/": { "access_token": "...", "expires_on": <unix seconds> },
|#     "https://graph.microsoft.com/": {...}, "https://database.windows.net/": {...} }
|# With them the install signs in to NOTHING itself: no browser, no Cloud Shell endpoint, no app sign-in. The tokens may be
|# a person's (delegated) or an application's (the Invardia Support app: idtyp app, no scp) -- the claims say which, and an
|# application's object id (oid) IS its service principal's. Every token must be for the SAME tenant (and for the install's
|# tenant when one is named): one for another tenant refuses the whole hand-over. Read ONCE, kept in memory only
|# ($global:SI_SetupHandoff), and the variable is removed from the environment so no later process inherits it. No refresh
|# token crosses over, so a token cannot be renewed: when one is about to run out the install STOPS with one plain line
|# and resumes from that step with a fresh hand-over. An Invardia Support session open in the same shell wins over the
|# hand-over (its calls are recorded in the customer's audit log and its tokens are renewed by the session).
|# ---------------------------------------------------------------------------------------------------------------
|$script:SIHandoffMinMinutes = 2
|
|function Get-SIHandoffResourceKey {
|    <# PURE. The comparison key of a token audience: 'https://graph.microsoft.com' and '.../' and '.../.default' are one. #>
|    param([string]$Resource)
|    return ((("$Resource".Trim()) -replace '/\.default$', '').TrimEnd('/') + '/').ToLowerInvariant()
|}
|
|function Get-SIHandoffExpiredText {
|    <# PURE. The one line said when a handed-over token runs out (the install resumes from the step it stopped at). #>
|    param([string]$Resource)
|    $what = if ("$Resource".Trim()) { ' (for {0})' -f (Get-SIHandoffResourceKey $Resource).TrimEnd('/') } else { '' }
|    'The hand-over sign-in{0} has expired -- restart the install with a fresh code from the installation page (the install resumes where it stopped).' -f $what
|}
|
|function Import-SIHandoffTokens {
|    <#
|        PURE given -Json and -NowUtc. Reads the bootstrap's hand-over JSON. Returns
|          @{ Present; Ok; Reason; TenantId; IsApp; ObjectId; AppId; Account; Tokens = @{ <resource key> = @{ Token; ExpiresAt } } }
|        Present = something was handed over. Ok = it can be used (at least an Azure Resource Manager token, every token for
|        one tenant -- -TenantId when given -- and every token of one kind: all a person's or all one application's).
|        Reason (when not Ok) never contains token text. ExpiresAt = the earlier of expires_on and the token's own exp.
|    #>
|    param([AllowEmptyString()][string]$Json, [string]$TenantId, [datetime]$NowUtc = [datetime]::UtcNow)
|    $out = @{ Present = $false; Ok = $false; Reason = ''; TenantId = ''; IsApp = $false; ObjectId = ''; AppId = ''; Account = ''; Tokens = @{} }
|    if (-not "$Json".Trim()) { return $out }
|    $out.Present = $true
|    $o = $null
|    try { $o = "$Json" | ConvertFrom-Json } catch { $out.Reason = 'the hand-over could not be read (it is not JSON)'; return $out }
|    $tids = @(); $kinds = @(); $oids = @()
|    foreach ($p in @($o.PSObject.Properties)) {
|        $v = $p.Value; $tok = ''; $exp = $null
|        if ($v -is [string]) { $tok = $v }
|        elseif ($null -ne $v -and $v.PSObject.Properties['access_token']) { $tok = [string]$v.access_token; if ($v.PSObject.Properties['expires_on']) { $exp = $v.expires_on } }
|        if (-not $tok.Trim()) { continue }
|        $c = ConvertFrom-SISignInJwt $tok
|        if (-not $c -or -not $c.PSObject.Properties['tid'] -or -not [string]$c.tid) { $out.Reason = ('the token handed over for {0} cannot be read (no tenant in it)' -f $p.Name); return $out }
|        $tid = ([string]$c.tid).Trim().ToLowerInvariant()
|        if ("$TenantId".Trim() -and $tid -ne "$TenantId".Trim().ToLowerInvariant()) {
|            $out.Reason = ('the token handed over for {0} is for tenant {1}, not this installation''s tenant {2}' -f $p.Name, $tid, "$TenantId".Trim()); return $out
|        }
|        $isApp = ([string]$(if ($c.PSObject.Properties['idtyp']) { $c.idtyp } else { '' }) -eq 'app') -or -not ($c.PSObject.Properties['scp'] -and [string]$c.scp)
|        # the expiry: the earlier of what the bootstrap says and the token's own exp claim
|        $ends = @()
|        $l = 0L
|        if ($null -ne $exp -and [long]::TryParse([string]$exp, [ref]$l) -and $l -gt 0) { $ends += [DateTimeOffset]::FromUnixTimeSeconds($l).UtcDateTime }
|        if ($c.PSObject.Properties['exp'] -and [long]::TryParse([string]$c.exp, [ref]$l) -and $l -gt 0) { $ends += [DateTimeOffset]::FromUnixTimeSeconds($l).UtcDateTime }
|        if (-not $ends.Count) { $out.Reason = ('the token handed over for {0} carries no expiry' -f $p.Name); return $out }
|        $out.Tokens[(Get-SIHandoffResourceKey $p.Name)] = @{ Token = $tok; ExpiresAt = (@($ends | Sort-Object) | Select-Object -First 1) }
|        $tids += $tid; $kinds += $isApp; $oids += ([string]$(if ($c.PSObject.Properties['oid']) { $c.oid } else { '' })).ToLowerInvariant()
|        if (-not $out.AppId -and $c.PSObject.Properties['appid']) { $out.AppId = [string]$c.appid }
|        if (-not $out.AppId -and $c.PSObject.Properties['azp']) { $out.AppId = [string]$c.azp }
|        if (-not $out.Account -and -not $isApp) { $out.Account = [string](Get-SISignInAccountName $c) }
|    }
|    if (-not $out.Tokens.Count) { $out.Reason = 'the hand-over holds no token'; return $out }
|    if (@($tids | Select-Object -Unique).Count -gt 1) { $out.Reason = ('the tokens handed over are for different tenants ({0})' -f ((@($tids | Select-Object -Unique)) -join ', ')); $out.Tokens = @{}; return $out }
|    if (@($kinds | Select-Object -Unique).Count -gt 1 -or @($oids | Where-Object { $_ } | Select-Object -Unique).Count -gt 1) {
|        $out.Reason = 'the tokens handed over are not all for the same identity'; $out.Tokens = @{}; return $out
|    }
|    if (-not $out.Tokens.ContainsKey('https://management.azure.com/')) { $out.Reason = 'the hand-over holds no Azure Resource Manager token'; $out.Tokens = @{}; return $out }
|    $out.TenantId = [string]$tids[0]; $out.IsApp = [bool]$kinds[0]
|    $out.ObjectId = [string](@($oids | Where-Object { $_ }) | Select-Object -First 1)
|    if ($out.IsApp) { $out.Account = $out.AppId }
|    $out.Ok = $true
|    return $out
|}
|
|function Get-SISetupHandoff {
|    <#
|        The hand-over of this process ($global:SI_SetupHandoff), read from $env:SI_HANDOFF_TOKENS the first time it is asked
|        for (then removed from the environment). $null when nothing was handed over. -TenantId: the install's tenant (a
|        hand-over for another tenant THROWS -- never used, never silently replaced by another sign-in).
|    #>
|    param([string]$TenantId)
|    $h = Get-Variable -Scope Global -Name SI_SetupHandoff -ValueOnly -ErrorAction Ignore
|    if (-not ($h -is [hashtable])) {
|        $json = [string][Environment]::GetEnvironmentVariable('SI_HANDOFF_TOKENS')
|        if (-not $json.Trim()) { return $null }
|        $h = Import-SIHandoffTokens -Json $json -TenantId $TenantId
|        [Environment]::SetEnvironmentVariable('SI_HANDOFF_TOKENS', $null)
|        Remove-Item -Path 'env:SI_HANDOFF_TOKENS' -ErrorAction SilentlyContinue
|        $global:SI_SetupHandoff = $h
|    }
|    if (-not $h.Present) { return $null }
|    if (-not $h.Ok) { throw ('The sign-in handed over by the installation page cannot be used: {0}. Nothing was changed. Restart the install with a fresh code from the installation page.' -f $h.Reason) }
|    if ("$TenantId".Trim() -and $h.TenantId -and $h.TenantId -ne "$TenantId".Trim().ToLowerInvariant()) {
|        throw ('The sign-in handed over by the installation page is for tenant {0}, not this installation''s tenant {1}. Nothing was changed. Restart the install from the installation page of tenant {1}.' -f $h.TenantId, "$TenantId".Trim())
|    }
|    return $h
|}
|
|function Test-SISetupHandoffPresent {
|    <# Was a sign-in handed over to this process (and not refused)? Never throws. #>
|    try { return [bool](Get-SISetupHandoff) } catch { return $false }
|}
|
|function Get-SISetupHandoffStatus {
|    <#
|        PURE given -NowUtc. Which handed-over tokens are usable for at least -MinMinutes more: @{ Expired = @(<resource>);
|        Missing = @(<resource>) } over -Resources. Used before each install step, so a step never starts on a token that
|        runs out under it.
|    #>
|    param([Parameter(Mandatory)][hashtable]$Handoff, [string[]]$Resources = @('https://management.azure.com/'), [datetime]$NowUtc = [datetime]::UtcNow, [int]$MinMinutes = $script:SIHandoffMinMinutes)
|    $exp = @(); $miss = @()
|    foreach ($r in $Resources) {
|        $k = Get-SIHandoffResourceKey $r
|        if (-not $Handoff.Tokens.ContainsKey($k)) { $miss += $k; continue }
|        if ($Handoff.Tokens[$k].ExpiresAt -le $NowUtc.AddMinutes($MinMinutes)) { $exp += $k }
|    }
|    @{ Expired = $exp; Missing = $miss }
|}
|
|# ---------------------------------------------------------------------------------------------------------------
|# The loopback listener and the browser
|# ---------------------------------------------------------------------------------------------------------------
|function Get-SIFreeLoopbackPort {
|    <# A free TCP port on the loopback interface (the OS picks it). #>
|    $l = New-Object System.Net.Sockets.TcpListener([System.Net.IPAddress]::Loopback, 0)
|    try { $l.Start(); return ([System.Net.IPEndPoint]$l.LocalEndpoint).Port } finally { $l.Stop() }
|}
|
|function Get-SISignInEdgePath {
|    <# The Microsoft Edge executable on Windows ($null when absent): the sign-in opens InPrivate in it. #>
|    foreach ($b in @(${env:ProgramFiles(x86)}, $env:ProgramFiles)) {
|        if (-not "$b".Trim()) { continue }
|        $p = [IO.Path]::Combine($b, 'Microsoft', 'Edge', 'Application', 'msedge.exe')
|        if (Test-Path -LiteralPath $p) { return $p }
|    }
|    $null
|}
|
|function Open-SISignInBrowser {
|    <#
|        Opens the sign-in page. Never throws: the URL is always printed as well.
|        #564 (PIM's install at customer I, 2026-10-10): a normal browser window opens the DEFAULT profile, whose saved account signs in
|        silently -- the person never sees a credential prompt and lands in the wrong tenant. On Windows the page opens in an
|        Edge InPrivate window (no saved account, the sign-in form always appears); without Edge, the default browser.
|        SI_SIGNIN_BROWSER=none: nothing is opened -- the person pastes the printed address into the right browser profile.
|    #>
|    param([Parameter(Mandatory)][string]$Url)
|    if ("$env:SI_SIGNIN_BROWSER".Trim().ToLowerInvariant() -eq 'none') { return $false }
|    try {
|        if ($PSVersionTable.PSEdition -ne 'Core' -or $IsWindows) {
|            $edge = Get-SISignInEdgePath
|            if ($edge) { Start-Process -FilePath $edge -ArgumentList @('--inprivate', '--new-window', $Url) | Out-Null; return $true }
|            Start-Process -FilePath $Url | Out-Null; return $true
|        }
|        if ($IsMacOS) { & open $Url 2>$null | Out-Null; return $true }
|        & xdg-open $Url 2>$null | Out-Null
|        return $true
|    } catch { return $false }
|}
|
|function Wait-SILoopbackAuthCode {
|    <#
|        Listens on http://localhost:<Port>/ (the loopback interface only) for the browser's redirect, answers it with a
|        short page, and returns the request's query string. -Listener is a test seam (an HttpListener the test drives).
|    #>
|    param([Parameter(Mandatory)][int]$Port, [int]$TimeoutSec = 300, $Listener)
|    $own = $false
|    if (-not $Listener) {
|        $Listener = New-Object System.Net.HttpListener
|        $Listener.Prefixes.Add(('http://localhost:{0}/' -f $Port))
|        $Listener.Start()
|        $own = $true
|    }
|    try {
|        $deadline = [datetime]::UtcNow.AddSeconds($TimeoutSec)
|        while ($true) {
|            $task = $Listener.GetContextAsync()
|            $left = [int][Math]::Max(1, ($deadline - [datetime]::UtcNow).TotalMilliseconds)
|            if (-not $task.Wait($left)) {
|                throw ('No answer from the browser sign-in within {0} seconds. Run the same command again and complete the sign-in in the browser window that opens.' -f $TimeoutSec)
|            }
|            $ctx = $task.Result
|            $query = [string]$ctx.Request.Url.Query
|            $isAnswer = ($query -match '(^|[?&])(code|error)=')
|            $html = if ($isAnswer) {
|                '<!doctype html><html><head><meta charset="utf-8"><title>SecurityInsight sign-in</title></head><body style="font-family:Segoe UI,Arial,sans-serif;margin:40px"><h2>SecurityInsight</h2><p>The sign-in is complete. You can close this window and return to PowerShell.</p></body></html>'
|            } else { '<!doctype html><html><body></body></html>' }
|            $bytes = [System.Text.Encoding]::UTF8.GetBytes($html)
|            try {
|                $ctx.Response.StatusCode = 200
|                $ctx.Response.ContentType = 'text/html; charset=utf-8'
|                $ctx.Response.ContentLength64 = $bytes.Length
|                $ctx.Response.OutputStream.Write($bytes, 0, $bytes.Length)
|            } finally { $ctx.Response.OutputStream.Close(); $ctx.Response.Close() }
|            if ($isAnswer) { return $query }
|            # a favicon or a probe: keep listening for the real redirect
|        }
|    } finally {
|        if ($own) { try { $Listener.Stop(); $Listener.Close() } catch { } }
|    }
|}
|
|# ---------------------------------------------------------------------------------------------------------------
|# Token endpoints
|# ---------------------------------------------------------------------------------------------------------------
|function Invoke-SISignInTokenRequest {
|    <# POST to the Entra v2 token endpoint of -TenantId with -Form. Returns the parsed response; throws Entra's own
|       error text (AADSTS...) in a customer sentence. #>
|    param([Parameter(Mandatory)][string]$TenantId, [Parameter(Mandatory)][System.Collections.IDictionary]$Form, [string]$What = 'Sign-in')
|    $pairs = foreach ($k in $Form.Keys) { '{0}={1}' -f $k, [uri]::EscapeDataString([string]$Form[$k]) }
|    $uri = 'https://login.microsoftonline.com/{0}/oauth2/v2.0/token' -f [uri]::EscapeDataString($TenantId)
|    $r = Invoke-SIAzRestHttp -Method POST -Uri $uri -Body ($pairs -join '&') -ContentType 'application/x-www-form-urlencoded' -TimeoutSec 60
|    $code = [int]$r.StatusCode
|    $j = $null; try { $j = ([string]$r.Content) | ConvertFrom-Json } catch { }
|    if ($code -lt 200 -or $code -ge 300 -or -not $j -or -not $j.access_token) {
|        $msg = if ($j -and $j.error_description) { ([string]$j.error_description -split "`r?`n")[0] } elseif ($code -eq 0) { [string]$r.Content } else { [string]$r.Content }
|        throw ('{0} failed (HTTP {1}): {2}' -f $What, $code, $msg)
|    }
|    return $j
|}
|
|function Get-SICloudShellToken {
|    <# A token for -Resource from the Azure Cloud Shell token endpoint: the person who opened Cloud Shell. #>
|    param([Parameter(Mandatory)][string]$Resource)
|    $ep = Get-SICloudShellEndpoint
|    if (-not $ep) { throw 'This is not Azure Cloud Shell: no Cloud Shell token endpoint (MSI_ENDPOINT) is set.' }
|    $res = ($Resource -replace '/\.default$', '').TrimEnd('/') + '/'
|    $r = Invoke-SIAzRestHttp -Method POST -Uri $ep -Headers @{ Metadata = 'true' } -Body ('resource=' + [uri]::EscapeDataString($res)) `
|             -ContentType 'application/x-www-form-urlencoded' -TimeoutSec 60
|    $j = $null; try { $j = ([string]$r.Content) | ConvertFrom-Json } catch { }
|    if ([int]$r.StatusCode -lt 200 -or [int]$r.StatusCode -ge 300 -or -not $j -or -not $j.access_token) {
|        throw ('Azure Cloud Shell did not hand out a token for {0} (HTTP {1}): {2}. Close and reopen Cloud Shell, then run the same command again.' -f $res, $r.StatusCode, $r.Content)
|    }
|    return [pscustomobject]@{ Token = [string]$j.access_token; ExpiresAt = (Get-SITokenExpiry -Response $j) }
|}
|
|# ---------------------------------------------------------------------------------------------------------------
|# The user session
|# ---------------------------------------------------------------------------------------------------------------
|function Send-SISignInNotice {
|    <#
|        #564: says "waiting: sign-in required for <resource> in tenant <t>" BEFORE a browser window opens -- on the console
|        and to the host's progress feed: $global:SI_SignInNotify = { param($Resource, $TenantId) ... } (the guided install
|        registers it and posts the line as an event, so the status page shows WHY the install waits). Never throws.
|    #>
|    param([Parameter(Mandatory)][string]$Resource, [string]$TenantId)
|    $t = if ("$TenantId".Trim()) { "$TenantId".Trim() } else { 'your organisation' }
|    Write-Host ('waiting: sign-in required for {0} in tenant {1}' -f $Resource, $t) -ForegroundColor Yellow
|    $n = Get-Variable -Scope Global -Name SI_SignInNotify -ValueOnly -ErrorAction Ignore
|    if ($n -is [scriptblock]) { try { & $n $Resource $TenantId } catch { } }
|}
|
|function Assert-SISignInTenant {
|    <# PURE apart from throwing. #564: a token whose tid is not the target tenant (a wrong browser profile or account) is
|       refused before any call is made with it. No target tenant (or not a tenant id) = nothing to compare. #>
|    param([AllowEmptyString()][string]$Token, [string]$TenantId, [string]$Where = 'the browser')
|    if (-not "$TenantId".Trim() -or "$TenantId" -notmatch '^[0-9a-fA-F-]{36}$') { return }
|    $c = ConvertFrom-SISignInJwt $Token
|    $tid = if ($c -and $c.PSObject.Properties['tid']) { [string]$c.tid } else { '' }
|    if ($tid -and $tid -ne $TenantId) {
|        throw ('You signed in to tenant {0} in {1}, but this installation is for tenant {2}. Sign in with an account of tenant {2} (open the address in the browser profile of an admin of that tenant), then run the same command again.' -f $tid, $Where, $TenantId)
|    }
|}
|
|function Test-SISignInInteractive {
|    <# Can this session open a browser for a person? (A seam: tests fake it -- a gate run over SSH is never interactive.) #>
|    $interactive = $true
|    try { $interactive = [Environment]::UserInteractive } catch { }
|    [bool]$interactive
|}
|
|function Invoke-SIBrowserCodeSignIn {
|    <#
|        ONE browser sign-in (authorization code + PKCE on a loopback listener) for -Resource with the public client
|        -ClientId. Returns Entra's token response (access_token, refresh_token, expires_in). The account must belong to
|        -TenantId (#564). -Prompt '' with a -LoginHint lets the browser reuse the person's sign-in (no account picker).
|    #>
|    param(
|        [string]$TenantId,
|        [Parameter(Mandatory)][string]$ClientId,
|        [Parameter(Mandatory)][string]$Resource,
|        [string]$LoginHint,
|        [string]$Prompt = 'select_account',
|        [string]$What = 'Azure Resource Manager',
|        [string]$Title = 'Sign in to Azure in your browser.',
|        [string]$FailText = 'The Azure sign-in',
|        [int]$TimeoutSec = 300
|    )
|    $pkce = New-SIPkcePair
|    $state = New-SIRandomBase64Url -ByteCount 16
|    $port = Get-SIFreeLoopbackPort
|    $redirect = 'http://localhost:{0}/' -f $port
|    $scope = (Get-SISignInScope -Resource $Resource) + ' offline_access openid profile'
|    $url = Get-SIAuthorizeUrl -TenantId $TenantId -ClientId $ClientId -RedirectUri $redirect -Scope $scope -CodeChallenge $pkce.Challenge -State $state -LoginHint $LoginHint -Prompt $Prompt
|    # #564: the reason for the wait is said BEFORE any window opens; the address is always printed
|    Send-SISignInNotice -Resource $What -TenantId $TenantId
|    $who = if ($TenantId) { 'an admin of tenant ' + $TenantId } else { 'the admin who installs' }
|    Write-Host ''
|    Write-Host ('{0} If no window opens, or it opens in the wrong profile or account, open this address in the browser profile of {1}:' -f $Title, $who) -ForegroundColor Cyan
|    Write-Host ('  {0}' -f $url)
|    $null = Open-SISignInBrowser -Url $url
|    $query = Wait-SILoopbackAuthCode -Port $port -TimeoutSec $TimeoutSec
|    $code = Resolve-SIAuthRedirect -Query $query -ExpectedState $state
|    $authTenant = if ($TenantId) { $TenantId } else { 'organizations' }
|    $j = Invoke-SISignInTokenRequest -TenantId $authTenant -What $FailText -Form ([ordered]@{
|        client_id     = $ClientId
|        grant_type    = 'authorization_code'
|        code          = $code
|        redirect_uri  = $redirect
|        code_verifier = $pkce.Verifier
|        scope         = $scope
|    })
|    # #564: the account must belong to the TARGET tenant -- refused here, before any call uses the token
|    Assert-SISignInTenant -Token ([string]$j.access_token) -TenantId $TenantId -Where 'the browser'
|    return $j
|}
|
|function Connect-SISetupUser {
|    <#
|        Signs a PERSON in for setup and records the session in this process (memory only).
|          -Method Auto       Cloud Shell when this is Cloud Shell, else the browser (code + PKCE on a loopback listener)
|          -Method CloudShell the Cloud Shell token endpoint
|          -Method Browser    the browser
|        -TenantId: the tenant to sign in to (the browser signs in there; Cloud Shell must already be in it).
|        Returns the session: Method, TenantId, Account, ObjectId.
|    #>
|    param(
|        [string]$TenantId,
|        [ValidateSet('Auto', 'CloudShell', 'Browser', 'Handoff')][string]$Method = 'Auto',
|        [string]$LoginHint,
|        [int]$TimeoutSec = 300,
|        [string]$ClientId
|    )
|    # #876: a sign-in handed over by the installation page answers first -- nothing is signed in here
|    $ho = $null
|    if ($Method -in 'Auto', 'Handoff') { $ho = Get-SISetupHandoff -TenantId $TenantId }
|    if ($Method -eq 'Handoff' -and -not $ho) { throw 'No sign-in was handed over to this PowerShell session (SI_HANDOFF_TOKENS is not set).' }
|    if ($ho) { $Method = 'Handoff' }
|    if ($Method -eq 'Auto') { $Method = if (Test-SICloudShell) { 'CloudShell' } else { 'Browser' } }
|    $st = Get-SISignInState
|    $st.Tokens = @{}
|    $st['Exchange'] = $null
|    $arm = 'https://management.azure.com/'
|    if ($Method -eq 'Handoff') {
|        $armTok = $ho.Tokens[$arm]
|        if ($armTok.ExpiresAt -le [datetime]::UtcNow.AddMinutes($script:SIHandoffMinMinutes)) { throw (Get-SIHandoffExpiredText -Resource $arm) }
|        $st.Session = @{ Method = 'Handoff'; TenantId = $ho.TenantId; Account = $ho.Account; ObjectId = $ho.ObjectId; IsApp = [bool]$ho.IsApp; AppId = $ho.AppId; RefreshToken = $null; ClientId = $null }
|        foreach ($k in @($ho.Tokens.Keys)) { $st.Tokens[$k] = @{ Token = $ho.Tokens[$k].Token; ExpiresAt = $ho.Tokens[$k].ExpiresAt } }
|        Write-Host ('Using the sign-in handed over by the installation page: {0} {1} (tenant {2}) -- no sign-in here.' -f $(if ($ho.IsApp) { 'the application' } else { 'the account' }), $ho.Account, $ho.TenantId) -ForegroundColor Green
|        return [pscustomobject]@{ Method = 'Handoff'; TenantId = $ho.TenantId; Account = $ho.Account; ObjectId = $ho.ObjectId; IsApp = [bool]$ho.IsApp }
|    }
|    if ($Method -eq 'CloudShell') {
|        $t = Get-SICloudShellToken -Resource $arm
|        $c = ConvertFrom-SISignInJwt $t.Token
|        $tid = if ($c) { [string]$c.tid } else { '' }
|        if ($TenantId -and $tid -and $tid -ne $TenantId) {
|            throw ("Azure Cloud Shell is signed in to tenant {0}, but this needs tenant {1}. Switch directory in the Azure portal (Settings > Directories), reopen Cloud Shell, then run the same command again." -f $tid, $TenantId)
|        }
|        $st.Session = @{ Method = 'CloudShell'; TenantId = $tid; Account = (Get-SISignInAccountName $c); ObjectId = $(if ($c) { [string]$c.oid } else { '' }); RefreshToken = $null; ClientId = $null }
|        $st.Tokens[$arm] = @{ Token = $t.Token; ExpiresAt = $t.ExpiresAt }
|    } else {
|        if (Test-SICloudShell) {
|            # #564: Cloud Shell has its own token endpoint (-Method CloudShell / Auto); a localhost answer cannot reach it
|            throw 'Azure Cloud Shell cannot take the browser sign-in''s answer (it goes to localhost on your own machine). In Cloud Shell setup signs in through Cloud Shell itself: run the same command without asking for the browser sign-in.'
|        }
|        if (-not (Test-SISignInInteractive)) {
|            throw 'A person has to sign in for this step, and this PowerShell session cannot open a browser. Run it in an interactive session or in Azure Cloud Shell, or sign in with an app (certificate or client secret).'
|        }
|        if (-not $ClientId) { $ClientId = Get-SISignInClientId }
|        $j = Invoke-SIBrowserCodeSignIn -TenantId $TenantId -ClientId $ClientId -Resource $arm -LoginHint $LoginHint -TimeoutSec $TimeoutSec
|        $c = ConvertFrom-SISignInJwt ([string]$j.access_token)
|        $tid = if ($c -and $c.tid) { [string]$c.tid } else { $TenantId }
|        $st.Session = @{ Method = 'Browser'; TenantId = $tid; Account = (Get-SISignInAccountName $c); ObjectId = $(if ($c) { [string]$c.oid } else { '' }); RefreshToken = [string]$j.refresh_token; ClientId = $ClientId }
|        $st.Tokens[$arm] = @{ Token = [string]$j.access_token; ExpiresAt = (Get-SITokenExpiry -Response $j) }
|    }
|    Write-Host ('Signed in to Azure as {0} (tenant {1}, {2}).' -f $st.Session.Account, $st.Session.TenantId, $(if ($st.Session.Method -eq 'CloudShell') { 'Azure Cloud Shell' } else { 'browser sign-in' })) -ForegroundColor Green
|    return [pscustomobject]@{ Method = $st.Session.Method; TenantId = $st.Session.TenantId; Account = $st.Session.Account; ObjectId = $st.Session.ObjectId }
|}
|
|function Test-SISetupUserSignedIn {
|    $st = Get-SISignInState
|    return ($st.Session -is [hashtable])
|}
|
|function Get-SISetupUserToken {
|    <# A token for -Resource as the signed-in person: memory cache, else the Cloud Shell endpoint or the refresh token. #>
|    param([Parameter(Mandatory)][string]$Resource, [switch]$ForceRefresh)
|    $st = Get-SISignInState
|    $s = $st.Session
|    if (-not ($s -is [hashtable])) { throw 'No one is signed in to Azure in this PowerShell session. Run the same command again to sign in.' }
|    $res = ($Resource -replace '/\.default$', '').TrimEnd('/') + '/'
|    if ($s.Method -eq 'Handoff') {
|        # #876: a handed-over token cannot be renewed here (no refresh token crosses over): one that is about to run out
|        # stops the step with one plain line, and the install resumes from that step with a fresh hand-over
|        $k = Get-SIHandoffResourceKey $res
|        $hit = $null
|        foreach ($tk in @($st.Tokens.Keys)) { if ((Get-SIHandoffResourceKey $tk) -eq $k) { $hit = $st.Tokens[$tk]; break } }
|        if (-not $hit) {
|            throw ('The sign-in handed over by the installation page holds no token for {0}, which this step needs. Nothing more was changed. Restart the install with a hand-over that includes {0} (the install resumes where it stopped).' -f $k.TrimEnd('/'))
|        }
|        if ($hit.ExpiresAt -le [datetime]::UtcNow.AddMinutes($script:SIHandoffMinMinutes)) { $global:SI_SetupHandoffExpired = $k; throw (Get-SIHandoffExpiredText -Resource $k) }
|        return [string]$hit.Token
|    }
|    if (-not $ForceRefresh -and $st.Tokens.ContainsKey($res) -and $st.Tokens[$res].ExpiresAt -gt [datetime]::UtcNow) { return [string]$st.Tokens[$res].Token }
|    if ($s.Method -eq 'CloudShell') {
|        $t = Get-SICloudShellToken -Resource $res
|        $st.Tokens[$res] = @{ Token = $t.Token; ExpiresAt = $t.ExpiresAt }
|        return $t.Token
|    }
|    if (Test-SISignInExchangeResource -Resource $res) {
|        # Exchange Online takes only a token of its own client (Exchange.Manage): its own refresh token, and the first time
|        # one more browser sign-in -- the same account pre-filled, so the browser normally signs straight in.
|        $xc = Get-SISignInExchangeClientId
|        $x = $st['Exchange']
|        $j = $null
|        if ($x -is [hashtable] -and $x.RefreshToken -and $x.ClientId -eq $xc) {
|            try {
|                $j = Invoke-SISignInTokenRequest -TenantId $s.TenantId -What 'Getting a token for Exchange Online' -Form ([ordered]@{
|                    client_id = $xc; grant_type = 'refresh_token'; refresh_token = $x.RefreshToken; scope = (Get-SISignInScope -Resource $res) + ' offline_access' })
|            } catch { $j = $null }
|        }
|        if (-not $j) {
|            if (-not (Test-SISignInInteractive)) { throw 'Exchange Online needs its own sign-in in the browser, and this PowerShell session cannot open a browser. Run it in an interactive PowerShell window.' }
|            $j = Invoke-SIBrowserCodeSignIn -TenantId $s.TenantId -ClientId $xc -Resource $res -LoginHint ([string]$s.Account) -Prompt '' `
|                     -What 'Exchange Online' -Title 'Sign in once more, for Exchange Online (it accepts only its own sign-in; your account is filled in).' -FailText 'The Exchange Online sign-in'
|        }
|        $st['Exchange'] = @{ ClientId = $xc; RefreshToken = $(if ($j.refresh_token) { [string]$j.refresh_token } elseif ($x -is [hashtable]) { $x.RefreshToken } else { $null }) }
|        Assert-SISignInTenant -Token ([string]$j.access_token) -TenantId ([string]$s.TenantId) -Where 'the token for Exchange Online'
|        $st.Tokens[$res] = @{ Token = [string]$j.access_token; ExpiresAt = (Get-SITokenExpiry -Response $j) }
|        return [string]$j.access_token
|    }
|    if (-not $s.RefreshToken) { throw 'The Azure sign-in has expired. Run the same command again to sign in.' }
|    $j = Invoke-SISignInTokenRequest -TenantId $s.TenantId -What ('Getting a token for {0}' -f $res) -Form ([ordered]@{
|        client_id     = $s.ClientId
|        grant_type    = 'refresh_token'
|        refresh_token = $s.RefreshToken
|        scope         = (Get-SISignInScope -Resource $res) + ' offline_access'
|    })
|    if ($j.refresh_token) { $s.RefreshToken = [string]$j.refresh_token }   # Entra rotates it
|    Assert-SISignInTenant -Token ([string]$j.access_token) -TenantId ([string]$s.TenantId) -Where ('the token for ' + $res)
|    $st.Tokens[$res] = @{ Token = [string]$j.access_token; ExpiresAt = (Get-SITokenExpiry -Response $j) }
|    return [string]$j.access_token
|}
|
|function Disconnect-SISetupUser {
|    $st = Get-SISignInState
|    $st.Session = $null
|    $st.Tokens = @{}
|    $st['Exchange'] = $null
|}
'@ }
$__siSupportFiles['engine/pro-settings/SI-ProSettings.ps1'] = @{ Sha256 = '5e4df5378cff1ac0886188081185f40dda9afc32e75c5242fbd0d6f830d34d1b'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- THE SETTINGS STORE (REQUIREMENTS §9.2, Pro-1).
|
|    In Pro every setting lives in SQL (cfg.Setting, sql\si-pro-settings.sql) and the launcher loads it at run start as
|    the CLOSEST configuration layer: shipped defaults and the files load first, then this. Engines are unchanged -- they
|    see the same $global: values a Community install sets in files.
|
|    🔒 FAIL CLOSED (operator, 2026-10-02): "SQL unreachable at run start = the run FAILS". A Pro install's settings are
|    authoritative; running on whatever the files happen to say instead would be a silent, wrong run. The same goes for a
|    row that does not validate -- it is refused, and the run stops with the reason, rather than handing an engine a bad
|    value.
|
|    The validation is the Community Settings page's own (engine\pro-settings\SI-Settings.ps1: the catalog and
|    Test-SISettingValue), so a value is checked by the same rules whichever edition wrote it.
|    Everything here except the store's default Invoke and Invoke-SIProSettingsLayer is pure and tested directly.
|#>
|
|$script:SIProRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|# Azure access (Log Analytics: has any run ever ended well -- Get-SIProSettingsGoodRunCount): plain REST, no modules
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '../_shared/SI-AzRest.ps1') }
|if (-not (Get-Command Test-SISettingValue -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-Settings.ps1'))
|}
|# Phase C: templates, item overrides, exemptions and the materialisation of every configuration family.
|. ([System.IO.Path]::Combine($PSScriptRoot, 'SI-ProConfig.ps1'))
|# #260: the audit trail's PowerShell writer (Write-SIAuditEvent) -- every Pro tool that opens the store can record its steps.
|. ([System.IO.Path]::Combine($PSScriptRoot, 'SI-Audit.ps1'))
|# the install's update ring (Read-SIInstallRingFacts): read at run start for the ring every status report carries
|if (-not (Get-Command -Name Read-SIInstallRingFacts -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, '..', '_shared', 'SI-InstallRing.ps1')) }
|
|function Get-SIProTokenCacheUntil {
|    <#
|        PURE. How long a SQL access token may be reused: until 5 minutes before its OWN expiry (the JWT 'exp' claim), never
|        longer than 45 minutes. A token that cannot be read keeps the 45 minutes (the sign-in retry covers it). customer G
|        2026-10-09: a managed-identity token can arrive with minutes left -- held for a fixed 45 it expired mid-run.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Token, [datetime]$Now = [datetime]::UtcNow)
|    $max = $Now.AddMinutes(45)
|    try {
|        $part = ([string]$Token).Split('.')[1]
|        $part = $part.Replace('-', '+').Replace('_', '/'); switch ($part.Length % 4) { 2 { $part += '==' } 3 { $part += '=' } }
|        $exp = [long](([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($part)) | ConvertFrom-Json).exp)
|        if ($exp -le 0) { return $max }
|        $until = [DateTimeOffset]::FromUnixTimeSeconds($exp).UtcDateTime.AddMinutes(-5)
|        if ($until -lt $max) { return $until }
|        return $max
|    } catch { return $max }
|}
|
|function Get-SIProSqlLoginFailureText {
|    <#
|        PURE. The plain words for a sign-in the Pro database refused TWICE (the second time with a fresh token): WHICH
|        identity needs a database user, from the token's own claims (appid / oid, and the audience it was issued for), and
|        how to grant it. Keeps the server's text ("Login failed for user ...") so the error class stays sql-login. A token
|        for another resource than the database is said as such (that is a product defect, not a missing grant).
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Token, [string]$Server, [string]$Database, [AllowEmptyString()][string]$ServerText)
|    $c = $null
|    try {
|        $part = ([string]$Token).Split('.')[1]
|        $part = $part.Replace('-', '+').Replace('_', '/'); switch ($part.Length % 4) { 2 { $part += '==' } 3 { $part += '=' } }
|        $c = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($part)) | ConvertFrom-Json
|    } catch { $c = $null }
|    $app = ''; $oid = ''; $aud = ''
|    if ($c) {
|        if ($c.PSObject.Properties['appid']) { $app = [string]$c.appid } elseif ($c.PSObject.Properties['azp']) { $app = [string]$c.azp }
|        if ($c.PSObject.Properties['oid']) { $oid = [string]$c.oid }
|        if ($c.PSObject.Properties['aud']) { $aud = [string]$c.aud }
|    }
|    $who = if ($app -or $oid) { ('the identity with client id {0}{1}' -f $(if ($app) { $app } else { '(unknown)' }), $(if ($oid) { " (object id $oid)" } else { '' })) } else { "this job's identity" }
|    if ($aud -and $aud.TrimEnd('/') -notmatch '^https://database\.windows\.net$') {
|        return ("the Pro database {0}/{1} refused the sign-in: the token was issued for '{2}', not for the database (https://database.windows.net/) -- a product defect, please report it. {3}" -f $Server, $Database, $aud, $ServerText)
|    }
|    ("the Pro database {0}/{1} refused the sign-in of {2}, also with a fresh token: it has no user in that database. Re-run the setup's database step (it grants every job's identity), or in the database as an Entra admin: CREATE USER [<the job's identity name>] FROM EXTERNAL PROVIDER; then give it the SecurityInsight roles. {3}" -f $Server, $Database, $who, $ServerText)
|}
|
|function New-SIProSettingsStore {
|    <#
|        The Pro database. -Invoke is the ONE seam (sql, params, mode 'reader' | 'nonquery' | 'scalar') -- tests pass a
|        fake; the default opens a connection per call with an Entra token for the engine SPN (certificate), the same way
|        the vulnerability close-loop reaches the same database.
|    #>
|    param([string]$Server, [string]$Database, [string]$AppId, [string]$TenantId, [string]$CertThumbprint, [scriptblock]$Invoke)
|    if (-not $Invoke) {
|        if ([string]::IsNullOrWhiteSpace($Server) -or [string]::IsNullOrWhiteSpace($Database)) { throw 'the Pro database is not configured (SI_ProSqlServer / SI_ProSqlDatabase)' }
|        $srv = $Server; $db = $Database; $app = $AppId; $ten = $TenantId
|        $tokenCache = @{ Token = $null; Until = [datetime]::MinValue }
|        if ($global:SI_UseManagedIdentity) {
|            # #211 (2): a container signed in as the job's managed identity (#209) -- Pro is container-only. The SQL
|            # token comes from the identity endpoint; no certificate exists there.
|            # The container entry point loads the identity helper; an engine never loads it itself.
|            if (-not (Get-Command -Name 'Get-SIManagedIdentityToken' -ErrorAction SilentlyContinue)) {
|                throw 'managed identity: the identity token helper is not loaded -- this sign-in works only inside a SecurityInsight container.'
|            }
|            $miFn = ${function:Get-SIManagedIdentityToken}
|            $getToken = { param([switch]$Fresh) & $miFn -Resource 'https://database.windows.net/' -ForceRefresh:$Fresh }.GetNewClosure()
|        } else {
|            if (-not (Get-Command -Name 'Get-SILedgerAccessToken' -ErrorAction SilentlyContinue)) {
|                . (Join-Path $script:SIProRoot 'engine\data-model\identity\SI-ObjectLedgerStore.ps1')
|            }
|            $cert = Get-SILedgerCertificate -Thumbprint $CertThumbprint
|            if (-not $cert) { throw ("the engine certificate {0} with a private key was not found" -f $CertThumbprint) }
|            $tokenFn = ${function:Get-SILedgerAccessToken}
|            # (a certificate token is requested new on every call -- -Fresh changes nothing here)
|            $getToken = { param([switch]$Fresh) & $tokenFn -Certificate $cert -AppId $app -TenantId $ten }.GetNewClosure()
|        }
|        $untilOf = ${function:Get-SIProTokenCacheUntil}
|        $loginText = ${function:Get-SIProSqlLoginFailureText}
|        # 2026-10-28 (a small install, a pipeline wake-up): the open failed on a broken pooled connection ("Internal .NET
|        # Framework Data Provider error 6") while the token was fine and the next wake-ups read the database. A temporary
|        # Azure SQL answer at the OPEN (Test-SISqlStatementTransient, SI-SqlRetry.ps1 -- nothing was sent yet) is tried again
|        # on a new connection after 2, 5, 10, 20 and 30 s, the pool of the broken one cleared first.
|        if (-not (Get-Command -Name Test-SISqlStatementTransient -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-SqlRetry.ps1')) }
|        $openTransient = ${function:Test-SISqlStatementTransient}
|        $openWaits = @(2, 5, 10, 20, 30)
|        # the ONE place this store builds a connection (the first open, the retry after a broken open, the fresh-token open)
|        $newCn = { param([string]$cs, [string]$tok) $c = New-Object System.Data.SqlClient.SqlConnection($cs); $c.AccessToken = $tok; $c }
|        $Invoke = {
|            param([string]$sql, $p, [string]$mode)
|            if (-not $tokenCache.Token -or [datetime]::UtcNow -ge $tokenCache.Until) {
|                $tokenCache.Token = & $getToken
|                $tokenCache.Until = & $untilOf -Token $tokenCache.Token -Now ([datetime]::UtcNow)
|            }
|            $cs = 'Server=tcp:{0},1433;Database={1};Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;' -f $srv, $db
|            $cn = & $newCn $cs $tokenCache.Token
|            try {
|                # customer G 2026-10-09: a token held for a fixed 45 minutes expired mid-run and every call answered "Login
|                # failed" (18456). A failed sign-in takes a FRESH token and opens once more; a second failure is the answer.
|                $openTry = 0; $openErr = $null
|                while ($true) {
|                    try { $cn.Open(); $openErr = $null; break }
|                    catch {
|                        if ($openTry -lt $openWaits.Count -and (& $openTransient $_)) {
|                            $ow = [int]$openWaits[$openTry]; $openTry++
|                            Write-Host ('       the database {0} could not be opened for a moment ({1}) -- trying again on a new connection in {2} s ({3}/{4})' -f $db, (([string]$_.Exception.Message) -split "`n")[0].Trim(), $ow, $openTry, $openWaits.Count) -ForegroundColor DarkYellow
|                            try { [System.Data.SqlClient.SqlConnection]::ClearPool($cn) } catch { }
|                            $cn.Dispose(); Start-Sleep -Seconds $ow
|                            $cn = & $newCn $cs $tokenCache.Token
|                            continue
|                        }
|                        $openErr = $_; break
|                    }
|                }
|                if ($openErr) {
|                    $sx = $openErr.Exception; while ($sx -and -not ($sx -is [System.Data.SqlClient.SqlException]) -and $sx.InnerException) { $sx = $sx.InnerException }
|                    if (-not ($sx -is [System.Data.SqlClient.SqlException]) -or [int]$sx.Number -ne 18456) { throw $openErr }
|                    $cn.Dispose()
|                    Start-Sleep -Seconds 3
|                    $tokenCache.Token = & $getToken -Fresh
|                    $tokenCache.Until = & $untilOf -Token $tokenCache.Token -Now ([datetime]::UtcNow)
|                    $cn = & $newCn $cs $tokenCache.Token
|                    # refused again with a fresh token: say WHICH identity needs the grant, in plain words (rc.465, MarkDone)
|                    try { $cn.Open() }
|                    catch {
|                        $sx2 = $_.Exception; while ($sx2 -and -not ($sx2 -is [System.Data.SqlClient.SqlException]) -and $sx2.InnerException) { $sx2 = $sx2.InnerException }
|                        if (-not ($sx2 -is [System.Data.SqlClient.SqlException]) -or [int]$sx2.Number -ne 18456) { throw }
|                        throw (& $loginText -Token $tokenCache.Token -Server $srv -Database $db -ServerText $sx2.Message)
|                    }
|                }
|                # mode 'transaction' (-p = { param($TxInvoke) }): ONE connection, ONE transaction for everything the body sends
|                # through $TxInvoke (sql, params, mode) -- committed when the body returns, rolled back on any error (the template
|                # publish: a run never reads a half-written set)
|                if ($mode -eq 'transaction') {
|                    $tx = $cn.BeginTransaction()
|                    $txInvoke = {
|                        param([string]$tsql, $tp, [string]$tmode)
|                        $tc = $cn.CreateCommand(); $tc.Transaction = $tx; $tc.CommandText = $tsql; $tc.CommandTimeout = 0
|                        if ($tp) { foreach ($k in $tp.Keys) { [void]$tc.Parameters.AddWithValue('@' + $k, $(if ($null -eq $tp[$k]) { [System.DBNull]::Value } else { $tp[$k] })) } }
|                        if ($tmode -eq 'reader') { $rd = $tc.ExecuteReader(); $out = New-Object System.Collections.Generic.List[object]; while ($rd.Read()) { $h = @{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $h[$rd.GetName($i)] = $(if ($rd.IsDBNull($i)) { $null } else { $rd.GetValue($i) }) }; $out.Add($h) }; $rd.Close(); return , $out.ToArray() }
|                        if ($tmode -eq 'scalar') { return $tc.ExecuteScalar() }
|                        [void]$tc.ExecuteNonQuery()
|                    }.GetNewClosure()
|                    try { $r = & $p $txInvoke; $tx.Commit(); $tx = $null; return $r }
|                    catch { if ($tx) { try { $tx.Rollback() } catch { } }; throw }
|                }
|                $cmd = $cn.CreateCommand(); $cmd.CommandText = $sql; $cmd.CommandTimeout = 0
|                if ($p) { foreach ($k in $p.Keys) { [void]$cmd.Parameters.AddWithValue('@' + $k, $(if ($null -eq $p[$k]) { [System.DBNull]::Value } else { $p[$k] })) } }
|                switch ($mode) {
|                    'reader' {
|                        $rd = $cmd.ExecuteReader()
|                        $out = New-Object System.Collections.Generic.List[object]
|                        while ($rd.Read()) { $h = @{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $h[$rd.GetName($i)] = $(if ($rd.IsDBNull($i)) { $null } else { $rd.GetValue($i) }) }; $out.Add($h) }
|                        $rd.Close(); , $out.ToArray()
|                    }
|                    'scalar' { $cmd.ExecuteScalar() }
|                    default  { [void]$cmd.ExecuteNonQuery() }
|                }
|            } finally { $cn.Dispose() }
|        }.GetNewClosure()
|        $own = $Invoke
|        $txn = { param([scriptblock]$Body) & $own '' $Body 'transaction' }.GetNewClosure()
|        return [pscustomobject]@{ Name = ('{0}/{1}' -f $Server, $Database); Invoke = $Invoke; Transaction = $txn }
|    }
|    [pscustomobject]@{ Name = ('{0}/{1}' -f $Server, $Database); Invoke = $Invoke }
|}
|
|function Read-SIProSettings {
|    <# Every row of cfg.Setting, one per pipeline item (the reader returns its rows as ONE array -- unrolled here, so
|       @(Read-SIProSettings) counts rows, not result sets). #>
|    param([Parameter(Mandatory)]$Store)
|    & $Store.Invoke 'SELECT Name, Scope, ValueJson, KeyVaultSecretName, CONVERT(varchar(30), CONVERT(bigint, RowVersion)) AS Version FROM cfg.Setting' @{} 'reader' | ForEach-Object { $_ }
|}
|
|# WHICH KEY VAULT SECRET A SECRET SETTING MAY NAME -- the SAME lists as the web app's SecretSettingPolicy.cs
|# (pro-management/src/SI.Management.Web/Settings; a test keeps the two equal). A secret setting names its OWN secret only:
|# the product's name for it or a name under its fixed prefix; never a secret the product keeps for another purpose, never
|# another setting's. A name a customer chose before this rule, outside the product's SI- names, keeps working.
|$script:SISecretSettingFamilies = @(
|    [pscustomobject]@{ Key = 'openai'; Settings = @('OpenAI_apiKey'); Names = @('SI-OpenAI-Key'); Prefix = 'SI-OpenAI-' }
|    [pscustomobject]@{ Key = 'smtp'; Settings = @('SMTPPassword'); Names = @('SI-Smtp-Password'); Prefix = 'SI-Smtp-' }
|    [pscustomobject]@{ Key = 'shodan'; Settings = @('SI_Shodan_ApiKey', 'SHODAN_ApiKey'); Names = @('SI-Shodan-ApiKey'); Prefix = 'SI-Shodan-' }
|    [pscustomobject]@{ Key = 'spn'; Settings = @('SI_SPN_Secret', 'SpnClientSecret', 'SpnSecretName', 'SI_Graph_Secret', 'SI_LogIngest_Secret'); Names = @('SI-SPN-Secret', 'SecurityInsight-Secret'); Prefix = 'SI-SPN-Secret' }
|)
|$script:SISecretSettingReserved = @('SI-Invardia-InstallKey', 'SI-InstallId', 'SI-License', 'SI-Update-State', 'SI-Settings-Handover',
|    'SI-LicenceRequest-State', 'SI-LicenceRequest-Notice', 'SI-LicenceRequest-PullToken', 'SI-SPN-Cert')
|$script:SISecretSettingReservedPrefixes = @('SI-Invardia-', 'SI-LicenceRequest-', 'SI-SPN-Cert', 'SI-Connector-', 'SI-ServiceNow-', 'SI-Web-')
|
|if (-not (Get-Command -Name Test-SIAzureSqlHost -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($script:SIProRoot, 'engine', '_shared', 'SI-OutboundTrust.ps1')) }
|
|function Test-SIProSettingHost {
|    <#
|        PURE. '' = a stored value of -Name may be put in force; else why not. The settings that name where a credential goes:
|          SI_Pro_DataSqlServer    the engine sends its Azure SQL access token there: an Azure SQL host only
|          SI_Pro_DataSqlDatabase  a database name only (it is never part of the connection's server)
|          SI_Telemetry_Endpoint   the install key goes there: Invardia's own https address only
|          SI_LicenseRequest_BaseUrl  the install key and the licence pull token go there: Invardia's own https address only
|        Empty = the default applies (allowed).
|    #>
|    param([Parameter(Mandatory)][string]$Name, $Value)
|    $v = "$Value".Trim()
|    if (-not $v) { return '' }
|    switch ($Name) {
|        'SI_Pro_DataSqlServer'      { return (Test-SIAzureSqlHost -Server $v) }
|        'SI_Pro_DataSqlDatabase'    { return (Test-SISqlDatabaseName -Database $v) }
|        'SI_Telemetry_Endpoint'     { return (Test-SITelemetryEndpointHost -Endpoint $v) }
|        'SI_LicenseRequest_BaseUrl' { return (Test-SITelemetryEndpointHost -Endpoint $v) }
|    }
|    ''
|}
|
|function Get-SISecretSettingFamily {
|    <# PURE. The family of a secret setting; one the list does not name gets its own: prefix SI-<name with dashes>. #>
|    param([Parameter(Mandatory)][string]$Setting)
|    foreach ($f in $script:SISecretSettingFamilies) { if (@($f.Settings | Where-Object { $_ -ieq $Setting }).Count) { return $f } }
|    [pscustomobject]@{ Key = $Setting; Settings = @(); Names = @(); Prefix = ('SI-' + $Setting.Replace('_', '-')) }
|}
|
|function Test-SISecretSettingReference {
|    <#
|        PURE. '' = -SecretName may be used for -Setting; else why not, in plain words.
|        Default: a reference ALREADY STORED (the engine's read, setup's import) -- its own names, or a name the customer chose
|        before the rule (not under the product's SI- names, not another setting's). -New: a new or changed reference -- its
|        own names only (the web app's save).
|    #>
|    param([Parameter(Mandatory)][string]$Setting, [AllowEmptyString()][string]$SecretName = '', [switch]$New,
|          # the other secret settings whose stored rows name the SAME Key Vault secret: a customer's own name belongs to one
|          # setting (family) only -- named by two, it is used by neither (ConvertFrom-SIProSettingRows passes them)
|          [AllowNull()][AllowEmptyCollection()][string[]]$AlsoNamedBy = @())
|    $n = "$SecretName".Trim()
|    if ($n -cnotmatch '^[0-9A-Za-z-]{1,127}$') { return ("'{0}' is not a Key Vault secret name" -f $n) }
|    $f = Get-SISecretSettingFamily -Setting $Setting
|    $allowed = '{0}a name that starts with {1}' -f $(if (@($f.Names).Count) { (@($f.Names) -join ' or ') + ', or ' } else { '' }), $f.Prefix
|    $reserved = @($script:SISecretSettingReserved | Where-Object { $_ -ieq $n }).Count -or @($script:SISecretSettingReservedPrefixes | Where-Object { $n.StartsWith($_, [StringComparison]::OrdinalIgnoreCase) }).Count
|    if ($reserved) { return ('{0} is a secret SecurityInsight keeps for another purpose -- {1} names its own secret: {2}' -f $n, $Setting, $allowed) }
|    $isOwn = { param($fam) @($fam.Names | Where-Object { $_ -ieq $n }).Count -or $n.StartsWith([string]$fam.Prefix, [StringComparison]::OrdinalIgnoreCase) }
|    if (& $isOwn $f) { return '' }
|    if ($New) { return ('{0} names its own Key Vault secret: {1}' -f $Setting, $allowed) }
|    foreach ($o in $script:SISecretSettingFamilies) { if ($o.Key -ne $f.Key -and (& $isOwn $o)) { return ('{0} is another setting''s secret -- {1} names its own: {2}' -f $n, $Setting, $allowed) } }
|    if ($n.StartsWith('SI-', [StringComparison]::OrdinalIgnoreCase)) { return ('{0} is not {1}''s own secret -- {1} names {2}' -f $n, $Setting, $allowed) }
|    foreach ($o in @($AlsoNamedBy | Where-Object { $_ })) {
|        if ((Get-SISecretSettingFamily -Setting $o).Key -ne $f.Key) { return ('{0} is also named by {1} -- a secret belongs to one setting; {2} names {3}' -f $n, $o, $Setting, $allowed) }
|    }
|    ''
|}
|
|function ConvertFrom-SIProSettingRows {
|    <#
|        PURE. cfg.Setting rows -> the values this engine runs with, validated against the catalog.
|        Scope: 'solution' rows apply to every engine, 'engine:<folder>' rows to that engine only and win over 'solution'.
|        Refused (the caller stops the run): an unknown setting, a Pro setting row that does not parse, a value of the
|        wrong type, a secret stored as a value, or a non-secret stored as a Key Vault reference.
|        -Retired: settings that no longer exist (Get-SISettingsRetiredNames) -- a row for one is skipped without a word.
|        Returns @{ Values = name -> value; Secrets = name -> Key Vault secret name; Refused = [@{ Name; Scope; Reason }] }.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Rows, [Parameter(Mandatory)][object[]]$Catalog, [Parameter(Mandatory)][string]$Engine,
|          [AllowEmptyCollection()][string[]]$Retired = @())
|    $byName = @{}; foreach ($s in $Catalog) { $byName[[string]$s.name] = $s }
|    $values = [ordered]@{}; $secrets = [ordered]@{}; $refused = New-Object System.Collections.Generic.List[object]
|    $skippedSecret = New-Object System.Collections.Generic.List[object]
|    $ordered = @($Rows | Where-Object { $_ } | Sort-Object { if ([string]$_.Scope -eq 'solution') { 0 } else { 1 } })
|    # which secret settings name each Key Vault secret (every scope): a customer's own name belongs to ONE setting
|    $namedBy = @{}
|    foreach ($r in $ordered) {
|        $kvn = "$([string]$r.KeyVaultSecretName)".Trim(); $sdef = $byName[[string]$r.Name]
|        if (-not $kvn -or -not $sdef -or -not $sdef.secret) { continue }
|        $kk = $kvn.ToLowerInvariant()
|        if (-not $namedBy.ContainsKey($kk)) { $namedBy[$kk] = New-Object System.Collections.Generic.List[string] }
|        if (-not $namedBy[$kk].Contains([string]$r.Name)) { $namedBy[$kk].Add([string]$r.Name) }
|    }
|    foreach ($r in $ordered) {
|        $name = [string]$r.Name; $scope = [string]$r.Scope
|        if ($scope -ne 'solution' -and $scope -ne ('engine:' + $Engine)) { continue }    # another engine's setting
|        if (@($Retired) -contains $name) { continue }                                     # a setting that no longer exists
|        $s = $byName[$name]
|        if (-not $s) { $refused.Add([pscustomobject]@{ Name = $name; Scope = $scope; Reason = 'not a known setting' }); continue }
|        $kv = [string]$r.KeyVaultSecretName
|        if ($s.secret) {
|            if ($null -ne $r.ValueJson -and [string]$r.ValueJson -ne '') { $refused.Add([pscustomobject]@{ Name = $name; Scope = $scope; Reason = 'a secret must be a Key Vault reference, never a stored value' }); continue }
|            if (-not $kv) { $refused.Add([pscustomobject]@{ Name = $name; Scope = $scope; Reason = 'a secret setting without a Key Vault secret name' }); continue }
|            # a secret setting names its OWN Key Vault secret only: another name is left out of the run and said (never a stop)
|            $also = @($namedBy[$kv.Trim().ToLowerInvariant()] | Where-Object { $_ -and $_ -ne $name })
|            $own = Test-SISecretSettingReference -Setting $name -SecretName $kv -AlsoNamedBy $also
|            if ($own) { $skippedSecret.Add([pscustomobject]@{ Name = $name; Scope = $scope; Reason = $own }); continue }
|            $secrets[$name] = $kv; continue
|        }
|        if ($kv) { $refused.Add([pscustomobject]@{ Name = $name; Scope = $scope; Reason = 'only a secret setting may point at Key Vault' }); continue }
|        $v = $null
|        try { $v = ([string]$r.ValueJson) | ConvertFrom-Json -ErrorAction Stop } catch { $refused.Add([pscustomobject]@{ Name = $name; Scope = $scope; Reason = 'the stored value is not valid JSON' }); continue }
|        if ($s.type -eq 'list' -and $null -ne $v) { $v = @($v | ForEach-Object { [string]$_ }) }
|        if ($s.type -eq 'int' -and $null -ne $v) { $n = 0L; if ([long]::TryParse([string]$v, [ref]$n)) { $v = [int]$n } }
|        $why = Test-SISettingValue -Setting $s -Value $v
|        if ($why) { $refused.Add([pscustomobject]@{ Name = $name; Scope = $scope; Reason = $why }); continue }
|        # a number reaches the engine as a [double] whether it was stored as 0.01 or as the text "0.01"
|        if ($s.type -eq 'number') { $v = ConvertTo-SISettingNumber $v }
|        $values[$name] = $v
|    }
|    [pscustomobject]@{ Values = $values; Secrets = $secrets; Refused = $refused.ToArray(); SkippedSecrets = $skippedSecret.ToArray() }
|}
|
|# The web app's own settings (stored at scope engine:management-web, never in the engines' catalog) that an ENGINE reads too.
|# ConvertFrom-SIProSettingRows skips that scope -- it belongs to the web app -- so these are read here, as plain text:
|#   SIWeb_EnvironmentName, SIWeb_TenantName, SIWeb_PublicBaseUrl   every mail's subject, footer and links (MAIL-1)
|#   SIWeb_CmdbSource                                                the ONE CMDB owner the CI build takes CMDB values from
|#                                                                   (engine\data-model\SI-CiBuildRun.ps1 Get-SICmdbOwner)
|#   SIWeb_NumberFormatDefault                                       the number format of the guard mails (SI-Guard.ps1)
|$script:SIProWebSettingsForEngines = @('SIWeb_EnvironmentName', 'SIWeb_TenantName', 'SIWeb_PublicBaseUrl', 'SIWeb_CmdbSource', 'SIWeb_NumberFormatDefault')
|
|# the names, one by one (a ', @()' here made @(Get-SIProWebSettingsForEngines) ONE item holding the whole list)
|function Get-SIProWebSettingsForEngines { foreach ($n in @($script:SIProWebSettingsForEngines)) { $n } }
|
|function ConvertFrom-SIProWebSettingRows {
|    <#
|        PURE. cfg.Setting rows -> the web-app settings an engine reads (Get-SIProWebSettingsForEngines), each @{ Name; Value }.
|        Only rows at scope engine:management-web whose value is a non-empty JSON string count; anything else is skipped
|        without a word (the web app validates its own settings).
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @())
|    foreach ($wr in @($Rows | Where-Object { $_ -and [string]$_.Scope -eq 'engine:management-web' -and $script:SIProWebSettingsForEngines -contains [string]$_.Name })) {
|        $wv = $null
|        try { $wv = ([string]$wr.ValueJson) | ConvertFrom-Json -ErrorAction Stop } catch { continue }
|        if ($wv -is [string] -and $wv.Trim()) { [pscustomobject]@{ Name = [string]$wr.Name; Value = $wv.Trim() } }
|    }
|}
|
|function Read-SIProDocuments {
|    <# Every row of cfg.Document, one per pipeline item. A database that has not had the Pro-1b schema applied yet has no
|       documents: the read is guarded, so it returns nothing instead of failing on a missing table. #>
|    param([Parameter(Mandatory)]$Store)
|    & $Store.Invoke "IF OBJECT_ID('cfg.Document') IS NOT NULL SELECT Kind, [Key] AS DocKey, Body, CONVERT(varchar(30), CONVERT(bigint, [Version])) AS Version FROM cfg.Document" @{} 'reader' | ForEach-Object { $_ }
|}
|
|# =====================================================================================================================
|#  Pro-1b -- STRUCTURED SETTINGS AS DOCUMENTS (cfg.Document, REQUIREMENTS §9.2 B / C.3)
|#  The validation is the Community Settings page's own (Test-SIJsonChange for exclusions and weights, Test-SIRuleText for
|#  tier rules) -- called, not copied -- so a document is checked by the same rules whichever edition wrote it.
|# =====================================================================================================================
|$script:SIProDocKinds = @('exclusions', 'weights', 'rule')
|
|function Get-SIProDocumentContext {
|    <# What validating a document needs from the installation: the shipped Risk Analysis report names and the rule kinds
|       the engine knows. Read once per run (and only when there are documents). #>
|    param([string]$SIRoot = $script:SIProRoot)
|    [pscustomobject]@{ SIRoot = $SIRoot; Reports = @(Get-SIRaReportNames -SIRoot $SIRoot); Kinds = @(Get-SIRuleKinds -SIRoot $SIRoot) }
|}
|
|function Test-SIProDocumentKey {
|    <# PURE. $null when the key is valid for the kind, else the reason. #>
|    param([AllowEmptyString()][string]$Kind, [AllowEmptyString()][string]$Key)
|    if ($script:SIProDocKinds -notcontains $Kind) { return ("'{0}' is not a document kind (exclusions, weights, rule)" -f $Kind) }
|    if ([string]::IsNullOrEmpty($Key) -or $Key.Length -gt 128) { return 'the key must be 1 to 128 characters' }
|    switch ($Kind) {
|        'exclusions' { if ($Key -ne 'global' -and $Key -notmatch '^[A-Za-z0-9_]+$') { return ("'{0}' is not 'global' or a report name" -f $Key) } }
|        'weights'    { if ($Key -ne 'solution') { return "the weights document has the key 'solution'" } }
|        'rule'       { if ($Key -notmatch '^(endpoint|identity|azure|shared)/[A-Za-z0-9][A-Za-z0-9_\-]{0,99}$') { return ("'{0}' is not '<engine>/<rule id>' (engine: endpoint, identity, azure or shared)" -f $Key) } }
|    }
|    $null
|}
|
|function Test-SIProDocument {
|    <#
|        The reasons a document is not accepted (empty = accepted). -Context from Get-SIProDocumentContext.
|          exclusions -- a JSON object; every property is checked by Test-SIJsonChange (CVE ids, configuration ids, tags,
|                        CveMinAgeDays). Notes ('_'-prefixed, or Comment) are allowed and never reach a query. Anything
|                        else -- including the engine's legacy alias names, which it would paste into KQL unchecked -- is
|                        refused.
|          weights    -- a JSON object with weightedRiskFactors (each engine checked by Test-SIJsonChange), $schema and
|                        notes. Other sections of the weights file are not managed as a document and are refused.
|          rule       -- the tier rule YAML, checked by Test-SIRuleText: it parses, carries the key's id, uses only the
|                        kinds the engine knows, tiers 0-3.
|    #>
|    param([AllowEmptyString()][string]$Kind, [AllowEmptyString()][string]$Key, [AllowEmptyString()][AllowNull()][string]$Body, [Parameter(Mandatory)]$Context)
|    $why = New-Object System.Collections.Generic.List[string]
|    $k = Test-SIProDocumentKey -Kind $Kind -Key $Key
|    if ($k) { $why.Add($k); return $why.ToArray() }
|    if ([string]::IsNullOrWhiteSpace($Body)) { $why.Add('the document is empty'); return $why.ToArray() }
|    $isNote = { param([string]$n) $n.StartsWith('_') -or $n -eq 'Comment' }
|    $parseObject = {
|        param([string]$text)
|        $o = $null
|        try { $o = $text | ConvertFrom-Json -ErrorAction Stop } catch { $why.Add('the document is not valid JSON: ' + $_.Exception.Message); return $null }
|        if ($o -isnot [System.Management.Automation.PSCustomObject]) { $why.Add('the document must be a JSON object'); return $null }
|        $o
|    }
|    switch ($Kind) {
|        'exclusions' {
|            if ($Key -ne 'global' -and @($Context.Reports) -notcontains $Key) { $why.Add(("'{0}' is not a shipped Risk Analysis report" -f $Key)); break }
|            $o = & $parseObject $Body
|            if ($null -eq $o) { break }
|            $fileKey = if ($Key -eq 'global') { 'exclusions:global' } else { 'exclusions:' + $Key }
|            foreach ($p in $o.PSObject.Properties) {
|                if (& $isNote $p.Name) { continue }
|                foreach ($w in @(Test-SIJsonChange -Key $fileKey -Property $p.Name -Value $p.Value)) { $why.Add($w) }
|            }
|        }
|        'weights' {
|            $o = & $parseObject $Body
|            if ($null -eq $o) { break }
|            foreach ($p in $o.PSObject.Properties) {
|                if ((& $isNote $p.Name) -or $p.Name -eq '$schema') { continue }
|                if ($p.Name -ne 'weightedRiskFactors') { $why.Add(("'{0}' is not managed as a Pro document -- only weightedRiskFactors (keep other sections in the file)" -f $p.Name)); continue }
|                if ($p.Value -isnot [System.Management.Automation.PSCustomObject]) { $why.Add('weightedRiskFactors must be an object keyed by engine'); continue }
|                foreach ($e in $p.Value.PSObject.Properties) {
|                    if (& $isNote $e.Name) { continue }
|                    foreach ($w in @(Test-SIJsonChange -Key 'weights' -Property $e.Name -Value $e.Value)) { $why.Add($w) }
|                }
|            }
|        }
|        'rule' {
|            $id = $Key.Substring($Key.IndexOf('/') + 1)
|            foreach ($w in @(Test-SIRuleText -Text $Body.TrimStart([char]0xFEFF) -Id $id -Kinds @($Context.Kinds))) { $why.Add($w) }
|        }
|    }
|    $why.ToArray()
|}
|
|function ConvertFrom-SIProDocumentRows {
|    <# cfg.Document rows -> the accepted documents and the refused ones (Name = kind/key, Scope = 'document', Reason). #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Rows, [Parameter(Mandatory)]$Context)
|    $docs = New-Object System.Collections.Generic.List[object]; $refused = New-Object System.Collections.Generic.List[object]
|    foreach ($r in @($Rows | Where-Object { $_ })) {
|        $kind = [string]$r.Kind; $key = [string]$r.DocKey
|        $why = @(Test-SIProDocument -Kind $kind -Key $key -Body ([string]$r.Body) -Context $Context)
|        if ($why.Count) { $refused.Add([pscustomobject]@{ Name = ('{0}/{1}' -f $kind, $key); Scope = 'document'; Reason = ($why -join '; ') }); continue }
|        $docs.Add([pscustomobject]@{ Kind = $kind; Key = $key; Body = ([string]$r.Body).TrimStart([char]0xFEFF) })
|    }
|    [pscustomobject]@{ Documents = $docs.ToArray(); Refused = $refused.ToArray() }
|}
|
|function Get-SIProSettingsVersion {
|    <#
|        PURE. The version of the settings a run used (REQUIREMENTS §9.2 C.5): '<highest row version>-<12 hex>'. The row
|        version (SQL rowversion, database-wide and increasing) says WHEN; the hash of every (Name, Scope, ValueJson,
|        KeyVaultSecretName) and (Kind, Key, Body), sorted ordinally, says WHAT -- so two runs with the same version ran
|        on the same settings, and a removed row changes the version even though no row version moved.
|    #>
|    param([AllowEmptyCollection()][object[]]$Settings = @(), [AllowEmptyCollection()][object[]]$Documents = @(),
|          # Phase C: templates (by hash -- the body is large), item overrides and exemptions count too. A database without
|          # them hashes exactly as before.
|          [AllowEmptyCollection()][object[]]$Templates = @(), [AllowEmptyCollection()][object[]]$Overrides = @(),
|          [AllowEmptyCollection()][object[]]$Exemptions = @())
|    $us = [string][char]0x1F; $nul = [string][char]0
|    $max = 0L
|    $recs = New-Object System.Collections.Generic.List[string]
|    $rec = {
|        param([string]$tag, $row, [string[]]$fields)
|        $v = 0L; if ([long]::TryParse([string](Get-SIProRowValue $row 'Version'), [ref]$v) -and $v -gt $script:__siVerMax) { $script:__siVerMax = $v }
|        $f = foreach ($n in $fields) { $x = Get-SIProRowValue $row $n; if ($null -eq $x -or $x -is [System.DBNull]) { $nul } elseif ($x -is [datetime]) { $x.ToString('o', [System.Globalization.CultureInfo]::InvariantCulture) } else { [string]$x } }
|        $recs.Add($tag + $us + ($f -join $us))
|    }
|    $script:__siVerMax = 0L
|    foreach ($r in @($Settings | Where-Object { $_ })) { & $rec 'S' $r @('Name', 'Scope', 'ValueJson', 'KeyVaultSecretName') }
|    foreach ($r in @($Documents | Where-Object { $_ })) { & $rec 'D' $r @('Kind', 'DocKey', 'Body') }
|    foreach ($r in @($Templates | Where-Object { $_ })) { & $rec 'T' $r @('Kind', 'ItemKey', 'TemplateVersion', 'BodyHash', 'Format', 'SortOrder', 'RetiredAt') }
|    foreach ($r in @($Overrides | Where-Object { $_ })) { & $rec 'O' $r @('Kind', 'ItemKey', 'State', 'BodyJson', 'Format') }
|    foreach ($r in @($Exemptions | Where-Object { $_ })) { & $rec 'E' $r @('ExemptionId', 'Scope', 'ReportName', 'ConfigurationId', 'Cve', 'AssetKey', 'ExpiresAt', 'RevokedAt') }
|    $max = $script:__siVerMax
|    $recs.Sort([System.StringComparer]::Ordinal)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $h = -join ($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes(($recs.ToArray() -join [string][char]0x1E))) | ForEach-Object { $_.ToString('x2') }) } finally { $sha.Dispose() }
|    '{0}-{1}' -f $max, $h.Substring(0, 12)
|}
|
|function New-SIProRunFolder {
|    <# The run's own folder for materialised documents: under the temp folder (never the installation), unique per run.
|       Folders of earlier runs older than two days are cleared on the way (best effort). #>
|    param([Parameter(Mandatory)][string]$Engine, [string]$Root)
|    if (-not $Root) { $Root = Join-Path ([System.IO.Path]::GetTempPath()) 'si-pro-run' }
|    if (-not (Test-Path -LiteralPath $Root)) { New-Item -ItemType Directory -Path $Root -Force | Out-Null }
|    $cut = (Get-Date).AddDays(-2)
|    foreach ($old in @(Get-ChildItem -LiteralPath $Root -Directory -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -lt $cut })) {
|        Remove-Item -LiteralPath $old.FullName -Recurse -Force -ErrorAction SilentlyContinue
|    }
|    $dir = Join-Path $Root ('{0}-{1}-{2}' -f ($Engine -replace '[^A-Za-z0-9_\-]', '_'), (Get-Date).ToUniversalTime().ToString('yyyyMMdd-HHmmss'), [guid]::NewGuid().ToString('N').Substring(0, 8))
|    New-Item -ItemType Directory -Path $dir -Force | Out-Null
|    $dir
|}
|
|function Export-SIProDocuments {
|    <#
|        Materialise validated documents into the run-local folder, in exactly the shape the engines' own loaders read:
|          rule       -> <run>\rules\<engine>\<id>.custom.yaml  -- returned as RulesRoot, to be set as SI_EnrichmentDataRoot.
|                        The overlay a run had before (-ExistingOverlay: other operator rules, asset / correlation decision
|                        files at its root) is COPIED in first, so nothing it supplied is lost; a document then replaces a
|                        copied rule with the same id. The original overlay is only read.
|          exclusions -> <run>\risk-analysis\RiskAnalysisGlobalExclusions.custom.json | <Report>.exclude.custom.json
|          weights    -> <run>\risk-analysis\riskscore_weighted.schema.custom.json   -- returned as RaSettingsPath.
|        The file names come from the Settings page's own mapping (Resolve-SIJsonTarget). Refuses a run folder inside the
|        SecurityInsight folder: the shipped tree is never written.
|        Phase C: the documents-only form of Export-SIProConfig (SI-ProConfig.ps1), which also materialises templates,
|        item overrides and exemptions.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Documents, [Parameter(Mandatory)][string]$RunFolder,
|          [Parameter(Mandatory)]$Context, [string]$ExistingOverlay)
|    $m = Export-SIProConfig -Documents @($Documents) -RunFolder $RunFolder -Context $Context -ExistingOverlay $ExistingOverlay
|    [pscustomobject]@{ RulesRoot = $m.RulesRoot; RaSettingsPath = $m.RaSettingsPath; Rules = $m.Rules; Exclusions = $m.Exclusions; Weights = $m.Weights }
|}
|# =====================================================================================================================
|#  RUN HEALTH ON A SETTINGS FAILURE (REQUIREMENTS §9.2 C.4): the run still FAILS, and leaves one END record saying why.
|# =====================================================================================================================
|function ConvertTo-SIProSafeText {
|    <# PURE. A failure message made safe for a log record: tokens, keys and passwords redacted, one line, bounded. #>
|    param([AllowEmptyString()][AllowNull()][string]$Text, [int]$Max = 2000)
|    if ([string]::IsNullOrEmpty($Text)) { return '' }
|    $t = $Text -replace '(?i)(bearer\s+)[A-Za-z0-9\-\._~\+/]+=*', '$1[redacted]'
|    $t = $t -replace 'eyJ[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]*', '[redacted-token]'
|    $t = $t -replace '(?i)\b(password|pwd|accountkey|sharedaccesskey|sig|client_secret|clientsecret|secret|accesstoken|access_token)(\s*[=:]\s*)([^;&\s,]+)', '$1$2[redacted]'
|    $t = ($t -replace '\s*\r?\n\s*', ' ').Trim()
|    if ($t.Length -gt $Max) { $t = $t.Substring(0, $Max) + '...' }
|    $t
|}
|
|function Send-SIProSettingsFailureRow {
|    <#
|        One run-health END record for a run the settings layer stopped: ExitReason 'settings-error', the reason (made safe)
|        and, when the rows were read, the settings version. NEVER THROWS -- it runs while another failure is on its way
|        out, and must neither mask it nor replace it with a second error.
|        Posted with the engines' own Send-SIRunHealthRow, using what layers 1-5 loaded (workspace, endpoint, identity).
|        When no Log Analytics target is configured at this point the record cannot be posted; the same line is written to
|        the console -- the launcher's transcript, which is where the launcher's own "Failed to load layered config"
|        failure lands -- so the reason is kept either way. -Send is a test seam: & $Send <RunContext> <ExitReason> <Message>.
|    #>
|    param([Parameter(Mandatory)][string]$Engine, [AllowEmptyString()][string]$Message, [string]$Version, [datetime]$StartedAt = ([datetime]::UtcNow), [scriptblock]$Send,
|          # UPLINK-FIX: 'success-partial' for an install that is not finished yet (Test-SIProSettingsInstallPending) -- a warning
|          [ValidateSet('settings-error', 'success-partial')][string]$ExitReason = 'settings-error')
|    $runId = [guid]::NewGuid().ToString()
|    $msg = ''; $status = 'not posted'
|    try {
|        $msg = ConvertTo-SIProSafeText $Message
|        if ($Version) { $msg = '{0} [settings version {1}]' -f $msg, $Version }
|        $ctx = [pscustomobject]@{ RunId = $runId; Engine = $Engine; ShardIndex = 0; ShardCount = 1; StartedAt = $StartedAt.ToUniversalTime(); CollectionTime = [datetime]::SpecifyKind($StartedAt.ToUniversalTime(), [DateTimeKind]::Utc); FailedStep = 'settings' }
|        if ($Send) {
|            & $Send $ctx $ExitReason $msg
|            $status = 'handed to the run-health sender'
|        } elseif (-not $global:SI_WorkspaceResourceId -or -not $global:SI_DceName -or -not $global:SI_DcrResourceGroup) {
|            $status = 'not posted -- no Log Analytics target (SI_WorkspaceResourceId / SI_DceName / SI_DcrResourceGroup) is configured at this point'
|        } else {
|            if (-not (Get-Command -Name 'Send-SIRunHealthRow' -ErrorAction SilentlyContinue)) { . (Join-Path $script:SIProRoot 'engine\asset-profiling\shared\Send-SIRunHealthRow.ps1') }
|            if (-not (Get-Command -Name 'Initialize-SIIngestGlobals' -ErrorAction SilentlyContinue)) { . (Join-Path $script:SIProRoot 'engine\_shared\SI-LogIngest.ps1') }
|            Initialize-SIIngestGlobals
|            Send-SIRunHealthRow -RunContext $ctx -Phase 'End' -AssetCount -1 -ExitReason $ExitReason -ErrorMessage $msg
|            $status = 'posted (best effort -- a failed post is warned above)'
|        }
|    } catch {
|        $status = 'not posted -- ' + (ConvertTo-SIProSafeText $_.Exception.Message 300)
|    }
|    try { Write-Host ('[RUN-HEALTH] End  Engine={0}  RunId={1}  ExitReason={4}  {2}  -- {3}' -f $Engine, $runId, $status, $msg, $ExitReason) -ForegroundColor Yellow } catch { }
|    [pscustomobject]@{ RunId = $runId; ExitReason = $ExitReason; ErrorMessage = $msg; Status = $status }
|}
|
|function Invoke-SIProSettingsLayer {
|    <#
|        Run start, Pro: read cfg.Setting, cfg.Document and (Phase C) cfg.Template, cfg.ItemOverride and cfg.Exemption; set
|        the $global: values for this engine and materialise everything else to a run-local folder. THROWS -- and so fails
|        the run -- when the database cannot be read, a setting, document, template, override or exemption is refused, a
|        Key Vault secret cannot be resolved, or the configuration cannot be materialised. Before the failure leaves, ONE
|        run-health END record says why (Send-SIProSettingsFailureRow); the failure itself is rethrown unchanged.
|        On success:
|          $global:SI_ProSettingsVersion   the settings version this run used (every row of every table counts)
|          $global:SI_EnrichmentDataRoot   the run-local rules overlay (tier rules, decision files)
|          $global:SI_ProRulesFromSql      $true when the tier rules come from the templates -- the shipped tree is not read
|          $global:SI_ProRaSettingsPath    Risk Analysis: exclusions (+ exemptions), weights, the report catalog, the risk index
|          $global:SI_ProConfigRoot        CMDB ownership, service model, asset-tagging config, schema overlays
|          $global:SI_ProAssetTaggingPath  the asset-tagging rules
|          $global:SI_DataModelRoot        the data model (field catalog, provider mappings, ...): templates + overrides (#456)
|          $global:SI_ProTemplateVersion   the release the templates were published from
|          names (tables, DCRs, ...)     cfg.Setting rows like every setting (#251: names are settings, the catalog
|                                        default is the default); a naming override row from before setup carried it
|                                        over still sets its name, and a cfg.Setting row wins over it
|        -Store, -Catalog, -ResolveSecret, -DocumentContext, -RunRoot, -RunHealth and -Now are seams for tests; by default
|        the store is built from SI_ProSqlServer / SI_ProSqlDatabase and the engine SPN.
|    #>
|    param([Parameter(Mandatory)][string]$Engine, $Store, [object[]]$Catalog, [scriptblock]$ResolveSecret,
|          $DocumentContext, [string]$RunRoot, [scriptblock]$RunHealth,
|          # Names this host owns and the database must not override -- a container passes its container-owned list
|          # (SI-ContainerConfig's protected names). Live 2026-10-02: an internal install's AutomationFramework = true,
|          # imported into the database, re-enabled the internal platform framework inside a container and Risk Analysis
|          # failed. Skipped names are reported in $global:SI_ProSettingsSkipped, never applied.
|          [string[]]$ExcludeNames = @(),
|          [datetime]$Now = ([datetime]::UtcNow),
|          # UPLINK-FIX: { } -> how many runs ever ended well on this install (Test-SIProSettingsInstallPending; tests)
|          [scriptblock]$RunsBefore,
|          # #1147: the waits (seconds) before each new read after a network-level connect error (default Get-SISqlConnectRetryWaits),
|          # and the wait itself { param($Seconds) } (tests)
|          [int[]]$ReadRetryWaits, [scriptblock]$ReadSleep)
|    $global:SI_ProSettingsInstallPending = $null; $global:SI_ProSettingsTaggingNoAccess = $null
|    # the permission self-check's database part (engine\_shared\SI-PermissionCheck.ps1): what this run saw of its own access
|    $global:SI_ProDatabaseAccess = $null
|    $started = [datetime]::UtcNow
|    $version = ''
|    foreach ($n in 'SI_ProSettingsVersion', 'SI_ProRaSettingsPath', 'SI_ProConfigRoot', 'SI_ProAssetTaggingPath', 'SI_ProRulesFromSql', 'SI_ProTemplateVersion', 'SI_DataModelRoot') { Remove-Variable -Name $n -Scope Global -ErrorAction SilentlyContinue }
|    try {
|        if (-not $Catalog) { $Catalog = @(Get-SISettingsCatalog -SIRoot $script:SIProRoot) }
|        if (-not $Store) {
|            # The settings database ('settings-database') is in BOTH versions since 2026-10-18 (owner: the free version has
|            # the database): a free feature, so this check never consults a licence. It stays at this one place: should the
|            # feature ever be paid again, a refusal stops the run with the reason (one run-health record, below) -- never a
|            # run on other settings.
|            if (-not (Get-Command -Name Test-SIFeatureAvailable -ErrorAction SilentlyContinue)) {
|                . ([System.IO.Path]::Combine($script:SIProRoot, 'engine', 'SI-FeatureCatalog.ps1'))
|            }
|            $gate = Test-SIFeatureAvailable -Feature 'settings-database'
|            if (-not $gate.Allowed) { throw ("SecurityInsight Pro: the settings database is not licensed for this tenant ({0}) -- install a licence that includes it." -f $gate.Reason) }
|            # the engine SPN: SI_SPN_* where set, else the identity Connect-Platform set in layer 1 (internal installs) --
|            # the same fallback the vulnerability close-loop uses. Read only; no global is changed here.
|            $first = { param([object[]]$v) foreach ($x in $v) { if (-not [string]::IsNullOrWhiteSpace([string]$x)) { return [string]$x } }; '' }
|            $Store = New-SIProSettingsStore -Server ([string]$global:SI_ProSqlServer) -Database ([string]$global:SI_ProSqlDatabase) `
|                        -AppId (& $first @($global:SI_SPN_AppId, $global:HighPriv_Modern_ApplicationID_Azure)) `
|                        -TenantId (& $first @($global:SI_SPN_TenantId, $global:AzureTenantId)) `
|                        -CertThumbprint (& $first @($global:SI_SPN_CertThumbprint, $global:HighPriv_Modern_CertificateThumbprint_Azure))
|        }
|        $rows = $null; $docRows = $null; $tplRows = $null; $ovrRows = $null; $exRows = $null; $revRows = @()
|        # #1147 (an install's runner, 2026-11-07): ONE network-level failure to connect ("TCP Provider, error: 40 - Could not
|        # open a connection to SQL Server") stopped the run, and the daily run was missed. A connect error at the network /
|        # transport level (Test-SISqlConnectTransient -- nothing was read or written yet; every read here is a SELECT) is
|        # tried again after a short growing wait, each said; any other error, or the last attempt, stops the run as before.
|        if (-not (Get-Command -Name Test-SISqlConnectTransient -ErrorAction SilentlyContinue)) {
|            $rp = [System.IO.Path]::Combine($script:SIProRoot, 'engine', '_shared', 'SI-SqlRetry.ps1'); if (Test-Path -LiteralPath $rp) { . $rp }
|        }
|        $readWaits = if ($PSBoundParameters.ContainsKey('ReadRetryWaits')) { @($ReadRetryWaits) } elseif (Get-Command -Name Get-SISqlConnectRetryWaits -ErrorAction SilentlyContinue) { @(Get-SISqlConnectRetryWaits) } else { @() }
|        $readTry = 0
|        while ($true) {
|            try {
|                $rows = @(Read-SIProSettings -Store $Store); $docRows = @(Read-SIProDocuments -Store $Store)
|                $tplRows = @(Read-SIProTemplates -Store $Store); $ovrRows = @(Read-SIProItemOverrides -Store $Store); $exRows = @(Read-SIProExemptions -Store $Store)
|                # the shipped bodies the stale overrides were made on -- for the additive upgrade (only those rows are read)
|                # (never fails the run: without them an override behind the shipped content stays as stored, upgrade available)
|                $revRows = @()
|                try { $revRows = @(Read-SIProOverrideBaseRevisions -Store $Store | Where-Object { $_ }) } catch { $revRows = @() }
|                if ($readTry -gt 0) { Write-Host ('[pro-settings] the settings database {0} was read on attempt {1}' -f $Store.Name, ($readTry + 1)) }
|                break
|            }
|            catch {
|                $err = $_
|                $netErr = [bool]((Get-Command -Name Test-SISqlConnectTransient -ErrorAction SilentlyContinue) -and (Test-SISqlConnectTransient -ErrorRecord $err))
|                if ($netErr -and $readTry -lt $readWaits.Count) {
|                    $w = [int]$readWaits[$readTry]; $readTry++
|                    Write-Host ('[pro-settings] the settings database {0} could not be reached ({1}) -- a network-level connect error; tried again in {2} s (attempt {3} of {4})' -f $Store.Name, (([string]$err.Exception.Message) -split "`n")[0].Trim(), $w, ($readTry + 1), ($readWaits.Count + 1)) -ForegroundColor DarkYellow
|                    if ($ReadSleep) { & $ReadSleep $w } else { Start-Sleep -Seconds $w }
|                    continue
|                }
|                $after = if ($readTry -gt 0) { ' (after {0} attempts)' -f ($readTry + 1) } else { '' }
|                throw ("SecurityInsight Pro: the settings database {0} could not be read{1} -- the run stops rather than use other settings. {2}" -f $Store.Name, $after, $err.Exception.Message)
|            }
|        }
|        # signed in and read: the identity's own database roles, for the permission self-check (never fails the run)
|        $global:SI_ProDatabaseAccess = Read-SIProDatabaseAccess -Store $Store
|        # the ring this install reports to Invardia (SI-TelemetrySend): the updater's state and the recorded ring, read on
|        # the connection already open -- never a second sign-in at run end. Never fails the run.
|        $global:SI_InstallRingFacts = $null
|        if (Get-Command -Name Read-SIInstallRingFacts -ErrorAction SilentlyContinue) { $global:SI_InstallRingFacts = Read-SIInstallRingFacts -Store $Store }
|        # #517: the same store records Invardia's "your licence was re-issued" answer for the updater (SI-TelemetrySend) --
|        # never a second sign-in at run end
|        $global:SI_ProSettingsStore = $Store
|        $version = Get-SIProSettingsVersion -Settings @($rows) -Documents @($docRows) -Templates @($tplRows) -Overrides @($ovrRows) -Exemptions @($exRows)
|        $c = ConvertFrom-SIProSettingRows -Rows @($rows) -Catalog $Catalog -Engine $Engine -Retired @(Get-SISettingsRetiredNames)
|        $d = [pscustomobject]@{ Documents = @(); Refused = @() }
|        $any = @($docRows).Count + @($tplRows).Count + @($ovrRows).Count + @($exRows).Count
|        $m = [pscustomobject]@{ Items = @(); Disabled = @(); Refused = @(); Notes = @(); TemplateVersion = ''; Families = @{} }
|        $x = [pscustomobject]@{ Active = @(); Inactive = @(); Refused = @() }
|        if ($any) {
|            if (-not $DocumentContext) { $DocumentContext = Get-SIProDocumentContext -SIRoot $script:SIProRoot }
|            # the customer's own Risk Analysis reports (and the templates' reports) are reports too
|            $reports = New-Object System.Collections.Generic.List[string]
|            foreach ($r in @($DocumentContext.Reports)) { $reports.Add([string]$r) }
|            foreach ($r in @(@($tplRows) + @($ovrRows) | Where-Object { [string](Get-SIProRowValue $_ 'Kind') -eq 'rareport' -and [string](Get-SIProRowValue $_ 'ItemKey') -like 'report/*' })) {
|                $n = ([string](Get-SIProRowValue $r 'ItemKey')).Substring(7); if (-not $reports.Contains($n)) { $reports.Add($n) }
|            }
|            $ctx = [pscustomobject]@{ SIRoot = $DocumentContext.SIRoot; Reports = $reports.ToArray(); Kinds = @($DocumentContext.Kinds); Catalog = @($Catalog) }
|            if (@($docRows).Count) { $d = ConvertFrom-SIProDocumentRows -Rows @($docRows) -Context $ctx }
|            # A STORED OVERRIDE NEVER STOPS THE RUN (owner 2026-10-10): one from the previous model is migrated for this run
|            # (Resolve-SIProRunOverrides, the update's own translation, in memory -- the update writes it), one that still
|            # does not validate is left out and its template applies -- each said, per item.
|            $ovRes = Resolve-SIProRunOverrides -Overrides @($ovrRows) -SIRoot $script:SIProRoot
|            $ovrRows = @($ovRes.Overrides)
|            $m = Merge-SIProItems -Templates @($tplRows) -Overrides @($ovrRows) -Documents @($d.Documents) -Context $ctx -Revisions @($revRows)
|            $badOvr = @($m.Refused | Where-Object { $_.Scope -eq 'override' })
|            if ($badOvr.Count) {
|                $skip = @{}; foreach ($b in $badOvr) { $skip[[string]$b.Name] = [string]$b.Reason }
|                $ovrRows = @($ovrRows | Where-Object { -not $skip.ContainsKey(('{0}/{1}' -f (Get-SIProRowValue $_ 'Kind'), (Get-SIProRowValue $_ 'ItemKey'))) })
|                $m = Merge-SIProItems -Templates @($tplRows) -Overrides @($ovrRows) -Documents @($d.Documents) -Context $ctx -Revisions @($revRows)
|                $more = New-Object System.Collections.Generic.List[string]
|                foreach ($n in @($ovRes.Notes)) { $more.Add([string]$n) }
|                foreach ($k in $skip.Keys) { $more.Add(("{0}: your change does not validate ({1}) -- this run uses the shipped template for it; fix or reset it on the web app" -f $k, $skip[$k])) }
|                foreach ($n in @($m.Notes)) { $more.Add([string]$n) }
|                $m.Notes = $more.ToArray()
|            } elseif (@($ovRes.Notes).Count) {
|                $m.Notes = @(@($ovRes.Notes) + @($m.Notes) | Where-Object { $_ })
|            }
|            $x = ConvertFrom-SIProExemptionRows -Rows @($exRows) -Context $ctx -Now $Now
|            $DocumentContext = $ctx
|        }
|        $bad = New-Object System.Collections.Generic.List[string]
|        if (@($c.Refused).Count) {
|            $list = (@($c.Refused) | ForEach-Object { '{0} ({1}): {2}' -f $_.Name, $_.Scope, $_.Reason }) -join '; '
|            $bad.Add(("{0} setting(s) in the settings database are not valid -- the run stops. {1}" -f @($c.Refused).Count, $list))
|        }
|        if (@($d.Refused).Count) {
|            $list = (@($d.Refused) | ForEach-Object { '{0}: {1}' -f $_.Name, $_.Reason }) -join '; '
|            $bad.Add(("{0} document(s) in the settings database are not valid -- the run stops. {1}" -f @($d.Refused).Count, $list))
|        }
|        if (@($m.Refused).Count) {
|            $list = (@($m.Refused) | ForEach-Object { '{0} ({1}): {2}' -f $_.Name, $_.Scope, $_.Reason }) -join '; '
|            $bad.Add(("{0} configuration item(s) in the settings database are not valid -- the run stops. {1}" -f @($m.Refused).Count, $list))
|        }
|        if (@($x.Refused).Count) {
|            $list = (@($x.Refused) | ForEach-Object { '{0}: {1}' -f $_.Name, $_.Reason }) -join '; '
|            $bad.Add(("{0} exemption(s) in the settings database are not valid -- the run stops. {1}" -f @($x.Refused).Count, $list))
|        }
|        if ($bad.Count) { throw ('SecurityInsight Pro: ' + ($bad -join ' ')) }
|
|        $skipped = New-Object System.Collections.Generic.List[string]
|        # Names first, so a cfg.Setting row for the same name still wins below. #251: names are settings -- only a naming
|        # override row written before setup carried it over to cfg.Setting reaches here (a naming template is history).
|        foreach ($it in @($m.Items | Where-Object { $_.Kind -eq 'naming' })) {
|            if ($ExcludeNames -contains $it.Key) { if (-not $skipped.Contains($it.Key)) { $skipped.Add($it.Key) }; continue }
|            $val = [string](ConvertFrom-SIProJson $it.Body)
|            $cur = Get-Variable -Name $it.Key -Scope Global -ErrorAction SilentlyContinue
|            if ($it.Origin -eq 'template' -and $cur -and -not [string]::IsNullOrWhiteSpace([string]$cur.Value)) { continue }
|            Set-Variable -Name $it.Key -Value $val -Scope Global
|        }
|        foreach ($k in @($c.Values.Keys)) {
|            if ($ExcludeNames -contains $k) { if (-not $skipped.Contains($k)) { $skipped.Add($k) }; continue }
|            # where a credential goes: the SQL server the engine's token is sent to (an Azure SQL host) and the uplink the
|            # install key is sent to (Invardia's own) -- another value is left out of this run and said, never a stop
|            $hostWhy = Test-SIProSettingHost -Name $k -Value $c.Values[$k]
|            if ($hostWhy) { Write-Warning ('[pro-settings] {0} is not used in this run: {1}. The value from the job''s own settings applies.' -f $k, $hostWhy); continue }
|            Set-Variable -Name $k -Value $c.Values[$k] -Scope Global
|        }
|        # MAIL-1: every mail's footer and subject name the environment as the web app's header does -- its name, tenant name and
|        # address are web-app settings (scope engine:management-web); read here (read only, plain text) for the mail transport.
|        # The same for every other web-app setting an engine reads (Get-SIProWebSettingsForEngines): the CMDB owner the CI build
|        # uses and the number format of the guard mails. Without this they were never set in a run, so the customer's choice
|        # on the web app was ignored by the engines.
|        foreach ($wv in @(ConvertFrom-SIProWebSettingRows -Rows @($rows))) {
|            if (-not [string](Get-Variable -Name ([string]$wv.Name) -Scope Global -ValueOnly -ErrorAction SilentlyContinue)) { Set-Variable -Name ([string]$wv.Name) -Value $wv.Value -Scope Global }
|        }
|        foreach ($k in @($c.Secrets.Keys)) { if ($ExcludeNames -contains $k) { $skipped.Add($k); [void]$c.Secrets.Remove($k) } }
|        foreach ($sk in @($c.SkippedSecrets | Where-Object { $_ })) {
|            Write-Warning ('[pro-settings] {0} ({1}) is not used in this run: {2}. A SuperAdmin points it at its own secret on Settings.' -f $sk.Name, $sk.Scope, $sk.Reason)
|        }
|        $global:SI_ProSettingsSkipped = $skipped.ToArray()
|        # the Key Vault secret NAMES the secret settings name (names only, never a value): a connector never names one of
|        # them (Test-SIConnectorSecretBinding)
|        $global:SI_ProSecretSettingNames = @(@($rows) | Where-Object { $_ -and "$([string]$_.KeyVaultSecretName)".Trim() } | ForEach-Object { "$([string]$_.KeyVaultSecretName)".Trim() } | Sort-Object -Unique)
|        if ($c.Secrets.Count) {
|            if (-not $ResolveSecret) {
|                if (-not (Get-Command Get-SIKvSecret -ErrorAction SilentlyContinue)) { . (Join-Path $script:SIProRoot 'auth\Get-SIKvSecret.ps1') }
|                if (-not (Get-Command Get-SIVaultName -ErrorAction SilentlyContinue)) { . (Join-Path $script:SIProRoot 'auth\Get-SIVaultName.ps1') }
|                $ResolveSecret = { param($secretName) Get-SIKvSecret -VaultName (Get-SIVaultName) -SecretName $secretName }
|            }
|            foreach ($k in $c.Secrets.Keys) {
|                $val = $null
|                try { $val = & $ResolveSecret ([string]$c.Secrets[$k]) } catch { $val = $null }
|                if ([string]::IsNullOrEmpty([string]$val)) { throw ("SecurityInsight Pro: the Key Vault secret '{0}' for {1} could not be read -- the run stops." -f $c.Secrets[$k], $k) }
|                Set-Variable -Name $k -Value $val -Scope Global
|            }
|        }
|
|        $mat = [pscustomobject]@{ RulesRoot = $null; RaSettingsPath = $null; ConfigRoot = $null; AssetTaggingPath = $null; RulesFromSql = $false; Rules = 0; Exclusions = 0; Weights = 0 }
|        $toWrite = @($m.Items | Where-Object { $_.Kind -ne 'naming' })
|        if (@($d.Documents).Count -or $toWrite.Count -or @($x.Active).Count -or @($m.Families.Keys | Where-Object { $_ -ne 'naming' }).Count) {
|            try {
|                $runFolder = New-SIProRunFolder -Engine $Engine -Root $RunRoot
|                $mat = Export-SIProConfig -Items $toWrite -Documents @($d.Documents) -Exemptions @($x.Active) -Families $m.Families -RunFolder $runFolder -Context $DocumentContext -ExistingOverlay ([string]$global:SI_EnrichmentDataRoot)
|            } catch { throw ("SecurityInsight Pro: the settings documents could not be prepared for this run -- the run stops. {0}" -f $_.Exception.Message) }
|            if ($mat.RulesRoot) { $global:SI_EnrichmentDataRoot = [string]$mat.RulesRoot }
|            if ($mat.RulesFromSql) { $global:SI_ProRulesFromSql = $true }
|            if ($mat.RaSettingsPath) { $global:SI_ProRaSettingsPath = [string]$mat.RaSettingsPath }
|            if ($mat.ConfigRoot) { $global:SI_ProConfigRoot = [string]$mat.ConfigRoot }
|            if ($mat.AssetTaggingPath) { $global:SI_ProAssetTaggingPath = [string]$mat.AssetTaggingPath }
|            # #456: the data model (catalog, mappings, ...) from the templates + the customer's overrides -- what the record
|            # writer, the CI build and the outputs read (Get-SIDataModelRoot)
|            if ($mat.PSObject.Properties['DataModelRoot'] -and $mat.DataModelRoot) { $global:SI_DataModelRoot = [string]$mat.DataModelRoot }
|        }
|        if ($m.TemplateVersion) {
|            $global:SI_ProTemplateVersion = $m.TemplateVersion
|            # #250: template versions are their own series (pack 1.0, 1.1, ...); the code ships one of them
|            $shippedPack = Get-SIProShippedPackInfo -SIRoot $script:SIProRoot
|            $fam = [string[]]@($m.Families.Keys); [Array]::Sort($fam, [System.StringComparer]::Ordinal)
|            Write-Host ('[pro-settings] configuration from the database: {0} item(s) from templates {1} ({2}), {3} disabled, {4} exemption(s) in force ({5} expired or revoked)' -f `
|                @($m.Items).Count, $m.TemplateVersion, ($fam -join ', '), @($m.Disabled).Count, @($x.Active).Count, @($x.Inactive).Count)
|            $older = @(([string]$m.TemplateVersion).Split(',') | ForEach-Object { $_.Trim() } | Where-Object { $_ -and (Compare-SIProVersionParts $_ $shippedPack.PackVersion) -lt 0 })
|            if ($older.Count -and $older.Count -eq @(([string]$m.TemplateVersion).Split(',') | Where-Object { $_.Trim() }).Count) {
|                Write-Host ('[pro-settings] the templates in force are {0}; this release ships {1} -- the next setup or update run installs them (your own changes are kept)' -f $m.TemplateVersion, $shippedPack.Name) -ForegroundColor Yellow
|            }
|        }
|        foreach ($note in @(@($m.Notes) + @($mat.Notes) | Where-Object { $_ })) { Write-Host ('[pro-settings] {0}' -f $note) -ForegroundColor Yellow }
|        $global:SI_ProSettingsVersion = $version
|        # #302 (AUDIT-1.1): the changes people committed in the web app are in force for this job from now -- one audit
|        # event per change, naming the person who asked for it (and the approver). Never fails the run.
|        $applied = 0
|        if ($Store.Invoke -and (Get-Command -Name Invoke-SIChangeAttributionApply -ErrorAction SilentlyContinue)) {
|            try { $applied = Invoke-SIChangeAttributionApply -Invoke $Store.Invoke -Job $Engine -Log { param($l, $msg) Write-Host ('[pro-settings] {0}' -f $msg) -ForegroundColor Yellow } } catch { $applied = 0 }
|            if ($applied -gt 0) { Write-Host ('[pro-settings] {0} change(s) committed in the web app are in force from this run (recorded on the audit trail with who asked for them)' -f $applied) }
|        }
|        [pscustomobject]@{ Store = $Store.Name; Values = $c.Values.Count; Secrets = $c.Secrets.Count; Documents = @($d.Documents).Count
|            Items = @($m.Items).Count; Disabled = @($m.Disabled).Count; Exemptions = @($x.Active).Count; TemplateVersion = $m.TemplateVersion
|            Version = $version; RulesRoot = $mat.RulesRoot; RaSettingsPath = $mat.RaSettingsPath; ConfigRoot = $mat.ConfigRoot
|            AssetTaggingPath = $mat.AssetTaggingPath; RulesFromSql = [bool]$mat.RulesFromSql }
|    } catch {
|        $failure = $_
|        $fmsg = [string]$failure.Exception.Message
|        # the permission self-check: the failed sign-in is recorded WITH its error text -- the check reads from it whether
|        # the database refused the identity (no database user) or its server's firewall refused the job before any
|        # sign-in (Get-SIPermissionDatabaseFailure, engine\_shared\SI-PermissionCheck.ps1); the run-health record says which
|        if ($null -eq $global:SI_ProDatabaseAccess -and (Test-SIProSettingsSqlNotReady $fmsg)) { $global:SI_ProDatabaseAccess = @{ SignIn = 'failed'; Roles = $null; Error = $fmsg } }
|        # UPLINK-FIX (customer G 2026-10-07): the guided install creates the jobs (step container-jobs) BEFORE the Pro
|        # database and the identity's database user (pro-sql / pro-schema), so the flow's 5-minute wake-ups during the
|        # install cannot sign in to it. While NO run has ever ended well on this install, that is "the install is not
|        # finished", not a failure: a warning record, and the container ends cleanly ($global:SI_ProSettingsInstallPending).
|        if (Test-SIProSettingsInstallPending -Message $fmsg -RunsBefore $RunsBefore) {
|            $global:SI_ProSettingsInstallPending = $true
|            $null = Send-SIProSettingsFailureRow -Engine $Engine -ExitReason 'success-partial' -Version $version -StartedAt $started -Send $RunHealth `
|                -Message ('install not finished: the settings database cannot be signed in to yet (its database user is created later in the install); this run did nothing. ' + $fmsg)
|        } elseif ($Engine -eq 'asset-tagging' -and (Test-SIProSettingsSqlNotReady $fmsg)) {
|            # Fix request 85bd728f: asset tagging runs under its OWN identity (#236), and installs made before the fix never
|            # gave it a database user. Nothing is tagged (it reports only by default) and nothing else is affected: a warning
|            # that says how to fix it, and the container ends cleanly -- never a failed run every morning (#448).
|            $global:SI_ProSettingsTaggingNoAccess = $true
|            $tagWhy = 'its own identity has no user in the Pro database; this run did nothing. Fix once, as the SQL server''s Entra admin: setup\Grant-SITaggingDatabase.ps1 -Apply. '
|            # the server's firewall refused the job before any sign-in: the database user is not the problem, and the record says so
|            if ((Get-Command -Name Get-SIPermissionDatabaseFailure -ErrorAction SilentlyContinue) -and (Get-SIPermissionDatabaseFailure -Message $fmsg) -eq 'firewall') {
|                $tagWhy = 'the database server''s firewall refused this job before it could sign in (its database user is not the problem); this run did nothing. Fix: in the Azure portal allow Azure services and resources to access the SQL server (Networking), or run the guided install again. '
|            }
|            $null = Send-SIProSettingsFailureRow -Engine $Engine -ExitReason 'success-partial' -Version $version -StartedAt $started -Send $RunHealth `
|                -Message ('asset tagging cannot read its settings: ' + $tagWhy + $fmsg)
|        } else {
|            $null = Send-SIProSettingsFailureRow -Engine $Engine -Message $fmsg -Version $version -StartedAt $started -Send $RunHealth
|        }
|        throw $failure
|    }
|}
|
|function Read-SIProDatabaseAccess {
|    <#
|        After a successful sign-in: this identity's own roles in the Pro database (IS_ROLEMEMBER), for the permission
|        self-check (engine\_shared\SI-PermissionCheck.ps1). Returns @{ SignIn = 'ok'; Roles = @{ db_owner; db_datareader;
|        db_datawriter } -> '1' / '0' / $null (unknown); User }. NEVER THROWS: a role query that fails leaves the roles
|        unknown (the check then says "not checked", never "missing").
|    #>
|    param([Parameter(Mandatory)]$Store)
|    $out = @{ SignIn = 'ok'; Roles = @{}; User = ''; Error = '' }
|    try {
|        $rows = @(& $Store.Invoke "SELECT USER_NAME() AS UserName, IS_ROLEMEMBER(N'db_owner') AS db_owner, IS_ROLEMEMBER(N'db_datareader') AS db_datareader, IS_ROLEMEMBER(N'db_datawriter') AS db_datawriter" @{} 'reader' | ForEach-Object { $_ })
|        $r = $rows | Where-Object { $_ } | Select-Object -First 1
|        if ($r) {
|            $get = { param($n) if ($r -is [System.Collections.IDictionary]) { if ($r.Contains($n)) { $r[$n] } else { $null } } elseif ($r.PSObject.Properties[$n]) { $r.$n } else { $null } }
|            foreach ($n in 'db_owner', 'db_datareader', 'db_datawriter') {
|                $v = & $get $n
|                $out.Roles[$n] = $(if ($null -eq $v -or $v -is [System.DBNull]) { $null } else { [string][int]$v })
|            }
|            $out.User = [string](& $get 'UserName')
|        }
|    } catch { $out.Error = [string]$_.Exception.Message }
|    $out
|}
|
|function Test-SIProSettingsSqlNotReady {
|    <# PURE. The settings database refused the SIGN-IN (no login / no database user yet) -- not a bad row, not a network fault. #>
|    param([AllowEmptyString()][AllowNull()][string]$Message)
|    [bool]("$Message" -match "(?i)Login failed for user|Cannot open (server|database) .* requested by the login|token-identified principal")
|}
|
|function Test-SIProSettingsSqlNotCreated {
|    <# PURE. The settings database's SERVER does not exist (yet): its name does not resolve, or the database is not there.
|       customer H 2026-10-08: the flow woke while the install was still creating the server. Only "install pending" uses it --
|       together with "no run ever ended well"; on an established install it stays a settings-error. #>
|    param([AllowEmptyString()][AllowNull()][string]$Message)
|    [bool]("$Message" -match "(?i)No such host is known|Name or service not known|nodename nor servname|could not be resolved|Database '[^']+' on server '[^']+' is not currently available|Cannot open database .* The login failed")
|}
|
|function Test-SIProSettingsInstallPending {
|    <#
|        Is a settings-database sign-in failure the install still running (UPLINK-FIX, customer G 2026-10-07)? Only when the
|        failure is a sign-in refusal (Test-SIProSettingsSqlNotReady) AND no run has EVER ended well on this install
|        (SI_RunHealth_CL: an End with success / success-partial; a table that does not exist yet = none). Anything that
|        cannot be told is NOT pending -- the failure is then reported as before. -RunsBefore { } -> [long] (tests).
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Message, [scriptblock]$RunsBefore)
|    if (-not (Test-SIProSettingsSqlNotReady $Message) -and -not (Test-SIProSettingsSqlNotCreated $Message)) { return $false }
|    $n = -1L
|    try {
|        if ($RunsBefore) { $n = [long](& $RunsBefore) }
|        elseif (-not (Get-Module -Name Pester)) { $n = Get-SIProSettingsGoodRunCount }
|    } catch { $n = -1L }
|    return ($n -eq 0)
|}
|
|function Get-SIProSettingsGoodRunCount {
|    <# How many runs ever ended well on this install (0 or 1 -- 'take 1'): SI_RunHealth_CL in its workspace. A table that
|       does not exist yet is 0; anything else that fails throws (the caller then treats it as unknown). #>
|    if (-not (Get-Command -Name Resolve-SIV3WorkspaceId -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($script:SIProRoot, 'engine', '_shared', 'SI-V3Snapshot.ps1')) }
|    if (-not (Get-Command -Name Test-SIKqlTableMissing -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($script:SIProRoot, 'engine', '_shared', 'SI-KqlError.ps1')) }
|    $ws = Resolve-SIV3WorkspaceId
|    # A GOOD RUN IS A RUN OF AN ENGINE. The pipeline's own records do not count (Engine 'flow' and 'flow:<step>'): the
|    # "install not finished" record this very check writes is Engine 'flow', ExitReason success-partial -- counted, it made
|    # the SECOND wake-up of an unfinished install a failed run the customer had to fix (the first customer install,
|    # 2026-10-12: one such report every 5 minutes). Neither does any record that says the install is not finished.
|    $kql = "SI_RunHealth_CL | where Phase == 'End' and ExitReason in ('success', 'success-partial') and Engine != 'flow' and not(Engine startswith 'flow:') and not(tostring(column_ifexists('ErrorMessage', '')) startswith 'install not finished') | take 1 | count | project n = Count"
|    try { $r = @((Invoke-SIAzOperationalInsightsQuery -WorkspaceId $ws -Query $kql -ErrorAction Stop).Results) }
|    catch { if (Test-SIKqlTableMissing -ErrorRecord $_ -TableName 'SI_RunHealth_CL') { return 0L }; throw }
|    if (-not $r.Count) { return 0L }
|    [long]$r[0].n
|}
|function Set-SIProSetting {
|    <#
|        Write one setting: Set (a value, or for a secret a Key Vault secret name) or Reset (remove the row), with its
|        cfg.ChangeLog entry in the SAME transaction. Validated first by the same rules the reader applies.
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][object[]]$Catalog, [Parameter(Mandatory)][string]$Name,
|          [Parameter(Mandatory)][string]$Scope, [ValidateSet('Set', 'Reset')][string]$Action = 'Set', $Value, [string]$KeyVaultSecretName,
|          [Parameter(Mandatory)][string]$ChangedBy, [string]$Reason = '')
|    $s = $Catalog | Where-Object { $_.name -eq $Name } | Select-Object -First 1
|    if (-not $s) { throw "'$Name' is not a known setting" }
|    if ($Scope -ne 'solution' -and $Scope -notmatch '^engine:[a-z0-9\-]+$') { throw "'$Scope' is not a valid scope" }
|    $json = $null; $kv = $null
|    if ($Action -eq 'Set') {
|        if ($s.secret) {
|            if (-not $KeyVaultSecretName) { throw "$Name is a secret: give its Key Vault secret name, never the value" }
|            # the same rule the engine reads with: a secret setting names its own Key Vault secret
|            $ownWhy = Test-SISecretSettingReference -Setting $Name -SecretName $KeyVaultSecretName
|            if ($ownWhy) { throw "${Name}: $ownWhy" }
|            $kv = $KeyVaultSecretName
|        }
|        else {
|            $why = Test-SISettingValue -Setting $s -Value $Value
|            if ($why) { throw "$Name $why" }
|            $json = ConvertTo-SIJsonText $Value
|        }
|    }
|    $sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @old nvarchar(max) = (SELECT COALESCE(ValueJson, 'keyvault:' + KeyVaultSecretName) FROM cfg.Setting WHERE Name = @Name AND Scope = @Scope);
|IF @Action = 'Reset'
|    DELETE FROM cfg.Setting WHERE Name = @Name AND Scope = @Scope;
|ELSE IF EXISTS (SELECT 1 FROM cfg.Setting WHERE Name = @Name AND Scope = @Scope)
|    UPDATE cfg.Setting SET ValueJson = @ValueJson, KeyVaultSecretName = @Kv, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @Name AND Scope = @Scope;
|ELSE
|    INSERT cfg.Setting (Name, Scope, ValueJson, KeyVaultSecretName, UpdatedBy) VALUES (@Name, @Scope, @ValueJson, @Kv, @By);
|INSERT cfg.ChangeLog (Name, Scope, Action, OldValue, NewValue, ChangedBy, Reason)
|VALUES (@Name, @Scope, @Action, @old, COALESCE(@ValueJson, 'keyvault:' + @Kv), @By, @Reason);
|COMMIT;
|'@
|    & $Store.Invoke $sql ([ordered]@{ Name = $Name; Scope = $Scope; Action = $Action; ValueJson = $json; Kv = $kv; By = $ChangedBy; Reason = $Reason }) 'nonquery'
|}
|
|function Set-SIProDocument {
|    <#
|        Write one document: Set (create or replace its Body) or Reset (remove it), with its cfg.ChangeLog entry (Name = the
|        key, Scope = 'document', Kind) in the SAME transaction. Validated BEFORE any SQL by the same rules the run-start
|        reader applies (Test-SIProDocument), so the writer can never store what the reader would refuse.
|        -Context is a seam (Get-SIProDocumentContext by default).
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Kind, [Parameter(Mandatory)][string]$Key,
|          [ValidateSet('Set', 'Reset')][string]$Action = 'Set', [AllowEmptyString()][string]$Body,
|          [Parameter(Mandatory)][string]$ChangedBy, [string]$Reason = '', $Context)
|    $bad = Test-SIProDocumentKey -Kind $Kind -Key $Key
|    if ($bad) { throw ("{0}/{1}: {2}" -f $Kind, $Key, $bad) }
|    $text = $null
|    if ($Action -eq 'Set') {
|        if (-not $Context) { $Context = Get-SIProDocumentContext -SIRoot $script:SIProRoot }
|        $text = ([string]$Body).TrimStart([char]0xFEFF)
|        $why = @(Test-SIProDocument -Kind $Kind -Key $Key -Body $text -Context $Context)
|        if ($why.Count) { throw ("{0}/{1} is not valid: {2}" -f $Kind, $Key, ($why -join '; ')) }
|    }
|    $sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @old nvarchar(max) = (SELECT Body FROM cfg.Document WITH (UPDLOCK, HOLDLOCK) WHERE Kind = @Kind AND [Key] = @Key);
|IF @Action = 'Reset'
|    DELETE FROM cfg.Document WHERE Kind = @Kind AND [Key] = @Key;
|ELSE IF @old IS NOT NULL
|    UPDATE cfg.Document SET Body = @Body, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Kind = @Kind AND [Key] = @Key;
|ELSE
|    INSERT cfg.Document (Kind, [Key], Body, UpdatedBy) VALUES (@Kind, @Key, @Body, @By);
|INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|VALUES (@Key, 'document', @Kind, @Action, @old, @Body, @By, @Reason);
|COMMIT;
|'@
|    & $Store.Invoke $sql ([ordered]@{ Kind = $Kind; Key = $Key; Action = $Action; Body = $text; By = $ChangedBy; Reason = $Reason }) 'nonquery'
|}
|
|function Get-SIProDocumentImportPlan {
|    <#
|        What importing an install's structured settings into cfg.Document would write, each validated exactly as the run
|        will validate it:
|          exclusions  risk-analysis-detection\RiskAnalysisGlobalExclusions.custom.json -> exclusions/global
|                      risk-analysis-detection\<Report>.exclude.custom.json            -> exclusions/<Report>
|                      ...else <Report>.exclude.json (the shipped sample's name; the engine's own order, #275 R1)
|                      config\*.exclude*.json is read by nothing: LISTED with where it belongs, not imported (#275 G10)
|          weights     risk-analysis-detection\riskscore_weighted.schema.custom.json   -> weights/solution
|          rule        every custom tier rule -- page-created or hand-written, in the tree or in the overlay
|                      (-OverlayRoot); where both exist the overlay one is the rule in force -> rule/<engine>/<id>
|        Not imported, with the reason: a file that does not validate, a per-report *.weighted.custom.json (not a document
|        kind), and an asset-tagging file (it is not a tier rule). The files are left as they are.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [string]$OverlayRoot, $Context)
|    if (-not $Context) { $Context = Get-SIProDocumentContext -SIRoot $SIRoot }
|    $rows = New-Object System.Collections.Generic.List[object]; $skipped = New-Object System.Collections.Generic.List[object]
|    $cands = New-Object System.Collections.Generic.List[object]
|    $dir = Join-Path $SIRoot 'risk-analysis-detection'
|    $info = New-Object System.Collections.Generic.List[object]
|    $relOf = { param([string]$p) if ($p.StartsWith($SIRoot, [StringComparison]::OrdinalIgnoreCase)) { $p.Substring($SIRoot.Length).TrimStart('\', '/') } else { $p } }
|    $g = Join-Path $dir 'RiskAnalysisGlobalExclusions.custom.json'
|    if (Test-Path -LiteralPath $g) { $cands.Add([pscustomobject]@{ Kind = 'exclusions'; Key = 'global'; Path = $g }) }
|    # #275 R1: per report, the file the 2.2 engine reads (RA-ExcludeLists.ps1 Get-ReportExcludeJson): <R>.exclude.custom.json,
|    # else <R>.exclude.json -- the name the shipped *.exclude.json.sample becomes -- the FIRST that parses. The other one,
|    # when both exist, was never read; it is said, not imported.
|    $byReport = [ordered]@{}
|    foreach ($f in @(Get-ChildItem -LiteralPath $dir -File -ErrorAction SilentlyContinue | Where-Object { $_.Name -match '(?i)^[^.]+\.exclude(\.custom)?\.json$' } | Sort-Object Name)) {
|        $rep = $f.Name -replace '(?i)\.exclude(\.custom)?\.json$', ''
|        if (-not $byReport.Contains($rep)) { $byReport[$rep] = @{ Custom = $null; Plain = $null } }
|        if ($f.Name -match '(?i)\.exclude\.custom\.json$') { $byReport[$rep].Custom = $f.FullName } else { $byReport[$rep].Plain = $f.FullName }
|    }
|    $parses = { param([string]$p) try { $null = ([System.IO.File]::ReadAllText($p)).TrimStart([char]0xFEFF) | ConvertFrom-Json -ErrorAction Stop; $true } catch { $false } }
|    foreach ($rep in @($byReport.Keys)) {
|        $pair = $byReport[$rep]
|        $use = $pair.Custom
|        if ($pair.Custom -and $pair.Plain) {
|            if (& $parses $pair.Custom) { $info.Add([pscustomobject]@{ Name = ('exclusions/{0}' -f $rep); Path = (& $relOf $pair.Plain); Reason = ('never read -- {0} comes first; not imported' -f (Split-Path -Leaf $pair.Custom)) }) }
|            else {
|                # the engine skips a file it cannot parse and reads the next one: so does the import (and says so)
|                $use = $pair.Plain
|                $skipped.Add([pscustomobject]@{ Name = ('exclusions/{0}' -f $rep); Scope = 'document'; Path = (& $relOf $pair.Custom); Reason = ('{0}: not valid JSON -- the run skipped it and read {1}, which is what is imported' -f (& $relOf $pair.Custom), (Split-Path -Leaf $pair.Plain)) })
|            }
|        } elseif (-not $use) { $use = $pair.Plain }
|        $cands.Add([pscustomobject]@{ Kind = 'exclusions'; Key = $rep; Path = $use })
|    }
|    # #275 G10: exclusion files in config\ -- where the README once said to put them. Nothing has ever read them (2.2 or
|    # 3.0), so they are not imported (that would switch on exclusions that were never in force); each is listed with the
|    # place it belongs.
|    if (-not (Get-Command -Name Get-SIMisplacedExcludeFiles -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'risk-analysis', '_shared', 'RA-ExcludeLists.ps1')) }
|    foreach ($m in @(Get-SIMisplacedExcludeFiles -SIRoot $SIRoot)) {
|        $skipped.Add([pscustomobject]@{ Name = ('exclusions/' + ($m.Name -replace '(?i)\.exclude(\.custom)?\.json$|\.custom\.json$', '')); Scope = 'document'; Path = (& $relOf $m.Path)
|            Reason = ('nothing reads exclusion files in config\ (2.2 or 3.0) -- these exclusions were never in force. To use them, move the file to {0}, check it, and import again' -f (& $relOf $m.ShouldBe)) })
|    }
|    $w = Join-Path $dir 'riskscore_weighted.schema.custom.json'
|    if (Test-Path -LiteralPath $w) { $cands.Add([pscustomobject]@{ Kind = 'weights'; Key = 'solution'; Path = $w }) }
|    foreach ($f in @(Get-ChildItem -LiteralPath $dir -Filter '*.weighted.custom.json' -File -ErrorAction SilentlyContinue)) {
|        $skipped.Add([pscustomobject]@{ Name = $f.Name; Scope = 'document'; Info = $true; Reason = ('a per-report weights file is not a document kind -- it is imported as the configuration item weights/report/{0}' -f ($f.Name -replace '\.weighted\.custom\.json$', '')) })
|    }
|    foreach ($r in @(Get-SIRuleView -SIRoot $SIRoot -OverlayRoot $OverlayRoot)) {
|        $own = if ($r.overlay) { $r.overlay } elseif ($r.custom) { $r.custom } else { $null }
|        if (-not $own) { continue }
|        # Phase C: turning a SHIPPED rule off is a state of its template (cfg.ItemOverride 'disable'), planned by
|        # Get-SIProConfigImportPlan -- not a document.
|        if ($r.locked -and $own.mode -eq 'disable') { continue }
|        $path = if ($own.path -like 'overlay:*') { Join-Path $OverlayRoot $own.path.Substring(8) } else { Join-Path $SIRoot $own.path }
|        $cands.Add([pscustomobject]@{ Kind = 'rule'; Key = ('{0}/{1}' -f $r.engine, $r.id); Path = $path })
|    }
|    foreach ($c in $cands) {
|        $text = ([System.IO.File]::ReadAllText($c.Path)).TrimStart([char]0xFEFF)
|        $rel = if ($c.Path.StartsWith($SIRoot, [StringComparison]::OrdinalIgnoreCase)) { $c.Path.Substring($SIRoot.Length).TrimStart('\') } else { $c.Path }
|        $name = '{0}/{1}' -f $c.Kind, $c.Key
|        if ($c.Kind -eq 'rule' -and $text -match '(?m)^AssetTagging\s*:') { $skipped.Add([pscustomobject]@{ Name = $name; Scope = 'document'; Info = $true; Path = $rel; Reason = ('{0} is an asset-tagging file, not a tier rule -- it stays in the files' -f $rel) }); continue }
|        if ($c.Kind -eq 'rule') {
|            # #908: a copied sample is an EXAMPLE, never a live rule -- the IP-subnet sample's 10.100.1.0/24 -> Tier 0 became
|            # one on an install this way. Refused (listed under "Not imported -- review"), the file is left as it is.
|            $sp = Get-SIRuleSamplePath -SIRoot $SIRoot -Path $c.Path -OverlayRoot $OverlayRoot
|            $st = if ($sp) { [System.IO.File]::ReadAllText($sp) } else { $null }
|            $sw = Get-SIRuleSampleReason -Text $text -SampleText $st
|            if ($sw) { $skipped.Add([pscustomobject]@{ Name = $name; Scope = 'document'; Path = $rel; Reason = ('{0}: the shipped example -- {1}' -f $rel, $sw) }); continue }
|        }
|        if ($c.Kind -eq 'weights') {
|            # An install's weights file is often the full risk-score model (mappers, normalizers, notes). Only its
|            # weightedRiskFactors is a Pro document -- that is all Risk Analysis reads from the Pro copy -- so that section
|            # is imported (with $schema and the file's notes) and every other section stays in the file, listed here.
|            $o = $null; try { $o = ConvertFrom-SIProJson $text } catch { $o = $null }
|            if ($o -is [System.Management.Automation.PSCustomObject]) {
|                $keep = { param([string]$n) $n.StartsWith('_') -or $n -eq 'Comment' -or $n -eq '$schema' -or $n -eq 'weightedRiskFactors' }
|                $other = @($o.PSObject.Properties | Where-Object { -not (& $keep $_.Name) } | ForEach-Object { $_.Name })
|                if (-not $o.PSObject.Properties['weightedRiskFactors']) {
|                    $skipped.Add([pscustomobject]@{ Name = $name; Scope = 'document'; Reason = ('{0}: it has no weightedRiskFactors -- only weightedRiskFactors is managed as a Pro document (keep other sections in the file)' -f $rel) }); continue
|                }
|                if ($other.Count -gt 0) {
|                    $doc = [ordered]@{}
|                    foreach ($p in $o.PSObject.Properties) { if (& $keep $p.Name) { $doc[$p.Name] = $p.Value } }
|                    $text = ConvertTo-SIJsonText $doc
|                    # #224: the sections are listed in FILE order (never a culture sort, which differs between PS 5.1 and 7).
|                    $skipped.Add([pscustomobject]@{ Name = ('{0} (other sections)' -f $name); Scope = 'document'; Info = $true; Reason = ('{0}: {1} -- not part of the weights document; they are imported as the configuration item weights/model (Get-SIProConfigImportPlan)' -f $rel, ($other -join ', ')) })
|                }
|            }
|        }
|        $why = @(Test-SIProDocument -Kind $c.Kind -Key $c.Key -Body $text -Context $Context)
|        if ($why.Count) { $skipped.Add([pscustomobject]@{ Name = $name; Scope = 'document'; Reason = ('{0}: {1}' -f $rel, ($why -join '; ')) }); continue }
|        $rows.Add([pscustomobject]@{ Kind = $c.Kind; Key = $c.Key; Body = $text; Source = $rel })
|    }
|    [pscustomobject]@{ Rows = $rows.ToArray(); Skipped = $skipped.ToArray(); Info = $info.ToArray() }
|}
|
|function Get-SIProLauncherOverrideFiles {
|    <#
|        #275 R4. Every launcher\<engine>\launcher.override.ps1 of an installation: free PowerShell the 2.2 internal launchers
|        dot-source AFTER the configuration layers (so it wins over LauncherConfig.custom.ps1). A container never runs it, so
|        Pro would silently lose what it sets: the importer lists every one. @{ Path; Rel; Engine; Scope = 'engine:<engine>' }.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot)
|    foreach ($d in @(Get-ChildItem -LiteralPath (Join-Path $SIRoot 'launcher') -Directory -ErrorAction SilentlyContinue | Sort-Object Name)) {
|        $p = Join-Path $d.FullName 'launcher.override.ps1'
|        if (-not (Test-Path -LiteralPath $p)) { continue }
|        [pscustomobject]@{ Path = $p; Rel = ('launcher\{0}\launcher.override.ps1' -f $d.Name); Engine = $d.Name; Scope = ('engine:{0}' -f $d.Name.ToLowerInvariant()) }
|    }
|}
|
|function Get-SIPs1CodeStatements {
|    <#
|        PURE. The top-level statements of a PowerShell text that are NOT a `$global:Name = ...` assignment -- code a settings
|        import cannot carry (a function, a condition, a command, a local variable). Per statement: Line, Text (its first line).
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Text)
|    $tokens = $null; $errors = $null
|    $ast = [System.Management.Automation.Language.Parser]::ParseInput($Text, [ref]$tokens, [ref]$errors)
|    if (@($errors).Count) {
|        $e = @($errors)[0]
|        [pscustomobject]@{ Line = $e.Extent.StartLineNumber; Text = ('the file does not parse: ' + $e.Message) }
|        return
|    }
|    $stmts = New-Object System.Collections.Generic.List[object]
|    if ($ast.ParamBlock) { $stmts.Add($ast.ParamBlock) }
|    foreach ($b in @($ast.DynamicParamBlock, $ast.BeginBlock, $ast.ProcessBlock, $ast.EndBlock)) { if ($b) { foreach ($s in $b.Statements) { $stmts.Add($s) } } }
|    foreach ($s in $stmts) {
|        if ($s -is [System.Management.Automation.Language.AssignmentStatementAst] -and $s.Left -is [System.Management.Automation.Language.VariableExpressionAst] -and
|            $s.Left.VariablePath.UserPath -match '^global:[A-Za-z_][A-Za-z0-9_]*$') { continue }
|        $first = ($s.Extent.Text -split "`r?`n")[0].Trim()
|        if ($first.Length -gt 120) { $first = $first.Substring(0, 117) + '...' }
|        [pscustomobject]@{ Line = $s.Extent.StartLineNumber; Text = $first }
|    }
|}
|
|function Get-SIProImportPlan {
|    <#
|        PURE given a root. What importing an install's custom files into cfg.Setting would write: every catalog setting
|        the solution file or an engine file sets as a plain value. A value set by code, and any secret, is NOT imported
|        -- it is listed with the reason, so the operator moves it by hand (a secret becomes a Key Vault reference).
|        A name that ANY imported file sets by code is not imported at any scope: the database layer is read last, so a
|        row would override that code (a Key Vault pull, an engine's own condition). The files stay in place in Pro, so
|        leaving the name out keeps exactly today's behaviour.
|        #275 R4: every launcher\<engine>\launcher.override.ps1 is read after the custom files (the launcher dot-sources it
|        last, so it wins at its engine's scope): its plain top-level `$global:Name = <literal>` catalog settings are
|        imported at scope engine:<engine>; everything else in it (code) is listed as needing manual review, with the line.
|        Returns @{ Rows; Skipped; Overrides (one per override file: Rel, Scope, Imported, Review) }. Every skipped entry
|        carries Path (the file) and, where there is one, Line.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][object[]]$Catalog)
|    $byName = @{}; foreach ($s in $Catalog) { $byName[[string]$s.name] = $s }
|    $retired = @(Get-SISettingsRetiredNames)
|    $rows = New-Object System.Collections.Generic.List[object]; $skipped = New-Object System.Collections.Generic.List[object]
|    $sources = New-Object System.Collections.Generic.List[object]
|    $targets = Get-SISettingsTargets -SIRoot $SIRoot
|    foreach ($key in $targets.Keys) {
|        $scope = if ($key -eq 'solution') { 'solution' } else { $key }
|        $p = $targets[$key]
|        $rel = if ($p.StartsWith($SIRoot, [StringComparison]::OrdinalIgnoreCase)) { $p.Substring($SIRoot.Length).TrimStart('\', '/') } else { $p }
|        $sources.Add([pscustomobject]@{ Path = $p; Rel = $rel; Scope = $scope; Override = $null })
|    }
|    $overrides = New-Object System.Collections.Generic.List[object]
|    foreach ($o in @(Get-SIProLauncherOverrideFiles -SIRoot $SIRoot)) {
|        $entry = [pscustomobject]@{ Rel = $o.Rel; Engine = $o.Engine; Scope = $o.Scope; Imported = 0; Review = 0 }
|        $overrides.Add($entry)
|        $sources.Add([pscustomobject]@{ Path = $o.Path; Rel = $o.Rel; Scope = $o.Scope; Override = $entry })
|    }
|    foreach ($src in $sources) {
|        $r = Read-SISettingsText -Path $src.Path
|        if (-not $r.Exists) { continue }
|        $scope = $src.Scope
|        $skip = { param([string]$name, $line, [string]$reason) $skipped.Add([pscustomobject]@{ Name = $name; Scope = $scope; Path = $src.Rel; Line = $line; Reason = $reason }); if ($src.Override) { $src.Override.Review++ } }
|        if ($src.Override) {
|            # the code in an override file: listed line by line -- a Pro run never executes it
|            foreach ($c in @(Get-SIPs1CodeStatements -Text $r.Text)) {
|                & $skip ('{0}:{1}' -f $src.Rel, $c.Line) $c.Line ('code at line {0} ({1}) -- a Pro run does not run launcher.override.ps1; move what it does into Settings' -f $c.Line, $c.Text)
|            }
|        }
|        foreach ($a in @(Get-SIPs1Assignments -Text $r.Text)) {
|            if ($retired -contains $a.Name) { continue }    # a setting that no longer exists: not imported, not listed
|            $s = $byName[$a.Name]
|            # Phase C: a name the catalog does not know is REPORTED (it stays in the file, and a Pro run without the file
|            # will not have it), and a Pro-edition setting is imported like any other -- this is the Pro database.
|            if (-not $s) { & $skip $a.Name $a.Line ('not in the settings catalog (line {0}) -- not imported; a Pro run reads only catalog settings from the database' -f $a.Line); continue }
|            if ($s.secret) {
|                # A secret's VALUE never enters the database. When the file pulls it from Key Vault by a literal secret
|                # name, that name becomes the database's Key Vault reference; otherwise it is listed for the operator.
|                $kv = [regex]::Match([string]$a.ValueText, '(?i)(Get-SIKvSecret|Get-AzKeyVaultSecret|keyvault\s+secret\s+show)\b.*?(-SecretName|-Name|--name)\s+[''"]([A-Za-z0-9\-]{1,127})[''"]')
|                if ($kv.Success) {
|                    $prev = $rows | Where-Object { $_.Name -eq $a.Name -and $_.Scope -eq $scope } | Select-Object -First 1
|                    if ($prev) { [void]$rows.Remove($prev) }
|                    $rows.Add([pscustomobject]@{ Name = $a.Name; Scope = $scope; Value = $null; KeyVaultSecretName = $kv.Groups[3].Value; Line = $a.Line; Source = $src.Rel })
|                    if ($src.Override) { $src.Override.Imported++ }
|                    continue
|                }
|                & $skip $a.Name $a.Line 'a secret -- store it in Key Vault and set its secret name'; continue
|            }
|            if (-not ($a.TopLevel -and $a.Literal)) { & $skip $a.Name $a.Line ('set by code at line {0}' -f $a.Line); continue }
|            $why = Test-SISettingValue -Setting $s -Value $a.Value
|            if ($why) { & $skip $a.Name $a.Line $why; continue }
|            # the last assignment in a file is the one that runs (and an override file runs after the custom file)
|            $prev = $rows | Where-Object { $_.Name -eq $a.Name -and $_.Scope -eq $scope } | Select-Object -First 1
|            if ($prev) { [void]$rows.Remove($prev) }
|            $rows.Add([pscustomobject]@{ Name = $a.Name; Scope = $scope; Value = $a.Value; Line = $a.Line; Source = $src.Rel })
|            if ($src.Override) { $src.Override.Imported++ }
|        }
|    }
|    $byCode = @{}; foreach ($s in $skipped) { if ($s.Reason -like 'set by code*') { $byCode[$s.Name] = $s } }
|    foreach ($r in @($rows | Where-Object { $byCode.ContainsKey($_.Name) })) {
|        [void]$rows.Remove($r)
|        $skipped.Add([pscustomobject]@{ Name = $r.Name; Scope = $r.Scope; Path = $r.Source; Line = $r.Line; Reason = ('kept in the files -- {0} also sets it by code; a database value would override that code' -f $byCode[$r.Name].Scope) })
|        $ov = @($overrides | Where-Object { $_.Rel -eq $r.Source }) | Select-Object -First 1
|        if ($ov) { $ov.Imported--; $ov.Review++ }
|    }
|    [pscustomobject]@{ Rows = $rows.ToArray(); Skipped = $skipped.ToArray(); Overrides = $overrides.ToArray() }
|}
|
|function Get-SIProImportReview {
|    <#
|        #275. PURE. The import report's final section, "Not imported -- review": every entry any plan did NOT import, as one
|        line a person can act on, plus the exit code a wizard and the upgrade test check:
|            0 = everything was imported          2 = items need review (listed)
|        Entry kinds: 'not-imported' ("not imported: <path> -- <reason>") and 'needs-review' (code, or a value set by code:
|        "needs manual review: <file>:<line> -- <reason>"). Entries a plan marks Info -- nothing is lost (a file the run never
|        read, sections imported elsewhere) -- go to Informational and do not change the exit code.
|        Also returns LauncherOverrides: every launcher.override.ps1 found, with what was imported from it.
|    #>
|    param($Settings, $Documents, $Items, $Connectors)
|    $review = New-Object System.Collections.Generic.List[object]; $infos = New-Object System.Collections.Generic.List[object]
|    $prop = { param($o, [string]$n) if ($o -and $o.PSObject.Properties[$n]) { $o.$n } else { $null } }
|    $sections = @(@{ N = 'settings'; P = $Settings }, @{ N = 'documents'; P = $Documents }, @{ N = 'items'; P = $Items }, @{ N = 'connectors'; P = $Connectors })
|    foreach ($sec in $sections) {
|        if (-not $sec.P) { continue }
|        foreach ($s in @(& $prop $sec.P 'Skipped')) {
|            if (-not $s) { continue }
|            $path = [string](& $prop $s 'Path'); $line = & $prop $s 'Line'; $name = [string](& $prop $s 'Name'); $reason = [string](& $prop $s 'Reason')
|            if (-not $path) { $path = $name }
|            if ([bool](& $prop $s 'Info')) {
|                $infos.Add([pscustomobject]@{ Section = $sec.N; Name = $name; Path = $path; Reason = $reason; Text = ('note: {0} -- {1}' -f $path, $reason) }); continue
|            }
|            $isCode = ($reason -match '^(code at line|set by code)') -and $null -ne $line
|            $kind = if ($isCode) { 'needs-review' } else { 'not-imported' }
|            $where = if ($isCode -and $null -ne $line) { '{0}:{1}' -f $path, $line } elseif ($name -and $name -ne $path) { '{0} ({1})' -f $path, $name } else { $path }
|            $text = if ($isCode) { 'needs manual review: {0} -- {1}' -f $where, $reason } else { 'not imported: {0} -- {1}' -f $where, $reason }
|            $review.Add([pscustomobject]@{ Section = $sec.N; Kind = $kind; Name = $name; Path = $path; Line = $line; Reason = $reason; Text = $text })
|        }
|        foreach ($s in @(& $prop $sec.P 'Info')) {
|            if (-not $s) { continue }
|            $path = [string](& $prop $s 'Path'); $reason = [string](& $prop $s 'Reason')
|            $infos.Add([pscustomobject]@{ Section = $sec.N; Name = [string](& $prop $s 'Name'); Path = $path; Reason = $reason; Text = ('note: {0} -- {1}' -f $path, $reason) })
|        }
|    }
|    $ov = @(& $prop $Settings 'Overrides' | Where-Object { $_ })
|    [pscustomobject]@{
|        NotImported = $review.ToArray(); Informational = $infos.ToArray(); LauncherOverrides = $ov
|        ExitCode = $(if ($review.Count) { 2 } else { 0 })
|    }
|}
|
|function ConvertTo-SIProImportReportJson {
|    <# PURE. The import report as JSON (-ReportPath): what was planned / imported per part, the launcher overrides found, the
|       informational notes and the "Not imported -- review" section with the exit code. #>
|    param([Parameter(Mandatory)]$Review, $Settings, $Documents, $Items, $Connectors, [string]$SIRoot, [bool]$Applied, [string]$GeneratedAt)
|    $rep = [ordered]@{
|        schema      = 'securityinsight.import-report/1'
|        generatedAt = $GeneratedAt
|        installPath = $SIRoot
|        applied     = $Applied
|        exitCode    = $Review.ExitCode
|        result      = $(if ($Review.ExitCode -eq 0) { 'everything imported' } else { 'items need review' })
|        imported    = [ordered]@{
|            settings   = @(@($Settings.Rows) | Where-Object { $_ } | ForEach-Object { [ordered]@{ name = $_.Name; scope = $_.Scope; source = [string]$_.Source; line = $_.Line; keyVaultSecretName = [string]$_.KeyVaultSecretName } })
|            documents  = @(@($Documents.Rows) | Where-Object { $_ } | ForEach-Object { [ordered]@{ kind = $_.Kind; key = $_.Key; source = $_.Source } })
|            items      = @(@($Items.Rows) | Where-Object { $_ } | ForEach-Object { [ordered]@{ kind = $_.Kind; key = $_.Key; state = $_.State; source = $_.Source } })
|            connectors = @(@($(if ($Connectors) { $Connectors.Rows })) | Where-Object { $_ -and $_.Action -ne 'same' } | ForEach-Object { [ordered]@{ name = [string]$_.Definition.Name; action = $_.Action } })
|            sameAsTemplate = @(@($(if ($Items) { $Items.Same })) | Where-Object { $_ })
|        }
|        launcherOverrides = @($Review.LauncherOverrides | ForEach-Object { [ordered]@{ path = $_.Rel; scope = $_.Scope; settingsImported = $_.Imported; needsReview = $_.Review } })
|        informational     = @($Review.Informational | ForEach-Object { [ordered]@{ section = $_.Section; path = $_.Path; name = $_.Name; reason = $_.Reason } })
|        notImported       = @($Review.NotImported | ForEach-Object { [ordered]@{ section = $_.Section; kind = $_.Kind; path = $_.Path; line = $_.Line; name = $_.Name; reason = $_.Reason; text = $_.Text } })
|    }
|    ConvertTo-Json -InputObject $rep -Depth 6
|}
|
|function Get-SIProSettingsEngineName {
|    <#
|        PURE. The engine folder a container job's SI_ENGINE maps to -- the name `engine:<folder>` settings rows use (#211 (2)).
|        The two Risk Analysis jobs share one folder, the close-loop job uses asset-cmdb's; every other container
|        engine IS its launcher folder.
|    #>
|    param([Parameter(Mandatory)][string]$ContainerEngine)
|    $e = $ContainerEngine.Trim().ToLowerInvariant()
|    switch ($e) {
|        'risk-analysis-detailed' { return 'risk-analysis' }
|        'ptc'                    { return 'privilege-tier-classifier' }
|        # the close-loop job is the VM's `asset-cmdb launcher -Vulnerabilities` (#216)
|        'asset-vulnerabilities'  { return 'asset-cmdb' }
|        # ...and so does the close-loop's daily mail job (engine\asset-cmdb\Invoke-SICloseLoopMail.ps1)
|        'close-loop-mail'        { return 'asset-cmdb' }
|        # ...and the SQL CMDB connector (#271, engine\asset-cmdb\Invoke-SICmdbSql.ps1)
|        'asset-cmdb-sql'         { return 'asset-cmdb' }
|        # the Pro data sync job (L-DATA) is the engine\pro-data folder
|        'asset-datasync'         { return 'pro-data' }
|        default                  { return $e }
|    }
|}
'@ }
$__siSupportFiles['engine/pro-settings/SI-Settings.ps1'] = @{ Sha256 = '82551d4087cdaad8d009379dae924547d5a312f43ffeb925aaf1c96a4689b9e9'; Text = @'
|#Requires -Version 5.1
|<#
|    The Settings page's backend: read every settings layer, plan a change as a reviewable diff, write it safely.
|
|    🔒 SURGICAL, NEVER REGENERATED. A custom config file is hand-edited by operators and carries code (Key Vault
|    pulls, conditionals) next to plain values. A change here replaces ONLY the value of one top-level
|    `$global:Name = <literal>` assignment, or appends one line to a marked block. Write-SICustomConfig's
|    whole-file render is for first setup and must never be used from this page -- it would drop every hand edit
|    it does not model. An assignment that is not a plain literal is refused, never rewritten.
|
|    Everything in this file except Write-SISettingsFile is pure (text in, text out) and tested directly.
|#>
|
|$script:SISettingsMarker = '# --- set by the Settings page (SecurityInsight Config Wizard) ---'
|function Get-SIPs1Assignments {
|    <#
|        PURE. Every `$global:Name = ...` assignment in a PowerShell text. Per assignment: Name, Line, TopLevel (not
|        inside an if / function / loop), Literal (a plain value: string, number, $true/$false/$null, or an array of
|        those), Value (when literal), ValueText, and the offsets needed to edit it.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Text)
|    $tokens = $null; $errors = $null
|    $ast = [System.Management.Automation.Language.Parser]::ParseInput($Text, [ref]$tokens, [ref]$errors)
|    $found = $ast.FindAll({ param($n)
|        $n -is [System.Management.Automation.Language.AssignmentStatementAst] -and
|        $n.Left -is [System.Management.Automation.Language.VariableExpressionAst] -and
|        $n.Left.VariablePath.UserPath -match '^global:[A-Za-z_][A-Za-z0-9_]*$'
|    }, $true)
|    foreach ($a in $found) {
|        $name = ($a.Left.VariablePath.UserPath -replace '^global:', '')
|        # Top level = the statement's parent chain reaches the script block without an if / loop / function / try.
|        $p = $a.Parent; $top = $true
|        while ($p -and -not ($p -is [System.Management.Automation.Language.ScriptBlockAst] -and $null -eq $p.Parent)) {
|            if ($p -isnot [System.Management.Automation.Language.NamedBlockAst] -and $p -isnot [System.Management.Automation.Language.ScriptBlockAst]) { $top = $false; break }
|            $p = $p.Parent
|        }
|        $expr = $null
|        $right = $a.Right
|        if ($right -is [System.Management.Automation.Language.PipelineAst] -and $right.PipelineElements.Count -eq 1 -and
|            $right.PipelineElements[0] -is [System.Management.Automation.Language.CommandExpressionAst]) {
|            $expr = $right.PipelineElements[0].Expression
|        } elseif ($right -is [System.Management.Automation.Language.CommandExpressionAst]) {
|            $expr = $right.Expression
|        }
|        $literal = $false; $value = $null
|        if ($expr -and $a.Operator -eq [System.Management.Automation.Language.TokenKind]::Equals) {
|            $isVar = $expr -is [System.Management.Automation.Language.VariableExpressionAst]
|            $okVar = (-not $isVar) -or ($expr.VariablePath.UserPath -in 'true', 'false', 'null')
|            $hasVar = @($expr.FindAll({ param($n) $n -is [System.Management.Automation.Language.VariableExpressionAst] -and $n.VariablePath.UserPath -notin 'true', 'false', 'null' }, $true)).Count -gt 0
|            $hasCall = @($expr.FindAll({ param($n) $n -is [System.Management.Automation.Language.CommandAst] -or $n -is [System.Management.Automation.Language.InvokeMemberExpressionAst] -or $n -is [System.Management.Automation.Language.SubExpressionAst] }, $true)).Count -gt 0
|            $isHash = @($expr.FindAll({ param($n) $n -is [System.Management.Automation.Language.HashtableAst] -or $n -is [System.Management.Automation.Language.ScriptBlockExpressionAst] }, $true)).Count -gt 0
|            if ($okVar -and -not $hasVar -and -not $hasCall -and -not $isHash) {
|                try { $value = $expr.SafeGetValue(); $literal = $true } catch { $literal = $false }
|            }
|        }
|        $vs = if ($expr) { $expr.Extent.StartOffset } else { $right.Extent.StartOffset }
|        $ve = if ($expr) { $expr.Extent.EndOffset } else { $right.Extent.EndOffset }
|        [pscustomobject]@{
|            Name = $name; Line = $a.Extent.StartLineNumber; TopLevel = $top; Literal = $literal
|            Value = $value; ValueText = $Text.Substring($vs, $ve - $vs)
|            StatementStart = $a.Extent.StartOffset; StatementEnd = $a.Extent.EndOffset; ValueStart = $vs; ValueEnd = $ve
|        }
|    }
|}
|
|function ConvertTo-SIPs1Literal {
|    <# PURE. A value as PowerShell source: 'text' (quotes doubled), numbers invariant, $true/$false/$null, @('a', 'b'). #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return '$null' }
|    if ($Value -is [bool]) { if ($Value) { return '$true' } else { return '$false' } }
|    if ($Value -is [int] -or $Value -is [long] -or $Value -is [double] -or $Value -is [decimal]) {
|        return ([string]::Format([System.Globalization.CultureInfo]::InvariantCulture, '{0}', $Value))
|    }
|    if ($Value -is [string]) { return ("'{0}'" -f $Value.Replace("'", "''")) }
|    if ($Value -is [System.Collections.IEnumerable] -and $Value -isnot [System.Collections.IDictionary]) {
|        $items = @(foreach ($v in $Value) {
|            if ($v -is [System.Collections.IEnumerable] -and $v -isnot [string]) { throw 'nested lists are not supported' }
|            ConvertTo-SIPs1Literal $v
|        })
|        return ('@(' + ($items -join ', ') + ')')
|    }
|    throw ("a value of type {0} cannot be written as a setting" -f $Value.GetType().Name)
|}
|
|function Edit-SIPs1Settings {
|    <#
|        PURE. Apply changes to a custom config text. Each change: @{ Name; Action = 'Set' | 'Reset'; Value }.
|          Set   -- the file's top-level literal assignment gets the new value (only its value text changes); with no
|                   assignment, one line is appended to the marked block at the end.
|          Reset -- the top-level literal assignment's line is removed, so the layer below applies again.
|        Refused (and listed, the text untouched for that name): any assignment of the name that is code, inside an
|        if / function, or shares its line with other code. Returns @{ Text; Applied; Refused }.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Text, [Parameter(Mandatory)][object[]]$Changes)
|    $nl = if ($Text.Contains("`r`n")) { "`r`n" } elseif ($Text.Contains("`n")) { "`n" } else { "`r`n" }
|    $assign = @(Get-SIPs1Assignments -Text $Text)
|    $edits = New-Object System.Collections.Generic.List[object]     # @{ Start; End; Text }
|    $appends = New-Object System.Collections.Generic.List[string]
|    $applied = New-Object System.Collections.Generic.List[object]
|    $refused = New-Object System.Collections.Generic.List[object]
|    foreach ($c in $Changes) {
|        $name = [string]$c.Name
|        if ($name -notmatch '^[A-Za-z_][A-Za-z0-9_]*$') { $refused.Add([pscustomobject]@{ Name = $name; Reason = 'not a valid setting name' }); continue }
|        $mine = @($assign | Where-Object { $_.Name -eq $name })
|        $bad = @($mine | Where-Object { -not $_.TopLevel -or -not $_.Literal })
|        if ($bad.Count -gt 0) {
|            $refused.Add([pscustomobject]@{ Name = $name; Reason = ('set by code at line {0} -- edit it in the file' -f $bad[0].Line) }); continue
|        }
|        if ($c.Action -eq 'Set') {
|            try { $lit = ConvertTo-SIPs1Literal $c.Value } catch { $refused.Add([pscustomobject]@{ Name = $name; Reason = $_.Exception.Message }); continue }
|            if ($mine.Count -gt 0) {
|                # Every literal top-level assignment gets the value -- the last one wins at run time, and leaving an
|                # earlier one stale would make the file read one way and run another.
|                foreach ($m in $mine) { $edits.Add(@{ Start = $m.ValueStart; End = $m.ValueEnd; Text = $lit }) }
|            } else {
|                $appends.Add(('$global:{0} = {1}' -f $name, $lit))
|            }
|            $applied.Add([pscustomobject]@{ Name = $name; Action = 'Set'; Value = $c.Value })
|        } elseif ($c.Action -eq 'Reset') {
|            if ($mine.Count -eq 0) { continue }    # nothing set here: already the layer below
|            $ok = $true; $cuts = @()
|            foreach ($m in $mine) {
|                $ls = $Text.LastIndexOf("`n", [Math]::Max(0, $m.StatementStart - 1)); $ls = if ($m.StatementStart -eq 0 -or $ls -lt 0) { 0 } else { $ls + 1 }
|                $le = $Text.IndexOf("`n", $m.StatementEnd); $le = if ($le -lt 0) { $Text.Length } else { $le + 1 }
|                $before = $Text.Substring($ls, $m.StatementStart - $ls)
|                $after  = $Text.Substring($m.StatementEnd, $le - $m.StatementEnd).TrimEnd("`r", "`n")
|                if ($before.Trim() -ne '' -or ($after.Trim() -ne '' -and -not $after.Trim().StartsWith('#'))) { $ok = $false; break }
|                $cuts += @{ Start = $ls; End = $le; Text = '' }
|            }
|            if (-not $ok) { $refused.Add([pscustomobject]@{ Name = $name; Reason = 'shares its line with other code -- edit it in the file' }); continue }
|            foreach ($x in $cuts) { $edits.Add($x) }
|            $applied.Add([pscustomobject]@{ Name = $name; Action = 'Reset'; Value = $null })
|        } else {
|            $refused.Add([pscustomobject]@{ Name = $name; Reason = ('unknown action {0}' -f $c.Action) })
|        }
|    }
|    $out = $Text
|    foreach ($e in @($edits | Sort-Object { $_.Start } -Descending)) {
|        $out = $out.Substring(0, $e.Start) + $e.Text + $out.Substring($e.End)
|    }
|    if ($appends.Count -gt 0) {
|        $idx = $out.IndexOf($script:SISettingsMarker)
|        if ($idx -ge 0) {
|            $le = $out.IndexOf("`n", $idx); $le = if ($le -lt 0) { $out.Length } else { $le + 1 }
|            $block = ($appends -join $nl) + $nl
|            if ($le -eq $out.Length -and -not $out.EndsWith("`n")) { $block = $nl + $block }
|            $out = $out.Substring(0, $le) + $block + $out.Substring($le)
|        } else {
|            $sep = if ($out.Length -eq 0) { '' } elseif ($out.EndsWith("`n")) { $nl } else { $nl + $nl }
|            $out = $out + $sep + $script:SISettingsMarker + $nl + ($appends -join $nl) + $nl
|        }
|    }
|    # Self-check: the result parses, and every Set reads back as the value asked for.
|    $perr = $null; $tk = $null
|    [void][System.Management.Automation.Language.Parser]::ParseInput($out, [ref]$tk, [ref]$perr)
|    if (@($perr).Count -gt 0) { throw ('the edited file would not parse: {0}' -f $perr[0].Message) }
|    $check = @(Get-SIPs1Assignments -Text $out)
|    foreach ($a in @($applied | Where-Object { $_.Action -eq 'Set' })) {
|        $last = @($check | Where-Object { $_.Name -eq $a.Name -and $_.TopLevel -and $_.Literal }) | Select-Object -Last 1
|        if (-not $last -or (ConvertTo-SIPs1Literal $last.Value) -ne (ConvertTo-SIPs1Literal $a.Value)) { throw ('{0} did not read back as the value written' -f $a.Name) }
|    }
|    [pscustomobject]@{ Text = $out; Applied = $applied.ToArray(); Refused = $refused.ToArray() }
|}
|
|function Get-SITextDiff {
|    <# PURE. A unified diff (3 lines of context) between two texts; empty when they are equal. #>
|    param([AllowEmptyString()][string]$Old, [AllowEmptyString()][string]$New, [string]$Label = 'file', [int]$Context = 3)
|    $a = @($Old -split "`r?`n"); $b = @($New -split "`r?`n")
|    if ($Old -ceq $New) { return '' }
|    $pre = 0; while ($pre -lt $a.Count -and $pre -lt $b.Count -and $a[$pre] -ceq $b[$pre]) { $pre++ }
|    $suf = 0; while ($suf -lt ($a.Count - $pre) -and $suf -lt ($b.Count - $pre) -and $a[$a.Count - 1 - $suf] -ceq $b[$b.Count - 1 - $suf]) { $suf++ }
|    $am = @(if ($a.Count - $pre - $suf -gt 0) { $a[$pre..($a.Count - $suf - 1)] })
|    $bm = @(if ($b.Count - $pre - $suf -gt 0) { $b[$pre..($b.Count - $suf - 1)] })
|    # LCS over the changed middle only -- a settings change touches a few lines.
|    $n = $am.Count; $m = $bm.Count
|    # jagged, not [int[,]]: PS 5.1 cannot parse a computed second index like $L[$i, ($j + 1)]
|    $L = New-Object 'object[]' ($n + 1)
|    for ($i = 0; $i -le $n; $i++) { $L[$i] = New-Object 'int[]' ($m + 1) }
|    for ($i = $n - 1; $i -ge 0; $i--) { $row = $L[$i]; $down = $L[$i + 1]; for ($j = $m - 1; $j -ge 0; $j--) {
|        if ($am[$i] -ceq $bm[$j]) { $row[$j] = $down[$j + 1] + 1 } else { $row[$j] = [Math]::Max($down[$j], $row[$j + 1]) } } }
|    $body = New-Object System.Collections.Generic.List[string]
|    $cs = [Math]::Max(0, $pre - $Context)
|    for ($k = $cs; $k -lt $pre; $k++) { $body.Add(' ' + $a[$k]) }
|    $i = 0; $j = 0
|    while ($i -lt $n -or $j -lt $m) {
|        if ($i -lt $n -and $j -lt $m -and $am[$i] -ceq $bm[$j]) { $body.Add(' ' + $am[$i]); $i++; $j++ }
|        # on a tie the removed line comes first, so a changed line reads "- old" then "+ new"
|        elseif ($j -lt $m -and ($i -ge $n -or $L[$i][$j + 1] -gt $L[$i + 1][$j])) { $body.Add('+' + $bm[$j]); $j++ }
|        else { $body.Add('-' + $am[$i]); $i++ }
|    }
|    $ce = [Math]::Min($a.Count, $a.Count - $suf + $Context)
|    for ($k = $a.Count - $suf; $k -lt $ce; $k++) { $body.Add(' ' + $a[$k]) }
|    $hdr = '@@ -{0} +{1} @@' -f ($cs + 1), ($cs + 1)
|    (@("--- $Label", "+++ $Label", $hdr) + $body.ToArray()) -join "`n"
|}
|
|function Get-SISettingsTargets {
|    <#
|        PURE given a root. The ONLY files the page may write, by key -- the browser names a key, never a path:
|        'solution' = config\SecurityInsight.custom.ps1; 'engine:<name>' = launcher\<name>\LauncherConfig.custom.ps1 for
|        every engine folder that ships a LauncherConfig.defaults.ps1 or LauncherConfig.custom.sample.ps1.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $t = [ordered]@{ 'solution' = (Join-Path $SIRoot 'config\SecurityInsight.custom.ps1') }
|    foreach ($d in @(Get-ChildItem -LiteralPath (Join-Path $SIRoot 'launcher') -Directory -ErrorAction SilentlyContinue | Sort-Object Name)) {
|        if ($d.Name -eq '_lib') { continue }
|        if ((Test-Path -LiteralPath (Join-Path $d.FullName 'LauncherConfig.defaults.ps1')) -or (Test-Path -LiteralPath (Join-Path $d.FullName 'LauncherConfig.custom.sample.ps1'))) {
|            $t[('engine:{0}' -f $d.Name)] = (Join-Path $d.FullName 'LauncherConfig.custom.ps1')
|        }
|    }
|    $t
|}
|
|function Get-SIFileHash {
|    param([Parameter(Mandatory)][string]$Path)
|    if (-not (Test-Path -LiteralPath $Path)) { return '' }
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { -join ($sha.ComputeHash([System.IO.File]::ReadAllBytes($Path)) | ForEach-Object { $_.ToString('x2') }) } finally { $sha.Dispose() }
|}
|
|function Read-SISettingsText {
|    <# The text of a settings file (empty when absent) and whether it carries a UTF-8 BOM. #>
|    param([Parameter(Mandatory)][string]$Path)
|    if (-not (Test-Path -LiteralPath $Path)) { return [pscustomobject]@{ Text = ''; Bom = $true; Exists = $false } }
|    $bytes = [System.IO.File]::ReadAllBytes($Path)
|    $bom = $bytes.Length -ge 3 -and $bytes[0] -eq 0xEF -and $bytes[1] -eq 0xBB -and $bytes[2] -eq 0xBF
|    $text = if ($bom) { [System.Text.Encoding]::UTF8.GetString($bytes, 3, $bytes.Length - 3) } else { [System.Text.Encoding]::UTF8.GetString($bytes) }
|    [pscustomobject]@{ Text = $text; Bom = $bom; Exists = $true }
|}
|
|function Write-SISettingsFile {
|    <#
|        Write one settings file: refused when it changed since it was read (hash), backed up first
|        (<file>.bak.<timestamp>), written to a temp file and swapped in, so it is never half-written. Keeps a BOM the
|        file had, and adds one when the text is not plain ASCII (PowerShell 5.1 misreads UTF-8 without it).
|    #>
|    param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][AllowEmptyString()][string]$Text,
|          [Parameter(Mandatory)][AllowEmptyString()][string]$ExpectedHash, [bool]$Bom = $true)
|    $now = Get-SIFileHash -Path $Path
|    if ($now -ne $ExpectedHash) { throw ('{0} changed since it was read -- reload and review again' -f (Split-Path -Leaf $Path)) }
|    $useBom = $Bom -or ($Text -match '[^\x00-\x7F]')
|    $dir = Split-Path -Parent $Path
|    if (-not (Test-Path -LiteralPath $dir)) { throw ('folder not found: {0}' -f $dir) }
|    # Short on purpose: PS 5.1 (.NET Framework) refuses paths over 260 characters, and "<long report name>.<guid>.tmp"
|    # crossed it in a deep install folder (measured 2026-10-02). Same folder, so the swap below stays one step.
|    $tmp = Join-Path $dir ('.si-{0}.tmp' -f [guid]::NewGuid().ToString('N').Substring(0, 8))
|    [System.IO.File]::WriteAllText($tmp, $Text, (New-Object System.Text.UTF8Encoding($useBom)))
|    $backup = $null
|    if (Test-Path -LiteralPath $Path) {
|        $backup = '{0}.bak.{1}' -f $Path, (Get-Date).ToString('yyyyMMdd-HHmmss')
|        [System.IO.File]::Replace($tmp, $Path, $backup)
|    } else {
|        [System.IO.File]::Move($tmp, $Path)
|    }
|    [pscustomobject]@{ Path = $Path; Backup = $backup; Hash = (Get-SIFileHash -Path $Path) }
|}
|
|function Get-SISettingsCatalog {
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $p = Join-Path $SIRoot 'config\settings.catalog.locked.json'
|    if (-not (Test-Path -LiteralPath $p)) { throw "settings catalog not found: $p" }
|    (Get-Content -LiteralPath $p -Raw -Encoding UTF8 | ConvertFrom-Json).settings
|}
|
|function Get-SISettingsRetiredNames {
|    <#
|        The settings that no longer exist (the catalog's "retired" list). A value left for one -- in a configuration file
|        or a Pro settings row -- is ignored without a message: never imported, never refused, never applied.
|    #>
|    param([string]$SIRoot)
|    # default: the solution root this function's own file ships in (engine\pro-settings\ -> root) -- read from the
|    # function itself, so it holds however and from whichever scope this file was loaded
|    if (-not $SIRoot) { $SIRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $MyInvocation.MyCommand.ScriptBlock.File)) }
|    if (-not $SIRoot) { return @() }
|    $p = Join-Path $SIRoot 'config\settings.catalog.locked.json'
|    if (-not (Test-Path -LiteralPath $p)) { return @() }
|    $c = Get-Content -LiteralPath $p -Raw -Encoding UTF8 | ConvertFrom-Json
|    if (-not $c.PSObject.Properties['retired']) { return @() }
|    @($c.retired | Where-Object { $_ } | ForEach-Object { [string]$_ })
|}
|
|function Get-SISettingsView {
|    <#
|        Every catalog setting with the value each layer gives it, the effective one, and where it comes from.
|        Layers, closest last: shared default -> engine default -> solution custom -> engine custom. A secret's value is
|        NEVER returned -- only whether it is set, and whether by code. Pro-only settings are left out: this page is the
|        Community edition's; Pro keeps its settings in SQL and manages them from its own page (operator, 2026-10-02).
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][object[]]$Catalog)
|    $targets = Get-SISettingsTargets -SIRoot $SIRoot
|    $read = @{}
|    function _layer([string]$key, [string]$path) {
|        $r = Read-SISettingsText -Path $path
|        $read[$key] = [pscustomobject]@{ Path = $path; Exists = $r.Exists; Assign = @(Get-SIPs1Assignments -Text $r.Text); Hash = (Get-SIFileHash -Path $path) }
|    }
|    _layer 'shared' (Join-Path $SIRoot 'launcher\_lib\SecurityInsight.shared-defaults.ps1')
|    foreach ($k in $targets.Keys) {
|        _layer $k $targets[$k]
|        if ($k -like 'engine:*') { _layer ('default:' + $k.Substring(7)) (Join-Path $SIRoot ('launcher\{0}\LauncherConfig.defaults.ps1' -f $k.Substring(7))) }
|    }
|    $rows = foreach ($s in $Catalog) {
|        if ($s.edition -eq 'pro') { continue }
|        $engines = @($s.engines)
|        $order = @(@{ Key = 'shared'; Label = 'shared default' })
|        foreach ($e in $engines) { $order += @{ Key = "default:$e"; Label = "$e default" } }
|        $order += @{ Key = 'solution'; Label = 'solution custom' }
|        foreach ($e in $engines) { $order += @{ Key = "engine:$e"; Label = "$e custom" } }
|        $layers = foreach ($o in $order) {
|            $L = $read[$o.Key]
|            if (-not $L) { continue }
|            $hits = @($L.Assign | Where-Object { $_.Name -eq $s.name })
|            if ($hits.Count -eq 0) { continue }
|            $h = $hits[-1]
|            $code = -not ($h.Literal -and $h.TopLevel)
|            [pscustomobject]@{
|                layer = $o.Label; key = $o.Key; line = $h.Line; byCode = $code
|                value = if ($s.secret -or $code) { $null } else { $h.Value }
|                text  = if ($s.secret) { $(if ($code) { '(set by code)' } else { '(set -- hidden)' }) } elseif ($code) { $h.ValueText } else { $null }
|            }
|        }
|        $layers = @($layers)
|        $eff = if ($layers.Count) { $layers[-1] } else { $null }
|        [pscustomobject]@{
|            name = $s.name; label = $s.label; group = $s.group; type = $s.type; engines = $engines; edition = $s.edition
|            secret = [bool]$s.secret; advanced = [bool]$s.advanced; description = $s.description
|            purpose = $s.purpose; defaultText = $s.defaultText; effect = $s.effect; whenToChange = $s.whenToChange; unit = $s.unit
|            values = $s.values; valueLabels = $s.valueLabels   # a fixed set of choices (type 'enum'): shown as a dropdown
|            target = if ($engines.Count -eq 1) { "engine:$($engines[0])" } else { 'solution' }
|            layers = $layers; effective = $eff
|            editable = (-not $s.secret)
|        }
|    }
|    [pscustomobject]@{
|        root = $SIRoot
|        files = @(foreach ($k in $read.Keys | Sort-Object) { [pscustomobject]@{ key = $k; path = $read[$k].Path; exists = $read[$k].Exists; hash = $read[$k].Hash; writable = $targets.Contains($k) } })
|        settings = @($rows)
|    }
|}
|
|function ConvertTo-SISettingNumber {
|    <#
|        PURE. A 'number' setting's value as a finite [double], or $null when it is not one. A real number (any integer or
|        decimal type) is taken as is; text is parsed with the INVARIANT culture only -- '0.01' is a number, '0,01' is not,
|        whatever the machine's culture -- so the same text means the same value on every host. NaN and infinity are not
|        numbers here. Booleans, lists and everything else are refused.
|    #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or $Value -is [bool]) { return $null }
|    $d = [double]::NaN
|    if ($Value -is [string]) {
|        if (-not [double]::TryParse($Value, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $null }
|    } elseif ($Value -is [int] -or $Value -is [long] -or $Value -is [double] -or $Value -is [decimal] -or $Value -is [single] -or
|              $Value -is [int16] -or $Value -is [byte] -or $Value -is [sbyte] -or $Value -is [uint16] -or $Value -is [uint32] -or $Value -is [uint64]) {
|        $d = [double]$Value
|    } else { return $null }
|    if ([double]::IsNaN($d) -or [double]::IsInfinity($d)) { return $null }
|    $d
|}
|
|function Test-SISettingValue {
|    <# PURE. $null when the value fits the setting's type, else the reason. #>
|    param([Parameter(Mandatory)]$Setting, [AllowNull()]$Value)
|    switch ([string]$Setting.type) {
|        'number' {
|            $d = ConvertTo-SISettingNumber $Value
|            if ($null -eq $d) { return 'must be a number' }
|            $inv = [System.Globalization.CultureInfo]::InvariantCulture
|            if ($null -ne $Setting.min -and $d -lt [double]$Setting.min) { return [string]::Format($inv, 'must be at least {0}', [double]$Setting.min) }
|            if ($null -ne $Setting.max -and $d -gt [double]$Setting.max) { return [string]::Format($inv, 'must be at most {0}', [double]$Setting.max) }
|        }
|        'bool'   { if ($Value -isnot [bool]) { return 'must be true or false' } }
|        'int'    {
|            $n = 0L
|            if (-not [long]::TryParse([string]$Value, [ref]$n)) { return 'must be a whole number' }
|            if ($null -ne $Setting.min -and $n -lt [long]$Setting.min) { return ('must be at least {0}' -f $Setting.min) }
|            if ($null -ne $Setting.max -and $n -gt [long]$Setting.max) { return ('must be at most {0}' -f $Setting.max) }
|        }
|        'list'   { if ($null -ne $Value -and -not ($Value -is [System.Collections.IEnumerable] -and $Value -isnot [string])) { return 'must be a list' } }
|        'enum'   { if (@($Setting.values) -notcontains [string]$Value) { return ('must be one of: {0}' -f (@($Setting.values) -join ', ')) } }
|        default  { if ($null -ne $Value -and $Value -isnot [string]) { return 'must be text' } }
|    }
|    if ($Setting.pattern -and $null -ne $Value -and [string]$Value -ne '' -and [string]$Value -notmatch [string]$Setting.pattern) { return ('does not match the expected format ({0})' -f $Setting.patternHint) }
|    $null
|}
|
|function Invoke-SISettingsPlan {
|    <#
|        A list of changes -> what each custom file would become, as a diff. Nothing is written. A change:
|        @{ name; action = 'Set' | 'Reset'; value }; its file comes from the catalog (one engine -> that engine's
|        custom file, else the solution file) -- the browser never names a file. Unknown settings, secrets, Pro settings
|        and values of the wrong type are refused with the reason. Returns @{ files; refused } where each file carries
|        its key, relative path, current hash, diff and (internal, not for the browser) the new text.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][object[]]$Catalog, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Changes)
|    $targets = Get-SISettingsTargets -SIRoot $SIRoot
|    $byName = @{}; foreach ($s in $Catalog) { $byName[[string]$s.name] = $s }
|    $refused = New-Object System.Collections.Generic.List[object]
|    $perFile = [ordered]@{}
|    foreach ($c in $Changes) {
|        $name = [string]$c.name; $action = [string]$c.action
|        $s = $byName[$name]
|        if (-not $s) { $refused.Add([pscustomobject]@{ name = $name; reason = 'not a known setting' }); continue }
|        if ($s.secret) { $refused.Add([pscustomobject]@{ name = $name; reason = 'a secret is never set from this page -- keep it in Key Vault' }); continue }
|        if ($s.edition -eq 'pro') { $refused.Add([pscustomobject]@{ name = $name; reason = 'a Pro setting is managed from the Pro settings page' }); continue }
|        if ($action -notin 'Set', 'Reset') { $refused.Add([pscustomobject]@{ name = $name; reason = "unknown action '$action'" }); continue }
|        $value = $c.value
|        if ($action -eq 'Set') {
|            if ($s.type -eq 'int' -and $value -is [string]) { $n = 0L; if ([long]::TryParse($value, [ref]$n)) { $value = [int]$n } }
|            if ($s.type -eq 'list' -and $null -ne $value) { $value = @($value | ForEach-Object { [string]$_ }) }
|            $why = Test-SISettingValue -Setting $s -Value $value
|            # a number is written as a number literal, invariant ('0.01', never '0,01' or a quoted '0.01'); a [double] also
|            # reads back as itself -- a [decimal] from PS 5.1's ConvertFrom-Json would keep '0.010' and fail the read-back
|            if (-not $why -and $s.type -eq 'number') { $value = ConvertTo-SISettingNumber $value }
|            if ($why) { $refused.Add([pscustomobject]@{ name = $name; reason = $why }); continue }
|        }
|        $engines = @($s.engines)
|        $key = if ($engines.Count -eq 1) { "engine:$($engines[0])" } else { 'solution' }
|        if (-not $targets.Contains($key)) { $refused.Add([pscustomobject]@{ name = $name; reason = "no custom file for $key" }); continue }
|        if (-not $perFile.Contains($key)) { $perFile[$key] = New-Object System.Collections.Generic.List[object] }
|        $perFile[$key].Add(@{ Name = $name; Action = $action; Value = $value })
|    }
|    $files = foreach ($key in $perFile.Keys) {
|        $path = $targets[$key]
|        $r = Read-SISettingsText -Path $path
|        $ed = Edit-SIPs1Settings -Text $r.Text -Changes $perFile[$key].ToArray()
|        foreach ($x in $ed.Refused) { $refused.Add([pscustomobject]@{ name = $x.Name; reason = $x.Reason }) }
|        $rel = $path.Substring($SIRoot.Length).TrimStart('\', '/').Replace('/', '\')
|        [pscustomobject]@{
|            key = $key; path = $rel; exists = $r.Exists; hash = (Get-SIFileHash -Path $path)
|            diff = (Get-SITextDiff -Old $r.Text -New $ed.Text -Label $rel)
|            applied = @($ed.Applied | ForEach-Object { [pscustomobject]@{ name = $_.Name; action = $_.Action; value = $_.Value } })
|            NewText = $ed.Text; Bom = $r.Bom; OldAssign = @(Get-SIPs1Assignments -Text $r.Text)
|        }
|    }
|    [pscustomobject]@{ files = @($files); refused = $refused.ToArray() }
|}
|
|function Invoke-SISettingsWrite {
|    <#
|        Re-plans the same changes on the server (the browser's text is never trusted) and writes each file only when
|        its hash is still the one the operator reviewed. Every applied change is logged to logs\settings-changes.log.
|        Nothing is written when any change is refused or any file is stale.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][object[]]$Catalog, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Changes,
|          [Parameter(Mandatory)][hashtable]$Hashes, [string]$User = ('{0}\{1}' -f $env:USERDOMAIN, $env:USERNAME))
|    $plan = Invoke-SISettingsPlan -SIRoot $SIRoot -Catalog $Catalog -Changes $Changes
|    if (@($plan.refused).Count -gt 0) { return [pscustomobject]@{ written = @(); refused = $plan.refused; error = 'some changes were refused -- nothing was written' } }
|    foreach ($f in $plan.files) {
|        if (-not $Hashes.ContainsKey($f.key) -or [string]$Hashes[$f.key] -ne $f.hash) {
|            return [pscustomobject]@{ written = @(); refused = @(); error = ('{0} changed since it was reviewed -- review again' -f $f.path) }
|        }
|    }
|    $written = New-Object System.Collections.Generic.List[object]
|    $logDir = Join-Path $SIRoot 'logs'
|    if (-not (Test-Path -LiteralPath $logDir)) { New-Item -ItemType Directory -Path $logDir -Force | Out-Null }
|    $log = Join-Path $logDir 'settings-changes.log'
|    foreach ($f in $plan.files) {
|        if (-not $f.diff) { continue }
|        $w = Write-SISettingsFile -Path (Join-Path $SIRoot $f.path) -Text $f.NewText -ExpectedHash $f.hash -Bom $f.Bom
|        foreach ($a in $f.applied) {
|            $old = @($f.OldAssign | Where-Object { $_.Name -eq $a.name }) | Select-Object -Last 1
|            $line = [ordered]@{
|                time = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ'); user = $User; file = $f.path; setting = $a.name; action = $a.action
|                old = $(if ($old) { $old.ValueText } else { $null }); new = $(if ($a.action -eq 'Set') { ConvertTo-SIPs1Literal $a.value } else { $null })
|            }
|            [System.IO.File]::AppendAllText($log, (($line | ConvertTo-Json -Compress) + "`r`n"), (New-Object System.Text.UTF8Encoding($false)))
|        }
|        $written.Add([pscustomobject]@{ key = $f.key; path = $f.path; backup = $(if ($w.Backup) { $w.Backup.Substring($SIRoot.Length).TrimStart('\', '/').Replace('/', '\') } else { $null }); hash = $w.Hash })
|    }
|    [pscustomobject]@{ written = $written.ToArray(); refused = @(); error = $null }
|}
|
|# =====================================================================================================================
|#  PHASE 2 -- the JSON settings: Risk Analysis exclusions and risk weights (risk-analysis-detection\*.custom.json)
|#  🔴 Every exclusion value and every weight field / value-map key is pasted into a KQL query by the engine, which
|#  escapes only a double quote. A backslash, a quote or a line break could break or change the query, so each value
|#  is checked against a strict pattern here -- the page's only way in.
|# =====================================================================================================================
|$script:SIJsonPatterns = @{
|    Cve      = '^CVE-\d{4}-\d{4,7}$'
|    ConfigId = '^[A-Za-z0-9._:\-]{1,128}$'
|    Tag      = '^[^"\\\r\n]{1,128}$'
|    Field    = '^[A-Za-z_][A-Za-z0-9_]{0,63}$'
|    MapKey   = '^[^"\\\r\n]{1,64}$'
|    IpRange  = '^\d{1,3}(\.\d{1,3}){3}(/\d{1,2})?$'
|}
|$script:SIWeightEngines = @('endpoint', 'identity', 'azure', 'publicip')
|
|function ConvertTo-SIJsonText {
|    <# PURE. Stable, readable JSON (2-space indent). A list is ALWAYS an array -- PS 5.1's ConvertTo-Json writes a one-item list as a bare value. #>
|    param([AllowNull()]$Value, [int]$Level = 0)
|    $pad = '  ' * $Level; $pad1 = '  ' * ($Level + 1)
|    if ($null -eq $Value) { return 'null' }
|    if ($Value -is [bool]) { if ($Value) { return 'true' } else { return 'false' } }
|    if ($Value -is [int] -or $Value -is [long] -or $Value -is [double] -or $Value -is [decimal] -or $Value -is [single]) {
|        return ([string]::Format([System.Globalization.CultureInfo]::InvariantCulture, '{0}', $Value))
|    }
|    if ($Value -is [string]) {
|        $sb = New-Object System.Text.StringBuilder
|        [void]$sb.Append('"')
|        foreach ($ch in $Value.ToCharArray()) {
|            switch ($ch) {
|                '"'  { [void]$sb.Append('\"') } '\' { [void]$sb.Append('\\') }
|                "`n" { [void]$sb.Append('\n') } "`r" { [void]$sb.Append('\r') } "`t" { [void]$sb.Append('\t') }
|                default { if ([int]$ch -lt 32) { [void]$sb.Append(('\u{0:x4}' -f [int]$ch)) } else { [void]$sb.Append($ch) } }
|            }
|        }
|        [void]$sb.Append('"'); return $sb.ToString()
|    }
|    $pairs = $null
|    if ($Value -is [System.Collections.IDictionary]) { $pairs = @(foreach ($k in $Value.get_Keys()) { ,@([string]$k, $Value[$k]) }) }
|    elseif ($Value -is [pscustomobject]) { $pairs = @(foreach ($p in $Value.PSObject.Properties) { ,@($p.Name, $p.Value) }) }
|    if ($null -ne $pairs) {
|        if ($pairs.Count -eq 0) { return '{}' }
|        $items = foreach ($p in $pairs) { $pad1 + (ConvertTo-SIJsonText $p[0]) + ': ' + (ConvertTo-SIJsonText $p[1] ($Level + 1)) }
|        return "{`n" + ($items -join ",`n") + "`n$pad}"
|    }
|    if ($Value -is [System.Collections.IEnumerable]) {
|        $arr = @($Value)
|        if ($arr.Count -eq 0) { return '[]' }
|        $items = foreach ($v in $arr) { $pad1 + (ConvertTo-SIJsonText $v ($Level + 1)) }
|        return "[`n" + ($items -join ",`n") + "`n$pad]"
|    }
|    return (ConvertTo-SIJsonText ([string]$Value) $Level)
|}
|
|function Get-SIRaReportNames {
|    <# The Risk Analysis report names in the shipped query file -- the only names an exclusion file may be created for. #>
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $p = Join-Path $SIRoot 'risk-analysis-detection\RiskAnalysis_Queries_Locked.yaml'
|    if (-not (Test-Path -LiteralPath $p)) { return @() }
|    @([regex]::Matches([System.IO.File]::ReadAllText($p), '(?m)^\s*-\s*ReportName:\s*([A-Za-z0-9_]+)\s*$') | ForEach-Object { $_.Groups[1].Value } | Sort-Object -Unique)
|}
|
|function Resolve-SIJsonTarget {
|    <# A JSON settings key -> its file, or $null. 'exclusions:global' | 'exclusions:<Report>' (a shipped report) | 'weights'. #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][string]$Key, [string[]]$Reports)
|    $dir = Join-Path $SIRoot 'risk-analysis-detection'
|    if ($Key -eq 'exclusions:global') { return (Join-Path $dir 'RiskAnalysisGlobalExclusions.custom.json') }
|    if ($Key -eq 'weights') { return (Join-Path $dir 'riskscore_weighted.schema.custom.json') }
|    if ($Key -match '^exclusions:([A-Za-z0-9_]+)$') {
|        $r = $Matches[1]
|        if (-not $Reports) { $Reports = Get-SIRaReportNames -SIRoot $SIRoot }
|        if ($Reports -contains $r) { return (Join-Path $dir ('{0}.exclude.custom.json' -f $r)) }
|    }
|    $null
|}
|
|function Test-SIJsonChange {
|    <# PURE. The reasons a change to a JSON settings file is not allowed (empty = allowed). #>
|    param([Parameter(Mandatory)][string]$Key, [Parameter(Mandatory)][string]$Property, [AllowNull()]$Value)
|    $why = New-Object System.Collections.Generic.List[string]
|    function _list($v, $rx, $what) {
|        foreach ($x in @($v)) { if ([string]$x -notmatch $rx) { $why.Add(("'{0}' is not a valid {1}" -f $x, $what)) } }
|    }
|    if ($Key -eq 'exclusions:global') {
|        # #541: the global exclusions -- asset tags, assets (CI ids or names) and address ranges -- reach every report whose
|        # scope declares them (data-model/report-scope, the Risk Analysis scope preamble)
|        switch ($Property) {
|            'ExcludedAssetTags' { _list $Value $script:SIJsonPatterns.Tag 'tag (no quotes, backslashes or line breaks)' }
|            'ExcludedAssets'    { _list $Value $script:SIJsonPatterns.Tag 'asset id or name (no quotes, backslashes or line breaks)' }
|            'ExcludedIpRanges'  { _list $Value $script:SIJsonPatterns.IpRange 'IPv4 address or range (a.b.c.d/nn)' }
|            default             { $why.Add('only ExcludedAssetTags, ExcludedAssets and ExcludedIpRanges can be set globally'); return $why.ToArray() }
|        }
|    } elseif ($Key -like 'exclusions:*') {
|        switch ($Property) {
|            'ExcludedCves'             { _list $Value $script:SIJsonPatterns.Cve 'CVE id (CVE-YYYY-NNNN)' }
|            'ExcludedConfigurationIds' { _list $Value $script:SIJsonPatterns.ConfigId 'configuration id (letters, digits, . _ : -)' }
|            'ExcludedAssetTags'        { _list $Value $script:SIJsonPatterns.Tag 'tag (no quotes, backslashes or line breaks)' }
|            'ExcludedAssets'           { _list $Value $script:SIJsonPatterns.Tag 'asset id or name (no quotes, backslashes or line breaks)' }
|            'ExcludedIpRanges'         { _list $Value $script:SIJsonPatterns.IpRange 'IPv4 address or range (a.b.c.d/nn)' }
|            'CveMinAgeDays'            { $n = 0; if (-not [int]::TryParse([string]$Value, [ref]$n) -or $n -lt 0 -or $n -gt 3650) { $why.Add('CveMinAgeDays must be a whole number from 0 to 3650') } }
|            default                    { $why.Add("'$Property' is not an exclusion setting") }
|        }
|    } elseif ($Key -eq 'weights') {
|        if ($script:SIWeightEngines -notcontains $Property) { $why.Add("'$Property' is not an engine (endpoint, identity, azure, publicip)"); return $why.ToArray() }
|        if ($null -eq $Value) { return $why.ToArray() }   # null = remove this engine's weights
|        # Multipliers are BASIS-100 WHOLE NUMBERS, as the engine reads them (RA-WeightedFactors.ps1 casts each to [int]
|        # and divides by 100): 100 = 1.0x, 150 = 1.5x. A decimal like 1.5 would become 2 = 0.02x -- silently no weight --
|        # so it is refused rather than accepted. A multiplier is 1..1000 (up to 10x); the cap is 0 (none) .. 10000 (100x,
|        # what two fields at 10x can reach). The real weights in use run 100..175.
|        function _whole($v, [double]$lo, [double]$hi) {
|            $d = 0.0
|            if (-not [double]::TryParse([string]$v, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $false }
|            ($d -eq [Math]::Floor($d)) -and $d -ge $lo -and $d -le $hi
|        }
|        $combine = [string]$Value.combine
|        if ($combine -and $combine -notin 'product', 'max', 'sum-of-deltas') { $why.Add("combine must be product, max or sum-of-deltas") }
|        if ($null -ne $Value.maxMultiplier -and -not (_whole $Value.maxMultiplier 0 10000)) { $why.Add('maxMultiplier must be a whole number from 0 to 10000 (100 = 1.0x, 500 = a 5x cap, 0 = no cap)') }
|        $fields = @($Value.fields)
|        if ($fields.Count -eq 0) { $why.Add('at least one weighted field is needed') }
|        foreach ($fl in $fields) {
|            if ([string]$fl.field -notmatch $script:SIJsonPatterns.Field) { $why.Add(("'{0}' is not a valid field name" -f $fl.field)); continue }
|            $map = $fl.valueMap
|            $props = if ($map -is [System.Collections.IDictionary]) { @($map.get_Keys()) } elseif ($map) { @($map.PSObject.Properties.Name) } else { @() }
|            if ($props.Count -eq 0) { $why.Add(("{0}: the value map is empty" -f $fl.field)) }
|            foreach ($k in $props) {
|                if ([string]$k -notmatch $script:SIJsonPatterns.MapKey) { $why.Add(("{0}: '{1}' is not a valid value" -f $fl.field, $k)) }
|                $mv = if ($map -is [System.Collections.IDictionary]) { $map[$k] } else { $map.$k }
|                if (-not (_whole $mv 1 1000)) { $why.Add(("{0}: the multiplier for '{1}' must be a whole number from 1 to 1000 (100 = 1.0x, 150 = 1.5x)" -f $fl.field, $k)) }
|            }
|            if ($null -ne $fl.default -and -not (_whole $fl.default 1 1000)) { $why.Add(("{0}: the default multiplier must be a whole number from 1 to 1000 (100 = 1.0x)" -f $fl.field)) }
|        }
|    } else {
|        $why.Add("unknown settings file '$Key'")
|    }
|    $why.ToArray()
|}
|
|function ConvertTo-SIOrderedJson {
|    <# PURE. ConvertFrom-Json output -> ordered dictionaries / lists, so a property can be set while every other key keeps its place. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [pscustomobject]) {
|        $o = [ordered]@{}; foreach ($p in $Value.PSObject.Properties) { $o[$p.Name] = ConvertTo-SIOrderedJson $p.Value }; return $o
|    }
|    if ($Value -is [System.Collections.IDictionary]) {
|        $o = [ordered]@{}; foreach ($k in $Value.get_Keys()) { $o[[string]$k] = ConvertTo-SIOrderedJson $Value[$k] }; return $o
|    }
|    if ($Value -is [System.Collections.IEnumerable] -and $Value -isnot [string]) { return ,@(foreach ($v in $Value) { ConvertTo-SIOrderedJson $v }) }
|    $Value
|}
|
|function Edit-SIJsonSettings {
|    <#
|        PURE. Apply property changes to one JSON settings file's text (empty / absent = {}). Every other key -- the
|        `_`-prefixed notes included -- keeps its value and place. For 'weights' the property is an engine under
|        weightedRiskFactors; $null removes it. For exclusions $null removes the property.
|    #>
|    param([Parameter(Mandatory)][string]$Key, [AllowEmptyString()][string]$Text, [Parameter(Mandatory)][object[]]$Changes)
|    $doc = if ([string]::IsNullOrWhiteSpace($Text)) { [ordered]@{} } else { ConvertTo-SIOrderedJson ($Text | ConvertFrom-Json) }
|    if ($doc -isnot [System.Collections.IDictionary]) { throw 'the file is not a JSON object' }
|    foreach ($c in $Changes) {
|        $prop = [string]$c.property
|        $val = ConvertTo-SIOrderedJson $c.value
|        if ($Key -eq 'weights') {
|            if (-not $doc.Contains('weightedRiskFactors') -or $doc['weightedRiskFactors'] -isnot [System.Collections.IDictionary]) { $doc['weightedRiskFactors'] = [ordered]@{} }
|            $w = $doc['weightedRiskFactors']
|            if ($null -eq $val) { if ($w.Contains($prop)) { $w.Remove($prop) } } else { $w[$prop] = $val }
|        } else {
|            if ($null -eq $val) { if ($doc.Contains($prop)) { $doc.Remove($prop) } }
|            elseif ($prop -eq 'CveMinAgeDays') { $doc[$prop] = [int]$val }
|            else { $doc[$prop] = @(@($val) | ForEach-Object { [string]$_ }) }
|        }
|    }
|    (ConvertTo-SIJsonText $doc) + "`n"
|}
|
|function Get-SIJsonSettingsView {
|    <# What the Exclusions and Risk weights pages show: the report names, the current global / per-report exclusions, and the current weights per engine. #>
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $reports = @(Get-SIRaReportNames -SIRoot $SIRoot)
|    $dir = Join-Path $SIRoot 'risk-analysis-detection'
|    function _read([string]$path) {
|        if (-not (Test-Path -LiteralPath $path)) { return $null }
|        try { Get-Content -LiteralPath $path -Raw -Encoding UTF8 | ConvertFrom-Json } catch { [pscustomobject]@{ _unreadable = $_.Exception.Message } }
|    }
|    $g = _read (Join-Path $dir 'RiskAnalysisGlobalExclusions.custom.json')
|    $per = foreach ($f in @(Get-ChildItem -LiteralPath $dir -Filter '*.exclude.custom.json' -ErrorAction SilentlyContinue)) {
|        $name = $f.Name -replace '\.exclude\.custom\.json$', ''
|        $b = _read $f.FullName
|        [pscustomobject]@{ report = $name; known = ($reports -contains $name); hash = (Get-SIFileHash -Path $f.FullName)
|            ExcludedCves = @($b.ExcludedCves | Where-Object { $_ }); ExcludedConfigurationIds = @($b.ExcludedConfigurationIds | Where-Object { $_ })
|            ExcludedAssetTags = @($b.ExcludedAssetTags | Where-Object { $_ }); CveMinAgeDays = $b.CveMinAgeDays }
|    }
|    $wpath = Join-Path $dir 'riskscore_weighted.schema.custom.json'
|    $w = _read $wpath
|    $sample = _read (Join-Path $dir 'riskscore_weighted.schema.custom.sample.json')
|    $engines = foreach ($e in $script:SIWeightEngines) {
|        $sec = if ($w -and $w.weightedRiskFactors -and $w.weightedRiskFactors.PSObject.Properties[$e]) { $w.weightedRiskFactors.$e } else { $null }
|        $ex = if ($sample -and $sample.weightedRiskFactors -and $sample.weightedRiskFactors.PSObject.Properties[$e]) { $sample.weightedRiskFactors.$e } else { $null }
|        [pscustomobject]@{ engine = $e; current = $sec; example = $ex }
|    }
|    [pscustomobject]@{
|        reports = $reports
|        global  = [pscustomobject]@{ ExcludedAssetTags = @($g.ExcludedAssetTags | Where-Object { $_ }); hash = (Get-SIFileHash -Path (Join-Path $dir 'RiskAnalysisGlobalExclusions.custom.json')) }
|        perReport = @($per)
|        weights = [pscustomobject]@{ engines = @($engines); hash = (Get-SIFileHash -Path $wpath); exists = (Test-Path -LiteralPath $wpath) }
|    }
|}
|
|function Invoke-SIJsonSettingsPlan {
|    <# Changes @{ key; property; value } -> per-file diff + hash, nothing written. Refused changes carry the reasons. #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Changes)
|    $reports = @(Get-SIRaReportNames -SIRoot $SIRoot)
|    $refused = New-Object System.Collections.Generic.List[object]
|    $perFile = [ordered]@{}
|    foreach ($c in $Changes) {
|        $key = [string]$c.key; $prop = [string]$c.property
|        $path = Resolve-SIJsonTarget -SIRoot $SIRoot -Key $key -Reports $reports
|        if (-not $path) { $refused.Add([pscustomobject]@{ name = "$key/$prop"; reason = "'$key' is not a settings file this page may change" }); continue }
|        $why = @(Test-SIJsonChange -Key $key -Property $prop -Value $c.value)
|        if ($why.Count) { $refused.Add([pscustomobject]@{ name = "$key/$prop"; reason = ($why -join '; ') }); continue }
|        if (-not $perFile.Contains($key)) { $perFile[$key] = @{ Path = $path; Changes = New-Object System.Collections.Generic.List[object] } }
|        $perFile[$key].Changes.Add(@{ property = $prop; value = $c.value })
|    }
|    $files = foreach ($key in $perFile.Keys) {
|        $path = $perFile[$key].Path
|        $r = Read-SISettingsText -Path $path
|        try { $new = Edit-SIJsonSettings -Key $key -Text $r.Text -Changes $perFile[$key].Changes.ToArray() }
|        catch { $refused.Add([pscustomobject]@{ name = $key; reason = ('the current file could not be read: {0}' -f $_.Exception.Message) }); continue }
|        $rel = $path.Substring($SIRoot.Length).TrimStart('\', '/').Replace('/', '\')
|        [pscustomobject]@{ key = $key; path = $rel; exists = $r.Exists; hash = (Get-SIFileHash -Path $path)
|            diff = (Get-SITextDiff -Old $r.Text -New $new -Label $rel); applied = @($perFile[$key].Changes | ForEach-Object { [pscustomobject]@{ property = $_.property } })
|            NewText = $new; OldText = $r.Text }
|    }
|    [pscustomobject]@{ files = @($files); refused = $refused.ToArray() }
|}
|
|function Invoke-SIJsonSettingsWrite {
|    <# Re-plans on the server and writes only files whose hash is still the reviewed one; logs each change. Nothing is written when anything is refused or stale. #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Changes,
|          [Parameter(Mandatory)][hashtable]$Hashes, [string]$User = ('{0}\{1}' -f $env:USERDOMAIN, $env:USERNAME))
|    $plan = Invoke-SIJsonSettingsPlan -SIRoot $SIRoot -Changes $Changes
|    if (@($plan.refused).Count) { return [pscustomobject]@{ written = @(); refused = $plan.refused; error = 'some changes were refused -- nothing was written' } }
|    foreach ($f in $plan.files) {
|        if (-not $Hashes.ContainsKey($f.key) -or [string]$Hashes[$f.key] -ne $f.hash) { return [pscustomobject]@{ written = @(); refused = @(); error = ('{0} changed since it was reviewed -- review again' -f $f.path) } }
|    }
|    $logDir = Join-Path $SIRoot 'logs'
|    if (-not (Test-Path -LiteralPath $logDir)) { New-Item -ItemType Directory -Path $logDir -Force | Out-Null }
|    $log = Join-Path $logDir 'settings-changes.log'
|    $written = New-Object System.Collections.Generic.List[object]
|    foreach ($f in $plan.files) {
|        if (-not $f.diff) { continue }
|        $w = Write-SISettingsFile -Path (Join-Path $SIRoot $f.path) -Text $f.NewText -ExpectedHash $f.hash -Bom $false
|        foreach ($a in $f.applied) {
|            $line = [ordered]@{ time = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ'); user = $User; file = $f.path; setting = $a.property; action = 'Set' }
|            [System.IO.File]::AppendAllText($log, (($line | ConvertTo-Json -Compress) + "`r`n"), (New-Object System.Text.UTF8Encoding($false)))
|        }
|        $written.Add([pscustomobject]@{ key = $f.key; path = $f.path; backup = $(if ($w.Backup) { $w.Backup.Substring($SIRoot.Length).TrimStart('\', '/').Replace('/', '\') } else { $null }); hash = $w.Hash })
|    }
|    [pscustomobject]@{ written = $written.ToArray(); refused = @(); error = $null }
|}
|
|# =====================================================================================================================
|#  PHASE 3 -- tier rules (asset-profiling-enrichment\<engine>\...\<id>.custom.yaml)
|#  A custom rule with the same id REPLACES the shipped one; `mode: disable` turns it off; a rule in the overlay folder
|#  (SI_EnrichmentDataRoot, outside the code tree) wins over both. The page writes only rules it created (marked on the
|#  first line) -- a hand-written custom rule is shown read-only, because a YAML round trip would drop its comments.
|# =====================================================================================================================
|$script:SIRuleMarker = '# Created by the SecurityInsight Settings page'
|$script:SIRuleEngines = @('endpoint', 'identity', 'azure', 'shared')
|
|function Get-SIRuleKinds {
|    <# The detection kinds the engine evaluates, read from its registry (the page never guesses). #>
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $p = Join-Path $SIRoot 'engine\asset-profiling\shared\RuleEval.ps1'
|    if (-not (Test-Path -LiteralPath $p)) { return @() }
|    $t = [System.IO.File]::ReadAllText($p)
|    $i = $t.IndexOf('$script:SIKindRegistry = @{'); if ($i -lt 0) { return @() }
|    $j = $t.IndexOf("`n}", $i)
|    @([regex]::Matches($t.Substring($i, $j - $i), "(?m)^\s*'([A-Za-z]+)'\s*=") | ForEach-Object { $_.Groups[1].Value })
|}
|
|function Get-SIRuleHeader {
|    <# PURE. The few fields the list shows, read from the text (no YAML round trip): id, mode, purpose, category, tiers set, page-created. #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Text)
|    $f = { param($k) $m = [regex]::Match($Text, "(?m)^$k\s*:\s*(.+?)\s*$"); if ($m.Success) { $m.Groups[1].Value.Trim("'", '"', ' ') } else { '' } }
|    [pscustomobject]@{
|        Id = (& $f 'id'); Mode = (& $f 'mode'); Purpose = (& $f 'purpose'); Category = (& $f 'category')
|        Tiers = @([regex]::Matches($Text, '(?m)^\s*Tier\s*:\s*(\d+)') | ForEach-Object { [int]$_.Groups[1].Value } | Sort-Object -Unique)
|        PageCreated = $Text.TrimStart([char]0xFEFF).StartsWith($script:SIRuleMarker)
|    }
|}
|
|function Get-SIRuleView {
|    <#
|        Every rule by id: its shipped file, an in-tree custom file, an overlay custom file, which one the engine uses, and
|        whether the page may edit it. Paths are relative (to the solution, or to the overlay as 'overlay:...').
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [string]$OverlayRoot)
|    $tree = Join-Path $SIRoot 'asset-profiling-enrichment'
|    $byId = [ordered]@{}
|    function _add($file, $base, $where) {
|        $rel = $file.FullName.Substring($base.Length).TrimStart('\', '/').Replace('/', '\')
|        $parts = $rel -split '\\'
|        $engine = $parts[0].ToLowerInvariant()
|        if ($script:SIRuleEngines -notcontains $engine) { return }
|        $relDir = if ($parts.Count -gt 2) { ($parts[1..($parts.Count - 2)] -join '\') } else { '' }
|        $text = [System.IO.File]::ReadAllText($file.FullName)
|        $h = Get-SIRuleHeader -Text $text
|        $id = if ($h.Id) { $h.Id } else { $file.Name -replace '\.(locked|custom)\.yaml$', '' }
|        $key = "$engine|$id"
|        if (-not $byId.Contains($key)) { $byId[$key] = [ordered]@{ id = $id; engine = $engine; relDir = $relDir; locked = $null; custom = $null; overlay = $null } }
|        $entry = [pscustomobject]@{ path = $(if ($where -eq 'overlay') { 'overlay:' + $rel } else { 'asset-profiling-enrichment\' + $rel }); mode = $h.Mode
|            purpose = $h.Purpose; category = $h.Category; tiers = $h.Tiers; pageCreated = $h.PageCreated; hash = (Get-SIFileHash -Path $file.FullName) }
|        $byId[$key][$where] = $entry
|        if (-not $byId[$key].relDir -and $relDir) { $byId[$key].relDir = $relDir }
|    }
|    foreach ($f in @(Get-ChildItem -LiteralPath $tree -Recurse -File -Filter '*.yaml' -ErrorAction SilentlyContinue)) {
|        if ($f.Name -like '*.locked.yaml') { _add $f $tree 'locked' } elseif ($f.Name -like '*.custom.yaml') { _add $f $tree 'custom' }
|    }
|    if ($OverlayRoot -and (Test-Path -LiteralPath $OverlayRoot)) {
|        foreach ($f in @(Get-ChildItem -LiteralPath $OverlayRoot -Recurse -File -Filter '*.custom.yaml' -ErrorAction SilentlyContinue)) { _add $f $OverlayRoot 'overlay' }
|    }
|    $rows = foreach ($k in $byId.Keys) {
|        $r = $byId[$k]
|        $eff = if ($r.overlay) { $r.overlay } elseif ($r.custom) { $r.custom } else { $r.locked }
|        $state = if (-not $r.locked) { 'added' } elseif ($eff -eq $r.locked) { 'shipped' } elseif ($eff.mode -eq 'disable') { 'turned off' } else { 'overridden' }
|        $show = if ($eff.mode -eq 'disable' -and $r.locked) { $r.locked } else { $eff }
|        [pscustomobject]@{ id = $r.id; engine = $r.engine; relDir = $r.relDir; state = $state
|            purpose = $show.purpose; category = $show.category; tiers = $show.tiers
|            locked = $r.locked; custom = $r.custom; overlay = $r.overlay; effective = $eff.path
|            editable = ($eff -ne $r.locked -and $eff.pageCreated) }
|    }
|    @($rows | Sort-Object engine, relDir, id)
|}
|
|function Get-SIRuleTargetPath {
|    <# Where the page writes a custom rule: the overlay when one is set, else beside the shipped rule. Id and folder are checked -- no path from the browser. #>
|    param([Parameter(Mandatory)][string]$SIRoot, [string]$OverlayRoot, [Parameter(Mandatory)][string]$Engine, [AllowEmptyString()][string]$RelDir, [Parameter(Mandatory)][string]$Id)
|    if ($script:SIRuleEngines -notcontains $Engine) { throw "unknown rule engine '$Engine'" }
|    if ($Id -notmatch '^[A-Za-z][A-Za-z0-9_\-]{0,99}$') { throw "'$Id' is not a valid rule id (letters, digits, _ and -)" }
|    if ($RelDir -and $RelDir -notmatch '^[A-Za-z0-9_\-]+(\\[A-Za-z0-9_\-]+)*$') { throw "'$RelDir' is not a valid rule folder" }
|    $base = if ($OverlayRoot) { $OverlayRoot } else { Join-Path $SIRoot 'asset-profiling-enrichment' }
|    $dir = if ($RelDir) { Join-Path (Join-Path $base $Engine) $RelDir } else { Join-Path $base $Engine }
|    Join-Path $dir ('{0}.custom.yaml' -f $Id)
|}
|
|function New-SIRuleText {
|    <# PURE. The text the page writes: turn a shipped rule off, start an override from the shipped text, or a new rule. #>
|    param([Parameter(Mandatory)][ValidateSet('disable', 'override', 'add')][string]$Kind, [Parameter(Mandatory)][string]$Id,
|          [string]$Engine = 'endpoint', [AllowEmptyString()][string]$LockedText = '')
|    switch ($Kind) {
|        'disable'  { return ("{0} -- turns off the shipped rule {1}.`r`nid: {1}`r`nmode: disable`r`n" -f $script:SIRuleMarker, $Id) }
|        'override' {
|            $body = ($LockedText.TrimStart([char]0xFEFF) -replace '(?m)^mode:\s*\S+', 'mode: overwrite')
|            return ("{0} -- replaces the shipped rule {1}; edit below.`r`n{2}" -f $script:SIRuleMarker, $Id, $body)
|        }
|        'add' {
|            $applies = if ($Engine -eq 'shared') { 'any' } else { $Engine }
|            return (@(
|                "$($script:SIRuleMarker) -- a rule of this installation.",
|                "id: $Id", "appliesTo: $applies", 'mode: append', "purpose: 'Describe what this rule finds'", "category: 'Custom'", "description: ''",
|                '', 'detections:', "  - id: $Id", '    detect:', '      any:', '        - kind: nameMatches', '          namePatterns:', "            - '(?i)^example-'",
|                '    set:', '      Tier: 3', "      Purpose: 'Describe what this rule finds'", "      Category: 'Custom'", ''
|            ) -join "`r`n")
|        }
|    }
|}
|
|function Test-SIRuleText {
|    <# The reasons a rule text is not accepted (empty = accepted): it must parse, carry the expected id, and use only known kinds and tiers 0-3. #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Text, [Parameter(Mandatory)][string]$Id, [Parameter(Mandatory)][string[]]$Kinds)
|    $why = New-Object System.Collections.Generic.List[string]
|    if (-not (Get-Command -Name ConvertFrom-SIYaml -ErrorAction SilentlyContinue)) {
|        . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-Yaml.ps1'))
|    }
|    $o = $null
|    try { $o = ConvertFrom-SIYaml -Yaml $Text -SourceName ('rule ' + $Id) } catch { $why.Add('the rule is not valid YAML: ' + $_.Exception.Message); return $why.ToArray() }
|    if ($o -isnot [System.Collections.IDictionary]) { $why.Add('the rule must be a YAML mapping'); return $why.ToArray() }
|    if ([string]$o['id'] -ne $Id) { $why.Add("the id must stay '$Id' -- it is what replaces the shipped rule") }
|    if ([string]$o['mode'] -eq 'disable') { return $why.ToArray() }
|    $ap = @($o['appliesTo'] | ForEach-Object { ([string]$_) -split '[,;]\s*' } | Where-Object { $_ })
|    foreach ($a in $ap) { if ($a.ToLowerInvariant() -notin 'endpoint', 'identity', 'azure', 'publicip', 'any') { $why.Add("appliesTo '$a' is not an engine") } }
|    $dets = @($o['detections'])
|    if ($dets.Count -eq 0 -or $null -eq $dets[0]) { $why.Add('a rule needs at least one detection'); return $why.ToArray() }
|    foreach ($d in $dets) {
|        $dt = $d['detect']
|        $list = if ($dt -and $dt['any']) { @($dt['any']) } elseif ($dt -and $dt['all']) { @($dt['all']) } else { @() }
|        if ($list.Count -eq 0) { $why.Add(("detection '{0}': detect needs an 'any' or 'all' list" -f $d['id'])) }
|        foreach ($k in $list) { if ($Kinds -notcontains [string]$k['kind']) { $why.Add(("detection '{0}': '{1}' is not a detection kind the engine knows" -f $d['id'], $k['kind'])) } }
|        $set = $d['set']
|        if ($set -and $null -ne $set['Tier']) { $n = 0; if (-not [int]::TryParse([string]$set['Tier'], [ref]$n) -or $n -lt 0 -or $n -gt 3) { $why.Add(("detection '{0}': Tier must be 0, 1, 2 or 3" -f $d['id'])) } }
|    }
|    $why.ToArray()
|}
|
|# #908: every shipped sample rule (*.custom.sample.yaml) starts with this header line. A live rule that still carries it
|# is the shipped EXAMPLE copied as it was -- on one install the IP-subnet sample (10.100.1.0/24 -> Tier 0, a "Domain
|# Controller") became a live rule that way. The web app keys on the same text (RuleEntry.IsShippedExample).
|$script:SIRuleSampleMarkerPattern = '(?m)^[ \t]*#[ \t]*SAMPLE[ \t]*/[ \t]*TEMPLATE\b'
|
|function Test-SIRuleSampleMarker {
|    <# PURE. $true when the rule text declares itself a shipped sample / template (the '# SAMPLE / TEMPLATE' header line). #>
|    param([AllowEmptyString()][AllowNull()][string]$Text)
|    if ([string]::IsNullOrEmpty($Text)) { return $false }
|    [regex]::IsMatch($Text, $script:SIRuleSampleMarkerPattern)
|}
|
|function Get-SIRuleSamplePath {
|    <#
|        The shipped sample a custom rule file was copied from: <rel>.custom.yaml -> asset-profiling-enrichment\<rel>.custom.sample.yaml,
|        for a file in the tree or in the overlay (whose paths are relative to the overlay root, engine first). $null when none.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][string]$Path, [string]$OverlayRoot)
|    $tree = Join-Path $SIRoot 'asset-profiling-enrichment'
|    $full = [System.IO.Path]::GetFullPath($Path)
|    $rel = $null
|    foreach ($base in @($tree, $OverlayRoot)) {
|        if (-not $base) { continue }
|        $b = [System.IO.Path]::GetFullPath($base).TrimEnd('\', '/') + [System.IO.Path]::DirectorySeparatorChar
|        if ($full.StartsWith($b, [StringComparison]::OrdinalIgnoreCase)) { $rel = $full.Substring($b.Length); break }
|    }
|    if (-not $rel -or $rel -notmatch '(?i)\.custom\.yaml$') { return $null }
|    $p = Join-Path $tree ($rel -replace '(?i)\.custom\.yaml$', '.custom.sample.yaml')
|    if (Test-Path -LiteralPath $p) { $p } else { $null }
|}
|
|function Get-SIRuleSampleReason {
|    <#
|        PURE (#908). Why a custom rule text must NOT become a live rule, or $null:
|          * it still carries the sample header ('# SAMPLE / TEMPLATE -- not loaded by the engine ...'), or
|          * it is the shipped sample unchanged (-SampleText; compared with all whitespace removed).
|        The importer refuses such a document and says so; the run only warns (it never drops a rule on suspicion).
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Text, [AllowEmptyString()][AllowNull()][string]$SampleText)
|    if ([string]::IsNullOrWhiteSpace($Text)) { return $null }
|    $squash = { param([string]$s) [regex]::Replace($s.TrimStart([char]0xFEFF), '\s+', '') }
|    if (-not [string]::IsNullOrWhiteSpace($SampleText) -and (& $squash $Text) -ceq (& $squash $SampleText)) {
|        return 'it is the shipped sample (.custom.sample.yaml) copied unchanged -- an example, not your rule. Edit it to describe your own assets (and remove the SAMPLE / TEMPLATE header), then import again'
|    }
|    if (Test-SIRuleSampleMarker -Text $Text) {
|        return "it still starts with the shipped sample's '# SAMPLE / TEMPLATE -- not loaded by the engine' header, so it is the example, not a reviewed rule. Check every detection (example names, subnets and tiers), remove that header line, then import again"
|    }
|    $null
|}
|
|function Invoke-SIRulePlan {
|    <#
|        Rule changes -> per-file diffs, nothing written. A change: @{ action = disable|override|add|edit|remove; id; engine; relDir; text }.
|          disable / override / add -- create the page's custom rule (refused if a custom rule for that id already exists);
|          edit   -- replace the text of a rule the page created;   remove -- take a page-created rule away (it is kept as a backup).
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [string]$OverlayRoot, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Changes)
|    $view = @(Get-SIRuleView -SIRoot $SIRoot -OverlayRoot $OverlayRoot)
|    $kinds = @(Get-SIRuleKinds -SIRoot $SIRoot)
|    $refused = New-Object System.Collections.Generic.List[object]
|    $files = New-Object System.Collections.Generic.List[object]
|    foreach ($c in $Changes) {
|        $id = [string]$c.id; $engine = ([string]$c.engine).ToLowerInvariant(); $action = [string]$c.action
|        $name = "$engine/$id"
|        $row = $view | Where-Object { $_.id -eq $id -and $_.engine -eq $engine } | Select-Object -First 1
|        try {
|            $relDir = if ($row) { $row.relDir } else { [string]$c.relDir }
|            $target = Get-SIRuleTargetPath -SIRoot $SIRoot -OverlayRoot $OverlayRoot -Engine $engine -RelDir $relDir -Id $id
|        } catch { $refused.Add([pscustomobject]@{ name = $name; reason = $_.Exception.Message }); continue }
|        $own = if ($row) { if ($row.overlay) { $row.overlay } elseif ($row.custom) { $row.custom } } else { $null }
|        $old = ''; $new = $null; $path = $target
|        switch ($action) {
|            { $_ -in 'disable', 'override' } {
|                if (-not $row -or -not $row.locked) { $refused.Add([pscustomobject]@{ name = $name; reason = 'no shipped rule with that id' }); continue }
|                if ($own) { $refused.Add([pscustomobject]@{ name = $name; reason = 'this rule already has a custom version -- edit or remove that one' }); continue }
|                $lockedText = [System.IO.File]::ReadAllText((Join-Path $SIRoot $row.locked.path))
|                $new = New-SIRuleText -Kind $action -Id $id -Engine $engine -LockedText $lockedText
|            }
|            'add' {
|                if ($row) { $refused.Add([pscustomobject]@{ name = $name; reason = 'a rule with that id already exists' }); continue }
|                $new = if ($c.text) { [string]$c.text } else { New-SIRuleText -Kind add -Id $id -Engine $engine }
|            }
|            'edit' {
|                if (-not $own -or -not $own.pageCreated) { $refused.Add([pscustomobject]@{ name = $name; reason = 'only a rule this page created can be edited here -- edit a hand-written rule in its file' }); continue }
|                $path = if ($own.path -like 'overlay:*') { Join-Path $OverlayRoot $own.path.Substring(8) } else { Join-Path $SIRoot $own.path }
|                $old = [System.IO.File]::ReadAllText($path); $new = [string]$c.text
|                if (-not $new.TrimStart([char]0xFEFF).StartsWith($script:SIRuleMarker)) { $new = $script:SIRuleMarker + "`r`n" + $new }
|            }
|            'remove' {
|                if (-not $own -or -not $own.pageCreated) { $refused.Add([pscustomobject]@{ name = $name; reason = 'only a rule this page created can be removed here' }); continue }
|                $path = if ($own.path -like 'overlay:*') { Join-Path $OverlayRoot $own.path.Substring(8) } else { Join-Path $SIRoot $own.path }
|                $old = [System.IO.File]::ReadAllText($path); $new = ''
|            }
|            default { $refused.Add([pscustomobject]@{ name = $name; reason = "unknown action '$action'" }); continue }
|        }
|        if ($action -ne 'remove') {
|            $why = @(Test-SIRuleText -Text $new -Id $id -Kinds $kinds)
|            if ($why.Count) { $refused.Add([pscustomobject]@{ name = $name; reason = ($why -join '; ') }); continue }
|        }
|        $label = if ($OverlayRoot -and $path.StartsWith($OverlayRoot, [StringComparison]::OrdinalIgnoreCase)) { 'overlay:' + $path.Substring($OverlayRoot.Length).TrimStart('\', '/').Replace('/', '\') } else { $path.Substring($SIRoot.Length).TrimStart('\', '/').Replace('/', '\') }
|        $files.Add([pscustomobject]@{ key = $name; action = $action; path = $label; exists = (Test-Path -LiteralPath $path); hash = (Get-SIFileHash -Path $path)
|            diff = (Get-SITextDiff -Old $old -New $new -Label $label); FullPath = $path; NewText = $new })
|    }
|    [pscustomobject]@{ files = $files.ToArray(); refused = $refused.ToArray() }
|}
|
|function Invoke-SIRuleWrite {
|    <# Re-plans on the server; writes each rule only when its hash is the reviewed one; a removal keeps the file as a backup. Logged. #>
|    param([Parameter(Mandatory)][string]$SIRoot, [string]$OverlayRoot, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Changes,
|          [Parameter(Mandatory)][hashtable]$Hashes, [string]$User = ('{0}\{1}' -f $env:USERDOMAIN, $env:USERNAME))
|    $plan = Invoke-SIRulePlan -SIRoot $SIRoot -OverlayRoot $OverlayRoot -Changes $Changes
|    if (@($plan.refused).Count) { return [pscustomobject]@{ written = @(); refused = $plan.refused; error = 'some changes were refused -- nothing was written' } }
|    foreach ($f in $plan.files) {
|        if (-not $Hashes.ContainsKey($f.key) -or [string]$Hashes[$f.key] -ne $f.hash) { return [pscustomobject]@{ written = @(); refused = @(); error = ('{0} changed since it was reviewed -- review again' -f $f.path) } }
|    }
|    $logDir = Join-Path $SIRoot 'logs'
|    if (-not (Test-Path -LiteralPath $logDir)) { New-Item -ItemType Directory -Path $logDir -Force | Out-Null }
|    $log = Join-Path $logDir 'settings-changes.log'
|    $written = New-Object System.Collections.Generic.List[object]
|    foreach ($f in $plan.files) {
|        $backup = $null
|        if ($f.action -eq 'remove') {
|            if ((Get-SIFileHash -Path $f.FullPath) -ne $f.hash) { throw ('{0} changed since it was reviewed' -f $f.path) }
|            $backup = '{0}.removed.{1}.bak' -f $f.FullPath, (Get-Date).ToString('yyyyMMdd-HHmmss')
|            [System.IO.File]::Move($f.FullPath, $backup)
|        } else {
|            $dir = Split-Path -Parent $f.FullPath
|            if (-not (Test-Path -LiteralPath $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null }
|            $w = Write-SISettingsFile -Path $f.FullPath -Text $f.NewText -ExpectedHash $f.hash -Bom $false
|            $backup = $w.Backup
|        }
|        $line = [ordered]@{ time = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ'); user = $User; file = $f.path; setting = $f.key; action = $f.action }
|        [System.IO.File]::AppendAllText($log, (($line | ConvertTo-Json -Compress) + "`r`n"), (New-Object System.Text.UTF8Encoding($false)))
|        $written.Add([pscustomobject]@{ key = $f.key; path = $f.path; backup = $backup })
|    }
|    [pscustomobject]@{ written = $written.ToArray(); refused = @(); error = $null }
|}
|
|function Invoke-SIRuleOverlayPlan {
|    <#
|        Setting up the rules folder outside the code tree: every in-tree *.custom.yaml moves there (same relative path),
|        and SI_EnrichmentDataRoot is set in the solution's custom file. Returns the moves and the config diff.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][string]$Target)
|    if (-not [System.IO.Path]::IsPathRooted($Target)) { throw 'the rules folder must be a full path' }
|    $full = [System.IO.Path]::GetFullPath($Target)
|    if ($full.StartsWith([System.IO.Path]::GetFullPath($SIRoot), [StringComparison]::OrdinalIgnoreCase)) { throw 'the rules folder must be outside the SecurityInsight folder -- an update replaces that folder' }
|    $tree = Join-Path $SIRoot 'asset-profiling-enrichment'
|    $moves = foreach ($f in @(Get-ChildItem -LiteralPath $tree -Recurse -File -Filter '*.custom.yaml' -ErrorAction SilentlyContinue)) {
|        $rel = $f.FullName.Substring($tree.Length).TrimStart('\', '/').Replace('/', '\')
|        [pscustomobject]@{ from = 'asset-profiling-enrichment\' + $rel; to = $rel; FromFull = $f.FullName; ToFull = (Join-Path $full $rel)
|            exists = (Test-Path -LiteralPath (Join-Path $full $rel)); hash = (Get-SIFileHash -Path $f.FullName) }
|    }
|    $cfg = Join-Path $SIRoot 'config\SecurityInsight.custom.ps1'
|    $r = Read-SISettingsText -Path $cfg
|    $ed = Edit-SIPs1Settings -Text $r.Text -Changes @(@{ Name = 'SI_EnrichmentDataRoot'; Action = 'Set'; Value = $full })
|    [pscustomobject]@{ target = $full; moves = @($moves); conflicts = @($moves | Where-Object exists | ForEach-Object to)
|        configDiff = (Get-SITextDiff -Old $r.Text -New $ed.Text -Label 'config\SecurityInsight.custom.ps1'); configHash = (Get-SIFileHash -Path $cfg); refused = $ed.Refused
|        ConfigText = $ed.Text; ConfigBom = $r.Bom; ConfigPath = $cfg }
|}
|
|function Invoke-SIRuleOverlayWrite {
|    <# Copies each rule, checks the copy is byte-identical, then keeps the in-tree original as <file>.moved.<time>.bak (out of the loader's reach) and sets SI_EnrichmentDataRoot. #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][string]$Target, [Parameter(Mandatory)][string]$ConfigHash, [string]$User = ('{0}\{1}' -f $env:USERDOMAIN, $env:USERNAME))
|    $p = Invoke-SIRuleOverlayPlan -SIRoot $SIRoot -Target $Target
|    if (@($p.refused).Count) { return [pscustomobject]@{ moved = @(); error = ('SI_EnrichmentDataRoot is set by code in the config file -- set it there: {0}' -f $p.refused[0].Reason) } }
|    if (@($p.conflicts).Count) { return [pscustomobject]@{ moved = @(); error = ('the rules folder already has: {0}' -f (@($p.conflicts) -join ', ')) } }
|    if ($p.configHash -ne $ConfigHash) { return [pscustomobject]@{ moved = @(); error = 'config\SecurityInsight.custom.ps1 changed since it was reviewed -- review again' } }
|    $stamp = (Get-Date).ToString('yyyyMMdd-HHmmss')
|    $moved = New-Object System.Collections.Generic.List[object]
|    foreach ($m in $p.moves) {
|        $dir = Split-Path -Parent $m.ToFull
|        if (-not (Test-Path -LiteralPath $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null }
|        [System.IO.File]::Copy($m.FromFull, $m.ToFull, $false)
|        if ((Get-SIFileHash -Path $m.ToFull) -ne $m.hash) { throw ('the copy of {0} is not identical -- stopped; nothing else was moved' -f $m.from) }
|        [System.IO.File]::Move($m.FromFull, ('{0}.moved.{1}.bak' -f $m.FromFull, $stamp))
|        $moved.Add([pscustomobject]@{ from = $m.from; to = $m.to })
|    }
|    if (-not (Test-Path -LiteralPath $p.target)) { New-Item -ItemType Directory -Path $p.target -Force | Out-Null }
|    $w = Write-SISettingsFile -Path $p.ConfigPath -Text $p.ConfigText -ExpectedHash $p.configHash -Bom $p.ConfigBom
|    $log = Join-Path (Join-Path $SIRoot 'logs') 'settings-changes.log'
|    if (-not (Test-Path -LiteralPath (Split-Path -Parent $log))) { New-Item -ItemType Directory -Path (Split-Path -Parent $log) -Force | Out-Null }
|    $line = [ordered]@{ time = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ'); user = $User; file = 'config\SecurityInsight.custom.ps1'; setting = 'SI_EnrichmentDataRoot'; action = 'Set'; new = $p.target; movedRules = $moved.Count }
|    [System.IO.File]::AppendAllText($log, (($line | ConvertTo-Json -Compress) + "`r`n"), (New-Object System.Text.UTF8Encoding($false)))
|    [pscustomobject]@{ moved = $moved.ToArray(); target = $p.target; configBackup = $w.Backup; error = $null }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-Yaml.ps1'] = @{ Sha256 = 'd131c52595f32fd6ff7e92ddbe17fa933d17c825acd5e2236fd18a1284993b04'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight's own YAML reader -- replaces the powershell-yaml module.
|
|    WHY. SecurityInsight v3 carries no PowerShell module dependencies. About 1,100 shipped YAML files
|    (tier rules, the Risk Analysis report catalogue, asset tagging, operator decisions) were read
|    with powershell-yaml's ConvertFrom-Yaml. This file reads them with plain PowerShell instead.
|
|    WHAT IT READS -- exactly the YAML subset the shipped files use (measured over every shipped
|    *.yaml, see docs/DESIGN.md "YAML reader"):
|      - block mappings and block sequences, including a sequence written at the same indentation as
|        its parent key, and "- key: value" maps inside a sequence
|      - flow sequences on one line:  [a, 'b c', 3]   (a trailing comma is allowed)
|      - plain scalars, also over several lines (folded with spaces, as YAML does)
|      - 'single-quoted' ('' escapes a quote) and "double-quoted" (backslash escapes) on one line
|      - literal and folded block scalars:  |  |-  >  >-   (KQL with | # : // inside is plain text)
|      - full-line and trailing comments, CRLF or LF line ends, a UTF-8 BOM, one leading ---
|    Anything else -- anchors, aliases, tags, flow mappings, multi-line quoted strings, |+ / >+,
|    explicit indentation indicators, more than one document, tab indentation, quoted keys,
|    duplicate keys -- is REFUSED with "<file>:<line>: <reason>". A rule file must never load as
|    something different from what its author wrote.
|
|    WHAT IT RETURNS -- the same shapes and types as powershell-yaml 0.4.12, so callers do not change:
|      mapping  -> [hashtable] (case-insensitive), or [ordered] with -Ordered
|      sequence -> [System.Collections.Generic.List[object]]
|      plain    -> [bool] / [int] / [long] / [BigInteger] / [decimal] / [double] / $null / [string],
|                  decided by the same .NET TryParse calls in the same order
|      quoted / block scalars -> [string]
|      an empty or comment-only text -> nothing ($null)
|    tests/pester/SIv3-SIYaml.Tests.ps1 proves this deep-equal against powershell-yaml on every
|    shipped file whenever that module is present.
|
|    PERFORMANCE. One function, one pass over the lines, explicit stacks instead of recursion, and
|    the number test only for plain values whose first character could start a number, a boolean or
|    a null. Measured against powershell-yaml in docs/TESTS.md.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope.
|# NO script-scope variables either: callers dot-source this file from inside functions as well as
|# at file level, and a $script: value set in one place is not the one read in the other.
|
|function ConvertTo-SIYamlPlainValue {
|    <# The plain-scalar typing rule of powershell-yaml 0.4.12, call for call. #>
|    param([string]$Value)
|    $inv = [System.Globalization.CultureInfo]::InvariantCulture
|    $b = $false
|    if ([bool]::TryParse($Value, [ref]$b)) { return $b }
|    $bi = [System.Numerics.BigInteger]::Zero
|    if ([System.Numerics.BigInteger]::TryParse($Value, ([System.Globalization.NumberStyles]::Float -bor [System.Globalization.NumberStyles]::Integer), $inv, [ref]$bi)) {
|        $x = $bi -as [int];  if ($null -ne $x) { return $x }
|        $x = $bi -as [long]; if ($null -ne $x) { return $x }
|        return $bi
|    }
|    $d = [decimal]0
|    if ([decimal]::TryParse($Value, [System.Globalization.NumberStyles]::Float, $inv, [ref]$d)) { return $d }
|    $db = [double]0
|    if ([double]::TryParse($Value, [System.Globalization.NumberStyles]::Float, $inv, [ref]$db)) { return $db }
|    if ($Value -in '', '~', 'null', 'Null', 'NULL') { return $null }
|    return $Value
|}
|
|function ConvertFrom-SIYamlJsonValue {
|    <#
|        One value of a JSON document, in powershell-yaml's shapes. JSON is valid YAML, and SecurityInsight Pro
|        materialises its catalogues as JSON in *.yaml files. JSON strings are double-quoted YAML scalars, so they
|        stay strings; numbers / true / false / null are plain scalars, so they get the same typing as plain YAML.
|    #>
|    param($Value, [bool]$Ordered)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [string] -or $Value -is [bool]) { return $Value }
|    if ($Value -is [datetime]) { return $Value.ToString('o', [System.Globalization.CultureInfo]::InvariantCulture) }   # only a pwsh without -DateKind
|    if ($Value -is [System.Management.Automation.PSCustomObject]) {
|        $cmp = [System.StringComparer]::CurrentCultureIgnoreCase
|        $h = if ($Ordered) { [System.Collections.Specialized.OrderedDictionary]::new($cmp) } else { [hashtable]::new($cmp) }
|        foreach ($p in $Value.PSObject.Properties) { $h[$p.Name] = ConvertFrom-SIYamlJsonValue -Value $p.Value -Ordered $Ordered }
|        return $h
|    }
|    if ($Value -is [System.Collections.IEnumerable]) {
|        $l = [System.Collections.Generic.List[object]]::new()
|        foreach ($x in $Value) { $l.Add((ConvertFrom-SIYamlJsonValue -Value $x -Ordered $Ordered)) }
|        return , $l
|    }
|    return (ConvertTo-SIYamlPlainValue -Value ([System.Convert]::ToString($Value, [System.Globalization.CultureInfo]::InvariantCulture)))
|}
|
|function ConvertFrom-SIYamlDoubleQuoted {
|    <# Body of a one-line "double-quoted" scalar (without the quotes) -> string. #>
|    param([string]$Body, [string]$Where)
|    if ($Body.IndexOf([char]'\') -lt 0) { return $Body }
|    $sb = [System.Text.StringBuilder]::new()
|    $k = 0
|    while ($k -lt $Body.Length) {
|        $c = $Body[$k]
|        if ($c -ne [char]'\') { [void]$sb.Append($c); $k++; continue }
|        if ($k + 1 -ge $Body.Length) { throw ('{0}: a double-quoted string ends in a lone backslash' -f $Where) }
|        $e = $Body[$k + 1]; $k += 2
|        switch -CaseSensitive ([string]$e) {
|            '0'  { [void]$sb.Append([char]0) }
|            'a'  { [void]$sb.Append([char]7) }
|            'b'  { [void]$sb.Append([char]8) }
|            't'  { [void]$sb.Append([char]9) }
|            "`t" { [void]$sb.Append([char]9) }
|            'n'  { [void]$sb.Append([char]10) }
|            'v'  { [void]$sb.Append([char]11) }
|            'f'  { [void]$sb.Append([char]12) }
|            'r'  { [void]$sb.Append([char]13) }
|            'e'  { [void]$sb.Append([char]27) }
|            ' '  { [void]$sb.Append(' ') }
|            '"'  { [void]$sb.Append('"') }
|            '/'  { [void]$sb.Append('/') }
|            '\'  { [void]$sb.Append('\') }
|            'N'  { [void]$sb.Append([char]0x85) }
|            '_'  { [void]$sb.Append([char]0xA0) }
|            'L'  { [void]$sb.Append([char]0x2028) }
|            'P'  { [void]$sb.Append([char]0x2029) }
|            { $_ -ceq 'x' -or $_ -ceq 'u' -or $_ -ceq 'U' } {
|                $len = if ($e -ceq 'x') { 2 } elseif ($e -ceq 'u') { 4 } else { 8 }
|                $hex = if ($k + $len -le $Body.Length) { $Body.Substring($k, $len) } else { '' }
|                if ($hex -notmatch '^[0-9A-Fa-f]+$' -or $hex.Length -ne $len) { throw ('{0}: a double-quoted string has a bad \{1} escape' -f $Where, $e) }
|                [void]$sb.Append([char]::ConvertFromUtf32([Convert]::ToInt32($hex, 16)))
|                $k += $len
|            }
|            default { throw ('{0}: a double-quoted string uses the unknown escape \{1}' -f $Where, $e) }
|        }
|    }
|    return $sb.ToString()
|}
|
|function ConvertFrom-SIYaml {
|    <#
|    .SYNOPSIS
|        Read SecurityInsight YAML into hashtables / lists / scalars -- the drop-in for powershell-yaml's
|        ConvertFrom-Yaml, for the YAML subset SecurityInsight's files use.
|    .PARAMETER Yaml
|        The YAML text. Pipeline input is joined with line breaks, as ConvertFrom-Yaml does.
|    .PARAMETER Path
|        Read this file (UTF-8) instead; its path is named in every error.
|    .PARAMETER SourceName
|        The name errors cite for -Yaml text (a file path, usually). Default '<yaml>'.
|    .PARAMETER Ordered
|        Mappings become [ordered] dictionaries (key order kept), as ConvertFrom-Yaml -Ordered.
|    #>
|    [CmdletBinding(DefaultParameterSetName = 'Text')]
|    param(
|        [Parameter(ParameterSetName = 'Text', Position = 0, ValueFromPipeline = $true)]
|        [AllowEmptyString()][AllowNull()]
|        [string]$Yaml,
|        [Parameter(ParameterSetName = 'Path', Mandatory = $true)]
|        [string]$Path,
|        [string]$SourceName,
|        [switch]$Ordered
|    )
|    begin { $text = $null }
|    process {
|        # Pipeline pieces are joined with line breaks, as ConvertFrom-Yaml does.
|        if ($null -ne $Yaml) { if ($null -eq $text) { $text = $Yaml + "`n" } else { $text = $text + $Yaml + "`n" } }
|    }
|    end {
|        if ($Path) {
|            $text = [System.IO.File]::ReadAllText($Path)
|            if ([string]::IsNullOrEmpty($SourceName)) { $SourceName = $Path }
|        } elseif ($null -eq $text) { return }
|        if ([string]::IsNullOrEmpty($SourceName)) { $SourceName = '<yaml>' }
|        $result = ConvertFrom-SIYamlText -Text $text -Source $SourceName -Ordered:$Ordered
|        if ($result -is [System.Collections.Generic.List[object]]) { return , $result }
|        return $result
|    }
|}
|
|function ConvertFrom-SIYamlText {
|    <#
|        The parser. One pass over the lines, explicit stacks instead of recursion. Internal: call
|        ConvertFrom-SIYaml. Written for speed on PowerShell 5.1: no function calls on the common
|        paths, ordinal string searches (the culture-aware overloads cost ~10x), characters and
|        comparers held in locals.
|    #>
|    param([string]$Text, [string]$Source, [switch]$Ordered)
|
|    if ($Text.Length -gt 0 -and $Text[0] -eq [char]0xFEFF) { $Text = $Text.Substring(1) }
|    # A JSON document (SecurityInsight Pro writes its materialised catalogues as JSON, which is YAML).
|    $first = $Text.TrimStart()
|    if ($first.Length -gt 0 -and ($first[0] -eq [char]'{' -or $first[0] -eq [char]'[')) {
|        $cj = Get-Command -Name ConvertFrom-Json
|        $ja = @{ InputObject = $Text; ErrorAction = 'Stop' }
|        if ($cj.Parameters.ContainsKey('DateKind')) { $ja['DateKind'] = 'String' }
|        if ($cj.Parameters.ContainsKey('Depth')) { $ja['Depth'] = 1024 }
|        if ($cj.Parameters.ContainsKey('NoEnumerate')) { $ja['NoEnumerate'] = $true }   # a one-item top-level array stays an array
|        try { $doc = ConvertFrom-Json @ja }
|        catch { throw ('{0}:1: the document starts with "{1}" but is not valid JSON (YAML flow style is only read as JSON): {2}' -f $Source, $first[0], $_.Exception.Message) }
|        $r = ConvertFrom-SIYamlJsonValue -Value $doc -Ordered ([bool]$Ordered)
|        if ($r -is [System.Collections.Generic.List[object]]) { return , $r }
|        return $r
|    }
|    $lines = $Text.Replace("`r`n", "`n").Split([char]"`n")
|    $n = $lines.Length
|    $useOrdered = [bool]$Ordered
|    # First characters a plain value needs to become anything but a string: digits, sign, dot (numbers),
|    # t/f (true/false), n/N (null, NaN), i/I (Infinity), ~ (null).
|    $typedFirst = '0123456789+-.tTfFnNiI~'
|    $inv = [System.Globalization.CultureInfo]::InvariantCulture
|    $ORD = [System.StringComparison]::Ordinal
|    # The comparer PowerShell gives @{} and [ordered]@{} -- so these are the same dictionaries.
|    $cmp = [System.StringComparer]::CurrentCultureIgnoreCase
|    $SP = [char]' '; $TAB = [char]"`t"; $HASH = [char]'#'; $DASH = [char]'-'; $COLON = [char]':'
|    $SQ = [char]"'"; $DQ = [char]'"'; $LB = [char]'['; $RB = [char]']'; $LC = [char]'{'
|    $PIPE = [char]'|'; $GT = [char]'>'; $BS = [char]'\'; $COMMA = [char]','; $CR = [char]"`r"
|    $SPTAB = [char[]]@(' ', "`t")
|    $keyBad   = '[{&*!|>@`?:,]}'
|    $plainBad = '{]},&*!%@`'
|    $flowBad  = '#&*!|>%@`'
|    # Only these plain values can come out as anything but a string (bool / number / null), so only
|    # these go through the full replica of powershell-yaml's typing; the rest stay strings untouched.
|    # .NET's number parsing (Float | Integer, invariant) accepts nothing outside [0-9.eE+-] apart from
|    # the NaN / Infinity words; bool.TryParse accepts true/false in any case; null is ~ / null.
|    $numLike  = '^[0-9.eE+\-]+$'
|    $wordLike = '^[+-]?(true|false|null|nan|infinity|~)$'
|
|    # Frame stacks: indentation, kind (1 = mapping, 2 = sequence), container.
|    $fInd  = [System.Collections.Generic.List[int]]::new()
|    $fKind = [System.Collections.Generic.List[int]]::new()
|    $fObj  = [System.Collections.Generic.List[object]]::new()
|
|    $root = $null; $rootSet = $false; $sawDocStart = $false
|    # A slot waiting for its value from the following lines: 1 = mapping key, 2 = sequence item.
|    $pend = 0; $pObj = $null; $pKey = $null; $pInd = -1
|
|    $i = 0
|    while ($i -lt $n) {
|        $line = $lines[$i]
|        $t = $line.TrimStart($SP)
|        $tl = $t.Length
|        if ($tl -eq 0) { $i++; continue }
|        $c0 = $t[0]
|        if ($c0 -eq $HASH) { $i++; continue }
|        if ($c0 -eq $TAB -or $c0 -eq $CR) {
|            if ($t.Trim().Length -eq 0) { $i++; continue }
|            throw ('{0}:{1}: a tab is used for indentation (YAML allows spaces only)' -f $Source, ($i + 1))
|        }
|        $ind = $line.Length - $tl
|        $ln = $i + 1
|        $last = $t[$tl - 1]
|        if ($last -eq $SP -or $last -eq $TAB -or $last -eq $CR) { $t = $t.TrimEnd(); $tl = $t.Length }
|
|        $isSeq = $false
|        if ($c0 -eq $DASH) {
|            if ($tl -eq 1 -or $t[1] -eq $SP) { $isSeq = $true }
|            elseif ($ind -eq 0 -and $t.StartsWith('---', $ORD) -and ($tl -eq 3 -or $t[3] -eq $SP)) {
|                if ($rootSet -or $sawDocStart) { throw ('{0}:{1}: more than one YAML document in one file is not supported' -f $Source, $ln) }
|                if ($tl -gt 3 -and $t.Substring(3).TrimStart()[0] -ne $HASH) { throw ('{0}:{1}: content on the --- line is not supported' -f $Source, $ln) }
|                $sawDocStart = $true; $i++; continue
|            }
|        } elseif ($c0 -eq [char]'.' -and $ind -eq 0 -and $t.StartsWith('...', $ORD)) {
|            throw ('{0}:{1}: a YAML document end marker (...) is not supported' -f $Source, $ln)
|        } elseif ($c0 -eq [char]'%') {
|            throw ('{0}:{1}: YAML directives (%) are not supported' -f $Source, $ln)
|        }
|
|        # ---- where does this line's value go? -------------------------------------------------
|        $slot = 0; $sObj = $null; $sKey = $null; $vt = $null; $vp = 0
|
|        if ($pend -ne 0) {
|            $newObj = $null; $newKind = 0
|            if ($isSeq -and ($ind -gt $pInd -or ($ind -eq $pInd -and $pend -eq 1))) {
|                $newObj = [System.Collections.Generic.List[object]]::new(); $newKind = 2
|            } elseif ($ind -gt $pInd) {
|                # A mapping key on this line, or a scalar value written on its own line?
|                $isKey = $false
|                if ($c0 -ne $SQ -and $c0 -ne $DQ -and $c0 -ne $LB -and $c0 -ne $LC -and $c0 -ne $PIPE -and $c0 -ne $GT) {
|                    $ci = $t.IndexOf(': ', $ORD)
|                    if ($ci -lt 0 -and $t[$tl - 1] -eq $COLON) { $ci = $tl - 1 }
|                    if ($ci -gt 0) { $hi = $t.IndexOf(' #', $ORD); if ($hi -lt 0 -or $hi -gt $ci) { $isKey = $true } }
|                }
|                if ($isKey) {
|                    if ($useOrdered) { $newObj = [System.Collections.Specialized.OrderedDictionary]::new($cmp) } else { $newObj = [hashtable]::new($cmp) }
|                    $newKind = 1
|                } else {
|                    $slot = $pend; $sObj = $pObj; $sKey = $pKey; $vt = $t; $vp = $pInd
|                }
|            }
|            if ($slot -eq 0) {
|                if ($pend -eq 1) { $pObj[$pKey] = $newObj } else { $pObj.Add($newObj) }
|                if ($newKind -ne 0) { $fInd.Add($ind); $fKind.Add($newKind); $fObj.Add($newObj) }
|            }
|            $pend = 0
|        }
|
|        if ($slot -eq 0) {
|            if ($fInd.Count -eq 0) {
|                if ($rootSet) { throw ('{0}:{1}: this line is outside the document (indented less than its first line)' -f $Source, $ln) }
|                $rootSet = $true
|                if ($isSeq) { $root = [System.Collections.Generic.List[object]]::new(); $rk = 2 }
|                else {
|                    if ($useOrdered) { $root = [System.Collections.Specialized.OrderedDictionary]::new($cmp) } else { $root = [hashtable]::new($cmp) }
|                    $rk = 1
|                }
|                $fInd.Add($ind); $fKind.Add($rk); $fObj.Add($root)
|            }
|            $top = $fInd.Count - 1
|            while ($top -ge 0 -and $fInd[$top] -gt $ind) { $fInd.RemoveAt($top); $fKind.RemoveAt($top); $fObj.RemoveAt($top); $top-- }
|            if ($top -ge 0 -and -not $isSeq -and $fInd[$top] -eq $ind -and $fKind[$top] -eq 2) {
|                # the end of a sequence written at the same indentation as its parent key
|                $fInd.RemoveAt($top); $fKind.RemoveAt($top); $fObj.RemoveAt($top); $top--
|            }
|            if ($top -lt 0 -or $fInd[$top] -ne $ind) { throw ('{0}:{1}: the indentation of this line does not match any open mapping or sequence' -f $Source, $ln) }
|
|            $mapText = $null
|            if ($fKind[$top] -eq 2) {
|                if (-not $isSeq) { throw ('{0}:{1}: expected a "- item" line in this sequence' -f $Source, $ln) }
|                $seqObj = $fObj[$top]
|                $rest = if ($tl -gt 2) { $t.Substring(2).TrimStart($SP) } else { '' }
|                $rl = $rest.Length
|                if ($rl -eq 0 -or $rest[0] -eq $HASH) {
|                    $pend = 2; $pObj = $seqObj; $pKey = $null; $pInd = $ind
|                    $i++; continue
|                }
|                $r0 = $rest[0]
|                if ($r0 -eq $DASH -and ($rl -eq 1 -or $rest[1] -eq $SP)) { throw ('{0}:{1}: a sequence written directly inside a sequence item ("- - x") is not supported' -f $Source, $ln) }
|                $isKey = $false
|                if ($r0 -ne $SQ -and $r0 -ne $DQ -and $r0 -ne $LB -and $r0 -ne $LC -and $r0 -ne $PIPE -and $r0 -ne $GT) {
|                    $ci = $rest.IndexOf(': ', $ORD)
|                    if ($ci -lt 0 -and $rest[$rl - 1] -eq $COLON) { $ci = $rl - 1 }
|                    if ($ci -gt 0) { $hi = $rest.IndexOf(' #', $ORD); if ($hi -lt 0 -or $hi -gt $ci) { $isKey = $true } }
|                } elseif ($r0 -eq $SQ -or $r0 -eq $DQ) {
|                    $q = $rest.IndexOf($r0, 1)
|                    if ($q -gt 0 -and $rl -gt $q + 1 -and $rest[$q + 1] -eq $COLON) { throw ('{0}:{1}: quoted mapping keys are not supported' -f $Source, $ln) }
|                }
|                if ($isKey) {
|                    if ($useOrdered) { $mapObj = [System.Collections.Specialized.OrderedDictionary]::new($cmp) } else { $mapObj = [hashtable]::new($cmp) }
|                    $seqObj.Add($mapObj)
|                    $mapInd = $ind + ($tl - $rl)
|                    $fInd.Add($mapInd); $fKind.Add(1); $fObj.Add($mapObj)
|                    $mapText = $rest
|                } else {
|                    $slot = 2; $sObj = $seqObj; $vt = $rest; $vp = $ind
|                }
|            } else {
|                if ($isSeq) { throw ('{0}:{1}: a "- item" line where a "key: value" line was expected' -f $Source, $ln) }
|                $mapObj = $fObj[$top]; $mapInd = $ind; $mapText = $t
|            }
|
|            if ($null -ne $mapText) {
|                # ---- key: value ----
|                $m0 = $mapText[0]
|                $ml = $mapText.Length
|                if ($m0 -eq $SQ -or $m0 -eq $DQ) { throw ('{0}:{1}: quoted mapping keys are not supported' -f $Source, $ln) }
|                if ($keyBad.IndexOf($m0) -ge 0) { throw ('{0}:{1}: this line is not a "key: value" line (it starts with "{2}")' -f $Source, $ln, $m0) }
|                $ci = $mapText.IndexOf(': ', $ORD)
|                if ($ci -lt 0 -and $mapText[$ml - 1] -eq $COLON) { $ci = $ml - 1 }
|                if ($ci -le 0) { throw ('{0}:{1}: expected "key: value" (a colon followed by a space)' -f $Source, $ln) }
|                $hi = $mapText.IndexOf(' #', 0, $ci, $ORD)
|                if ($hi -ge 0) { throw ('{0}:{1}: expected "key: value" (a colon followed by a space)' -f $Source, $ln) }
|                $key = $mapText.Substring(0, $ci)
|                if ($key[$ci - 1] -eq $SP -or $key[$ci - 1] -eq $TAB) { $key = $key.TrimEnd() }
|                if ($mapObj.Contains($key)) {
|                    foreach ($ek in @($mapObj.Keys)) {
|                        if ([string]::Equals([string]$ek, $key, $ORD)) { throw ('{0}:{1}: duplicate key "{2}"' -f $Source, $ln, $key) }
|                    }
|                }
|                $after = if ($ci + 2 -lt $ml) { $mapText.Substring($ci + 2).TrimStart($SP) } else { '' }
|                if ($after.Length -eq 0 -or $after[0] -eq $HASH) {
|                    $mapObj[$key] = $null
|                    $pend = 1; $pObj = $mapObj; $pKey = $key; $pInd = $mapInd
|                    $i++; continue
|                }
|                $slot = 1; $sObj = $mapObj; $sKey = $key; $vt = $after; $vp = $mapInd
|            }
|        }
|
|        # ---- the value text $vt (first line), its parent indentation $vp ----------------------------
|        $v0 = $vt[0]
|        $vl = $vt.Length
|        $val = $null
|        if ($v0 -eq $SQ) {
|            $k = 1; $closed = -1
|            while ($k -lt $vl) {
|                $q = $vt.IndexOf($SQ, $k)
|                if ($q -lt 0) { break }
|                if ($q + 1 -lt $vl -and $vt[$q + 1] -eq $SQ) { $k = $q + 2; continue }
|                $closed = $q; break
|            }
|            if ($closed -lt 0) { throw ('{0}:{1}: a single-quoted string must end on the same line' -f $Source, $ln) }
|            $val = $vt.Substring(1, $closed - 1)
|            if ($val.IndexOf($SQ) -ge 0) { $val = $val.Replace("''", "'") }
|            if ($closed + 1 -lt $vl) {
|                $tail = $vt.Substring($closed + 1); $tt = $tail.TrimStart($SPTAB)
|                if ($tt.Length -gt 0 -and ($tt[0] -ne $HASH -or $tt.Length -eq $tail.Length)) { throw ('{0}:{1}: unexpected text after a quoted string' -f $Source, $ln) }
|            }
|        } elseif ($v0 -eq $DQ) {
|            $k = 1; $closed = -1
|            while ($k -lt $vl) {
|                $ch = $vt[$k]
|                if ($ch -eq $BS) { $k += 2; continue }
|                if ($ch -eq $DQ) { $closed = $k; break }
|                $k++
|            }
|            if ($closed -lt 0) { throw ('{0}:{1}: a double-quoted string must end on the same line' -f $Source, $ln) }
|            $val = $vt.Substring(1, $closed - 1)
|            if ($val.IndexOf($BS) -ge 0) { $val = ConvertFrom-SIYamlDoubleQuoted -Body $val -Where ('{0}:{1}' -f $Source, $ln) }
|            if ($closed + 1 -lt $vl) {
|                $tail = $vt.Substring($closed + 1); $tt = $tail.TrimStart($SPTAB)
|                if ($tt.Length -gt 0 -and ($tt[0] -ne $HASH -or $tt.Length -eq $tail.Length)) { throw ('{0}:{1}: unexpected text after a quoted string' -f $Source, $ln) }
|            }
|        } elseif ($v0 -eq $LB) {
|            $val = [System.Collections.Generic.List[object]]::new()
|            $k = 1; $closed = $false; $needItem = $true
|            while ($k -lt $vl) {
|                $ch = $vt[$k]
|                if ($ch -eq $SP -or $ch -eq $TAB) { $k++; continue }
|                if ($ch -eq $RB) { $closed = $true; $k++; break }
|                if ($ch -eq $COMMA) {
|                    if ($needItem) { throw ('{0}:{1}: an empty item in a [ ] list' -f $Source, $ln) }
|                    $needItem = $true; $k++; continue
|                }
|                if (-not $needItem) { throw ('{0}:{1}: a comma is missing between items of a [ ] list' -f $Source, $ln) }
|                if ($ch -eq $LB -or $ch -eq $LC) { throw ('{0}:{1}: nested [ ] / {{ }} inside a [ ] list are not supported' -f $Source, $ln) }
|                if ($ch -eq $SQ) {
|                    $s = $k + 1; $e = -1
|                    while ($s -lt $vl) {
|                        $q = $vt.IndexOf($SQ, $s)
|                        if ($q -lt 0) { break }
|                        if ($q + 1 -lt $vl -and $vt[$q + 1] -eq $SQ) { $s = $q + 2; continue }
|                        $e = $q; break
|                    }
|                    if ($e -lt 0) { throw ('{0}:{1}: a quoted item in a [ ] list is not closed on the same line' -f $Source, $ln) }
|                    $val.Add($vt.Substring($k + 1, $e - $k - 1).Replace("''", "'")); $k = $e + 1
|                } elseif ($ch -eq $DQ) {
|                    $s = $k + 1; $e = -1
|                    while ($s -lt $vl) { $cc = $vt[$s]; if ($cc -eq $BS) { $s += 2; continue }; if ($cc -eq $DQ) { $e = $s; break }; $s++ }
|                    if ($e -lt 0) { throw ('{0}:{1}: a quoted item in a [ ] list is not closed on the same line' -f $Source, $ln) }
|                    $val.Add((ConvertFrom-SIYamlDoubleQuoted -Body $vt.Substring($k + 1, $e - $k - 1) -Where ('{0}:{1}' -f $Source, $ln))); $k = $e + 1
|                } else {
|                    if ($flowBad.IndexOf($ch) -ge 0) { throw ('{0}:{1}: a [ ] list item starts with "{2}", which is not supported' -f $Source, $ln, $ch) }
|                    $s = $k
|                    while ($k -lt $vl -and $vt[$k] -ne $COMMA -and $vt[$k] -ne $RB) { $k++ }
|                    $item = $vt.Substring($s, $k - $s).TrimEnd($SPTAB)
|                    if ($item.IndexOf(': ', $ORD) -ge 0 -or $item[$item.Length - 1] -eq $COLON -or $item.IndexOf(' #', $ORD) -ge 0 -or $item.IndexOf($LB) -ge 0 -or $item.IndexOf($LC) -ge 0) {
|                        throw ('{0}:{1}: a [ ] list item "{2}" is not a plain value' -f $Source, $ln, $item)
|                    }
|                    if ($typedFirst.IndexOf($item[0]) -lt 0) { $val.Add($item) }
|                    elseif ($item.Length -le 9 -and $item -cmatch '^[0-9]+$') { $val.Add([int]::Parse($item, $inv)) }
|                    elseif ($item -cmatch $numLike -or $item -match $wordLike) { $val.Add((ConvertTo-SIYamlPlainValue -Value $item)) }
|                    else { $val.Add($item) }
|                }
|                $needItem = $false
|            }
|            if (-not $closed) { throw ('{0}:{1}: a [ ] list must end on the same line' -f $Source, $ln) }
|            if ($k -lt $vl) {
|                $tail = $vt.Substring($k); $tt = $tail.TrimStart($SPTAB)
|                if ($tt.Length -gt 0 -and ($tt[0] -ne $HASH -or $tt.Length -eq $tail.Length)) { throw ('{0}:{1}: unexpected text after a [ ] list' -f $Source, $ln) }
|            }
|        } elseif ($v0 -eq $PIPE -or $v0 -eq $GT) {
|            # ---- block scalar ----
|            $hdr = $vt
|            $hc = $hdr.IndexOf($HASH)
|            if ($hc -ge 0) {
|                if ($hc -eq 0 -or ($hdr[$hc - 1] -ne $SP -and $hdr[$hc - 1] -ne $TAB)) { throw ('{0}:{1}: unexpected text after a block scalar indicator' -f $Source, $ln) }
|                $hdr = $hdr.Substring(0, $hc).TrimEnd()
|            }
|            $strip = $false
|            if ($hdr.Length -eq 2 -and $hdr[1] -eq $DASH) { $strip = $true }
|            elseif ($hdr.Length -ne 1) { throw ('{0}:{1}: block scalar header "{2}" is not supported (use | |- > >-)' -f $Source, $ln, $hdr) }
|            $folded = ($v0 -eq $GT)
|            # List[object], not List[string]: PowerShell turns $null into '' on the way into a string list,
|            # and $null is how an empty line is told apart from content.
|            $buf = [System.Collections.Generic.List[object]]::new()
|            $mi = -1; $j = $i + 1
|            while ($j -lt $n) {
|                $l = $lines[$j]
|                $lt = $l.TrimStart($SP)
|                if ($lt.Length -eq 0) {
|                    if ($mi -ge 0 -and $l.Length -gt $mi) { $buf.Add($l.Substring($mi)) } else { $buf.Add($null) }
|                    $j++; continue
|                }
|                $li = $l.Length - $lt.Length
|                if ($mi -lt 0) {
|                    if ($li -le $vp) { break }
|                    if ($lt[0] -eq $TAB) { throw ('{0}:{1}: a tab is used for indentation (YAML allows spaces only)' -f $Source, ($j + 1)) }
|                    $mi = $li
|                } elseif ($li -lt $mi) { break }
|                $buf.Add($l.Substring($mi)); $j++
|            }
|            # $null entries are empty lines. Trailing empty lines are dropped (clip / strip).
|            $lastC = $buf.Count - 1
|            while ($lastC -ge 0 -and $null -eq $buf[$lastC]) { $lastC-- }
|            if ($lastC -lt 0) { $val = '' }
|            else {
|                $sb = [System.Text.StringBuilder]::new()
|                if (-not $folded) {
|                    for ($x = 0; $x -le $lastC; $x++) {
|                        if ($x -gt 0) { [void]$sb.Append("`n") }
|                        if ($null -ne $buf[$x]) { [void]$sb.Append($buf[$x]) }
|                    }
|                } else {
|                    # Folding: a line break between two ordinary lines becomes a space; N empty lines
|                    # become N line breaks; around a more-indented line the break is kept.
|                    $x = 0
|                    while ($x -le $lastC -and $null -eq $buf[$x]) { [void]$sb.Append("`n"); $x++ }
|                    $prev = $buf[$x]; [void]$sb.Append($prev); $x++
|                    while ($x -le $lastC) {
|                        $empties = 0
|                        while ($null -eq $buf[$x]) { $empties++; $x++ }
|                        $cur = $buf[$x]
|                        $spaced = ($prev.Length -gt 0 -and ($prev[0] -eq $SP -or $prev[0] -eq $TAB)) -or
|                                  ($cur.Length -gt 0 -and ($cur[0] -eq $SP -or $cur[0] -eq $TAB))
|                        if ($spaced) { [void]$sb.Append("`n"); if ($empties -gt 0) { [void]$sb.Append("`n" * $empties) } }
|                        elseif ($empties -eq 0) { [void]$sb.Append(' ') }
|                        else { [void]$sb.Append("`n" * $empties) }
|                        [void]$sb.Append($cur); $prev = $cur; $x++
|                    }
|                }
|                if (-not $strip) { [void]$sb.Append("`n") }
|                $val = $sb.ToString()
|            }
|            $i = $j - 1
|        } else {
|            # ---- plain scalar ----
|            if ($plainBad.IndexOf($v0) -ge 0) { throw ('{0}:{1}: a value starting with "{2}" is not supported (anchors, aliases, tags and {{ }} maps are not used by SecurityInsight)' -f $Source, $ln, $v0) }
|            if (($v0 -eq $DASH -or $v0 -eq [char]'?' -or $v0 -eq $COLON) -and ($vl -eq 1 -or $vt[1] -eq $SP)) {
|                throw ('{0}:{1}: a value cannot start with "{2} " here' -f $Source, $ln, $v0)
|            }
|            $ended = $false
|            $hi = $vt.IndexOf(' #', $ORD)
|            if ($vt.IndexOf($TAB) -ge 0) { $ti = $vt.IndexOf("`t#", $ORD); if ($ti -ge 0 -and ($hi -lt 0 -or $ti -lt $hi)) { $hi = $ti } }
|            if ($hi -ge 0) { $pv = $vt.Substring(0, $hi).TrimEnd($SPTAB); $ended = $true } else { $pv = $vt }
|            if ($pv.IndexOf($COLON) -ge 0 -and ($pv.IndexOf(': ', $ORD) -ge 0 -or $pv[$pv.Length - 1] -eq $COLON -or $pv.IndexOf(":`t", $ORD) -ge 0)) {
|                throw ('{0}:{1}: a plain value contains ": " -- quote it' -f $Source, $ln)
|            }
|            if (-not $ended) {
|                # continuation lines: more indented than the parent, until a comment or a less-indented line
|                $j = $i + 1; $empt = 0; $sb = $null; $lastJ = $i
|                while ($j -lt $n) {
|                    $l = $lines[$j]
|                    $lt = $l.TrimStart($SP)
|                    if ($lt.Length -eq 0) { $empt++; $j++; continue }
|                    $li = $l.Length - $lt.Length
|                    if ($li -le $vp) { break }
|                    $ct = $lt.Trim()
|                    if ($ct.Length -eq 0) { $empt++; $j++; continue }
|                    if ($ct[0] -eq $HASH) { break }
|                    $hi = $ct.IndexOf(' #', $ORD); $ti = $ct.IndexOf("`t#", $ORD)
|                    if ($ti -ge 0 -and ($hi -lt 0 -or $ti -lt $hi)) { $hi = $ti }
|                    $stop = $false
|                    if ($hi -ge 0) { $ct = $ct.Substring(0, $hi).TrimEnd($SPTAB); $stop = $true }
|                    if ($ct.IndexOf(': ', $ORD) -ge 0 -or $ct[$ct.Length - 1] -eq $COLON -or $ct.IndexOf(":`t", $ORD) -ge 0) {
|                        throw ('{0}:{1}: this line continues a plain value but contains ": " (a key indented too far, or a value that needs quotes)' -f $Source, ($j + 1))
|                    }
|                    if ($null -eq $sb) { $sb = [System.Text.StringBuilder]::new(); [void]$sb.Append($pv) }
|                    if ($empt -eq 0) { [void]$sb.Append(' ') } else { [void]$sb.Append("`n" * $empt) }
|                    [void]$sb.Append($ct)
|                    $empt = 0; $lastJ = $j; $j++
|                    if ($stop) { break }
|                }
|                if ($null -ne $sb) { $pv = $sb.ToString() }
|                $i = $lastJ
|            }
|            # Typing, as powershell-yaml does it. Common cases inline (a function call costs more than
|            # the rest of the line); everything else through the call-for-call replica.
|            if ($typedFirst.IndexOf($pv[0]) -lt 0) { $val = $pv }
|            elseif ($pv.Length -le 9 -and $pv -cmatch '^[0-9]+$') { $val = [int]::Parse($pv, $inv) }
|            elseif ($pv -cmatch $numLike -or $pv -match $wordLike) { $val = ConvertTo-SIYamlPlainValue -Value $pv }
|            else { $val = $pv }
|        }
|
|        if ($slot -eq 1) { $sObj[$sKey] = $val } else { $sObj.Add($val) }
|        $i++
|    }
|
|    # A "- " item with nothing after it at the end of the text is a null item (a "key:" was set to null already).
|    if ($pend -eq 2) { $pObj.Add($null) }
|    if (-not $rootSet) { return $null }
|    if ($root -is [System.Collections.Generic.List[object]]) { return , $root }
|    return $root
|}
'@ }
$__siSupportFiles['config/settings.catalog.locked.json'] = @{ Sha256 = '3166a42e9997e865fd52e444bdd18b7e9c435b77d12c044576fa8c95b47a692a'; Text = @'
|{
|  "_purpose": "The settings SecurityInsight Pro manages (its web app validates by them). GENERATED by engine\\pro-settings\\Build-SISettingsCatalog.ps1 from the shipped configuration files -- do not edit by hand; re-run the tool.",
|  "sources": [
|    "config\\SecurityInsight.custom.reference.ps1",
|    "launcher\\_lib\\SecurityInsight.shared-defaults.ps1",
|    "launcher\\<engine>\\LauncherConfig.defaults.ps1",
|    "config\\*.sample.ps1",
|    "launcher\\<engine>\\LauncherConfig.custom.sample.ps1",
|    "config\\settings.descriptions.locked.json"
|  ],
|  "groups": [
|    {
|      "name": "Mail & notifications",
|      "description": "Who receives the report mails, when they are sent, and the mail server they go through."
|    },
|    {
|      "name": "Guards (safety checks)",
|      "description": "The safety checks that hold, refuse or stop a step to protect your data: each can be turned off, its mail turned off, and its limits tuned."
|    },
|    {
|      "name": "Schedules & what runs",
|      "description": "Which jobs run and when; how many run side by side."
|    },
|    {
|      "name": "Collection scope & limits",
|      "description": "What each collection includes or skips, and the limits that keep runs fast. Engine tags show which collection a setting belongs to."
|    },
|    {
|      "name": "Risk Analysis reports",
|      "description": "What the Risk Analysis reports contain, how findings are filtered and scored, and where the reports go."
|    },
|    {
|      "name": "Risk Analysis -- mails and executive view",
|      "description": "Whether the Summary and Detailed mails show the same headline figures, which report leads, and the matching executive view in the web app."
|    },
|    {
|      "name": "AI",
|      "description": "Azure OpenAI: whether AI is used, for what, and how much it may spend."
|    },
|    {
|      "name": "Connectors & CMDB",
|      "description": "What SecurityInsight reads from and writes to other systems: the CMDB, ServiceNow and asset tags."
|    },
|    {
|      "name": "Data & retention",
|      "description": "Where collected data is written, how much detail it keeps, and how long it is kept."
|    },
|    {
|      "name": "Sign-in & Azure resources",
|      "description": "Set at install and rarely changed: how SecurityInsight signs in, and the names of the Azure resources it uses."
|    },
|    {
|      "name": "Advanced / diagnostics",
|      "description": "Diagnostic switches, older names kept for existing configuration files, and internal plumbing. Leave alone unless support asks."
|    }
|  ],
|  "categories": [
|    {
|      "name": "Environment",
|      "description": "This environment's name and the tenant it serves, as the header at the top of every page shows them.",
|      "groups": []
|    },
|    {
|      "name": "Mail & notifications",
|      "description": "Who gets which mail, and the mail server it goes through.",
|      "groups": [
|        "Mail & notifications"
|      ]
|    },
|    {
|      "name": "Guards (safety checks)",
|      "description": "Turn each safety check (or all of them) off, turn its mail off, and tune its limits.",
|      "groups": [
|        "Guards (safety checks)"
|      ]
|    },
|    {
|      "name": "Schedules & what runs",
|      "description": "Which container jobs run, and when.",
|      "groups": [
|        "Schedules & what runs"
|      ]
|    },
|    {
|      "name": "Collection scope & limits",
|      "description": "What each collection includes or skips.",
|      "groups": [
|        "Collection scope & limits"
|      ]
|    },
|    {
|      "name": "Risk Analysis reports",
|      "description": "What the Risk Analysis reports contain and where they go.",
|      "groups": [
|        "Risk Analysis reports",
|        "Risk Analysis -- mails and executive view"
|      ]
|    },
|    {
|      "name": "AI",
|      "description": "Whether Azure OpenAI is used, for what, and how much it may spend.",
|      "groups": [
|        "AI"
|      ]
|    },
|    {
|      "name": "Departments & owners",
|      "description": "Who is responsible for each asset, and when findings count as overdue.",
|      "groups": []
|    },
|    {
|      "name": "Connectors & CMDB",
|      "description": "The CMDB, ServiceNow and asset tags.",
|      "groups": [
|        "Connectors & CMDB"
|      ]
|    },
|    {
|      "name": "Data & retention",
|      "description": "Where collected data is written and how long it is kept.",
|      "groups": [
|        "Data & retention"
|      ]
|    },
|    {
|      "name": "Licence & updates",
|      "description": "Your licence and updates from Invardia.",
|      "groups": []
|    },
|    {
|      "name": "Sign-in & Azure resources",
|      "description": "How SecurityInsight signs in, and the Azure resources it uses. Set at install.",
|      "groups": [
|        "Sign-in & Azure resources"
|      ]
|    },
|    {
|      "name": "Web app",
|      "description": "The header, the chat, the wall board and number formats of this web app.",
|      "groups": [
|        "Web app"
|      ]
|    },
|    {
|      "name": "Exemptions",
|      "description": "How exemptions are requested, reviewed and shown.",
|      "groups": [
|        "Exemptions"
|      ]
|    },
|    {
|      "name": "Advanced / diagnostics",
|      "description": "Diagnostic switches and older names. Leave alone unless support asks.",
|      "groups": [
|        "Advanced / diagnostics"
|      ]
|    }
|  ],
|  "cards": [
|    {
|      "name": "Environment and tenant",
|      "category": "Environment",
|      "description": "The names the header shows. The tenant's own name is read from Entra ID when SecurityInsight is installed; set a name here only to show a different one.",
|      "settings": []
|    },
|    {
|      "name": "Mail",
|      "category": "Mail & notifications",
|      "description": "How SecurityInsight sends every mail: an Office 365 shared mailbox (recommended) or your own SMTP relay.",
|      "settings": [
|        "SI_Mail_Mode",
|        "SI_Mail_From",
|        "SI_Mail_ProbeMailbox",
|        "SI_Mail_RestrictionAttestation",
|        "SI_Mail_SmtpKept"
|      ]
|    },
|    {
|      "name": "Mail server",
|      "category": "Mail & notifications",
|      "description": "Your own SMTP relay -- used when How mail is sent (SI_Mail_Mode) is smtp.",
|      "settings": [
|        "SmtpServer",
|        "SMTPPort",
|        "SMTP_UseSSL",
|        "SMTPFrom",
|        "Mail_SendAnonymous",
|        "SMTPUser",
|        "SMTPPassword"
|      ]
|    },
|    {
|      "name": "Risk Analysis report mails",
|      "category": "Mail & notifications",
|      "description": "Who receives the Summary and Detailed reports. A report's own list wins over the default list.",
|      "settings": [
|        "SendMail",
|        "MailTo",
|        "RiskAnalysis_Summary_SendMail",
|        "RiskAnalysis_Summary_To",
|        "RiskAnalysis_Detailed_SendMail",
|        "RiskAnalysis_Detailed_To",
|        "RA_MailEvenIfEmpty",
|        "SI_MaxMailAttachmentMB",
|        "SI_RA_ExcelExport_Summary",
|        "SI_RA_ExcelExport_Detailed"
|      ]
|    },
|    {
|      "name": "Daily vulnerability mail",
|      "category": "Mail & notifications",
|      "description": "One mail a day with the vulnerabilities opened, closed and reopened in the last 24 hours.",
|      "settings": [
|        "Mail_CloseLoop_Daily_SendMail",
|        "Mail_CloseLoop_Daily_To",
|        "Mail_CloseLoop_Daily_SendTimeUtc"
|      ]
|    },
|    {
|      "name": "Mails to departments",
|      "category": "Mail & notifications",
|      "description": "Monthly reports and new-findings digests to each department's owners. A department needs an owner with a mail address.",
|      "settings": [
|        "SI_Pro_DepartmentReport_SendMail",
|        "SI_Pro_DepartmentReport_DayOfMonth",
|        "SI_Pro_TechnicalReview_SendMail",
|        "SI_Pro_TechnicalReview_DayOfMonth",
|        "SI_Pro_GovernanceNotify_SendMail",
|        "SI_Pro_GovernanceNotify_MinSeverity",
|        "SI_Pro_GovernanceNotify_Mode",
|        "SI_Exempted_InDepartmentReports"
|      ]
|    },
|    {
|      "name": "Task reminders",
|      "category": "Mail & notifications",
|      "description": "A daily mail to each person whose follow-up tasks are due.",
|      "settings": [
|        "SI_Pro_TaskDigest_SendMail",
|        "SI_Pro_TaskDigest_DueSoonDays"
|      ]
|    },
|    {
|      "name": "Safety-check mails",
|      "category": "Mail & notifications",
|      "description": "A mail when a safety check holds or stops a step to protect your data.",
|      "settings": [
|        "SI_GuardMail_Enabled",
|        "SI_GuardMail_To"
|      ]
|    },
|    {
|      "name": "Guards (safety checks)",
|      "category": "Guards (safety checks)",
|      "description": "One switch for all safety checks. Turning it off means SecurityInsight acts on data that looks broken or incomplete -- read the warning first.",
|      "settings": [
|        "SI_Guards_Enabled"
|      ]
|    },
|    {
|      "name": "Data-quality warnings",
|      "category": "Guards (safety checks)",
|      "description": "Each pipeline run's key numbers against the median of the last 3 runs: shown on Operations > Data quality and in Run health, and one mail a day when something is off. Never blocks anything.",
|      "settings": [
|        "SI_Pro_DataQuality_Mail_Enabled",
|        "SI_Pro_DataQuality_Mail_To",
|        "SI_Pro_DataQuality_AssetDropPercent",
|        "SI_Pro_DataQuality_ReportDropPercent",
|        "SI_Pro_DataQuality_FillDropPoints",
|        "SI_Pro_DataQuality_TierShiftPercent",
|        "SI_Pro_SourceDropout_HoldDeliveryDays",
|        "SI_Pro_Pipeline_GoOnAfterFailedStep",
|        "SI_Pro_PublishPartialRun",
|        "SI_Pro_Pipeline_FirstRunRestarts",
|        "SI_Pro_SourceDropout_AssetDropAction",
|        "SI_Pro_LifecycleStaleOpenRepair"
|      ]
|    },
|    {
|      "name": "Data health",
|      "category": "Guards (safety checks)",
|      "description": "Every day SecurityInsight checks a random 10% of each source's records against its newest collection, and re-asks Defender about a random 10% of the devices with vulnerability findings. Three anomalous days in a row make the data Unhealthy: then nothing is sent out (tickets, CMDB, connectors, tagging, outputs) until one good day, or until a SuperAdmin lets one channel through on Configuration > Connectors > Data-health hold.",
|      "settings": [
|        "SI_DataHealth_Enabled",
|        "SI_DataHealth_Margin_EntraUsers",
|        "SI_DataHealth_Margin_EntraApps",
|        "SI_DataHealth_Margin_Devices",
|        "SI_DataHealth_Margin_Azure",
|        "SI_DataHealth_Margin_DefenderForCloud",
|        "SI_DataHealth_Margin_Vulnerabilities",
|        "SI_DataHealth_Margin_RiskAnalysis",
|        "SI_DataHealth_MarginMinimum",
|        "SI_Telemetry_SendHealth"
|      ]
|    },
|    {
|      "name": "Vulnerability connector checks",
|      "category": "Guards (safety checks)",
|      "description": "The checks before the vulnerability connector opens or closes records in your vulnerability system, and their limits.",
|      "settings": [
|        "SI_VulnSync_MaxClosePercent",
|        "SI_VulnSync_MaxCloseAbsolute",
|        "SI_VulnSync_CollapseFloor",
|        "SI_Guard_VulnConnectorCloseCeiling_Enabled",
|        "SI_Guard_VulnConnectorCloseCeiling_Mail",
|        "SI_Guard_VulnConnectorEmptySnapshot_Enabled",
|        "SI_Guard_VulnConnectorEmptySnapshot_Mail",
|        "SI_Guard_VulnConnectorCollapse_Enabled",
|        "SI_Guard_VulnConnectorCollapse_Mail",
|        "SI_Guard_VulnConnectorScopeChanged_Enabled",
|        "SI_Guard_VulnConnectorScopeChanged_Mail",
|        "SI_Guard_VulnConnectorRunIncomplete_Enabled",
|        "SI_Guard_VulnConnectorRunIncomplete_Mail",
|        "SI_Guard_VulnConnectorSnapshotIncomplete_Enabled",
|        "SI_Guard_VulnConnectorSnapshotIncomplete_Mail",
|        "SI_Guard_VulnConnectorTargetIncomplete_Enabled",
|        "SI_Guard_VulnConnectorTargetIncomplete_Mail",
|        "SI_Guard_VulnConnectorRefused_Enabled",
|        "SI_Guard_VulnConnectorRefused_Mail"
|      ]
|    },
|    {
|      "name": "CMDB, ServiceNow and asset metadata checks",
|      "category": "Guards (safety checks)",
|      "description": "The checks before CIs are written, retired or handed over, and before asset metadata is handed off. The allowed change of the asset metadata is set on the Asset properties card.",
|      "settings": [
|        "SI_Guard_CmdbSqlSnapshotIncomplete_Enabled",
|        "SI_Guard_CmdbSqlSnapshotIncomplete_Mail",
|        "SI_Guard_CmdbSqlCollapse_Enabled",
|        "SI_Guard_CmdbSqlCollapse_Mail",
|        "SI_Guard_CmdbSqlEmptySnapshot_Enabled",
|        "SI_Guard_CmdbSqlEmptySnapshot_Mail",
|        "SI_Guard_CmdbSqlNoCorrelationMap_Enabled",
|        "SI_Guard_CmdbSqlNoCorrelationMap_Mail",
|        "SI_Guard_CmdbSqlStale_Enabled",
|        "SI_Guard_CmdbSqlStale_Mail",
|        "SI_Guard_CmdbHandoffMassChange_Enabled",
|        "SI_Guard_CmdbHandoffMassChange_Mail",
|        "SI_Guard_CmdbServicenowUnreachable_Enabled",
|        "SI_Guard_CmdbServicenowUnreachable_Mail",
|        "SI_Guard_CmdbServicenowCreateGate_Enabled",
|        "SI_Guard_CmdbServicenowCreateGate_Mail",
|        "SI_Guard_CmdbServicenowServiceModel_Enabled",
|        "SI_Guard_CmdbServicenowServiceModel_Mail",
|        "SI_Guard_AssetPropertiesCollectionChange_Enabled",
|        "SI_Guard_AssetPropertiesCollectionChange_Mail",
|        "SI_Guard_CollectionSourceAssetDrop_Enabled",
|        "SI_Guard_CollectionSourceAssetDrop_Mail",
|        "SI_Guard_CiBuildConcurrent_Enabled",
|        "SI_Guard_CiBuildConcurrent_Mail"
|      ]
|    },
|    {
|      "name": "Data sync and Risk Analysis checks",
|      "category": "Guards (safety checks)",
|      "description": "The checks before a Risk Analysis collection is loaded into the web app, and on the Risk Analysis results themselves.",
|      "settings": [
|        "SI_Guard_DatasyncCollectionHeld_Enabled",
|        "SI_Guard_DatasyncCollectionHeld_Mail",
|        "SI_Guard_DatasyncCollectionRefused_Enabled",
|        "SI_Guard_DatasyncCollectionRefused_Mail",
|        "SI_Guard_DatasyncAssetKindDropped_Enabled",
|        "SI_Guard_DatasyncAssetKindDropped_Mail",
|        "SI_Guard_DatasyncCollectionShortRead_Enabled",
|        "SI_Guard_DatasyncCollectionShortRead_Mail",
|        "SI_Guard_RaOutputRowDrop_Enabled",
|        "SI_Guard_RaOutputRowDrop_Mail",
|        "SI_Guard_RaOutputColumnEmptied_Enabled",
|        "SI_Guard_RaOutputColumnEmptied_Mail",
|        "SI_Guard_RaBucketCountJump_Enabled",
|        "SI_Guard_RaBucketCountJump_Mail",
|        "SI_Guard_IngestRowsShortCount_Enabled",
|        "SI_Guard_IngestRowsShortCount_Mail"
|      ]
|    },
|    {
|      "name": "Other checks",
|      "category": "Guards (safety checks)",
|      "description": "Setup, updates, the licence, the audit trail, bulk exemptions and the daily job flow.",
|      "settings": [
|        "SI_Guard_SchemaGateRefused_Enabled",
|        "SI_Guard_SchemaGateRefused_Mail",
|        "SI_Guard_UpdateSchemaFailed_Enabled",
|        "SI_Guard_UpdateSchemaFailed_Mail",
|        "SI_Guard_LicenceStateInvalid_Enabled",
|        "SI_Guard_LicenceStateInvalid_Mail",
|        "SI_Guard_LicenceStateGrace_Enabled",
|        "SI_Guard_LicenceStateGrace_Mail",
|        "SI_Guard_AuditRetentionRefused_Enabled",
|        "SI_Guard_AuditRetentionRefused_Mail",
|        "SI_Guard_ExemptionBulkRefused_Enabled",
|        "SI_Guard_ExemptionBulkRefused_Mail",
|        "SI_Guard_FlowRunCatchUp_Enabled",
|        "SI_Guard_FlowRunCatchUp_Mail",
|        "SI_Guard_FlowStepSkipped_Enabled",
|        "SI_Guard_FlowStepSkipped_Mail",
|        "SI_Guard_FlowStepStartFailed_Enabled",
|        "SI_Guard_FlowStepStartFailed_Mail",
|        "SI_Guard_FlowStepInterrupted_Enabled",
|        "SI_Guard_FlowStepInterrupted_Mail",
|        "SI_Guard_JobExecutionPreviousRunning_Enabled",
|        "SI_Guard_JobExecutionPreviousRunning_Mail",
|        "SI_Guard_JobRunThrottledStuck_Enabled",
|        "SI_Guard_JobRunThrottledStuck_Mail",
|        "SI_Throttle_StuckHours",
|        "SI_Throttle_StuckRuns"
|      ]
|    },
|    {
|      "name": "Links in e-mails",
|      "category": "Mail & notifications",
|      "description": "How the links in mails open this web app.",
|      "settings": []
|    },
|    {
|      "name": "Daily pipeline",
|      "category": "Schedules & what runs",
|      "description": "When the daily flow starts: data in, correlate, data out.",
|      "settings": [
|        "SI_Pipeline_StartTime",
|        "SI_Pipeline_TimeZone",
|        "SI_CiBuild_FullReconcileDays",
|        "SI_CiRulesBudgetSeconds"
|      ]
|    },
|    {
|      "name": "Container jobs",
|      "category": "Schedules & what runs",
|      "description": "Which jobs container setup creates and when each runs (cron, UTC). Takes effect when setup runs again.",
|      "settings": [
|        "SI_Bootstrap_Engines",
|        "SI_Bootstrap_ScheduleEndpoint",
|        "SI_Bootstrap_ScheduleIdentity",
|        "SI_Bootstrap_ScheduleAzure",
|        "SI_Bootstrap_ScheduleAssetTagging",
|        "SI_Bootstrap_ScheduleRiskAnalysis"
|      ]
|    },
|    {
|      "name": "Daily pipeline",
|      "category": "Schedules & what runs",
|      "description": "When a new install's daily pipeline (Collect, Correlate, Deliver) starts, and the time zone that time is read in.",
|      "settings": [
|        "SI_Pipeline_StartTime",
|        "SI_Pipeline_TimeZone",
|        "SI_CiBuild_FullReconcileDays",
|        "SI_CiRulesBudgetSeconds"
|      ]
|    },
|    {
|      "name": "Which assets are included",
|      "category": "Collection scope & limits",
|      "description": "Which devices, identities and subscriptions the collections keep.",
|      "settings": [
|        "SI_ActiveStaleDays",
|        "SI_IncludeInactive_Endpoint",
|        "SI_RequireMdeActive_Endpoint",
|        "SI_IncludeInactive_Identity",
|        "SI_RequireRecentSignIn_Identity",
|        "SI_IncludeFirstPartySpns",
|        "SI_AzureSubscriptionExcludePatterns",
|        "SI_AssetDecisionsPath"
|      ]
|    },
|    {
|      "name": "Disabled accounts and devices",
|      "category": "Collection scope & limits",
|      "description": "What happens to users, service principals, managed identities and computers whose account is disabled in their own directory -- one setting per stage. Read on every run: an account that is enabled again is included again everywhere.",
|      "settings": [
|        "SI_DisabledAssets_Collect",
|        "SI_DisabledAssets_Correlate",
|        "SI_DisabledAssets_RiskAnalysis",
|        "SI_DisabledAssets_StateActions",
|        "SI_DisabledAssets_Connectors"
|      ]
|    },
|    {
|      "name": "Exposure Graph identities without an asset",
|      "category": "Collection scope & limits",
|      "description": "On by default (an install that chose a value keeps it): Exposure Graph identities that get no asset. What is left out is counted in each run's log and on the Data health page; existing CIs retire with a reason naming the setting.",
|      "settings": [
|        "SI_Identity_SkipNeverSyncedAd",
|        "SI_Identity_SkipNeverSyncedDisabledAd",
|        "SI_Identity_SkipDeletedGroups"
|      ]
|    },
|    {
|      "name": "Users' sign-in methods in full",
|      "category": "Collection scope & limits",
|      "description": "Every sign-in method of each user with its details and the device a key lives on, read in the background (one read per user, Microsoft throttles: about 8-9 hours of reading at 150,000 users the first time, privileged users first). Collections never wait for it; not read yet shows as unknown, never as no.",
|      "settings": [
|        "SI_Identity_SignInMethodsPerUser",
|        "SI_Identity_SignInMethodsMaxAgeDays",
|        "SI_Identity_SignInMethodsFillMinutes"
|      ]
|    },
|    {
|      "name": "Extra details",
|      "category": "Collection scope & limits",
|      "description": "Optional data the collections can add.",
|      "settings": [
|        "SI_CollectDefenderRecommendations",
|        "SI_EnableSignInEnrich"
|      ]
|    },
|    {
|      "name": "Public IP checks (Shodan)",
|      "category": "Collection scope & limits",
|      "description": "Which public addresses are checked with Shodan, and how much it may spend.",
|      "settings": [
|        "SI_PublicIP_DiscoverySource",
|        "SI_PublicIP_ExtraTargets",
|        "SI_Shodan_ApiKey",
|        "SI_Shodan_TierMax",
|        "SI_Shodan_ForceFreshScan",
|        "SI_ShodanMonthlyCreditCap"
|      ]
|    },
|    {
|      "name": "Vulnerability (CVE) filters",
|      "category": "Risk Analysis reports",
|      "description": "Which vulnerabilities the CVE reports include.",
|      "settings": [
|        "SI_CVE_MinSeverity",
|        "SI_CVE_MinCvssScore",
|        "SI_CVE_MaxPublishedAgeDays",
|        "SI_CVE_RequireExploit",
|        "SI_PatchCycle_CatchUpDays",
|        "SI_PatchCycle_MsrcDates"
|      ]
|    },
|    {
|      "name": "Report mode and output",
|      "category": "Risk Analysis reports",
|      "description": "Which report runs by default, and where its results are written.",
|      "settings": [
|        "RiskAnalysis_Summary_Override",
|        "RiskAnalysis_Detailed_Override",
|        "ExportDestination",
|        "WriteJsonOutput",
|        "SendToLogAnalytics",
|        "SI_RiskAnalysis_SendToLogAnalytics"
|      ]
|    },
|    {
|      "name": "Summary and Detailed agreement",
|      "category": "Risk Analysis reports",
|      "description": "Whether both reports show the same headline figures.",
|      "settings": [
|        "SI_AISummary_Mode",
|        "SI_AISummary_Leader"
|      ]
|    },
|    {
|      "name": "Internet exposure",
|      "category": "Risk Analysis reports",
|      "description": "Your own internet-facing network ranges: an asset with an address in them counts as internet exposed, together with what Defender, Exposure Management, Azure and Shodan report.",
|      "settings": [
|        "SI_InternetExposedRanges"
|      ]
|    },
|    {
|      "name": "Sources and links",
|      "category": "Risk Analysis reports",
|      "description": "Data the reports read, and the tenant their links point to.",
|      "settings": [
|        "SI_HasExposureGraphInLA",
|        "SI_TenantDomain"
|      ]
|    },
|    {
|      "name": "Azure OpenAI connection",
|      "category": "AI",
|      "description": "The Azure OpenAI resource every AI feature uses.",
|      "settings": [
|        "OpenAI_endpoint",
|        "OpenAI_deployment",
|        "OpenAI_apiKey"
|      ]
|    },
|    {
|      "name": "Where AI is used",
|      "category": "AI",
|      "description": "Switch AI on or off per feature. Each needs the Azure OpenAI connection.",
|      "settings": [
|        "SI_EnableAI",
|        "SI_EnableAI_azure",
|        "SI_EnableAI_endpoint",
|        "SI_DisableAI",
|        "SI_DisableAI_endpoint",
|        "SI_PrivilegeTierClassifier_RunAI",
|        "BuildSummaryByAI",
|        "SI_RiskAnalysis_BuildSummaryByAI"
|      ]
|    },
|    {
|      "name": "AI spending",
|      "category": "AI",
|      "description": "Limits on what AI may cost.",
|      "settings": [
|        "SI_PrivilegeTierClassifier_RefreshDays",
|        "SI_SchemaProposeAiCeiling"
|      ]
|    },
|    {
|      "name": "Which department owns an asset",
|      "category": "Departments & owners",
|      "description": "How SecurityInsight finds the department responsible for each asset.",
|      "settings": [
|        "SI_Pro_Responsibility_Sources",
|        "SI_Pro_Responsibility_TagNames",
|        "SI_Pro_Responsibility_DefaultDepartment"
|      ]
|    },
|    {
|      "name": "Overdue and planning",
|      "category": "Departments & owners",
|      "description": "When open findings count as overdue, and automatic planning.",
|      "settings": [
|        "SI_Pro_Responsibility_OverdueDays",
|        "SI_Pro_Remediation_AutoSchedule"
|      ]
|    },
|    {
|      "name": "CMDB",
|      "category": "Connectors & CMDB",
|      "description": "Where business services come from.",
|      "settings": [
|        "SI_EnableCmdbProvider"
|      ]
|    },
|    {
|      "name": "ServiceNow CMDB connector",
|      "category": "Connectors & CMDB",
|      "description": "Whether the ServiceNow CMDB connector writes to your ServiceNow instance or only plans and reports.",
|      "settings": [
|        "SI_Cmdb_Run"
|      ]
|    },
|    {
|      "name": "Data out",
|      "category": "Connectors & CMDB",
|      "description": "Which workbooks and ServiceNow Import Set hand-offs are written after each data sync.",
|      "settings": [
|        "SI_DataOut_Outputs"
|      ]
|    },
|    {
|      "name": "Asset properties",
|      "category": "Connectors & CMDB",
|      "description": "How much SecurityInsight keeps about each asset: security (what it needs for risk) or full (all metadata from every source, shown on the asset page and handed to the CMDB).",
|      "settings": [
|        "SI_AssetProperties",
|        "SI_AssetProperties_RetentionDays",
|        "SI_AssetProperties_ChangeGuardPercent"
|      ]
|    },
|    {
|      "name": "SQL CMDB connector",
|      "category": "Connectors & CMDB",
|      "description": "Writes every asset as a CI row in the Pro database.",
|      "settings": [
|        "SI_Pro_CmdbSql_Enabled",
|        "SI_Pro_CmdbSql_Kinds",
|        "SI_Pro_CmdbSql_RetireAfterRuns",
|        "SI_Cmdb_RetireAfterDays"
|      ]
|    },
|    {
|      "name": "Assets no longer seen",
|      "category": "Connectors & CMDB",
|      "description": "How long an asset SecurityInsight no longer sees stays open before it is retired -- in general and per kind of asset.",
|      "settings": [
|        "SI_Pro_AssetRetire_GraceDays",
|        "SI_Pro_AssetRetire_GraceDays_ClientPc",
|        "SI_Pro_AssetRetire_GraceDays_Server",
|        "SI_Pro_AssetRetire_GraceDays_ServicePrincipal",
|        "SI_Pro_AssetRetire_GraceDays_User",
|        "SI_Pro_AssetRetire_GraceDays_AzureVm",
|        "SI_Pro_AssetRetire_GraceDays_AzureResource",
|        "SI_DeletionProof_Entra",
|        "SI_DeletionProof_Azure",
|        "SI_DeletionProof_Intune"
|      ]
|    },
|    {
|      "name": "Asset tagging",
|      "category": "Connectors & CMDB",
|      "description": "Whether asset tagging is on at all, whether the tagging job writes tags, and where.",
|      "settings": [
|        "SI_AssetTagging_Enabled",
|        "SI_AssetTagging_Apply",
|        "SI_Pro_AssetTagging_Apply",
|        "SI_Bootstrap_GrantTaggingRoles",
|        "SI_Bootstrap_TaggingScopes"
|      ]
|    },
|    {
|      "name": "Where collected data goes",
|      "category": "Data & retention",
|      "description": "Log Analytics, JSON and/or Excel, per collection.",
|      "settings": [
|        "SI_Sinks_Endpoint",
|        "SI_Sinks_Identity",
|        "SI_Sinks_Azure",
|        "SI_Sinks_PublicIp",
|        "SI_LaExport",
|        "SI_RA_Findings"
|      ]
|    },
|    {
|      "name": "How long data is kept",
|      "category": "Data & retention",
|      "description": "Run logs, the Pro database and the configuration backups.",
|      "settings": [
|        "SI_LogRetentionDays",
|        "SI_Pro_DataRetentionDays",
|        "SI_Pro_ConfigBackupRetentionDays"
|      ]
|    },
|    {
|      "name": "Counting and closing findings",
|      "category": "Data & retention",
|      "description": "How exempted findings are counted, and when a vulnerability that is gone is closed.",
|      "settings": [
|        "SI_Exempted_CountInManagement",
|        "SI_VulnSync_CloseAfterRuns"
|      ]
|    },
|    {
|      "name": "Database write pace",
|      "category": "Data & retention",
|      "description": "The large writers slow down while the database is at its limit, so the web app stays usable -- nothing is left out.",
|      "settings": [
|        "SI_SqlPacing_Enabled",
|        "SI_SqlPacing_HighPercent",
|        "SI_SqlPacing_LowPercent"
|      ]
|    },
|    {
|      "name": "Licence and updates",
|      "category": "Licence & updates",
|      "description": "The licence and updates come from Invardia by themselves. Only a SuperAdmin changes the licence settings.",
|      "settings": [
|        "SI_LicenseRequest_Auto",
|        "SI_LicenseRequest_ContactEmail",
|        "SI_InvardiaUpdate_Enabled",
|        "SI_InvardiaUpdate_HoldMicrosoftContent",
|        "SI_Update_RenameDisplayNames",
|        "SI_UpdateRing",
|        "SI_Telemetry_Enabled",
|        "SI_Telemetry_SetupControls",
|        "SI_Telemetry_SendEndpoints"
|      ]
|    },
|    {
|      "name": "How SecurityInsight signs in",
|      "category": "Sign-in & Azure resources",
|      "description": "The identity the jobs sign in as, and the Key Vault holding its secrets.",
|      "settings": [
|        "SI_AuthMethod",
|        "SI_SPN_TenantId",
|        "SI_SPN_AppId",
|        "SI_SPN_CertThumbprint",
|        "SI_SPN_Secret",
|        "SI_ManagedIdentityClientId",
|        "SI_KeyVaultName"
|      ]
|    },
|    {
|      "name": "Log Analytics",
|      "category": "Sign-in & Azure resources",
|      "description": "The workspace the data goes to, and how it is sent.",
|      "settings": [
|        "SI_WorkspaceResourceId",
|        "SI_WorkspaceName",
|        "SI_WorkspaceResourceGroup",
|        "SI_DceName",
|        "SI_DcrResourceGroup",
|        "SI_DefenderWorkspaceResourceId",
|        "SI_Location"
|      ]
|    },
|    {
|      "name": "Storage",
|      "category": "Sign-in & Azure resources",
|      "description": "The storage account the collections stage data in.",
|      "settings": [
|        "SI_StorageAccount",
|        "SI_StorageResourceGroup"
|      ]
|    },
|    {
|      "name": "Container hosting",
|      "category": "Sign-in & Azure resources",
|      "description": "Where container setup creates the jobs.",
|      "settings": [
|        "SI_Bootstrap_Location",
|        "SI_Bootstrap_ResourceGroupName",
|        "SI_Bootstrap_UseManagedIdentity"
|      ]
|    },
|    {
|      "name": "Wall board",
|      "category": "Web app",
|      "description": "The big-screen page.",
|      "settings": []
|    },
|    {
|      "name": "Named views",
|      "category": "Web app",
|      "description": "The views at the top of Security recommendations, Summary and Detailed.",
|      "settings": [
|        "SI_Pro_HiddenViews"
|      ]
|    },
|    {
|      "name": "Key figure windows",
|      "category": "Web app",
|      "description": "The windows the key figures of the Executive overview, the Executive report and the management mail count over: opened / fixed in the last N days, the mean time to fix, stale privileged accounts and the age bands of open CVE findings.",
|      "settings": [
|        "SI_KeyFigures_RecentDays",
|        "SI_KeyFigures_MeanTimeToFixDays",
|        "SI_KeyFigures_StaleAdminDays",
|        "SI_KeyFigures_CveAgeBands"
|      ]
|    },
|    {
|      "name": "Protection score",
|      "category": "Web app",
|      "description": "The protection score of the Executive overview, the Executive report, the management mail and the wall board: its accepted lifecycle per asset type, the tier weights and the severities that count.",
|      "settings": [
|        "SI_ProtectionScore_GraceDays_Device",
|        "SI_ProtectionScore_GraceDays_Identity",
|        "SI_ProtectionScore_GraceDays_CloudResource",
|        "SI_ProtectionScore_GraceDays_PublicIp",
|        "SI_ProtectionScore_OtherGraceDays_Device",
|        "SI_ProtectionScore_OtherGraceDays_Identity",
|        "SI_ProtectionScore_OtherGraceDays_CloudResource",
|        "SI_ProtectionScore_OtherGraceDays_PublicIp",
|        "SI_ProtectionScore_TierWeights",
|        "SI_ProtectionScore_Severities",
|        "SI_RA_SourceFirstSeen"
|      ]
|    }
|  ],
|  "settings": [
|    {
|      "name": "AI_MaxAttempts",
|      "label": "AI call attempts",
|      "group": "AI",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "4 attempts.",
|      "description": "Attempts for each AI call (default 4).",
|      "purpose": "How many times Risk Analysis tries an AI request when the AI service times out, throttles or has a temporary failure.",
|      "effect": "More attempts make the AI summary more likely to succeed under load, but a failing service makes the run take longer. Other errors fail at once regardless.",
|      "whenToChange": "Raise if AI summaries often fail on throttling or timeouts.",
|      "unit": "attempts",
|      "info": {
|        "what": "How many times Risk Analysis tries an AI request when the AI service times out, throttles or has a temporary failure.",
|        "whenChanged": "More attempts make the AI summary more likely to succeed under load, but a failing service makes the run take longer. Other errors fail at once regardless.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Nothing else.",
|        "default": "4 attempts.",
|        "recommended": "Keep the default. Change it when: Raise if AI summaries often fail on throttling or timeouts.",
|        "docUrl": "https://invardia.com/docs/si/settings/AI_MaxAttempts/"
|      }
|    },
|    {
|      "name": "AutoBucketCache",
|      "label": "Remember query split counts",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": true,
|      "defaultText": "On: split counts are saved and reused.",
|      "description": "reuse last-known-good bucket count",
|      "purpose": "Saves how many parts each large risk analysis query had to be split into, so later runs start at the right number.",
|      "effect": "Off, every run probes again from one part upward, which makes large estates noticeably slower. On, a changed query is detected and re-probed automatically.",
|      "whenToChange": "Rarely; turn off only while troubleshooting query splitting.",
|      "info": {
|        "what": "Saves how many parts each large risk analysis query had to be split into, so later runs start at the right number.",
|        "whenOn": "split counts are saved and reused.",
|        "whenOff": "Off, every run probes again from one part upward, which makes large estates noticeably slower. On, a changed query is detected and re-probed automatically.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "On: split counts are saved and reused.",
|        "recommended": "Keep the default. Change it when: Rarely; turn off only while troubleshooting query splitting.",
|        "docUrl": "https://invardia.com/docs/si/settings/AutoBucketCache/"
|      }
|    },
|    {
|      "name": "AutoBucketChallenger_ConfirmDays",
|      "label": "Split count re-test pause",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "7 days.",
|      "description": "... and at most once in this many days after a run decided the count.",
|      "purpose": "After a run decided a report's split count, how many days pass before a suspiciously high count is tested again.",
|      "effect": "Shorter re-tests a count that looks too high sooner, at the cost of extra queries; longer keeps a wrong count longer.",
|      "whenToChange": "Rarely; only with support while tuning query splitting.",
|      "unit": "days",
|      "info": {
|        "what": "After a run decided a report's split count, how many days pass before a suspiciously high count is tested again.",
|        "whenChanged": "Shorter re-tests a count that looks too high sooner, at the cost of extra queries; longer keeps a wrong count longer.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "7 days.",
|        "recommended": "Keep the default. Change it when: Rarely; only with support while tuning query splitting.",
|        "docUrl": "https://invardia.com/docs/si/settings/AutoBucketChallenger_ConfirmDays/"
|      }
|    },
|    {
|      "name": "AutoBucketChallenger_MedianMultiplier",
|      "label": "Split count re-test threshold",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "10 times the median.",
|      "description": "Re-test of a suspicious split count: a count this many times the median of the other reports is re-tested ...",
|      "purpose": "A report's split count this many times the median of the other reports' counts is treated as suspicious and tested again.",
|      "effect": "Lower re-tests more reports (more queries); higher re-tests only extreme counts.",
|      "whenToChange": "Rarely; only with support while tuning query splitting.",
|      "unit": "times",
|      "info": {
|        "what": "A report's split count this many times the median of the other reports' counts is treated as suspicious and tested again.",
|        "whenChanged": "Lower re-tests more reports (more queries); higher re-tests only extreme counts.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "10 times the median.",
|        "recommended": "Keep the default. Change it when: Rarely; only with support while tuning query splitting.",
|        "docUrl": "https://invardia.com/docs/si/settings/AutoBucketChallenger_MedianMultiplier/"
|      }
|    },
|    {
|      "name": "AutoBucketChallenger_MinEntries",
|      "label": "Split count re-test sample size",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "10 reports.",
|      "description": "... once at least this many reports have a count to compare with ...",
|      "purpose": "How many reports must have a split count before one count is compared with the others at all.",
|      "effect": "Lower compares sooner on small installs; higher waits for more reports before re-testing anything.",
|      "whenToChange": "Rarely; only with support while tuning query splitting.",
|      "unit": "reports",
|      "info": {
|        "what": "How many reports must have a split count before one count is compared with the others at all.",
|        "whenChanged": "Lower compares sooner on small installs; higher waits for more reports before re-testing anything.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "10 reports.",
|        "recommended": "Keep the default. Change it when: Rarely; only with support while tuning query splitting.",
|        "docUrl": "https://invardia.com/docs/si/settings/AutoBucketChallenger_MinEntries/"
|      }
|    },
|    {
|      "name": "AutoBucketCount",
|      "label": "Automatic query splitting",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": true,
|      "defaultText": "On.",
|      "description": "Adaptive bucketing (handles Defender's 30k-row query ceiling).",
|      "purpose": "Splits large risk analysis queries into smaller parts automatically so results stay under Defender's row limit.",
|      "effect": "Off, large queries run at a fixed split and can exceed Defender's limit, giving incomplete or failed reports on big estates.",
|      "whenToChange": "Leave on; turn off only for troubleshooting.",
|      "info": {
|        "what": "Splits large risk analysis queries into smaller parts automatically so results stay under Defender's row limit.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "Off, large queries run at a fixed split and can exceed Defender's limit, giving incomplete or failed reports on big estates.",
|        "risk": "Large queries run at a fixed split and can exceed Defender's row limit: reports on big estates can be incomplete or fail. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "On.",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/AutoBucketCount/",
|        "confirmWhen": "off",
|        "confirm": "Off, large queries run at a fixed split and can exceed Defender's limit, giving incomplete or failed reports on big estates. Large queries run at a fixed split and can exceed Defender's row limit: reports on big estates can be incomplete or fail. Reversible at once."
|      }
|    },
|    {
|      "name": "AutoBucketMax",
|      "label": "Query split upper limit",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 131072,
|      "defaultText": "131072 parts (sized for very large estates).",
|      "description": "safety cap. Sized for 1M+ asset estates;",
|      "purpose": "The most parts automatic query splitting may divide a risk analysis query into.",
|      "effect": "A lower limit stops probing sooner, so a query too large for that many parts can still fail or return incomplete rows; a higher limit is accepted but rarely needed.",
|      "whenToChange": "Almost never.",
|      "unit": "parts",
|      "info": {
|        "what": "The most parts automatic query splitting may divide a risk analysis query into.",
|        "whenChanged": "A lower limit stops probing sooner, so a query too large for that many parts can still fail or return incomplete rows; a higher limit is accepted but rarely needed.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "131072 parts (sized for very large estates).",
|        "recommended": "Keep the default. Change it when: Almost never.",
|        "docUrl": "https://invardia.com/docs/si/settings/AutoBucketMax/"
|      }
|    },
|    {
|      "name": "AutomationFramework",
|      "label": "Internal platform sign-in mode",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: SecurityInsight's own sign-in settings are used.",
|      "description": "Internal: when $true, AutomationFramework long-name globals win (set by Initialize-PlatformAutomationFramework). Customer doesn't usually set this.",
|      "purpose": "Marks a run as hosted on the vendor's internal automation platform, which provides the sign-in identity instead of SecurityInsight's own settings.",
|      "effect": "When on, engines take their identity and connections from the internal platform and skip their own sign-in. On a normal install this breaks sign-in.",
|      "whenToChange": "Never on a customer install; it is set automatically by the internal platform.",
|      "info": {
|        "what": "Marks a run as hosted on the vendor's internal automation platform, which provides the sign-in identity instead of SecurityInsight's own settings.",
|        "whenOn": "When on, engines take their identity and connections from the internal platform and skip their own sign-in. On a normal install this breaks sign-in.",
|        "whenOff": "SecurityInsight's own sign-in settings are used.",
|        "risk": "On a normal install this breaks sign-in: every engine takes its identity from an internal platform that is not there, and runs fail. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Off: SecurityInsight's own sign-in settings are used.",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/AutomationFramework/",
|        "confirmWhen": "on",
|        "confirm": "When on, engines take their identity and connections from the internal platform and skip their own sign-in. On a normal install this breaks sign-in. On a normal install this breaks sign-in: every engine takes its identity from an internal platform that is not there, and runs fail. Reversible at once."
|      }
|    },
|    {
|      "name": "BuildSummaryByAI",
|      "label": "AI summary in the report mail",
|      "group": "AI",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off",
|      "description": "RiskAnalysis: master ON/OFF for the AI executive summary in the email body.",
|      "purpose": "Adds an AI-written executive summary of the Risk Analysis findings to the report email.",
|      "effect": "When on, each Risk Analysis run calls your Azure OpenAI deployment, adding run time and AI cost. If the AI settings are missing, a VM run stops with an error; a container run skips the summary.",
|      "whenToChange": "Turn on when you have Azure OpenAI set up and want a narrative summary in the mail.",
|      "card": "Where AI is used",
|      "hint": "When the reports run on a server.",
|      "info": {
|        "what": "Adds an AI-written executive summary of the Risk Analysis findings to the report email.",
|        "whenOn": "When on, each Risk Analysis run calls your Azure OpenAI deployment, adding run time and AI cost. If the AI settings are missing, a VM run stops with an error; a container run skips the summary.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "Report content is sent to YOUR Azure OpenAI deployment for a summary, and each run costs. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off",
|        "recommended": "As your organisation prefers; on gives readers a written summary.",
|        "docUrl": "https://invardia.com/docs/si/settings/BuildSummaryByAI/",
|        "confirmWhen": "on",
|        "confirm": "When on, each Risk Analysis run calls your Azure OpenAI deployment, adding run time and AI cost. If the AI settings are missing, a VM run stops with an error; a container run skips the summary. Report content is sent to YOUR Azure OpenAI deployment for a summary, and each run costs. Reversible at once."
|      }
|    },
|    {
|      "name": "CsaAttributeSet",
|      "label": "Custom security attribute set",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [
|        "asset-tagging"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "SecurityInsight",
|      "description": "Custom Security Attribute set name used by Entra tagging logic. Default 'SecurityInsight'.",
|      "purpose": "The Entra custom security attribute set that identity tagging rules write their tags into.",
|      "effect": "Identity tags are written into the named attribute set instead. The set must exist in Entra; a rule that names its own set still wins over this value.",
|      "whenToChange": "Only if your Entra tenant uses a different attribute set name for these tags.",
|      "info": {
|        "what": "The Entra custom security attribute set that identity tagging rules write their tags into.",
|        "whenChanged": "Identity tags are written into the named attribute set instead. The set must exist in Entra; a rule that names its own set still wins over this value.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Read by: asset-tagging.",
|        "default": "SecurityInsight",
|        "recommended": "Keep the default. Change it when: Only if your Entra tenant uses a different attribute set name for these tags.",
|        "docUrl": "https://invardia.com/docs/si/settings/CsaAttributeSet/"
|      }
|    },
|    {
|      "name": "CustomYamlFile",
|      "label": "Your asset tagging rules file",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [
|        "asset-tagging"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "AssetTagging.custom.yaml",
|      "defaultText": "AssetTagging.custom.yaml",
|      "description": "File name of your own asset-tagging rules YAML, loaded from the settings folder on top of the shipped rules; defaults to AssetTagging.custom.yaml.",
|      "purpose": "File name of your own asset tagging rules, loaded from the rules folder on top of the shipped rules.",
|      "effect": "Rules in this file are added to the shipped rules. If the file does not exist, only the shipped rules run. Ignored when rules come from the Pro settings database.",
|      "whenToChange": "Only if you keep your tagging rules under another file name.",
|      "info": {
|        "what": "File name of your own asset tagging rules, loaded from the rules folder on top of the shipped rules.",
|        "whenChanged": "Rules in this file are added to the shipped rules. If the file does not exist, only the shipped rules run. Ignored when rules come from the Pro settings database.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Read by: asset-tagging.",
|        "default": "AssetTagging.custom.yaml",
|        "recommended": "Keep the default. Change it when: Only if you keep your tagging rules under another file name.",
|        "docUrl": "https://invardia.com/docs/si/settings/CustomYamlFile/"
|      }
|    },
|    {
|      "name": "DceIngestionUri",
|      "label": "Ingestion endpoint address (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: looked up from the endpoint name",
|      "description": "Optional: explicit DCE ingestion URI (auto-resolved from SI_DceName otherwise).",
|      "purpose": "Older name for the data collection endpoint's ingestion address, used by Risk Analysis when sending results to Log Analytics.",
|      "effect": "Used only when SI_RiskAnalysis_DceIngestionUri and SI_DceIngestionUri are not set. A wrong address makes Risk Analysis ingestion fail.",
|      "whenToChange": "Never on new installs; use SI_DceIngestionUri or leave it to automatic lookup.",
|      "info": {
|        "what": "Older name for the data collection endpoint's ingestion address, used by Risk Analysis when sending results to Log Analytics.",
|        "whenChanged": "Used only when SI_RiskAnalysis_DceIngestionUri and SI_DceIngestionUri are not set. A wrong address makes Risk Analysis ingestion fail.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: looked up from the endpoint name",
|        "recommended": "Keep the default. Change it when: Never on new installs; use SI_DceIngestionUri or leave it to automatic lookup.",
|        "docUrl": "https://invardia.com/docs/si/settings/DceIngestionUri/"
|      }
|    },
|    {
|      "name": "DceName",
|      "label": "Data collection endpoint name (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "dce-securityinsight",
|      "defaultText": "dce-securityinsight",
|      "description": "--- Data Collection Endpoint (shared across all SI ingestion engines) ---",
|      "purpose": "Older name for the data collection endpoint that Risk Analysis sends its results through.",
|      "effect": "Used by Risk Analysis only when SI_RiskAnalysis_DceName and SI_DceName are not set; in a container it also fills SI_DceName. A wrong name stops Risk Analysis ingestion or creates a new endpoint.",
|      "whenToChange": "Never on new installs; set SI_DceName instead.",
|      "info": {
|        "what": "Older name for the data collection endpoint that Risk Analysis sends its results through.",
|        "whenChanged": "Used by Risk Analysis only when SI_RiskAnalysis_DceName and SI_DceName are not set; in a container it also fills SI_DceName. A wrong name stops Risk Analysis ingestion or creates a new endpoint.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "dce-securityinsight",
|        "recommended": "Keep the default. Change it when: Never on new installs; set SI_DceName instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/DceName/"
|      }
|    },
|    {
|      "name": "DceResourceGroup",
|      "label": "Endpoint resource group (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "rg-dce-securityinsight",
|      "defaultText": "rg-dce-securityinsight",
|      "description": "Resource group of the data collection endpoint used when risk-analysis results are sent to Log Analytics; the newer SI_DcrResourceGroup takes precedence when set.",
|      "purpose": "Older name for the resource group of the data collection endpoint used by Risk Analysis and setup checks.",
|      "effect": "Used only when SI_DceResourceGroup (and, for other engines, SI_DcrResourceGroup) is not set. A wrong group makes the engine look in, or create resources in, the wrong place.",
|      "whenToChange": "Never on new installs; set SI_DceResourceGroup only if you split resource groups.",
|      "info": {
|        "what": "Older name for the resource group of the data collection endpoint used by Risk Analysis and setup checks.",
|        "whenChanged": "Used only when SI_DceResourceGroup (and, for other engines, SI_DcrResourceGroup) is not set. A wrong group makes the engine look in, or create resources in, the wrong place.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "rg-dce-securityinsight",
|        "recommended": "Keep the default. Change it when: Never on new installs; set SI_DceResourceGroup only if you split resource groups.",
|        "docUrl": "https://invardia.com/docs/si/settings/DceResourceGroup/"
|      }
|    },
|    {
|      "name": "DcrResourceGroup",
|      "label": "Rules resource group (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "rg-dcr-securityinsight",
|      "defaultText": "rg-dcr-securityinsight",
|      "description": "--- Data Collection Rules (one RG holds ALL SI DCRs; DCR NAMES are engine-specific) ---",
|      "purpose": "Older name for the resource group holding the data collection rules that Risk Analysis uses.",
|      "effect": "Used by Risk Analysis only when SI_RiskAnalysis_DcrResourceGroup and SI_DcrResourceGroup are not set; in a container it also fills SI_DcrResourceGroup. A wrong group puts rules in the wrong place.",
|      "whenToChange": "Never on new installs; set SI_DcrResourceGroup instead.",
|      "info": {
|        "what": "Older name for the resource group holding the data collection rules that Risk Analysis uses.",
|        "whenChanged": "Used by Risk Analysis only when SI_RiskAnalysis_DcrResourceGroup and SI_DcrResourceGroup are not set; in a container it also fills SI_DcrResourceGroup. A wrong group puts rules in the wrong place.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "rg-dcr-securityinsight",
|        "recommended": "Keep the default. Change it when: Never on new installs; set SI_DcrResourceGroup instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/DcrResourceGroup/"
|      }
|    },
|    {
|      "name": "DebugQueryHash",
|      "label": "Query fingerprint debug output",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off.",
|      "description": "When on, risk analysis logs each auto-bucketed report's query fingerprint and writes the hashed query to an OUTPUT\\Debug folder for troubleshooting; off by default.",
|      "purpose": "Logs each split query's fingerprint and saves the query to a debug folder for troubleshooting.",
|      "effect": "On writes one query file per report to the output Debug folder and adds log lines; no effect on report content.",
|      "whenToChange": "Only when asked to diagnose query splitting.",
|      "info": {
|        "what": "Logs each split query's fingerprint and saves the query to a debug folder for troubleshooting.",
|        "whenOn": "On writes one query file per report to the output Debug folder and adds log lines; no effect on report content.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off.",
|        "recommended": "Keep the default. Change it when: Only when asked to diagnose query splitting.",
|        "docUrl": "https://invardia.com/docs/si/settings/DebugQueryHash/"
|      }
|    },
|    {
|      "name": "Detailed",
|      "label": "Detailed run mode",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: Summary mode.",
|      "description": "Runs risk analysis in Detailed mode (one row per affected asset finding) using the Detailed report template, table and recipients; cannot be combined with Summary.",
|      "purpose": "Runs risk analysis in Detailed mode: one row per affected asset, with the Detailed template, table and mail recipients.",
|      "effect": "Honoured when the engine is run directly. The launchers and containers decide the mode themselves (command-line switch, RiskAnalysis_Detailed_Override, or the template name) and replace this value.",
|      "whenToChange": "Use the -Detailed switch or RiskAnalysis_Detailed_Override instead.",
|      "info": {
|        "what": "Runs risk analysis in Detailed mode: one row per affected asset, with the Detailed template, table and mail recipients.",
|        "whenOn": "Honoured when the engine is run directly. The launchers and containers decide the mode themselves (command-line switch, RiskAnalysis_Detailed_Override, or the template name) and replace this value.",
|        "whenOff": "Summary mode.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off: Summary mode.",
|        "recommended": "Keep the default. Change it when: Use the -Detailed switch or RiskAnalysis_Detailed_Override instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/Detailed/"
|      }
|    },
|    {
|      "name": "ExportDestination",
|      "label": "Report upload destination",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On a server: no upload. In a container: the staging storage account's report folder",
|      "description": "RiskAnalysis: blob/UNC upload after Excel/JSON write. Type auto-detected from prefix: 'https://...' = Azure Blob, '\\\\server\\share' = UNC. Backup-then-overwrite: existing files renamed <name>.<ts>.<ext>.bak.",
|      "purpose": "Where Risk Analysis copies its Excel (and JSON) report after a run: an Azure Blob container URL or a Windows file share path.",
|      "effect": "Reports are also uploaded there; an existing file with the same name is first kept as a timestamped backup. The run's identity needs write access to that location.",
|      "whenToChange": "Set it when reports should land on a share or storage container people or tools read from.",
|      "card": "Report mode and output",
|      "info": {
|        "what": "Where Risk Analysis copies its Excel (and JSON) report after a run: an Azure Blob container URL or a Windows file share path.",
|        "whenChanged": "Reports are also uploaded there; an existing file with the same name is first kept as a timestamped backup. The run's identity needs write access to that location.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "On a server: no upload. In a container: the staging storage account's report folder",
|        "recommended": "Keep the default. Change it when: Set it when reports should land on a share or storage container people or tools read from.",
|        "docUrl": "https://invardia.com/docs/si/settings/ExportDestination/"
|      }
|    },
|    {
|      "name": "GraphQueryMaxRetries",
|      "label": "Defender query retries",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 4,
|      "defaultText": "4 attempts.",
|      "description": "How many times risk analysis retries a Defender advanced-hunting query after a transient error before giving up; defaults to 4 attempts.",
|      "purpose": "How many attempts risk analysis makes for a Defender advanced hunting query before giving up.",
|      "effect": "More attempts ride out longer outages but can make a failing run take much longer; fewer attempts fail sooner and risk missing report sections after a brief error.",
|      "whenToChange": "Raise it if transient Defender errors often break runs.",
|      "unit": "attempts",
|      "info": {
|        "what": "How many attempts risk analysis makes for a Defender advanced hunting query before giving up.",
|        "whenChanged": "More attempts ride out longer outages but can make a failing run take much longer; fewer attempts fail sooner and risk missing report sections after a brief error.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "4 attempts.",
|        "recommended": "Keep the default. Change it when: Raise it if transient Defender errors often break runs.",
|        "docUrl": "https://invardia.com/docs/si/settings/GraphQueryMaxRetries/"
|      }
|    },
|    {
|      "name": "GraphReconnectMaxAgeMinutes",
|      "label": "Graph reconnect interval",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 45,
|      "defaultText": "45 minutes.",
|      "description": "Graph reconnect / retry tuning.",
|      "purpose": "How old the Microsoft Graph sign-in may get before risk analysis signs in again before a query.",
|      "effect": "Shorter reconnects more often (small overhead); longer risks a sign-in expiring during long runs and queries failing.",
|      "whenToChange": "Only if long runs fail with expired sign-ins.",
|      "unit": "minutes",
|      "info": {
|        "what": "How old the Microsoft Graph sign-in may get before risk analysis signs in again before a query.",
|        "whenChanged": "Shorter reconnects more often (small overhead); longer risks a sign-in expiring during long runs and queries failing.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "45 minutes.",
|        "recommended": "Keep the default. Change it when: Only if long runs fail with expired sign-ins.",
|        "docUrl": "https://invardia.com/docs/si/settings/GraphReconnectMaxAgeMinutes/"
|      }
|    },
|    {
|      "name": "Location",
|      "label": "Azure region (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "westeurope",
|      "defaultText": "westeurope; the workspace resource group's region wins when it exists",
|      "description": "--- Region (used when the engine has to create any missing infra) ---",
|      "purpose": "Older name for the Azure region Risk Analysis uses when it has to create a missing workspace or ingestion resources.",
|      "effect": "Used only when SI_Location is not set, and only when Risk Analysis creates missing resources. Existing resources are not moved.",
|      "whenToChange": "Never on new installs; set SI_Location instead.",
|      "info": {
|        "what": "Older name for the Azure region Risk Analysis uses when it has to create a missing workspace or ingestion resources.",
|        "whenChanged": "Used only when SI_Location is not set, and only when Risk Analysis creates missing resources. Existing resources are not moved.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "westeurope; the workspace resource group's region wins when it exists",
|        "recommended": "Keep the default. Change it when: Never on new installs; set SI_Location instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/Location/"
|      }
|    },
|    {
|      "name": "LockedYamlFile",
|      "label": "Shipped asset tagging rules file",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [
|        "asset-tagging"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "AssetTagging.locked.yaml",
|      "defaultText": "AssetTagging.locked.yaml",
|      "description": "The rule files, in the engine's rules folder (SettingsPath).",
|      "purpose": "File name of the shipped asset tagging rules in the rules folder.",
|      "effect": "The engine loads the shipped rules from this file. A wrong name loses the shipped rules; with neither rules file present the run stops. Ignored when rules come from the Pro settings database.",
|      "whenToChange": "Practically never; the shipped name should be kept.",
|      "info": {
|        "what": "File name of the shipped asset tagging rules in the rules folder.",
|        "whenChanged": "The engine loads the shipped rules from this file. A wrong name loses the shipped rules; with neither rules file present the run stops. Ignored when rules come from the Pro settings database.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Read by: asset-tagging.",
|        "default": "AssetTagging.locked.yaml",
|        "recommended": "Keep the default. Change it when: Practically never; the shipped name should be kept.",
|        "docUrl": "https://invardia.com/docs/si/settings/LockedYamlFile/"
|      }
|    },
|    {
|      "name": "Mail_CloseLoop_Daily_SendMail",
|      "label": "Send the daily vulnerability mail",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "SERVICENOW -- ONE ROUTE (#914). SecurityInsight never writes ServiceNow configuration items or vulnerable items itself: it delivers to STAGING -- the hand-off database (SQL views ServiceNow imports through a JDBC data source) or the ServiceNow data-out connector (Import Set tables, the SI_DataOut_ServiceNow* settings above) -- and ServiceNow's own import / transform rules make every change. The older push and its settings (SI_ServiceNow_ImportSetTable, SI_ServiceNow_ImportSetMaxRows, SI_VulnSync_ServiceNowImportSetTable, SI_ServiceNow_DirectWrite, SI_VulnSync_ServiceNowDirectWrite) were removed. The vulnerability close-loop's DAILY MAIL (Pro; edited on the management GUI's e-mail settings page): the last 24 hours' opened, closed and reopened vulnerabilities by severity and asset tier, what is open now, and the mean time to fix, sent after the close-loop run through the same relay as the Risk Analysis mail. Off by default.",
|      "purpose": "Sends one mail a day with the vulnerabilities opened, closed and reopened in the last 24 hours, what is open now and the mean time to fix.",
|      "effect": "On: a daily job mails the summary to the close-loop recipients through the same mail server as the Risk Analysis mail. Nothing is sent without recipients.",
|      "whenToChange": "Turn on when the team should get a daily view of vulnerability progress.",
|      "card": "Daily vulnerability mail",
|      "info": {
|        "what": "Sends one mail a day with the vulnerabilities opened, closed and reopened in the last 24 hours, what is open now and the mean time to fix.",
|        "whenOn": "a daily job mails the summary to the close-loop recipients through the same mail server as the Risk Analysis mail. Nothing is sent without recipients.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Off",
|        "recommended": "Keep the default. Change it when: Turn on when the team should get a daily view of vulnerability progress.",
|        "docUrl": "https://invardia.com/docs/si/settings/Mail_CloseLoop_Daily_SendMail/"
|      }
|    },
|    {
|      "name": "Mail_CloseLoop_Daily_SendTimeUtc",
|      "label": "Daily vulnerability mail time (UTC)",
|      "group": "Mail & notifications",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "10:45 UTC, after the close-loop and data sync",
|      "description": "The time of day (UTC, HH:mm) the daily mail job runs. Default 10:45, after the close-loop; a changed time takes effect when setup (Bootstrap-ContainerAppJob.ps1) is run again.",
|      "purpose": "The time of day, in UTC, the daily vulnerability mail is sent.",
|      "effect": "Moves when the daily mail is sent. A time before the close-loop finishes mails yesterday's state. An invalid value falls back to 10:45. Takes effect when setup is run again.",
|      "whenToChange": "Only to fit recipients' working hours; keep it after the close-loop run.",
|      "patternHint": "HH:mm, UTC",
|      "pattern": "^([01][0-9]|2[0-3]):[0-5][0-9]$",
|      "card": "Daily vulnerability mail",
|      "hint": "HH:mm. Takes effect when setup runs again.",
|      "needs": "Mail_CloseLoop_Daily_SendMail",
|      "info": {
|        "what": "The time of day, in UTC, the daily vulnerability mail is sent.",
|        "whenChanged": "Moves when the daily mail is sent. A time before the close-loop finishes mails yesterday's state. An invalid value falls back to 10:45. Takes effect when setup is run again.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"Send the daily vulnerability mail\" is on. A SecurityInsight Pro licence.",
|        "default": "10:45 UTC, after the close-loop and data sync",
|        "recommended": "Keep the default. Change it when: Only to fit recipients' working hours; keep it after the close-loop run.",
|        "docUrl": "https://invardia.com/docs/si/settings/Mail_CloseLoop_Daily_SendTimeUtc/"
|      }
|    },
|    {
|      "name": "Mail_CloseLoop_Daily_To",
|      "label": "Daily vulnerability mail recipients",
|      "group": "Mail & notifications",
|      "type": "list",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "No recipients: the mail is not sent, and the run says so",
|      "description": "Who receives the close-loop daily mail.",
|      "purpose": "The addresses that receive the daily vulnerability mail.",
|      "effect": "Adding addresses makes the daily close-loop mail go to them, provided Mail_CloseLoop_Daily_SendMail is on. Removing them all stops the mail without failing the job.",
|      "whenToChange": "Set it when you turn on the close-loop daily mail, or when the team that follows up on fixes changes.",
|      "card": "Daily vulnerability mail",
|      "needs": "Mail_CloseLoop_Daily_SendMail",
|      "itemFormat": "email",
|      "info": {
|        "what": "The addresses that receive the daily vulnerability mail.",
|        "whenChanged": "Adding addresses makes the daily close-loop mail go to them, provided Mail_CloseLoop_Daily_SendMail is on. Removing them all stops the mail without failing the job.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"Send the daily vulnerability mail\" is on. A SecurityInsight Pro licence.",
|        "default": "No recipients: the mail is not sent, and the run says so",
|        "recommended": "Keep the default. Change it when: Set it when you turn on the close-loop daily mail, or when the team that follows up on fixes changes.",
|        "docUrl": "https://invardia.com/docs/si/settings/Mail_CloseLoop_Daily_To/"
|      }
|    },
|    {
|      "name": "Mail_SecurityInsight_Detailed_SendMail",
|      "label": "Detailed report mail on (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: RiskAnalysis_Detailed_SendMail or SendMail decides",
|      "description": "Older name for turning on e-mail of the Detailed risk-analysis report; used only when RiskAnalysis_Detailed_SendMail is not set.",
|      "purpose": "Older name for switching e-mail of the Detailed Risk Analysis report on or off.",
|      "effect": "Same as RiskAnalysis_Detailed_SendMail, which wins when both are set.",
|      "whenToChange": "Only kept for older configuration files; use RiskAnalysis_Detailed_SendMail instead.",
|      "info": {
|        "what": "Older name for switching e-mail of the Detailed Risk Analysis report on or off.",
|        "whenOn": "Same as RiskAnalysis_Detailed_SendMail, which wins when both are set.",
|        "whenOff": "Not set: RiskAnalysis_Detailed_SendMail or SendMail decides",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: RiskAnalysis_Detailed_SendMail or SendMail decides",
|        "recommended": "Keep the default. Change it when: Only kept for older configuration files; use RiskAnalysis_Detailed_SendMail instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/Mail_SecurityInsight_Detailed_SendMail/"
|      }
|    },
|    {
|      "name": "Mail_SecurityInsight_Detailed_To",
|      "label": "Detailed report recipients (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: RiskAnalysis_Detailed_To, else MailTo, is used",
|      "description": "Older name for the Detailed report recipient list; used only when RiskAnalysis_Detailed_To is empty.",
|      "purpose": "Older name for the recipient list of the Detailed Risk Analysis report.",
|      "effect": "Same as RiskAnalysis_Detailed_To, which wins when both are set.",
|      "whenToChange": "Only kept for older configuration files; use RiskAnalysis_Detailed_To instead.",
|      "itemFormat": "email",
|      "info": {
|        "what": "Older name for the recipient list of the Detailed Risk Analysis report.",
|        "whenChanged": "Same as RiskAnalysis_Detailed_To, which wins when both are set.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: RiskAnalysis_Detailed_To, else MailTo, is used",
|        "recommended": "Keep the default. Change it when: Only kept for older configuration files; use RiskAnalysis_Detailed_To instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/Mail_SecurityInsight_Detailed_To/"
|      }
|    },
|    {
|      "name": "Mail_SecurityInsight_Summary_SendMail",
|      "label": "Summary report mail on (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: RiskAnalysis_Summary_SendMail or SendMail decides",
|      "description": "AF-prefixed equivalents (internal AutomationFramework reads these).",
|      "purpose": "Older name for switching e-mail of the Summary Risk Analysis report on or off.",
|      "effect": "Same as RiskAnalysis_Summary_SendMail, which wins when both are set.",
|      "whenToChange": "Only kept for older configuration files; use RiskAnalysis_Summary_SendMail instead.",
|      "info": {
|        "what": "Older name for switching e-mail of the Summary Risk Analysis report on or off.",
|        "whenOn": "Same as RiskAnalysis_Summary_SendMail, which wins when both are set.",
|        "whenOff": "Not set: RiskAnalysis_Summary_SendMail or SendMail decides",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: RiskAnalysis_Summary_SendMail or SendMail decides",
|        "recommended": "Keep the default. Change it when: Only kept for older configuration files; use RiskAnalysis_Summary_SendMail instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/Mail_SecurityInsight_Summary_SendMail/"
|      }
|    },
|    {
|      "name": "Mail_SecurityInsight_Summary_To",
|      "label": "Summary report recipients (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: RiskAnalysis_Summary_To, else MailTo, is used",
|      "description": "Older name for the Summary report recipient list; used only when RiskAnalysis_Summary_To is empty.",
|      "purpose": "Older name for the recipient list of the Summary Risk Analysis report.",
|      "effect": "Same as RiskAnalysis_Summary_To, which wins when both are set.",
|      "whenToChange": "Only kept for older configuration files; use RiskAnalysis_Summary_To instead.",
|      "itemFormat": "email",
|      "info": {
|        "what": "Older name for the recipient list of the Summary Risk Analysis report.",
|        "whenChanged": "Same as RiskAnalysis_Summary_To, which wins when both are set.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: RiskAnalysis_Summary_To, else MailTo, is used",
|        "recommended": "Keep the default. Change it when: Only kept for older configuration files; use RiskAnalysis_Summary_To instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/Mail_SecurityInsight_Summary_To/"
|      }
|    },
|    {
|      "name": "Mail_SendAnonymous",
|      "label": "Send mail without sign-in",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off: the mail server sign-in (user, password, sender) is required",
|      "description": "anonymous relay (no creds; not common)",
|      "purpose": "Sends mail through a relay that accepts mail without a user name and password.",
|      "effect": "On: no SMTP credentials are needed or checked. Off with mail switched on: the run stops at start if the sender, user or password is missing. A relay that requires sign-in rejects anonymous mail.",
|      "whenToChange": "Only when your internal relay accepts unauthenticated mail from this host.",
|      "card": "Mail server",
|      "info": {
|        "what": "Sends mail through a relay that accepts mail without a user name and password.",
|        "whenOn": "no SMTP credentials are needed or checked. Off with mail switched on: the run stops at start if the sender, user or password is missing. A relay that requires sign-in rejects anonymous mail.",
|        "whenOff": "the mail server sign-in (user, password, sender) is required",
|        "risk": "Mail is sent without signing in to the mail server: only safe through an internal relay that accepts mail from this host alone. With an open relay, report mails can be spoofed or intercepted. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off: the mail server sign-in (user, password, sender) is required",
|        "recommended": "Off (sign in to the mail server, or use the shared mailbox).",
|        "docUrl": "https://invardia.com/docs/si/settings/Mail_SendAnonymous/",
|        "confirmWhen": "on",
|        "confirm": "no SMTP credentials are needed or checked. Off with mail switched on: the run stops at start if the sender, user or password is missing. A relay that requires sign-in rejects anonymous mail. Mail is sent without signing in to the mail server: only safe through an internal relay that accepts mail from this host alone. With an open relay, report mails can be spoofed or intercepted. Reversible at once."
|      }
|    },
|    {
|      "name": "MailTo",
|      "label": "Default recipients",
|      "group": "Mail & notifications",
|      "type": "list",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Empty (no recipients)",
|      "description": "Fallback list of e-mail recipients for risk-analysis reports, used when no report-specific (Summary or Detailed) recipient list is set.",
|      "purpose": "The addresses that receive every Risk Analysis report that has no recipient list of its own.",
|      "effect": "Reports go to these addresses unless a report-specific list exists. If mail is switched on and no recipient list is set anywhere, the run stops at start.",
|      "whenToChange": "Set it when one group should receive every Risk Analysis report.",
|      "card": "Risk Analysis report mails",
|      "hint": "Get every report without a list of its own.",
|      "itemFormat": "email",
|      "info": {
|        "what": "The addresses that receive every Risk Analysis report that has no recipient list of its own.",
|        "whenChanged": "Reports go to these addresses unless a report-specific list exists. If mail is switched on and no recipient list is set anywhere, the run stops at start.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Empty (no recipients)",
|        "recommended": "Keep the default. Change it when: Set it when one group should receive every Risk Analysis report.",
|        "docUrl": "https://invardia.com/docs/si/settings/MailTo/"
|      }
|    },
|    {
|      "name": "MaxAiSpendPerRun",
|      "label": "AI spend limit per run",
|      "group": "AI",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Container jobs: 4 US dollars. VM runs: no limit",
|      "description": "AI spend ceiling for one orchestrator run (USD). Stage Classify stops when reached; remaining rows tagged SI_Classify_Status='budget-capped'. Default 4.",
|      "purpose": "Caps the estimated Azure OpenAI spend (in US dollars) of AI classification in one profiling run.",
|      "effect": "When the estimate reaches the cap, remaining assets are classified without AI and marked as budget-capped. Higher caps allow more AI classification at more cost.",
|      "whenToChange": "Raise for large estates using AI classification; lower to control cost.",
|      "unit": "USD",
|      "info": {
|        "what": "Caps the estimated Azure OpenAI spend (in US dollars) of AI classification in one profiling run.",
|        "whenChanged": "When the estimate reaches the cap, remaining assets are classified without AI and marked as budget-capped. Higher caps allow more AI classification at more cost.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Nothing else.",
|        "default": "Container jobs: 4 US dollars. VM runs: no limit",
|        "recommended": "Keep the default. Change it when: Raise for large estates using AI classification; lower to control cost.",
|        "docUrl": "https://invardia.com/docs/si/settings/MaxAiSpendPerRun/"
|      }
|    },
|    {
|      "name": "OpenAI_apiKey",
|      "label": "Azure OpenAI key (Key Vault secret name)",
|      "group": "AI",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": true,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: AI classification is skipped; an AI summary request fails",
|      "description": "These four values are required when ANY engine has AI enabled (SI_EnableAI, SI_EnableAI_<engine>, BuildSummaryByAI, or SI_PrivilegeTierClassifier_RunAI).",
|      "purpose": "The NAME of the Key Vault secret that holds the key of your Azure OpenAI resource -- never the key itself. Get Started > AI integration stores the key in your Key Vault and fills this in.",
|      "effect": "With endpoint and deployment set, AI features can run. Keep it in Key Vault rather than in a file.",
|      "whenToChange": "When turning on AI features or rotating the key.",
|      "card": "Azure OpenAI connection",
|      "info": {
|        "what": "The NAME of the Key Vault secret that holds the key of your Azure OpenAI resource -- never the key itself. Get Started > AI integration stores the key in your Key Vault and fills this in.",
|        "whenChanged": "With endpoint and deployment set, AI features can run. Keep it in Key Vault rather than in a file.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Kept in the install's Key Vault. Read by: risk-analysis.",
|        "default": "Not set: AI classification is skipped; an AI summary request fails",
|        "recommended": "Keep the default. Change it when: When turning on AI features or rotating the key.",
|        "docUrl": "https://invardia.com/docs/si/settings/OpenAI_apiKey/"
|      }
|    },
|    {
|      "name": "OpenAI_apiVersion",
|      "label": "Azure OpenAI API version",
|      "group": "AI",
|      "type": "text",
|      "engines": [
|        "privilege-tier-classifier",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "2024-08-01-preview",
|      "defaultText": "2024-08-01-preview (Risk Analysis, the tier classifier and the profiling engines alike)",
|      "description": "OpenAI API version default. Engine reads this to build the chat-completions URL. Setup-SecurityInsight's OpenAI phase will overwrite if it provisioned the AOAI deployment; this default protects ad-hoc classifier runs that never touched Setup. Carried over from v2.1 Build_Tier_Definitions defaults.",
|      "purpose": "The Azure OpenAI API version used when calling your model deployment.",
|      "effect": "Must be a version your Azure OpenAI resource supports; an unsupported version makes AI calls fail.",
|      "whenToChange": "Rarely; when your deployment needs a newer API version.",
|      "info": {
|        "what": "The Azure OpenAI API version used when calling your model deployment.",
|        "whenChanged": "Must be a version your Azure OpenAI resource supports; an unsupported version makes AI calls fail.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: privilege-tier-classifier, risk-analysis.",
|        "default": "2024-08-01-preview (Risk Analysis, the tier classifier and the profiling engines alike)",
|        "recommended": "Keep the default. Change it when: Rarely; when your deployment needs a newer API version.",
|        "docUrl": "https://invardia.com/docs/si/settings/OpenAI_apiVersion/"
|      }
|    },
|    {
|      "name": "OpenAI_deployment",
|      "label": "Azure OpenAI deployment",
|      "group": "AI",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: AI classification is skipped; an AI summary request fails",
|      "description": "Name of the Azure OpenAI model deployment used for AI classification and AI summaries; AI features stay off unless endpoint, key and deployment are all set.",
|      "purpose": "Name of the Azure OpenAI model deployment used for AI classification and AI summaries.",
|      "effect": "Chooses which model answers; a larger model may give better text at higher cost. AI features stay off unless endpoint, key and deployment are all set.",
|      "whenToChange": "When turning on AI features or moving to another model deployment.",
|      "card": "Azure OpenAI connection",
|      "info": {
|        "what": "Name of the Azure OpenAI model deployment used for AI classification and AI summaries.",
|        "whenChanged": "Chooses which model answers; a larger model may give better text at higher cost. AI features stay off unless endpoint, key and deployment are all set.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Not set: AI classification is skipped; an AI summary request fails",
|        "recommended": "Keep the default. Change it when: When turning on AI features or moving to another model deployment.",
|        "docUrl": "https://invardia.com/docs/si/settings/OpenAI_deployment/"
|      }
|    },
|    {
|      "name": "OpenAI_endpoint",
|      "label": "Azure OpenAI endpoint",
|      "group": "AI",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: AI classification is skipped and AI summaries cannot run.",
|      "description": "URL of your Azure OpenAI resource used for AI classification and AI summaries; AI features stay off unless endpoint, key and deployment are all set.",
|      "purpose": "The web address of your Azure OpenAI resource, used for AI classification, AI tiering of roles and AI report summaries.",
|      "effect": "With endpoint, key and deployment all set, engines that have AI switched on call your Azure OpenAI. Missing it, profiling falls back to rule-based tiers, role tiering marks items for manual review, and an AI summary request stops the report run.",
|      "whenToChange": "Set it when you want AI features; change it only when you move to another Azure OpenAI resource.",
|      "card": "Azure OpenAI connection",
|      "info": {
|        "what": "The web address of your Azure OpenAI resource, used for AI classification, AI tiering of roles and AI report summaries.",
|        "whenChanged": "With endpoint, key and deployment all set, engines that have AI switched on call your Azure OpenAI. Missing it, profiling falls back to rule-based tiers, role tiering marks items for manual review, and an AI summary request stops the report run.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Not set: AI classification is skipped and AI summaries cannot run.",
|        "recommended": "Keep the default. Change it when: Set it when you want AI features; change it only when you move to another Azure OpenAI resource.",
|        "docUrl": "https://invardia.com/docs/si/settings/OpenAI_endpoint/"
|      }
|    },
|    {
|      "name": "OpenAI_MaxTokensPerRequest",
|      "label": "AI summary answer length",
|      "group": "AI",
|      "type": "int",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 16384,
|      "defaultText": "16384 tokens, unless the older AI_MaxTokensPerRequest is set",
|      "description": "Maximum number of tokens the AI may return per request when building risk-analysis summaries; defaults to 16384.",
|      "purpose": "The largest answer, in tokens, the AI may return for each risk-analysis summary request.",
|      "effect": "Higher allows longer AI summaries but costs more per call and may exceed what your model deployment allows; lower gives shorter, cheaper summaries that may be cut off.",
|      "whenToChange": "Rarely; lower it if your model has a smaller limit, raise it if summaries are cut short.",
|      "unit": "tokens",
|      "info": {
|        "what": "The largest answer, in tokens, the AI may return for each risk-analysis summary request.",
|        "whenChanged": "Higher allows longer AI summaries but costs more per call and may exceed what your model deployment allows; lower gives shorter, cheaper summaries that may be cut off.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: risk-analysis.",
|        "default": "16384 tokens, unless the older AI_MaxTokensPerRequest is set",
|        "recommended": "Keep the default. Change it when: Rarely; lower it if your model has a smaller limit, raise it if summaries are cut short.",
|        "docUrl": "https://invardia.com/docs/si/settings/OpenAI_MaxTokensPerRequest/"
|      }
|    },
|    {
|      "name": "OverwriteXlsx",
|      "label": "Replace Excel workbook each run",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": true,
|      "defaultText": "On: a fresh workbook every run.",
|      "description": "When on (default), risk analysis deletes the previous Excel workbook at the start of a run and writes a fresh one instead of adding to it.",
|      "purpose": "Deletes the previous risk analysis Excel workbook at the start of a run and writes a fresh one.",
|      "effect": "Off, the run writes into the existing workbook instead, so older content can remain alongside new results.",
|      "whenToChange": "Almost never.",
|      "info": {
|        "what": "Deletes the previous risk analysis Excel workbook at the start of a run and writes a fresh one.",
|        "whenOn": "a fresh workbook every run.",
|        "whenOff": "Off, the run writes into the existing workbook instead, so older content can remain alongside new results.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "On: a fresh workbook every run.",
|        "recommended": "Keep the default. Change it when: Almost never.",
|        "docUrl": "https://invardia.com/docs/si/settings/OverwriteXlsx/"
|      }
|    },
|    {
|      "name": "RA_MailEvenIfEmpty",
|      "label": "Mail reports with no findings",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: a report with no rows is not mailed.",
|      "description": "Send the report mail even when a run produced 0 rows (a heartbeat). Default: an empty report is not mailed.",
|      "purpose": "Sends the report mail even when a run found nothing, as a sign the job ran.",
|      "effect": "When on, recipients get a mail after every run, including empty ones, confirming the job is alive. When off, an empty run sends nothing.",
|      "whenToChange": "Turn on if you want a daily confirmation mail even when there are no findings.",
|      "card": "Risk Analysis report mails",
|      "info": {
|        "what": "Sends the report mail even when a run found nothing, as a sign the job ran.",
|        "whenOn": "When on, recipients get a mail after every run, including empty ones, confirming the job is alive. When off, an empty run sends nothing.",
|        "whenOff": "a report with no rows is not mailed.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Nothing else.",
|        "default": "Off: a report with no rows is not mailed.",
|        "recommended": "Keep the default. Change it when: Turn on if you want a daily confirmation mail even when there are no findings.",
|        "docUrl": "https://invardia.com/docs/si/settings/RA_MailEvenIfEmpty/"
|      }
|    },
|    {
|      "name": "ReportTemplate",
|      "label": "Risk analysis report template",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "RiskAnalysis_Summary",
|      "defaultText": "RiskAnalysis_Summary.",
|      "description": "Two templates ship in the Locked YAML: RiskAnalysis_Summary (default; compact summary across all areas) RiskAnalysis_Detailed (full per-row detail, larger Excel, slower)",
|      "purpose": "Names the report template risk analysis runs: RiskAnalysis_Summary (compact) or RiskAnalysis_Detailed (one row per finding).",
|      "effect": "The launchers and containers set this themselves from the command line or the per-mode template settings, so a value in the config file is only honoured when the engine is run directly.",
|      "whenToChange": "Use RiskAnalysis_ReportTemplate_Default_Summary or _Detailed, or -ReportTemplate, instead.",
|      "info": {
|        "what": "Names the report template risk analysis runs: RiskAnalysis_Summary (compact) or RiskAnalysis_Detailed (one row per finding).",
|        "whenChanged": "The launchers and containers set this themselves from the command line or the per-mode template settings, so a value in the config file is only honoured when the engine is run directly.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "RiskAnalysis_Summary.",
|        "recommended": "Keep the default. Change it when: Use RiskAnalysis_ReportTemplate_Default_Summary or _Detailed, or -ReportTemplate, instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/ReportTemplate/"
|      }
|    },
|    {
|      "name": "ResetCache",
|      "label": "Reset query split memory",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off.",
|      "description": "force fresh bucket probe",
|      "purpose": "Deletes the saved query split counts at the start of a run so they are probed again.",
|      "effect": "On, the next run re-probes every large query from scratch, so it takes longer; the new counts are saved again afterwards.",
|      "whenToChange": "For one run when reports look incomplete or after a large estate change.",
|      "info": {
|        "what": "Deletes the saved query split counts at the start of a run so they are probed again.",
|        "whenOn": "On, the next run re-probes every large query from scratch, so it takes longer; the new counts are saved again afterwards.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off.",
|        "recommended": "Keep the default. Change it when: For one run when reports look incomplete or after a large estate change.",
|        "docUrl": "https://invardia.com/docs/si/settings/ResetCache/"
|      }
|    },
|    {
|      "name": "RiskAnalysis_Detailed_Override",
|      "label": "Default to Detailed mode",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: runs default to Summary mode.",
|      "description": "When on, risk analysis runs in Detailed mode by default unless Summary is explicitly requested on the command line; off by default.",
|      "purpose": "Makes risk analysis run in Detailed mode unless Summary is asked for on the command line.",
|      "effect": "On, scheduled runs produce one row per affected asset: larger Excel files, longer runs, more data ingested, and the Detailed mail recipients. Cannot be on together with RiskAnalysis_Summary_Override.",
|      "whenToChange": "When a host should produce Detailed reports by default.",
|      "card": "Report mode and output",
|      "hint": "Used when a run does not say which report.",
|      "info": {
|        "what": "Makes risk analysis run in Detailed mode unless Summary is asked for on the command line.",
|        "whenOn": "On, scheduled runs produce one row per affected asset: larger Excel files, longer runs, more data ingested, and the Detailed mail recipients. Cannot be on together with RiskAnalysis_Summary_Override.",
|        "whenOff": "runs default to Summary mode.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off: runs default to Summary mode.",
|        "recommended": "Keep the default. Change it when: When a host should produce Detailed reports by default.",
|        "docUrl": "https://invardia.com/docs/si/settings/RiskAnalysis_Detailed_Override/"
|      }
|    },
|    {
|      "name": "RiskAnalysis_Detailed_SendMail",
|      "label": "Mail the Detailed report",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the older name, else SendMail (off) decides",
|      "description": "# Required by Hosted relays. # Omit to fall back to $SMTPUser (legacy). Per-template recipients (also works in AF mode; legacy $global:Mail_SecurityInsight_* names are still accepted as a fallback):",
|      "purpose": "Mails the Detailed Risk Analysis report after each run.",
|      "effect": "On: each Detailed run mails the full report to its recipients; this needs working mail server settings. A report template's own mail switch still wins.",
|      "whenToChange": "Turn on when the security team should receive the full Detailed report by mail.",
|      "card": "Risk Analysis report mails",
|      "hint": "Not set: Mail every report decides.",
|      "info": {
|        "what": "Mails the Detailed Risk Analysis report after each run.",
|        "whenOn": "each Detailed run mails the full report to its recipients; this needs working mail server settings. A report template's own mail switch still wins.",
|        "whenOff": "Not set: the older name, else SendMail (off) decides",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Not set: the older name, else SendMail (off) decides",
|        "recommended": "Keep the default. Change it when: Turn on when the security team should receive the full Detailed report by mail.",
|        "docUrl": "https://invardia.com/docs/si/settings/RiskAnalysis_Detailed_SendMail/"
|      }
|    },
|    {
|      "name": "RiskAnalysis_Detailed_To",
|      "label": "Detailed report recipients",
|      "group": "Mail & notifications",
|      "type": "list",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the older name, else MailTo, is used",
|      "description": "E-mail recipients for the Detailed risk-analysis report; falls back to MailTo when empty.",
|      "purpose": "The addresses that receive the Detailed Risk Analysis report.",
|      "effect": "Detailed reports go to these addresses instead of the default list. Blank entries are dropped with a warning. A report template's own recipients still win.",
|      "whenToChange": "Set it when the Detailed report should go to different people than the default list.",
|      "card": "Risk Analysis report mails",
|      "hint": "Empty: the default recipients get it.",
|      "itemFormat": "email",
|      "info": {
|        "what": "The addresses that receive the Detailed Risk Analysis report.",
|        "whenChanged": "Detailed reports go to these addresses instead of the default list. Blank entries are dropped with a warning. A report template's own recipients still win.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Not set: the older name, else MailTo, is used",
|        "recommended": "Keep the default. Change it when: Set it when the Detailed report should go to different people than the default list.",
|        "docUrl": "https://invardia.com/docs/si/settings/RiskAnalysis_Detailed_To/"
|      }
|    },
|    {
|      "name": "RiskAnalysis_ReportTemplate_Default_Detailed",
|      "label": "Detailed report template",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "RiskAnalysis_Detailed.",
|      "description": "Report template used when risk analysis runs in Detailed mode and no template is named explicitly; defaults to RiskAnalysis_Detailed.",
|      "purpose": "The report template used for Detailed runs when no template is named explicitly.",
|      "effect": "Detailed runs and the Detailed container job use the named template instead. A template name that does not exist makes the run fail.",
|      "whenToChange": "When you have created your own Detailed template.",
|      "info": {
|        "what": "The report template used for Detailed runs when no template is named explicitly.",
|        "whenChanged": "Detailed runs and the Detailed container job use the named template instead. A template name that does not exist makes the run fail.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "RiskAnalysis_Detailed.",
|        "recommended": "Keep the default. Change it when: When you have created your own Detailed template.",
|        "docUrl": "https://invardia.com/docs/si/settings/RiskAnalysis_ReportTemplate_Default_Detailed/"
|      }
|    },
|    {
|      "name": "RiskAnalysis_ReportTemplate_Default_Summary",
|      "label": "Summary report template",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "RiskAnalysis_Summary.",
|      "description": "Per-mode ReportTemplate override (every template is auto-bucketed for large estates).",
|      "purpose": "The report template used for Summary runs when no template is named explicitly.",
|      "effect": "Summary runs and the Summary container job use the named template instead. A template name that does not exist makes the run fail.",
|      "whenToChange": "When you have created your own Summary template.",
|      "info": {
|        "what": "The report template used for Summary runs when no template is named explicitly.",
|        "whenChanged": "Summary runs and the Summary container job use the named template instead. A template name that does not exist makes the run fail.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "RiskAnalysis_Summary.",
|        "recommended": "Keep the default. Change it when: When you have created your own Summary template.",
|        "docUrl": "https://invardia.com/docs/si/settings/RiskAnalysis_ReportTemplate_Default_Summary/"
|      }
|    },
|    {
|      "name": "RiskAnalysis_Summary_Override",
|      "label": "Default to Summary mode",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Summary mode is already the launcher's default.",
|      "description": "Mode override (per-run). Mutually exclusive: Summary (tier-rolled-up) vs Detailed (one row per affected identity/device).",
|      "purpose": "Makes risk analysis run in Summary mode unless Detailed is asked for on the command line.",
|      "effect": "On keeps runs in compact Summary mode with the Summary table and recipients. Cannot be on together with RiskAnalysis_Detailed_Override; set it off when you switch a host to Detailed.",
|      "whenToChange": "Rarely; only to make the Summary choice explicit.",
|      "card": "Report mode and output",
|      "hint": "Used when a run does not say which report.",
|      "info": {
|        "what": "Makes risk analysis run in Summary mode unless Detailed is asked for on the command line.",
|        "whenOn": "On keeps runs in compact Summary mode with the Summary table and recipients. Cannot be on together with RiskAnalysis_Detailed_Override; set it off when you switch a host to Detailed.",
|        "whenOff": "Summary mode is already the launcher's default.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Summary mode is already the launcher's default.",
|        "recommended": "Keep the default. Change it when: Rarely; only to make the Summary choice explicit.",
|        "docUrl": "https://invardia.com/docs/si/settings/RiskAnalysis_Summary_Override/"
|      }
|    },
|    {
|      "name": "RiskAnalysis_Summary_SendMail",
|      "label": "Mail the Summary report",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the older name, else SendMail (off) decides",
|      "description": "Per-mode mail routing for RiskAnalysis (community short names).",
|      "purpose": "Mails the Summary Risk Analysis report after each run.",
|      "effect": "On: each Summary run mails the report to its recipients; this needs working mail server settings. A report template's own mail switch still wins. While the Summary step is off (the default since 2026-10), the management mail -- the Detailed report's mail, with its management summary -- goes to these recipients instead.",
|      "whenToChange": "Turn on when management or the security team should receive the Summary report by mail.",
|      "card": "Risk Analysis report mails",
|      "hint": "Not set: Mail every report decides.",
|      "info": {
|        "what": "Mails the Summary Risk Analysis report after each run.",
|        "whenOn": "each Summary run mails the report to its recipients; this needs working mail server settings. A report template's own mail switch still wins. While the Summary step is off (the default since 2026-10), the management mail -- the Detailed report's mail, with its management summary -- goes to these recipients instead.",
|        "whenOff": "Not set: the older name, else SendMail (off) decides",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Not set: the older name, else SendMail (off) decides",
|        "recommended": "Keep the default. Change it when: Turn on when management or the security team should receive the Summary report by mail.",
|        "docUrl": "https://invardia.com/docs/si/settings/RiskAnalysis_Summary_SendMail/"
|      }
|    },
|    {
|      "name": "RiskAnalysis_Summary_To",
|      "label": "Summary report recipients",
|      "group": "Mail & notifications",
|      "type": "list",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the older name, else MailTo, is used",
|      "description": "E-mail recipients for the Summary risk-analysis report; falls back to MailTo when empty.",
|      "purpose": "The addresses that receive the Summary Risk Analysis report.",
|      "effect": "Summary reports go to these addresses instead of the default list. Blank entries are dropped with a warning. A report template's own recipients still win. While the Summary step is off (the default since 2026-10), these addresses receive the management mail -- the Detailed report's mail -- when Mail the Summary report is on.",
|      "whenToChange": "Set it when the Summary report should go to different people than the default list.",
|      "card": "Risk Analysis report mails",
|      "hint": "Empty: the default recipients get it.",
|      "itemFormat": "email",
|      "info": {
|        "what": "The addresses that receive the Summary Risk Analysis report.",
|        "whenChanged": "Summary reports go to these addresses instead of the default list. Blank entries are dropped with a warning. A report template's own recipients still win. While the Summary step is off (the default since 2026-10), these addresses receive the management mail -- the Detailed report's mail -- when Mail the Summary report is on.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Not set: the older name, else MailTo, is used",
|        "recommended": "Keep the default. Change it when: Set it when the Summary report should go to different people than the default list.",
|        "docUrl": "https://invardia.com/docs/si/settings/RiskAnalysis_Summary_To/"
|      }
|    },
|    {
|      "name": "Scope",
|      "label": "Asset tagging rule scope",
|      "group": "Connectors & CMDB",
|      "type": "list",
|      "engines": [
|        "asset-tagging",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "PROD",
|      "defaultText": "PROD: only production rules run.",
|      "description": "or @('TEST')",
|      "purpose": "Which asset tagging rules run, by the mode each rule is marked with: PROD, TEST, or both.",
|      "effect": "Adding TEST also runs rules marked as test rules, which can tag assets with untried logic. Rules whose mode is not listed are skipped. Risk analysis does not read this setting.",
|      "whenToChange": "To try new tagging rules marked TEST before promoting them.",
|      "info": {
|        "what": "Which asset tagging rules run, by the mode each rule is marked with: PROD, TEST, or both.",
|        "whenChanged": "Adding TEST also runs rules marked as test rules, which can tag assets with untried logic. Rules whose mode is not listed are skipped. Risk analysis does not read this setting.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Read by: asset-tagging, risk-analysis.",
|        "default": "PROD: only production rules run.",
|        "recommended": "Keep the default. Change it when: To try new tagging rules marked TEST before promoting them.",
|        "docUrl": "https://invardia.com/docs/si/settings/Scope/"
|      }
|    },
|    {
|      "name": "SendMail",
|      "label": "Mail every report",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off",
|      "description": "--- SMTP (RiskAnalysis email delivery) --- Hosted relays REJECT mail when From != verified sender, so $SMTPFrom must be a verified-sender address -- NOT the relay login.",
|      "purpose": "Mails each Risk Analysis report, unless a report's own switch says otherwise.",
|      "effect": "On: reports are mailed to MailTo (or the report-specific lists). The run stops at start if mail is on but no recipients or required mail server sign-in details are set.",
|      "whenToChange": "Turn on to mail every report; use the Summary/Detailed switches for finer control.",
|      "card": "Risk Analysis report mails",
|      "hint": "Used when a report's own switch below is not set.",
|      "info": {
|        "what": "Mails each Risk Analysis report, unless a report's own switch says otherwise.",
|        "whenOn": "reports are mailed to MailTo (or the report-specific lists). The run stops at start if mail is on but no recipients or required mail server sign-in details are set.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off",
|        "recommended": "Keep the default. Change it when: Turn on to mail every report; use the Summary/Detailed switches for finer control.",
|        "docUrl": "https://invardia.com/docs/si/settings/SendMail/"
|      }
|    },
|    {
|      "name": "SendToLogAnalytics",
|      "label": "Copy Risk Analysis report rows to Log Analytics (SI_RiskAnalysis_Detailed_CL)",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off: the report rows are kept in the database only",
|      "description": "--- Copy Risk Analysis report rows to Log Analytics (SI_RiskAnalysis_Detailed_CL) -- optional, off by default --- After each Risk Analysis run, copies its report rows (SI_RiskAnalysis_Detailed_CL; SI_RiskAnalysis_Summary_CL for the Summary report; the day's trend row in SI_Trend_CL) into your Log Analytics workspace, for your own workbooks, Sentinel or KQL. SecurityInsight itself does not need it: its pages read the results from its database. Adds ingestion cost.",
|      "purpose": "Optional. After each Risk Analysis run, copies its report rows into your Log Analytics workspace (SI_RiskAnalysis_Detailed_CL, and SI_RiskAnalysis_Summary_CL when the Summary report runs; the day's trend row in SI_Trend_CL), for your own workbooks, Sentinel or KQL. SecurityInsight itself does not need it: its pages, the data sync, the vulnerability connectors and the trends read the results from its database. On a large estate the copy takes a long time and adds Log Analytics ingestion cost. Off by default.",
|      "effect": "On: after every Risk Analysis run its report rows are also posted to SI_RiskAnalysis_Detailed_CL (SI_RiskAnalysis_Summary_CL for the Summary report), after the result is complete in the database, and the day's trend row to SI_Trend_CL. On a large estate that is close to an hour, and it costs ingestion for every row, every run. Off: nothing is copied; the Excel reports, the mail and everything SecurityInsight shows are unchanged. The Azure workbook in preview\\AzureWorkbook reads the copy, so it needs it on.",
|      "whenToChange": "Only when your own workbooks, Sentinel rules or KQL queries read SI_RiskAnalysis_Detailed_CL, SI_RiskAnalysis_Summary_CL or SI_Trend_CL; leave off otherwise.",
|      "card": "Report mode and output",
|      "hint": "Off = the report rows stay in the database. On = also a copy in Log Analytics (takes long on a large estate, costs ingestion).",
|      "info": {
|        "what": "Optional. After each Risk Analysis run, copies its report rows into your Log Analytics workspace (SI_RiskAnalysis_Detailed_CL, and SI_RiskAnalysis_Summary_CL when the Summary report runs; the day's trend row in SI_Trend_CL), for your own workbooks, Sentinel or KQL. SecurityInsight itself does not need it: its pages, the data sync, the vulnerability connectors and the trends read the results from its database. On a large estate the copy takes a long time and adds Log Analytics ingestion cost. Off by default.",
|        "whenOn": "after every Risk Analysis run its report rows are also posted to SI_RiskAnalysis_Detailed_CL (SI_RiskAnalysis_Summary_CL for the Summary report), after the result is complete in the database, and the day's trend row to SI_Trend_CL. On a large estate that is close to an hour, and it costs ingestion for every row, every run.",
|        "whenOff": "nothing is copied; the Excel reports, the mail and everything SecurityInsight shows are unchanged. The Azure workbook in preview\\AzureWorkbook reads the copy, so it needs it on.",
|        "risk": "Log Analytics ingestion cost for every report row, every run, and a longer run on a large estate. SecurityInsight itself does not need the copy: its pages, the data sync, the vulnerability connectors and the trends read the database. Reversible: turn it off and the next run copies nothing.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off: the report rows are kept in the database only",
|        "recommended": "Off, unless your own workbooks, Sentinel rules or KQL read the report rows in Log Analytics.",
|        "docUrl": "https://invardia.com/docs/si/settings/SendToLogAnalytics/",
|        "confirmWhen": "on",
|        "confirm": "Every Risk Analysis run will also copy its report rows to Log Analytics (SI_RiskAnalysis_Detailed_CL; SI_RiskAnalysis_Summary_CL for the Summary report; the trend row in SI_Trend_CL). On a large estate the copy takes close to an hour after each run; it adds ingestion cost."
|      }
|    },
|    {
|      "name": "SettingsPath",
|      "label": "Asset tagging rules folder",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [
|        "asset-tagging"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The shipped rule files next to the endpoint enrichment rules.",
|      "description": "Your own rules folder and file names (default: asset-profiling-enrichment\\endpoint, AssetTagging.*.yaml).",
|      "purpose": "The folder the asset tagging engine reads its tagging rule files from.",
|      "effect": "Point it at your own folder to tag with your own rule files instead of the shipped ones. A missing folder stops the run with a clear error. The Risk Analysis and privilege tier launchers set their own folder and ignore this value.",
|      "whenToChange": "Only when you keep your own tagging rule files outside the installation.",
|      "info": {
|        "what": "The folder the asset tagging engine reads its tagging rule files from.",
|        "whenChanged": "Point it at your own folder to tag with your own rule files instead of the shipped ones. A missing folder stops the run with a clear error. The Risk Analysis and privilege tier launchers set their own folder and ignore this value.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Read by: asset-tagging.",
|        "default": "The shipped rule files next to the endpoint enrichment rules.",
|        "recommended": "Keep the default. Change it when: Only when you keep your own tagging rule files outside the installation.",
|        "docUrl": "https://invardia.com/docs/si/settings/SettingsPath/"
|      }
|    },
|    {
|      "name": "SHODAN_ApiKey",
|      "label": "Shodan API key (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": true,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: the key under its current name is used; without any key, Shodan details stay empty.",
|      "description": "Shodan API key (required for the engine to do anything useful).",
|      "purpose": "Older name for the Shodan API key the public IP engine uses to look up your public IP addresses.",
|      "effect": "Used only when SI_Shodan_ApiKey is not set. Without any key the public IP engine still runs, but every Shodan field (open ports, services, vulnerabilities) is empty.",
|      "whenToChange": "Prefer SI_Shodan_ApiKey; keep this only for older configuration files.",
|      "info": {
|        "what": "Older name for the Shodan API key the public IP engine uses to look up your public IP addresses.",
|        "whenChanged": "Used only when SI_Shodan_ApiKey is not set. Without any key the public IP engine still runs, but every Shodan field (open ports, services, vulnerabilities) is empty.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Kept in the install's Key Vault.",
|        "default": "Not set: the key under its current name is used; without any key, Shodan details stay empty.",
|        "recommended": "Keep the default. Change it when: Prefer SI_Shodan_ApiKey; keep this only for older configuration files.",
|        "docUrl": "https://invardia.com/docs/si/settings/SHODAN_ApiKey/"
|      }
|    },
|    {
|      "name": "ShowConfig",
|      "label": "Show resolved configuration",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off.",
|      "description": "When on, risk analysis prints the fully resolved configuration at start-up so you can see which values are in effect; off by default.",
|      "purpose": "Prints the configuration risk analysis actually uses at start-up, so you can see which values are in effect.",
|      "effect": "On adds a configuration listing to the run log, including identifiers from your setup; no effect on reports.",
|      "whenToChange": "When troubleshooting which value is in effect.",
|      "info": {
|        "what": "Prints the configuration risk analysis actually uses at start-up, so you can see which values are in effect.",
|        "whenOn": "On adds a configuration listing to the run log, including identifiers from your setup; no effect on reports.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off.",
|        "recommended": "Keep the default. Change it when: When troubleshooting which value is in effect.",
|        "docUrl": "https://invardia.com/docs/si/settings/ShowConfig/"
|      }
|    },
|    {
|      "name": "SI_ActiveStaleDays",
|      "label": "Active asset freshness window",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": 30,
|      "defaultText": "30 days",
|      "description": "--- Active-asset freshness threshold (preview.87+) --- Asset is IsEnabledActive=$true when seen by a provider within N days.",
|      "purpose": "Sets how recently an asset must have been seen (or an identity signed in) to count as active.",
|      "effect": "Lower values mark more assets inactive; inactive endpoints are left out of the profile output and identities without a recent sign-in are flagged inactive. Higher values keep older, possibly retired assets in reports.",
|      "whenToChange": "Most installs keep 30. Lower for tighter hygiene reporting; raise if devices are often offline for long periods.",
|      "unit": "days",
|      "card": "Which assets are included",
|      "info": {
|        "what": "Sets how recently an asset must have been seen (or an identity signed in) to count as active.",
|        "whenChanged": "Lower values mark more assets inactive; inactive endpoints are left out of the profile output and identities without a recent sign-in are flagged inactive. Higher values keep older, possibly retired assets in reports.",
|        "risk": "A shorter value marks more assets inactive: devices not seen within it leave the profiles and reports (a device offline for a week or two can drop out). Reversible: the next run includes them again.",
|        "requires": "Read by: azure, endpoint, identity, publicip.",
|        "default": "30 days",
|        "recommended": "30 days.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ActiveStaleDays/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter value marks more assets inactive: devices not seen within it leave the profiles and reports (a device offline for a week or two can drop out). Reversible: the next run includes them again."
|      }
|    },
|    {
|      "name": "SI_AI_CostPerCallEstimate",
|      "label": "AI cost per call estimate",
|      "group": "AI",
|      "type": "number",
|      "engines": [
|        "identity"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 0.01,
|      "defaultText": "0.01 USD per call",
|      "description": "Per-call cost estimate (USD). Default 0.01. Tune after observing actuals.",
|      "purpose": "The estimated price in US dollars of one AI call, used to keep each run within its AI spending budget.",
|      "effect": "The engines count this amount per AI call against the run's AI budget. A higher estimate stops AI calls sooner (more assets classified by rules only); a lower one allows more calls and higher real cost.",
|      "whenToChange": "After a few real runs, set it to your observed cost per call.",
|      "unit": "USD",
|      "info": {
|        "what": "The estimated price in US dollars of one AI call, used to keep each run within its AI spending budget.",
|        "whenChanged": "The engines count this amount per AI call against the run's AI budget. A higher estimate stops AI calls sooner (more assets classified by rules only); a lower one allows more calls and higher real cost.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: identity.",
|        "default": "0.01 USD per call",
|        "recommended": "Keep the default. Change it when: After a few real runs, set it to your observed cost per call.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AI_CostPerCallEstimate/"
|      }
|    },
|    {
|      "name": "SI_AISummary_Leader",
|      "label": "Leading report for AI summary",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "enum",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Detailed is the leading report.",
|      "description": "WHICH REPORT IS THE SOURCE OF TRUTH in 'Consistent' mode. The leader always builds its own figures and never adopts anyone else's; the other report adopts the leader's. Default 'Summary', because that is the grain an executive audience usually reads -- set 'Detailed' if your management receives the Detailed report instead and the relationship inverts cleanly. There is deliberately NO time window deciding who wins. An earlier design said \"the first report of the cycle wins\", but a cycle cannot be identified from a clock: your two runs may legitimately fall on different UTC days (Summary late evening, Detailed early morning), and a long run can straddle midnight by itself. Naming a leader removes the question entirely -- the pairing survives any schedule, timezone or run duration, and the follower's figures can never appear in the leader's mail.",
|      "purpose": "In Consistent mode, chooses which report (Summary or Detailed) builds the AI summary, risk score and top list that the other report reuses.",
|      "effect": "The leading report always computes its own figures; the other copies them so both mails agree. An unknown value falls back to Detailed with a warning. Ignored in PerReport mode. With the Summary step off (the default) only the Detailed report runs, so it always leads.",
|      "whenToChange": "Set to Summary only when the Summary step is switched on and management mainly receives the Summary report.",
|      "values": [
|        "Summary",
|        "Detailed"
|      ],
|      "valueLabels": {
|        "Summary": "Summary report leads",
|        "Detailed": "Detailed report leads"
|      },
|      "card": "Summary and Detailed agreement",
|      "info": {
|        "what": "In Consistent mode, chooses which report (Summary or Detailed) builds the AI summary, risk score and top list that the other report reuses.",
|        "whenChanged": "The leading report always computes its own figures; the other copies them so both mails agree. An unknown value falls back to Detailed with a warning. Ignored in PerReport mode. With the Summary step off (the default) only the Detailed report runs, so it always leads.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Detailed is the leading report.",
|        "recommended": "Keep the default. Change it when: Set to Summary only when the Summary step is switched on and management mainly receives the Summary report.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AISummary_Leader/"
|      }
|    },
|    {
|      "name": "SI_AISummary_MaxAgeHours",
|      "label": "AI summary reuse age limit",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "24 hours.",
|      "description": "How stale the leader's snapshot may be before the other report stops adopting it and builds its own instead. A BACKSTOP only -- it does not decide who leads. It exists so a snapshot left behind by a host that was offline for a week is not carried into today's mail. Ignored in 'PerReport' mode, which never adopts.",
|      "purpose": "How old the leading report's saved summary may be before the other report stops reusing it and builds its own.",
|      "effect": "Higher lets an older summary be reused, so figures can be stale after a missed run. Lower makes the follower build its own figures more often, costing more AI calls.",
|      "whenToChange": "Only if your two reports run more than a day apart.",
|      "unit": "hours",
|      "info": {
|        "what": "How old the leading report's saved summary may be before the other report stops reusing it and builds its own.",
|        "whenChanged": "Higher lets an older summary be reused, so figures can be stale after a missed run. Lower makes the follower build its own figures more often, costing more AI calls.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "24 hours.",
|        "recommended": "Keep the default. Change it when: Only if your two reports run more than a day apart.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AISummary_MaxAgeHours/"
|      }
|    },
|    {
|      "name": "SI_AISummary_Mode",
|      "label": "Summary and Detailed agreement",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "enum",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Depends on the edition. SecurityInsight Pro: PerReport -- each report shows its own figures (Summary counts distinct assets, Detailed counts individual findings). Community: Consistent -- both reports show the same figures. A value you set wins in both editions.",
|      "description": "--- AI executive summary (RA) --------------------------------------------- HOW THE SUMMARY AND DETAILED REPORTS RELATE TO EACH OTHER. The two reports count different things and always will: Summary counts distinct ASSETS, Detailed counts individual ASSET FINDINGS (one asset can carry many). The same estate therefore produces different totals and percentages in the two reports. What you choose here is whether the two reports are made to AGREE, or whether each simply reports its own grain. Either way both mails now carry a line under the KPI explaining why the figures differ. 'Consistent' (Community default) -- the leading report builds the AI narrative, the headline Risk Score KPI and the Top-50 list, and the other report REUSES them verbatim, so both mails show identical figures. Choose this where management receives BOTH reports. 'PerReport' (Pro default) -- each report computes and shows its own numbers and never adopts the other's. Choose this where management receives ONE report, or where each report should be true to its own grain. Leave unset for the edition's default: 'Consistent' in Community -- what every install did before this setting existed, so upgrading changes nothing -- and 'PerReport' in SecurityInsight Pro, where the web app shows Summary and Detailed side by side. A value you set here wins in both editions.",
|      "purpose": "Chooses whether the Summary and Detailed reports show identical AI summary, risk score and top list, or each shows its own figures.",
|      "effect": "Consistent makes one report reuse the other's figures, saving AI calls. PerReport makes each report compute its own, so totals differ. Unknown values fall back to the edition's default.",
|      "whenToChange": "Choose PerReport when each audience receives only one report, or (Pro) to compare Summary and Detailed in the web app. Choose Consistent when management receives both mails and they must show the same figures.",
|      "values": [
|        "Consistent",
|        "PerReport"
|      ],
|      "valueLabels": {
|        "Consistent": "Same figures in both reports, from the leading report",
|        "PerReport": "Each report shows its own figures"
|      },
|      "card": "Summary and Detailed agreement",
|      "info": {
|        "what": "Chooses whether the Summary and Detailed reports show identical AI summary, risk score and top list, or each shows its own figures.",
|        "whenChanged": "Consistent makes one report reuse the other's figures, saving AI calls. PerReport makes each report compute its own, so totals differ. Unknown values fall back to the edition's default.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Depends on the edition. SecurityInsight Pro: PerReport -- each report shows its own figures (Summary counts distinct assets, Detailed counts individual findings). Community: Consistent -- both reports show the same figures. A value you set wins in both editions.",
|        "recommended": "Keep the default. Change it when: Choose PerReport when each audience receives only one report, or (Pro) to compare Summary and Detailed in the web app. Choose Consistent when management receives both mails and they must show the same figures.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AISummary_Mode/"
|      }
|    },
|    {
|      "name": "SI_AssetDecisionsPath",
|      "label": "Asset decisions file",
|      "group": "Collection scope & limits",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "The asset decisions file in the config folder and in your enrichment data folder, if they exist.",
|      "description": "--- asset decisions (tier overrides, exceptions, exemptions) ----------------- Default: config\\asset-decisions.custom.yaml (copy the .sample.yaml next to it).",
|      "purpose": "Path to your file of asset decisions: tier overrides, exceptions and exemptions applied during profiling.",
|      "effect": "When set, only this file is read and the default locations are ignored. A path that does not exist is reported, and none of your decisions are applied.",
|      "whenToChange": "When you keep the decisions file outside the installation folder.",
|      "card": "Which assets are included",
|      "info": {
|        "what": "Path to your file of asset decisions: tier overrides, exceptions and exemptions applied during profiling.",
|        "whenChanged": "When set, only this file is read and the default locations are ignored. A path that does not exist is reported, and none of your decisions are applied.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "The asset decisions file in the config folder and in your enrichment data folder, if they exist.",
|        "recommended": "Keep the default. Change it when: When you keep the decisions file outside the installation folder.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetDecisionsPath/"
|      }
|    },
|    {
|      "name": "SI_AssetLimit_Azure",
|      "label": "Azure asset limit",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "azure"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 0,
|      "defaultText": "No limit (every discovered resource).",
|      "description": "Asset limit -- 0 means no limit. Smoke tests on production tenants MUST keep this at 0; sliced samples hide pagination, throttling, and rare-type bugs.",
|      "purpose": "Caps how many discovered Azure resources the Azure engine processes in one run, for testing.",
|      "effect": "Keeps only the first N resources after discovery, so runs are faster but the inventory and every report built on it are incomplete. A command-line value wins over this.",
|      "whenToChange": "Never in production; only for quick local tests.",
|      "unit": "assets",
|      "info": {
|        "what": "Caps how many discovered Azure resources the Azure engine processes in one run, for testing.",
|        "whenChanged": "Keeps only the first N resources after discovery, so runs are faster but the inventory and every report built on it are incomplete. A command-line value wins over this.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: azure.",
|        "default": "No limit (every discovered resource).",
|        "recommended": "Keep the default. Change it when: Never in production; only for quick local tests.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetLimit_Azure/"
|      }
|    },
|    {
|      "name": "SI_AssetLimit_Endpoint",
|      "label": "Endpoint asset limit",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "endpoint"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 0,
|      "defaultText": "No limit (every discovered device).",
|      "description": "Cap discovered assets (0 = unlimited). KEEP at 0 for production smoke tests.",
|      "purpose": "Caps how many discovered devices the endpoint engine processes in one run, for testing.",
|      "effect": "Keeps only the first N devices after discovery, so runs are faster but the inventory and every report built on it are incomplete. A command-line value wins over this.",
|      "whenToChange": "Never in production; only for quick local tests.",
|      "unit": "assets",
|      "info": {
|        "what": "Caps how many discovered devices the endpoint engine processes in one run, for testing.",
|        "whenChanged": "Keeps only the first N devices after discovery, so runs are faster but the inventory and every report built on it are incomplete. A command-line value wins over this.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: endpoint.",
|        "default": "No limit (every discovered device).",
|        "recommended": "Keep the default. Change it when: Never in production; only for quick local tests.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetLimit_Endpoint/"
|      }
|    },
|    {
|      "name": "SI_AssetLimit_Identity",
|      "label": "Identity asset limit",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "identity"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 0,
|      "defaultText": "No limit (every discovered identity).",
|      "description": "Asset limit -- 0 means no limit (process all discovered assets). Customer-side override: set $global:SI_AssetLimit_Identity in custom.ps1. Smoke tests on production tenants MUST keep this at 0; sliced samples hide scale-only bugs (pagination, throttling, large-array serialization, rare-type schema drift). Use only for local dev with mock data.",
|      "purpose": "Caps how many discovered users and service principals the identity engine processes in one run, for testing.",
|      "effect": "Keeps only the first N identities after discovery, so runs are faster but the inventory and every report built on it are incomplete. A command-line value wins over this.",
|      "whenToChange": "Never in production; only for quick local tests.",
|      "unit": "assets",
|      "info": {
|        "what": "Caps how many discovered users and service principals the identity engine processes in one run, for testing.",
|        "whenChanged": "Keeps only the first N identities after discovery, so runs are faster but the inventory and every report built on it are incomplete. A command-line value wins over this.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: identity.",
|        "default": "No limit (every discovered identity).",
|        "recommended": "Keep the default. Change it when: Never in production; only for quick local tests.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetLimit_Identity/"
|      }
|    },
|    {
|      "name": "SI_AssetLimit_PublicIp",
|      "label": "Public IP asset limit",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 0,
|      "defaultText": "No limit (every discovered public IP).",
|      "description": "Asset limit -- 0 means no limit. Smoke tests on production tenants MUST keep this at 0; sliced samples hide pagination, throttling, and rare-type bugs.",
|      "purpose": "Caps how many public IP addresses the public IP engine processes in one run, for testing.",
|      "effect": "Keeps only the first N addresses after discovery, so runs are faster and use fewer Shodan credits, but the inventory and reports are incomplete. A command-line value wins over this.",
|      "whenToChange": "Never in production; only for quick local tests.",
|      "unit": "assets",
|      "info": {
|        "what": "Caps how many public IP addresses the public IP engine processes in one run, for testing.",
|        "whenChanged": "Keeps only the first N addresses after discovery, so runs are faster and use fewer Shodan credits, but the inventory and reports are incomplete. A command-line value wins over this.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "No limit (every discovered public IP).",
|        "recommended": "Keep the default. Change it when: Never in production; only for quick local tests.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetLimit_PublicIp/"
|      }
|    },
|    {
|      "name": "SI_AssetProperties",
|      "label": "Asset properties",
|      "group": "Connectors & CMDB",
|      "type": "enum",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "security: the security profile only -- what SecurityInsight needs for risk",
|      "description": "Asset properties, two levels. 'security' (the default) = what SecurityInsight needs for risk: the profilers read their sources exactly as always and nothing extra is stored. 'full' = each profiler reads each source ONCE with every property, builds the same security profile from it, and publishes the whole object (Defender, Entra, Intune, AD, Azure, Exposure Graph, VM extensions) to SI_AssetProperties_CL for the CMDB hand-off; (Pro) the data sync stores every snapshot for the web app's asset page, with its history.",
|      "purpose": "How much SecurityInsight keeps about each asset: security (what SecurityInsight needs for risk) or full (all metadata from every source, kept a few days).",
|      "effect": "'security' (the default) keeps what SecurityInsight needs for risk -- name, kind, tier and the security fields each profile carries -- and stores nothing extra. 'full' also keeps every property each source knows about an asset -- Defender, Entra, Intune, Active Directory, Azure, Exposure Graph and VM extensions, including serial numbers and MAC addresses. Each source is still read only once: the profiler reads it with every property and builds the same security profile from it, so the profile does not change. The whole objects go to SI_AssetProperties_CL for the CMDB and vulnerability hand-off, and the data sync stores them in the Pro database, where the asset page shows them under \"Full metadata\" per source (lists stay lists), with a history of every snapshot kept and what changed between them. It is kept for the days set in \"Full asset metadata: days kept\" (default 3). Full adds Log Analytics ingest on every run; switching back to security stops the collection, and what was stored ages out after those days.",
|      "whenToChange": "Choose full when you want to see every property of an asset in the web app, or when SecurityInsight should hand asset metadata to a CMDB (for example ServiceNow); leave security otherwise.",
|      "values": [
|        "security",
|        "full"
|      ],
|      "valueLabels": {
|        "security": "Security: what SecurityInsight needs for risk",
|        "full": "Full: all metadata from every source, kept a few days"
|      },
|      "card": "Asset properties",
|      "hint": "Security = what SecurityInsight needs for risk. Full = all metadata from every source, kept a few days.",
|      "info": {
|        "what": "How much SecurityInsight keeps about each asset: security (what SecurityInsight needs for risk) or full (all metadata from every source, kept a few days).",
|        "whenChanged": "'security' (the default) keeps what SecurityInsight needs for risk -- name, kind, tier and the security fields each profile carries -- and stores nothing extra. 'full' also keeps every property each source knows about an asset -- Defender, Entra, Intune, Active Directory, Azure, Exposure Graph and VM extensions, including serial numbers and MAC addresses. Each source is still read only once: the profiler reads it with every property and builds the same security profile from it, so the profile does not change. The whole objects go to SI_AssetProperties_CL for the CMDB and vulnerability hand-off, and the data sync stores them in the Pro database, where the asset page shows them under \"Full metadata\" per source (lists stay lists), with a history of every snapshot kept and what changed between them. It is kept for the days set in \"Full asset metadata: days kept\" (default 3). Full adds Log Analytics ingest on every run; switching back to security stops the collection, and what was stored ages out after those days.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "security: the security profile only -- what SecurityInsight needs for risk",
|        "recommended": "Keep the default. Change it when: Choose full when you want to see every property of an asset in the web app, or when SecurityInsight should hand asset metadata to a CMDB (for example ServiceNow); leave security otherwise.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetProperties/"
|      }
|    },
|    {
|      "name": "SI_AssetProperties_ChangeGuardPercent",
|      "label": "Full asset metadata: allowed change between runs",
|      "group": "Connectors & CMDB",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "10 %",
|      "description": "How much (in percent) the full asset metadata collected from one source may change from one run to the next before the run holds that source's hand-off and raises a guard event. Default 10.",
|      "purpose": "How much the full asset metadata collected from one source may change from one run to the next before the hand-off of that source is held.",
|      "effect": "When a source (for example Defender, Entra or Azure) returns more than this share more or fewer objects than in the previous run, the previous collection of that source is kept for the CMDB and vulnerability hand-off, and a guard event is raised (mail and Operations > Guards (safety checks)). The hold ends by itself on the next run that is back within the limit, or once when an Admin releases it.",
|      "whenToChange": "Raise it if your estate legitimately changes a lot between runs; lower it to be warned of smaller changes.",
|      "unit": "%",
|      "min": 1,
|      "max": 100,
|      "card": "Asset properties",
|      "info": {
|        "what": "How much the full asset metadata collected from one source may change from one run to the next before the hand-off of that source is held.",
|        "whenChanged": "When a source (for example Defender, Entra or Azure) returns more than this share more or fewer objects than in the previous run, the previous collection of that source is kept for the CMDB and vulnerability hand-off, and a guard event is raised (mail and Operations > Guards (safety checks)). The hold ends by itself on the next run that is back within the limit, or once when an Admin releases it.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "10 %",
|        "recommended": "Keep the default. Change it when: Raise it if your estate legitimately changes a lot between runs; lower it to be warned of smaller changes.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetProperties_ChangeGuardPercent/"
|      }
|    },
|    {
|      "name": "SI_AssetProperties_RetentionDays",
|      "label": "Full asset metadata: days kept",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "3 days",
|      "description": "Days the full asset metadata is kept -- in Log Analytics (the table's retention, set by the run; Log Analytics keeps a table at least 4 days, so a lower value is raised to 4) and in the Pro database (pruned by the data sync). Default 3.",
|      "purpose": "How many days the full asset metadata is kept, in Log Analytics and in the Pro database.",
|      "effect": "The run sets the retention of SI_AssetProperties_CL to this many days (Log Analytics keeps a table at least 4 days, so a lower value is raised to 4 and the run says so), and the data sync removes older full metadata from the Pro database. Every snapshot inside these days is kept, so the asset page's history goes back this far. The data is only needed for the hand-off, the history and the change guard, so a short retention keeps the cost low.",
|      "whenToChange": "Raise it only if the full asset metadata must be looked up further back.",
|      "unit": "days",
|      "min": 1,
|      "card": "Asset properties",
|      "info": {
|        "what": "How many days the full asset metadata is kept, in Log Analytics and in the Pro database.",
|        "whenChanged": "The run sets the retention of SI_AssetProperties_CL to this many days (Log Analytics keeps a table at least 4 days, so a lower value is raised to 4 and the run says so), and the data sync removes older full metadata from the Pro database. Every snapshot inside these days is kept, so the asset page's history goes back this far. The data is only needed for the hand-off, the history and the change guard, so a short retention keeps the cost low.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "3 days",
|        "recommended": "Keep the default. Change it when: Raise it only if the full asset metadata must be looked up further back.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetProperties_RetentionDays/"
|      }
|    },
|    {
|      "name": "SI_AssetTagActivityDcr",
|      "label": "Tag activity collection rule",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "dcr-si-assettag-activity",
|      "description": "Optional: override the asset-tagging audit DCR / table (Invoke-Tagging).",
|      "purpose": "Name of the data collection rule used to send the asset-tagging activity log to Log Analytics.",
|      "effect": "Tagging activity rows are sent through this rule instead. A rule that does not match the activity table makes the activity log stop arriving.",
|      "whenToChange": "Almost never; only to avoid a name clash with an existing rule.",
|      "info": {
|        "what": "Name of the data collection rule used to send the asset-tagging activity log to Log Analytics.",
|        "whenChanged": "Tagging activity rows are sent through this rule instead. A rule that does not match the activity table makes the activity log stop arriving.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "dcr-si-assettag-activity",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a name clash with an existing rule.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetTagActivityDcr/"
|      }
|    },
|    {
|      "name": "SI_AssetTagActivityTable",
|      "label": "Tag activity table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "SI_AssetTagActivity (stored as SI_AssetTagActivity_CL).",
|      "description": "Log Analytics table that receives the asset-tagging activity log (which tags were applied or removed); defaults to SI_AssetTagActivity.",
|      "purpose": "Log Analytics table receiving the asset-tagging activity log: which tags were or would be applied or removed.",
|      "effect": "Tagging activity from both the tagging engine and the profilers' read-only tagging check goes to this table. Queries reading the standard table will no longer see new rows.",
|      "whenToChange": "Almost never; only to avoid a clash with an existing table.",
|      "info": {
|        "what": "Log Analytics table receiving the asset-tagging activity log: which tags were or would be applied or removed.",
|        "whenChanged": "Tagging activity from both the tagging engine and the profilers' read-only tagging check goes to this table. Queries reading the standard table will no longer see new rows.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "SI_AssetTagActivity (stored as SI_AssetTagActivity_CL).",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a clash with an existing table.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetTagActivityTable/"
|      }
|    },
|    {
|      "name": "SI_AssetTagging_Apply",
|      "label": "Asset tagging on a server writes tags",
|      "group": "Connectors & CMDB",
|      "type": "bool",
|      "engines": [
|        "asset-tagging"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: report only, every planned tag is logged, nothing is changed",
|      "description": "Write the tags on every run (default: report only -- every planned tag is logged, nothing is changed).",
|      "purpose": "Lets the asset-tagging script on a server (launcher.community-vm.ps1) write the tags its rules select in Defender, Azure and Entra on every run, instead of only reporting them.",
|      "effect": "On, every run changes Defender machine tags, Azure resource tags and Entra custom security attributes in your tenant; -WhatIfMode on a run still makes that run report only. The identity also needs the write grants. For one run only, use -Apply instead.",
|      "whenToChange": "Turn it on after reviewing the report-only results and granting the tagging write grants. An install that wrote tags before 3.0 sets it to keep writing.",
|      "card": "Asset tagging",
|      "info": {
|        "what": "Lets the asset-tagging script on a server (launcher.community-vm.ps1) write the tags its rules select in Defender, Azure and Entra on every run, instead of only reporting them.",
|        "whenOn": "On, every run changes Defender machine tags, Azure resource tags and Entra custom security attributes in your tenant; -WhatIfMode on a run still makes that run report only. The identity also needs the write grants. For one run only, use -Apply instead.",
|        "whenOff": "report only, every planned tag is logged, nothing is changed",
|        "risk": "Writes to your tenant: every run changes Defender machine tags, Azure resource tags and Entra custom security attributes. A wrong rule tags or untags many objects at once. Reversible only by changing the rules and running again (or by hand); the audit trail records every change.",
|        "requires": "Read by: asset-tagging.",
|        "default": "Off: report only, every planned tag is logged, nothing is changed",
|        "recommended": "Off until the report-only output has been reviewed; then on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetTagging_Apply/",
|        "confirmWhen": "on",
|        "confirm": "On, every run changes Defender machine tags, Azure resource tags and Entra custom security attributes in your tenant; -WhatIfMode on a run still makes that run report only. The identity also needs the write grants. For one run only, use -Apply instead. Writes to your tenant: every run changes Defender machine tags, Azure resource tags and Entra custom security attributes. A wrong rule tags or untags many objects at once. Reversible only by changing the rules and running again (or by hand); the audit trail records every change."
|      }
|    },
|    {
|      "name": "SI_AssetTagging_Enabled",
|      "label": "Asset tagging",
|      "group": "Connectors & CMDB",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: no tagging rule sets a tag anywhere and no report treats a device as excluded because of one",
|      "description": "Asset tagging (#643). Off by default: the asset-tagging rules (e.g. Auto-CanBeOnboarded--Excluded--SI) set no tag anywhere -- not on the CIs inside SecurityInsight, not in Defender, Azure or Entra -- and no report treats a device as excluded because of a tagging rule (a tag an earlier tagging run wrote is ignored). Your own exclusion tags keep working. On: the rules apply inside SecurityInsight; writing to your tenant is still the separate SI_Pro_AssetTagging_Apply / SI_AssetTagging_Apply.",
|      "purpose": "Turns asset tagging on: the asset-tagging rules (for example Auto-CanBeOnboarded--Excluded--SI for the devices Defender can onboard) apply inside SecurityInsight, and the tagging job may run.",
|      "effect": "On, the asset-tagging rules you have switched on tag the CIs inside SecurityInsight, and a rule whose tag ends in --Excluded--SI takes the device out of every report. Writing the tags to Defender, Azure and Entra stays the separate 'Asset tagging writes tags' setting. Off, no tagging rule tags anything, the tagging job does not run, and a tag an earlier tagging run wrote is ignored; your own exclusion tags keep working.",
|      "whenToChange": "Turn it on when you want the automatic exclusion rules (devices Defender cannot onboard, name patterns) to take devices out of the reports -- and check the Excluded assets report afterwards.",
|      "card": "Asset tagging",
|      "info": {
|        "what": "Turns asset tagging on: the asset-tagging rules (for example Auto-CanBeOnboarded--Excluded--SI for the devices Defender can onboard) apply inside SecurityInsight, and the tagging job may run.",
|        "whenOn": "On, the asset-tagging rules you have switched on tag the CIs inside SecurityInsight, and a rule whose tag ends in --Excluded--SI takes the device out of every report. Writing the tags to Defender, Azure and Entra stays the separate 'Asset tagging writes tags' setting. Off, no tagging rule tags anything, the tagging job does not run, and a tag an earlier tagging run wrote is ignored; your own exclusion tags keep working.",
|        "whenOff": "no tagging rule sets a tag anywhere and no report treats a device as excluded because of one",
|        "risk": "The tagging rules you have switched on take devices out of every report (a tag ending in --Excluded--SI). A wrong rule hides many devices at once. Reversible: turn it off and the next CI build puts them back.",
|        "requires": "Nothing else.",
|        "default": "Off: no tagging rule sets a tag anywhere and no report treats a device as excluded because of one",
|        "recommended": "Off until you have decided which automatic exclusions you want; then on, and check the Excluded assets report.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AssetTagging_Enabled/",
|        "confirmWhen": "on",
|        "confirm": "On, the asset-tagging rules you have switched on tag the CIs inside SecurityInsight, and a rule whose tag ends in --Excluded--SI takes the device out of every report. Writing the tags to Defender, Azure and Entra stays the separate 'Asset tagging writes tags' setting. Off, no tagging rule tags anything, the tagging job does not run, and a tag an earlier tagging run wrote is ignored; your own exclusion tags keep working. The tagging rules you have switched on take devices out of every report (a tag ending in --Excluded--SI). A wrong rule hides many devices at once. Reversible: turn it off and the next CI build puts them back."
|      }
|    },
|    {
|      "name": "SI_AuthMethod",
|      "label": "Sign-in method",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Keeps a configured service principal; otherwise the host's managed identity",
|      "description": "THE sign-in choice. Managed identity is the default for a new install: an Azure VM or an Azure Arc-enabled server uses its system-assigned identity; give a client id to use a user-assigned one. When SI_AuthMethod is NOT set, an existing install keeps what it has: a configured SPN stays the SPN.",
|      "purpose": "Chooses how SecurityInsight signs in to Microsoft services: managed identity, service principal with certificate, or service principal with client secret.",
|      "effect": "Decides which identity every engine uses, and therefore which permissions must be granted. An unknown value stops the run with an error. Choosing a service principal switches managed-identity sign-in off.",
|      "whenToChange": "Set during setup. Change when moving between managed identity and a service principal.",
|      "card": "How SecurityInsight signs in",
|      "info": {
|        "what": "Chooses how SecurityInsight signs in to Microsoft services: managed identity, service principal with certificate, or service principal with client secret.",
|        "whenChanged": "Decides which identity every engine uses, and therefore which permissions must be granted. An unknown value stops the run with an error. Choosing a service principal switches managed-identity sign-in off.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Keeps a configured service principal; otherwise the host's managed identity",
|        "recommended": "Keep the default. Change it when: Set during setup. Change when moving between managed identity and a service principal.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AuthMethod/"
|      }
|    },
|    {
|      "name": "SI_AutoBucketDefaultDetailed",
|      "label": "Detailed report starting buckets",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "2 slices.",
|      "description": "Default bucket count for the Detailed run before adaptive bucketing takes over (default 2).",
|      "purpose": "How many slices a Detailed Risk Analysis query is split into on the first try, before automatic splitting adapts.",
|      "effect": "More slices avoid query timeouts on very large tenants but add overhead per slice, making small tenants slower. A per-report bucket count in the report template still wins.",
|      "whenToChange": "Only if Detailed reports repeatedly time out on a very large tenant.",
|      "unit": "buckets",
|      "info": {
|        "what": "How many slices a Detailed Risk Analysis query is split into on the first try, before automatic splitting adapts.",
|        "whenChanged": "More slices avoid query timeouts on very large tenants but add overhead per slice, making small tenants slower. A per-report bucket count in the report template still wins.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "2 slices.",
|        "recommended": "Keep the default. Change it when: Only if Detailed reports repeatedly time out on a very large tenant.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AutoBucketDefaultDetailed/"
|      }
|    },
|    {
|      "name": "SI_AutoBucketSubFanOut",
|      "label": "Query split fan-out",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "4 pieces per split.",
|      "description": "sub-buckets created per split",
|      "purpose": "How many smaller pieces a timed-out Risk Analysis query slice is split into each time.",
|      "effect": "More pieces shrink heavy slices faster but run more queries; fewer pieces mean more split rounds. No rows are lost either way.",
|      "whenToChange": "Rarely; only when tuning very large tenants with support.",
|      "unit": "pieces",
|      "info": {
|        "what": "How many smaller pieces a timed-out Risk Analysis query slice is split into each time.",
|        "whenChanged": "More pieces shrink heavy slices faster but run more queries; fewer pieces mean more split rounds. No rows are lost either way.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "4 pieces per split.",
|        "recommended": "Keep the default. Change it when: Rarely; only when tuning very large tenants with support.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AutoBucketSubFanOut/"
|      }
|    },
|    {
|      "name": "SI_AzSubscriptionId",
|      "label": "Azure subscription for ingestion",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Taken from the workspace resource id, else SubscriptionId",
|      "description": "Subscription override for DCR merge diagnostics + ad-hoc setup helpers.",
|      "purpose": "The Azure subscription in which the engines look up and create the data collection endpoint and rules.",
|      "effect": "Scopes all endpoint and rule lookups and resource creation to this subscription. A wrong value makes ingestion refuse to post or create resources in the wrong subscription.",
|      "whenToChange": "Only when the ingestion resources live in a different subscription than the workspace.",
|      "info": {
|        "what": "The Azure subscription in which the engines look up and create the data collection endpoint and rules.",
|        "whenChanged": "Scopes all endpoint and rule lookups and resource creation to this subscription. A wrong value makes ingestion refuse to post or create resources in the wrong subscription.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Taken from the workspace resource id, else SubscriptionId",
|        "recommended": "Keep the default. Change it when: Only when the ingestion resources live in a different subscription than the workspace.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzSubscriptionId/"
|      }
|    },
|    {
|      "name": "SI_Azure_DcrName",
|      "label": "Azure profile collection rule",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "dcr-si-azure-profile (from the standard naming pattern).",
|      "description": "Overrides the data collection rule name the Azure profiling engine ingests through; when empty, the standard naming pattern is used.",
|      "purpose": "Name of the data collection rule the Azure profiling engine sends its results through.",
|      "effect": "Azure profile rows are ingested through this rule instead. Useful to avoid picking up a same-named rule from an older install; a wrong name makes ingestion fail.",
|      "whenToChange": "Only when another rule with the standard name is visible to the identity.",
|      "info": {
|        "what": "Name of the data collection rule the Azure profiling engine sends its results through.",
|        "whenChanged": "Azure profile rows are ingested through this rule instead. Useful to avoid picking up a same-named rule from an older install; a wrong name makes ingestion fail.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "dcr-si-azure-profile (from the standard naming pattern).",
|        "recommended": "Keep the default. Change it when: Only when another rule with the standard name is visible to the identity.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Azure_DcrName/"
|      }
|    },
|    {
|      "name": "SI_Azure_TableName",
|      "label": "Azure profile table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "SI_Azure_Profile (stored as SI_Azure_Profile_CL).",
|      "description": "Overrides the Log Analytics table the Azure profiling engine writes to; when empty, the standard SI_Azure_Profile table is used.",
|      "purpose": "Log Analytics table the Azure profiling engine writes its asset profiles to.",
|      "effect": "Azure profiles go to this table instead. Risk Analysis and workbooks that read the standard table will no longer see new Azure data unless changed too.",
|      "whenToChange": "Almost never; only to avoid a clash with an existing table.",
|      "info": {
|        "what": "Log Analytics table the Azure profiling engine writes its asset profiles to.",
|        "whenChanged": "Azure profiles go to this table instead. Risk Analysis and workbooks that read the standard table will no longer see new Azure data unless changed too.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "SI_Azure_Profile (stored as SI_Azure_Profile_CL).",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a clash with an existing table.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Azure_TableName/"
|      }
|    },
|    {
|      "name": "SI_AzureEgNonAssetTypes",
|      "label": "Azure types not treated as assets",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Role and policy assignments and definitions, locks and diagnostic settings.",
|      "description": "Exposure Graph node types treated as NOT assets (extension resources). Default: role/policy assignments, locks, diagnostic settings.",
|      "purpose": "Azure resource types from the exposure graph that are settings on other resources, not assets, and are left out of Azure collection.",
|      "effect": "Replaces the list. Removing a type brings those items back as Azure assets, which can greatly increase row counts and duplicates; adding a type removes it from collection.",
|      "whenToChange": "Only if you genuinely want one of these types profiled, or another type excluded.",
|      "info": {
|        "what": "Azure resource types from the exposure graph that are settings on other resources, not assets, and are left out of Azure collection.",
|        "whenChanged": "Replaces the list. Removing a type brings those items back as Azure assets, which can greatly increase row counts and duplicates; adding a type removes it from collection.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "Role and policy assignments and definitions, locks and diagnostic settings.",
|        "recommended": "Keep the default. Change it when: Only if you genuinely want one of these types profiled, or another type excluded.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureEgNonAssetTypes/"
|      }
|    },
|    {
|      "name": "SI_AzureEgTypeAllowlist",
|      "label": "Azure exposure graph type list",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Every Azure type in the exposure graph, minus role/policy assignments, locks and diagnostic settings.",
|      "description": "EG node-label allowlist for Azure types (default = enumerated weekly).",
|      "purpose": "Fixes which Azure resource types are read from the Defender exposure graph, the Azure engine's main source.",
|      "effect": "Replaces the automatically discovered type list entirely, so only the types you list are collected from the exposure graph. New Azure types are no longer picked up automatically, and the built-in exclusion of non-asset types no longer applies.",
|      "whenToChange": "Only to narrow collection to specific types, for example in a very large estate.",
|      "info": {
|        "what": "Fixes which Azure resource types are read from the Defender exposure graph, the Azure engine's main source.",
|        "whenChanged": "Replaces the automatically discovered type list entirely, so only the types you list are collected from the exposure graph. New Azure types are no longer picked up automatically, and the built-in exclusion of non-asset types no longer applies.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "Every Azure type in the exposure graph, minus role/policy assignments, locks and diagnostic settings.",
|        "recommended": "Keep the default. Change it when: Only to narrow collection to specific types, for example in a very large estate.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureEgTypeAllowlist/"
|      }
|    },
|    {
|      "name": "SI_AzureExcludeTypes",
|      "label": "Azure resource types to skip",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Only the built-in list of 7 noisy types (alerts, assessments, policy states and similar) is skipped.",
|      "description": "Additional types to EXCLUDE on top of the engine's noisy-types list.",
|      "purpose": "Extra Azure resource types the Resource Graph source leaves out, on top of the built-in list of noisy types.",
|      "effect": "The types you list are added to the built-in skip list for the Resource Graph source, reducing data volume and run time. Resources of those types disappear from the Azure inventory unless the exposure graph also returns them.",
|      "whenToChange": "When a high-volume type adds noise to your Azure inventory.",
|      "info": {
|        "what": "Extra Azure resource types the Resource Graph source leaves out, on top of the built-in list of noisy types.",
|        "whenChanged": "The types you list are added to the built-in skip list for the Resource Graph source, reducing data volume and run time. Resources of those types disappear from the Azure inventory unless the exposure graph also returns them.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "Only the built-in list of 7 noisy types (alerts, assessments, policy states and similar) is skipped.",
|        "recommended": "Keep the default. Change it when: When a high-volume type adds noise to your Azure inventory.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureExcludeTypes/"
|      }
|    },
|    {
|      "name": "SI_AzureExposureGraph_AccessEdgeLabels",
|      "label": "Azure access relationship types",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The shipped list of 6 relationship types, such as 'has access to' and 'has permissions to'.",
|      "description": "Exposure-graph relationship types (such as \"has access to\") treated as access paths from identities to Azure resources; the shipped list is used when empty.",
|      "purpose": "Which exposure graph relationship types count as an identity having access to an Azure resource.",
|      "effect": "Changes which access paths are counted when the engine works out which privileged identities can reach each Azure resource. A list that misses real relationship names leaves those counts empty.",
|      "whenToChange": "Only if your Defender exposure graph uses non-standard relationship names.",
|      "info": {
|        "what": "Which exposure graph relationship types count as an identity having access to an Azure resource.",
|        "whenChanged": "Changes which access paths are counted when the engine works out which privileged identities can reach each Azure resource. A list that misses real relationship names leaves those counts empty.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "The shipped list of 6 relationship types, such as 'has access to' and 'has permissions to'.",
|        "recommended": "Keep the default. Change it when: Only if your Defender exposure graph uses non-standard relationship names.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureExposureGraph_AccessEdgeLabels/"
|      }
|    },
|    {
|      "name": "SI_AzureExposureGraph_IdentityLabels",
|      "label": "Azure access identity types",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "User, service principal, managed identity and group.",
|      "description": "Exposure-graph node types treated as identities (such as user and service principal) when mapping who can access Azure resources; the shipped list is used when empty.",
|      "purpose": "Which exposure graph node types are treated as identities when mapping who can access Azure resources.",
|      "effect": "Changes which kinds of identity are counted as having access to Azure resources. Leaving a type out hides access held by that kind of identity.",
|      "whenToChange": "Only if your Defender exposure graph uses non-standard node names.",
|      "info": {
|        "what": "Which exposure graph node types are treated as identities when mapping who can access Azure resources.",
|        "whenChanged": "Changes which kinds of identity are counted as having access to Azure resources. Leaving a type out hides access held by that kind of identity.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "User, service principal, managed identity and group.",
|        "recommended": "Keep the default. Change it when: Only if your Defender exposure graph uses non-standard node names.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureExposureGraph_IdentityLabels/"
|      }
|    },
|    {
|      "name": "SI_AzureExposureGraph_ResourceLabels",
|      "label": "Azure exposure graph resource types",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The shipped list of 16 resource types; access mapping also includes every other Azure resource type.",
|      "description": "EG node + edge label overrides (only when XDR schema is non-standard).",
|      "purpose": "Which exposure graph node types are treated as Azure resources for extra exposure details and access mapping.",
|      "effect": "Restricts exposure detail lookups and access mapping to the types you list. Once set, access mapping no longer covers every other Azure resource type, so access counts can shrink.",
|      "whenToChange": "Only if your Defender exposure graph uses non-standard node names.",
|      "info": {
|        "what": "Which exposure graph node types are treated as Azure resources for extra exposure details and access mapping.",
|        "whenChanged": "Restricts exposure detail lookups and access mapping to the types you list. Once set, access mapping no longer covers every other Azure resource type, so access counts can shrink.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "The shipped list of 16 resource types; access mapping also includes every other Azure resource type.",
|        "recommended": "Keep the default. Change it when: Only if your Defender exposure graph uses non-standard node names.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureExposureGraph_ResourceLabels/"
|      }
|    },
|    {
|      "name": "SI_AzureMaxResources",
|      "label": "Azure Resource Graph row cap",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "No cap of its own; Resource Graph's own limit still applies.",
|      "description": "Hard cap on resources pulled from ARG in one run (0 = ARG's own 100k cap applies). Use a smaller value for first-runs in big tenants (limits AI metaprofile spend).",
|      "purpose": "A safety cap on how many resources the Azure engine pulls from Azure Resource Graph in one run.",
|      "effect": "Stops reading Resource Graph once the cap is reached, which shortens first runs in large estates and limits AI spend. Resources beyond the cap are missing unless the exposure graph returns them.",
|      "whenToChange": "For a first run in a very large estate; remove it afterwards.",
|      "unit": "rows",
|      "info": {
|        "what": "A safety cap on how many resources the Azure engine pulls from Azure Resource Graph in one run.",
|        "whenChanged": "Stops reading Resource Graph once the cap is reached, which shortens first runs in large estates and limits AI spend. Resources beyond the cap are missing unless the exposure graph returns them.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "No cap of its own; Resource Graph's own limit still applies.",
|        "recommended": "Keep the default. Change it when: For a first run in a very large estate; remove it afterwards.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureMaxResources/"
|      }
|    },
|    {
|      "name": "SI_AzureRecommendation_DcrName",
|      "label": "Azure recommendations collection rule",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "dcr-si-azure-recommendation",
|      "description": "Data collection rule name used to ingest Azure (Defender for Cloud) recommendations; defaults to dcr-si-azure-recommendation.",
|      "purpose": "Name of the data collection rule used to send Defender for Cloud recommendations to Log Analytics.",
|      "effect": "Recommendations are sent through this rule instead. A rule that does not match the recommendations table makes them stop arriving.",
|      "whenToChange": "Almost never; only to avoid a name clash with an existing rule.",
|      "info": {
|        "what": "Name of the data collection rule used to send Defender for Cloud recommendations to Log Analytics.",
|        "whenChanged": "Recommendations are sent through this rule instead. A rule that does not match the recommendations table makes them stop arriving.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "dcr-si-azure-recommendation",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a name clash with an existing rule.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureRecommendation_DcrName/"
|      }
|    },
|    {
|      "name": "SI_AzureRecommendation_TableName",
|      "label": "Azure recommendations table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "SI_AzureRecommendation (stored as SI_AzureRecommendation_CL).",
|      "description": "Log Analytics table that receives Azure (Defender for Cloud) recommendations; defaults to SI_AzureRecommendation.",
|      "purpose": "Log Analytics table that receives Defender for Cloud recommendations collected with the Azure engine.",
|      "effect": "Recommendations go to this table instead. Queries reading the standard table will no longer see new rows.",
|      "whenToChange": "Almost never; only to avoid a clash with an existing table.",
|      "info": {
|        "what": "Log Analytics table that receives Defender for Cloud recommendations collected with the Azure engine.",
|        "whenChanged": "Recommendations go to this table instead. Queries reading the standard table will no longer see new rows.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "SI_AzureRecommendation (stored as SI_AzureRecommendation_CL).",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a clash with an existing table.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureRecommendation_TableName/"
|      }
|    },
|    {
|      "name": "SI_AzureResourceTypes",
|      "label": "Azure resource types to collect",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Every resource type the sign-in identity can read.",
|      "description": "Restrict discovery to a hand-picked allowlist (default = ALL ARG-readable types).",
|      "purpose": "Restricts the Azure Resource Graph source to a hand-picked list of resource types.",
|      "effect": "Only the listed types are read from Resource Graph, which lowers run time and data volume. Other types then come only from the exposure graph, so brand-new resources of those types may be missed.",
|      "whenToChange": "Only when you deliberately want a narrow Azure inventory.",
|      "info": {
|        "what": "Restricts the Azure Resource Graph source to a hand-picked list of resource types.",
|        "whenChanged": "Only the listed types are read from Resource Graph, which lowers run time and data volume. Other types then come only from the exposure graph, so brand-new resources of those types may be missed.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "Every resource type the sign-in identity can read.",
|        "recommended": "Keep the default. Change it when: Only when you deliberately want a narrow Azure inventory.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureResourceTypes/"
|      }
|    },
|    {
|      "name": "SI_AzureSubscriptionExcludePatterns",
|      "label": "Subscriptions skipped for identity roles",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [
|        "identity"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "No subscriptions skipped; every visible subscription is scanned.",
|      "description": "Subscriptions to EXCLUDE from delegation enumeration (wildcard match).",
|      "purpose": "Subscription names (wildcards allowed) skipped when the identity engine scans Azure role assignments.",
|      "effect": "Role assignments in matching subscriptions are ignored, which speeds up the scan but hides privileges granted there, so identities may get a lower tier than they really hold.",
|      "whenToChange": "To skip personal, trial or lab subscriptions that do not matter for privilege.",
|      "card": "Which assets are included",
|      "info": {
|        "what": "Subscription names (wildcards allowed) skipped when the identity engine scans Azure role assignments.",
|        "whenChanged": "Role assignments in matching subscriptions are ignored, which speeds up the scan but hides privileges granted there, so identities may get a lower tier than they really hold.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: identity.",
|        "default": "No subscriptions skipped; every visible subscription is scanned.",
|        "recommended": "Keep the default. Change it when: To skip personal, trial or lab subscriptions that do not matter for privilege.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_AzureSubscriptionExcludePatterns/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_AcrName",
|      "label": "Container registry name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "acrsecurityinsight (new installs get a name chosen by setup)",
|      "description": "Name of the Azure Container Registry that holds the SecurityInsight container image; created by the container setup if it does not exist.",
|      "purpose": "Name of the Azure Container Registry that holds the SecurityInsight container image; container setup creates it if it does not exist.",
|      "effect": "Setup builds and stores the image in this registry and the jobs pull from it. A new name creates a new registry and image; updates also use it to find a container install.",
|      "whenToChange": "Only before the first container setup, to follow your naming rules.",
|      "info": {
|        "what": "Name of the Azure Container Registry that holds the SecurityInsight container image; container setup creates it if it does not exist.",
|        "whenChanged": "Setup builds and stores the image in this registry and the jobs pull from it. A new name creates a new registry and image; updates also use it to find a container install.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "acrsecurityinsight (new installs get a name chosen by setup)",
|        "recommended": "Keep the default. Change it when: Only before the first container setup, to follow your naming rules.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_AcrName/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_Engines",
|      "label": "Container jobs to deploy",
|      "group": "Schedules & what runs",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "All standard engines, plus asset trend and the Pro engines where installed",
|      "description": "the default (+ the Pro engines where present)",
|      "purpose": "The list of engines container setup creates scheduled jobs for.",
|      "effect": "Only the listed engines get a job. When you set a list it is used exactly as given, so Pro and trend jobs are not added automatically. The role classifier is left out when Azure OpenAI is not configured.",
|      "whenToChange": "When you want fewer jobs, or an engine not deployed by default, such as schema discovery.",
|      "card": "Container jobs",
|      "setupOnly": true,
|      "info": {
|        "what": "The list of engines container setup creates scheduled jobs for.",
|        "whenChanged": "Only the listed engines get a job. When you set a list it is used exactly as given, so Pro and trend jobs are not added automatically. The role classifier is left out when Azure OpenAI is not configured.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "All standard engines, plus asset trend and the Pro engines where installed",
|        "recommended": "Keep the default. Change it when: When you want fewer jobs, or an engine not deployed by default, such as schema discovery.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_Engines/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_EnvName",
|      "label": "Container Apps environment name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "cae-securityinsight (new installs get a name chosen by setup)",
|      "description": "Name of the Azure Container Apps environment the SecurityInsight jobs run in; created by the container setup if it does not exist.",
|      "purpose": "Name of the Azure Container Apps environment the SecurityInsight jobs run in; container setup creates it if it does not exist.",
|      "effect": "All jobs are created in this environment. A new name creates a new environment and new jobs there; the old ones are left in place.",
|      "whenToChange": "Only before the first container setup, to follow your naming rules.",
|      "setupOnly": true,
|      "info": {
|        "what": "Name of the Azure Container Apps environment the SecurityInsight jobs run in; container setup creates it if it does not exist.",
|        "whenChanged": "All jobs are created in this environment. A new name creates a new environment and new jobs there; the old ones are left in place.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "cae-securityinsight (new installs get a name chosen by setup)",
|        "recommended": "Keep the default. Change it when: Only before the first container setup, to follow your naming rules.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_EnvName/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_GrantTaggingRoles",
|      "label": "Grant asset tagging write rights",
|      "group": "Connectors & CMDB",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: rights are only listed, and the job can only report.",
|      "description": "grant asset tagging's write permissions (opt-in)",
|      "purpose": "Lets container setup give the asset tagging job's own identity the rights it needs, including writing tags.",
|      "effect": "When on, setup grants the tagging identity its read rights plus write rights for Defender machine tags, Azure resource tags and Entra security attributes. Tags are written only when asset tagging is also set to apply.",
|      "whenToChange": "When you have decided SecurityInsight may write tags in your tenant.",
|      "card": "Asset tagging",
|      "setupOnly": true,
|      "info": {
|        "what": "Lets container setup give the asset tagging job's own identity the rights it needs, including writing tags.",
|        "whenOn": "When on, setup grants the tagging identity its read rights plus write rights for Defender machine tags, Azure resource tags and Entra security attributes. Tags are written only when asset tagging is also set to apply.",
|        "whenOff": "rights are only listed, and the job can only report.",
|        "risk": "Gives the asset tagging identity WRITE rights in your tenant (Defender machine tags, Azure tags, Entra security attributes). Reversible: remove the role assignments; turning the setting off does not remove rights already granted.",
|        "requires": "Nothing else.",
|        "default": "Off: rights are only listed, and the job can only report.",
|        "recommended": "Off unless asset tagging should write; then on for one setup run.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_GrantTaggingRoles/",
|        "confirmWhen": "on",
|        "confirm": "When on, setup grants the tagging identity its read rights plus write rights for Defender machine tags, Azure resource tags and Entra security attributes. Tags are written only when asset tagging is also set to apply. Gives the asset tagging identity WRITE rights in your tenant (Defender machine tags, Azure tags, Entra security attributes). Reversible: remove the role assignments; turning the setting off does not remove rights already granted."
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ImageTag",
|      "label": "Container image tag",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "latest",
|      "description": "Container image tag the container setup builds and the scheduled jobs run; defaults to latest.",
|      "purpose": "The tag of the container image that setup builds and every scheduled job runs.",
|      "effect": "Jobs run the image with this tag. A different tag lets you keep or test a specific build; a tag that was never built makes the jobs fail to start.",
|      "whenToChange": "Only to pin or test a specific image build.",
|      "setupOnly": true,
|      "info": {
|        "what": "The tag of the container image that setup builds and every scheduled job runs.",
|        "whenChanged": "Jobs run the image with this tag. A different tag lets you keep or test a specific build; a tag that was never built makes the jobs fail to start.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "latest",
|        "recommended": "Keep the default. Change it when: Only to pin or test a specific image build.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ImageTag/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_KedaMaxReplicas",
|      "label": "Maximum queue-driven workers",
|      "group": "Schedules & what runs",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "30 workers",
|      "description": "Maximum number of worker containers that may run at the same time when queue-driven scaling (UseKEDA) is on; defaults to 30.",
|      "purpose": "The most worker containers that may run at the same time per engine when queue-driven scaling is on.",
|      "effect": "Higher finishes large collections faster but runs more containers at once, raising peak cost and load on the source APIs. Has no effect unless queue-driven scaling is on.",
|      "whenToChange": "Only with queue-driven scaling, to speed up very large tenants or cap cost.",
|      "unit": "containers",
|      "setupOnly": true,
|      "info": {
|        "what": "The most worker containers that may run at the same time per engine when queue-driven scaling is on.",
|        "whenChanged": "Higher finishes large collections faster but runs more containers at once, raising peak cost and load on the source APIs. Has no effect unless queue-driven scaling is on.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "30 workers",
|        "recommended": "Keep the default. Change it when: Only with queue-driven scaling, to speed up very large tenants or cap cost.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_KedaMaxReplicas/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_Location",
|      "label": "Container hosting region",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Uses SI_Location; setup stops if neither is set.",
|      "description": "REQUIRED. Match $global:SI_Location above.",
|      "purpose": "The Azure region where container setup creates the registry, environment and identities.",
|      "effect": "All container resources are created in this region. It should match your other SecurityInsight resources; changing it later creates new resources in the new region.",
|      "whenToChange": "Set it once at setup if containers should live in a different region than SI_Location.",
|      "card": "Container hosting",
|      "setupOnly": true,
|      "info": {
|        "what": "The Azure region where container setup creates the registry, environment and identities.",
|        "whenChanged": "All container resources are created in this region. It should match your other SecurityInsight resources; changing it later creates new resources in the new region.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Uses SI_Location; setup stops if neither is set.",
|        "recommended": "Keep the default. Change it when: Set it once at setup if containers should live in a different region than SI_Location.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_Location/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ParallelismAzure",
|      "label": "Azure job containers in parallel",
|      "group": "Schedules & what runs",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1 container",
|      "description": "Number of containers the Azure profiling job runs in parallel per execution; defaults to 1.",
|      "purpose": "How many containers the Azure profiling job runs side by side in each run.",
|      "effect": "More containers split the Azure collection and finish sooner, at higher compute cost per run and more parallel load on Azure APIs.",
|      "whenToChange": "Only for large Azure estates where the job runs too long.",
|      "unit": "containers",
|      "setupOnly": true,
|      "info": {
|        "what": "How many containers the Azure profiling job runs side by side in each run.",
|        "whenChanged": "More containers split the Azure collection and finish sooner, at higher compute cost per run and more parallel load on Azure APIs.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "1 container",
|        "recommended": "Keep the default. Change it when: Only for large Azure estates where the job runs too long.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ParallelismAzure/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ParallelismEndpoint",
|      "label": "Endpoint job containers in parallel",
|      "group": "Schedules & what runs",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1 container",
|      "description": "Per-engine parallelism (collection only; RA never shards).",
|      "purpose": "How many containers the endpoint profiling job runs side by side; also used for jobs that have no parallel setting of their own.",
|      "effect": "More containers split the collection and finish sooner, at higher compute cost per run. It also applies to other collection jobs without their own setting, such as public IP.",
|      "whenToChange": "Only for large estates where the endpoint job runs too long.",
|      "unit": "containers",
|      "setupOnly": true,
|      "info": {
|        "what": "How many containers the endpoint profiling job runs side by side; also used for jobs that have no parallel setting of their own.",
|        "whenChanged": "More containers split the collection and finish sooner, at higher compute cost per run. It also applies to other collection jobs without their own setting, such as public IP.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "1 container",
|        "recommended": "Keep the default. Change it when: Only for large estates where the endpoint job runs too long.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ParallelismEndpoint/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ParallelismIdentity",
|      "label": "Identity job containers in parallel",
|      "group": "Schedules & what runs",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1 container",
|      "description": "Number of containers the identity profiling job runs in parallel per execution; defaults to 1.",
|      "purpose": "How many containers the identity profiling job runs side by side in each run.",
|      "effect": "More containers split the identity collection and finish sooner, at higher compute cost per run and more parallel load on Microsoft Graph.",
|      "whenToChange": "Only for large directories where the job runs too long.",
|      "unit": "containers",
|      "setupOnly": true,
|      "info": {
|        "what": "How many containers the identity profiling job runs side by side in each run.",
|        "whenChanged": "More containers split the identity collection and finish sooner, at higher compute cost per run and more parallel load on Microsoft Graph.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "1 container",
|        "recommended": "Keep the default. Change it when: Only for large directories where the job runs too long.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ParallelismIdentity/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ParallelismSchemaDiscovery",
|      "label": "Schema discovery containers in parallel",
|      "group": "Schedules & what runs",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1 container",
|      "description": "Number of containers the schema-discovery job runs in parallel per execution; defaults to 1.",
|      "purpose": "How many containers the schema discovery job runs side by side in each run.",
|      "effect": "More containers finish schema discovery sooner at higher compute cost. Only matters when schema discovery is in the list of container jobs, which it is not by default.",
|      "whenToChange": "Rarely; only when schema discovery is deployed and runs too long.",
|      "unit": "containers",
|      "setupOnly": true,
|      "info": {
|        "what": "How many containers the schema discovery job runs side by side in each run.",
|        "whenChanged": "More containers finish schema discovery sooner at higher compute cost. Only matters when schema discovery is in the list of container jobs, which it is not by default.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "1 container",
|        "recommended": "Keep the default. Change it when: Rarely; only when schema discovery is deployed and runs too long.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ParallelismSchemaDiscovery/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_RaMaxWorkers",
|      "label": "Risk Analysis workers at once",
|      "group": "Schedules & what runs",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "4 workers",
|      "description": "How many Risk Analysis queue workers may run Detailed reports at the same time; defaults to 4.",
|      "purpose": "How many Risk Analysis queue workers may run Detailed reports at the same time.",
|      "effect": "More workers finish a long Risk Analysis sooner but run more containers at once. The workers share the parts one Risk Analysis job may ask Defender at a time (each at least one), so more workers do not multiply what Defender is asked at once. Has no effect when the Risk Analysis workers are off.",
|      "whenToChange": "Rarely; only when Risk Analysis Detailed runs too long on a very large tenant.",
|      "unit": "containers",
|      "info": {
|        "what": "How many Risk Analysis queue workers may run Detailed reports at the same time.",
|        "whenChanged": "More workers finish a long Risk Analysis sooner but run more containers at once. The workers share the parts one Risk Analysis job may ask Defender at a time (each at least one), so more workers do not multiply what Defender is asked at once. Has no effect when the Risk Analysis workers are off.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "4 workers",
|        "recommended": "Keep the default. Change it when: Rarely; only when Risk Analysis Detailed runs too long on a very large tenant.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_RaMaxWorkers/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_RaScaleOut",
|      "label": "Risk Analysis on queue workers",
|      "group": "Schedules & what runs",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On wherever queue scaling and the managed identity let it run; otherwise the reports run in their job.",
|      "description": "Risk Analysis Detailed reports on queue workers, several reports at once: ON by default wherever queue scaling and the managed identity let them run (setup and every update give them). $false switches them off: the reports run one after another in the Risk Analysis job. RaMaxWorkers = how many workers run at once (default 4).",
|      "purpose": "Runs the Risk Analysis Detailed reports on queue workers, several reports at the same time, instead of one after another in one job.",
|      "effect": "On: setup and every update give the install a worker job that scales from zero with the reports to run, and the Detailed run finishes sooner; the stored findings and what Log Analytics receives are the same. Off: the reports run one after another in the Risk Analysis job.",
|      "whenToChange": "Only switch it off if support asks you to.",
|      "info": {
|        "what": "Runs the Risk Analysis Detailed reports on queue workers, several reports at the same time, instead of one after another in one job.",
|        "whenOn": "setup and every update give the install a worker job that scales from zero with the reports to run, and the Detailed run finishes sooner; the stored findings and what Log Analytics receives are the same.",
|        "whenOff": "the reports run one after another in the Risk Analysis job.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "On wherever queue scaling and the managed identity let it run; otherwise the reports run in their job.",
|        "recommended": "Keep the default. Change it when: Only switch it off if support asks you to.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_RaScaleOut/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ResourceGroupName",
|      "label": "Container resource group",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "rg-securityinsight (new installs get a name chosen by setup)",
|      "description": "ARM resource naming.",
|      "purpose": "The Azure resource group where container setup creates the registry, environment, identities and jobs.",
|      "effect": "All container resources go into this group. Its presence also marks the install as container-hosted, so updates and checks treat it that way; a new name creates everything anew there.",
|      "whenToChange": "Set once at setup to follow your naming rules; remove it on a machine-only install.",
|      "card": "Container hosting",
|      "info": {
|        "what": "The Azure resource group where container setup creates the registry, environment, identities and jobs.",
|        "whenChanged": "All container resources go into this group. Its presence also marks the install as container-hosted, so updates and checks treat it that way; a new name creates everything anew there.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "rg-securityinsight (new installs get a name chosen by setup)",
|        "recommended": "Keep the default. Change it when: Set once at setup to follow your naming rules; remove it on a machine-only install.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ResourceGroupName/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ScheduleAssetTagging",
|      "label": "Asset tagging schedule",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Daily at 05:50 UTC, after the collection jobs",
|      "description": "Asset tagging (Community edition and Pro): its job runs under its OWN identity, never the read-only collection identity, after the profilers. Its write grants (Defender machine tags, Tag Contributor, Entra custom security attributes) are given only when GrantTaggingRoles is on; TaggingScopes is where Azure tags may be written (default: the collection scope).",
|      "purpose": "When the asset tagging container job runs, as a cron expression in UTC.",
|      "effect": "Sets when tagging rules are evaluated. Running before the collection jobs finish means rules see the previous day's assets.",
|      "whenToChange": "When you move the collection schedules, to keep tagging after them.",
|      "card": "Container jobs",
|      "setupOnly": true,
|      "info": {
|        "what": "When the asset tagging container job runs, as a cron expression in UTC.",
|        "whenChanged": "Sets when tagging rules are evaluated. Running before the collection jobs finish means rules see the previous day's assets.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Daily at 05:50 UTC, after the collection jobs",
|        "recommended": "Keep the default. Change it when: When you move the collection schedules, to keep tagging after them.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ScheduleAssetTagging/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ScheduleAzure",
|      "label": "Azure collection schedule",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Daily at 05:00 UTC",
|      "description": "Cron schedule (UTC) for the Azure profiling container job; defaults to daily at 05:00.",
|      "purpose": "When the Azure profiling container job runs, as a cron expression in UTC.",
|      "effect": "Sets when Azure assets are collected. Reports and later jobs read the result, so keep it before risk analysis.",
|      "whenToChange": "To fit your own maintenance window or time zone.",
|      "card": "Container jobs",
|      "setupOnly": true,
|      "info": {
|        "what": "When the Azure profiling container job runs, as a cron expression in UTC.",
|        "whenChanged": "Sets when Azure assets are collected. Reports and later jobs read the result, so keep it before risk analysis.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Daily at 05:00 UTC",
|        "recommended": "Keep the default. Change it when: To fit your own maintenance window or time zone.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ScheduleAzure/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ScheduleConfigBackup",
|      "label": "Configuration backup job schedule",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Daily at 18:00 UTC: after the working day, before the evening pipeline, never at the 23:00 update.",
|      "description": "the daily configuration backup -- its own timer, outside the pipeline",
|      "purpose": "Schedule (cron, UTC) of the container job that backs up your configuration once a day.",
|      "effect": "Container setup gives the configuration backup job this schedule on its next run. The job is never a step of the pipeline and never runs twice at the same time.",
|      "whenToChange": "Only if your configuration changes happen at another time of day, or the pipeline starts earlier.",
|      "setupOnly": true,
|      "info": {
|        "what": "Schedule (cron, UTC) of the container job that backs up your configuration once a day.",
|        "whenChanged": "Container setup gives the configuration backup job this schedule on its next run. The job is never a step of the pipeline and never runs twice at the same time.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Daily at 18:00 UTC: after the working day, before the evening pipeline, never at the 23:00 update.",
|        "recommended": "Keep the default. Change it when: Only if your configuration changes happen at another time of day, or the pipeline starts earlier.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ScheduleConfigBackup/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ScheduleEndpoint",
|      "label": "Endpoint collection schedule",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Daily at 04:00 UTC",
|      "description": "Cron schedules (UTC).",
|      "purpose": "When the endpoint profiling container job runs, as a cron expression in UTC; also used for jobs without a schedule of their own.",
|      "effect": "Sets when endpoints are collected. Reports and later jobs read the result, so keep it before risk analysis.",
|      "whenToChange": "To fit your own maintenance window or time zone.",
|      "card": "Container jobs",
|      "setupOnly": true,
|      "info": {
|        "what": "When the endpoint profiling container job runs, as a cron expression in UTC; also used for jobs without a schedule of their own.",
|        "whenChanged": "Sets when endpoints are collected. Reports and later jobs read the result, so keep it before risk analysis.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Daily at 04:00 UTC",
|        "recommended": "Keep the default. Change it when: To fit your own maintenance window or time zone.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ScheduleEndpoint/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ScheduleIdentity",
|      "label": "Identity collection schedule",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Daily at 04:30 UTC",
|      "description": "Cron schedule (UTC) for the identity profiling container job; defaults to daily at 04:30.",
|      "purpose": "When the identity profiling container job runs, as a cron expression in UTC.",
|      "effect": "Sets when identities are collected. Reports and later jobs read the result, so keep it before risk analysis.",
|      "whenToChange": "To fit your own maintenance window or time zone.",
|      "card": "Container jobs",
|      "setupOnly": true,
|      "info": {
|        "what": "When the identity profiling container job runs, as a cron expression in UTC.",
|        "whenChanged": "Sets when identities are collected. Reports and later jobs read the result, so keep it before risk analysis.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Daily at 04:30 UTC",
|        "recommended": "Keep the default. Change it when: To fit your own maintenance window or time zone.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ScheduleIdentity/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ScheduleRiskAnalysis",
|      "label": "Summary report schedule",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Daily at 06:00 UTC, after collection",
|      "description": "Cron schedule (UTC) for the Summary risk-analysis container job; defaults to daily at 06:00, after collection has finished.",
|      "purpose": "When the Summary risk-analysis container job runs, as a cron expression in UTC.",
|      "effect": "Sets when the Summary report is built. Running it before collection finishes reports on the previous day's data.",
|      "whenToChange": "When you move the collection schedules or want the report at another time.",
|      "card": "Container jobs",
|      "setupOnly": true,
|      "info": {
|        "what": "When the Summary risk-analysis container job runs, as a cron expression in UTC.",
|        "whenChanged": "Sets when the Summary report is built. Running it before collection finishes reports on the previous day's data.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Daily at 06:00 UTC, after collection",
|        "recommended": "Keep the default. Change it when: When you move the collection schedules or want the report at another time.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ScheduleRiskAnalysis/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ScheduleSchemaDiscovery",
|      "label": "Schema discovery schedule",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Sundays at 03:00 UTC",
|      "description": "Cron schedule (UTC) for the schema-discovery container job; defaults to Sundays at 03:00.",
|      "purpose": "When the schema discovery container job runs, as a cron expression in UTC.",
|      "effect": "Sets how often schema discovery runs. Only used when schema discovery is in the list of container jobs, which it is not by default.",
|      "whenToChange": "Only when schema discovery is deployed and you want another day or time.",
|      "setupOnly": true,
|      "info": {
|        "what": "When the schema discovery container job runs, as a cron expression in UTC.",
|        "whenChanged": "Sets how often schema discovery runs. Only used when schema discovery is in the list of container jobs, which it is not by default.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Sundays at 03:00 UTC",
|        "recommended": "Keep the default. Change it when: Only when schema discovery is deployed and you want another day or time.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ScheduleSchemaDiscovery/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_ScheduleTrend",
|      "label": "Asset trend job schedule",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Daily at 09:00 UTC, moved with the start hour chosen in guided setup.",
|      "description": "Every NON-SECRET setting in this file is passed to the container jobs automatically; secrets travel only as job secrets. Trend and (with Pro) the Pro engines get their own jobs; schedules can be changed with:",
|      "purpose": "Schedule (cron, UTC) of the container job that builds the asset trend; it should run after the Detailed report.",
|      "effect": "Container setup gives the trend job this schedule on its next run (an explicit -ScheduleTrend on the setup command still wins). Running it before the Detailed report trends the previous day's data.",
|      "whenToChange": "Only if the trend job must run at another time, for example after you moved the Detailed report.",
|      "setupOnly": true,
|      "info": {
|        "what": "Schedule (cron, UTC) of the container job that builds the asset trend; it should run after the Detailed report.",
|        "whenChanged": "Container setup gives the trend job this schedule on its next run (an explicit -ScheduleTrend on the setup command still wins). Running it before the Detailed report trends the previous day's data.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Daily at 09:00 UTC, moved with the start hour chosen in guided setup.",
|        "recommended": "Keep the default. Change it when: Only if the trend job must run at another time, for example after you moved the Detailed report.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_ScheduleTrend/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_SkipImageBuild",
|      "label": "Skip container image build",
|      "group": "Sign-in & Azure resources",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: setup builds the image each time.",
|      "description": "When on, container setup skips building the container image and reuses the image already in the registry; off by default.",
|      "purpose": "Lets container setup reuse the image already in the registry instead of building a new one.",
|      "effect": "When on, setup is much faster but the jobs keep running the image already stored, so code changes are not picked up. If no image exists, the jobs fail to start.",
|      "whenToChange": "When re-running setup only to change settings and the image is already current.",
|      "setupOnly": true,
|      "info": {
|        "what": "Lets container setup reuse the image already in the registry instead of building a new one.",
|        "whenOn": "When on, setup is much faster but the jobs keep running the image already stored, so code changes are not picked up. If no image exists, the jobs fail to start.",
|        "whenOff": "setup builds the image each time.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Off: setup builds the image each time.",
|        "recommended": "Keep the default. Change it when: When re-running setup only to change settings and the image is already current.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_SkipImageBuild/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_SqlServiceObjective",
|      "label": "Pro database size",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Empty: the product's rule -- Standard S3 for every install, raised to it when smaller, never lowered.",
|      "description": "The Pro database's size (Azure SQL service objective, S1 to S12) that setup and every update keep, also when it is smaller than the product's; empty = the product's rule (Standard S3).",
|      "purpose": "The size (Azure SQL service objective) of the Pro database. Allowed values: S1, S2, S3, S4, S6, S7, S9, S12. Empty = the product's rule.",
|      "effect": "Every update sets the Pro database to this size, raising or LOWERING it, by one online change (no data loss; open connections reconnect once). Never below S1. A database on Premium, vCore or in an elastic pool is left as it is. The identity database is not affected: it stays S1. A smaller size costs less but makes pages and the nightly writes slower.",
|      "whenToChange": "Only when support advises it -- for example S2 for a small install whose database is mostly idle.",
|      "patternHint": "S1, S2, S3, S4, S6, S7, S9 or S12; empty = the product's rule",
|      "pattern": "^[Ss](1|2|3|4|6|7|9|12)$",
|      "info": {
|        "what": "The size (Azure SQL service objective) of the Pro database. Allowed values: S1, S2, S3, S4, S6, S7, S9, S12. Empty = the product's rule.",
|        "whenChanged": "Every update sets the Pro database to this size, raising or LOWERING it, by one online change (no data loss; open connections reconnect once). Never below S1. A database on Premium, vCore or in an elastic pool is left as it is. The identity database is not affected: it stays S1. A smaller size costs less but makes pages and the nightly writes slower.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Empty: the product's rule -- Standard S3 for every install, raised to it when smaller, never lowered.",
|        "recommended": "Keep the default. Change it when: Only when support advises it -- for example S2 for a small install whose database is mostly idle.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_SqlServiceObjective/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_SubscriptionId",
|      "label": "Container hosting subscription",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Falls back to SI_AzSubscriptionId, then the workspace subscription, then the signed-in Azure context.",
|      "description": "--- container hosting (written by setup; see Bootstrap-ContainerAppJob.ps1) ---- Where the containers live -- setup saves these so every update can find them. An install made before 3.0.0 records them once with: setup\\Invoke-SIContainerUpdate.ps1 -ResourceGroupName <rg> -AcrName <acr> -Save",
|      "purpose": "The Azure subscription the SecurityInsight containers are installed in, saved by setup so later updates and upgrades work in the same subscription.",
|      "effect": "Container setup, updates and upgrades create and look for the containers in this subscription. A wrong value points updates at a subscription where the containers do not exist.",
|      "whenToChange": "Setup writes it. Change only if the container hosting was moved to another subscription.",
|      "info": {
|        "what": "The Azure subscription the SecurityInsight containers are installed in, saved by setup so later updates and upgrades work in the same subscription.",
|        "whenChanged": "Container setup, updates and upgrades create and look for the containers in this subscription. A wrong value points updates at a subscription where the containers do not exist.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Falls back to SI_AzSubscriptionId, then the workspace subscription, then the signed-in Azure context.",
|        "recommended": "Keep the default. Change it when: Setup writes it. Change only if the container hosting was moved to another subscription.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_SubscriptionId/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_TaggingIdentityName",
|      "label": "Asset tagging identity name",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "uami-securityinsight-tagging",
|      "description": "asset tagging's own identity (never the collection one)",
|      "purpose": "Name of the separate managed identity the asset tagging job runs as, so the collection identity stays read-only.",
|      "effect": "Setup creates or reuses this identity for the tagging job. It must differ from the collection identity, or setup stops.",
|      "whenToChange": "Only to follow your naming rules before first deployment.",
|      "setupOnly": true,
|      "info": {
|        "what": "Name of the separate managed identity the asset tagging job runs as, so the collection identity stays read-only.",
|        "whenChanged": "Setup creates or reuses this identity for the tagging job. It must differ from the collection identity, or setup stops.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Nothing else.",
|        "default": "uami-securityinsight-tagging",
|        "recommended": "Keep the default. Change it when: Only to follow your naming rules before first deployment.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_TaggingIdentityName/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_TaggingScopes",
|      "label": "Where Azure tags may be written",
|      "group": "Connectors & CMDB",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "The same scopes the jobs read from (the subscription by default)",
|      "description": "where Azure tags may be written (Tag Contributor)",
|      "purpose": "The Azure scopes, such as subscriptions or resource groups, where the asset tagging identity may write resource tags.",
|      "effect": "A narrower list limits where tags can ever be written; a wider list allows tagging in more places. Rights are granted only when tagging write rights are granted.",
|      "whenToChange": "When tags should only be written in part of your estate.",
|      "card": "Asset tagging",
|      "setupOnly": true,
|      "info": {
|        "what": "The Azure scopes, such as subscriptions or resource groups, where the asset tagging identity may write resource tags.",
|        "whenChanged": "A narrower list limits where tags can ever be written; a wider list allows tagging in more places. Rights are granted only when tagging write rights are granted.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Nothing else.",
|        "default": "The same scopes the jobs read from (the subscription by default)",
|        "recommended": "Keep the default. Change it when: When tags should only be written in part of your estate.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_TaggingScopes/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_TriggerNowAfter",
|      "label": "Start jobs right after setup",
|      "group": "Schedules & what runs",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: jobs wait for their schedule.",
|      "description": "Deployment behaviour switches.",
|      "purpose": "Makes container setup start each job once immediately after creating or updating it.",
|      "effect": "When on, every deployed job runs at once, giving results straight away but running all engines at the same time, out of their normal order, with the compute and API load that brings.",
|      "whenToChange": "For a first test run after setup; leave off otherwise.",
|      "setupOnly": true,
|      "info": {
|        "what": "Makes container setup start each job once immediately after creating or updating it.",
|        "whenOn": "When on, every deployed job runs at once, giving results straight away but running all engines at the same time, out of their normal order, with the compute and API load that brings.",
|        "whenOff": "jobs wait for their schedule.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Off: jobs wait for their schedule.",
|        "recommended": "Keep the default. Change it when: For a first test run after setup; leave off otherwise.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_TriggerNowAfter/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_UseClientSecret",
|      "label": "Jobs sign in with a client secret",
|      "group": "Sign-in & Azure resources",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": true,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: the jobs sign in as a managed identity, unless the configuration already carries a client secret.",
|      "description": "Sign-in of the jobs: a managed identity by default. A client secret only when chosen (a supported choice):",
|      "purpose": "Makes all container jobs sign in as the app registration (service principal) with its client secret instead of a managed identity.",
|      "effect": "On, every job carries the client secret as a job secret. Queue scaling is not available with it. A supported choice, never the default.",
|      "whenToChange": "Only when a managed identity or a certificate cannot be used.",
|      "setupOnly": true,
|      "info": {
|        "what": "Makes all container jobs sign in as the app registration (service principal) with its client secret instead of a managed identity.",
|        "whenOn": "On, every job carries the client secret as a job secret. Queue scaling is not available with it. A supported choice, never the default.",
|        "whenOff": "the jobs sign in as a managed identity, unless the configuration already carries a client secret.",
|        "risk": "Every job carries the client secret: a secret to store, rotate and protect, and queue scaling is not available. A supported choice, but weaker than a managed identity. Reversible: run setup with the managed identity.",
|        "requires": "Kept in the install's Key Vault.",
|        "default": "Off: the jobs sign in as a managed identity, unless the configuration already carries a client secret.",
|        "recommended": "Off (the managed identity).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_UseClientSecret/",
|        "confirmWhen": "on",
|        "confirm": "On, every job carries the client secret as a job secret. Queue scaling is not available with it. A supported choice, never the default. Every job carries the client secret: a secret to store, rotate and protect, and queue scaling is not available. A supported choice, but weaker than a managed identity. Reversible: run setup with the managed identity."
|      }
|    },
|    {
|      "name": "SI_Bootstrap_UseKEDA",
|      "label": "Queue-driven scaling",
|      "group": "Schedules & what runs",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: one scheduled job per engine.",
|      "description": "When on, collection engines run as queue-driven workers that scale from zero with the amount of work instead of one scheduled job each; risk analysis is unaffected.",
|      "purpose": "Runs the collection engines as queue-driven workers that scale from zero with the amount of work, instead of one scheduled job each.",
|      "effect": "When on, each collection engine gets a scheduler and a worker job that scales up to the worker maximum, speeding up large tenants. Risk analysis and asset tagging are not affected.",
|      "whenToChange": "Only for very large tenants where scheduled jobs run too long.",
|      "info": {
|        "what": "Runs the collection engines as queue-driven workers that scale from zero with the amount of work, instead of one scheduled job each.",
|        "whenOn": "When on, each collection engine gets a scheduler and a worker job that scales up to the worker maximum, speeding up large tenants. Risk analysis and asset tagging are not affected.",
|        "whenOff": "one scheduled job per engine.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "Off: one scheduled job per engine.",
|        "recommended": "Keep the default. Change it when: Only for very large tenants where scheduled jobs run too long.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_UseKEDA/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_UseManagedIdentity",
|      "label": "Jobs sign in with managed identity",
|      "group": "Sign-in & Azure resources",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the managed identity anyway, unless the configuration carries a client secret (an existing install keeps it).",
|      "description": "Container setup signs the jobs in as one user-assigned managed identity (the default unless the configuration carries a client secret).",
|      "purpose": "Makes all container jobs sign in as one user-assigned managed identity, said explicitly.",
|      "effect": "On, setup creates the identity and the jobs carry no secret; the image is also pulled as that identity. Its rights are listed, and granted only when setup is told to grant them; some database access is a one-time manual step.",
|      "whenToChange": "To move an existing install that signs in with a client secret to a managed identity; guided installs switch it on.",
|      "card": "Container hosting",
|      "setupOnly": true,
|      "info": {
|        "what": "Makes all container jobs sign in as one user-assigned managed identity, said explicitly.",
|        "whenOn": "On, setup creates the identity and the jobs carry no secret; the image is also pulled as that identity. Its rights are listed, and granted only when setup is told to grant them; some database access is a one-time manual step.",
|        "whenOff": "Not set: the managed identity anyway, unless the configuration carries a client secret (an existing install keeps it).",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Not set: the managed identity anyway, unless the configuration carries a client secret (an existing install keeps it).",
|        "recommended": "Keep the default. Change it when: To move an existing install that signs in with a client secret to a managed identity; guided installs switch it on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_UseManagedIdentity/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_WebAppCpu",
|      "label": "Web app CPU",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Empty: the product's size, 2 CPU / 4 GiB.",
|      "description": "Sizes (Pro). Empty = the product's size, which setup and every update give: the web app 2 CPU / 4 GiB, the Pro database Standard S3. A size set here is kept by every update, also when it is SMALLER: the web app's CPU (0.5 to 4 in steps of 0.25; memory is 2 x CPU unless WebAppMemory says it), and the Pro database's service objective (S1, S2, S3, S4, S6, S7, S9, S12 -- never below S1). Support sets them per install in the Pro database (Settings page, setup\\Set-SIProSetting.ps1).",
|      "purpose": "The CPU of the web app's own container: 0.5 to 4, in steps of 0.25. Empty = the product's size.",
|      "effect": "Every update sets the web app to this CPU, raising or lowering it, with memory twice the CPU unless Web app memory says otherwise. The sign-in front next to it keeps its own 0.25 CPU / 0.5 GiB; together they stay within 4 CPU / 8 GiB.",
|      "whenToChange": "Only when support advises it -- the web app normally uses a small part of 2 CPU.",
|      "unit": "CPU",
|      "patternHint": "0.5 to 4 in steps of 0.25; empty = the product's size",
|      "pattern": "^(0\\.5|0\\.75|[1-3](\\.(0|25|5|75))?|4(\\.0)?)$",
|      "info": {
|        "what": "The CPU of the web app's own container: 0.5 to 4, in steps of 0.25. Empty = the product's size.",
|        "whenChanged": "Every update sets the web app to this CPU, raising or lowering it, with memory twice the CPU unless Web app memory says otherwise. The sign-in front next to it keeps its own 0.25 CPU / 0.5 GiB; together they stay within 4 CPU / 8 GiB.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Empty: the product's size, 2 CPU / 4 GiB.",
|        "recommended": "Keep the default. Change it when: Only when support advises it -- the web app normally uses a small part of 2 CPU.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_WebAppCpu/"
|      }
|    },
|    {
|      "name": "SI_Bootstrap_WebAppMemory",
|      "label": "Web app memory",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Empty: twice the CPU (4 GiB with the product's 2 CPU).",
|      "description": "The web app's memory (for example 4Gi) that every update keeps; empty = twice the CPU.",
|      "purpose": "The memory of the web app's own container, for example 4Gi. Empty = twice the web app's CPU.",
|      "effect": "Every update sets the web app to this memory. Azure takes memory as twice the CPU, so a memory set alone also sets the CPU to half of it.",
|      "whenToChange": "Rarely; set Web app CPU instead.",
|      "unit": "GiB",
|      "patternHint": "1Gi to 8Gi in steps of 0.5Gi; empty = twice the CPU",
|      "pattern": "^([1-8](\\.(0|5))?)(Gi)?$",
|      "info": {
|        "what": "The memory of the web app's own container, for example 4Gi. Empty = twice the web app's CPU.",
|        "whenChanged": "Every update sets the web app to this memory. Azure takes memory as twice the CPU, so a memory set alone also sets the CPU to half of it.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Empty: twice the CPU (4 GiB with the product's 2 CPU).",
|        "recommended": "Keep the default. Change it when: Rarely; set Web app CPU instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Bootstrap_WebAppMemory/"
|      }
|    },
|    {
|      "name": "SI_BucketLateRetries",
|      "label": "Risk Analysis late bucket retries",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "3 attempts",
|      "description": "--- risk analysis ----------------------------------------------------------- Late retries of a bucket that failed transiently, after the main pass (default 3).",
|      "purpose": "How many extra attempts a query slice gets at the end of a Risk Analysis report when it failed earlier because the service was throttling or unavailable.",
|      "effect": "More attempts recover more slices on a busy tenant but lengthen the run (each waits up to 10 minutes). Fewer, or 0, ends sooner but the rows of a failed slice are missing from the report.",
|      "whenToChange": "Most installs never should. Raise it if reports often miss rows because of throttling.",
|      "unit": "attempts",
|      "info": {
|        "what": "How many extra attempts a query slice gets at the end of a Risk Analysis report when it failed earlier because the service was throttling or unavailable.",
|        "whenChanged": "More attempts recover more slices on a busy tenant but lengthen the run (each waits up to 10 minutes). Fewer, or 0, ends sooner but the rows of a failed slice are missing from the report.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "3 attempts",
|        "recommended": "Keep the default. Change it when: Most installs never should. Raise it if reports often miss rows because of throttling.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_BucketLateRetries/"
|      }
|    },
|    {
|      "name": "SI_BucketOverflowRetries",
|      "label": "Risk Analysis too-large slice retries",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1 attempt (split at once)",
|      "description": "1 = split a too-large slice at once",
|      "purpose": "How many times a Risk Analysis query slice that the service answers as too large is sent at the same size before it is split into smaller slices. 1 splits it on the first too-large answer.",
|      "effect": "Higher sends the same too-large request again, after a 30 s and then a 60 s pause, before splitting it. The same request at the same size fails the same way, so this only adds time. Throttling, timeouts and service errors are retried separately (Risk Analysis transient error retries).",
|      "whenToChange": "Most installs never should. Keep 1.",
|      "unit": "attempts",
|      "info": {
|        "what": "How many times a Risk Analysis query slice that the service answers as too large is sent at the same size before it is split into smaller slices. 1 splits it on the first too-large answer.",
|        "whenChanged": "Higher sends the same too-large request again, after a 30 s and then a 60 s pause, before splitting it. The same request at the same size fails the same way, so this only adds time. Throttling, timeouts and service errors are retried separately (Risk Analysis transient error retries).",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "1 attempt (split at once)",
|        "recommended": "Keep the default. Change it when: Most installs never should. Keep 1.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_BucketOverflowRetries/"
|      }
|    },
|    {
|      "name": "SI_BucketTransientRetries",
|      "label": "Risk Analysis transient error retries",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "3 attempts",
|      "description": "retry a bucket on a transient error",
|      "purpose": "How many times a Risk Analysis query slice is retried, after signing in again, when it fails with a temporary error such as an expired token or a gateway timeout.",
|      "effect": "More attempts make long reports more robust against brief outages, at the cost of a longer run when the service stays unavailable. Fewer gives up on a slice sooner.",
|      "whenToChange": "Most installs never should. Raise it on tenants with frequent temporary service errors.",
|      "unit": "attempts",
|      "info": {
|        "what": "How many times a Risk Analysis query slice is retried, after signing in again, when it fails with a temporary error such as an expired token or a gateway timeout.",
|        "whenChanged": "More attempts make long reports more robust against brief outages, at the cost of a longer run when the service stays unavailable. Fewer gives up on a slice sooner.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "3 attempts",
|        "recommended": "Keep the default. Change it when: Most installs never should. Raise it on tenants with frequent temporary service errors.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_BucketTransientRetries/"
|      }
|    },
|    {
|      "name": "SI_CiBuild_FullReconcileDays",
|      "label": "CI build: days between full rebuilds",
|      "group": "Schedules & what runs",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 7,
|      "defaultText": "7 days: every CI is rebuilt at least once a week; the days between build only what changed",
|      "description": "The CI build (correlation) rebuilds only the CIs whose records, link states, time thresholds, identity anchors or manual overrides changed since their last build; every CI is rebuilt (a full reconcile) when the last full build is this many days old, when the data model, rules, mappings or CMDB change, and after a build that failed. 0 = a full build every run.",
|      "purpose": "The CI build (correlation) rebuilds only the CIs whose input changed since their last build: a record new, changed, moved or gone, a link state, a time threshold, an identity anchor or a manual override. Every CI is rebuilt (a full reconcile) when the last full build is this many days old; also at once when the data model, rules, mappings or CMDB change, and after a build that failed.",
|      "effect": "A lower value rebuilds every CI more often (a longer correlation run on those days); 0 rebuilds every CI on every run, as before. A full reconcile that finds a CI the daily builds should have changed says so in the run log.",
|      "whenToChange": "Set 0 while support investigates a CI that looks out of date; otherwise keep the default.",
|      "unit": "days",
|      "min": 0,
|      "max": 365,
|      "card": "Daily pipeline",
|      "info": {
|        "what": "The CI build (correlation) rebuilds only the CIs whose input changed since their last build: a record new, changed, moved or gone, a link state, a time threshold, an identity anchor or a manual override. Every CI is rebuilt (a full reconcile) when the last full build is this many days old; also at once when the data model, rules, mappings or CMDB change, and after a build that failed.",
|        "whenChanged": "A lower value rebuilds every CI more often (a longer correlation run on those days); 0 rebuilds every CI on every run, as before. A full reconcile that finds a CI the daily builds should have changed says so in the run log.",
|        "risk": "None to the data: a change to what the CIs are built from always rebuilds every CI on the next run; the setting only decides how often an unchanged estate is rebuilt in full. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "7 days: every CI is rebuilt at least once a week; the days between build only what changed",
|        "recommended": "Keep the default (7).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CiBuild_FullReconcileDays/"
|      }
|    },
|    {
|      "name": "SI_CiRulesBudgetSeconds",
|      "label": "CI build: time limit for the rules of one asset",
|      "group": "Schedules & what runs",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 60,
|      "defaultText": "60 seconds per asset",
|      "description": "The seconds the rules of ONE asset may take in the CI build. An asset that takes longer is not fully evaluated in that run: it keeps what it had from its last complete evaluation (a new asset is left out), is named in the run log and is evaluated again in the next run -- one asset never holds the build. 0 = no limit.",
|      "purpose": "How long the rules of one asset may take in the CI build (correlation) before the build goes on with the next asset. Applying the rules to one asset normally takes milliseconds; an asset with unusually large data could otherwise hold the whole build, and with it every step after it.",
|      "effect": "An asset that takes longer is not fully evaluated in that run. Nothing of the half evaluation is stored: Risk Analysis and the views keep what the asset had from its last complete evaluation, and a new asset is left out until it is fully evaluated. It is named in the run log, counted (\"N asset(s) not fully evaluated in this run\") and evaluated again in the next run. A higher value gives a slow asset more time; 0 removes the limit, and one asset can then hold the build for as long as its rules take.",
|      "whenToChange": "Raise it when the run log names the same assets as not fully evaluated run after run and they must be included before the cause is fixed; otherwise keep the default.",
|      "unit": "seconds",
|      "min": 0,
|      "card": "Daily pipeline",
|      "info": {
|        "what": "How long the rules of one asset may take in the CI build (correlation) before the build goes on with the next asset. Applying the rules to one asset normally takes milliseconds; an asset with unusually large data could otherwise hold the whole build, and with it every step after it.",
|        "whenChanged": "An asset that takes longer is not fully evaluated in that run. Nothing of the half evaluation is stored: Risk Analysis and the views keep what the asset had from its last complete evaluation, and a new asset is left out until it is fully evaluated. It is named in the run log, counted (\"N asset(s) not fully evaluated in this run\") and evaluated again in the next run. A higher value gives a slow asset more time; 0 removes the limit, and one asset can then hold the build for as long as its rules take.",
|        "risk": "None to the data either way: an asset that is not fully evaluated keeps its last complete result, and no tier or finding is based on part of the rules. A very high value, or 0, lets one asset hold the build and with it the steps after it. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "60 seconds per asset",
|        "recommended": "Keep the default (60).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CiRulesBudgetSeconds/"
|      }
|    },
|    {
|      "name": "SI_Cmdb_AllowCreate",
|      "label": "ServiceNow CMDB: allow creating CIs",
|      "group": "Connectors & CMDB",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: no CI is created",
|      "description": "the second switch before a CI is created",
|      "purpose": "The second switch needed before the ServiceNow CMDB connector creates a CI.",
|      "effect": "On, with the create-if-unmatched mode and apply, unmatched assets are created as CIs in ServiceNow.",
|      "whenToChange": "Together with the create-if-unmatched mode.",
|      "info": {
|        "what": "The second switch needed before the ServiceNow CMDB connector creates a CI.",
|        "whenOn": "On, with the create-if-unmatched mode and apply, unmatched assets are created as CIs in ServiceNow.",
|        "whenOff": "no CI is created",
|        "risk": "New CIs are created in ServiceNow (with apply and the create-if-unmatched mode); created CIs stay when it is turned off again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Off: no CI is created",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Cmdb_AllowCreate/",
|        "confirmWhen": "on",
|        "confirm": "SecurityInsight will create CIs in your ServiceNow CMDB for assets it could not match."
|      }
|    },
|    {
|      "name": "SI_Cmdb_Mode",
|      "label": "ServiceNow CMDB: match mode",
|      "group": "Connectors & CMDB",
|      "type": "enum",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "match-only: only matched CIs are updated",
|      "description": "'match-only' | 'create-if-unmatched'",
|      "purpose": "Whether the ServiceNow CMDB connector only updates CIs it matched, or may also create CIs for assets it could not match.",
|      "effect": "create-if-unmatched creates a CI for an asset ServiceNow does not know, when creating is also allowed (SI_Cmdb_AllowCreate).",
|      "whenToChange": "When SecurityInsight should add the assets your CMDB is missing.",
|      "values": [
|        "match-only",
|        "create-if-unmatched"
|      ],
|      "info": {
|        "what": "Whether the ServiceNow CMDB connector only updates CIs it matched, or may also create CIs for assets it could not match.",
|        "whenChanged": "create-if-unmatched creates a CI for an asset ServiceNow does not know, when creating is also allowed (SI_Cmdb_AllowCreate).",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "match-only: only matched CIs are updated",
|        "recommended": "Keep the default. Change it when: When SecurityInsight should add the assets your CMDB is missing.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Cmdb_Mode/"
|      }
|    },
|    {
|      "name": "SI_Cmdb_RetireAfterDays",
|      "label": "Days unseen before a CI may be retired",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "7 days",
|      "description": "The least number of days an asset must go unseen before its CI is retired (in the CI table and in the state handed to ServiceNow) -- a brake under every other rule (the grace period, the runs missing, an early retirement). Default 7, at least 1.",
|      "purpose": "The least number of days an asset must go unseen before its CI is retired -- in the CI table and in the state handed to ServiceNow. A brake under every other rule: whatever decided the retirement (the grace period, the runs missing, an early retirement on the Not seen anymore page), the CI waits until its asset has been unseen this long.",
|      "effect": "Higher keeps CIs of assets that are away for a while; a CI retired too early is the one mistake that does not heal by itself. No grace period can be shorter than this. Below 1 is raised to 1; non-numbers use 7.",
|      "whenToChange": "Raise it if CIs are retired for assets that come back after a week or more.",
|      "unit": "days",
|      "min": 1,
|      "card": "SQL CMDB connector",
|      "info": {
|        "what": "The least number of days an asset must go unseen before its CI is retired -- in the CI table and in the state handed to ServiceNow. A brake under every other rule: whatever decided the retirement (the grace period, the runs missing, an early retirement on the Not seen anymore page), the CI waits until its asset has been unseen this long.",
|        "whenChanged": "Higher keeps CIs of assets that are away for a while; a CI retired too early is the one mistake that does not heal by itself. No grace period can be shorter than this. Below 1 is raised to 1; non-numbers use 7.",
|        "risk": "A lower value lets a CI retire sooner after its asset was last seen -- a device that is only offline for a few days can lose its CI (in the CI table and in ServiceNow). A CI retired by mistake does not heal by itself until the asset is seen again. Reversible for the future.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "7 days",
|        "recommended": "7 days (the brake against CIs retired by mistake).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Cmdb_RetireAfterDays/",
|        "confirmWhen": "lower",
|        "confirm": "A lower value lets a CI retire sooner after its asset was last seen -- a device that is only offline for a few days can lose its CI (in the CI table and in ServiceNow). A CI retired by mistake does not heal by itself until the asset is seen again. Reversible for the future."
|      }
|    },
|    {
|      "name": "SI_Cmdb_RowLimit",
|      "label": "ServiceNow CMDB: row limit",
|      "group": "Connectors & CMDB",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0: no limit, every asset",
|      "description": "0 = every asset; a number = only that many (testing)",
|      "purpose": "A limit on how many assets one ServiceNow CMDB run handles, for trying the connector on a few assets first.",
|      "effect": "A number above 0 handles only that many assets per run.",
|      "whenToChange": "Only while testing the connector.",
|      "min": 0,
|      "info": {
|        "what": "A limit on how many assets one ServiceNow CMDB run handles, for trying the connector on a few assets first.",
|        "whenChanged": "A number above 0 handles only that many assets per run.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "0: no limit, every asset",
|        "recommended": "Keep the default. Change it when: Only while testing the connector.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Cmdb_RowLimit/"
|      }
|    },
|    {
|      "name": "SI_Cmdb_Run",
|      "label": "ServiceNow CMDB: write or plan",
|      "group": "Connectors & CMDB",
|      "type": "enum",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "plan: nothing is written to ServiceNow; the match report is produced",
|      "description": "--- ServiceNow CMDB connector (the asset-cmdb job) and the asset correlation ---",
|      "purpose": "Whether the ServiceNow CMDB connector writes to your ServiceNow instance or only plans and reports what it would write.",
|      "effect": "apply writes the matched CIs (and, with creating allowed, new ones) to ServiceNow on every run. plan writes nothing.",
|      "whenToChange": "Set apply once the plan report shows the matches you expect.",
|      "values": [
|        "plan",
|        "apply"
|      ],
|      "card": "ServiceNow CMDB connector",
|      "info": {
|        "what": "Whether the ServiceNow CMDB connector writes to your ServiceNow instance or only plans and reports what it would write.",
|        "whenChanged": "apply writes the matched CIs (and, with creating allowed, new ones) to ServiceNow on every run. plan writes nothing.",
|        "risk": "apply writes to your ServiceNow CMDB on every run; plan writes nothing. Reversible for future runs; what was written stays in ServiceNow.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "plan: nothing is written to ServiceNow; the match report is produced",
|        "recommended": "plan until the match report shows what you expect.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Cmdb_Run/"
|      }
|    },
|    {
|      "name": "SI_CmdbCsvPath",
|      "label": "CMDB export file location",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The CMDB.csv in the CMDB provider folder is used",
|      "description": "Full path to your CMDB export CSV when it is kept outside the SecurityInsight folder; when empty, the CSV is looked for in the CMDB provider folder.",
|      "purpose": "Points the CMDB provider at your CMDB export CSV when it is stored outside the SecurityInsight folder, for example on a file share.",
|      "effect": "The CMDB cache is loaded from this file instead of the provider folder. A wrong path means no CMDB data, so CMDB columns stay empty. In SecurityInsight Pro the file is read once, by setup, to move it into the CMDB in the Pro database; runs then read the Pro CMDB.",
|      "whenToChange": "Only when your CMDB export lives on a share or other folder; leave empty when you drop CMDB.csv in the provider folder.",
|      "info": {
|        "what": "Points the CMDB provider at your CMDB export CSV when it is stored outside the SecurityInsight folder, for example on a file share.",
|        "whenChanged": "The CMDB cache is loaded from this file instead of the provider folder. A wrong path means no CMDB data, so CMDB columns stay empty. In SecurityInsight Pro the file is read once, by setup, to move it into the CMDB in the Pro database; runs then read the Pro CMDB.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Nothing else.",
|        "default": "The CMDB.csv in the CMDB provider folder is used",
|        "recommended": "Keep the default. Change it when: Only when your CMDB export lives on a share or other folder; leave empty when you drop CMDB.csv in the provider folder.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CmdbCsvPath/"
|      }
|    },
|    {
|      "name": "SI_CmdbRefreshIntervalHours",
|      "label": "CMDB cache refresh interval",
|      "group": "Connectors & CMDB",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "24 hours",
|      "description": "How many hours the cached CMDB data is reused before it is refreshed from the CSV; defaults to 24.",
|      "purpose": "How long the cached CMDB data is reused before it is reloaded from the CSV at the start of a profiling run.",
|      "effect": "Lower values pick up CMDB changes sooner but re-read the CSV more often; higher values save work but CMDB changes appear later. A full run always refreshes.",
|      "whenToChange": "Rarely. Lower it if your CMDB export changes several times a day.",
|      "unit": "hours",
|      "info": {
|        "what": "How long the cached CMDB data is reused before it is reloaded from the CSV at the start of a profiling run.",
|        "whenChanged": "Lower values pick up CMDB changes sooner but re-read the CSV more often; higher values save work but CMDB changes appear later. A full run always refreshes.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Nothing else.",
|        "default": "24 hours",
|        "recommended": "Keep the default. Change it when: Rarely. Lower it if your CMDB export changes several times a day.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CmdbRefreshIntervalHours/"
|      }
|    },
|    {
|      "name": "SI_CollectDefenderRecommendations",
|      "label": "Defender for Cloud recommendations",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On: recommendations are collected on every Azure run",
|      "description": "--- azure engine: Defender for Cloud recommendations + CVEs ------------------- Collected by default into their own table. Opt out, or rename the destination:",
|      "purpose": "Whether the Azure engine also collects every unhealthy Defender for Cloud recommendation into its own table for the Risk Analysis reports.",
|      "effect": "Setting it to false skips the recommendations step: the Azure run is a little shorter and ingests less data, but reports have no Defender for Cloud recommendation findings.",
|      "whenToChange": "Turn off only if you do not use Defender for Cloud or do not want these findings.",
|      "card": "Extra details",
|      "info": {
|        "what": "Whether the Azure engine also collects every unhealthy Defender for Cloud recommendation into its own table for the Risk Analysis reports.",
|        "whenOn": "recommendations are collected on every Azure run",
|        "whenOff": "Setting it to false skips the recommendations step: the Azure run is a little shorter and ingests less data, but reports have no Defender for Cloud recommendation findings.",
|        "risk": "Defender for Cloud recommendations are no longer collected: those findings disappear from the reports (they are not fixed). Reversible: the next Azure run collects them again.",
|        "requires": "Nothing else.",
|        "default": "On: recommendations are collected on every Azure run",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CollectDefenderRecommendations/",
|        "confirmWhen": "off",
|        "confirm": "Setting it to false skips the recommendations step: the Azure run is a little shorter and ingests less data, but reports have no Defender for Cloud recommendation findings. Defender for Cloud recommendations are no longer collected: those findings disappear from the reports (they are not fixed). Reversible: the next Azure run collects them again."
|      }
|    },
|    {
|      "name": "SI_Correlation_DryRun",
|      "label": "Asset correlation: plan only",
|      "group": "Connectors & CMDB",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: the correlation results are published",
|      "description": "compute and report, publish nothing",
|      "purpose": "Makes the asset correlation compute and report its results without publishing them.",
|      "effect": "On, nothing is published, so the CI keys stay as they were on the last published run.",
|      "whenToChange": "Only while checking a change to the correlation.",
|      "info": {
|        "what": "Makes the asset correlation compute and report its results without publishing them.",
|        "whenOn": "On, nothing is published, so the CI keys stay as they were on the last published run.",
|        "whenOff": "the correlation results are published",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Off: the correlation results are published",
|        "recommended": "Keep the default. Change it when: Only while checking a change to the correlation.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Correlation_DryRun/"
|      }
|    },
|    {
|      "name": "SI_Correlation_RowLimit",
|      "label": "Asset correlation: row limit",
|      "group": "Connectors & CMDB",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0: no limit, every asset",
|      "description": "0 = every asset (troubleshooting only)",
|      "purpose": "A limit on how many assets one correlation run reads, for troubleshooting.",
|      "effect": "A number above 0 correlates only that many assets; the rest keep their previous result.",
|      "whenToChange": "Only while troubleshooting.",
|      "min": 0,
|      "info": {
|        "what": "A limit on how many assets one correlation run reads, for troubleshooting.",
|        "whenChanged": "A number above 0 correlates only that many assets; the rest keep their previous result.",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "0: no limit, every asset",
|        "recommended": "Keep the default. Change it when: Only while troubleshooting.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Correlation_RowLimit/"
|      }
|    },
|    {
|      "name": "SI_CustomConfigPath",
|      "label": "Custom configuration file path",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The standard custom configuration file in the config folder",
|      "description": "Path to a non-default custom config file (only when this file lives outside the canonical config/ folder; very rare).",
|      "purpose": "Points the asset-profiling engine at a custom configuration file kept outside the standard config folder.",
|      "effect": "When set, the profiling engine loads this file at start, even when started by a launcher. A wrong path means your settings are not applied.",
|      "whenToChange": "Very rarely; only if your custom configuration file lives outside the config folder.",
|      "info": {
|        "what": "Points the asset-profiling engine at a custom configuration file kept outside the standard config folder.",
|        "whenChanged": "When set, the profiling engine loads this file at start, even when started by a launcher. A wrong path means your settings are not applied.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "The standard custom configuration file in the config folder",
|        "recommended": "Keep the default. Change it when: Very rarely; only if your custom configuration file lives outside the config folder.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CustomConfigPath/"
|      }
|    },
|    {
|      "name": "SI_CVE_MaxPublishedAgeDays",
|      "label": "CVE maximum age",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: CVEs of every age are reported",
|      "description": "0 = off",
|      "purpose": "Limits the vulnerability (CVE) reports to vulnerabilities published within the last number of days.",
|      "effect": "Any value above 0 removes older CVEs from the reports, making them shorter and faster, but old unpatched vulnerabilities are no longer shown.",
|      "whenToChange": "Only if you deliberately want to focus on recently published vulnerabilities.",
|      "unit": "days",
|      "card": "Vulnerability (CVE) filters",
|      "info": {
|        "what": "Limits the vulnerability (CVE) reports to vulnerabilities published within the last number of days.",
|        "whenChanged": "Any value above 0 removes older CVEs from the reports, making them shorter and faster, but old unpatched vulnerabilities are no longer shown.",
|        "risk": "Any value above 0 hides older CVEs from the reports: old unpatched vulnerabilities -- often the most exploited -- become invisible to readers. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Off: CVEs of every age are reported",
|        "recommended": "0 (every CVE, whatever its age).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CVE_MaxPublishedAgeDays/"
|      }
|    },
|    {
|      "name": "SI_CVE_MinCvssScore",
|      "label": "CVE minimum CVSS score",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: CVEs of every score are reported",
|      "description": "0..10; 0 = off",
|      "purpose": "Limits the vulnerability (CVE) reports to vulnerabilities at or above this CVSS score (0 to 10).",
|      "effect": "A value above 0 removes lower-scored CVEs from the reports, making them shorter and faster but hiding those findings completely.",
|      "whenToChange": "Only if you want to focus on high-impact vulnerabilities, for example 7.0.",
|      "card": "Vulnerability (CVE) filters",
|      "info": {
|        "what": "Limits the vulnerability (CVE) reports to vulnerabilities at or above this CVSS score (0 to 10).",
|        "whenChanged": "A value above 0 removes lower-scored CVEs from the reports, making them shorter and faster but hiding those findings completely.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Off: CVEs of every score are reported",
|        "recommended": "Keep the default. Change it when: Only if you want to focus on high-impact vulnerabilities, for example 7.0.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CVE_MinCvssScore/"
|      }
|    },
|    {
|      "name": "SI_CVE_MinSeverity",
|      "label": "CVE minimum severity",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: CVEs of every severity are reported",
|      "description": "--- CVE report filters (RA) ----------------------------------------------- All OFF by default -- every CVE is reported. Each one REMOVES findings.",
|      "purpose": "Limits the vulnerability (CVE) reports to this severity and above: Critical, High or Medium.",
|      "effect": "Setting it removes all less severe CVEs from the reports. Shorter, faster reports, but those findings are not shown anywhere in the report. An unknown value is ignored.",
|      "whenToChange": "Only if you want the reports to focus on the most severe vulnerabilities.",
|      "card": "Vulnerability (CVE) filters",
|      "info": {
|        "what": "Limits the vulnerability (CVE) reports to this severity and above: Critical, High or Medium.",
|        "whenChanged": "Setting it removes all less severe CVEs from the reports. Shorter, faster reports, but those findings are not shown anywhere in the report. An unknown value is ignored.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Off: CVEs of every severity are reported",
|        "recommended": "Keep the default. Change it when: Only if you want the reports to focus on the most severe vulnerabilities.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CVE_MinSeverity/"
|      }
|    },
|    {
|      "name": "SI_CVE_RequireExploit",
|      "label": "Only CVEs with known exploits",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: CVEs are reported whether or not an exploit is known",
|      "description": "only CVEs with exploit signals",
|      "purpose": "Limits the vulnerability (CVE) reports to vulnerabilities for which an exploit is known to exist.",
|      "effect": "When on, every CVE without a known exploit is removed from the reports. Much shorter reports, but unexploited vulnerabilities are hidden.",
|      "whenToChange": "Only if you want to prioritise vulnerabilities that are actively exploitable.",
|      "card": "Vulnerability (CVE) filters",
|      "info": {
|        "what": "Limits the vulnerability (CVE) reports to vulnerabilities for which an exploit is known to exist.",
|        "whenOn": "When on, every CVE without a known exploit is removed from the reports. Much shorter reports, but unexploited vulnerabilities are hidden.",
|        "whenOff": "CVEs are reported whether or not an exploit is known",
|        "risk": "Hides every vulnerability without a known exploit from the reports: real, patchable exposure becomes invisible to readers. Reversible at once (the next report shows them again).",
|        "requires": "Nothing else.",
|        "default": "Off: CVEs are reported whether or not an exploit is known",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_CVE_RequireExploit/",
|        "confirmWhen": "on",
|        "confirm": "When on, every CVE without a known exploit is removed from the reports. Much shorter reports, but unexploited vulnerabilities are hidden. Hides every vulnerability without a known exploit from the reports: real, patchable exposure becomes invisible to readers. Reversible at once (the next report shows them again)."
|      }
|    },
|    {
|      "name": "SI_DataHealth_Enabled",
|      "label": "Data health check",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On",
|      "description": "DATA HEALTH (Pro): every day a random 10% of each source's records are looked up in the newest collection, and a random 10% of the devices with vulnerability findings are asked again from Defender. Read-only. Three anomalous days in a row make the data Unhealthy (nothing is sent out until one good day, or a SuperAdmin lets one channel through); one good day, Healthy.",
|      "purpose": "Every day SecurityInsight checks its own data: a random 10% of each source's records (at least 50) are read from the source and looked up in the newest collection, and a random 10% of the devices with vulnerability findings are asked again from Defender. It only reads. Three anomalous days in a row make the data Unhealthy, one good day makes it Healthy again; while Unhealthy nothing is sent out unless a SuperAdmin lets a channel through.",
|      "effect": "Off: nothing is checked, the state is no longer updated and nothing is held because of data health. On: the check runs with the verification job every day.",
|      "whenToChange": "Keep it on. Switch it off only for a short time while Microsoft support confirms a problem in a source.",
|      "card": "Data health",
|      "info": {
|        "what": "Every day SecurityInsight checks its own data: a random 10% of each source's records (at least 50) are read from the source and looked up in the newest collection, and a random 10% of the devices with vulnerability findings are asked again from Defender. It only reads. Three anomalous days in a row make the data Unhealthy, one good day makes it Healthy again; while Unhealthy nothing is sent out unless a SuperAdmin lets a channel through.",
|        "whenOn": "the check runs with the verification job every day.",
|        "whenOff": "nothing is checked, the state is no longer updated and nothing is held because of data health.",
|        "risk": "Off: SecurityInsight no longer checks its own data, and nothing is held when the data goes wrong -- a short or wrong collection can reach tickets, the CMDB and the connectors. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "On",
|        "recommended": "Keep the default. Change it when: Keep it on. Switch it off only for a short time while Microsoft support confirms a problem in a source.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_Enabled/"
|      }
|    },
|    {
|      "name": "SI_DataHealth_Margin_Azure",
|      "label": "Data health margin: Azure resources",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "3 %",
|      "description": "Data health margin, Azure resources: percent of those checked that may differ.",
|      "purpose": "How many of the checked Azure resources may be missing from the newest collection or differ from Azure before the day counts as anomalous, as a percent of the resources checked (never fewer than the minimum records below).",
|      "effect": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|      "whenToChange": "Raise it only when resources are created and deleted all day (for example short-lived test environments).",
|      "unit": "%",
|      "card": "Data health",
|      "info": {
|        "what": "How many of the checked Azure resources may be missing from the newest collection or differ from Azure before the day counts as anomalous, as a percent of the resources checked (never fewer than the minimum records below).",
|        "whenChanged": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|        "risk": "Higher: more missing or different Azure resources are tolerated before data-out is held. Lower: data-out is held sooner. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "3 %",
|        "recommended": "Keep the default. Change it when: Raise it only when resources are created and deleted all day (for example short-lived test environments).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_Margin_Azure/"
|      }
|    },
|    {
|      "name": "SI_DataHealth_Margin_DefenderForCloud",
|      "label": "Data health margin: Defender for Cloud recommendations",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "5 %",
|      "description": "Data health margin, Defender for Cloud recommendations: percent of those checked that may differ.",
|      "purpose": "How many of the checked resources with Defender for Cloud recommendations may be missing from the newest collection or have a different number of open recommendations before the day counts as anomalous, as a percent of those checked (never fewer than the minimum records below).",
|      "effect": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|      "whenToChange": "Raise it only when Defender for Cloud re-evaluates many resources between the collection and the check.",
|      "unit": "%",
|      "card": "Data health",
|      "info": {
|        "what": "How many of the checked resources with Defender for Cloud recommendations may be missing from the newest collection or have a different number of open recommendations before the day counts as anomalous, as a percent of those checked (never fewer than the minimum records below).",
|        "whenChanged": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|        "risk": "Higher: more differences in Defender for Cloud recommendations are tolerated before data-out is held. Lower: data-out is held sooner. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "5 %",
|        "recommended": "Keep the default. Change it when: Raise it only when Defender for Cloud re-evaluates many resources between the collection and the check.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_Margin_DefenderForCloud/"
|      }
|    },
|    {
|      "name": "SI_DataHealth_Margin_Devices",
|      "label": "Data health margin: Defender devices",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "2 %",
|      "description": "Data health margin, Defender devices: percent of those checked that may differ.",
|      "purpose": "How many of the checked Defender for Endpoint devices may be missing from the newest collection or differ from Defender before the day counts as anomalous, as a percent of the devices checked (never fewer than the minimum records below).",
|      "effect": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|      "whenToChange": "Raise it only when many devices are onboarded or removed every day.",
|      "unit": "%",
|      "card": "Data health",
|      "info": {
|        "what": "How many of the checked Defender for Endpoint devices may be missing from the newest collection or differ from Defender before the day counts as anomalous, as a percent of the devices checked (never fewer than the minimum records below).",
|        "whenChanged": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|        "risk": "Higher: more missing or different devices are tolerated before data-out is held. Lower: data-out is held sooner. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "2 %",
|        "recommended": "Keep the default. Change it when: Raise it only when many devices are onboarded or removed every day.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_Margin_Devices/"
|      }
|    },
|    {
|      "name": "SI_DataHealth_Margin_EntraApps",
|      "label": "Data health margin: Entra apps and service principals",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1 %",
|      "description": "Data health margin, Entra apps and service principals: percent of those checked that may differ.",
|      "purpose": "How many of the checked Entra apps and service principals may be missing from the newest collection or differ from Entra before the day counts as anomalous, as a percent of those checked (never fewer than the minimum records below).",
|      "effect": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|      "whenToChange": "Raise it only when apps are added and removed so often that normal changes count as differences.",
|      "unit": "%",
|      "card": "Data health",
|      "info": {
|        "what": "How many of the checked Entra apps and service principals may be missing from the newest collection or differ from Entra before the day counts as anomalous, as a percent of those checked (never fewer than the minimum records below).",
|        "whenChanged": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|        "risk": "Higher: more missing or different apps are tolerated before data-out is held. Lower: data-out is held sooner. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "1 %",
|        "recommended": "Keep the default. Change it when: Raise it only when apps are added and removed so often that normal changes count as differences.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_Margin_EntraApps/"
|      }
|    },
|    {
|      "name": "SI_DataHealth_Margin_EntraUsers",
|      "label": "Data health margin: Entra users",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1 %",
|      "description": "Margins: how many of the checked records may differ, in percent of those checked, per source (never fewer than the minimum).",
|      "purpose": "How many of the checked Entra users may be missing from the newest collection or differ from Entra before the day counts as anomalous, as a percent of the users checked (never fewer than the minimum records below).",
|      "effect": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|      "whenToChange": "Raise it only when the users change so fast that the daily check sees normal changes as differences.",
|      "unit": "%",
|      "card": "Data health",
|      "info": {
|        "what": "How many of the checked Entra users may be missing from the newest collection or differ from Entra before the day counts as anomalous, as a percent of the users checked (never fewer than the minimum records below).",
|        "whenChanged": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|        "risk": "Higher: more missing or different users are tolerated before data-out is held. Lower: data-out is held sooner. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "1 %",
|        "recommended": "Keep the default. Change it when: Raise it only when the users change so fast that the daily check sees normal changes as differences.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_Margin_EntraUsers/"
|      }
|    },
|    {
|      "name": "SI_DataHealth_Margin_RiskAnalysis",
|      "label": "Data health margin: Risk Analysis reports",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "3 %",
|      "description": "Data health margin, each Risk Analysis report: percent of the checked findings that may differ from Defender.",
|      "purpose": "Per Risk Analysis report with vulnerability findings: how many of the checked findings may differ from what Defender reports now (missing, or no longer reported) before the day counts as anomalous, as a percent of those checked (never fewer than the minimum records below).",
|      "effect": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|      "whenToChange": "Raise it only when devices are patched so often that findings fixed since the run count as differences.",
|      "unit": "%",
|      "card": "Data health",
|      "info": {
|        "what": "Per Risk Analysis report with vulnerability findings: how many of the checked findings may differ from what Defender reports now (missing, or no longer reported) before the day counts as anomalous, as a percent of those checked (never fewer than the minimum records below).",
|        "whenChanged": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|        "risk": "Higher: more differences between a report and Defender are tolerated before data-out is held. Lower: data-out is held sooner. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "3 %",
|        "recommended": "Keep the default. Change it when: Raise it only when devices are patched so often that findings fixed since the run count as differences.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_Margin_RiskAnalysis/"
|      }
|    },
|    {
|      "name": "SI_DataHealth_Margin_Vulnerabilities",
|      "label": "Data health margin: vulnerabilities",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "5 %",
|      "description": "Data health margin, vulnerabilities: percent of Defender's vulnerabilities of the checked devices that may be missing.",
|      "purpose": "How many of the vulnerabilities Defender reports for the checked devices may be missing from SecurityInsight's findings before the day counts as anomalous, as a percent of those vulnerabilities (never fewer than the minimum records below).",
|      "effect": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|      "whenToChange": "Raise it when vulnerabilities are left out on purpose (excluded vulnerabilities, a minimum age) and the check counts them.",
|      "unit": "%",
|      "card": "Data health",
|      "info": {
|        "what": "How many of the vulnerabilities Defender reports for the checked devices may be missing from SecurityInsight's findings before the day counts as anomalous, as a percent of those vulnerabilities (never fewer than the minimum records below).",
|        "whenChanged": "Higher tolerates more differences before the data turns Unhealthy; lower turns it Unhealthy sooner.",
|        "risk": "Higher: more vulnerabilities missing from the findings are tolerated before data-out is held. Lower: data-out is held sooner. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "5 %",
|        "recommended": "Keep the default. Change it when: Raise it when vulnerabilities are left out on purpose (excluded vulnerabilities, a minimum age) and the check counts them.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_Margin_Vulnerabilities/"
|      }
|    },
|    {
|      "name": "SI_DataHealth_MarginMinimum",
|      "label": "Data health margin: minimum records",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "5 records",
|      "description": "Data health margins: the fewest differences any margin allows, whatever its percent.",
|      "purpose": "The fewest differences any data health margin allows, whatever its percent -- so a small source does not turn the data Unhealthy over one or two records.",
|      "effect": "Higher tolerates more differences in small sources; lower makes small sources stricter.",
|      "whenToChange": "Keep the default.",
|      "unit": "records",
|      "card": "Data health",
|      "info": {
|        "what": "The fewest differences any data health margin allows, whatever its percent -- so a small source does not turn the data Unhealthy over one or two records.",
|        "whenChanged": "Higher tolerates more differences in small sources; lower makes small sources stricter.",
|        "risk": "Higher: small sources tolerate more differences before data-out is held. Lower: small sources are stricter. Reversible at once; it applies from the next daily check.",
|        "requires": "Nothing else.",
|        "default": "5 records",
|        "recommended": "Keep the default. Change it when: Keep the default.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataHealth_MarginMinimum/"
|      }
|    },
|    {
|      "name": "SI_DataOut_Outputs",
|      "label": "Data out: outputs written",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the outputs that are on by default are written",
|      "description": "--- Data out: the workbooks and ServiceNow Import Set hand-offs written after each data sync --- Which outputs are written (ids from config\\data-out.locked.json, comma separated); not set = the outputs on by default.",
|      "purpose": "Which data-out outputs SecurityInsight writes after each data sync: the Excel workbooks (CIs, findings, the findings summary, records) and the ServiceNow Import Set hand-offs. Each is a listed connector whose runs and items are recorded.",
|      "effect": "A list of output ids (for example excel-ci, excel-findings-detailed, servicenow-ci) writes exactly those and no others; an id that is not an output is left out with a warning. Outputs of the other edition are never written.",
|      "whenToChange": "When you want a workbook or a ServiceNow hand-off that is off by default, or want to stop one that is on.",
|      "card": "Data out",
|      "info": {
|        "what": "Which data-out outputs SecurityInsight writes after each data sync: the Excel workbooks (CIs, findings, the findings summary, records) and the ServiceNow Import Set hand-offs. Each is a listed connector whose runs and items are recorded.",
|        "whenChanged": "A list of output ids (for example excel-ci, excel-findings-detailed, servicenow-ci) writes exactly those and no others; an id that is not an output is left out with a warning. Outputs of the other edition are never written.",
|        "risk": "Changes which workbooks and ServiceNow hand-offs are written from the next data sync; an output switched off stops being refreshed, what it wrote before stays where it is. Reversible: switch it on again.",
|        "requires": "Nothing else.",
|        "default": "Not set: the outputs that are on by default are written",
|        "recommended": "Leave it empty for the default outputs; name the outputs you need.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataOut_Outputs/"
|      }
|    },
|    {
|      "name": "SI_DataOut_ServiceNowCiTable",
|      "label": "Data out: ServiceNow CI Import Set table",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: the ServiceNow CI hand-off output is not written, and its run says so",
|      "description": "The Import Set tables of the two ServiceNow outputs (an output without its table is not written, and says so).",
|      "purpose": "The ServiceNow Import Set table the CI hand-off output (servicenow-ci) sends its rows to.",
|      "effect": "Rows are sent to this Import Set table, where your transform map creates and updates CIs. Without it the output does nothing.",
|      "whenToChange": "When you switch the servicenow-ci output on.",
|      "info": {
|        "what": "The ServiceNow Import Set table the CI hand-off output (servicenow-ci) sends its rows to.",
|        "whenChanged": "Rows are sent to this Import Set table, where your transform map creates and updates CIs. Without it the output does nothing.",
|        "risk": "Rows go to the named ServiceNow Import Set table; a wrong table name means the rows land where no transform map reads them. Reversible at once.",
|        "requires": "The servicenow-ci output switched on (SI_DataOut_Outputs) and the ServiceNow connection.",
|        "default": "Not set: the ServiceNow CI hand-off output is not written, and its run says so",
|        "recommended": "Keep the default. Change it when: When you switch the servicenow-ci output on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataOut_ServiceNowCiTable/"
|      }
|    },
|    {
|      "name": "SI_DataOut_ServiceNowRequest",
|      "label": "Data out: ServiceNow resync or test batch",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Empty: no request. Each request is carried out once.",
|      "description": "A one-time request for the ServiceNow outputs, carried out on the next sync: 'resync:<token>' sends every record in scope again as new (one batch, mode resync); 'test:<token>' first sends at most 5 rows per output as a test batch the importer never imports. A token is carried out once. Set from Connectors > ServiceNow: one route.",
|      "purpose": "A one-time request for the ServiceNow outputs, carried out on the next sync: a full resync (every record in scope sent again as new, in one batch) or a test batch (at most 5 rows per output, which your importer never imports).",
|      "effect": "resync:<token> sends every record in scope as new in the next batch (mode resync, imported like a normal batch). test:<token> first sends a test batch of at most 5 rows per output (mode test, never imported), then the normal batch.",
|      "whenToChange": "After your ServiceNow team rebuilt or emptied its tables (resync), or while it builds and checks its importer (test batch). Use the buttons on Connectors > ServiceNow: one route.",
|      "info": {
|        "what": "A one-time request for the ServiceNow outputs, carried out on the next sync: a full resync (every record in scope sent again as new, in one batch) or a test batch (at most 5 rows per output, which your importer never imports).",
|        "whenChanged": "resync:<token> sends every record in scope as new in the next batch (mode resync, imported like a normal batch). test:<token> first sends a test batch of at most 5 rows per output (mode test, never imported), then the normal batch.",
|        "risk": "A resync sends every record in scope again in one batch; a test batch sends at most 5 rows per output that the importer never imports. Carried out once per token; nothing is deleted.",
|        "requires": "A ServiceNow output switched on and the ServiceNow data-out connector.",
|        "default": "Empty: no request. Each request is carried out once.",
|        "recommended": "Keep the default. Change it when: After your ServiceNow team rebuilt or emptied its tables (resync), or while it builds and checks its importer (test batch). Use the buttons on Connectors > ServiceNow: one route.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataOut_ServiceNowRequest/"
|      }
|    },
|    {
|      "name": "SI_DataOut_ServiceNowStagingStatusTable",
|      "label": "Data out: ServiceNow staging status table",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "u_si_staging_status. An install that sent to ServiceNow before the staging status table existed has it empty: the rows are sent without it, with a warning, until your ServiceNow team creates the table and you set its name here.",
|      "description": "The staging status table: one row when a push of an output starts (writing) and one when it ends (complete, failed or held), so your ServiceNow importer knows when a batch is complete. Every data row carries the batch id (u_si_batch_id). Not set = u_si_staging_status. '' = no staging status table: the rows are sent without it, with a warning.",
|      "purpose": "The ServiceNow import set table where SecurityInsight says when each push of a ServiceNow output starts (writing) and ends (complete, failed or held). Every data row carries the same batch id, so your importer imports a batch only once it is complete.",
|      "effect": "Set: each push is one batch -- a writing row first, the batch id on every data row, then a complete, failed or held row. If the table is missing or lacks a column, nothing is sent. Empty: the rows are sent without a batch, and the ServiceNow check warns.",
|      "whenToChange": "After your ServiceNow team has created the staging status table (Connectors > the ServiceNow data-out connector > For your ServiceNow team), if it has another name than the default -- or, on an install that has it empty, to switch it on.",
|      "info": {
|        "what": "The ServiceNow import set table where SecurityInsight says when each push of a ServiceNow output starts (writing) and ends (complete, failed or held). Every data row carries the same batch id, so your importer imports a batch only once it is complete.",
|        "whenChanged": "Set: each push is one batch -- a writing row first, the batch id on every data row, then a complete, failed or held row. If the table is missing or lacks a column, nothing is sent. Empty: the rows are sent without a batch, and the ServiceNow check warns.",
|        "risk": "Set to a table that does not exist on the instance, nothing is sent to ServiceNow until it is there (the ServiceNow check says why). Empty, your importer cannot tell a finished push from one that stopped halfway. Reversible at once.",
|        "requires": "A ServiceNow output switched on (SI_DataOut_Outputs), the ServiceNow data-out connector and the table created in ServiceNow.",
|        "default": "u_si_staging_status. An install that sent to ServiceNow before the staging status table existed has it empty: the rows are sent without it, with a warning, until your ServiceNow team creates the table and you set its name here.",
|        "recommended": "Keep the default. Change it when: After your ServiceNow team has created the staging status table (Connectors > the ServiceNow data-out connector > For your ServiceNow team), if it has another name than the default -- or, on an install that has it empty, to switch it on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataOut_ServiceNowStagingStatusTable/"
|      }
|    },
|    {
|      "name": "SI_DataOut_ServiceNowVulnTable",
|      "label": "Data out: ServiceNow vulnerable item Import Set table",
|      "group": "Connectors & CMDB",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: the ServiceNow vulnerable item output is not written, and its run says so",
|      "description": "the vulnerable item output's Import Set table (not set = that output is not written, and says so)",
|      "purpose": "The ServiceNow Import Set table the vulnerable item output (servicenow-vulnerable-item) sends its rows to.",
|      "effect": "Rows are sent to this Import Set table, where your transform map creates and updates vulnerable items. Without it the output does nothing.",
|      "whenToChange": "When you switch the servicenow-vulnerable-item output on.",
|      "info": {
|        "what": "The ServiceNow Import Set table the vulnerable item output (servicenow-vulnerable-item) sends its rows to.",
|        "whenChanged": "Rows are sent to this Import Set table, where your transform map creates and updates vulnerable items. Without it the output does nothing.",
|        "risk": "Rows go to the named ServiceNow Import Set table; a wrong table name means the rows land where no transform map reads them. Reversible at once.",
|        "requires": "The servicenow-vulnerable-item output switched on (SI_DataOut_Outputs) and the ServiceNow connection.",
|        "default": "Not set: the ServiceNow vulnerable item output is not written, and its run says so",
|        "recommended": "Keep the default. Change it when: When you switch the servicenow-vulnerable-item output on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DataOut_ServiceNowVulnTable/"
|      }
|    },
|    {
|      "name": "SI_DceIngestionUri",
|      "label": "Ingestion endpoint address",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: looked up from the endpoint name",
|      "description": "canonical SI alias",
|      "purpose": "The ingestion address of the data collection endpoint that Risk Analysis sends results to.",
|      "effect": "Used by Risk Analysis unless SI_RiskAnalysis_DceIngestionUri is set. A wrong address makes Risk Analysis ingestion fail; the collection engines do not read it.",
|      "whenToChange": "Rarely; only if automatic lookup of the endpoint cannot work in your environment.",
|      "info": {
|        "what": "The ingestion address of the data collection endpoint that Risk Analysis sends results to.",
|        "whenChanged": "Used by Risk Analysis unless SI_RiskAnalysis_DceIngestionUri is set. A wrong address makes Risk Analysis ingestion fail; the collection engines do not read it.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Not set: looked up from the endpoint name",
|        "recommended": "Keep the default. Change it when: Rarely; only if automatic lookup of the endpoint cannot work in your environment.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DceIngestionUri/"
|      }
|    },
|    {
|      "name": "SI_DceName",
|      "label": "Data collection endpoint name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: endpoint pinning is skipped; setup may create dce-si-securityinsight",
|      "description": "DCE / DCR resource layout (auto-resolved when the canonical short names below match your tenant; override only when they don't).",
|      "purpose": "Name of the data collection endpoint all engines send their data to Log Analytics through.",
|      "effect": "Tells the engines which endpoint to use. A wrong name stops ingestion or, during setup, creates a new endpoint. Run health rows are not sent without it.",
|      "whenToChange": "Set at install to the endpoint your setup created; change only if you rename or move it.",
|      "card": "Log Analytics",
|      "info": {
|        "what": "Name of the data collection endpoint all engines send their data to Log Analytics through.",
|        "whenChanged": "Tells the engines which endpoint to use. A wrong name stops ingestion or, during setup, creates a new endpoint. Run health rows are not sent without it.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Not set: endpoint pinning is skipped; setup may create dce-si-securityinsight",
|        "recommended": "Keep the default. Change it when: Set at install to the endpoint your setup created; change only if you rename or move it.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DceName/"
|      }
|    },
|    {
|      "name": "SI_DceResourceGroup",
|      "label": "Data collection endpoint resource group",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Same resource group as the data collection rules",
|      "description": "DCE and DCR live in the SAME RG as the workspace by default (engine derives via Az lookup; explicit override only needed when you split resources across multiple RGs, which is unusual). Don't set these unless you've intentionally split -- stale value makes the engine print a wrong \"ingest -> DCR\" line.",
|      "purpose": "The resource group that holds the data collection endpoint used to send data to Log Analytics.",
|      "effect": "Tells the engines where to find the endpoint. A wrong value makes runs refuse to post when several endpoints share the name, or print misleading ingestion lines.",
|      "whenToChange": "Only when you have deliberately placed the endpoint in a different resource group than the rules.",
|      "info": {
|        "what": "The resource group that holds the data collection endpoint used to send data to Log Analytics.",
|        "whenChanged": "Tells the engines where to find the endpoint. A wrong value makes runs refuse to post when several endpoints share the name, or print misleading ingestion lines.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Same resource group as the data collection rules",
|        "recommended": "Keep the default. Change it when: Only when you have deliberately placed the endpoint in a different resource group than the rules.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DceResourceGroup/"
|      }
|    },
|    {
|      "name": "SI_DcrMergeDiagnostic",
|      "label": "Rule column diagnostic",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Diagnostic: dump pre-/post-merge column diff for every DCR ingest call. Off by default; turn on briefly when investigating \"column dropped\" warnings.",
|      "purpose": "Logs the difference between a data collection rule's columns and the data being sent, on every ingestion call.",
|      "effect": "On, each ingestion call logs added, removed and changed columns. Makes logs longer and runs slightly slower; never stops ingestion.",
|      "whenToChange": "Turn on briefly when investigating warnings about dropped columns.",
|      "info": {
|        "what": "Logs the difference between a data collection rule's columns and the data being sent, on every ingestion call.",
|        "whenOn": "On, each ingestion call logs added, removed and changed columns. Makes logs longer and runs slightly slower; never stops ingestion.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Off",
|        "recommended": "Keep the default. Change it when: Turn on briefly when investigating warnings about dropped columns.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DcrMergeDiagnostic/"
|      }
|    },
|    {
|      "name": "SI_DcrNamePattern",
|      "label": "Rule name pattern",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "dcr-si-{0}-profile",
|      "description": "engine default",
|      "purpose": "The pattern used to name each collection engine's data collection rule, where {0} is replaced by the engine name.",
|      "effect": "Changing it makes engines create and use differently named rules; existing rules are left behind and new ones are made.",
|      "whenToChange": "Only if you maintain a parallel naming scheme; most installs never should.",
|      "info": {
|        "what": "The pattern used to name each collection engine's data collection rule, where {0} is replaced by the engine name.",
|        "whenChanged": "Changing it makes engines create and use differently named rules; existing rules are left behind and new ones are made.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "dcr-si-{0}-profile",
|        "recommended": "Keep the default. Change it when: Only if you maintain a parallel naming scheme; most installs never should.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DcrNamePattern/"
|      }
|    },
|    {
|      "name": "SI_DcrResourceGroup",
|      "label": "Data collection rules resource group",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: Risk Analysis uses DcrResourceGroup; setup uses rg-securityinsight",
|      "description": "Resource group holding the data collection rules (and, by default, the data collection endpoint) used to ingest SecurityInsight data into Log Analytics.",
|      "purpose": "Resource group holding the data collection rules (and, by default, the endpoint) used to send data to Log Analytics.",
|      "effect": "Tells engines where to find and create rules. A wrong group creates duplicate rules or refuses to post. Run health rows are not sent without it.",
|      "whenToChange": "Set at install; change only if you move the rules.",
|      "card": "Log Analytics",
|      "info": {
|        "what": "Resource group holding the data collection rules (and, by default, the endpoint) used to send data to Log Analytics.",
|        "whenChanged": "Tells engines where to find and create rules. A wrong group creates duplicate rules or refuses to post. Run health rows are not sent without it.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Not set: Risk Analysis uses DcrResourceGroup; setup uses rg-securityinsight",
|        "recommended": "Keep the default. Change it when: Set at install; change only if you move the rules.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DcrResourceGroup/"
|      }
|    },
|    {
|      "name": "SI_DefenderWorkspaceResourceId",
|      "label": "Defender data workspace",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "endpoint"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: Defender data is read from the SecurityInsight workspace",
|      "description": "only when MDE/IdentityInfo lives in a DIFFERENT workspace",
|      "purpose": "Full resource id of a separate Log Analytics workspace holding Defender data, when it is not the SecurityInsight workspace.",
|      "effect": "Identity discovery and Risk Analysis queries read Defender tables from this workspace. A wrong value makes those queries return nothing or fail.",
|      "whenToChange": "Only when your Defender data is in a different workspace than SecurityInsight's own.",
|      "card": "Log Analytics",
|      "info": {
|        "what": "Full resource id of a separate Log Analytics workspace holding Defender data, when it is not the SecurityInsight workspace.",
|        "whenChanged": "Identity discovery and Risk Analysis queries read Defender tables from this workspace. A wrong value makes those queries return nothing or fail.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: endpoint.",
|        "default": "Not set: Defender data is read from the SecurityInsight workspace",
|        "recommended": "Keep the default. Change it when: Only when your Defender data is in a different workspace than SecurityInsight's own.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DefenderWorkspaceResourceId/"
|      }
|    },
|    {
|      "name": "SI_DeletionProof_Azure",
|      "label": "Retire at once: resources deleted in Azure",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: an Azure resource Azure no longer lists waits the not-seen grace period, as before",
|      "description": "an Azure resource with a Delete in the Resource Graph resource changes",
|      "purpose": "Retires an asset at once when Azure PROVES its resource was deleted: a Delete in Azure Resource Graph's resource changes (the last 14 days). Merely missing from a list is never proof -- it keeps the not-seen grace period.",
|      "effect": "Stages: the CI build checks the Azure records missing from a complete collection against the resource changes; a proven one is recorded, its CI retires at once ('retired at once: deleted in Azure') -- the proof wins over the grace period -- and its open vulnerabilities close as 'asset deleted in Azure', never as fixed. A CI another source still sees stays active. A resource listed again is active again and its findings reopen. A read that is not complete decides nothing for what it did not return.",
|      "whenToChange": "When an asset deleted in Azure should not wait the grace period before it and its vulnerabilities are retired.",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "Retires an asset at once when Azure PROVES its resource was deleted: a Delete in Azure Resource Graph's resource changes (the last 14 days). Merely missing from a list is never proof -- it keeps the not-seen grace period.",
|        "whenOn": "Stages: the CI build checks the Azure records missing from a complete collection against the resource changes; a proven one is recorded, its CI retires at once ('retired at once: deleted in Azure') -- the proof wins over the grace period -- and its open vulnerabilities close as 'asset deleted in Azure', never as fixed. A CI another source still sees stays active. A resource listed again is active again and its findings reopen. A read that is not complete decides nothing for what it did not return.",
|        "whenOff": "an Azure resource Azure no longer lists waits the not-seen grace period, as before",
|        "risk": "Assets of resources deleted in Azure retire from the next CI build and their vulnerabilities close as deleted (ServiceNow closures follow). Reversible: turn it off and the next build decides them by the grace period again.",
|        "requires": "Read access to Azure Resource Graph (Reader, which the engine identity already has).",
|        "default": "Off: an Azure resource Azure no longer lists waits the not-seen grace period, as before",
|        "recommended": "Off, unless your organisation chose it.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DeletionProof_Azure/",
|        "confirmWhen": "on",
|        "confirm": "Assets whose Azure resource Azure proves deleted retire at once from the next CI build; their open vulnerabilities close as asset deleted in Azure."
|      }
|    },
|    {
|      "name": "SI_DeletionProof_Entra",
|      "label": "Retire at once: objects deleted in Entra ID",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: a user, device or group Entra ID no longer lists waits the not-seen grace period, as before",
|      "description": "Retire at once on PROOF of deletion, per source. Off by default. On, an asset whose source proves it deleted (never merely missing from a list -- that keeps the not-seen grace period) retires at once, and its open vulnerabilities close as 'asset deleted in <source>', never as fixed. Restored / listed again = active again, its findings reopen.",
|      "purpose": "Retires an asset at once when Entra ID PROVES its object was deleted: the user, device or group is in Entra ID's deleted items. Merely missing from a list is never proof -- it keeps the not-seen grace period.",
|      "effect": "Stages: the CI build checks the Entra ID records (and the Exposure Graph users and groups) missing from a complete collection against Entra ID's deleted items; a proven one is recorded, its CI retires at once ('retired at once: deleted in Entra ID') -- the proof wins over the grace period -- and its open vulnerabilities close as 'asset deleted in Entra ID', never as fixed. A CI another source still sees stays active. An object restored in Entra ID is listed again: its CI is active again and its findings reopen. A read that is not complete decides nothing for what it did not return.",
|      "whenToChange": "When an object deleted in Entra ID should not wait the grace period before it and its vulnerabilities are retired.",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "Retires an asset at once when Entra ID PROVES its object was deleted: the user, device or group is in Entra ID's deleted items. Merely missing from a list is never proof -- it keeps the not-seen grace period.",
|        "whenOn": "Stages: the CI build checks the Entra ID records (and the Exposure Graph users and groups) missing from a complete collection against Entra ID's deleted items; a proven one is recorded, its CI retires at once ('retired at once: deleted in Entra ID') -- the proof wins over the grace period -- and its open vulnerabilities close as 'asset deleted in Entra ID', never as fixed. A CI another source still sees stays active. An object restored in Entra ID is listed again: its CI is active again and its findings reopen. A read that is not complete decides nothing for what it did not return.",
|        "whenOff": "a user, device or group Entra ID no longer lists waits the not-seen grace period, as before",
|        "risk": "Assets of objects deleted in Entra ID retire from the next CI build and their vulnerabilities close as deleted (ServiceNow closures follow). Reversible: turn it off and the next build decides them by the grace period again.",
|        "requires": "Read access to Entra ID's deleted items (Directory.Read.All, which the engine identity already has).",
|        "default": "Off: a user, device or group Entra ID no longer lists waits the not-seen grace period, as before",
|        "recommended": "Off, unless your organisation chose it.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DeletionProof_Entra/",
|        "confirmWhen": "on",
|        "confirm": "Assets whose object Entra ID lists in its deleted items retire at once from the next CI build; their open vulnerabilities close as asset deleted in Entra ID."
|      }
|    },
|    {
|      "name": "SI_DeletionProof_Intune",
|      "label": "Retire at once: devices deleted in Intune",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: a device Intune no longer lists waits the not-seen grace period, as before",
|      "description": "a managed device deleted in Intune's audit events (needs DeviceManagementApps.Read.All)",
|      "purpose": "Retires an asset at once when Intune PROVES its managed device was deleted: a successful Delete of the managed device in Intune's audit events. Merely missing from a list is never proof -- it keeps the not-seen grace period.",
|      "effect": "Stages: the CI build checks the Intune records missing from a complete collection against Intune's audit events; a proven one is recorded, its CI retires at once ('retired at once: deleted in Intune') -- the proof wins over the grace period -- and its open vulnerabilities close as 'asset deleted in Intune', never as fixed. A CI another source still sees stays active. A device listed again is active again and its findings reopen. A read that is not complete (for example without the permission) decides nothing for what it did not return.",
|      "whenToChange": "When a device deleted in Intune should not wait the grace period before it and its vulnerabilities are retired.",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "Retires an asset at once when Intune PROVES its managed device was deleted: a successful Delete of the managed device in Intune's audit events. Merely missing from a list is never proof -- it keeps the not-seen grace period.",
|        "whenOn": "Stages: the CI build checks the Intune records missing from a complete collection against Intune's audit events; a proven one is recorded, its CI retires at once ('retired at once: deleted in Intune') -- the proof wins over the grace period -- and its open vulnerabilities close as 'asset deleted in Intune', never as fixed. A CI another source still sees stays active. A device listed again is active again and its findings reopen. A read that is not complete (for example without the permission) decides nothing for what it did not return.",
|        "whenOff": "a device Intune no longer lists waits the not-seen grace period, as before",
|        "risk": "Assets of devices deleted in Intune retire from the next CI build and their vulnerabilities close as deleted (ServiceNow closures follow). Reversible: turn it off and the next build decides them by the grace period again.",
|        "requires": "Read access to Intune's audit events (DeviceManagementApps.Read.All -- not granted to the engine identity by setup today; without it the read answers 403 and decides nothing).",
|        "default": "Off: a device Intune no longer lists waits the not-seen grace period, as before",
|        "recommended": "Off, unless your organisation chose it.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DeletionProof_Intune/",
|        "confirmWhen": "on",
|        "confirm": "Assets whose managed device Intune's audit events show deleted retire at once from the next CI build; their open vulnerabilities close as asset deleted in Intune."
|      }
|    },
|    {
|      "name": "SI_DisableAI",
|      "label": "Turn off AI classification (all engines)",
|      "group": "AI",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: AI runs where it has been switched on.",
|      "description": "Tenant-wide AI kill-switch (wins over every opt-in above).",
|      "purpose": "A master switch that turns off AI asset classification for every collection engine, whatever else is switched on.",
|      "effect": "When on, asset profiling, signal maps and schema proposals use rules only and send nothing to Azure OpenAI. It does not stop the role tiering classifier or the risk-analysis AI summary, which have their own switches.",
|      "whenToChange": "When AI must not be used, for example for a policy or cost reason.",
|      "card": "Where AI is used",
|      "hint": "Wins over every switch above.",
|      "info": {
|        "what": "A master switch that turns off AI asset classification for every collection engine, whatever else is switched on.",
|        "whenOn": "When on, asset profiling, signal maps and schema proposals use rules only and send nothing to Azure OpenAI. It does not stop the role tiering classifier or the risk-analysis AI summary, which have their own switches.",
|        "whenOff": "AI runs where it has been switched on.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Nothing else.",
|        "default": "Off: AI runs where it has been switched on.",
|        "recommended": "Keep the default. Change it when: When AI must not be used, for example for a policy or cost reason.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisableAI/"
|      }
|    },
|    {
|      "name": "SI_DisableAI_endpoint",
|      "label": "Turn off AI for the endpoint engine",
|      "group": "AI",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: the endpoint engine follows the general AI switches.",
|      "description": "When on, switches off AI classification for the endpoint engine only, even if Azure OpenAI is configured; AI stays on for the other engines.",
|      "purpose": "Switches off AI classification for the endpoint engine only, even when AI is on for all engines.",
|      "effect": "Devices are classified by rules only; any device without a rule-based tier gets the default tier. Removes AI cost for endpoints. Wins over every AI turn-on switch.",
|      "whenToChange": "When you use AI elsewhere but want rule-only tiering for devices.",
|      "card": "Where AI is used",
|      "hint": "Wins over the switches above, for endpoints only.",
|      "info": {
|        "what": "Switches off AI classification for the endpoint engine only, even when AI is on for all engines.",
|        "whenOn": "Devices are classified by rules only; any device without a rule-based tier gets the default tier. Removes AI cost for endpoints. Wins over every AI turn-on switch.",
|        "whenOff": "the endpoint engine follows the general AI switches.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Nothing else.",
|        "default": "Off: the endpoint engine follows the general AI switches.",
|        "recommended": "Keep the default. Change it when: When you use AI elsewhere but want rule-only tiering for devices.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisableAI_endpoint/"
|      }
|    },
|    {
|      "name": "SI_DisabledAssets_Collect",
|      "label": "Disabled accounts and devices: collect them",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": true,
|      "defaultText": "On: disabled accounts and devices are collected",
|      "description": "Disabled accounts and devices, one setting per stage. Disabled = the account is disabled in its own directory (Entra accountEnabled = false, AD userAccountControl disabled) -- users, service principals / managed identities and computers alike; never inferred from inactivity. Read on every run: an account that is enabled again is included again everywhere. A stage that leaves disabled assets out logs how many, and their open findings, actions and tickets are kept (never resolved or closed). The later stages only see what collection kept, so the last four need SI_DisabledAssets_Collect on.",
|      "purpose": "Whether disabled users, service principals and managed identities, and disabled computers are collected from the sources. Disabled means the account is disabled in its own directory (Entra accountEnabled false, AD account disabled); it is never guessed from inactivity.",
|      "effect": "Off leaves them out of the profiles, so no later stage can see them -- the correlation, Risk Analysis, finding actions and connector settings below then have no effect for disabled assets. Their open findings, actions and tickets are kept as they are (never resolved or closed). The state is read on every run: an account that is enabled again is collected again on the next run. Each run logs how many were left out.",
|      "whenToChange": "Turn it off only if you never want to see disabled accounts or devices anywhere in SecurityInsight.",
|      "card": "Disabled accounts and devices",
|      "hint": "Later stages only see what is collected.",
|      "info": {
|        "what": "Whether disabled users, service principals and managed identities, and disabled computers are collected from the sources. Disabled means the account is disabled in its own directory (Entra accountEnabled false, AD account disabled); it is never guessed from inactivity.",
|        "whenOn": "disabled accounts and devices are collected",
|        "whenOff": "Off leaves them out of the profiles, so no later stage can see them -- the correlation, Risk Analysis, finding actions and connector settings below then have no effect for disabled assets. Their open findings, actions and tickets are kept as they are (never resolved or closed). The state is read on every run: an account that is enabled again is collected again on the next run. Each run logs how many were left out.",
|        "risk": "Disabled accounts and devices disappear from profiles, CIs, reports and connectors from the next run; their open findings and tickets are kept (never closed). Reversible: the next run collects them again.",
|        "requires": "Nothing else.",
|        "default": "On: disabled accounts and devices are collected",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisabledAssets_Collect/",
|        "confirmWhen": "off",
|        "confirm": "Off leaves them out of the profiles, so no later stage can see them -- the correlation, Risk Analysis, finding actions and connector settings below then have no effect for disabled assets. Their open findings, actions and tickets are kept as they are (never resolved or closed). The state is read on every run: an account that is enabled again is collected again on the next run. Each run logs how many were left out. Disabled accounts and devices disappear from profiles, CIs, reports and connectors from the next run; their open findings and tickets are kept (never closed). Reversible: the next run collects them again."
|      }
|    },
|    {
|      "name": "SI_DisabledAssets_Connectors",
|      "label": "Disabled accounts and devices: connectors and exports",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off: connectors and exports leave disabled assets out",
|      "description": "sent out by connectors and exports",
|      "purpose": "Whether connectors and exports send disabled users, service principals, managed identities and computers out of SecurityInsight (ServiceNow, Jira, risk register, CMDB, data exports).",
|      "effect": "Off leaves disabled assets out of what is sent; a ticket or record already sent for one is kept as it is (never resolved or closed because the asset was left out) and carries on when the account is enabled again. On sends them like any other. Has no effect while collection of disabled assets is off. Each run logs how many were left out.",
|      "whenToChange": "Turn it on when your CMDB or ticketing system should also hold disabled accounts and devices.",
|      "card": "Disabled accounts and devices",
|      "needs": "SI_DisabledAssets_Collect",
|      "info": {
|        "what": "Whether connectors and exports send disabled users, service principals, managed identities and computers out of SecurityInsight (ServiceNow, Jira, risk register, CMDB, data exports).",
|        "whenOn": "Off leaves disabled assets out of what is sent; a ticket or record already sent for one is kept as it is (never resolved or closed because the asset was left out) and carries on when the account is enabled again. On sends them like any other. Has no effect while collection of disabled assets is off. Each run logs how many were left out.",
|        "whenOff": "connectors and exports leave disabled assets out",
|        "risk": "On sends disabled accounts and devices to your CMDB, ticketing systems and exports. Reversible for future runs; records already written there stay.",
|        "requires": "Works only while \"Disabled accounts and devices: collect them\" is on.",
|        "default": "Off: connectors and exports leave disabled assets out",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisabledAssets_Connectors/",
|        "confirmWhen": "on",
|        "confirm": "Off leaves disabled assets out of what is sent; a ticket or record already sent for one is kept as it is (never resolved or closed because the asset was left out) and carries on when the account is enabled again. On sends them like any other. Has no effect while collection of disabled assets is off. Each run logs how many were left out. On sends disabled accounts and devices to your CMDB, ticketing systems and exports. Reversible for future runs; records already written there stay."
|      }
|    },
|    {
|      "name": "SI_DisabledAssets_Correlate",
|      "label": "Disabled accounts and devices: CI correlation",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": true,
|      "defaultText": "On: disabled assets are correlated into CIs",
|      "description": "take part in CI correlation",
|      "purpose": "Whether disabled users, service principals, managed identities and computers take part in the correlation that builds configuration items (CIs).",
|      "effect": "Off keeps disabled assets out of the CI build: no CI is built or changed from them, and the findings of an existing CI are kept as they are (never resolved or closed) until the account is enabled again. Has no effect while collection of disabled assets is off -- they are not collected then. Each run logs how many were left out.",
|      "whenToChange": "Turn it off when disabled assets should not appear as CIs or reach your CMDB.",
|      "card": "Disabled accounts and devices",
|      "needs": "SI_DisabledAssets_Collect",
|      "info": {
|        "what": "Whether disabled users, service principals, managed identities and computers take part in the correlation that builds configuration items (CIs).",
|        "whenOn": "disabled assets are correlated into CIs",
|        "whenOff": "Off keeps disabled assets out of the CI build: no CI is built or changed from them, and the findings of an existing CI are kept as they are (never resolved or closed) until the account is enabled again. Has no effect while collection of disabled assets is off -- they are not collected then. Each run logs how many were left out.",
|        "risk": "Disabled assets are not built into CIs from the next run; findings of existing CIs are kept (never closed). Reversible: the next run correlates them again.",
|        "requires": "Works only while \"Disabled accounts and devices: collect them\" is on.",
|        "default": "On: disabled assets are correlated into CIs",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisabledAssets_Correlate/"
|      }
|    },
|    {
|      "name": "SI_DisabledAssets_RiskAnalysis",
|      "label": "Disabled accounts and devices: Risk Analysis",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off: the reports leave disabled assets out, except the reports where the disabled state is the finding",
|      "description": "reach the Risk Analysis reports",
|      "purpose": "Whether the Risk Analysis reports include disabled users, service principals, managed identities and computers.",
|      "effect": "On lets every report see disabled assets. Two reports always see them, whatever this says, because the disabled state is the finding there: a disabled guest still holding a privileged role, and a disabled service principal still owning a publicly reachable resource. Reports that ask about usable accounts (for example accounts without MFA) keep their own enabled filter. Has no effect while collection of disabled assets is off.",
|      "whenToChange": "Turn it on when you also want findings for disabled accounts and devices in the reports, for example while cleaning them up.",
|      "card": "Disabled accounts and devices",
|      "needs": "SI_DisabledAssets_Collect",
|      "info": {
|        "what": "Whether the Risk Analysis reports include disabled users, service principals, managed identities and computers.",
|        "whenOn": "On lets every report see disabled assets. Two reports always see them, whatever this says, because the disabled state is the finding there: a disabled guest still holding a privileged role, and a disabled service principal still owning a publicly reachable resource. Reports that ask about usable accounts (for example accounts without MFA) keep their own enabled filter. Has no effect while collection of disabled assets is off.",
|        "whenOff": "the reports leave disabled assets out, except the reports where the disabled state is the finding",
|        "risk": "On adds findings for disabled accounts and devices to the reports: more rows to read. Off is the default; the two reports where the disabled state is the finding always include them. Reversible at once.",
|        "requires": "Works only while \"Disabled accounts and devices: collect them\" is on.",
|        "default": "Off: the reports leave disabled assets out, except the reports where the disabled state is the finding",
|        "recommended": "Off, unless you are cleaning up disabled accounts and devices.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisabledAssets_RiskAnalysis/"
|      }
|    },
|    {
|      "name": "SI_DisabledAssets_StateActions",
|      "label": "Disabled accounts and devices: finding actions",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off: findings of disabled assets are kept as they are",
|      "description": "finding / vulnerability lifecycle, close-loop, tickets",
|      "purpose": "Whether the finding and vulnerability lifecycle acts on disabled assets: opening, resolving and closing findings, the close-loop mail and opening or closing tickets.",
|      "effect": "Off freezes the findings of a disabled asset: they are shown as excluded (disabled), never resolved or closed, and a missing finding is not counted as fixed. When the account is enabled again, the same findings carry on. On treats disabled assets like any other. Has no effect while collection of disabled assets is off. Each run logs how many were left out.",
|      "whenToChange": "Turn it on when findings on disabled assets should be opened and closed like any other.",
|      "card": "Disabled accounts and devices",
|      "needs": "SI_DisabledAssets_Collect",
|      "info": {
|        "what": "Whether the finding and vulnerability lifecycle acts on disabled assets: opening, resolving and closing findings, the close-loop mail and opening or closing tickets.",
|        "whenOn": "Off freezes the findings of a disabled asset: they are shown as excluded (disabled), never resolved or closed, and a missing finding is not counted as fixed. When the account is enabled again, the same findings carry on. On treats disabled assets like any other. Has no effect while collection of disabled assets is off. Each run logs how many were left out.",
|        "whenOff": "findings of disabled assets are kept as they are",
|        "risk": "On lets the lifecycle resolve and close findings and tickets of disabled assets like any other, and a finding that is missing for a disabled asset can then be closed. Reversible for future runs; what was closed stays closed.",
|        "requires": "Works only while \"Disabled accounts and devices: collect them\" is on.",
|        "default": "Off: findings of disabled assets are kept as they are",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisabledAssets_StateActions/",
|        "confirmWhen": "on",
|        "confirm": "Off freezes the findings of a disabled asset: they are shown as excluded (disabled), never resolved or closed, and a missing finding is not counted as fixed. When the account is enabled again, the same findings carry on. On treats disabled assets like any other. Has no effect while collection of disabled assets is off. Each run logs how many were left out. On lets the lifecycle resolve and close findings and tickets of disabled assets like any other, and a finding that is missing for a disabled asset can then be closed. Reversible for future runs; what was closed stays closed."
|      }
|    },
|    {
|      "name": "SI_DisableEndpointAzureCorrelation",
|      "label": "Azure VM to device tier linking off",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: an Azure VM takes the tier of the matching endpoint device.",
|      "description": "Disable the EndpointAzureCorrelation cache (only after diagnosing a cache bug).",
|      "purpose": "Stops the Azure engine from giving an Azure VM or Arc machine the same tier as its matching Defender device.",
|      "effect": "When on, Azure VMs and Arc machines keep their own Azure-side tier and lose the link to their endpoint record, so the same machine can show different tiers in the two views.",
|      "whenToChange": "Only while diagnosing a problem with this linking.",
|      "info": {
|        "what": "Stops the Azure engine from giving an Azure VM or Arc machine the same tier as its matching Defender device.",
|        "whenOn": "When on, Azure VMs and Arc machines keep their own Azure-side tier and lose the link to their endpoint record, so the same machine can show different tiers in the two views.",
|        "whenOff": "an Azure VM takes the tier of the matching endpoint device.",
|        "risk": "Azure VMs and Arc machines lose the link to their endpoint record, so one machine can show two different tiers. Reversible at once (the next run links them again).",
|        "requires": "Nothing else.",
|        "default": "Off: an Azure VM takes the tier of the matching endpoint device.",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisableEndpointAzureCorrelation/",
|        "confirmWhen": "on",
|        "confirm": "When on, Azure VMs and Arc machines keep their own Azure-side tier and lose the link to their endpoint record, so the same machine can show different tiers in the two views. Azure VMs and Arc machines lose the link to their endpoint record, so one machine can show two different tiers. Reversible at once (the next run links them again)."
|      }
|    },
|    {
|      "name": "SI_DisableTranscript",
|      "label": "Turn off run logs",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: every run writes and keeps a run log.",
|      "description": "Disable launcher transcript writing entirely (lab/CI use only).",
|      "purpose": "Stops the launchers from writing a run log (transcript) to disk and uploading it to storage.",
|      "effect": "No run log is kept, so failed runs cannot be investigated afterwards. Collection and reports are unaffected.",
|      "whenToChange": "Only in lab or test pipelines where logs are not wanted.",
|      "info": {
|        "what": "Stops the launchers from writing a run log (transcript) to disk and uploading it to storage.",
|        "whenOn": "No run log is kept, so failed runs cannot be investigated afterwards. Collection and reports are unaffected.",
|        "whenOff": "every run writes and keeps a run log.",
|        "risk": "No run log is kept: a failed run cannot be investigated afterwards and support has nothing to read. Reversible at once (from the next run).",
|        "requires": "Nothing else.",
|        "default": "Off: every run writes and keeps a run log.",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DisableTranscript/",
|        "confirmWhen": "on",
|        "confirm": "No run log is kept, so failed runs cannot be investigated afterwards. Collection and reports are unaffected. No run log is kept: a failed run cannot be investigated afterwards and support has nothing to read. Reversible at once (from the next run)."
|      }
|    },
|    {
|      "name": "SI_DumpAIPayload",
|      "label": "Save AI requests to disk",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: nothing is saved.",
|      "description": "Dump AI request/response payloads to disk (debug only; verbose I/O).",
|      "purpose": "A troubleshooting switch that saves every AI classification request to a file in the machine's temp folder.",
|      "effect": "When on, each AI call writes one file holding the prompt and the asset data sent, so prompts can be inspected. This adds disk writes and leaves asset details on disk.",
|      "whenToChange": "Only while diagnosing AI results; switch it off again afterwards.",
|      "info": {
|        "what": "A troubleshooting switch that saves every AI classification request to a file in the machine's temp folder.",
|        "whenOn": "When on, each AI call writes one file holding the prompt and the asset data sent, so prompts can be inspected. This adds disk writes and leaves asset details on disk.",
|        "whenOff": "nothing is saved.",
|        "risk": "Writes the prompts and the asset data sent to AI to files on disk, where they stay until removed. Reversible: turn it off and delete the files.",
|        "requires": "Nothing else.",
|        "default": "Off: nothing is saved.",
|        "recommended": "Off; on only briefly when support asks.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_DumpAIPayload/",
|        "confirmWhen": "on",
|        "confirm": "When on, each AI call writes one file holding the prompt and the asset data sent, so prompts can be inspected. This adds disk writes and leaves asset details on disk. Writes the prompts and the asset data sent to AI to files on disk, where they stay until removed. Reversible: turn it off and delete the files."
|      }
|    },
|    {
|      "name": "SI_EgIdentityBucketThreshold",
|      "label": "Identity exposure graph split size",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "30000 identities.",
|      "description": "Switch from EG bucket-paging to single-pass when bucket count exceeds N. Default 30000 (matches Defender's per-query row ceiling).",
|      "purpose": "Above this many identities of one kind, the identity engine reads the exposure graph in several smaller queries instead of one.",
|      "effect": "A lower value splits reads sooner: more queries, but each stays within response limits. A higher value risks a single oversized query failing in very large tenants.",
|      "whenToChange": "Only if exposure graph reads for identities fail or time out.",
|      "unit": "rows",
|      "info": {
|        "what": "Above this many identities of one kind, the identity engine reads the exposure graph in several smaller queries instead of one.",
|        "whenChanged": "A lower value splits reads sooner: more queries, but each stays within response limits. A higher value risks a single oversized query failing in very large tenants.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "30000 identities.",
|        "recommended": "Keep the default. Change it when: Only if exposure graph reads for identities fail or time out.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_EgIdentityBucketThreshold/"
|      }
|    },
|    {
|      "name": "SI_EnableAI",
|      "label": "AI integration",
|      "group": "AI",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: assets are classified by rules only.",
|      "description": "Tenant-wide AI opt-in for asset-profiling Classify (turns AI on for endpoint+ azure+publicip; identity is hard-disabled). Per-engine opt-in is preferred.",
|      "purpose": "ONE switch for AI: on = AI for every engine that has an AI step (the endpoint and Azure engines classify the assets their rules cannot place). It needs the Azure OpenAI endpoint, deployment and key.",
|      "effect": "When on, and Azure OpenAI is configured, assets that rules cannot place are sent to Azure OpenAI for a tier and service type. This adds AI cost and run time. The identity and public IP engines never use AI.",
|      "whenToChange": "When you want AI help classifying assets -- in Get Started > AI integration, with the endpoint, deployment and key.",
|      "card": "Where AI is used",
|      "hint": "On = on for all engines. The per-engine switches (Advanced) only matter to turn ONE engine on or off against this switch.",
|      "info": {
|        "what": "ONE switch for AI: on = AI for every engine that has an AI step (the endpoint and Azure engines classify the assets their rules cannot place). It needs the Azure OpenAI endpoint, deployment and key.",
|        "whenOn": "When on, and Azure OpenAI is configured, assets that rules cannot place are sent to Azure OpenAI for a tier and service type. This adds AI cost and run time. The identity and public IP engines never use AI.",
|        "whenOff": "assets are classified by rules only.",
|        "risk": "Asset data (names, properties) of assets the rules cannot place is sent to YOUR Azure OpenAI deployment, and each call costs. Reversible at once; tiers already set by AI stay until the next full run.",
|        "requires": "Nothing else.",
|        "default": "Off: assets are classified by rules only.",
|        "recommended": "Off unless rules leave many assets untiered.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_EnableAI/",
|        "confirmWhen": "on",
|        "confirm": "When on, and Azure OpenAI is configured, assets that rules cannot place are sent to Azure OpenAI for a tier and service type. This adds AI cost and run time. The identity and public IP engines never use AI. Asset data (names, properties) of assets the rules cannot place is sent to YOUR Azure OpenAI deployment, and each call costs. Reversible at once; tiers already set by AI stay until the next full run."
|      }
|    },
|    {
|      "name": "SI_EnableAI_azure",
|      "label": "AI for the Azure engine",
|      "group": "AI",
|      "type": "bool",
|      "engines": [
|        "azure"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off, unless AI is turned on for all engines.",
|      "description": "AI integration -- per-engine opt-in. Tenant-wide $global:SI_EnableAI also turns it on for ALL engines; this per-engine flag is the targeted opt-in.",
|      "purpose": "An override for ONE engine: turns on Azure OpenAI classification and application grouping for the Azure engine only, while AI integration is off. With AI integration on it changes nothing.",
|      "effect": "Resources without a rule-based tier are classified by AI, and resource groups are named as applications. Adds AI cost and run time. Needs the Azure OpenAI settings; without them AI stays off. A disable switch wins.",
|      "whenToChange": "Only to use AI in the Azure engine alone; normally use AI integration (on = on for all engines).",
|      "card": "Where AI is used",
|      "info": {
|        "what": "An override for ONE engine: turns on Azure OpenAI classification and application grouping for the Azure engine only, while AI integration is off. With AI integration on it changes nothing.",
|        "whenOn": "Resources without a rule-based tier are classified by AI, and resource groups are named as applications. Adds AI cost and run time. Needs the Azure OpenAI settings; without them AI stays off. A disable switch wins.",
|        "whenOff": "unless AI is turned on for all engines.",
|        "risk": "Resource data of untiered Azure resources is sent to YOUR Azure OpenAI deployment, and each call costs. Reversible at once.",
|        "requires": "Read by: azure.",
|        "default": "Off, unless AI is turned on for all engines.",
|        "recommended": "Leave it off and use AI integration (on = on for all engines); this only turns the Azure engine on alone.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_EnableAI_azure/",
|        "confirmWhen": "on",
|        "confirm": "Resources without a rule-based tier are classified by AI, and resource groups are named as applications. Adds AI cost and run time. Needs the Azure OpenAI settings; without them AI stays off. A disable switch wins. Resource data of untiered Azure resources is sent to YOUR Azure OpenAI deployment, and each call costs. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_EnableAI_endpoint",
|      "label": "AI for the endpoint engine",
|      "group": "AI",
|      "type": "bool",
|      "engines": [
|        "endpoint"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off, unless AI is turned on for all engines.",
|      "description": "Per-engine AI opt-in (force-off via SI_DisableAI_endpoint = $true).",
|      "purpose": "An override for ONE engine: turns on Azure OpenAI classification for the endpoint engine only, while AI integration is off. With AI integration on it changes nothing.",
|      "effect": "Devices without a rule-based tier are classified by AI instead of getting the default tier. Adds AI cost and run time. Needs the Azure OpenAI settings; SI_DisableAI_endpoint wins over it.",
|      "whenToChange": "Only to use AI in the endpoint engine alone; normally use AI integration (on = on for all engines).",
|      "card": "Where AI is used",
|      "info": {
|        "what": "An override for ONE engine: turns on Azure OpenAI classification for the endpoint engine only, while AI integration is off. With AI integration on it changes nothing.",
|        "whenOn": "Devices without a rule-based tier are classified by AI instead of getting the default tier. Adds AI cost and run time. Needs the Azure OpenAI settings; SI_DisableAI_endpoint wins over it.",
|        "whenOff": "unless AI is turned on for all engines.",
|        "risk": "Device data of untiered devices is sent to YOUR Azure OpenAI deployment, and each call costs. Reversible at once.",
|        "requires": "Read by: endpoint.",
|        "default": "Off, unless AI is turned on for all engines.",
|        "recommended": "Leave it off and use AI integration (on = on for all engines); this only turns the endpoint engine on alone.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_EnableAI_endpoint/",
|        "confirmWhen": "on",
|        "confirm": "Devices without a rule-based tier are classified by AI instead of getting the default tier. Adds AI cost and run time. Needs the Azure OpenAI settings; SI_DisableAI_endpoint wins over it. Device data of untiered devices is sent to YOUR Azure OpenAI deployment, and each call costs. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_EnableAI_identity",
|      "label": "AI for the identity engine",
|      "group": "AI",
|      "type": "bool",
|      "engines": [
|        "identity"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off; identity classification never uses AI.",
|      "description": "AI integration -- per-engine opt-in. Tenant-wide $global:SI_EnableAI also turns it on for ALL engines; this per-engine flag is the targeted opt-in. Force-off: $global:SI_DisableAI_identity = $true.",
|      "purpose": "Per-engine AI switch for the identity engine.",
|      "effect": "No effect today: identity tiers always come from the built-in role and permission catalog, whatever this is set to.",
|      "whenToChange": "Never at present; it is kept for consistency with the other engines.",
|      "info": {
|        "what": "Per-engine AI switch for the identity engine.",
|        "whenOn": "No effect today: identity tiers always come from the built-in role and permission catalog, whatever this is set to.",
|        "whenOff": "identity classification never uses AI.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: identity.",
|        "default": "Off; identity classification never uses AI.",
|        "recommended": "Keep the default. Change it when: Never at present; it is kept for consistency with the other engines.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_EnableAI_identity/"
|      }
|    },
|    {
|      "name": "SI_EnableCmdbProvider",
|      "label": "CMDB enrichment on",
|      "group": "Connectors & CMDB",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: CMDB data is not used",
|      "description": "--- CMDB provider auto-refresh (preview.87+) --- When ENABLED, Stage Schedule auto-refreshes the CMDB cache at run start (gated by cache age). Reconcile then folds matched rows into Properties.collect.cmdb.",
|      "purpose": "Turns on enrichment of assets with data from your CMDB export (CMDB id, name, criticality, data sensitivity).",
|      "effect": "When on and a CMDB.csv is present, profiling runs refresh the CMDB cache and stamp CMDB fields onto matched assets; CMDB ids in custom rules take effect. When off, they are ignored. In SecurityInsight Pro the services come from the CMDB in the Pro database (the CMDB page) instead of a file; a v2.2 CMDB.csv is moved there once by setup, and a CMDB.csv left on disk is not read (the run warns when the Pro CMDB is empty and a CSV was never moved).",
|      "whenToChange": "Turn on when you have a CMDB export (or, in Pro, services on the CMDB page) you want reflected in reports.",
|      "card": "CMDB",
|      "info": {
|        "what": "Turns on enrichment of assets with data from your CMDB export (CMDB id, name, criticality, data sensitivity).",
|        "whenOn": "When on and a CMDB.csv is present, profiling runs refresh the CMDB cache and stamp CMDB fields onto matched assets; CMDB ids in custom rules take effect. When off, they are ignored. In SecurityInsight Pro the services come from the CMDB in the Pro database (the CMDB page) instead of a file; a v2.2 CMDB.csv is moved there once by setup, and a CMDB.csv left on disk is not read (the run warns when the Pro CMDB is empty and a CSV was never moved).",
|        "whenOff": "CMDB data is not used",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "Nothing else.",
|        "default": "Off: CMDB data is not used",
|        "recommended": "Keep the default. Change it when: Turn on when you have a CMDB export (or, in Pro, services on the CMDB page) you want reflected in reports.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_EnableCmdbProvider/"
|      }
|    },
|    {
|      "name": "SI_EnableServiceNowCmdb",
|      "label": "ServiceNow CMDB source",
|      "group": "Connectors & CMDB",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: the generic CMDB file is used when one is provided",
|      "description": "Enable the ServiceNow CMDB source in the Reconcile stage.",
|      "purpose": "Marks the live ServiceNow CMDB as the asset-inventory (CMDB) source used to enrich profiled assets.",
|      "effect": "The ServiceNow CMDB source is not available in this version: turning this on is refused with an error and the CMDB columns stay empty. It also does not fall back to the CMDB file.",
|      "whenToChange": "Leave off. Not usable until the ServiceNow CMDB connector is released.",
|      "info": {
|        "what": "Marks the live ServiceNow CMDB as the asset-inventory (CMDB) source used to enrich profiled assets.",
|        "whenOn": "The ServiceNow CMDB source is not available in this version: turning this on is refused with an error and the CMDB columns stay empty. It also does not fall back to the CMDB file.",
|        "whenOff": "the generic CMDB file is used when one is provided",
|        "risk": "Affects what SecurityInsight writes to your CMDB or ticketing systems. Reversible for future runs, but changes already written there stay; the connector's own guards hold large or unsafe changes.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Off: the generic CMDB file is used when one is provided",
|        "recommended": "Keep the default. Change it when: Leave off. Not usable until the ServiceNow CMDB connector is released.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_EnableServiceNowCmdb/"
|      }
|    },
|    {
|      "name": "SI_EnableSignInEnrich",
|      "label": "Identity sign-in details",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On.",
|      "description": "Sign-in enrichment (per-identity SignInActivity reads from Graph).",
|      "purpose": "Lets the identity engine add sign-in statistics per user, such as sign-in counts, apps, IP addresses and countries.",
|      "effect": "Turning it off skips the sign-in log queries, so runs are faster and cheaper, but sign-in counts, apps and locations stay empty. Last sign-in date still comes from Entra.",
|      "whenToChange": "Turn off if sign-in queries are too slow or costly in your tenant.",
|      "card": "Extra details",
|      "info": {
|        "what": "Lets the identity engine add sign-in statistics per user, such as sign-in counts, apps, IP addresses and countries.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "Turning it off skips the sign-in log queries, so runs are faster and cheaper, but sign-in counts, apps and locations stay empty. Last sign-in date still comes from Entra.",
|        "risk": "Sign-in counts, apps and locations stay empty: findings that depend on sign-in activity lose that context. Reversible: the next run collects it again.",
|        "requires": "Nothing else.",
|        "default": "On.",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_EnableSignInEnrich/",
|        "confirmWhen": "off",
|        "confirm": "Turning it off skips the sign-in log queries, so runs are faster and cheaper, but sign-in counts, apps and locations stay empty. Last sign-in date still comes from Entra. Sign-in counts, apps and locations stay empty: findings that depend on sign-in activity lose that context. Reversible: the next run collects it again."
|      }
|    },
|    {
|      "name": "SI_Endpoint_DcrName",
|      "label": "Endpoint data collection rule name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The standard name, dcr-si-endpoint-profile (from the naming pattern)",
|      "description": "Overrides the data collection rule name the endpoint profiling engine ingests through; when empty, the standard naming pattern is used.",
|      "purpose": "The name of the data collection rule the endpoint engine sends its asset rows through to Log Analytics.",
|      "effect": "Rows are sent through the named rule. A name that does not match an existing or creatable rule makes the endpoint ingest fail.",
|      "whenToChange": "Only if you renamed the rule or must avoid a name clash with another install.",
|      "info": {
|        "what": "The name of the data collection rule the endpoint engine sends its asset rows through to Log Analytics.",
|        "whenChanged": "Rows are sent through the named rule. A name that does not match an existing or creatable rule makes the endpoint ingest fail.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "The standard name, dcr-si-endpoint-profile (from the naming pattern)",
|        "recommended": "Keep the default. Change it when: Only if you renamed the rule or must avoid a name clash with another install.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Endpoint_DcrName/"
|      }
|    },
|    {
|      "name": "SI_Endpoint_TableName",
|      "label": "Endpoint table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The standard table, SI_Endpoint_Profile_CL",
|      "description": "--- Table / DCR name overrides -------------------------------------------- Only set these if you renamed the destination objects. The engine resolves the shipped names when unset; there is no hard-coded fallback in this file.",
|      "purpose": "The Log Analytics table the endpoint engine writes its asset rows to.",
|      "effect": "Rows go to the named table instead. Reports, queries and dashboards that read the standard table then no longer see new endpoint data.",
|      "whenToChange": "Only if you renamed the destination table.",
|      "info": {
|        "what": "The Log Analytics table the endpoint engine writes its asset rows to.",
|        "whenChanged": "Rows go to the named table instead. Reports, queries and dashboards that read the standard table then no longer see new endpoint data.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "The standard table, SI_Endpoint_Profile_CL",
|        "recommended": "Keep the default. Change it when: Only if you renamed the destination table.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Endpoint_TableName/"
|      }
|    },
|    {
|      "name": "SI_ExcelMaxDataRows",
|      "label": "Excel report row limit",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1,000,000 rows",
|      "description": "--- Delivery limits (added v2.2.441) -------------------------------------- Excel holds 1,048,576 rows INCLUDING the header. Above this the workbook keeps the TOP N by the sort column (highest risk first) and says how many were left out; the .json sibling and the LA ingest still carry every row.",
|      "purpose": "The most rows written to one worksheet of an Excel report; above it, the highest-risk rows are kept and the rest are left out of the workbook.",
|      "effect": "A lower value gives smaller, quicker workbooks but more rows are left out of the Excel file. Nothing is lost from the run: the JSON file and Log Analytics still hold every row.",
|      "whenToChange": "Most installs never should. Lower it if workbooks are too large to open or mail.",
|      "unit": "rows",
|      "info": {
|        "what": "The most rows written to one worksheet of an Excel report; above it, the highest-risk rows are kept and the rest are left out of the workbook.",
|        "whenChanged": "A lower value gives smaller, quicker workbooks but more rows are left out of the Excel file. Nothing is lost from the run: the JSON file and Log Analytics still hold every row.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "1,000,000 rows",
|        "recommended": "Keep the default. Change it when: Most installs never should. Lower it if workbooks are too large to open or mail.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ExcelMaxDataRows/"
|      }
|    },
|    {
|      "name": "SI_Exempted_CountInManagement",
|      "label": "Count exempted findings in the management numbers",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "off (exempted findings are not counted)",
|      "description": "EXEMPTED FINDINGS: an approved exemption never removes a finding -- Risk Analysis keeps it, marked, in Log Analytics and the Pro database, and each report decides whether to count it. Count exempted findings in the management numbers: Risk Analysis's workbook, JSON, summary and mail, and the web app's dashboards, KPIs, trends, closure and Services view and the wall board. Off by default: exempted findings are left out, and every surface says how many.",
|      "purpose": "Whether findings covered by an approved exemption are counted in the management numbers: Risk Analysis's workbook, JSON, summary and mail, and the web app's dashboards, KPIs, trends, closure and Services view and the wall board.",
|      "effect": "An exemption never removes a finding: it is kept, marked, in Log Analytics and the Pro database either way. Off: every management number leaves exempted findings out and says how many it left out; each dashboard has an 'Include exempted' tick that recomputes its figures with them (shown as simulated, never saved). On: they are counted everywhere by default.",
|      "whenToChange": "Turn on if management should see the risk including accepted exemptions.",
|      "card": "Counting and closing findings",
|      "info": {
|        "what": "Whether findings covered by an approved exemption are counted in the management numbers: Risk Analysis's workbook, JSON, summary and mail, and the web app's dashboards, KPIs, trends, closure and Services view and the wall board.",
|        "whenOn": "they are counted everywhere by default.",
|        "whenOff": "every management number leaves exempted findings out and says how many it left out; each dashboard has an 'Include exempted' tick that recomputes its figures with them (shown as simulated, never saved).",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "off (exempted findings are not counted)",
|        "recommended": "Keep the default. Change it when: Turn on if management should see the risk including accepted exemptions.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Exempted_CountInManagement/"
|      }
|    },
|    {
|      "name": "SI_Exempted_InDepartmentReports",
|      "label": "Count exempted findings for departments",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "off (exempted findings are not counted)",
|      "description": "Count exempted findings in the department reports: the department pages, the business owners' monthly report and the technical owners' digest and review. Off by default: exempted findings are left out, and the report says how many.",
|      "purpose": "Whether findings with an approved exemption count on the department pages and in the department mails.",
|      "effect": "Off: department pages and mails leave exempted findings out and say how many they left out; a department page's 'Include exempted' tick shows them for that view only. On: they are counted by default. The data keeps them either way.",
|      "whenToChange": "Turn on if departments should keep seeing the findings they have an exemption for.",
|      "card": "Mails to departments",
|      "info": {
|        "what": "Whether findings with an approved exemption count on the department pages and in the department mails.",
|        "whenOn": "they are counted by default. The data keeps them either way.",
|        "whenOff": "department pages and mails leave exempted findings out and say how many they left out; a department page's 'Include exempted' tick shows them for that view only.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "off (exempted findings are not counted)",
|        "recommended": "Keep the default. Change it when: Turn on if departments should keep seeing the findings they have an exemption for.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Exempted_InDepartmentReports/"
|      }
|    },
|    {
|      "name": "SI_FingerprintCache_Enabled",
|      "label": "Asset fingerprint cache",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: every asset is processed on every run",
|      "description": "Fingerprint cache is OPT-IN (the gate is `-eq $true`); default is OFF.",
|      "purpose": "Remembers each asset between runs so incremental runs can skip assets that are not yet due for re-processing.",
|      "effect": "On can shorten incremental runs, but adds storage writes, and it has no effect on full runs. Off is safe: every row is still produced.",
|      "whenToChange": "Only on installs that run incremental (not full) runs and want shorter run times.",
|      "info": {
|        "what": "Remembers each asset between runs so incremental runs can skip assets that are not yet due for re-processing.",
|        "whenOn": "On can shorten incremental runs, but adds storage writes, and it has no effect on full runs. Off is safe: every row is still produced.",
|        "whenOff": "every asset is processed on every run",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: azure, endpoint, identity, publicip.",
|        "default": "Off: every asset is processed on every run",
|        "recommended": "Keep the default. Change it when: Only on installs that run incremental (not full) runs and want shorter run times.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_FingerprintCache_Enabled/"
|      }
|    },
|    {
|      "name": "SI_ForceFullRun",
|      "label": "Full run for all profilers",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Force a full re-run for ALL profile engines this invocation. Per-engine overrides (SI_ForceFullRun_<Engine>) win over this tenant-wide switch.",
|      "purpose": "Makes every asset-profiling engine process all assets on the next run, ignoring the per-asset skip schedule and cached CMDB data.",
|      "effect": "Every asset is re-collected and re-classified, so runs take longer and use more AI calls when AI is on. A per-engine full-run setting that is on wins; a job's own SI_FORCE_FULL_RUN wins over both. Applies the same way on a VM and in container jobs.",
|      "whenToChange": "After changing rules or fixing bad cached data, when you want every asset refreshed at once.",
|      "info": {
|        "what": "Makes every asset-profiling engine process all assets on the next run, ignoring the per-asset skip schedule and cached CMDB data.",
|        "whenOn": "Every asset is re-collected and re-classified, so runs take longer and use more AI calls when AI is on. A per-engine full-run setting that is on wins; a job's own SI_FORCE_FULL_RUN wins over both. Applies the same way on a VM and in container jobs.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "Off",
|        "recommended": "Keep the default. Change it when: After changing rules or fixing bad cached data, when you want every asset refreshed at once.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ForceFullRun/"
|      }
|    },
|    {
|      "name": "SI_ForceFullRun_Azure",
|      "label": "Azure full re-run",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [
|        "azure"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: unchanged resources are skipped.",
|      "description": "Force-full-run -- skip the fingerprint cadence short-circuit. Use after rule changes or schema updates. Default $false (cadence wins).",
|      "purpose": "Makes the Azure engine reprocess every resource instead of skipping ones that have not changed since the last run.",
|      "effect": "Every resource is reclassified, so the run takes longer and, with AI on, costs more. Overrides the all-engine full re-run switch for this engine.",
|      "whenToChange": "Once after changing rules or the schema; then switch it back off.",
|      "info": {
|        "what": "Makes the Azure engine reprocess every resource instead of skipping ones that have not changed since the last run.",
|        "whenOn": "Every resource is reclassified, so the run takes longer and, with AI on, costs more. Overrides the all-engine full re-run switch for this engine.",
|        "whenOff": "unchanged resources are skipped.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: azure.",
|        "default": "Off: unchanged resources are skipped.",
|        "recommended": "Keep the default. Change it when: Once after changing rules or the schema; then switch it back off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ForceFullRun_Azure/"
|      }
|    },
|    {
|      "name": "SI_ForceFullRun_Endpoint",
|      "label": "Endpoint full re-run",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [
|        "endpoint"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: unchanged devices are skipped.",
|      "description": "Skip the per-asset cadence short-circuit; re-classify every asset this run.",
|      "purpose": "Makes the endpoint engine reprocess every device instead of skipping ones that have not changed since the last run.",
|      "effect": "Every device is reclassified, so the run takes longer and, with AI on, costs more. Overrides the all-engine full re-run switch for this engine.",
|      "whenToChange": "Once after changing rules or the schema; then switch it back off.",
|      "info": {
|        "what": "Makes the endpoint engine reprocess every device instead of skipping ones that have not changed since the last run.",
|        "whenOn": "Every device is reclassified, so the run takes longer and, with AI on, costs more. Overrides the all-engine full re-run switch for this engine.",
|        "whenOff": "unchanged devices are skipped.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: endpoint.",
|        "default": "Off: unchanged devices are skipped.",
|        "recommended": "Keep the default. Change it when: Once after changing rules or the schema; then switch it back off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ForceFullRun_Endpoint/"
|      }
|    },
|    {
|      "name": "SI_ForceFullRun_Identity",
|      "label": "Identity full re-run",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [
|        "identity"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: unchanged identities are skipped.",
|      "description": "Force-full-run -- skip the fingerprint cadence short-circuit; re-process every asset. Use after rule changes or schema updates. Default $false (cadence wins).",
|      "purpose": "Makes the identity engine reprocess every identity instead of skipping ones that have not changed since the last run.",
|      "effect": "Every identity is reprocessed, so the run takes longer. Overrides the all-engine full re-run switch for this engine.",
|      "whenToChange": "Once after changing rules or the schema; then switch it back off.",
|      "info": {
|        "what": "Makes the identity engine reprocess every identity instead of skipping ones that have not changed since the last run.",
|        "whenOn": "Every identity is reprocessed, so the run takes longer. Overrides the all-engine full re-run switch for this engine.",
|        "whenOff": "unchanged identities are skipped.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: identity.",
|        "default": "Off: unchanged identities are skipped.",
|        "recommended": "Keep the default. Change it when: Once after changing rules or the schema; then switch it back off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ForceFullRun_Identity/"
|      }
|    },
|    {
|      "name": "SI_ForceFullRun_PublicIp",
|      "label": "Public IP force full run",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off; falls back to SI_ForceFullRun, which is also off.",
|      "description": "Force-full-run -- skip the fingerprint cadence short-circuit. Use after rule changes or schema updates. Default $false (cadence wins).",
|      "purpose": "Makes the public IP engine process every address, ignoring the per-tier re-check cadence, for this engine only.",
|      "effect": "On, every address is re-processed on every run. It only changes anything when the fingerprint cache (SI_FingerprintCache_Enabled) is on; without it every address is processed anyway. More run time when it matters.",
|      "whenToChange": "Once after changing tier rules or the schema, then turn it off again.",
|      "info": {
|        "what": "Makes the public IP engine process every address, ignoring the per-tier re-check cadence, for this engine only.",
|        "whenOn": "On, every address is re-processed on every run. It only changes anything when the fingerprint cache (SI_FingerprintCache_Enabled) is on; without it every address is processed anyway. More run time when it matters.",
|        "whenOff": "falls back to SI_ForceFullRun, which is also off.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "Off; falls back to SI_ForceFullRun, which is also off.",
|        "recommended": "Keep the default. Change it when: Once after changing tier rules or the schema, then turn it off again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ForceFullRun_PublicIp/"
|      }
|    },
|    {
|      "name": "SI_Graph_AppId",
|      "label": "App id (older Graph name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_SPN_AppId is used",
|      "description": "Legacy split-SPN aliases (still honoured as fallback by the engine; set only if you can't use the unified SI_SPN_* names above):",
|      "purpose": "Older name for the service principal's application id; still read when SI_SPN_AppId is not set.",
|      "effect": "Only matters when SI_SPN_AppId is empty; then this app id is used for Microsoft Graph sign-in and setup copies it forward.",
|      "whenToChange": "Never on new installs; use SI_SPN_AppId instead.",
|      "info": {
|        "what": "Older name for the service principal's application id; still read when SI_SPN_AppId is not set.",
|        "whenChanged": "Only matters when SI_SPN_AppId is empty; then this app id is used for Microsoft Graph sign-in and setup copies it forward.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: SI_SPN_AppId is used",
|        "recommended": "Keep the default. Change it when: Never on new installs; use SI_SPN_AppId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Graph_AppId/"
|      }
|    },
|    {
|      "name": "SI_Graph_Secret",
|      "label": "Client secret (older Graph name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": true,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_SPN_Secret is used",
|      "description": "Older name for the service principal's client secret; used only when SI_SPN_Secret is not set.",
|      "purpose": "Older name for the service principal's client secret; used only when SI_SPN_Secret is not set.",
|      "effect": "Only matters when SI_SPN_Secret is empty; then this secret is used for Microsoft Graph sign-in.",
|      "whenToChange": "Never on new installs; use SI_SPN_Secret, a certificate or managed identity.",
|      "info": {
|        "what": "Older name for the service principal's client secret; used only when SI_SPN_Secret is not set.",
|        "whenChanged": "Only matters when SI_SPN_Secret is empty; then this secret is used for Microsoft Graph sign-in.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Kept in the install's Key Vault.",
|        "default": "Not set: SI_SPN_Secret is used",
|        "recommended": "Keep the default. Change it when: Never on new installs; use SI_SPN_Secret, a certificate or managed identity.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Graph_Secret/"
|      }
|    },
|    {
|      "name": "SI_Graph_TenantId",
|      "label": "Tenant id (older Graph name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_SPN_TenantId is used",
|      "description": "Older name for the Entra tenant id the service principal signs in to; used only when SI_SPN_TenantId is not set.",
|      "purpose": "Older name for the Entra tenant id the service principal signs in to; used only when SI_SPN_TenantId is not set.",
|      "effect": "Only matters when SI_SPN_TenantId is empty; then this tenant is used for Microsoft Graph sign-in.",
|      "whenToChange": "Never on new installs; use SI_SPN_TenantId instead.",
|      "info": {
|        "what": "Older name for the Entra tenant id the service principal signs in to; used only when SI_SPN_TenantId is not set.",
|        "whenChanged": "Only matters when SI_SPN_TenantId is empty; then this tenant is used for Microsoft Graph sign-in.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: SI_SPN_TenantId is used",
|        "recommended": "Keep the default. Change it when: Never on new installs; use SI_SPN_TenantId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Graph_TenantId/"
|      }
|    },
|    {
|      "name": "SI_Guard_AssetPropertiesCollectionChange_Enabled",
|      "label": "Asset metadata: large change",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Asset metadata: large change (asset.properties.collection-change). Off: the step goes on as if the check had not tripped -- a large change of the asset metadata is handed over like any other.",
|      "purpose": "The safety check that protects the asset metadata handed to your CMDB and vulnerability system: The full asset metadata collected from one source changed by more than the allowed share since the previous run, which looks like a broken collection rather than a real change, so the previous collection of that source was kept for the hand-off.",
|      "effect": "Off: the step goes on as if the check had not tripped -- a large change of the asset metadata is handed over like any other. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the asset metadata handed to your CMDB and vulnerability system: The full asset metadata collected from one source changed by more than the allowed share since the previous run, which looks like a broken collection rather than a real change, so the previous collection of that source was kept for the hand-off.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- a large change of the asset metadata is handed over like any other.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_AssetPropertiesCollectionChange_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- a large change of the asset metadata is handed over like any other. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_AssetPropertiesCollectionChange_Mail",
|      "label": "Asset metadata: large change: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_AssetPropertiesCollectionChange_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Asset metadata: large change\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_AssetPropertiesCollectionChange_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_AuditRetentionRefused_Enabled",
|      "label": "Audit trail retention setting",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Audit trail retention setting (audit.retention.refused). Off: no event and no mail. The step itself still stops, because the retention setting is not valid.",
|      "purpose": "The safety check that protects the audit trail: The audit trail retention setting (SI_Pro_AuditRetentionMonths) is not a whole number of at least 13 months, so nothing was removed.",
|      "effect": "Off: no event and no mail. The step itself still stops, because the retention setting is not valid. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the audit trail: The audit trail retention setting (SI_Pro_AuditRetentionMonths) is not a whole number of at least 13 months, so nothing was removed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because the retention setting is not valid.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_AuditRetentionRefused_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because the retention setting is not valid. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_AuditRetentionRefused_Mail",
|      "label": "Audit trail retention setting: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_AuditRetentionRefused_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Audit trail retention setting\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_AuditRetentionRefused_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CiBuildConcurrent_Enabled",
|      "label": "CI build started while another was running",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "CI build started while another was running (ci.build.concurrent). Off: no event. The second CI build still waits for the first one, because two builds never write the CIs at the same time.",
|      "purpose": "The safety check that protects your configuration items (CIs) from being written by two builds at the same time: A CI build was started while another CI build was still running.",
|      "effect": "Off: no event. The second CI build still waits for the first one, because two builds never write the CIs at the same time. On: the check works as described on the Guards page.",
|      "whenToChange": "Leave it on: it only reports, and nothing is stopped by it. Turn it off when you do not need to know that a CI build had to wait.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects your configuration items (CIs) from being written by two builds at the same time: A CI build was started while another CI build was still running.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event. The second CI build still waits for the first one, because two builds never write the CIs at the same time.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "On",
|        "recommended": "Keep it on. Change it when: Leave it on: it only reports, and nothing is stopped by it. Turn it off when you do not need to know that a CI build had to wait.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CiBuildConcurrent_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event. The second CI build still waits for the first one, because two builds never write the CIs at the same time. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CiBuildConcurrent_Mail",
|      "label": "CI build started while another was running: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "This check only reports and stops nothing, so it sends no mail either way: the event is shown on the Guards page and kept in run health and the audit trail.",
|      "whenToChange": "Nothing to change: a check that only reports is not mailed.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CiBuildConcurrent_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "This check only reports and stops nothing, so it sends no mail either way: the event is shown on the Guards page and kept in run health and the audit trail.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"CI build started while another was running\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Nothing to change: a check that only reports is not mailed.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CiBuildConcurrent_Mail/",
|        "confirmWhen": "off",
|        "confirm": "This check only reports and stops nothing, so it sends no mail either way: the event is shown on the Guards page and kept in run health and the audit trail. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbHandoffMassChange_Enabled",
|      "label": "CMDB hand-off: large change",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "CMDB hand-off: large change (cmdb.handoff.mass-change). Off: the step goes on as if the check had not tripped -- the batch is handed over to ServiceNow however many CIs changed or disappeared.",
|      "purpose": "The safety check that protects the CIs your ServiceNow imports from the CMDB hand-off database: Far more of the CIs handed to ServiceNow last time are missing from this run than the connector allows, which looks like a broken collection rather than assets gone, so this run's batch was held and ServiceNow keeps importing the previous one.",
|      "effect": "Off: the step goes on as if the check had not tripped -- the batch is handed over to ServiceNow however many CIs changed or disappeared. On: the check works as described on the Guards page.",
|      "whenToChange": "Leave it on. Turn it off only when this check keeps stopping work you know is right -- read what Off means first.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the CIs your ServiceNow imports from the CMDB hand-off database: Far more of the CIs handed to ServiceNow last time are missing from this run than the connector allows, which looks like a broken collection rather than assets gone, so this run's batch was held and ServiceNow keeps importing the previous one.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- the batch is handed over to ServiceNow however many CIs changed or disappeared.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "On",
|        "recommended": "Keep it on. Change it when: Leave it on. Turn it off only when this check keeps stopping work you know is right -- read what Off means first.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbHandoffMassChange_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- the batch is handed over to ServiceNow however many CIs changed or disappeared. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbHandoffMassChange_Mail",
|      "label": "CMDB hand-off: large change: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbHandoffMassChange_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"CMDB hand-off: large change\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbHandoffMassChange_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbServicenowCreateGate_Enabled",
|      "label": "ServiceNow: CIs not accepted",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "ServiceNow: CIs not accepted (cmdb.servicenow.create-gate). Off: no event and no mail. The rows ServiceNow did not accept are still sent again with the next run.",
|      "purpose": "The safety check that protects the configuration items (CIs) in ServiceNow: ServiceNow's import did not accept some of the CIs SecurityInsight sent, so this batch was not completed.",
|      "effect": "Off: no event and no mail. The rows ServiceNow did not accept are still sent again with the next run. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the configuration items (CIs) in ServiceNow: ServiceNow's import did not accept some of the CIs SecurityInsight sent, so this batch was not completed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The rows ServiceNow did not accept are still sent again with the next run.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbServicenowCreateGate_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The rows ServiceNow did not accept are still sent again with the next run. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbServicenowCreateGate_Mail",
|      "label": "ServiceNow: CIs not accepted: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbServicenowCreateGate_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"ServiceNow: CIs not accepted\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbServicenowCreateGate_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbServicenowServiceModel_Enabled",
|      "label": "ServiceNow: service model errors",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "ServiceNow: service model errors (cmdb.servicenow.service-model). Off: no event and no mail. The step itself still stops, because the service model has errors.",
|      "purpose": "The safety check that protects the placement of assets in your business services: The service model has errors, so no asset was placed in a business service.",
|      "effect": "Off: no event and no mail. The step itself still stops, because the service model has errors. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the placement of assets in your business services: The service model has errors, so no asset was placed in a business service.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because the service model has errors.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbServicenowServiceModel_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because the service model has errors. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbServicenowServiceModel_Mail",
|      "label": "ServiceNow: service model errors: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbServicenowServiceModel_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"ServiceNow: service model errors\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbServicenowServiceModel_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbServicenowUnreachable_Enabled",
|      "label": "ServiceNow: not reachable",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "ServiceNow: not reachable (cmdb.servicenow.unreachable). Off: no event and no mail. The step itself still stops, because ServiceNow cannot be reached.",
|      "purpose": "The safety check that protects the configuration items (CIs) in ServiceNow: The ServiceNow instance could not be reached, so nothing was sent.",
|      "effect": "Off: no event and no mail. The step itself still stops, because ServiceNow cannot be reached. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the configuration items (CIs) in ServiceNow: The ServiceNow instance could not be reached, so nothing was sent.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because ServiceNow cannot be reached.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbServicenowUnreachable_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because ServiceNow cannot be reached. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbServicenowUnreachable_Mail",
|      "label": "ServiceNow: not reachable: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbServicenowUnreachable_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"ServiceNow: not reachable\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbServicenowUnreachable_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlCollapse_Enabled",
|      "label": "CMDB table: far fewer assets than usual",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "CMDB table: far fewer assets than usual (cmdb.sql.collapse). Off: the step goes on as if the check had not tripped -- CIs are retired even when SecurityInsight sees far fewer assets than are active in the CMDB table.",
|      "purpose": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: SecurityInsight sees far fewer assets than are active in the CMDB table, which looks like a broken collection rather than assets gone, so nothing was retired.",
|      "effect": "Off: the step goes on as if the check had not tripped -- CIs are retired even when SecurityInsight sees far fewer assets than are active in the CMDB table. On: the check works as described on the Guards page.",
|      "whenToChange": "Leave it on. Turn it off only when this check keeps stopping work you know is right -- read what Off means first.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: SecurityInsight sees far fewer assets than are active in the CMDB table, which looks like a broken collection rather than assets gone, so nothing was retired.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- CIs are retired even when SecurityInsight sees far fewer assets than are active in the CMDB table.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "On",
|        "recommended": "Keep it on. Change it when: Leave it on. Turn it off only when this check keeps stopping work you know is right -- read what Off means first.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlCollapse_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- CIs are retired even when SecurityInsight sees far fewer assets than are active in the CMDB table. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlCollapse_Mail",
|      "label": "CMDB table: far fewer assets than usual: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbSqlCollapse_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"CMDB table: far fewer assets than usual\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlCollapse_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlEmptySnapshot_Enabled",
|      "label": "CMDB table: empty asset collection",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "CMDB table: empty asset collection (cmdb.sql.empty-snapshot). Off: the step goes on as if the check had not tripped -- an empty asset collection is written too, which can retire every CI.",
|      "purpose": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: The newest asset collection holds no assets at all, so nothing was written or retired.",
|      "effect": "Off: the step goes on as if the check had not tripped -- an empty asset collection is written too, which can retire every CI. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: The newest asset collection holds no assets at all, so nothing was written or retired.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- an empty asset collection is written too, which can retire every CI.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlEmptySnapshot_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- an empty asset collection is written too, which can retire every CI. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlEmptySnapshot_Mail",
|      "label": "CMDB table: empty asset collection: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbSqlEmptySnapshot_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"CMDB table: empty asset collection\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlEmptySnapshot_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlNoCorrelationMap_Enabled",
|      "label": "CMDB table: no correlation results",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "CMDB table: no correlation results (cmdb.sql.no-correlation-map). Off: no event and no mail. The step itself still stops, because without the correlation results no asset can be matched to its CI.",
|      "purpose": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: The asset correlation results are missing, so assets could not be matched to their CIs and nothing was written.",
|      "effect": "Off: no event and no mail. The step itself still stops, because without the correlation results no asset can be matched to its CI. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: The asset correlation results are missing, so assets could not be matched to their CIs and nothing was written.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because without the correlation results no asset can be matched to its CI.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlNoCorrelationMap_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because without the correlation results no asset can be matched to its CI. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlNoCorrelationMap_Mail",
|      "label": "CMDB table: no correlation results: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbSqlNoCorrelationMap_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"CMDB table: no correlation results\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlNoCorrelationMap_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlSnapshotIncomplete_Enabled",
|      "label": "CMDB table: asset collection not complete",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "CMDB table: asset collection not complete (cmdb.sql.snapshot-incomplete). Off: no event and no mail. The step itself still stops, because a CI is never written from an asset collection that is not complete.",
|      "purpose": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: The newest asset collection is not known to be complete, so the CMDB table was not changed.",
|      "effect": "Off: no event and no mail. The step itself still stops, because a CI is never written from an asset collection that is not complete. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: The newest asset collection is not known to be complete, so the CMDB table was not changed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because a CI is never written from an asset collection that is not complete.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlSnapshotIncomplete_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because a CI is never written from an asset collection that is not complete. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlSnapshotIncomplete_Mail",
|      "label": "CMDB table: asset collection not complete: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbSqlSnapshotIncomplete_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"CMDB table: asset collection not complete\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlSnapshotIncomplete_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlStale_Enabled",
|      "label": "CMDB table: changed by another run",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "CMDB table: changed by another run (cmdb.sql.stale). Off: no event and no mail. The step itself still stops, because another run changed the CMDB table meanwhile; the next run plans again.",
|      "purpose": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: Another run changed the CMDB table while this one was planning, so this run wrote nothing.",
|      "effect": "Off: no event and no mail. The step itself still stops, because another run changed the CMDB table meanwhile; the next run plans again. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the configuration items (CIs) in your SQL CMDB table: Another run changed the CMDB table while this one was planning, so this run wrote nothing.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because another run changed the CMDB table meanwhile; the next run plans again.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlStale_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because another run changed the CMDB table meanwhile; the next run plans again. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CmdbSqlStale_Mail",
|      "label": "CMDB table: changed by another run: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CmdbSqlStale_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"CMDB table: changed by another run\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CmdbSqlStale_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_CollectionSourceAssetDrop_Enabled",
|      "label": "Collection: far fewer assets from one source",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "Collection: far fewer assets from one source (collection.source.asset-drop). Off: a collection with far fewer assets is taken as it comes -- the assets the source no longer lists are marked not seen at once, and their CIs retire after the usual days.",
|      "purpose": "The safety check that protects your configuration items (CIs) and everything calculated from them: One source returned far fewer assets than in its last good collection, although the collection completed.",
|      "effect": "Off: a collection with far fewer assets is taken as it comes -- the assets the source no longer lists are marked not seen at once, and their CIs retire after the usual days. On: the check works as described on the Guards page.",
|      "whenToChange": "Leave it on. Turn it off only when this check keeps stopping work you know is right -- read what Off means first.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects your configuration items (CIs) and everything calculated from them: One source returned far fewer assets than in its last good collection, although the collection completed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "a collection with far fewer assets is taken as it comes -- the assets the source no longer lists are marked not seen at once, and their CIs retire after the usual days.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "On",
|        "recommended": "Keep it on. Change it when: Leave it on. Turn it off only when this check keeps stopping work you know is right -- read what Off means first.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CollectionSourceAssetDrop_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "a collection with far fewer assets is taken as it comes -- the assets the source no longer lists are marked not seen at once, and their CIs retire after the usual days. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_CollectionSourceAssetDrop_Mail",
|      "label": "Collection: far fewer assets from one source: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: this check never sends a mail -- its event is shown on the Guards page only; a value here changes nothing.",
|      "purpose": "This safety check never sends a mail: it accepts a real drop by itself on the next complete collection, so its event is shown on the Guards page only. This switch changes nothing and is not shown on the Settings page.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Never: this check sends no mail either way.",
|      "card": "CMDB, ServiceNow and asset metadata checks",
|      "needs": "SI_Guard_CollectionSourceAssetDrop_Enabled",
|      "info": {
|        "what": "This safety check never sends a mail: it accepts a real drop by itself on the next complete collection, so its event is shown on the Guards page only. This switch changes nothing and is not shown on the Settings page.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Collection: far fewer assets from one source\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Never: this check sends no mail either way.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_CollectionSourceAssetDrop_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_DatasyncAssetKindDropped_Enabled",
|      "label": "Data sync: findings an asset kind filter cannot show",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Data sync: findings an asset kind filter cannot show (datasync.asset.kind-dropped). Off: no event and no mail when a loaded collection has findings of an asset kind that no asset of that kind carries; the findings are loaded as before.",
|      "purpose": "The safety check that protects the asset kind filters of the Pro web app: findings of an asset kind were loaded, but their assets were stored without that kind (or without any kind), so the asset kind filter cannot show them.",
|      "effect": "Off: no event and no mail when a loaded collection has findings of an asset kind that no asset of that kind carries; the findings are loaded as before. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the asset kind filters of the Pro web app: findings of an asset kind were loaded, but their assets were stored without that kind (or without any kind), so the asset kind filter cannot show them.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail when a loaded collection has findings of an asset kind that no asset of that kind carries; the findings are loaded as before.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_DatasyncAssetKindDropped_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail when a loaded collection has findings of an asset kind that no asset of that kind carries; the findings are loaded as before. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_DatasyncAssetKindDropped_Mail",
|      "label": "Data sync: findings an asset kind filter cannot show: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guard_DatasyncAssetKindDropped_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Data sync: findings an asset kind filter cannot show\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_DatasyncAssetKindDropped_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_DatasyncCollectionHeld_Enabled",
|      "label": "Data sync: collection of an unfinished run",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Data sync: collection of an unfinished run (datasync.collection.held). Off: the step goes on as if the check had not tripped -- a collection whose Risk Analysis run did not finish completely is loaded anyway and MARKED PARTIAL in the web app.",
|      "purpose": "The safety check that protects the collections shown in the Pro web app: Some Risk Analysis collections were not loaded into the Pro database because the run that produced them is not known to be complete.",
|      "effect": "Off: the step goes on as if the check had not tripped -- a collection whose Risk Analysis run did not finish completely is loaded anyway and MARKED PARTIAL in the web app. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the collections shown in the Pro web app: Some Risk Analysis collections were not loaded into the Pro database because the run that produced them is not known to be complete.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- a collection whose Risk Analysis run did not finish completely is loaded anyway and MARKED PARTIAL in the web app.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_DatasyncCollectionHeld_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- a collection whose Risk Analysis run did not finish completely is loaded anyway and MARKED PARTIAL in the web app. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_DatasyncCollectionHeld_Mail",
|      "label": "Data sync: collection of an unfinished run: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guard_DatasyncCollectionHeld_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Data sync: collection of an unfinished run\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_DatasyncCollectionHeld_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_DatasyncCollectionRefused_Enabled",
|      "label": "Data sync: rows without their key",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Data sync: rows without their key (datasync.collection.refused). Off: no event and no mail. The step itself still stops, because rows without their finding id or collection time cannot be placed in a day.",
|      "purpose": "The safety check that protects the days shown in the Pro web app and its trends: Risk Analysis data arrived without its key columns (its finding ids, or its collection time), so it was not loaded as a day.",
|      "effect": "Off: no event and no mail. The step itself still stops, because rows without their finding id or collection time cannot be placed in a day. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the days shown in the Pro web app and its trends: Risk Analysis data arrived without its key columns (its finding ids, or its collection time), so it was not loaded as a day.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because rows without their finding id or collection time cannot be placed in a day.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_DatasyncCollectionRefused_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because rows without their finding id or collection time cannot be placed in a day. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_DatasyncCollectionRefused_Mail",
|      "label": "Data sync: rows without their key: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guard_DatasyncCollectionRefused_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Data sync: rows without their key\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_DatasyncCollectionRefused_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_DatasyncCollectionShortRead_Enabled",
|      "label": "Data sync: collection not read in full",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Data sync: collection not read in full (datasync.collection.short-read). Off: no event and no mail. The step itself still stops, because a collection that could not be read or written in full is not loaded.",
|      "purpose": "The safety check that protects the collections shown in the Pro web app: A collection could not be read or written in full, so it was not loaded.",
|      "effect": "Off: no event and no mail. The step itself still stops, because a collection that could not be read or written in full is not loaded. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the collections shown in the Pro web app: A collection could not be read or written in full, so it was not loaded.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because a collection that could not be read or written in full is not loaded.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_DatasyncCollectionShortRead_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because a collection that could not be read or written in full is not loaded. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_DatasyncCollectionShortRead_Mail",
|      "label": "Data sync: collection not read in full: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guard_DatasyncCollectionShortRead_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Data sync: collection not read in full\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_DatasyncCollectionShortRead_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_ExemptionBulkRefused_Enabled",
|      "label": "Bulk exemption limit",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Bulk exemption limit (exemption.bulk.refused). Off: no event and no mail. The request itself is still refused, because a whole collection is never exempted in one go -- raise the limit instead (Settings > Exemptions: Most findings in one bulk exemption request, up to 2,000).",
|      "purpose": "The safety check that protects your findings from being exempted in bulk by mistake: A request to exempt or change many findings at once was refused (no narrowing filter, or more findings than the limit allows).",
|      "effect": "Off: no event and no mail. The request itself is still refused, because a whole collection is never exempted in one go -- raise the limit instead (Settings > Exemptions: Most findings in one bulk exemption request, up to 2,000). On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects your findings from being exempted in bulk by mistake: A request to exempt or change many findings at once was refused (no narrowing filter, or more findings than the limit allows).",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The request itself is still refused, because a whole collection is never exempted in one go -- raise the limit instead (Settings > Exemptions: Most findings in one bulk exemption request, up to 2,000).",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_ExemptionBulkRefused_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The request itself is still refused, because a whole collection is never exempted in one go -- raise the limit instead (Settings > Exemptions: Most findings in one bulk exemption request, up to 2,000). Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_ExemptionBulkRefused_Mail",
|      "label": "Bulk exemption limit: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_ExemptionBulkRefused_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Bulk exemption limit\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_ExemptionBulkRefused_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_FlowRunCatchUp_Enabled",
|      "label": "Daily flow: start held for the previous run",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Daily flow: start held for the previous run (flow.run.catch-up). Off: no event and no mail; the daily flow still waits for its previous run.",
|      "purpose": "The safety check that protects the order of the daily jobs: A scheduled start of the daily job flow was held because the previous run was still running; it ran once as soon as that run finished.",
|      "effect": "Off: no event and no mail; the daily flow still waits for its previous run. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the order of the daily jobs: A scheduled start of the daily job flow was held because the previous run was still running; it ran once as soon as that run finished.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail; the daily flow still waits for its previous run.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_FlowRunCatchUp_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail; the daily flow still waits for its previous run. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_FlowRunCatchUp_Mail",
|      "label": "Daily flow: start held for the previous run: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_FlowRunCatchUp_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Daily flow: start held for the previous run\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_FlowRunCatchUp_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_FlowStepInterrupted_Enabled",
|      "label": "Daily flow: job interrupted",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Daily flow: job interrupted (flow.step.interrupted). Off: no event and no mail; an interrupted job is still not started again.",
|      "purpose": "The safety check that protects the jobs that depend on an earlier job: A job in the daily flow was interrupted and was not started again automatically.",
|      "effect": "Off: no event and no mail; an interrupted job is still not started again. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the jobs that depend on an earlier job: A job in the daily flow was interrupted and was not started again automatically.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail; an interrupted job is still not started again.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_FlowStepInterrupted_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail; an interrupted job is still not started again. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_FlowStepInterrupted_Mail",
|      "label": "Daily flow: job interrupted: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_FlowStepInterrupted_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Daily flow: job interrupted\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_FlowStepInterrupted_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_FlowStepSkipped_Enabled",
|      "label": "Daily flow: jobs skipped",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Daily flow: jobs skipped (flow.step.skipped). Off: no event and no mail; jobs that need a failed job are still skipped.",
|      "purpose": "The safety check that protects the jobs that depend on an earlier job: One or more jobs in the daily flow were skipped because a job they need did not succeed.",
|      "effect": "Off: no event and no mail; jobs that need a failed job are still skipped. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the jobs that depend on an earlier job: One or more jobs in the daily flow were skipped because a job they need did not succeed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail; jobs that need a failed job are still skipped.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_FlowStepSkipped_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail; jobs that need a failed job are still skipped. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_FlowStepSkipped_Mail",
|      "label": "Daily flow: jobs skipped: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_FlowStepSkipped_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Daily flow: jobs skipped\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_FlowStepSkipped_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_FlowStepStartFailed_Enabled",
|      "label": "Daily flow: job did not start",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Daily flow: job did not start (flow.step.start-failed). Off: no event and no mail; a job that does not start is still not run.",
|      "purpose": "The safety check that protects the jobs of the daily flow: A job in the daily flow could not start: its container stopped before SecurityInsight ran (an Azure platform problem).",
|      "effect": "Off: no event and no mail; a job that does not start is still not run. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the jobs of the daily flow: A job in the daily flow could not start: its container stopped before SecurityInsight ran (an Azure platform problem).",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail; a job that does not start is still not run.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_FlowStepStartFailed_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail; a job that does not start is still not run. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_FlowStepStartFailed_Mail",
|      "label": "Daily flow: job did not start: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_FlowStepStartFailed_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Daily flow: job did not start\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_FlowStepStartFailed_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_IngestRowsShortCount_Enabled",
|      "label": "Log Analytics: rows not accepted",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Log Analytics: rows not accepted (ingest.rows.short-count). Off: no event and no mail. The step itself still stops, because the rows Log Analytics did not accept are not there.",
|      "purpose": "The safety check that protects the results written to your Log Analytics workspace: Not every row of a result was accepted by Log Analytics, so the run was stopped instead of reporting a partial result as complete.",
|      "effect": "Off: no event and no mail. The step itself still stops, because the rows Log Analytics did not accept are not there. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the results written to your Log Analytics workspace: Not every row of a result was accepted by Log Analytics, so the run was stopped instead of reporting a partial result as complete.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because the rows Log Analytics did not accept are not there.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_IngestRowsShortCount_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because the rows Log Analytics did not accept are not there. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_IngestRowsShortCount_Mail",
|      "label": "Log Analytics: rows not accepted: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guard_IngestRowsShortCount_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Log Analytics: rows not accepted\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_IngestRowsShortCount_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_JobExecutionPreviousRunning_Enabled",
|      "label": "Job started while still running",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Job started while still running (job.execution.previous-running). Off: no event and no mail. The step itself still stops, because two runs of one job never run at the same time.",
|      "purpose": "The safety check that protects a job from running twice at the same time: A job was started while its previous run was still running, so the new run did nothing.",
|      "effect": "Off: no event and no mail. The step itself still stops, because two runs of one job never run at the same time. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects a job from running twice at the same time: A job was started while its previous run was still running, so the new run did nothing.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because two runs of one job never run at the same time.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_JobExecutionPreviousRunning_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because two runs of one job never run at the same time. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_JobExecutionPreviousRunning_Mail",
|      "label": "Job started while still running: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_JobExecutionPreviousRunning_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Job started while still running\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_JobExecutionPreviousRunning_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_JobRunThrottledStuck_Enabled",
|      "label": "Job stuck on throttling",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Job stuck on throttling (job.run.throttled-stuck). Off: no event and no mail when a job is stuck on throttling. Throttled runs are still shown as throttled on the Jobs and Run health pages.",
|      "purpose": "The safety check that protects the data of a job that Microsoft keeps throttling: A job has not completed for a long time, because Microsoft throttled every run of it.",
|      "effect": "Off: no event and no mail when a job is stuck on throttling. Throttled runs are still shown as throttled on the Jobs and Run health pages. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the data of a job that Microsoft keeps throttling: A job has not completed for a long time, because Microsoft throttled every run of it.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail when a job is stuck on throttling. Throttled runs are still shown as throttled on the Jobs and Run health pages.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_JobRunThrottledStuck_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail when a job is stuck on throttling. Throttled runs are still shown as throttled on the Jobs and Run health pages. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_JobRunThrottledStuck_Mail",
|      "label": "Job stuck on throttling: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_JobRunThrottledStuck_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Job stuck on throttling\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_JobRunThrottledStuck_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_LicenceStateGrace_Enabled",
|      "label": "Licence grace period",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Licence grace period (licence.state.grace). Off: no event and no mail during the licence grace period; everything keeps running.",
|      "purpose": "The safety check that protects the SecurityInsight Pro features: The SecurityInsight Pro licence is in its grace period.",
|      "effect": "Off: no event and no mail during the licence grace period; everything keeps running. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the SecurityInsight Pro features: The SecurityInsight Pro licence is in its grace period.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail during the licence grace period; everything keeps running.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_LicenceStateGrace_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail during the licence grace period; everything keeps running. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_LicenceStateGrace_Mail",
|      "label": "Licence grace period: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_LicenceStateGrace_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Licence grace period\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_LicenceStateGrace_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_LicenceStateInvalid_Enabled",
|      "label": "Licence not valid",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Licence not valid (licence.state.invalid). Off: no event and no mail. The step itself still stops, because the licence, not this switch, decides which Pro features run.",
|      "purpose": "The safety check that protects the SecurityInsight Pro features: The SecurityInsight Pro licence does not verify (it has expired or is not valid for this install), so the Pro jobs did not run.",
|      "effect": "Off: no event and no mail. The step itself still stops, because the licence, not this switch, decides which Pro features run. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the SecurityInsight Pro features: The SecurityInsight Pro licence does not verify (it has expired or is not valid for this install), so the Pro jobs did not run.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because the licence, not this switch, decides which Pro features run.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_LicenceStateInvalid_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because the licence, not this switch, decides which Pro features run. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_LicenceStateInvalid_Mail",
|      "label": "Licence not valid: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_LicenceStateInvalid_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Licence not valid\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_LicenceStateInvalid_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_RaBucketCountJump_Enabled",
|      "label": "Risk Analysis: far more buckets than usual",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "Risk Analysis: far more buckets than usual (ra.bucket.count-jump). Off: no event when a report needs far more buckets than usual; the run itself is unchanged.",
|      "purpose": "The safety check that protects the speed and correctness of your Risk Analysis reports: One or more reports needed far more buckets (query slices) than usual.",
|      "effect": "Off: no event when a report needs far more buckets than usual; the run itself is unchanged. On: the check works as described on the Guards page.",
|      "whenToChange": "On by default (owner-approved bucket sizing design): it only warns and never stops a run. Turn it off only if you do not want these warnings.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the speed and correctness of your Risk Analysis reports: One or more reports needed far more buckets (query slices) than usual.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event when a report needs far more buckets than usual; the run itself is unchanged.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "On",
|        "recommended": "Keep it on. Change it when: On by default (owner-approved bucket sizing design): it only warns and never stops a run. Turn it off only if you do not want these warnings.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_RaBucketCountJump_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event when a report needs far more buckets than usual; the run itself is unchanged. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_RaBucketCountJump_Mail",
|      "label": "Risk Analysis: far more buckets than usual: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guard_RaBucketCountJump_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Risk Analysis: far more buckets than usual\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_RaBucketCountJump_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_RaOutputColumnEmptied_Enabled",
|      "label": "Risk Analysis: column emptied",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Risk Analysis: column emptied (ra.output.column-emptied). Off: no event and no mail when a report column lost its content; the report itself is unchanged.",
|      "purpose": "The safety check that protects the completeness of your Risk Analysis reports: One or more report columns are empty (or gone) while they had values in the previous run.",
|      "effect": "Off: no event and no mail when a report column lost its content; the report itself is unchanged. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the completeness of your Risk Analysis reports: One or more report columns are empty (or gone) while they had values in the previous run.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail when a report column lost its content; the report itself is unchanged.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_RaOutputColumnEmptied_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail when a report column lost its content; the report itself is unchanged. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_RaOutputColumnEmptied_Mail",
|      "label": "Risk Analysis: column emptied: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guard_RaOutputColumnEmptied_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Risk Analysis: column emptied\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_RaOutputColumnEmptied_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_RaOutputRowDrop_Enabled",
|      "label": "Risk Analysis: far fewer findings",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Risk Analysis: far fewer findings (ra.output.row-drop). Off: the step goes on as if the check had not tripped -- a report with far fewer findings than the previous run no longer makes the run partial (a failed query or a missing result still does).",
|      "purpose": "The safety check that protects the completeness of your Risk Analysis reports: One or more reports produced far fewer findings than the previous run.",
|      "effect": "Off: the step goes on as if the check had not tripped -- a report with far fewer findings than the previous run no longer makes the run partial (a failed query or a missing result still does). On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects the completeness of your Risk Analysis reports: One or more reports produced far fewer findings than the previous run.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- a report with far fewer findings than the previous run no longer makes the run partial (a failed query or a missing result still does).",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_RaOutputRowDrop_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- a report with far fewer findings than the previous run no longer makes the run partial (a failed query or a missing result still does). Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_RaOutputRowDrop_Mail",
|      "label": "Risk Analysis: far fewer findings: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Data sync and Risk Analysis checks",
|      "needs": "SI_Guard_RaOutputRowDrop_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Risk Analysis: far fewer findings\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_RaOutputRowDrop_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_SchemaGateRefused_Enabled",
|      "label": "Database change that could remove data",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Database change that could remove data (schema.gate.refused). Off: no event and no mail. The step itself still stops, because a database change that could remove data is never applied automatically.",
|      "purpose": "The safety check that protects your SecurityInsight database: A database change was refused because it is not approved for this install, or because it could remove data.",
|      "effect": "Off: no event and no mail. The step itself still stops, because a database change that could remove data is never applied automatically. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects your SecurityInsight database: A database change was refused because it is not approved for this install, or because it could remove data.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because a database change that could remove data is never applied automatically.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_SchemaGateRefused_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because a database change that could remove data is never applied automatically. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_SchemaGateRefused_Mail",
|      "label": "Database change that could remove data: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_SchemaGateRefused_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Database change that could remove data\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_SchemaGateRefused_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_UpdateSchemaFailed_Enabled",
|      "label": "Update: database update failed",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Update: database update failed (update.schema.failed). Off: no event and no mail. The step itself still stops, because the database update failed.",
|      "purpose": "The safety check that protects your SecurityInsight installation from running a new version on an old database: An update stopped before it changed anything, because the new version's database changes could not be applied.",
|      "effect": "Off: no event and no mail. The step itself still stops, because the database update failed. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Other checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects your SecurityInsight installation from running a new version on an old database: An update stopped before it changed anything, because the new version's database changes could not be applied.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because the database update failed.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_UpdateSchemaFailed_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because the database update failed. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_UpdateSchemaFailed_Mail",
|      "label": "Update: database update failed: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Other checks",
|      "needs": "SI_Guard_UpdateSchemaFailed_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Update: database update failed\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_UpdateSchemaFailed_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorCloseCeiling_Enabled",
|      "label": "Vulnerability close limit",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Vulnerability close limit (vuln.connector.close-ceiling). Off: the step goes on as if the check had not tripped -- the vulnerability connector closes every record the run would close, however many; nothing is held for release.",
|      "purpose": "The safety check that protects open vulnerability records: SecurityInsight would have closed far more vulnerability records in one run than it allows, so it closed none.",
|      "effect": "Off: the step goes on as if the check had not tripped -- the vulnerability connector closes every record the run would close, however many; nothing is held for release. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects open vulnerability records: SecurityInsight would have closed far more vulnerability records in one run than it allows, so it closed none.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- the vulnerability connector closes every record the run would close, however many; nothing is held for release.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorCloseCeiling_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- the vulnerability connector closes every record the run would close, however many; nothing is held for release. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorCloseCeiling_Mail",
|      "label": "Vulnerability close limit: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorCloseCeiling_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Vulnerability close limit\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorCloseCeiling_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorCollapse_Enabled",
|      "label": "Vulnerabilities: result far smaller than usual",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Vulnerabilities: result far smaller than usual (vuln.connector.collapse). Off: the step goes on as if the check had not tripped -- a result that lost most of its findings closes the records it no longer reports.",
|      "purpose": "The safety check that protects open vulnerability records: Far fewer of the open vulnerability records are still reported than usual, which looks like a partial collection rather than a real fix, so nothing was closed.",
|      "effect": "Off: the step goes on as if the check had not tripped -- a result that lost most of its findings closes the records it no longer reports. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects open vulnerability records: Far fewer of the open vulnerability records are still reported than usual, which looks like a partial collection rather than a real fix, so nothing was closed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- a result that lost most of its findings closes the records it no longer reports.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorCollapse_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- a result that lost most of its findings closes the records it no longer reports. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorCollapse_Mail",
|      "label": "Vulnerabilities: result far smaller than usual: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorCollapse_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Vulnerabilities: result far smaller than usual\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorCollapse_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorEmptySnapshot_Enabled",
|      "label": "Vulnerabilities: empty result",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Vulnerabilities: empty result (vuln.connector.empty-snapshot). Off: the step goes on as if the check had not tripped -- an EMPTY result closes the open records it no longer reports, so a failed collection can close every open vulnerability.",
|      "purpose": "The safety check that protects open vulnerability records: The newest Risk Analysis results held no vulnerabilities while records are still open, so nothing was closed.",
|      "effect": "Off: the step goes on as if the check had not tripped -- an EMPTY result closes the open records it no longer reports, so a failed collection can close every open vulnerability. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects open vulnerability records: The newest Risk Analysis results held no vulnerabilities while records are still open, so nothing was closed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- an EMPTY result closes the open records it no longer reports, so a failed collection can close every open vulnerability.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorEmptySnapshot_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- an EMPTY result closes the open records it no longer reports, so a failed collection can close every open vulnerability. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorEmptySnapshot_Mail",
|      "label": "Vulnerabilities: empty result: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorEmptySnapshot_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Vulnerabilities: empty result\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorEmptySnapshot_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorRefused_Enabled",
|      "label": "Vulnerabilities: connector not set up",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Vulnerabilities: connector not set up (vuln.connector.refused). Off: no event and no mail. The step itself still stops, because the connector is not set up completely and cannot run.",
|      "purpose": "The safety check that protects your vulnerability target: A vulnerability connector is not set up completely, so it did not run.",
|      "effect": "Off: no event and no mail. The step itself still stops, because the connector is not set up completely and cannot run. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects your vulnerability target: A vulnerability connector is not set up completely, so it did not run.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because the connector is not set up completely and cannot run.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorRefused_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because the connector is not set up completely and cannot run. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorRefused_Mail",
|      "label": "Vulnerabilities: connector not set up: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorRefused_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Vulnerabilities: connector not set up\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorRefused_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorRunIncomplete_Enabled",
|      "label": "Vulnerabilities: Risk Analysis run not finished",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Vulnerabilities: Risk Analysis run not finished (vuln.connector.run-incomplete). Off: the step goes on as if the check had not tripped -- records are closed even when the Risk Analysis run behind the results did not finish cleanly.",
|      "purpose": "The safety check that protects open vulnerability records: The Risk Analysis run behind these results did not finish cleanly, so nothing was closed.",
|      "effect": "Off: the step goes on as if the check had not tripped -- records are closed even when the Risk Analysis run behind the results did not finish cleanly. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects open vulnerability records: The Risk Analysis run behind these results did not finish cleanly, so nothing was closed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- records are closed even when the Risk Analysis run behind the results did not finish cleanly.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorRunIncomplete_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- records are closed even when the Risk Analysis run behind the results did not finish cleanly. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorRunIncomplete_Mail",
|      "label": "Vulnerabilities: Risk Analysis run not finished: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorRunIncomplete_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Vulnerabilities: Risk Analysis run not finished\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorRunIncomplete_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorScopeChanged_Enabled",
|      "label": "Vulnerabilities: scope changed",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Vulnerabilities: scope changed (vuln.connector.scope-changed). Off: the step goes on as if the check had not tripped -- records that dropped out of the collection scope are closed like any other absent record.",
|      "purpose": "The safety check that protects open vulnerability records: The scope of the collection changed, so records that dropped out of it were not closed.",
|      "effect": "Off: the step goes on as if the check had not tripped -- records that dropped out of the collection scope are closed like any other absent record. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects open vulnerability records: The scope of the collection changed, so records that dropped out of it were not closed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- records that dropped out of the collection scope are closed like any other absent record.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorScopeChanged_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- records that dropped out of the collection scope are closed like any other absent record. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorScopeChanged_Mail",
|      "label": "Vulnerabilities: scope changed: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorScopeChanged_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Vulnerabilities: scope changed\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorScopeChanged_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorSnapshotIncomplete_Enabled",
|      "label": "Vulnerabilities: results not known to be complete",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Vulnerabilities: results not known to be complete (vuln.connector.snapshot-incomplete). Off: the step goes on as if the check had not tripped -- absences are counted and records closed even when the newest results are not known to be complete.",
|      "purpose": "The safety check that protects open vulnerability records: The newest Risk Analysis results are not known to be complete, so findings were opened and updated but nothing was closed.",
|      "effect": "Off: the step goes on as if the check had not tripped -- absences are counted and records closed even when the newest results are not known to be complete. On: the check works as described on the Guards page.",
|      "whenToChange": "Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects open vulnerability records: The newest Risk Analysis results are not known to be complete, so findings were opened and updated but nothing was closed.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "the step goes on as if the check had not tripped -- absences are counted and records closed even when the newest results are not known to be complete.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "Off",
|        "recommended": "Keep the default (off) unless you want this check to hold or stop the step. Change it when: Off by default: only the two brakes stay on (CIs retired by mistake, duplicate vulnerability records) -- this check is a warning you can switch on. Turn it on when you want it to hold or stop the step, and mail, again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorSnapshotIncomplete_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the step goes on as if the check had not tripped -- absences are counted and records closed even when the newest results are not known to be complete. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorSnapshotIncomplete_Mail",
|      "label": "Vulnerabilities: results not known to be complete: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorSnapshotIncomplete_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Vulnerabilities: results not known to be complete\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorSnapshotIncomplete_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorTargetIncomplete_Enabled",
|      "label": "Vulnerabilities: target not read in full",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "Vulnerabilities: target not read in full (vuln.connector.target-incomplete). Off: no event and no mail. The step itself still stops, because writing after a partial read of the target would open every record the read missed again as a duplicate.",
|      "purpose": "The safety check that protects your vulnerability target from duplicate records: The vulnerability target (for example the ServiceNow table) could not be read in full, so nothing was written: every record the read missed would have been opened again as a duplicate.",
|      "effect": "Off: no event and no mail. The step itself still stops, because writing after a partial read of the target would open every record the read missed again as a duplicate. On: the check works as described on the Guards page.",
|      "whenToChange": "Leave it on. Turn it off only when this check keeps stopping work you know is right -- read what Off means first.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guards_Enabled",
|      "info": {
|        "what": "The safety check that protects your vulnerability target from duplicate records: The vulnerability target (for example the ServiceNow table) could not be read in full, so nothing was written: every record the read missed would have been opened again as a duplicate.",
|        "whenOn": "the check works as described on the Guards page.",
|        "whenOff": "no event and no mail. The step itself still stops, because writing after a partial read of the target would open every record the read missed again as a duplicate.",
|        "risk": "Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Works only while \"All guards (safety checks)\" is on.",
|        "default": "On",
|        "recommended": "Keep it on. Change it when: Leave it on. Turn it off only when this check keeps stopping work you know is right -- read what Off means first.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorTargetIncomplete_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "no event and no mail. The step itself still stops, because writing after a partial read of the target would open every record the read missed again as a duplicate. Turning this check off removes a protection: when its condition happens, nothing holds or stops the step and no event is raised. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_Guard_VulnConnectorTargetIncomplete_Mail",
|      "label": "Vulnerabilities: target not read in full: mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On (follows the check: nothing is mailed while the check is off)",
|      "description": "Its mail: off = the event is still shown on the Guards page, but not mailed.",
|      "purpose": "Whether this safety check sends a mail when it trips.",
|      "effect": "Off: the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|      "whenToChange": "Turn it off for a check whose mails you do not need, instead of turning the check off.",
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorTargetIncomplete_Enabled",
|      "info": {
|        "what": "Whether this safety check sends a mail when it trips.",
|        "whenOn": "(follows the check: nothing is mailed while the check is off)",
|        "whenOff": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check.",
|        "risk": "Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Works only while \"Vulnerabilities: target not read in full\" is on.",
|        "default": "On (follows the check: nothing is mailed while the check is off)",
|        "recommended": "Keep the default. Change it when: Turn it off for a check whose mails you do not need, instead of turning the check off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guard_VulnConnectorTargetIncomplete_Mail/",
|        "confirmWhen": "off",
|        "confirm": "the event is still shown on the Guards page and kept in run health and the audit trail, but no mail is sent for it. The install-wide switch \"Mail when a safety check stops a step\" still applies to every check. Low: no data is changed and the check still works; only its mail stops, so a trip is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_GuardMail_Enabled",
|      "label": "Mail when a safety check stops a step",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "When SecurityInsight holds, refuses or stops a step to protect your data (for example the vulnerability connector refusing to close far more records than usual), it mails the people below -- at most once a day per guard while it keeps happening. On by default.",
|      "purpose": "Mails a person when a safety check holds, refuses or stops a step to protect your data -- for example when far more vulnerabilities would close than usual.",
|      "effect": "Off sends no such mail: the event is still recorded in run health, on the Guards page of the Pro web app and in the audit trail, and still reported to Invardia when status reports are on. While a check keeps tripping, at most one mail a day is sent, saying how many times it happened.",
|      "whenToChange": "Leave it on. Turn it off only if another system already watches these events for you.",
|      "card": "Safety-check mails",
|      "info": {
|        "what": "Mails a person when a safety check holds, refuses or stops a step to protect your data -- for example when far more vulnerabilities would close than usual.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "Off sends no such mail: the event is still recorded in run health, on the Guards page of the Pro web app and in the audit trail, and still reported to Invardia when status reports are on. While a check keeps tripping, at most one mail a day is sent, saying how many times it happened.",
|        "risk": "No check mails anyone any more: a held or stopped step is seen only on the Guards page, in run health and in the audit trail. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "On",
|        "recommended": "Keep it on. Change it when: Leave it on. Turn it off only if another system already watches these events for you.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_GuardMail_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "Off sends no such mail: the event is still recorded in run health, on the Guards page of the Pro web app and in the audit trail, and still reported to Invardia when status reports are on. While a check keeps tripping, at most one mail a day is sent, saying how many times it happened. No check mails anyone any more: a held or stopped step is seen only on the Guards page, in run health and in the audit trail. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_GuardMail_To",
|      "label": "Safety-check mail recipients",
|      "group": "Mail & notifications",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "The report recipients (MailTo); without those, the SecurityInsight Pro SuperAdmins whose sign-in name is a mail address",
|      "description": "Who gets them. Default: the report recipients (MailTo), else the SecurityInsight Pro SuperAdmins.",
|      "purpose": "The addresses that receive the mail when a safety check holds, refuses or stops a step.",
|      "effect": "These addresses get the mails instead of the report recipients.",
|      "whenToChange": "Set it to the team that runs SecurityInsight day to day, when that is not the team that reads the reports.",
|      "card": "Safety-check mails",
|      "hint": "Empty: the default recipients, else the SuperAdmins.",
|      "needs": "SI_GuardMail_Enabled",
|      "itemFormat": "email",
|      "info": {
|        "what": "The addresses that receive the mail when a safety check holds, refuses or stops a step.",
|        "whenChanged": "These addresses get the mails instead of the report recipients.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"Mail when a safety check stops a step\" is on.",
|        "default": "The report recipients (MailTo); without those, the SecurityInsight Pro SuperAdmins whose sign-in name is a mail address",
|        "recommended": "Keep the default. Change it when: Set it to the team that runs SecurityInsight day to day, when that is not the team that reads the reports.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_GuardMail_To/"
|      }
|    },
|    {
|      "name": "SI_Guards_Enabled",
|      "label": "All guards (safety checks)",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "Every safety check can be turned on or off, and its mail turned off (Pro: Settings > Guards). Since the guard relief (2026-10-11) only the two brakes are ON by default: CIs retired by mistake (cmdb.sql.collapse, cmdb.handoff.mass-change) and duplicate vulnerability records (vuln.connector.target-incomplete); every other check is OFF until you switch it on (the examples below show the switch, not the default -- the glossary at the end says each default). Off = the check does not hold, refuse or stop: it says so once in the job log and the step goes on (config\\guard-catalog .locked.json 'whenOff' says what that means per check). WARNING: SecurityInsight then acts on data that may be broken. All checks at once:",
|      "purpose": "One switch for every safety check that holds, refuses or stops a step to protect your data (the list below and the Guards page).",
|      "effect": "WARNING -- Off turns EVERY safety check off at once: SecurityInsight then closes vulnerability records, retires CIs, hands over batches and loads collections even when the data looks broken or incomplete, so a failed collection can close or retire everything it no longer sees. Nothing is held for release and no guard mail is sent; each check says once in its job log that it is off. The checks that only report a stop SecurityInsight cannot skip (the source failed, the licence) stop reporting it. On: every check works as set below.",
|      "whenToChange": "Leave it on. Turn it off only for a short time, when the checks stop work you know is right -- and prefer turning off or tuning the one check that is in the way.",
|      "card": "Guards (safety checks)",
|      "hint": "Off = every check below is off.",
|      "info": {
|        "what": "One switch for every safety check that holds, refuses or stops a step to protect your data (the list below and the Guards page).",
|        "whenOn": "every check works as set below.",
|        "whenOff": "WARNING -- Off turns EVERY safety check off at once: SecurityInsight then closes vulnerability records, retires CIs, hands over batches and loads collections even when the data looks broken or incomplete, so a failed collection can close or retire everything it no longer sees. Nothing is held for release and no guard mail is sent; each check says once in its job log that it is off. The checks that only report a stop SecurityInsight cannot skip (the source failed, the licence) stop reporting it. On: every check works as set below.",
|        "risk": "Turning this off removes EVERY safety check at once: no step is held or stopped to protect your data, whatever happens. Reversible at once: switch it back on; it applies from the next run.",
|        "requires": "Nothing else.",
|        "default": "On",
|        "recommended": "Keep it on. Change it when: Leave it on. Turn it off only for a short time, when the checks stop work you know is right -- and prefer turning off or tuning the one check that is in the way.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Guards_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "WARNING -- Off turns EVERY safety check off at once: SecurityInsight then closes vulnerability records, retires CIs, hands over batches and loads collections even when the data looks broken or incomplete, so a failed collection can close or retire everything it no longer sees. Nothing is held for release and no guard mail is sent; each check says once in its job log that it is off. The checks that only report a stop SecurityInsight cannot skip (the source failed, the licence) stop reporting it. On: every check works as set below. Turning this off removes EVERY safety check at once: no step is held or stopped to protect your data, whatever happens. Reversible at once: switch it back on; it applies from the next run."
|      }
|    },
|    {
|      "name": "SI_HasExposureGraphInLA",
|      "label": "Exposure graph available in workspace",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: reports needing exposure graph tables are skipped",
|      "description": "set when ExposureGraph is mirrored to LA (Sentinel data lake); enables RA queries that need EG tables",
|      "purpose": "Tells Risk Analysis that Defender exposure graph tables are mirrored into Log Analytics, so reports needing them can run.",
|      "effect": "On, Risk Analysis runs the reports that query exposure graph tables in the workspace. Turning it on without the tables present makes those reports fail.",
|      "whenToChange": "Turn on after enabling exposure graph table mirroring to Log Analytics.",
|      "card": "Sources and links",
|      "info": {
|        "what": "Tells Risk Analysis that Defender exposure graph tables are mirrored into Log Analytics, so reports needing them can run.",
|        "whenOn": "On, Risk Analysis runs the reports that query exposure graph tables in the workspace. Turning it on without the tables present makes those reports fail.",
|        "whenOff": "reports needing exposure graph tables are skipped",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Off: reports needing exposure graph tables are skipped",
|        "recommended": "Keep the default. Change it when: Turn on after enabling exposure graph table mirroring to Log Analytics.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_HasExposureGraphInLA/"
|      }
|    },
|    {
|      "name": "SI_Identity_DcrName",
|      "label": "Identity data collection rule name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The standard name, dcr-si-identity-profile (from the naming pattern)",
|      "description": "Overrides the data collection rule name the identity profiling engine ingests through; when empty, the standard naming pattern is used.",
|      "purpose": "The name of the data collection rule the identity engine sends its rows through to Log Analytics.",
|      "effect": "Rows are sent through the named rule. A name that does not match an existing or creatable rule makes the identity ingest fail.",
|      "whenToChange": "Only if you renamed the rule or must avoid a name clash with another install.",
|      "info": {
|        "what": "The name of the data collection rule the identity engine sends its rows through to Log Analytics.",
|        "whenChanged": "Rows are sent through the named rule. A name that does not match an existing or creatable rule makes the identity ingest fail.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "The standard name, dcr-si-identity-profile (from the naming pattern)",
|        "recommended": "Keep the default. Change it when: Only if you renamed the rule or must avoid a name clash with another install.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Identity_DcrName/"
|      }
|    },
|    {
|      "name": "SI_Identity_SignInMethodsFillMinutes",
|      "label": "Users' sign-in methods: background reading per slice (minutes)",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 8,
|      "defaultText": "8 minutes",
|      "description": "minutes of background reading per 15-minute run",
|      "purpose": "How many minutes of each 15-minute run of its own job (caj-si-signin-methods) the background read of the users' sign-in methods may use.",
|      "effect": "More minutes fill the detail sooner (about 250-300 users a minute, depending on how much Microsoft throttles); fewer leave more of the tick idle. A slice that is still running is never started twice.",
|      "whenToChange": "Raise it to fill a large tenant faster the first time; lower it to keep the job's runs short.",
|      "unit": "minutes",
|      "min": 1,
|      "max": 25,
|      "card": "Users' sign-in methods in full",
|      "needs": "SI_Identity_SignInMethodsPerUser",
|      "info": {
|        "what": "How many minutes of each 15-minute run of its own job (caj-si-signin-methods) the background read of the users' sign-in methods may use.",
|        "whenChanged": "More minutes fill the detail sooner (about 250-300 users a minute, depending on how much Microsoft throttles); fewer leave more of the tick idle. A slice that is still running is never started twice.",
|        "risk": "More minutes make each run of the job caj-si-signin-methods longer (its limit is 30 minutes); fewer fill the detail more slowly. Nothing collected is changed. Reversible at once.",
|        "requires": "SI_Identity_SignInMethodsPerUser all or privileged. Works only while \"Users' sign-in methods in full: which users are read\" is on.",
|        "default": "8 minutes",
|        "recommended": "8 minutes (the default).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Identity_SignInMethodsFillMinutes/"
|      }
|    },
|    {
|      "name": "SI_Identity_SignInMethodsMaxAgeDays",
|      "label": "Users' sign-in methods: read again after (days)",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 90,
|      "defaultText": "90 days",
|      "description": "read again at the latest after this many days",
|      "purpose": "How old a user's full sign-in method detail may get before the background read reads that user again, even when the registration report says nothing changed (it also catches changes the report does not show, such as a renamed device).",
|      "effect": "Lower: details are fresher, and more of each 15-minute slice goes to reading users again (at 150,000 users and 90 days, about 1,700 users a day). Higher: fewer reads. A user whose registered methods changed is read again at once, whatever this is.",
|      "whenToChange": "Lower it when you rely on the device names and app versions being recent; raise it on a very large tenant.",
|      "unit": "days",
|      "min": 1,
|      "max": 365,
|      "card": "Users' sign-in methods in full",
|      "needs": "SI_Identity_SignInMethodsPerUser",
|      "info": {
|        "what": "How old a user's full sign-in method detail may get before the background read reads that user again, even when the registration report says nothing changed (it also catches changes the report does not show, such as a renamed device).",
|        "whenChanged": "Lower: details are fresher, and more of each 15-minute slice goes to reading users again (at 150,000 users and 90 days, about 1,700 users a day). Higher: fewer reads. A user whose registered methods changed is read again at once, whatever this is.",
|        "risk": "A long age keeps details such as device names and app versions older; a short one spends more of the background reading on users that did not change. No data is lost either way. Reversible at once.",
|        "requires": "SI_Identity_SignInMethodsPerUser all or privileged. Works only while \"Users' sign-in methods in full: which users are read\" is on.",
|        "default": "90 days",
|        "recommended": "90 days (the default).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Identity_SignInMethodsMaxAgeDays/"
|      }
|    },
|    {
|      "name": "SI_Identity_SignInMethodsPerUser",
|      "label": "Users' sign-in methods in full: which users are read",
|      "group": "Collection scope & limits",
|      "type": "enum",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": "all",
|      "defaultText": "All: every member user is read in the background, privileged users first",
|      "description": "The users' sign-in methods in full -- every method with its details (phone, e-mail, Authenticator app, FIDO2 key, Windows Hello ...) and the device a Windows Hello or Authenticator key lives on -- need one read per user, which Microsoft throttles: about 8-9 hours at 150,000 users. The collections never wait for it: its own job (caj-si-signin-methods) reads users in the background, privileged users first, a slice every 15 minutes, and the next collection shows what was read with its date. Not read yet = unknown, never no. 'privileged' and 'off' are faster to fill but leave the other users' per-user facts unknown; the tenant-wide registration report (MFA, SSPR, passwordless capable, registered methods) is read for everyone.",
|      "purpose": "Which users get their sign-in methods read in full: every method with its details (phone number and type, e-mail address, Microsoft Authenticator app and version, FIDO2 key or passkey model and attestation, Windows Hello key strength, Temporary Access Pass) and, for a Windows Hello or Microsoft Authenticator key, the device it lives on (name, operating system, compliant, managed) linked to that device's CI. It also decides whether a user has a password and signs in passwordless only. This needs one read per user, which Microsoft throttles, so it runs in the background: a slice every 15 minutes in its own job (caj-si-signin-methods), privileged users first, then users whose methods changed, then users never read, then the oldest. Collections never wait for it; each collection shows what was read, with the date it was read. The tenant-wide registration report (MFA registered and capable, passwordless capable, self-service password reset, the registered and preferred methods) is read for every user on every collection, whatever this setting is.",
|      "effect": "All: every member user. At 150,000 users the first full read takes about 8-9 hours of reading, spread through the day (about 2,000 users per 15-minute slice); after that only users whose methods changed, and each user again after the maximum age. Until a user is read, its per-user facts (each method's details and device, password present, passwordless only) show as unknown, never as no. Privileged: only users with an Entra role (permanent or eligible, also through a group), an Azure role, or marked admin -- a few minutes on any tenant; every other user keeps those facts unknown. Off: no per-user read at all; only the registration report's facts, and the per-user facts are unknown for everyone. Changing it takes effect at the next 15-minute slice and the next collection.",
|      "whenToChange": "Choose privileged when you only need the full detail for your admins and want it filled quickly; choose off only when you do not want SecurityInsight to read each user's sign-in methods.",
|      "values": [
|        "all",
|        "privileged",
|        "off"
|      ],
|      "valueLabels": {
|        "all": "All member users (privileged first) -- the full detail, filled in the background",
|        "privileged": "Privileged users only -- fast; other users' per-user facts stay unknown",
|        "off": "Off -- the tenant-wide registration report only; per-user facts unknown"
|      },
|      "card": "Users' sign-in methods in full",
|      "info": {
|        "what": "Which users get their sign-in methods read in full: every method with its details (phone number and type, e-mail address, Microsoft Authenticator app and version, FIDO2 key or passkey model and attestation, Windows Hello key strength, Temporary Access Pass) and, for a Windows Hello or Microsoft Authenticator key, the device it lives on (name, operating system, compliant, managed) linked to that device's CI. It also decides whether a user has a password and signs in passwordless only. This needs one read per user, which Microsoft throttles, so it runs in the background: a slice every 15 minutes in its own job (caj-si-signin-methods), privileged users first, then users whose methods changed, then users never read, then the oldest. Collections never wait for it; each collection shows what was read, with the date it was read. The tenant-wide registration report (MFA registered and capable, passwordless capable, self-service password reset, the registered and preferred methods) is read for every user on every collection, whatever this setting is.",
|        "whenChanged": "All: every member user. At 150,000 users the first full read takes about 8-9 hours of reading, spread through the day (about 2,000 users per 15-minute slice); after that only users whose methods changed, and each user again after the maximum age. Until a user is read, its per-user facts (each method's details and device, password present, passwordless only) show as unknown, never as no. Privileged: only users with an Entra role (permanent or eligible, also through a group), an Azure role, or marked admin -- a few minutes on any tenant; every other user keeps those facts unknown. Off: no per-user read at all; only the registration report's facts, and the per-user facts are unknown for everyone. Changing it takes effect at the next 15-minute slice and the next collection.",
|        "risk": "All reads every member user's sign-in methods one by one in the background: on a large tenant the first full read takes 8-9 hours of reading spread over the day, and the users not read yet show unknown, never no. Privileged and off leave every other user's per-user facts (each method's details and device, password present, passwordless only) unknown, so reports cannot say who still has a password or which devices hold sign-in keys. No collection waits for it either way. Reversible: change it back; the next slices read again.",
|        "requires": "The Microsoft Graph application permission UserAuthenticationMethod.Read.All for the collection identity (the setup grants it), and the install's database.",
|        "default": "All: every member user is read in the background, privileged users first",
|        "recommended": "All (the default).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Identity_SignInMethodsPerUser/"
|      }
|    },
|    {
|      "name": "SI_Identity_SkipDeletedGroups",
|      "label": "Exposure Graph: no asset for groups Entra ID no longer has",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": true,
|      "defaultText": "On: a group becomes an asset only while Entra ID still has it",
|      "description": "groups: only those Entra ID still has (active or recently deleted) become assets",
|      "purpose": "A customer's choice for groups the Exposure Graph still lists although Entra ID no longer has them (neither active nor in its deleted items). On, only groups that still exist in Entra ID (active or recently deleted) become assets. The others are counted and get no asset.",
|      "effect": "Stages: the identity collection reads the ids of Entra ID's groups and deleted groups once per run and records no asset for an Exposure Graph group with an Entra object id that Entra ID does not return; the run log and the Data health page show how many per run; the CI build retires the existing CI of such a group at once, with a reason naming this setting. A run whose Entra ID group read is not complete decides nothing: groups keep their last state. On-premises groups that were never synced, users, devices and findings are not affected. Off again, the next run records them again and their CIs come back.",
|      "whenToChange": "Turn it off only when your organisation wants every group the Exposure Graph lists as an asset, also groups Entra ID no longer has.",
|      "card": "Exposure Graph identities without an asset",
|      "info": {
|        "what": "A customer's choice for groups the Exposure Graph still lists although Entra ID no longer has them (neither active nor in its deleted items). On, only groups that still exist in Entra ID (active or recently deleted) become assets. The others are counted and get no asset.",
|        "whenOn": "a group becomes an asset only while Entra ID still has it",
|        "whenOff": "Stages: the identity collection reads the ids of Entra ID's groups and deleted groups once per run and records no asset for an Exposure Graph group with an Entra object id that Entra ID does not return; the run log and the Data health page show how many per run; the CI build retires the existing CI of such a group at once, with a reason naming this setting. A run whose Entra ID group read is not complete decides nothing: groups keep their last state. On-premises groups that were never synced, users, devices and findings are not affected. Off again, the next run records them again and their CIs come back.",
|        "risk": "Groups the customer chose not to keep stop being assets from the next run and their CIs retire (CMDB / ServiceNow closures follow the retired CIs). A run whose Entra ID group read is not complete changes nothing. Reversible: turn it off and the next run records them again and their CIs come back.",
|        "requires": "The identity collection with the Exposure Graph, and read access to Entra ID groups (Group.Read.All or Directory.Read.All, which the engine identity already has).",
|        "default": "On: a group becomes an asset only while Entra ID still has it",
|        "recommended": "On (the default). Off only when your organisation wants these objects as assets.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Identity_SkipDeletedGroups/",
|        "confirmWhen": "on",
|        "confirm": "Groups the Exposure Graph lists that Entra ID no longer has (neither active nor in its deleted items) stop being assets from the next run; their existing CIs retire at once with this setting as the reason."
|      }
|    },
|    {
|      "name": "SI_Identity_SkipNeverSyncedAd",
|      "label": "Exposure Graph: no asset for never-synced AD accounts that are not privileged",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: never-synced on-premises AD accounts are decided by SI_Identity_SkipNeverSyncedDisabledAd (only disabled, non-privileged ones are left out)",
|      "description": "off by default; on: on-prem AD accounts never synced to Entra become assets only while privileged",
|      "purpose": "A customer's choice for on-premises Active Directory accounts that the Exposure Graph lists but that were never synced to Entra ID (no Entra object id). On, only the privileged ones become assets, whether they are enabled or disabled: privileged = an admin count, a critical or tier 0/1 AD group (Domain Admins, Enterprise Admins ...), an assigned role, a service account, a sensitive account or a Microsoft criticality level. The others are counted and get no asset. It is the wider form of SI_Identity_SkipNeverSyncedDisabledAd: while it is on, that setting decides nothing.",
|      "effect": "Stages: the identity collection records no asset for a never-synced AD account that is not privileged, whatever its enabled state (the Exposure Graph often lists such accounts with their name only); the run log and the Data health page show how many per run; the CI build retires the existing CI of such an account at once, with a reason naming this setting (its findings close as asset retired, never as fixed). Only on-premises AD accounts are affected (a domain SID, or an account name and domain): accounts synced to Entra ID, identities from other sources, groups, devices and findings are not. Off, SI_Identity_SkipNeverSyncedDisabledAd decides these accounts again (only disabled ones are left out), and the next run records the others again and their CIs come back.",
|      "whenToChange": "Off by default. Turn it on only for a tenant with very many on-premises AD accounts that never sync to Entra ID (hundreds of thousands), where they would otherwise become assets that nobody manages; with a few of them, keep it off so they stay assets.",
|      "card": "Exposure Graph identities without an asset",
|      "info": {
|        "what": "A customer's choice for on-premises Active Directory accounts that the Exposure Graph lists but that were never synced to Entra ID (no Entra object id). On, only the privileged ones become assets, whether they are enabled or disabled: privileged = an admin count, a critical or tier 0/1 AD group (Domain Admins, Enterprise Admins ...), an assigned role, a service account, a sensitive account or a Microsoft criticality level. The others are counted and get no asset. It is the wider form of SI_Identity_SkipNeverSyncedDisabledAd: while it is on, that setting decides nothing.",
|        "whenOn": "Stages: the identity collection records no asset for a never-synced AD account that is not privileged, whatever its enabled state (the Exposure Graph often lists such accounts with their name only); the run log and the Data health page show how many per run; the CI build retires the existing CI of such an account at once, with a reason naming this setting (its findings close as asset retired, never as fixed). Only on-premises AD accounts are affected (a domain SID, or an account name and domain): accounts synced to Entra ID, identities from other sources, groups, devices and findings are not. Off, SI_Identity_SkipNeverSyncedDisabledAd decides these accounts again (only disabled ones are left out), and the next run records the others again and their CIs come back.",
|        "whenOff": "never-synced on-premises AD accounts are decided by SI_Identity_SkipNeverSyncedDisabledAd (only disabled, non-privileged ones are left out)",
|        "risk": "Objects the customer chose not to keep stop being assets from the next run and their CIs retire (CMDB / ServiceNow closures follow the retired CIs). Accounts synced to Entra ID, identities from other sources, groups, devices and findings are not affected. Reversible: turn it off and the next run records them again and their CIs come back.",
|        "requires": "The identity collection with the Exposure Graph (Defender XDR advanced hunting).",
|        "default": "Off: never-synced on-premises AD accounts are decided by SI_Identity_SkipNeverSyncedDisabledAd (only disabled, non-privileged ones are left out)",
|        "recommended": "Off (the default). On only for a tenant with very many on-premises AD accounts that never sync to Entra ID.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Identity_SkipNeverSyncedAd/",
|        "confirmWhen": "on",
|        "confirm": "On-premises AD accounts the Exposure Graph lists that were never synced to Entra ID and are not privileged stop being assets from the next run, enabled or not; their existing CIs retire at once with this setting as the reason, and their findings close as asset retired."
|      }
|    },
|    {
|      "name": "SI_Identity_SkipNeverSyncedDisabledAd",
|      "label": "Exposure Graph: no asset for never-synced, disabled AD accounts",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": true,
|      "defaultText": "On: a never-synced on-premises AD account becomes an asset only while it is enabled or privileged",
|      "description": "on-prem AD accounts never synced to Entra: only enabled or privileged ones become assets",
|      "purpose": "A customer's choice for on-premises Active Directory accounts that the Exposure Graph lists but that were never synced to Entra ID (no Entra object id). On, only the enabled or privileged ones become assets: privileged = an admin count, a critical or tier 0/1 AD group (Domain Admins, Enterprise Admins ...), an assigned role, a service account, a sensitive account or a Microsoft criticality level. The others are counted and get no asset.",
|      "effect": "Stages: the identity collection records no asset for a never-synced AD account that is disabled and not privileged; the run log and the Data health page show how many per run; the CI build retires the existing CI of such an account at once, with a reason naming this setting (its findings close as asset retired, never as fixed). Disabled = the account says so itself (accountEnabled false, or the disabled flag of userAccountControl); an account that does not say is kept. Accounts synced to Entra ID, groups, devices and findings are not affected. Off again, the next run records them again and their CIs come back.",
|      "whenToChange": "Turn it off only when your organisation wants every on-premises AD account the Exposure Graph lists as an asset, also the disabled ones that never reached Entra ID.",
|      "card": "Exposure Graph identities without an asset",
|      "info": {
|        "what": "A customer's choice for on-premises Active Directory accounts that the Exposure Graph lists but that were never synced to Entra ID (no Entra object id). On, only the enabled or privileged ones become assets: privileged = an admin count, a critical or tier 0/1 AD group (Domain Admins, Enterprise Admins ...), an assigned role, a service account, a sensitive account or a Microsoft criticality level. The others are counted and get no asset.",
|        "whenOn": "a never-synced on-premises AD account becomes an asset only while it is enabled or privileged",
|        "whenOff": "Stages: the identity collection records no asset for a never-synced AD account that is disabled and not privileged; the run log and the Data health page show how many per run; the CI build retires the existing CI of such an account at once, with a reason naming this setting (its findings close as asset retired, never as fixed). Disabled = the account says so itself (accountEnabled false, or the disabled flag of userAccountControl); an account that does not say is kept. Accounts synced to Entra ID, groups, devices and findings are not affected. Off again, the next run records them again and their CIs come back.",
|        "risk": "Objects the customer chose not to keep stop being assets from the next run and their CIs retire (CMDB / ServiceNow closures follow the retired CIs). Accounts synced to Entra ID, groups, devices and findings are not affected. Reversible: turn it off and the next run records them again and their CIs come back.",
|        "requires": "The identity collection with the Exposure Graph (Defender XDR advanced hunting).",
|        "default": "On: a never-synced on-premises AD account becomes an asset only while it is enabled or privileged",
|        "recommended": "On (the default). Off only when your organisation wants these objects as assets.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Identity_SkipNeverSyncedDisabledAd/",
|        "confirmWhen": "on",
|        "confirm": "On-premises AD accounts the Exposure Graph lists that were never synced to Entra ID, are disabled and are not privileged stop being assets from the next run; their existing CIs retire at once with this setting as the reason, and their findings close as asset retired."
|      }
|    },
|    {
|      "name": "SI_Identity_TableName",
|      "label": "Identity table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The standard table, SI_Identity_Profile_CL",
|      "description": "Overrides the Log Analytics table the identity profiling engine writes to; when empty, the standard SI_Identity_Profile table is used.",
|      "purpose": "The Log Analytics table the identity engine writes its rows to.",
|      "effect": "Rows go to the named table instead. Reports, queries and dashboards that read the standard table then no longer see new identity data.",
|      "whenToChange": "Only if you renamed the destination table.",
|      "info": {
|        "what": "The Log Analytics table the identity engine writes its rows to.",
|        "whenChanged": "Rows go to the named table instead. Reports, queries and dashboards that read the standard table then no longer see new identity data.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "The standard table, SI_Identity_Profile_CL",
|        "recommended": "Keep the default. Change it when: Only if you renamed the destination table.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Identity_TableName/"
|      }
|    },
|    {
|      "name": "SI_IncludeFirstPartySpns",
|      "label": "Include Microsoft service principals",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On: Microsoft service principals are included.",
|      "description": "Include 1st-party Microsoft service principals in discovery. Default $true (preview.87+; was opt-in in earlier previews -- noisier but more complete).",
|      "purpose": "Whether the identity engine includes Microsoft's own built-in service principals in its inventory.",
|      "effect": "Turning it off drops the hundreds of Microsoft-published service principals, giving a smaller, less noisy inventory, but privileged ones among them are no longer reported.",
|      "whenToChange": "Turn off if Microsoft service principals add noise you do not want in reports.",
|      "card": "Which assets are included",
|      "info": {
|        "what": "Whether the identity engine includes Microsoft's own built-in service principals in its inventory.",
|        "whenOn": "Microsoft service principals are included.",
|        "whenOff": "Turning it off drops the hundreds of Microsoft-published service principals, giving a smaller, less noisy inventory, but privileged ones among them are no longer reported.",
|        "risk": "Microsoft-published service principals are left out -- including privileged ones, whose exposure then disappears from the reports. Reversible: the next run includes them again.",
|        "requires": "Nothing else.",
|        "default": "On: Microsoft service principals are included.",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_IncludeFirstPartySpns/",
|        "confirmWhen": "off",
|        "confirm": "Turning it off drops the hundreds of Microsoft-published service principals, giving a smaller, less noisy inventory, but privileged ones among them are no longer reported. Microsoft-published service principals are left out -- including privileged ones, whose exposure then disappears from the reports. Reversible: the next run includes them again."
|      }
|    },
|    {
|      "name": "SI_IncludeInactive_Endpoint",
|      "label": "Include inactive endpoints",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: devices not seen by any source within the stale-days window are left out",
|      "description": "--- Asset filters: these DROP ROWS from the output ------------------------ The engine filters inactive/stale assets by default and reports how many it dropped. These change that decision.",
|      "purpose": "Turns off the filter that leaves out stale or offboarded devices, so every known device is published.",
|      "effect": "On publishes every device, including stale registrations and offboarded machines: more rows, more ingested data, and more noise in reports. Useful when cleaning up stale devices.",
|      "whenToChange": "When you want to find and clean up stale or ghost devices.",
|      "card": "Which assets are included",
|      "info": {
|        "what": "Turns off the filter that leaves out stale or offboarded devices, so every known device is published.",
|        "whenOn": "On publishes every device, including stale registrations and offboarded machines: more rows, more ingested data, and more noise in reports. Useful when cleaning up stale devices.",
|        "whenOff": "devices not seen by any source within the stale-days window are left out",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "Off: devices not seen by any source within the stale-days window are left out",
|        "recommended": "Keep the default. Change it when: When you want to find and clean up stale or ghost devices.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_IncludeInactive_Endpoint/"
|      }
|    },
|    {
|      "name": "SI_IncludeInactive_Identity",
|      "label": "Include inactive identities",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: only Microsoft apps this tenant granted nothing are left out",
|      "description": "also publish Microsoft apps granted nothing",
|      "purpose": "Turns off the one identity filter left: Microsoft-published applications this tenant granted nothing. Every user (disabled accounts and guests too) and every service principal and managed identity the tenant owns is always published.",
|      "effect": "On publishes the Microsoft-published applications too (hundreds in most tenants): more rows, more ingested data, and more noise in reports.",
|      "whenToChange": "When you need a complete identity inventory, for example for an audit.",
|      "card": "Which assets are included",
|      "info": {
|        "what": "Turns off the one identity filter left: Microsoft-published applications this tenant granted nothing. Every user (disabled accounts and guests too) and every service principal and managed identity the tenant owns is always published.",
|        "whenOn": "On publishes the Microsoft-published applications too (hundreds in most tenants): more rows, more ingested data, and more noise in reports.",
|        "whenOff": "only Microsoft apps this tenant granted nothing are left out",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "Off: only Microsoft apps this tenant granted nothing are left out",
|        "recommended": "Keep the default. Change it when: When you need a complete identity inventory, for example for an audit.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_IncludeInactive_Identity/"
|      }
|    },
|    {
|      "name": "SI_InternetExposedRanges",
|      "label": "Internet-exposed network ranges",
|      "group": "Risk Analysis reports",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "None: only what Defender, Exposure Graph, Azure and Shodan report counts as exposure.",
|      "description": "Address ranges that are internet-facing by design (DMZ, online landing zones), as CIDRs or addresses: an asset with an address in them gets the 'Internet exposed' risk factor, whatever the providers say (added to the internet_exposed_ranges list of data-model\\lists.locked.json; lists.custom.json works too). Default: none.",
|      "purpose": "Address ranges that are reachable from the internet by design, such as a DMZ or an online landing zone. An asset with an address in them counts as internet exposed in the risk score.",
|      "effect": "Assets with an address in these ranges get the Internet exposed risk factor, which adds its impact (default 4) to the asset side of their findings' risk score.",
|      "whenToChange": "When you have network segments that face the internet that the providers do not flag, for example a DMZ behind a firewall NAT.",
|      "card": "Internet exposure",
|      "info": {
|        "what": "Address ranges that are reachable from the internet by design, such as a DMZ or an online landing zone. An asset with an address in them counts as internet exposed in the risk score.",
|        "whenChanged": "Assets with an address in these ranges get the Internet exposed risk factor, which adds its impact (default 4) to the asset side of their findings' risk score.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "None: only what Defender, Exposure Graph, Azure and Shodan report counts as exposure.",
|        "recommended": "Keep the default. Change it when: When you have network segments that face the internet that the providers do not flag, for example a DMZ behind a firewall NAT.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_InternetExposedRanges/"
|      }
|    },
|    {
|      "name": "SI_InvardiaUpdate_Enabled",
|      "label": "Pro updates from Invardia",
|      "group": "Sign-in & Azure resources",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "SecurityInsight Pro: the updater job checks Invardia every night for a release approved for this install's ring and applies it (signed, verified, restored on failure). On by default; $false never checks or applies anything.",
|      "purpose": "Whether SecurityInsight Pro takes its updates from Invardia by itself. Every night the updater job asks Invardia for the release approved for this installation's ring, checks its signature and contents, and applies it; if anything fails the previous version is restored. A release that needs a manual step first, or a newer version than this installation can move to directly, is held and shown on this page.",
|      "effect": "Off: the updater job never asks Invardia for updates and applies nothing; the Settings page and the job's log say that Pro updates from Invardia are off. The installation stays on its current version until you turn it on again.",
|      "whenToChange": "Turn it off only to hold an installation on its current version for a while, for example during an audit or a change freeze; turn it on again afterwards.",
|      "card": "Licence and updates",
|      "info": {
|        "what": "Whether SecurityInsight Pro takes its updates from Invardia by itself. Every night the updater job asks Invardia for the release approved for this installation's ring, checks its signature and contents, and applies it; if anything fails the previous version is restored. A release that needs a manual step first, or a newer version than this installation can move to directly, is held and shown on this page.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "the updater job never asks Invardia for updates and applies nothing; the Settings page and the job's log say that Pro updates from Invardia are off. The installation stays on its current version until you turn it on again.",
|        "risk": "No updates are applied any more -- including security fixes -- until it is turned on again. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "On",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_InvardiaUpdate_Enabled/",
|        "confirmWhen": "off",
|        "confirm": "the updater job never asks Invardia for updates and applies nothing; the Settings page and the job's log say that Pro updates from Invardia are off. The installation stays on its current version until you turn it on again. No updates are applied any more -- including security fixes -- until it is turned on again. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_InvardiaUpdate_HoldMicrosoftContent",
|      "label": "Hold template packs",
|      "group": "Sign-in & Azure resources",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: template packs are installed automatically",
|      "description": "SecurityInsight Pro: template packs (new Microsoft content and template updates between releases) wait on Template releases for a manual Install instead of being installed automatically by the updater job. Off by default.",
|      "purpose": "Whether new template packs wait for you. Between releases SecurityInsight ships template packs: reports and rules for data that Microsoft added to Defender and the Exposure Graph, such as a new attack-path type, and updates to the templates SecurityInsight ships. Normally the updater job installs them by itself once your installation runs the SecurityInsight version a pack needs; your own changes are never overwritten by a pack.",
|      "effect": "On: a template pack is kept on the Template releases page, with what it changes, until you select Install there. Off: it is installed automatically the next time the updater job runs. Your own changes to templates are never touched either way, and an installed pack can be rolled back on Template releases.",
|      "whenToChange": "Turn it on when every change to what SecurityInsight reports must be reviewed first, for example during a change freeze or an audit.",
|      "card": "Licence and updates",
|      "info": {
|        "what": "Whether new template packs wait for you. Between releases SecurityInsight ships template packs: reports and rules for data that Microsoft added to Defender and the Exposure Graph, such as a new attack-path type, and updates to the templates SecurityInsight ships. Normally the updater job installs them by itself once your installation runs the SecurityInsight version a pack needs; your own changes are never overwritten by a pack.",
|        "whenOn": "a template pack is kept on the Template releases page, with what it changes, until you select Install there.",
|        "whenOff": "it is installed automatically the next time the updater job runs. Your own changes to templates are never touched either way, and an installed pack can be rolled back on Template releases.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Off: template packs are installed automatically",
|        "recommended": "Keep the default. Change it when: Turn it on when every change to what SecurityInsight reports must be reviewed first, for example during a change freeze or an audit.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_InvardiaUpdate_HoldMicrosoftContent/"
|      }
|    },
|    {
|      "name": "SI_KeyFigures_CveAgeBands",
|      "label": "Key figures: age bands of open CVE findings (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30,60,90",
|      "description": "The key figures' age bands of open CVE findings (\"older than N days\"), one band per number, comma-separated. Default '30,60,90'.",
|      "purpose": "The bands of the key figures' table \"Age of open CVE findings\": one row \"older than N days\" per number, separated by commas.",
|      "effect": "The next data sync counts the open CVE findings first detected more than each number of days before the collection. Whole numbers 1 to 3650; a list with none = the default.",
|      "whenToChange": "Your patch policy has other milestones (for example 14,30,90).",
|      "unit": "days",
|      "card": "Key figure windows",
|      "info": {
|        "what": "The bands of the key figures' table \"Age of open CVE findings\": one row \"older than N days\" per number, separated by commas.",
|        "whenChanged": "The next data sync counts the open CVE findings first detected more than each number of days before the collection. Whole numbers 1 to 3650; a list with none = the default.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "30,60,90",
|        "recommended": "Keep the default. Change it when: Your patch policy has other milestones (for example 14,30,90).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_KeyFigures_CveAgeBands/"
|      }
|    },
|    {
|      "name": "SI_KeyFigures_MeanTimeToFixDays",
|      "label": "Key figures: mean time to fix over the last (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "90 days",
|      "description": "The key figures' mean time to fix is worked out over the vulnerabilities fixed in the last N days (default 90).",
|      "purpose": "Which fixed vulnerabilities the key figure \"Mean time to fix\" averages: those remediated within this many days before the collection.",
|      "effect": "The next data sync averages the days from first detection to remediation of the CVE findings remediated in this window; the label says the number in force.",
|      "whenToChange": "A longer window gives a steadier number, a shorter one shows a recent change sooner.",
|      "unit": "days",
|      "min": 1,
|      "max": 3650,
|      "card": "Key figure windows",
|      "info": {
|        "what": "Which fixed vulnerabilities the key figure \"Mean time to fix\" averages: those remediated within this many days before the collection.",
|        "whenChanged": "The next data sync averages the days from first detection to remediation of the CVE findings remediated in this window; the label says the number in force.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "90 days",
|        "recommended": "Keep the default. Change it when: A longer window gives a steadier number, a shorter one shows a recent change sooner.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_KeyFigures_MeanTimeToFixDays/"
|      }
|    },
|    {
|      "name": "SI_KeyFigures_RecentDays",
|      "label": "Key figures: opened / fixed in the last (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30 days",
|      "description": "The key figures' windows (the Executive overview, report and management mail; every window a figure counts over is a setting -- #859). \"Vulnerabilities opened / fixed in the last N days\", in days (default 30).",
|      "purpose": "The window of the key figures \"Vulnerabilities opened in the last N days\" and \"Vulnerabilities fixed in the last N days\" (the Executive overview, the Executive report and the management mail).",
|      "effect": "The next data sync counts the CVE findings first detected, and the CVE findings remediated, within this many days before the collection; the labels say the number in force. Collections already figured keep the window they were worked out with; an update works the newest ones out again.",
|      "whenToChange": "Your management reports per quarter or per sprint (for example 90 or 14).",
|      "unit": "days",
|      "min": 1,
|      "max": 3650,
|      "card": "Key figure windows",
|      "info": {
|        "what": "The window of the key figures \"Vulnerabilities opened in the last N days\" and \"Vulnerabilities fixed in the last N days\" (the Executive overview, the Executive report and the management mail).",
|        "whenChanged": "The next data sync counts the CVE findings first detected, and the CVE findings remediated, within this many days before the collection; the labels say the number in force. Collections already figured keep the window they were worked out with; an update works the newest ones out again.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "30 days",
|        "recommended": "Keep the default. Change it when: Your management reports per quarter or per sprint (for example 90 or 14).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_KeyFigures_RecentDays/"
|      }
|    },
|    {
|      "name": "SI_KeyFigures_StaleAdminDays",
|      "label": "Key figures: privileged accounts without a sign-in for (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "90 days",
|      "description": "The key figures' \"privileged accounts without a sign-in for N days\", in days (default 90).",
|      "purpose": "When the key figure \"Privileged accounts without a sign-in for N days\" counts an enabled, active privileged account: its last sign-in is longer ago than this.",
|      "effect": "The next data sync counts the privileged accounts whose last sign-in (Entra ID sign-in activity) is older than this many days before the collection; the label says the number in force.",
|      "whenToChange": "Your access review calls an admin account stale sooner (for example 30 or 45 days).",
|      "unit": "days",
|      "min": 1,
|      "max": 3650,
|      "card": "Key figure windows",
|      "info": {
|        "what": "When the key figure \"Privileged accounts without a sign-in for N days\" counts an enabled, active privileged account: its last sign-in is longer ago than this.",
|        "whenChanged": "The next data sync counts the privileged accounts whose last sign-in (Entra ID sign-in activity) is older than this many days before the collection; the label says the number in force.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "90 days",
|        "recommended": "Keep the default. Change it when: Your access review calls an admin account stale sooner (for example 30 or 45 days).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_KeyFigures_StaleAdminDays/"
|      }
|    },
|    {
|      "name": "SI_KeyVaultName",
|      "label": "Key Vault name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Falls back to SpnKeyVaultName; with neither set, secret reads stop with an error",
|      "description": "--- Key Vault + licence ----------------------------------------------------- The ONE Key Vault SecurityInsight reads secrets from (the SPN secret, integration credentials, a Pro licence). Setup writes it. $global:SpnKeyVaultName is still accepted on installs that predate this name.",
|      "purpose": "The one Key Vault SecurityInsight reads its secrets from: the sign-in secret, integration credentials and a Pro licence.",
|      "effect": "All secrets are read from the named vault. A wrong name means sign-in secrets, keys and the licence cannot be read and runs fail or run as Community.",
|      "whenToChange": "Setup writes it. Change only if you move secrets to another Key Vault.",
|      "card": "How SecurityInsight signs in",
|      "info": {
|        "what": "The one Key Vault SecurityInsight reads its secrets from: the sign-in secret, integration credentials and a Pro licence.",
|        "whenChanged": "All secrets are read from the named vault. A wrong name means sign-in secrets, keys and the licence cannot be read and runs fail or run as Community.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Falls back to SpnKeyVaultName; with neither set, secret reads stop with an error",
|        "recommended": "Keep the default. Change it when: Setup writes it. Change only if you move secrets to another Key Vault.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_KeyVaultName/"
|      }
|    },
|    {
|      "name": "SI_KvMiClientId",
|      "label": "Key Vault managed identity (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Uses SI_ManagedIdentityClientId; otherwise the machine's own system managed identity",
|      "description": "Key Vault reads by a user-assigned managed identity (default: the machine's system identity / the SPN).",
|      "purpose": "The client id of a user-assigned managed identity used to read Key Vault when no Azure sign-in exists yet. Older name for SI_ManagedIdentityClientId.",
|      "effect": "Key Vault reads sign in as this user-assigned identity. It is ignored when SI_ManagedIdentityClientId is set, or when an Azure sign-in already exists.",
|      "whenToChange": "Only on older configurations that use a user-assigned identity; new installs use SI_ManagedIdentityClientId.",
|      "info": {
|        "what": "The client id of a user-assigned managed identity used to read Key Vault when no Azure sign-in exists yet. Older name for SI_ManagedIdentityClientId.",
|        "whenChanged": "Key Vault reads sign in as this user-assigned identity. It is ignored when SI_ManagedIdentityClientId is set, or when an Azure sign-in already exists.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Uses SI_ManagedIdentityClientId; otherwise the machine's own system managed identity",
|        "recommended": "Keep the default. Change it when: Only on older configurations that use a user-assigned identity; new installs use SI_ManagedIdentityClientId.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_KvMiClientId/"
|      }
|    },
|    {
|      "name": "SI_LaExport",
|      "label": "Copy records to Log Analytics",
|      "group": "Data & retention",
|      "type": "enum",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "off: the records are kept only in the database",
|      "description": "--- Optional copy of the provider records to Log Analytics --- The records live in the database (correlation and the CI build run in SQL only). 'records' also posts them to SI_Record_CL (+ SI_RecordRaw_CL for raw data) for Azure Monitor or workbooks -- a one-way copy; it costs ingestion.",
|      "purpose": "Optionally copies the provider records (every object a collection reads, mapped to SI fields) to Log Analytics, for Azure Monitor or your own workbooks.",
|      "effect": "'records' also posts every record to SI_Record_CL (and, for the providers raw data is on for, the whole object to SI_RecordRaw_CL) on every collection run. This costs Log Analytics ingestion for every record, every run. It is a one-way copy: correlation, the CI build and the data sync read the records from the database only and never read this copy back. The CIs (SI_CI_CL) are in Log Analytics in every install, because Risk Analysis reads them there, so they need no setting; the findings per CI are copied there only when Copy findings per CI to Log Analytics (SI_Finding_CL) is on.",
|      "whenToChange": "Only when you build your own Azure Monitor alerts or workbooks on the raw provider records; leave off otherwise.",
|      "values": [
|        "off",
|        "records"
|      ],
|      "valueLabels": {
|        "off": "Off: records in the database only",
|        "records": "Records: also copy them to Log Analytics"
|      },
|      "card": "Where collected data goes",
|      "hint": "Off = records in the database only. Records = also a copy in Log Analytics (costs ingestion).",
|      "info": {
|        "what": "Optionally copies the provider records (every object a collection reads, mapped to SI fields) to Log Analytics, for Azure Monitor or your own workbooks.",
|        "whenChanged": "'records' also posts every record to SI_Record_CL (and, for the providers raw data is on for, the whole object to SI_RecordRaw_CL) on every collection run. This costs Log Analytics ingestion for every record, every run. It is a one-way copy: correlation, the CI build and the data sync read the records from the database only and never read this copy back. The CIs (SI_CI_CL) are in Log Analytics in every install, because Risk Analysis reads them there, so they need no setting; the findings per CI are copied there only when Copy findings per CI to Log Analytics (SI_Finding_CL) is on.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "Nothing else.",
|        "default": "off: the records are kept only in the database",
|        "recommended": "Keep the default. Change it when: Only when you build your own Azure Monitor alerts or workbooks on the raw provider records; leave off otherwise.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LaExport/"
|      }
|    },
|    {
|      "name": "SI_LAQueryMaxRetries",
|      "label": "Log Analytics query retries",
|      "group": "Advanced / diagnostics",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "3 attempts (1, 3 and 7 seconds apart)",
|      "description": "--- Retries and query bucketing (RA) --------------------------------------",
|      "purpose": "How many attempts the asset engines make for a Log Analytics query that fails with a temporary error.",
|      "effect": "More attempts ride out brief workspace errors at the cost of a slightly longer run; fewer (minimum 1) fails faster and may drop the affected data from the run.",
|      "whenToChange": "Most installs never should. Raise it if runs log intermittent Log Analytics query failures.",
|      "unit": "attempts",
|      "info": {
|        "what": "How many attempts the asset engines make for a Log Analytics query that fails with a temporary error.",
|        "whenChanged": "More attempts ride out brief workspace errors at the cost of a slightly longer run; fewer (minimum 1) fails faster and may drop the affected data from the run.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "3 attempts (1, 3 and 7 seconds apart)",
|        "recommended": "Keep the default. Change it when: Most installs never should. Raise it if runs log intermittent Log Analytics query failures.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LAQueryMaxRetries/"
|      }
|    },
|    {
|      "name": "SI_LicenseRequest_Auto",
|      "label": "Automatic licence request",
|      "group": "Sign-in & Azure resources",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "SecurityInsight Pro: the updater job asks Invardia for the licence by itself every night when there is none, it ends within 30 days or it is in its grace period, installs it and mails the result. On by default; $false never asks.",
|      "purpose": "Whether SecurityInsight Pro asks Invardia for its licence by itself. Every night the updater job checks the licence; when there is none, it ends within 30 days, or it is in its grace period, the job asks Invardia for one, checks the licence it gets and installs it. The result is written to the audit trail and mailed to you. While the licence is valid nothing is asked.",
|      "effect": "Off: Invardia is never asked for a licence by the updater job, and the Settings page and the job's log say that the automatic licence request is off. A licence then has to be requested by hand (setup\\Request-SILicense.ps1) or installed by hand before the current one ends.",
|      "whenToChange": "Turn it off only if your organisation does not allow the installation to contact Invardia by itself; then renew the licence by hand.",
|      "card": "Licence and updates",
|      "info": {
|        "what": "Whether SecurityInsight Pro asks Invardia for its licence by itself. Every night the updater job checks the licence; when there is none, it ends within 30 days, or it is in its grace period, the job asks Invardia for one, checks the licence it gets and installs it. The result is written to the audit trail and mailed to you. While the licence is valid nothing is asked.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "Invardia is never asked for a licence by the updater job, and the Settings page and the job's log say that the automatic licence request is off. A licence then has to be requested by hand (setup\\Request-SILicense.ps1) or installed by hand before the current one ends.",
|        "risk": "The licence is not renewed automatically: when it expires, Pro features stop until a licence is installed by hand. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "On",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LicenseRequest_Auto/",
|        "confirmWhen": "off",
|        "confirm": "Invardia is never asked for a licence by the updater job, and the Settings page and the job's log say that the automatic licence request is off. A licence then has to be requested by hand (setup\\Request-SILicense.ps1) or installed by hand before the current one ends. The licence is not renewed automatically: when it expires, Pro features stop until a licence is installed by hand. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_LicenseRequest_BaseUrl",
|      "label": "Licence service address",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "https://invardia.com",
|      "description": "SecurityInsight Pro: the licence is read from the Key Vault secret 'SI-License' (setup\\Set-SILicense.ps1 installs it). Without one the install runs the Community edition -- complete on its own; Pro components print one line. The Pro updater job asks Invardia for the licence itself, and renews it before it ends (setup\\Request-SILicense.ps1 does the same by hand). Where Invardia's licence service is (https only; default https://invardia.com).",
|      "purpose": "The address of the licence service that a manual licence request contacts. Must be an https address.",
|      "effect": "Licence requests go to this address instead. A wrong address means licences cannot be requested or renewed by hand. The updater job uses its own environment setting.",
|      "whenToChange": "Practically never; only if the licence service tells you to use another address.",
|      "info": {
|        "what": "The address of the licence service that a manual licence request contacts. Must be an https address.",
|        "whenChanged": "Licence requests go to this address instead. A wrong address means licences cannot be requested or renewed by hand. The updater job uses its own environment setting.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "https://invardia.com",
|        "recommended": "Keep the default. Change it when: Practically never; only if the licence service tells you to use another address.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LicenseRequest_BaseUrl/"
|      }
|    },
|    {
|      "name": "SI_LicenseRequest_ContactEmail",
|      "label": "Licence contact e-mail",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: no contact address is sent with the request",
|      "description": "Who Invardia may contact about a licence request. Sent only when set.",
|      "purpose": "The email address the licence provider may use to contact you about a manual licence request.",
|      "effect": "When set, the address is sent with the licence request so the provider can reach you about it. It changes nothing else.",
|      "whenToChange": "Set it if you want to be contacted about your licence requests.",
|      "card": "Licence and updates",
|      "info": {
|        "what": "The email address the licence provider may use to contact you about a manual licence request.",
|        "whenChanged": "When set, the address is sent with the licence request so the provider can reach you about it. It changes nothing else.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Not set: no contact address is sent with the request",
|        "recommended": "Keep the default. Change it when: Set it if you want to be contacted about your licence requests.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LicenseRequest_ContactEmail/"
|      }
|    },
|    {
|      "name": "SI_LicenseRequest_Edition",
|      "label": "Licence request edition",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: no edition is named in the request",
|      "description": "The edition asked for in a licence request (optional; Invardia's owner decides). Sent only when set.",
|      "purpose": "The edition you ask for when requesting a licence by hand. The licence provider decides what is granted.",
|      "effect": "The named edition is included in the request as a wish; the licence issued is decided by the provider.",
|      "whenToChange": "Only when asked to name an edition in your licence request.",
|      "setupOnly": true,
|      "info": {
|        "what": "The edition you ask for when requesting a licence by hand. The licence provider decides what is granted.",
|        "whenChanged": "The named edition is included in the request as a wish; the licence issued is decided by the provider.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Not set: no edition is named in the request",
|        "recommended": "Keep the default. Change it when: Only when asked to name an edition in your licence request.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LicenseRequest_Edition/"
|      }
|    },
|    {
|      "name": "SI_LoadPendingRules",
|      "label": "Use AI-proposed draft rules",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: only shipped and your own custom rules are used.",
|      "description": "Auto-load AI-proposed pending rules into the live engine. Default OFF (drafts must be reviewed + promoted via human PR first).",
|      "purpose": "Lets the profiling engines also load draft posture rules proposed by schema discovery, before anyone has reviewed them.",
|      "effect": "When on, unreviewed AI-drafted rules also affect findings and tiers. This can add useful detections but also wrong or noisy results.",
|      "whenToChange": "Only for testing drafts in a lab; normally review and promote drafts instead.",
|      "info": {
|        "what": "Lets the profiling engines also load draft posture rules proposed by schema discovery, before anyone has reviewed them.",
|        "whenOn": "When on, unreviewed AI-drafted rules also affect findings and tiers. This can add useful detections but also wrong or noisy results.",
|        "whenOff": "only shipped and your own custom rules are used.",
|        "risk": "Unreviewed, AI-drafted rules change tiers and findings: wrong tiers or noisy findings can follow. Reversible: turn it off; the next run uses reviewed rules only.",
|        "requires": "Nothing else.",
|        "default": "Off: only shipped and your own custom rules are used.",
|        "recommended": "Off; review pending rules and approve the good ones instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LoadPendingRules/",
|        "confirmWhen": "on",
|        "confirm": "When on, unreviewed AI-drafted rules also affect findings and tiers. This can add useful detections but also wrong or noisy results. Unreviewed, AI-drafted rules change tiers and findings: wrong tiers or noisy findings can follow. Reversible: turn it off; the next run uses reviewed rules only."
|      }
|    },
|    {
|      "name": "SI_Location",
|      "label": "Azure region",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: setup asks for the region; a collection run does not use it",
|      "description": "Region override (used during workspace/DCE/DCR creation when missing).",
|      "purpose": "The Azure region setup creates the workspace, endpoint, storage and container resources in. A collection run creates no Azure resource, so it does not need it.",
|      "effect": "Decides where setup creates new resources. Existing resources are not moved. Risk Analysis falls back to Location, then westeurope.",
|      "whenToChange": "Set once at install to your preferred region.",
|      "card": "Log Analytics",
|      "info": {
|        "what": "The Azure region setup creates the workspace, endpoint, storage and container resources in. A collection run creates no Azure resource, so it does not need it.",
|        "whenChanged": "Decides where setup creates new resources. Existing resources are not moved. Risk Analysis falls back to Location, then westeurope.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Not set: setup asks for the region; a collection run does not use it",
|        "recommended": "Keep the default. Change it when: Set once at install to your preferred region.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Location/"
|      }
|    },
|    {
|      "name": "SI_LogIngest_AppId",
|      "label": "Ingestion app id (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_SPN_AppId is used",
|      "description": "Older name for the app id used to ingest data into Log Analytics; used only when SI_SPN_AppId is not set.",
|      "purpose": "Older name for the app id used to send data to Log Analytics; used only when SI_SPN_AppId is not set.",
|      "effect": "Only matters when SI_SPN_AppId is empty; then data ingestion signs in with this app.",
|      "whenToChange": "Never on new installs; use SI_SPN_AppId instead.",
|      "info": {
|        "what": "Older name for the app id used to send data to Log Analytics; used only when SI_SPN_AppId is not set.",
|        "whenChanged": "Only matters when SI_SPN_AppId is empty; then data ingestion signs in with this app.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: SI_SPN_AppId is used",
|        "recommended": "Keep the default. Change it when: Never on new installs; use SI_SPN_AppId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LogIngest_AppId/"
|      }
|    },
|    {
|      "name": "SI_LogIngest_ObjectId",
|      "label": "Ingestion object id (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_SPN_ObjectId is used",
|      "description": "Older name for the object id of the ingesting service principal, used to grant it rights on data collection rules; used only when SI_SPN_ObjectId is not set.",
|      "purpose": "Older name for the object id of the ingesting service principal, used to grant it rights on data collection rules; used when SI_SPN_ObjectId is not set.",
|      "effect": "Used only when SI_SPN_ObjectId is empty: every output path that grants ingest rights on a data collection rule takes SI_SPN_ObjectId first and this name second.",
|      "whenToChange": "Never on new installs; set SI_SPN_ObjectId instead.",
|      "info": {
|        "what": "Older name for the object id of the ingesting service principal, used to grant it rights on data collection rules; used when SI_SPN_ObjectId is not set.",
|        "whenChanged": "Used only when SI_SPN_ObjectId is empty: every output path that grants ingest rights on a data collection rule takes SI_SPN_ObjectId first and this name second.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: SI_SPN_ObjectId is used",
|        "recommended": "Keep the default. Change it when: Never on new installs; set SI_SPN_ObjectId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LogIngest_ObjectId/"
|      }
|    },
|    {
|      "name": "SI_LogIngest_Secret",
|      "label": "Ingestion secret (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": true,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_SPN_Secret is used",
|      "description": "Older name for the client secret used to ingest data into Log Analytics; used only when SI_SPN_Secret is not set.",
|      "purpose": "Older name for the client secret used to send data to Log Analytics; used only when SI_SPN_Secret is not set.",
|      "effect": "Only matters when SI_SPN_Secret is empty; then data ingestion signs in with this secret.",
|      "whenToChange": "Never on new installs; use SI_SPN_Secret, a certificate or managed identity.",
|      "info": {
|        "what": "Older name for the client secret used to send data to Log Analytics; used only when SI_SPN_Secret is not set.",
|        "whenChanged": "Only matters when SI_SPN_Secret is empty; then data ingestion signs in with this secret.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Kept in the install's Key Vault.",
|        "default": "Not set: SI_SPN_Secret is used",
|        "recommended": "Keep the default. Change it when: Never on new installs; use SI_SPN_Secret, a certificate or managed identity.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LogIngest_Secret/"
|      }
|    },
|    {
|      "name": "SI_LogIngest_TenantId",
|      "label": "Ingestion tenant id (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_SPN_TenantId is used",
|      "description": "Older name for the Entra tenant id used to ingest data into Log Analytics; used only when SI_SPN_TenantId is not set.",
|      "purpose": "Older name for the Entra tenant id used to send data to Log Analytics; used only when SI_SPN_TenantId is not set.",
|      "effect": "Only matters when SI_SPN_TenantId is empty; then data ingestion signs in to this tenant.",
|      "whenToChange": "Never on new installs; use SI_SPN_TenantId instead.",
|      "info": {
|        "what": "Older name for the Entra tenant id used to send data to Log Analytics; used only when SI_SPN_TenantId is not set.",
|        "whenChanged": "Only matters when SI_SPN_TenantId is empty; then data ingestion signs in to this tenant.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: SI_SPN_TenantId is used",
|        "recommended": "Keep the default. Change it when: Never on new installs; use SI_SPN_TenantId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LogIngest_TenantId/"
|      }
|    },
|    {
|      "name": "SI_LogRetentionDays",
|      "label": "Run log retention",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30 days.",
|      "description": "Days to keep launcher transcripts before pruning. Default 30.",
|      "purpose": "How many days run logs are kept, both on the local disk and in the storage account, before being deleted.",
|      "effect": "Longer keeps more history for investigating past runs, using more disk and storage space. Shorter frees space but older runs can no longer be checked.",
|      "whenToChange": "When your audit or troubleshooting needs require a longer or shorter history.",
|      "unit": "days",
|      "card": "How long data is kept",
|      "info": {
|        "what": "How many days run logs are kept, both on the local disk and in the storage account, before being deleted.",
|        "whenChanged": "Longer keeps more history for investigating past runs, using more disk and storage space. Shorter frees space but older runs can no longer be checked.",
|        "risk": "A shorter value deletes older run logs: past runs can no longer be investigated. Cannot be undone.",
|        "requires": "Nothing else.",
|        "default": "30 days.",
|        "recommended": "30 days.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_LogRetentionDays/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter value deletes older run logs: past runs can no longer be investigated. Cannot be undone."
|      }
|    },
|    {
|      "name": "SI_Mail_From",
|      "label": "Shared mailbox (sender)",
|      "group": "Mail & notifications",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: with a shared mailbox nothing is sent; with SMTP the older sender setting is used",
|      "description": "The shared mailbox SecurityInsight sends as (also the From address for smtp).",
|      "purpose": "The shared mailbox SecurityInsight sends as. With an SMTP relay it is the From address (and wins over the older sender settings).",
|      "effect": "Mail comes from this address. With a shared mailbox, Exchange must allow SecurityInsight's identity to send as it (and only as it).",
|      "whenToChange": "Set when you set up mail, or when the mailbox changes.",
|      "card": "Mail",
|      "info": {
|        "what": "The shared mailbox SecurityInsight sends as. With an SMTP relay it is the From address (and wins over the older sender settings).",
|        "whenChanged": "Mail comes from this address. With a shared mailbox, Exchange must allow SecurityInsight's identity to send as it (and only as it).",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Nothing else.",
|        "default": "Not set: with a shared mailbox nothing is sent; with SMTP the older sender setting is used",
|        "recommended": "Keep the default. Change it when: Set when you set up mail, or when the mailbox changes.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Mail_From/"
|      }
|    },
|    {
|      "name": "SI_Mail_Mode",
|      "label": "How mail is sent",
|      "group": "Mail & notifications",
|      "type": "enum",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: your SMTP relay when a mail server is set, else no mail",
|      "description": "--- MAIL: how SecurityInsight sends every mail (MAIL-1) --- sharedMailbox (recommended): an Office 365 shared mailbox, through Microsoft Graph as SecurityInsight's own identity; Mail.Send is granted in Exchange only, scoped to that mailbox (setup\\Set-SIMail.ps1 sets it up). smtp: your own SMTP relay (the settings below). none: no mail. Not set: smtp when SmtpServer is set, else none.",
|      "purpose": "How SecurityInsight sends every mail: sharedMailbox = an Office 365 shared mailbox through Microsoft Graph as SecurityInsight's own identity (recommended); smtp = your own SMTP relay; none = no mail.",
|      "effect": "Every mail (reports, safety-check alerts, close-loop, exemption, governance and digest mails, licence notices) goes this way. With sharedMailbox SecurityInsight sends only once it has verified that Mail.Send is restricted to the shared mailbox.",
|      "whenToChange": "Set up with Settings > E-mail > Set up mail, or setup\\Set-SIMail.ps1.",
|      "editor": "radio",
|      "values": [
|        "sharedMailbox",
|        "smtp",
|        "none"
|      ],
|      "valueLabels": {
|        "sharedMailbox": "Shared mailbox (Office 365) -- recommended",
|        "smtp": "SMTP relay (your own mail server)",
|        "none": "No mail"
|      },
|      "card": "Mail",
|      "hint": "The shared mailbox is recommended: no password to keep, and Exchange lets SecurityInsight send only as that one mailbox.",
|      "info": {
|        "what": "How SecurityInsight sends every mail: sharedMailbox = an Office 365 shared mailbox through Microsoft Graph as SecurityInsight's own identity (recommended); smtp = your own SMTP relay; none = no mail.",
|        "whenChanged": "Every mail (reports, safety-check alerts, close-loop, exemption, governance and digest mails, licence notices) goes this way. With sharedMailbox SecurityInsight sends only once it has verified that Mail.Send is restricted to the shared mailbox.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Nothing else.",
|        "default": "Not set: your SMTP relay when a mail server is set, else no mail",
|        "recommended": "Keep the default. Change it when: Set up with Settings > E-mail > Set up mail, or setup\\Set-SIMail.ps1.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Mail_Mode/"
|      }
|    },
|    {
|      "name": "SI_Mail_ProbeMailbox",
|      "label": "Mailbox to prove the restriction",
|      "group": "Mail & notifications",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: the restriction counts as verified only when an Exchange administrator confirmed it",
|      "description": "A mailbox OUTSIDE the scope: SecurityInsight checks that it may NOT send as it before it sends anything.",
|      "purpose": "An ordinary mailbox OUTSIDE the shared mailbox's scope. Before it sends, SecurityInsight checks that it may NOT send as this mailbox -- which proves Mail.Send is restricted. Nothing is delivered by the check.",
|      "effect": "Without it (and without a confirmation) SecurityInsight does not send through the shared mailbox.",
|      "whenToChange": "Set once, to an administrator's own mailbox; setup fills it in.",
|      "card": "Mail",
|      "hint": "An e-mail address (name@domain) of a different, ordinary mailbox -- never the shared mailbox itself, and not a display name.",
|      "info": {
|        "what": "An ordinary mailbox OUTSIDE the shared mailbox's scope. Before it sends, SecurityInsight checks that it may NOT send as this mailbox -- which proves Mail.Send is restricted. Nothing is delivered by the check.",
|        "whenChanged": "Without it (and without a confirmation) SecurityInsight does not send through the shared mailbox.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Nothing else.",
|        "default": "Not set: the restriction counts as verified only when an Exchange administrator confirmed it",
|        "recommended": "Keep the default. Change it when: Set once, to an administrator's own mailbox; setup fills it in.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Mail_ProbeMailbox/"
|      }
|    },
|    {
|      "name": "SI_Mail_RestrictionAttestation",
|      "label": "Restriction confirmed by",
|      "group": "Mail & notifications",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set",
|      "description": "When no such mailbox can be tested: who confirmed the restriction (Test-ServicePrincipalAuthorization), and when.",
|      "purpose": "Who confirmed that Mail.Send is restricted to the shared mailbox (Test-ServicePrincipalAuthorization), and when. Used only when no other mailbox can be tested.",
|      "effect": "Counts as verified when the check against another mailbox cannot run.",
|      "whenToChange": "Set by the mail setup, or after your Exchange administrator ran the check.",
|      "card": "Mail",
|      "info": {
|        "what": "Who confirmed that Mail.Send is restricted to the shared mailbox (Test-ServicePrincipalAuthorization), and when. Used only when no other mailbox can be tested.",
|        "whenChanged": "Counts as verified when the check against another mailbox cannot run.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Nothing else.",
|        "default": "Not set",
|        "recommended": "Keep the default. Change it when: Set by the mail setup, or after your Exchange administrator ran the check.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Mail_RestrictionAttestation/"
|      }
|    },
|    {
|      "name": "SI_Mail_SmtpKept",
|      "label": "Keep the SMTP relay (by choice)",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: SecurityInsight recommends moving to an Office 365 shared mailbox, and Home and Settings > E-mail show that hint",
|      "description": "Your own SMTP relay is kept by choice: the hint to move to a shared mailbox is no longer shown. Default $false.",
|      "purpose": "Says that your own SMTP relay is kept on purpose, so SecurityInsight stops suggesting the move to an Office 365 shared mailbox.",
|      "effect": "On: the SMTP relay is kept by choice -- the amber \"move to an Office 365 shared mailbox\" hint is hidden on Home and on Settings > E-mail, and mail shows as set up. A failed test mail is still shown in red. Mail is sent exactly as before.",
|      "whenToChange": "When you decide to keep your own SMTP relay; Ignore on the Home banner sets it, Undo on Settings > E-mail clears it.",
|      "card": "Mail",
|      "info": {
|        "what": "Says that your own SMTP relay is kept on purpose, so SecurityInsight stops suggesting the move to an Office 365 shared mailbox.",
|        "whenOn": "the SMTP relay is kept by choice -- the amber \"move to an Office 365 shared mailbox\" hint is hidden on Home and on Settings > E-mail, and mail shows as set up. A failed test mail is still shown in red. Mail is sent exactly as before.",
|        "whenOff": "SecurityInsight recommends moving to an Office 365 shared mailbox, and Home and Settings > E-mail show that hint",
|        "risk": "Low: only the advice to move to a shared mailbox is hidden; how mail is sent does not change, and a failed test mail still shows in red. Reversible at once (Undo on Settings > E-mail).",
|        "requires": "Nothing else.",
|        "default": "Off: SecurityInsight recommends moving to an Office 365 shared mailbox, and Home and Settings > E-mail show that hint",
|        "recommended": "Off, unless you keep your own SMTP relay on purpose.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Mail_SmtpKept/"
|      }
|    },
|    {
|      "name": "SI_ManagedIdentityClientId",
|      "label": "User-assigned managed identity",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Empty: the host's system-assigned identity",
|      "description": "empty = system-assigned",
|      "purpose": "Client id of a user-assigned managed identity to sign in with when the sign-in method is managed identity.",
|      "effect": "Selects which managed identity holds the permissions. A wrong client id makes sign-in fail; empty uses the Azure VM's or Arc server's own identity.",
|      "whenToChange": "Only when you sign in with a user-assigned identity instead of the host's system-assigned one.",
|      "card": "How SecurityInsight signs in",
|      "info": {
|        "what": "Client id of a user-assigned managed identity to sign in with when the sign-in method is managed identity.",
|        "whenChanged": "Selects which managed identity holds the permissions. A wrong client id makes sign-in fail; empty uses the Azure VM's or Arc server's own identity.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Empty: the host's system-assigned identity",
|        "recommended": "Keep the default. Change it when: Only when you sign in with a user-assigned identity instead of the host's system-assigned one.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ManagedIdentityClientId/"
|      }
|    },
|    {
|      "name": "SI_MaxMailAttachmentMB",
|      "label": "Largest mail attachment",
|      "group": "Mail & notifications",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "24 MB (fits a 25 MB mail server limit)",
|      "description": "Mail attachment budget in MB of MESSAGE, measured base64-ENCODED (attachments inflate ~37%, so a 20 MB file is ~27 MB on the wire). Over budget, the report is sent WITHOUT the attachment rather than the relay rejecting the whole mail.",
|      "purpose": "The largest Excel attachment, measured as encoded for mail, that a Risk Analysis mail carries; larger reports are mailed without the attachment.",
|      "effect": "Raising it lets bigger workbooks be attached, but above your mail server's limit the whole mail is rejected and nothing arrives. Lowering it is always safe.",
|      "whenToChange": "Raise only if your mail server accepts larger messages; lower if mails are rejected.",
|      "unit": "MB",
|      "card": "Risk Analysis report mails",
|      "hint": "A larger report is mailed without its Excel file.",
|      "info": {
|        "what": "The largest Excel attachment, measured as encoded for mail, that a Risk Analysis mail carries; larger reports are mailed without the attachment.",
|        "whenChanged": "Raising it lets bigger workbooks be attached, but above your mail server's limit the whole mail is rejected and nothing arrives. Lowering it is always safe.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Nothing else.",
|        "default": "24 MB (fits a 25 MB mail server limit)",
|        "recommended": "Keep the default. Change it when: Raise only if your mail server accepts larger messages; lower if mails are rejected.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_MaxMailAttachmentMB/"
|      }
|    },
|    {
|      "name": "SI_PatchCycle_CatchUpDays",
|      "label": "Patch cycle: catch-up after",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30 days.",
|      "description": "Patch cycle: a finding whose fix was released (or, without one dated update, that was first detected) more than this many days before the collection is Catch-up, else In monthly cycle (default 30; exactly 30 is still in the cycle).",
|      "purpose": "When a finding counts as catch-up instead of being fixed in the monthly patch cycle: its fix was released (the month a \"October 2026 Security Updates\" text names -> that month's Patch Tuesday), or -- without one dated update -- the finding was first detected, more than this many days before the collection.",
|      "effect": "The Patch cycle column of every finding (In monthly cycle / Catch-up / No fix available / Unknown) and its filter use this number from the next Risk Analysis run; findings already stored keep the value they were given.",
|      "whenToChange": "Match your patch policy: e.g. 45 when monthly patches are allowed six weeks.",
|      "unit": "days",
|      "min": 1,
|      "card": "Vulnerability (CVE) filters",
|      "info": {
|        "what": "When a finding counts as catch-up instead of being fixed in the monthly patch cycle: its fix was released (the month a \"October 2026 Security Updates\" text names -> that month's Patch Tuesday), or -- without one dated update -- the finding was first detected, more than this many days before the collection.",
|        "whenChanged": "The Patch cycle column of every finding (In monthly cycle / Catch-up / No fix available / Unknown) and its filter use this number from the next Risk Analysis run; findings already stored keep the value they were given.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "30 days.",
|        "recommended": "Keep the default. Change it when: Match your patch policy: e.g. 45 when monthly patches are allowed six weeks.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PatchCycle_CatchUpDays/"
|      }
|    },
|    {
|      "name": "SI_PatchCycle_MsrcDates",
|      "label": "Patch cycle: read Microsoft update release dates",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On.",
|      "description": "Patch cycle: read the release date of each Microsoft update (by its KB) from Microsoft's public Security Update Guide (https://api.msrc.microsoft.com, once a day, cached). Off: no call; the month the update's name says is used (default on).",
|      "purpose": "Reads the release date of each Microsoft update (by its KB number) from Microsoft's public Security Update Guide (api.msrc.microsoft.com, no sign-in), once a day, and keeps it in the install. Defender names the update and its KB but not when it was released.",
|      "effect": "On: a Microsoft fix's own release date decides In monthly cycle / Catch-up (an out-of-band update by its own date). Off: no call to api.msrc.microsoft.com; the month the update's name says (its Patch Tuesday) is used. A third-party fix uses the first detection either way.",
|      "whenToChange": "Turn off when the install must not call out to api.msrc.microsoft.com (a private network that does not allow it). A failed call is said once per run and the name rule is used.",
|      "card": "Vulnerability (CVE) filters",
|      "info": {
|        "what": "Reads the release date of each Microsoft update (by its KB number) from Microsoft's public Security Update Guide (api.msrc.microsoft.com, no sign-in), once a day, and keeps it in the install. Defender names the update and its KB but not when it was released.",
|        "whenOn": "a Microsoft fix's own release date decides In monthly cycle / Catch-up (an out-of-band update by its own date).",
|        "whenOff": "no call to api.msrc.microsoft.com; the month the update's name says (its Patch Tuesday) is used. A third-party fix uses the first detection either way.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "On.",
|        "recommended": "Keep the default. Change it when: Turn off when the install must not call out to api.msrc.microsoft.com (a private network that does not allow it). A failed call is said once per run and the name rule is used.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PatchCycle_MsrcDates/"
|      }
|    },
|    {
|      "name": "SI_PayloadProfile",
|      "label": "Asset detail level",
|      "group": "Data & retention",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "cmdb: every collected property is kept",
|      "description": "--- profile payload --------------------------------------------------------- 'cmdb' (default) = every collected property; 'security' = only the schema-declared columns (default-deny, smaller).",
|      "purpose": "Chooses how much detail is kept per asset: everything collected (cmdb) or only the columns the schema declares (security).",
|      "effect": "security gives smaller rows and lower ingest cost, but drops undeclared properties that queries or dashboards may use; dropped fields are listed in the run log. An unknown value falls back to cmdb.",
|      "whenToChange": "Consider security only if ingest volume matters more than a full asset inventory.",
|      "info": {
|        "what": "Chooses how much detail is kept per asset: everything collected (cmdb) or only the columns the schema declares (security).",
|        "whenChanged": "security gives smaller rows and lower ingest cost, but drops undeclared properties that queries or dashboards may use; dropped fields are listed in the run log. An unknown value falls back to cmdb.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "Nothing else.",
|        "default": "cmdb: every collected property is kept",
|        "recommended": "Keep the default. Change it when: Consider security only if ingest volume matters more than a full asset inventory.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PayloadProfile/"
|      }
|    },
|    {
|      "name": "SI_Pipeline_StartTime",
|      "label": "Daily pipeline start time",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "19:00 in the local time of the install's Azure region (Danish time when the region is not known)",
|      "description": "The daily pipeline (Collect -> Correlate -> Deliver): when a NEW install's pipeline starts -- a time of day in its own time zone, the same local time all year (summer time included). A pipeline already stored (Operations > Jobs, or config\\job-flow.custom.json) keeps its own time. The guided installer asks for the time zone.",
|      "purpose": "The time of day a new install's daily pipeline (Collect, Correlate, Deliver) starts, in the pipeline's time zone.",
|      "effect": "The pipeline starts at this local time every day; summer time moves the time in UTC, never the local time. A pipeline already stored on Operations > Jobs or in config\\job-flow.custom.json keeps its own time -- change that one there.",
|      "whenToChange": "When the collection should run at another time of day, for example to finish before the working day starts.",
|      "patternHint": "HH:mm, local time",
|      "pattern": "^([01][0-9]|2[0-3]):[0-5][0-9]$",
|      "card": "Daily pipeline",
|      "info": {
|        "what": "The time of day a new install's daily pipeline (Collect, Correlate, Deliver) starts, in the pipeline's time zone.",
|        "whenChanged": "The pipeline starts at this local time every day; summer time moves the time in UTC, never the local time. A pipeline already stored on Operations > Jobs or in config\\job-flow.custom.json keeps its own time -- change that one there.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "19:00 in the local time of the install's Azure region (Danish time when the region is not known)",
|        "recommended": "Keep the default. Change it when: When the collection should run at another time of day, for example to finish before the working day starts.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pipeline_StartTime/"
|      }
|    },
|    {
|      "name": "SI_Pipeline_TimeZone",
|      "label": "Daily pipeline time zone",
|      "group": "Schedules & what runs",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "The time zone of the install's Azure region, written by the install (Europe/Copenhagen, Danish time, when the region is not known)",
|      "description": "an IANA id (Europe/Oslo, America/New_York) or a Windows id; unknown = UTC",
|      "purpose": "The time zone the daily pipeline's start time is read in.",
|      "effect": "An IANA id such as Europe/Oslo or America/New_York, or a Windows id. The start time stays the same local time all year. An id the machine does not know is read as UTC, with a warning in the run log.",
|      "whenToChange": "Set it to the time zone of the people who read the results; the guided installer asks for it.",
|      "card": "Daily pipeline",
|      "info": {
|        "what": "The time zone the daily pipeline's start time is read in.",
|        "whenChanged": "An IANA id such as Europe/Oslo or America/New_York, or a Windows id. The start time stays the same local time all year. An id the machine does not know is read as UTC, with a warning in the run log.",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "The time zone of the install's Azure region, written by the install (Europe/Copenhagen, Danish time, when the region is not known)",
|        "recommended": "Keep the default. Change it when: Set it to the time zone of the people who read the results; the guided installer asks for it.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pipeline_TimeZone/"
|      }
|    },
|    {
|      "name": "SI_PreferUami",
|      "label": "Managed identity switch (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off, unless the sign-in choice selects managed identity",
|      "description": "Older managed-identity switch, still honoured (SI_AuthMethod is the one to use).",
|      "purpose": "Older switch to sign in with a managed identity, still honoured; SI_AuthMethod is the setting to use.",
|      "effect": "When on and no service principal is configured, managed identity is used. For Log Analytics ingestion it takes effect only together with a user-assigned client id.",
|      "whenToChange": "Never on new installs; set SI_AuthMethod instead.",
|      "info": {
|        "what": "Older switch to sign in with a managed identity, still honoured; SI_AuthMethod is the setting to use.",
|        "whenOn": "When on and no service principal is configured, managed identity is used. For Log Analytics ingestion it takes effect only together with a user-assigned client id.",
|        "whenOff": "unless the sign-in choice selects managed identity",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Off, unless the sign-in choice selects managed identity",
|        "recommended": "Keep the default. Change it when: Never on new installs; set SI_AuthMethod instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PreferUami/"
|      }
|    },
|    {
|      "name": "SI_PrivilegeTierClassifier_RefreshDays",
|      "label": "Privilege tier catalog: days kept while unchanged",
|      "group": "AI",
|      "type": "int",
|      "engines": [
|        "privilege-tier-classifier"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 7,
|      "defaultText": "7 days: the catalog is rebuilt as soon as a role or permission changes, and at least once a week",
|      "description": "Days a catalog is kept while its inputs are unchanged. Each run collects the role definitions and permission catalogs (seconds) and skips the AI pass when they, the engine and the AI settings are the same as for the last complete catalog and that catalog is younger than this. 0 = rebuild on every run.",
|      "purpose": "How long the privilege tier classifier keeps its catalog while nothing it is made from changed. Every run reads the Entra role definitions, the API permission catalog and the Azure role definitions (seconds); when they, the engine and the AI settings are the same as for the last complete catalog and that catalog is younger than this, the AI pass is skipped and the catalog is kept.",
|      "effect": "A lower value rebuilds (and sends the AI requests) more often; 0 rebuilds on every run, as before. A catalog that left items untiered is always rebuilt on the next run.",
|      "whenToChange": "Set 0 to rebuild every run, for example while you test new tiering prompts; raise it to cut AI calls further.",
|      "unit": "days",
|      "min": 0,
|      "max": 365,
|      "card": "AI spending",
|      "info": {
|        "what": "How long the privilege tier classifier keeps its catalog while nothing it is made from changed. Every run reads the Entra role definitions, the API permission catalog and the Azure role definitions (seconds); when they, the engine and the AI settings are the same as for the last complete catalog and that catalog is younger than this, the AI pass is skipped and the catalog is kept.",
|        "whenChanged": "A lower value rebuilds (and sends the AI requests) more often; 0 rebuilds on every run, as before. A catalog that left items untiered is always rebuilt on the next run.",
|        "risk": "None to the data: a changed role or permission always rebuilds the catalog on the next run; the setting only decides how long an unchanged catalog is kept. Reversible at once.",
|        "requires": "Read by: privilege-tier-classifier.",
|        "default": "7 days: the catalog is rebuilt as soon as a role or permission changes, and at least once a week",
|        "recommended": "Keep the default (7).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PrivilegeTierClassifier_RefreshDays/"
|      }
|    },
|    {
|      "name": "SI_PrivilegeTierClassifier_RunAI",
|      "label": "AI for privilege tier catalog",
|      "group": "AI",
|      "type": "bool",
|      "engines": [
|        "privilege-tier-classifier"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": true,
|      "defaultText": "On.",
|      "description": "Master switch. $true (default) runs all 4 AI categories; $false short-circuits to the static built-in tier map.",
|      "purpose": "An override for ONE engine: whether the privilege tier classifier asks Azure OpenAI to tier new roles and permissions. It follows its own switch, not AI integration: it calls AI whenever the Azure OpenAI settings are set, unless this is off.",
|      "effect": "Turning it off sends nothing to Azure OpenAI: roles and permissions already in the catalog keep their tier, and new ones are left unresolved for manual review. Removes AI cost for this engine.",
|      "whenToChange": "Only to keep AI out of the privilege tier classifier while it is used elsewhere; or turn it off if you tier new roles yourself.",
|      "card": "Where AI is used",
|      "info": {
|        "what": "An override for ONE engine: whether the privilege tier classifier asks Azure OpenAI to tier new roles and permissions. It follows its own switch, not AI integration: it calls AI whenever the Azure OpenAI settings are set, unless this is off.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "Turning it off sends nothing to Azure OpenAI: roles and permissions already in the catalog keep their tier, and new ones are left unresolved for manual review. Removes AI cost for this engine.",
|        "risk": "With the Azure OpenAI settings set, new role and permission names are sent to YOUR Azure OpenAI deployment, and each call costs; off leaves new ones untiered for manual review. Reversible at once.",
|        "requires": "Read by: privilege-tier-classifier.",
|        "default": "On.",
|        "recommended": "Keep the default; turn it off only to keep AI out of this engine.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PrivilegeTierClassifier_RunAI/"
|      }
|    },
|    {
|      "name": "SI_Pro_AssetRetire_GraceDays",
|      "label": "Days before an unseen asset is retired",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30 days",
|      "description": "AN ASSET SECURITYINSIGHT NO LONGER SEES (#406): how many days an asset may go unseen before SecurityInsight retires it -- its open vulnerabilities then close as AssetRetired (never as fixed), its CI is retired, and ServiceNow gets the state (u_si_state). Seen again = active again. Default for every category; each category below can override it. Default 30.",
|      "purpose": "How many days an asset SecurityInsight no longer sees may stay unseen before it is retired: its open vulnerabilities close as AssetRetired (never as fixed), its CI in the CI table is retired, and ServiceNow gets the state (u_si_state = retired). Used for every category that has no value of its own.",
|      "effect": "Until then the asset is listed on Assets & services > CMDB > Not seen anymore with its open findings, where an Admin may retire it early. Seen again = active again, and its findings reopen. Shorter than the seen-window (8 days) is raised to the seen-window; non-numbers use 30.",
|      "whenToChange": "Raise it if assets are away longer than this and come back (for example laptops during a long holiday); lower it to close the findings of removed assets sooner.",
|      "unit": "days",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "How many days an asset SecurityInsight no longer sees may stay unseen before it is retired: its open vulnerabilities close as AssetRetired (never as fixed), its CI in the CI table is retired, and ServiceNow gets the state (u_si_state = retired). Used for every category that has no value of its own.",
|        "whenChanged": "Until then the asset is listed on Assets & services > CMDB > Not seen anymore with its open findings, where an Admin may retire it early. Seen again = active again, and its findings reopen. Shorter than the seen-window (8 days) is raised to the seen-window; non-numbers use 30.",
|        "risk": "A shorter grace period retires unseen assets sooner -- and closes their open vulnerabilities as retired. A device that is only offline for a while can be retired by mistake. Reversible for the future; closed findings reopen only when the asset is seen again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "30 days",
|        "recommended": "30 days (devices can be offline for weeks).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AssetRetire_GraceDays/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter grace period retires unseen assets sooner -- and closes their open vulnerabilities as retired. A device that is only offline for a while can be retired by mistake. Reversible for the future; closed findings reopen only when the asset is seen again."
|      }
|    },
|    {
|      "name": "SI_Pro_AssetRetire_GraceDays_AzureResource",
|      "label": "Days before an unseen asset is retired: other Azure resources",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The general value (30 days)",
|      "description": "Grace period for other Azure resources: any Azure resource that is not a virtual machine. Empty = SI_Pro_AssetRetire_GraceDays.",
|      "purpose": "The grace period for other Azure resources -- any Azure resource that is not a virtual machine. Overrides the general value for this category.",
|      "effect": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|      "whenToChange": "Lower it if Azure resources are deleted for good and you want their findings closed sooner.",
|      "unit": "days",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "The grace period for other Azure resources -- any Azure resource that is not a virtual machine. Overrides the general value for this category.",
|        "whenChanged": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|        "risk": "A shorter grace period retires unseen Azure resources sooner and closes their open vulnerabilities as retired. Reversible for the future.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "The general value (30 days)",
|        "recommended": "The general value.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AssetRetire_GraceDays_AzureResource/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter grace period retires unseen Azure resources sooner and closes their open vulnerabilities as retired. Reversible for the future."
|      }
|    },
|    {
|      "name": "SI_Pro_AssetRetire_GraceDays_AzureVm",
|      "label": "Days before an unseen asset is retired: Azure virtual machines",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The general value (30 days)",
|      "description": "Grace period for Azure virtual machines: an Azure virtual machine or scale set, also when Defender reports it as a device. Empty = SI_Pro_AssetRetire_GraceDays.",
|      "purpose": "The grace period for Azure virtual machines -- an Azure virtual machine or scale set, also when Defender reports it as a device. Overrides the general value for this category.",
|      "effect": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|      "whenToChange": "Raise it for VMs that are deallocated for long periods.",
|      "unit": "days",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "The grace period for Azure virtual machines -- an Azure virtual machine or scale set, also when Defender reports it as a device. Overrides the general value for this category.",
|        "whenChanged": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|        "risk": "A shorter grace period retires unseen Azure VMs sooner (a stopped VM can be retired by mistake) and closes their open vulnerabilities as retired. Reversible for the future.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "The general value (30 days)",
|        "recommended": "The general value.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AssetRetire_GraceDays_AzureVm/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter grace period retires unseen Azure VMs sooner (a stopped VM can be retired by mistake) and closes their open vulnerabilities as retired. Reversible for the future."
|      }
|    },
|    {
|      "name": "SI_Pro_AssetRetire_GraceDays_ClientPc",
|      "label": "Days before an unseen asset is retired: client PCs",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The general value (30 days)",
|      "description": "Grace period for client PCs: a device whose operating system is not a server (laptops, desktops). Empty = SI_Pro_AssetRetire_GraceDays.",
|      "purpose": "The grace period for client PCs -- a device whose operating system is not a server (laptops, desktops). Overrides the general value for this category.",
|      "effect": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|      "whenToChange": "Raise it if people are away longer than this with their laptop switched off (holidays, leave).",
|      "unit": "days",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "The grace period for client PCs -- a device whose operating system is not a server (laptops, desktops). Overrides the general value for this category.",
|        "whenChanged": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|        "risk": "A shorter grace period retires unseen client PCs sooner (laptops are often offline for weeks) and closes their open vulnerabilities as retired. Reversible for the future.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "The general value (30 days)",
|        "recommended": "The general value (30 days) or longer.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AssetRetire_GraceDays_ClientPc/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter grace period retires unseen client PCs sooner (laptops are often offline for weeks) and closes their open vulnerabilities as retired. Reversible for the future."
|      }
|    },
|    {
|      "name": "SI_Pro_AssetRetire_GraceDays_Server",
|      "label": "Days before an unseen asset is retired: servers",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The general value (30 days)",
|      "description": "Grace period for servers: a device with a server operating system, or an Arc-connected machine. Empty = SI_Pro_AssetRetire_GraceDays.",
|      "purpose": "The grace period for servers -- a device with a server operating system, or an Arc-connected machine. Overrides the general value for this category.",
|      "effect": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|      "whenToChange": "Lower it if your servers are decommissioned through a process you trust and you want their findings closed sooner.",
|      "unit": "days",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "The grace period for servers -- a device with a server operating system, or an Arc-connected machine. Overrides the general value for this category.",
|        "whenChanged": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|        "risk": "A shorter grace period retires unseen servers sooner and closes their open vulnerabilities as retired. Reversible for the future.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "The general value (30 days)",
|        "recommended": "The general value.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AssetRetire_GraceDays_Server/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter grace period retires unseen servers sooner and closes their open vulnerabilities as retired. Reversible for the future."
|      }
|    },
|    {
|      "name": "SI_Pro_AssetRetire_GraceDays_ServicePrincipal",
|      "label": "Days before an unseen asset is retired: service principals",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The general value (30 days)",
|      "description": "Grace period for service principals: an Entra service principal or managed identity. Empty = SI_Pro_AssetRetire_GraceDays.",
|      "purpose": "The grace period for service principals -- an Entra service principal or managed identity. Overrides the general value for this category.",
|      "effect": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|      "whenToChange": "Raise it for service principals that are used only now and then.",
|      "unit": "days",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "The grace period for service principals -- an Entra service principal or managed identity. Overrides the general value for this category.",
|        "whenChanged": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|        "risk": "A shorter grace period retires unseen service principals sooner and closes their open findings as retired. Reversible for the future.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "The general value (30 days)",
|        "recommended": "The general value.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AssetRetire_GraceDays_ServicePrincipal/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter grace period retires unseen service principals sooner and closes their open findings as retired. Reversible for the future."
|      }
|    },
|    {
|      "name": "SI_Pro_AssetRetire_GraceDays_User",
|      "label": "Days before an unseen asset is retired: users",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The general value (30 days)",
|      "description": "Grace period for users: an Entra user account. Empty = SI_Pro_AssetRetire_GraceDays.",
|      "purpose": "The grace period for users -- an Entra user account. Overrides the general value for this category.",
|      "effect": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|      "whenToChange": "Raise it if accounts are disabled for long periods (leave) and come back.",
|      "unit": "days",
|      "card": "Assets no longer seen",
|      "info": {
|        "what": "The grace period for users -- an Entra user account. Overrides the general value for this category.",
|        "whenChanged": "An asset of this category that SecurityInsight has not seen for longer than this is retired; its open vulnerabilities close as AssetRetired and ServiceNow gets the state. Seen again = active again. Shorter than the seen-window (8 days) is raised to it.",
|        "risk": "A shorter grace period retires unseen users sooner and closes their open findings as retired. Reversible for the future.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "The general value (30 days)",
|        "recommended": "The general value.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AssetRetire_GraceDays_User/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter grace period retires unseen users sooner and closes their open findings as retired. Reversible for the future."
|      }
|    },
|    {
|      "name": "SI_Pro_AssetTagging_Apply",
|      "label": "Asset tagging writes tags",
|      "group": "Connectors & CMDB",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: report only, every planned tag is logged, nothing is changed",
|      "description": "Let the asset-tagging job WRITE the tags its rules select (Defender machine tags, Azure resource tags, Entra custom security attributes). Off by default: the job then only reports what it would tag, and every planned tag is logged to the asset-tag activity table. Writing also needs the job's own identity to hold the write permissions (setup -GrantTaggingRoles).",
|      "purpose": "Lets the asset-tagging job actually write the tags its rules select in Defender, Azure and Entra, instead of only reporting them.",
|      "effect": "On, the job changes Defender machine tags, Azure resource tags and Entra custom security attributes in your tenant. Only a real true turns it on; the job identity also needs the write roles.",
|      "whenToChange": "Turn it on after reviewing the report-only results and granting the tagging write roles.",
|      "card": "Asset tagging",
|      "info": {
|        "what": "Lets the asset-tagging job actually write the tags its rules select in Defender, Azure and Entra, instead of only reporting them.",
|        "whenOn": "On, the job changes Defender machine tags, Azure resource tags and Entra custom security attributes in your tenant. Only a real true turns it on; the job identity also needs the write roles.",
|        "whenOff": "report only, every planned tag is logged, nothing is changed",
|        "risk": "Writes to your tenant: the job changes Defender machine tags, Azure resource tags and Entra custom security attributes. A wrong rule tags or untags many objects at once. Reversible only by changing the rules and running again (or by hand); every change is on the audit trail.",
|        "requires": "The asset tagging identity's write rights (granted by setup only when asked). A SecurityInsight Pro licence.",
|        "default": "Off: report only, every planned tag is logged, nothing is changed",
|        "recommended": "Off until the report-only plan has been reviewed on the Asset tagging page; then on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AssetTagging_Apply/",
|        "confirmWhen": "on",
|        "confirm": "On, the job changes Defender machine tags, Azure resource tags and Entra custom security attributes in your tenant. Only a real true turns it on; the job identity also needs the write roles. Writes to your tenant: the job changes Defender machine tags, Azure resource tags and Entra custom security attributes. A wrong rule tags or untags many objects at once. Reversible only by changing the rules and running again (or by hand); every change is on the audit trail."
|      }
|    },
|    {
|      "name": "SI_Pro_AuditRetentionMonths",
|      "label": "Audit trail retention",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "not set: the audit trail is kept forever",
|      "description": "Months the Pro audit trail (cfg.AuditEvent: every action in the web app, the jobs and setup) keeps its rows. Not set = kept forever. At least 13; older rows are removed only by the data sync's retention step, which records itself.",
|      "purpose": "How many months the Pro audit trail (every action in the web app, the jobs and setup: who, when, why, before and after) keeps its rows.",
|      "effect": "When set, the data sync removes audit rows older than this many months and records that removal on the trail itself. It cannot be shorter than 13 months; a smaller value or one that is not a whole number is refused and the trail is kept in full.",
|      "whenToChange": "Set it when your retention policy requires audit evidence to be removed after a period -- keep it at least as long as the data the trail explains.",
|      "unit": "months",
|      "min": 13,
|      "info": {
|        "what": "How many months the Pro audit trail (every action in the web app, the jobs and setup: who, when, why, before and after) keeps its rows.",
|        "whenChanged": "When set, the data sync removes audit rows older than this many months and records that removal on the trail itself. It cannot be shorter than 13 months; a smaller value or one that is not a whole number is refused and the trail is kept in full.",
|        "risk": "Setting it, or lowering it, PERMANENTLY deletes audit rows older than this at the next sync (at least 13 months is enforced). Cannot be undone; check your audit obligations first.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "not set: the audit trail is kept forever",
|        "recommended": "Not set (keep the audit trail), or your audit policy's period.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_AuditRetentionMonths/",
|        "confirmWhen": "lower",
|        "confirm": "Setting it, or lowering it, PERMANENTLY deletes audit rows older than this at the next sync (at least 13 months is enforced). Cannot be undone; check your audit obligations first."
|      }
|    },
|    {
|      "name": "SI_Pro_CiChangeRetentionDays",
|      "label": "CI change history kept",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "730 days",
|      "description": "--- Pro database: how long the CI history is kept (days; removed after each data sync) ---",
|      "purpose": "How many days the change history of each configuration item (CI) is kept in the Pro database.",
|      "effect": "Older CI changes are removed after each data sync. Longer keeps more history on the CI page but grows the database.",
|      "whenToChange": "Shorten it to keep the database small; lengthen it when you need a longer audit of CI changes.",
|      "unit": "days",
|      "min": 1,
|      "info": {
|        "what": "How many days the change history of each configuration item (CI) is kept in the Pro database.",
|        "whenChanged": "Older CI changes are removed after each data sync. Longer keeps more history on the CI page but grows the database.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "730 days",
|        "recommended": "Keep the default. Change it when: Shorten it to keep the database small; lengthen it when you need a longer audit of CI changes.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_CiChangeRetentionDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_CiDailyRetentionDays",
|      "label": "CI daily trend kept",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "400 days",
|      "description": "each CI's daily trend",
|      "purpose": "How many days of each CI's daily trend (risk score, open findings by severity) the Pro database keeps.",
|      "effect": "Older daily rows are removed after each data sync, so trend charts go back this far.",
|      "whenToChange": "Shorten it to keep the database small; lengthen it for longer trend charts.",
|      "unit": "days",
|      "min": 1,
|      "info": {
|        "what": "How many days of each CI's daily trend (risk score, open findings by severity) the Pro database keeps.",
|        "whenChanged": "Older daily rows are removed after each data sync, so trend charts go back this far.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "400 days",
|        "recommended": "Keep the default. Change it when: Shorten it to keep the database small; lengthen it for longer trend charts.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_CiDailyRetentionDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_CmdbSql_DryRun",
|      "label": "SQL CMDB connector dry run",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: the connector writes the CI table",
|      "description": "Plan the SQL CMDB connector (what it would create, update and retire) without writing to SQL.",
|      "purpose": "Makes the SQL CMDB connector plan what it would create, update and retire without writing anything to SQL.",
|      "effect": "On, the CI table is not changed and no run is recorded there; the plan is in the job's log and on the audit trail as a plan.",
|      "whenToChange": "Turn on briefly to check a new setup; turn off again afterwards.",
|      "info": {
|        "what": "Makes the SQL CMDB connector plan what it would create, update and retire without writing anything to SQL.",
|        "whenOn": "On, the CI table is not changed and no run is recorded there; the plan is in the job's log and on the audit trail as a plan.",
|        "whenOff": "the connector writes the CI table",
|        "risk": "The CMDB table is not updated while it is on: consumers of the CMDB hand-off keep the last state. Reversible: turn it off.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Off: the connector writes the CI table",
|        "recommended": "Off; on only to check a change safely.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_CmdbSql_DryRun/",
|        "confirmWhen": "on",
|        "confirm": "On, the CI table is not changed and no run is recorded there; the plan is in the job's log and on the audit trail as a plan. The CMDB table is not updated while it is on: consumers of the CMDB hand-off keep the last state. Reversible: turn it off."
|      }
|    },
|    {
|      "name": "SI_Pro_CmdbSql_Enabled",
|      "label": "SQL CMDB connector",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On when a Pro database is configured",
|      "description": "THE SQL CMDB CONNECTOR: writes every asset SecurityInsight knows (one row per asset, with its tier, department, owner, business services, identifiers and history) into the CI table of the Pro database (cmdbsync.ConfigurationItem, and the view cmdbsync.vConfigurationItem for Power BI). On by default when there is a Pro database; $false switches it off.",
|      "purpose": "Writes every asset SecurityInsight knows into a CI table in the Pro database (one row per asset with its tier, department, owner, business services, identifiers and change history), for reporting and Power BI.",
|      "effect": "Off, the CMDB connector job ends at once and the CI table keeps what it last held; nothing is deleted. On, each run creates new CIs, updates changed ones and retires CIs that are gone.",
|      "whenToChange": "Turn off only if you do not want the CI table kept up to date.",
|      "card": "SQL CMDB connector",
|      "info": {
|        "what": "Writes every asset SecurityInsight knows into a CI table in the Pro database (one row per asset with its tier, department, owner, business services, identifiers and change history), for reporting and Power BI.",
|        "whenOn": "when a Pro database is configured",
|        "whenOff": "Off, the CMDB connector job ends at once and the CI table keeps what it last held; nothing is deleted. On, each run creates new CIs, updates changed ones and retires CIs that are gone.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "On when a Pro database is configured",
|        "recommended": "Keep the default. Change it when: Turn off only if you do not want the CI table kept up to date.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_CmdbSql_Enabled/"
|      }
|    },
|    {
|      "name": "SI_Pro_CmdbSql_Kinds",
|      "label": "Asset kinds written as CIs",
|      "group": "Data & retention",
|      "type": "list",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "endpoint and azure",
|      "description": "Which kinds of asset become CIs: 'endpoint' (devices), 'azure' (Azure resources) and, if you want them, 'publicip'. Identities are never written as CIs.",
|      "purpose": "Which kinds of asset the SQL CMDB connector writes to the CI table: endpoint (devices), azure (Azure resources) and publicip (public IP addresses).",
|      "effect": "A kind you add gets its CIs on the next run. CIs of a kind you remove are kept as they are (not retired). Identities are never written as CIs; unknown values are ignored.",
|      "whenToChange": "Add publicip if you want public IP addresses in the CI table as well.",
|      "card": "SQL CMDB connector",
|      "info": {
|        "what": "Which kinds of asset the SQL CMDB connector writes to the CI table: endpoint (devices), azure (Azure resources) and publicip (public IP addresses).",
|        "whenChanged": "A kind you add gets its CIs on the next run. CIs of a kind you remove are kept as they are (not retired). Identities are never written as CIs; unknown values are ignored.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "endpoint and azure",
|        "recommended": "Keep the default. Change it when: Add publicip if you want public IP addresses in the CI table as well.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_CmdbSql_Kinds/"
|      }
|    },
|    {
|      "name": "SI_Pro_CmdbSql_RetireAfterRuns",
|      "label": "Runs before a CI is retired",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "2 runs",
|      "description": "How many complete runs in a row an asset must be missing before its CI is retired (kept, never deleted). Each new snapshot counts once; a run that reads the same snapshot again counts nothing. Default 2, at least 1.",
|      "purpose": "How many complete runs in a row an asset must be missing before the SQL CMDB connector retires its CI.",
|      "effect": "Higher keeps CIs of assets that drop out now and then, but marks really removed assets as retired later. A retired CI is kept with its history and comes back if the asset is seen again. A run that reads the same snapshot as the last one does not count. Below 1 is raised to 1; non-numbers use 2.",
|      "whenToChange": "Raise it if CIs are retired and reactivated for assets that are still there.",
|      "unit": "runs",
|      "min": 1,
|      "card": "SQL CMDB connector",
|      "info": {
|        "what": "How many complete runs in a row an asset must be missing before the SQL CMDB connector retires its CI.",
|        "whenChanged": "Higher keeps CIs of assets that drop out now and then, but marks really removed assets as retired later. A retired CI is kept with its history and comes back if the asset is seen again. A run that reads the same snapshot as the last one does not count. Below 1 is raised to 1; non-numbers use 2.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "2 runs",
|        "recommended": "Keep the default. Change it when: Raise it if CIs are retired and reactivated for assets that are still there.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_CmdbSql_RetireAfterRuns/"
|      }
|    },
|    {
|      "name": "SI_Pro_CmdbSql_SeenWithinDays",
|      "label": "CI seen-window",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "8 days",
|      "description": "An asset counts as present when its profile was published within this many days. Low tiers are re-profiled weekly, so keep it above the slowest tier's re-check interval. Default 8, at least 1.",
|      "purpose": "How recently an asset's profile must have been published for the SQL CMDB connector to count the asset as present.",
|      "effect": "Shorter notices removed assets sooner but can count low-tier assets as missing, because they are re-profiled only weekly. A kind whose newest snapshot is older than this is not used at all and the run changes nothing. Below 1 is raised to 1.",
|      "whenToChange": "Only if you changed how often low-tier assets are re-profiled; keep it above the slowest re-check interval.",
|      "unit": "days",
|      "min": 1,
|      "info": {
|        "what": "How recently an asset's profile must have been published for the SQL CMDB connector to count the asset as present.",
|        "whenChanged": "Shorter notices removed assets sooner but can count low-tier assets as missing, because they are re-profiled only weekly. A kind whose newest snapshot is older than this is not used at all and the run changes nothing. Below 1 is raised to 1.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "8 days",
|        "recommended": "Keep the default. Change it when: Only if you changed how often low-tier assets are re-profiled; keep it above the slowest re-check interval.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_CmdbSql_SeenWithinDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_ConfigBackupRetentionDays",
|      "label": "Configuration backups kept (days)",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "90 days",
|      "description": "Days the configuration backups are kept (the daily backup job and Back up now; Configuration > Backups (restore)). Default 90, at least 1. A pinned backup is kept until it is unpinned; removals are recorded on the audit trail.",
|      "purpose": "How many days the configuration backups are kept (the daily backup and Back up now).",
|      "effect": "The backup job removes backups older than this, except pinned ones and a backup whose content a newer one points at; each removal is recorded on the audit trail. A day without changes is recorded as no change, not copied again.",
|      "whenToChange": "When your policy needs backups for a longer or shorter time. The change journal is always kept at least this long.",
|      "unit": "days",
|      "min": 1,
|      "card": "How long data is kept",
|      "info": {
|        "what": "How many days the configuration backups are kept (the daily backup and Back up now).",
|        "whenChanged": "The backup job removes backups older than this, except pinned ones and a backup whose content a newer one points at; each removal is recorded on the audit trail. A day without changes is recorded as no change, not copied again.",
|        "risk": "A shorter value deletes older configuration backups at the next backup run (pinned ones are kept). Cannot be undone.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "90 days",
|        "recommended": "90 days.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_ConfigBackupRetentionDays/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter value deletes older configuration backups at the next backup run (pinned ones are kept). Cannot be undone."
|      }
|    },
|    {
|      "name": "SI_Pro_ConfigJournalRetentionDays",
|      "label": "Change journal kept (days)",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "not set: the change journal is kept forever",
|      "description": "Days the change journal (every configuration change, record by record -- what undo and restore are built on) keeps its rows. Not set = kept forever (the default). Never shorter than the backup retention: a shorter value is refused and the journal is kept.",
|      "purpose": "How many days the change journal keeps its rows -- every configuration change, record by record, that undo and restore are built on.",
|      "effect": "When set, the backup job removes journal rows older than this and records that on the audit trail. It can never be shorter than the backup retention: a shorter value is refused and the journal is kept, because an undo needs its evidence.",
|      "whenToChange": "Only when your retention policy requires configuration history to be removed after a period.",
|      "unit": "days",
|      "min": 1,
|      "info": {
|        "what": "How many days the change journal keeps its rows -- every configuration change, record by record, that undo and restore are built on.",
|        "whenChanged": "When set, the backup job removes journal rows older than this and records that on the audit trail. It can never be shorter than the backup retention: a shorter value is refused and the journal is kept, because an undo needs its evidence.",
|        "risk": "Setting it, or lowering it, deletes older change-journal rows at the next backup run. Cannot be undone.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "not set: the change journal is kept forever",
|        "recommended": "Not set (keep the journal).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_ConfigJournalRetentionDays/",
|        "confirmWhen": "lower",
|        "confirm": "Setting it, or lowering it, deletes older change-journal rows at the next backup run. Cannot be undone."
|      }
|    },
|    {
|      "name": "SI_Pro_DataLookbackDays",
|      "label": "Pro data sync look-back",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "3 days",
|      "description": "Days of Log Analytics the data sync looks back for complete runs it has not copied yet.",
|      "purpose": "How many days back in Log Analytics the Pro data sync looks for complete runs it has not copied yet.",
|      "effect": "A longer look-back catches up after longer outages but makes each sync query more data and take longer. Too short can leave runs from a long outage uncopied. A value below 1 or not a whole number stops the sync.",
|      "whenToChange": "Raise it temporarily after the sync has been down for more than a few days.",
|      "unit": "days",
|      "min": 1,
|      "info": {
|        "what": "How many days back in Log Analytics the Pro data sync looks for complete runs it has not copied yet.",
|        "whenChanged": "A longer look-back catches up after longer outages but makes each sync query more data and take longer. Too short can leave runs from a long outage uncopied. A value below 1 or not a whole number stops the sync.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "3 days",
|        "recommended": "Keep the default. Change it when: Raise it temporarily after the sync has been down for more than a few days.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataLookbackDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataQuality_AssetDropPercent",
|      "label": "Data quality: asset drop",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "30 %",
|      "description": "Assets (per source, active CIs): warn when down this many percent or more from the median of the last 3 runs.",
|      "purpose": "When the assets of a source (Defender for Endpoint, Entra ID, Azure, public IPs) or the active CIs fall this many percent or more below the median of the last 3 runs, it is shown as a data-quality warning.",
|      "effect": "Lower warns about smaller drops; higher only about large ones. A warning never blocks anything.",
|      "whenToChange": "Raise it when the number of assets moves a lot from day to day on purpose.",
|      "unit": "%",
|      "min": 1,
|      "max": 100,
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "When the assets of a source (Defender for Endpoint, Entra ID, Azure, public IPs) or the active CIs fall this many percent or more below the median of the last 3 runs, it is shown as a data-quality warning.",
|        "whenChanged": "Lower warns about smaller drops; higher only about large ones. A warning never blocks anything.",
|        "risk": "Only changes when a data-quality WARNING is shown and mailed; nothing is ever held or stopped by it. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "30 %",
|        "recommended": "Keep the default. Change it when: Raise it when the number of assets moves a lot from day to day on purpose.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataQuality_AssetDropPercent/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataQuality_FillDropPoints",
|      "label": "Data quality: column fill drop",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "30 points",
|      "description": "A key column's fill (risk factors, tier, owner, asset type, SQL tag): warn when down this many percentage points or more.",
|      "purpose": "When the share of rows that carry a key value -- the probability and consequence risk factors, the tier, the SQL tag, and the CIs' asset type and owner -- falls this many percentage points or more below the median of the last 3 runs, it is shown as a data-quality warning.",
|      "effect": "Lower warns about smaller drops in fill; higher only about large ones. A warning never blocks anything.",
|      "whenToChange": "Lower it if you want to hear early about owners or factors going missing.",
|      "unit": "points",
|      "min": 1,
|      "max": 100,
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "When the share of rows that carry a key value -- the probability and consequence risk factors, the tier, the SQL tag, and the CIs' asset type and owner -- falls this many percentage points or more below the median of the last 3 runs, it is shown as a data-quality warning.",
|        "whenChanged": "Lower warns about smaller drops in fill; higher only about large ones. A warning never blocks anything.",
|        "risk": "Only changes when a data-quality WARNING is shown and mailed; nothing is ever held or stopped by it. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "30 points",
|        "recommended": "Keep the default. Change it when: Lower it if you want to hear early about owners or factors going missing.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataQuality_FillDropPoints/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataQuality_Mail_Enabled",
|      "label": "Data-quality mail",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "Every pipeline run stores its key numbers (assets per source, rows per Risk Analysis report, fill of the key columns, CIs per tier, active CIs, CIs to retire) and compares each with the median of the last 3 runs. A number off its range is shown on the Data quality panel and in the run health -- it never blocks anything. ONE mail a day, only when a number is off. On by default.",
|      "purpose": "One mail a day when a key number of the latest pipeline run is far off its usual range -- for example far fewer assets, a report with no rows, or risk factors suddenly missing.",
|      "effect": "Off sends no data-quality mail: the warnings are still shown on Operations > Data quality and in Run health. Nothing is ever blocked by them either way.",
|      "whenToChange": "Leave it on. Turn it off only if another system already watches these numbers for you.",
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "One mail a day when a key number of the latest pipeline run is far off its usual range -- for example far fewer assets, a report with no rows, or risk factors suddenly missing.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "Off sends no data-quality mail: the warnings are still shown on Operations > Data quality and in Run health. Nothing is ever blocked by them either way.",
|        "risk": "Off: nobody is mailed when a key number of a run is far off its usual range; the warnings are still on the Data quality panel and in Run health. Nothing is ever held or stopped by them. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "On",
|        "recommended": "Keep the default. Change it when: Leave it on. Turn it off only if another system already watches these numbers for you.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataQuality_Mail_Enabled/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataQuality_Mail_To",
|      "label": "Data-quality mail recipients",
|      "group": "Guards (safety checks)",
|      "type": "list",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "The safety-check mail recipients (SI_GuardMail_To); without those the report recipients (MailTo), else the SecurityInsight Pro SuperAdmins",
|      "description": "Who gets the data-quality mail. Default: the safety-check mail recipients (SI_GuardMail_To), else MailTo, else the SuperAdmins.",
|      "purpose": "The addresses that receive the daily data-quality mail.",
|      "effect": "These addresses get the data-quality mail instead of the default recipients.",
|      "whenToChange": "Set it to the people who change SecurityInsight's settings, so a setting that caused a drop is corrected quickly.",
|      "card": "Data-quality warnings",
|      "hint": "Empty: the safety-check mail recipients.",
|      "needs": "SI_Pro_DataQuality_Mail_Enabled",
|      "itemFormat": "email",
|      "info": {
|        "what": "The addresses that receive the daily data-quality mail.",
|        "whenChanged": "These addresses get the data-quality mail instead of the default recipients.",
|        "risk": "A wrong address means the daily data-quality mail reaches the wrong people or nobody; nothing is held or stopped. Reversible at once.",
|        "requires": "Works only while \"Data-quality mail\" is on. A SecurityInsight Pro licence.",
|        "default": "The safety-check mail recipients (SI_GuardMail_To); without those the report recipients (MailTo), else the SecurityInsight Pro SuperAdmins",
|        "recommended": "Keep the default. Change it when: Set it to the people who change SecurityInsight's settings, so a setting that caused a drop is corrected quickly.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataQuality_Mail_To/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataQuality_ReportDropPercent",
|      "label": "Data quality: report drop",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "50 %",
|      "description": "A Risk Analysis report: warn when it has 0 rows, or is down this many percent or more.",
|      "purpose": "When a Risk Analysis report has 0 rows, or falls this many percent or more below the median of the last 3 runs, it is shown as a data-quality warning -- the sign of a query that suddenly returns nothing.",
|      "effect": "Lower warns about smaller drops; higher only about large ones. A report at 0 rows always warns. A warning never blocks anything.",
|      "whenToChange": "Raise it when your reports shrink a lot on purpose (a large remediation round).",
|      "unit": "%",
|      "min": 1,
|      "max": 100,
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "When a Risk Analysis report has 0 rows, or falls this many percent or more below the median of the last 3 runs, it is shown as a data-quality warning -- the sign of a query that suddenly returns nothing.",
|        "whenChanged": "Lower warns about smaller drops; higher only about large ones. A report at 0 rows always warns. A warning never blocks anything.",
|        "risk": "Only changes when a data-quality WARNING is shown and mailed; nothing is ever held or stopped by it. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "50 %",
|        "recommended": "Keep the default. Change it when: Raise it when your reports shrink a lot on purpose (a large remediation round).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataQuality_ReportDropPercent/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataQuality_TierShiftPercent",
|      "label": "Data quality: tier shift",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "20 % of all active CIs",
|      "description": "A tier: warn when it moved by this share of all active CIs or more (up or down); also CIs to retire rising by it.",
|      "purpose": "When the active CIs in a tier (0 to 3) change by this share of all active CIs or more compared with the median of the last 3 runs -- or the CIs about to retire rise by it -- it is shown as a data-quality warning. The typical cause: a customised rule that moved all servers to one tier.",
|      "effect": "Lower warns about smaller moves between tiers; higher only about large ones. A warning never blocks anything.",
|      "whenToChange": "Raise it while you re-tier your estate on purpose.",
|      "unit": "%",
|      "min": 1,
|      "max": 100,
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "When the active CIs in a tier (0 to 3) change by this share of all active CIs or more compared with the median of the last 3 runs -- or the CIs about to retire rise by it -- it is shown as a data-quality warning. The typical cause: a customised rule that moved all servers to one tier.",
|        "whenChanged": "Lower warns about smaller moves between tiers; higher only about large ones. A warning never blocks anything.",
|        "risk": "Only changes when a data-quality WARNING is shown and mailed; nothing is ever held or stopped by it. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "20 % of all active CIs",
|        "recommended": "Keep the default. Change it when: Raise it while you re-tier your estate on purpose.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataQuality_TierShiftPercent/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataRetentionDays",
|      "label": "Pro data retention",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "90 days",
|      "description": "Days of run data the Pro database keeps (findings, assets, daily aggregates); older collections are purged. Default 90, at least 1. The vulnerability current state and the identity ledger are never purged.",
|      "purpose": "How many days of run data (findings, assets, daily aggregates) the Pro database keeps before older collections are removed.",
|      "effect": "Longer keeps more history for trends but grows the database and its cost; shorter purges history permanently. Current vulnerability state and the identity ledger are never purged. An invalid value stops the sync.",
|      "whenToChange": "Change it when you need longer history for reporting or must limit database size.",
|      "unit": "days",
|      "min": 1,
|      "card": "How long data is kept",
|      "info": {
|        "what": "How many days of run data (findings, assets, daily aggregates) the Pro database keeps before older collections are removed.",
|        "whenChanged": "Longer keeps more history for trends but grows the database and its cost; shorter purges history permanently. Current vulnerability state and the identity ledger are never purged. An invalid value stops the sync.",
|        "risk": "A shorter value PERMANENTLY deletes older history (trends, past collections) at the next sync; current state is kept. Cannot be undone. Longer grows the database and its cost.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "90 days",
|        "recommended": "Keep 90 days or longer for trends across quarters.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataRetentionDays/",
|        "confirmWhen": "lower",
|        "confirm": "A shorter value PERMANENTLY deletes older history (trends, past collections) at the next sync; current state is kept. Cannot be undone. Longer grows the database and its cost."
|      }
|    },
|    {
|      "name": "SI_Pro_DataSqlDatabase",
|      "label": "Pro data sync database",
|      "group": "Data & retention",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Same database as SI_ProSqlDatabase",
|      "description": "The SQL database the data sync writes to (default: SI_ProSqlDatabase).",
|      "purpose": "The SQL database the Pro data sync writes run data to, when it should differ from the Pro settings database.",
|      "effect": "Points the data sync, the close-loop mail and data setup at another database. Without any Pro database configured the data sync job is skipped.",
|      "whenToChange": "Only when you deliberately keep run data in a separate database from the Pro settings.",
|      "info": {
|        "what": "The SQL database the Pro data sync writes run data to, when it should differ from the Pro settings database.",
|        "whenChanged": "Points the data sync, the close-loop mail and data setup at another database. Without any Pro database configured the data sync job is skipped.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Same database as SI_ProSqlDatabase",
|        "recommended": "Keep the default. Change it when: Only when you deliberately keep run data in a separate database from the Pro settings.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataSqlDatabase/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataSqlServer",
|      "label": "Pro data sync SQL server",
|      "group": "Data & retention",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Same server as SI_ProSqlServer",
|      "description": "The SQL server the data sync writes to (default: SI_ProSqlServer, the Pro settings database's server).",
|      "purpose": "The SQL server the Pro data sync writes run data to, when it should differ from the Pro settings database's server.",
|      "effect": "Points the data sync (and the close-loop mail's data source) at another server; the identity must have access there. Without any Pro database configured the data sync job is skipped.",
|      "whenToChange": "Only when run data lives on a different SQL server than the Pro settings.",
|      "info": {
|        "what": "The SQL server the Pro data sync writes run data to, when it should differ from the Pro settings database's server.",
|        "whenChanged": "Points the data sync (and the close-loop mail's data source) at another server; the identity must have access there. Without any Pro database configured the data sync job is skipped.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Same server as SI_ProSqlServer",
|        "recommended": "Keep the default. Change it when: Only when run data lives on a different SQL server than the Pro settings.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataSqlServer/"
|      }
|    },
|    {
|      "name": "SI_Pro_DataSync_DryRun",
|      "label": "Pro data sync dry run",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: the data sync writes to the database",
|      "description": "Plan the data sync (what would be copied and purged) without writing to SQL.",
|      "purpose": "Makes the Pro data sync plan what it would copy and purge without writing anything to SQL.",
|      "effect": "On, no run data reaches the Pro database and nothing is purged, so Pro pages stop getting new data. Useful to check a new setup safely.",
|      "whenToChange": "Turn on briefly when testing a new database setup; turn off again afterwards.",
|      "info": {
|        "what": "Makes the Pro data sync plan what it would copy and purge without writing anything to SQL.",
|        "whenOn": "On, no run data reaches the Pro database and nothing is purged, so Pro pages stop getting new data. Useful to check a new setup safely.",
|        "whenOff": "the data sync writes to the database",
|        "risk": "No run data reaches the Pro database: the web app's pages stop getting new data while it is on. Reversible: turn it off; the next sync catches up within its look-back.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Off: the data sync writes to the database",
|        "recommended": "Off; on only to check a new setup safely.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DataSync_DryRun/",
|        "confirmWhen": "on",
|        "confirm": "On, no run data reaches the Pro database and nothing is purged, so Pro pages stop getting new data. Useful to check a new setup safely. No run data reaches the Pro database: the web app's pages stop getting new data while it is on. Reversible: turn it off; the next sync catches up within its look-back."
|      }
|    },
|    {
|      "name": "SI_Pro_DepartmentReport_DayOfMonth",
|      "label": "Monthly report day",
|      "group": "Mail & notifications",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "1",
|      "description": "The day of the month (1 to 28) from which the monthly report for the previous month is sent.",
|      "purpose": "The day of the month from which the report for the previous month is sent.",
|      "effect": "The report goes out on the first daily run on or after this day; a day the mail relay fails is retried the next day.",
|      "whenToChange": "When the previous month's data settles later (for example after a monthly patch window).",
|      "unit": "day of the month (1-28)",
|      "card": "Mails to departments",
|      "needs": "SI_Pro_DepartmentReport_SendMail",
|      "info": {
|        "what": "The day of the month from which the report for the previous month is sent.",
|        "whenChanged": "The report goes out on the first daily run on or after this day; a day the mail relay fails is retried the next day.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"Monthly report to business owners\" is on. A SecurityInsight Pro licence.",
|        "default": "1",
|        "recommended": "Keep the default. Change it when: When the previous month's data settles later (for example after a monthly patch window).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DepartmentReport_DayOfMonth/"
|      }
|    },
|    {
|      "name": "SI_Pro_DepartmentReport_SendMail",
|      "label": "Monthly report to business owners",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "off",
|      "description": "Send each department's business owners a monthly status mail (their assets and services, with a link to the department page). Off by default. Sent by the close-loop mail job through the same relay as the Risk Analysis mail.",
|      "purpose": "Sends each department's business owners a monthly mail with the status of their assets and services.",
|      "effect": "When on, the daily close-loop mail job sends each department its report for the previous month from the chosen day on, once per month, through the same mail relay as the Risk Analysis mail. Departments without a business owner with a mail address get none.",
|      "whenToChange": "Once departments and their business owners are set up.",
|      "card": "Mails to departments",
|      "info": {
|        "what": "Sends each department's business owners a monthly mail with the status of their assets and services.",
|        "whenOn": "When on, the daily close-loop mail job sends each department its report for the previous month from the chosen day on, once per month, through the same mail relay as the Risk Analysis mail. Departments without a business owner with a mail address get none.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "off",
|        "recommended": "Keep the default. Change it when: Once departments and their business owners are set up.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_DepartmentReport_SendMail/"
|      }
|    },
|    {
|      "name": "SI_Pro_FindingSla_CriticalDays",
|      "label": "Days to fix a critical finding",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "15 days",
|      "description": "--- Findings per CI: the days a finding has to be fixed, per severity (its due date; 0 = no due date) ---",
|      "purpose": "How many days a critical finding has to be fixed, counted from when it was first found (or found again after it was fixed).",
|      "effect": "Sets the due date of every critical finding. A finding past its due date is shown as overdue on the CI page, the service views and the trend. 0 = critical findings have no due date.",
|      "whenToChange": "Set it to the deadline your security policy gives critical findings.",
|      "unit": "days",
|      "min": 0,
|      "max": 3650,
|      "info": {
|        "what": "How many days a critical finding has to be fixed, counted from when it was first found (or found again after it was fixed).",
|        "whenChanged": "Sets the due date of every critical finding. A finding past its due date is shown as overdue on the CI page, the service views and the trend. 0 = critical findings have no due date.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "15 days",
|        "recommended": "Keep the default. Change it when: Set it to the deadline your security policy gives critical findings.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_FindingSla_CriticalDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_FindingSla_HighDays",
|      "label": "Days to fix a high finding",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "30 days",
|      "description": "the days a high finding has to be fixed (0 = no due date)",
|      "purpose": "How many days a high finding has to be fixed, counted from when it was first found (or found again after it was fixed).",
|      "effect": "Sets the due date of every high finding. A finding past its due date is shown as overdue. 0 = high findings have no due date.",
|      "whenToChange": "Set it to the deadline your security policy gives high findings.",
|      "unit": "days",
|      "min": 0,
|      "max": 3650,
|      "info": {
|        "what": "How many days a high finding has to be fixed, counted from when it was first found (or found again after it was fixed).",
|        "whenChanged": "Sets the due date of every high finding. A finding past its due date is shown as overdue. 0 = high findings have no due date.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "30 days",
|        "recommended": "Keep the default. Change it when: Set it to the deadline your security policy gives high findings.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_FindingSla_HighDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_FindingSla_LowDays",
|      "label": "Days to fix a low finding",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "180 days",
|      "description": "the days a low finding has to be fixed (0 = no due date)",
|      "purpose": "How many days a low finding has to be fixed, counted from when it was first found (or found again after it was fixed).",
|      "effect": "Sets the due date of every low finding. A finding past its due date is shown as overdue. 0 = low findings have no due date.",
|      "whenToChange": "Set it to the deadline your security policy gives low findings.",
|      "unit": "days",
|      "min": 0,
|      "max": 3650,
|      "info": {
|        "what": "How many days a low finding has to be fixed, counted from when it was first found (or found again after it was fixed).",
|        "whenChanged": "Sets the due date of every low finding. A finding past its due date is shown as overdue. 0 = low findings have no due date.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "180 days",
|        "recommended": "Keep the default. Change it when: Set it to the deadline your security policy gives low findings.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_FindingSla_LowDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_FindingSla_MediumDays",
|      "label": "Days to fix a medium finding",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "90 days",
|      "description": "the days a medium finding has to be fixed (0 = no due date)",
|      "purpose": "How many days a medium finding has to be fixed, counted from when it was first found (or found again after it was fixed).",
|      "effect": "Sets the due date of every medium finding. A finding past its due date is shown as overdue. 0 = medium findings have no due date.",
|      "whenToChange": "Set it to the deadline your security policy gives medium findings.",
|      "unit": "days",
|      "min": 0,
|      "max": 3650,
|      "info": {
|        "what": "How many days a medium finding has to be fixed, counted from when it was first found (or found again after it was fixed).",
|        "whenChanged": "Sets the due date of every medium finding. A finding past its due date is shown as overdue. 0 = medium findings have no due date.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "90 days",
|        "recommended": "Keep the default. Change it when: Set it to the deadline your security policy gives medium findings.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_FindingSla_MediumDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_FindingStateRetentionDays",
|      "label": "Closed finding history kept",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "365 days",
|      "description": "closed findings' lifecycle rows (open ones are never removed)",
|      "purpose": "How many days a closed finding's lifecycle row (first detected, closed, close reason) is kept in the Pro database.",
|      "effect": "Closed lifecycle rows older than this are removed after each data sync; open findings are never removed.",
|      "whenToChange": "Lengthen it when you report on fixes over a longer period.",
|      "unit": "days",
|      "min": 1,
|      "info": {
|        "what": "How many days a closed finding's lifecycle row (first detected, closed, close reason) is kept in the Pro database.",
|        "whenChanged": "Closed lifecycle rows older than this are removed after each data sync; open findings are never removed.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "365 days",
|        "recommended": "Keep the default. Change it when: Lengthen it when you report on fixes over a longer period.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_FindingStateRetentionDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_GovernanceNotify_MinSeverity",
|      "label": "New-findings digest: lowest severity",
|      "group": "Mail & notifications",
|      "type": "enum",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "High -- critical and high findings",
|      "description": "The lowest severity the technical owners' digest announces: Critical, High, Medium or Low.",
|      "purpose": "The lowest severity the technical owners' digest announces (Critical, High, Medium or Low).",
|      "effect": "Findings below this severity are not announced (they are still on the department page and in the monthly review).",
|      "whenToChange": "Lower it for a team that wants to hear about every new finding; raise it to Critical when the digest is too long.",
|      "values": [
|        "Critical",
|        "High",
|        "Medium",
|        "Low"
|      ],
|      "valueLabels": {
|        "Critical": "Critical only",
|        "High": "High and critical",
|        "Medium": "Medium and up",
|        "Low": "Every severity"
|      },
|      "card": "Mails to departments",
|      "needs": "SI_Pro_GovernanceNotify_SendMail",
|      "info": {
|        "what": "The lowest severity the technical owners' digest announces (Critical, High, Medium or Low).",
|        "whenChanged": "Findings below this severity are not announced (they are still on the department page and in the monthly review).",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"New-findings digest to technical owners\" is on. A SecurityInsight Pro licence.",
|        "default": "High -- critical and high findings",
|        "recommended": "Keep the default. Change it when: Lower it for a team that wants to hear about every new finding; raise it to Critical when the digest is too long.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_GovernanceNotify_MinSeverity/"
|      }
|    },
|    {
|      "name": "SI_Pro_GovernanceNotify_Mode",
|      "label": "New-findings digest: one row per",
|      "group": "Mail & notifications",
|      "type": "enum",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "vulnerability",
|      "description": "How the technical owners' digest lists the new findings: 'vulnerability' (one row per finding) or 'asset' (one row per asset).",
|      "purpose": "How the technical owners' digest lists what is new: one row per vulnerability, or one row per asset with how many new findings it has and the highest severity.",
|      "effect": "Only the layout of the digest changes; it is still one mail per department per collection, listing the 50 most severe rows with the rest counted.",
|      "whenToChange": "Choose asset when the team works machine by machine (for example a server team patching hosts), vulnerability when it works issue by issue.",
|      "values": [
|        "vulnerability",
|        "asset"
|      ],
|      "valueLabels": {
|        "vulnerability": "Vulnerability",
|        "asset": "Asset"
|      },
|      "card": "Mails to departments",
|      "needs": "SI_Pro_GovernanceNotify_SendMail",
|      "info": {
|        "what": "How the technical owners' digest lists what is new: one row per vulnerability, or one row per asset with how many new findings it has and the highest severity.",
|        "whenChanged": "Only the layout of the digest changes; it is still one mail per department per collection, listing the 50 most severe rows with the rest counted.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"New-findings digest to technical owners\" is on. A SecurityInsight Pro licence.",
|        "default": "vulnerability",
|        "recommended": "Keep the default. Change it when: Choose asset when the team works machine by machine (for example a server team patching hosts), vulnerability when it works issue by issue.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_GovernanceNotify_Mode/"
|      }
|    },
|    {
|      "name": "SI_Pro_GovernanceNotify_SendMail",
|      "label": "New-findings digest to technical owners",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "off",
|      "description": "GOVERNANCE (departments, phase 2): after each data sync, send each department's technical owners ONE digest of the findings that are new for the department. Off by default. Sent by the close-loop mail job through the same relay as the Risk Analysis mail.",
|      "purpose": "After each data sync, sends each department's technical owners one mail with their new findings.",
|      "effect": "When on, the daily close-loop mail job compares the newest collection with the last one each department was told about and sends one digest per department (nothing new means no mail), through the same mail relay as the Risk Analysis mail. Each collection is announced once per department; the very first collection is only recorded as the starting point. Departments without a technical owner with a mail address get none.",
|      "whenToChange": "Once departments and their technical owners are set up and they want to hear about new findings without opening the web app.",
|      "card": "Mails to departments",
|      "info": {
|        "what": "After each data sync, sends each department's technical owners one mail with their new findings.",
|        "whenOn": "When on, the daily close-loop mail job compares the newest collection with the last one each department was told about and sends one digest per department (nothing new means no mail), through the same mail relay as the Risk Analysis mail. Each collection is announced once per department; the very first collection is only recorded as the starting point. Departments without a technical owner with a mail address get none.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "off",
|        "recommended": "Keep the default. Change it when: Once departments and their technical owners are set up and they want to hear about new findings without opening the web app.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_GovernanceNotify_SendMail/"
|      }
|    },
|    {
|      "name": "SI_Pro_HiddenViews",
|      "label": "Hidden named views",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "list",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "None hidden: every shipped view is in the picker",
|      "description": "The shipped named views hidden from the view picker of Security recommendations > Summary and Detailed, for everyone: critical-high, tier0, cve, exploited, mitre, compliance, cvss (summary:<view> / detailed:<view> = one page). Default none.",
|      "purpose": "The named views SecurityInsight ships for Security recommendations, Summary and Detailed (Critical and High, On Tier 0, Vulnerabilities (CVE), Known exploited, MITRE, Compliance, CVSS) that are hidden from the view picker for everyone.",
|      "effect": "A view on the list is no longer offered in the picker of either page (critical-high, tier0, cve, exploited, mitre, compliance, cvss); summary:<view> or detailed:<view> hides it on one page only. Its address still opens it. The findings are unchanged.",
|      "whenToChange": "Hide a view your organisation does not use, so the picker shows only the ones people need.",
|      "card": "Named views",
|      "info": {
|        "what": "The named views SecurityInsight ships for Security recommendations, Summary and Detailed (Critical and High, On Tier 0, Vulnerabilities (CVE), Known exploited, MITRE, Compliance, CVSS) that are hidden from the view picker for everyone.",
|        "whenChanged": "A view on the list is no longer offered in the picker of either page (critical-high, tier0, cve, exploited, mitre, compliance, cvss); summary:<view> or detailed:<view> hides it on one page only. Its address still opens it. The findings are unchanged.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "None hidden: every shipped view is in the picker",
|        "recommended": "Keep the default. Change it when: Hide a view your organisation does not use, so the picker shows only the ones people need.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_HiddenViews/"
|      }
|    },
|    {
|      "name": "SI_Pro_LifecycleStaleOpenRepair",
|      "label": "One-time repair of stale finding records",
|      "group": "Guards (safety checks)",
|      "type": "enum",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "off -- nothing is changed",
|      "description": "REMOVE-ME once it has run everywhere: the one-time repair of finding lifecycle rows left open or mislabelled before the empty-CI-id fix. off = nothing (the default); count = read only, the data sync's log says how many rows it would change and what they would become; apply = once, after a complete collection: an empty CI id becomes none, and a finding still open under an old asset key that the newest collection reports open under its CI closes as rekeyed. Nothing is deleted.",
|      "purpose": "A one-time clean-up of the finding history. Before a fix of October 2026, a finding that no CI held could be closed as no longer monitored when it had only moved to a CI, and such a finding could stay open under its old asset key. This repair puts those records right once.",
|      "effect": "off: nothing. count: nothing is changed; the data sync's log says how many finding records the repair would change and what they would become. apply: once, after a complete collection -- a record whose CI id is empty gets none (nothing visible changes), and a finding still open under an old asset key that the newest collection reports open under its CI is closed as rekeyed (the same finding, now under its CI; not a fix). Nothing is deleted; every other record goes through the usual rule.",
|      "whenToChange": "Only when support asks for it: first count, then apply. It is removed in a later release once it has run everywhere.",
|      "values": [
|        "off",
|        "count",
|        "apply"
|      ],
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "A one-time clean-up of the finding history. Before a fix of October 2026, a finding that no CI held could be closed as no longer monitored when it had only moved to a CI, and such a finding could stay open under its old asset key. This repair puts those records right once.",
|        "whenChanged": "off: nothing. count: nothing is changed; the data sync's log says how many finding records the repair would change and what they would become. apply: once, after a complete collection -- a record whose CI id is empty gets none (nothing visible changes), and a finding still open under an old asset key that the newest collection reports open under its CI is closed as rekeyed (the same finding, now under its CI; not a fix). Nothing is deleted; every other record goes through the usual rule.",
|        "risk": "count changes nothing. apply changes finding records once: an empty CI id is cleared, and a finding still open under an old asset key that is open under its CI is closed as rekeyed -- its CI's own record stays open, so no finding disappears from the open list; it only stops being counted twice. Not reversible by the setting (turning it off later does not reopen them); nothing is deleted.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "off -- nothing is changed",
|        "recommended": "off; count first when support asks, then apply.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_LifecycleStaleOpenRepair/"
|      }
|    },
|    {
|      "name": "SI_Pro_Pipeline_FirstRunRestarts",
|      "label": "First collection: restarts of a failed step",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "2 restarts",
|      "description": "A new install's first collection: a step that fails or is stopped is started again at once -- it carries on from what it finished -- this many times. After that the run ends with a warning that names the step and who must act. Only the steps that collect, correlate and load the web app are started again; never a step that writes to a CMDB, to ServiceNow or to a ticket, and never after the first complete collection. 0 = a failed step is not started again.",
|      "purpose": "On a new install's first collection, a step that fails or is stopped is started again at once and carries on from what it finished, this many times. After that the run ends with a warning that names the step and who must act.",
|      "effect": "Higher tries more often before the first collection ends with a warning; 0 means a failed step is not started again. Only the steps that collect, correlate and load the web app are started again -- never a step that writes to a CMDB, to ServiceNow or to a ticket. It has no effect after the first complete collection.",
|      "whenToChange": "Leave it at 2. Set 0 only when a failed step of the first collection must be looked at before anything is started again.",
|      "unit": "restarts",
|      "min": 0,
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "On a new install's first collection, a step that fails or is stopped is started again at once and carries on from what it finished, this many times. After that the run ends with a warning that names the step and who must act.",
|        "whenChanged": "Higher tries more often before the first collection ends with a warning; 0 means a failed step is not started again. Only the steps that collect, correlate and load the web app are started again -- never a step that writes to a CMDB, to ServiceNow or to a ticket. It has no effect after the first complete collection.",
|        "risk": "0: a step that fails on a new install's first collection is not started again, so the first data arrives a run later. Higher: a step that cannot succeed is tried that many times more before the warning. Nothing is written to a CMDB, to ServiceNow or to a ticket by a restart, and nothing is closed. Reversible at once; it applies from the next run and only until the first complete collection.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "2 restarts",
|        "recommended": "Keep the default. Change it when: Leave it at 2. Set 0 only when a failed step of the first collection must be looked at before anything is started again.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_Pipeline_FirstRunRestarts/"
|      }
|    },
|    {
|      "name": "SI_Pro_Pipeline_GoOnAfterFailedStep",
|      "label": "Failed step: show what was collected all the same",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On",
|      "description": "One failed step does not cost the rest of the run: when the correlation or Risk Analysis fails after the collections completed, the data sync and the verification still run on what is stored, so the web app shows what was collected. Nothing is closed, no ticket is changed and no mail is sent from such a run, and it is marked as not complete. $false = every step after a failed one waits for the next good run, as before.",
|      "purpose": "When the correlation or Risk Analysis fails after the collections completed, the data sync and the verification still run on what is stored, so the web app shows what was collected instead of nothing. The run is marked as not complete and says what is missing.",
|      "effect": "Off holds every step after a failed one until the next good run, as before: a new install then shows nothing until its first run completes. On or off, nothing is closed, no ticket is changed and no mail is sent from a run that is not complete.",
|      "whenToChange": "Leave it on. Turn it off only if the web app must never show data of a run in which a step failed.",
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "When the correlation or Risk Analysis fails after the collections completed, the data sync and the verification still run on what is stored, so the web app shows what was collected instead of nothing. The run is marked as not complete and says what is missing.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "Off holds every step after a failed one until the next good run, as before: a new install then shows nothing until its first run completes. On or off, nothing is closed, no ticket is changed and no mail is sent from a run that is not complete.",
|        "risk": "Off: after one failed step the web app gets nothing from that run -- a new install stays empty until its first run completes. On: the web app shows what the completed collections brought, marked as not complete. Either way nothing is closed, no ticket is changed and no mail is sent from a run that is not complete. Reversible at once; it applies from the next run.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "On",
|        "recommended": "Keep the default. Change it when: Leave it on. Turn it off only if the web app must never show data of a run in which a step failed.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_Pipeline_GoOnAfterFailedStep/"
|      }
|    },
|    {
|      "name": "SI_Pro_PublishPartialRun",
|      "label": "Show a run in which a report fell back to an earlier result",
|      "group": "Guards (safety checks)",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off",
|      "description": "Every page shows ONE run: the last run that completed in full. A run in which a report could not be completed and fell back to its last complete result is not shown either, and the pages keep the last complete run. $true = show such a run, marked \"a part of this run is from an earlier result\".",
|      "purpose": "Every page shows one run: the last run that completed in full. A run in which a report could not be completed and fell back to its last complete result is not shown by default -- the pages keep the last complete run, so nothing on a page is from two runs.",
|      "effect": "On: such a run is shown, marked \"a part of this run is from an earlier result\". Off: the pages keep the last complete run until a run completes in full.",
|      "whenToChange": "Leave it off. Turn it on only when a report keeps failing and the rest of the newest run must be shown all the same.",
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "Every page shows one run: the last run that completed in full. A run in which a report could not be completed and fell back to its last complete result is not shown by default -- the pages keep the last complete run, so nothing on a page is from two runs.",
|        "whenOn": "such a run is shown, marked \"a part of this run is from an earlier result\".",
|        "whenOff": "the pages keep the last complete run until a run completes in full.",
|        "risk": "On: a run in which a report fell back to its last complete result is shown, marked -- a page can then show a part from an earlier run. Off (the default): the pages keep the last complete run until a run completes in full, so a newer result can wait a day. Nothing is closed or sent by it. Reversible at once; it applies from the next run.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Off",
|        "recommended": "Keep the default. Change it when: Leave it off. Turn it on only when a report keeps failing and the rest of the newest run must be shown all the same.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_PublishPartialRun/"
|      }
|    },
|    {
|      "name": "SI_Pro_Remediation_AutoSchedule",
|      "label": "Plan findings automatically (Auto in the maintenance window)",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "off -- findings are planned only when a person applies the flow on the finding's page",
|      "description": "REMEDIATION FLOWS (departments, phase 3): let the daily mail job plan every finding without a status whose flow is \"Auto in the maintenance window\" for the department's next window. Off by default. It records a planned state; it never changes Defender, Intune, Entra or Azure.",
|      "purpose": "Lets the daily mail job plan every finding that has no governance status yet and whose department's remediation flow is 'Auto in the maintenance window' for that department's next maintenance window.",
|      "effect": "When on, such findings get a 'planned' entry in their governance log (by SecurityInsight, with the window) and show as planned on the department page and in the technical owners' mails. SecurityInsight never pushes a change to Defender, Intune, Entra or Azure: the fix itself is made by the platform's own tooling, and the next collections show whether it worked. A department without a maintenance window gets nothing planned.",
|      "whenToChange": "Once the remediation flows and the departments' maintenance windows are set up and agreed.",
|      "card": "Overdue and planning",
|      "info": {
|        "what": "Lets the daily mail job plan every finding that has no governance status yet and whose department's remediation flow is 'Auto in the maintenance window' for that department's next maintenance window.",
|        "whenOn": "When on, such findings get a 'planned' entry in their governance log (by SecurityInsight, with the window) and show as planned on the department page and in the technical owners' mails. SecurityInsight never pushes a change to Defender, Intune, Entra or Azure: the fix itself is made by the platform's own tooling, and the next collections show whether it worked. A department without a maintenance window gets nothing planned.",
|        "whenOff": "- findings are planned only when a person applies the flow on the finding's page",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "off -- findings are planned only when a person applies the flow on the finding's page",
|        "recommended": "Keep the default. Change it when: Once the remediation flows and the departments' maintenance windows are set up and agreed.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_Remediation_AutoSchedule/"
|      }
|    },
|    {
|      "name": "SI_Pro_Responsibility_DefaultDepartment",
|      "label": "Default department",
|      "group": "Data & retention",
|      "type": "text",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "none -- such assets go to the Unassigned queue",
|      "description": "The department an asset goes to when no override, tag or rule places it. Empty = the Unassigned queue.",
|      "purpose": "The department that receives every asset no override, tag or rule places.",
|      "effect": "With a default set, nothing is Unassigned: the default department sees and is reported on every unplaced asset. Without one, unplaced assets wait in the Unassigned triage view. A name that is not an active department counts as none.",
|      "whenToChange": "When one team (for example central IT) should own everything nobody else does.",
|      "card": "Which department owns an asset",
|      "info": {
|        "what": "The department that receives every asset no override, tag or rule places.",
|        "whenChanged": "With a default set, nothing is Unassigned: the default department sees and is reported on every unplaced asset. Without one, unplaced assets wait in the Unassigned triage view. A name that is not an active department counts as none.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "none -- such assets go to the Unassigned queue",
|        "recommended": "Keep the default. Change it when: When one team (for example central IT) should own everything nobody else does.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_Responsibility_DefaultDepartment/"
|      }
|    },
|    {
|      "name": "SI_Pro_Responsibility_OverdueDays",
|      "label": "Overdue after (days, per severity)",
|      "group": "Data & retention",
|      "type": "list",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Critical=15, High=30, Medium=90, Low=180",
|      "description": "When an open vulnerability counts as OVERDUE in the business owners' monthly report: days since it was first seen, per severity.",
|      "purpose": "When an open vulnerability counts as overdue in the business owners' monthly report, counted from when it was first seen.",
|      "effect": "Only the Overdue section of the monthly report changes; nothing is closed or escalated.",
|      "whenToChange": "To match the remediation targets your organisation has agreed.",
|      "card": "Overdue and planning",
|      "info": {
|        "what": "When an open vulnerability counts as overdue in the business owners' monthly report, counted from when it was first seen.",
|        "whenChanged": "Only the Overdue section of the monthly report changes; nothing is closed or escalated.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Critical=15, High=30, Medium=90, Low=180",
|        "recommended": "Keep the default. Change it when: To match the remediation targets your organisation has agreed.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_Responsibility_OverdueDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_Responsibility_Sources",
|      "label": "Department sources, in order",
|      "group": "Data & retention",
|      "type": "list",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "tags, then rules",
|      "description": "ASSET RESPONSIBILITY (departments): where the data sync looks, in order, to decide which department an asset belongs to. 'tags' = the platform tags named below (Azure resource tags, Defender device tags, Entra attributes); 'rules' = the department rules defined on the web app (asset name, group, CMDB service, kind). Leave one out to switch it off. Overrides set on the web app always win; an asset nothing matches goes to the default department, else Unassigned.",
|      "purpose": "Where SecurityInsight looks to decide which department is responsible for an asset: the platform tags (tags) and the department rules defined on the web app (rules), in the order listed.",
|      "effect": "Changes which department owns which assets and findings. Every retained collection is re-resolved on the next data sync, so the department pages, trends and monthly reports follow the new order. Overrides set on the web app always win; an asset nothing places goes to the default department, else Unassigned. Leave a source out to switch it off.",
|      "whenToChange": "When your rules are more reliable than your tags (put rules first), or when one of the two is not used at all.",
|      "card": "Which department owns an asset",
|      "info": {
|        "what": "Where SecurityInsight looks to decide which department is responsible for an asset: the platform tags (tags) and the department rules defined on the web app (rules), in the order listed.",
|        "whenChanged": "Changes which department owns which assets and findings. Every retained collection is re-resolved on the next data sync, so the department pages, trends and monthly reports follow the new order. Overrides set on the web app always win; an asset nothing places goes to the default department, else Unassigned. Leave a source out to switch it off.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "tags, then rules",
|        "recommended": "Keep the default. Change it when: When your rules are more reliable than your tags (put rules first), or when one of the two is not used at all.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_Responsibility_Sources/"
|      }
|    },
|    {
|      "name": "SI_Pro_Responsibility_TagNames",
|      "label": "Tag names that name a department",
|      "group": "Data & retention",
|      "type": "list",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Department, Owner, CostCenter",
|      "description": "The tag names that name a department, earliest first. A tag's value matches a department by its name or one of its \"also matches\" values (e.g. a cost centre number). Defender tags count as Name:Value or Name=Value.",
|      "purpose": "The tag names whose value names the responsible department: Azure resource tags (and the subscription's), Defender device tags written as Name:Value, and the Entra Department attribute.",
|      "effect": "An asset whose tag value equals a department's name, or one of its 'also matches' values, is placed in that department; an earlier name wins over a later one. Every retained collection is re-resolved on the next data sync.",
|      "whenToChange": "When your organisation tags ownership under another name (for example BusinessUnit or cost-center).",
|      "card": "Which department owns an asset",
|      "info": {
|        "what": "The tag names whose value names the responsible department: Azure resource tags (and the subscription's), Defender device tags written as Name:Value, and the Entra Department attribute.",
|        "whenChanged": "An asset whose tag value equals a department's name, or one of its 'also matches' values, is placed in that department; an earlier name wins over a later one. Every retained collection is re-resolved on the next data sync.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Department, Owner, CostCenter",
|        "recommended": "Keep the default. Change it when: When your organisation tags ownership under another name (for example BusinessUnit or cost-center).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_Responsibility_TagNames/"
|      }
|    },
|    {
|      "name": "SI_Pro_SourceDropout_AssetDropAction",
|      "label": "Far fewer assets from a source: what to do",
|      "group": "Guards (safety checks)",
|      "type": "enum",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "confirm",
|      "description": "A collection that COMPLETES with far fewer assets than the last good one (down by SI_Pro_DataQuality_AssetDropPercent or more): confirm = keep the last good collection and accept the drop by itself when the next complete collection shows the same level (a real clean-up costs one run); accept = take it as it comes, the safety check only reports.",
|      "purpose": "What happens when a source's collection completes with far fewer assets than its last good collection (down by the data-quality asset drop limit or more). That can be a real clean-up, for example many Azure resources removed, or a source that answered only in part.",
|      "effect": "confirm: the last good collection is kept (nothing is marked not seen), the run goes on, and the drop is accepted by itself when the next complete collection of that source shows the same level -- a real clean-up takes effect one run later. accept: the collection is taken as it comes and the safety check only reports it.",
|      "whenToChange": "Set accept when large clean-ups are normal for you and must show at once.",
|      "values": [
|        "confirm",
|        "accept"
|      ],
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "What happens when a source's collection completes with far fewer assets than its last good collection (down by the data-quality asset drop limit or more). That can be a real clean-up, for example many Azure resources removed, or a source that answered only in part.",
|        "whenChanged": "confirm: the last good collection is kept (nothing is marked not seen), the run goes on, and the drop is accepted by itself when the next complete collection of that source shows the same level -- a real clean-up takes effect one run later. accept: the collection is taken as it comes and the safety check only reports it.",
|        "risk": "Accept: a source that answered only in part is taken as the truth at once -- the assets it no longer lists are marked not seen, and their CIs retire after the usual days. Confirm (the default) costs one run when a clean-up is real. Reversible at once; it applies from the next collection.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "confirm",
|        "recommended": "Keep the default. Change it when: Set accept when large clean-ups are normal for you and must show at once.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_SourceDropout_AssetDropAction/"
|      }
|    },
|    {
|      "name": "SI_Pro_SourceDropout_HoldDeliveryDays",
|      "label": "Source down: days until delivery waits",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "7 days",
|      "description": "A source whose collection fails does not stop the run: the calculation goes on with that source's last good collection, and every run says how old it is. When a source has had no good collection for this many days or more, delivery waits (no mail, no ticket change) until it collects again; the calculation still goes on. 0 = delivery never waits for a source.",
|      "purpose": "When the collection of one source (identities, Azure resources, endpoints, the public IP scan) fails, the run goes on with that source's last good collection and says how old it is. When a source has had no good collection for this many days or more, delivery waits: no mail is sent and no ticket is changed until that source collects again.",
|      "effect": "Lower makes delivery wait sooner; higher lets mails and ticket updates go out longer on older data. 0 means delivery never waits for a source. The calculation always goes on, and nothing is closed or retired because a source is down.",
|      "whenToChange": "Raise it when a source is known to be down for longer and the mails should keep going out meanwhile.",
|      "unit": "days",
|      "min": 0,
|      "max": 365,
|      "card": "Data-quality warnings",
|      "info": {
|        "what": "When the collection of one source (identities, Azure resources, endpoints, the public IP scan) fails, the run goes on with that source's last good collection and says how old it is. When a source has had no good collection for this many days or more, delivery waits: no mail is sent and no ticket is changed until that source collects again.",
|        "whenChanged": "Lower makes delivery wait sooner; higher lets mails and ticket updates go out longer on older data. 0 means delivery never waits for a source. The calculation always goes on, and nothing is closed or retired because a source is down.",
|        "risk": "Higher, or 0: mails and ticket updates keep going out although one source's data is that many days old. Lower: delivery waits sooner when a source stays down. The calculation is never held by it, and nothing is closed or retired by it. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "7 days",
|        "recommended": "Keep the default. Change it when: Raise it when a source is known to be down for longer and the mails should keep going out meanwhile.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_SourceDropout_HoldDeliveryDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_TaskDigest_DueSoonDays",
|      "label": "Task reminder: due soon means within",
|      "group": "Mail & notifications",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "7",
|      "description": "How many days ahead the task digest counts an open task as due soon (0 to 60).",
|      "purpose": "How many days ahead the daily task digest counts an open task as due soon.",
|      "effect": "An open task due within this many days (or already overdue, or whose reminder day has come) is in the assignee's digest. 0 lists only overdue tasks, tasks due today and reminders.",
|      "whenToChange": "Shorten it when people find the digest too long; lengthen it for teams that plan further ahead.",
|      "unit": "days (0-60)",
|      "card": "Task reminders",
|      "needs": "SI_Pro_TaskDigest_SendMail",
|      "info": {
|        "what": "How many days ahead the daily task digest counts an open task as due soon.",
|        "whenChanged": "An open task due within this many days (or already overdue, or whose reminder day has come) is in the assignee's digest. 0 lists only overdue tasks, tasks due today and reminders.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"Daily task reminder to assignees\" is on. A SecurityInsight Pro licence.",
|        "default": "7",
|        "recommended": "Keep the default. Change it when: Shorten it when people find the digest too long; lengthen it for teams that plan further ahead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_TaskDigest_DueSoonDays/"
|      }
|    },
|    {
|      "name": "SI_Pro_TaskDigest_SendMail",
|      "label": "Daily task reminder to assignees",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "off",
|      "description": "FOLLOW-UP TASKS: once a day, send each person who has open tasks that are overdue, due soon or whose reminder day has come ONE digest of them, with a link to each task. Off by default. Sent by the close-loop mail job through the same relay as the Risk Analysis mail.",
|      "purpose": "Once a day, mails each person whose follow-up tasks are overdue, due soon or have a reminder today.",
|      "effect": "When on, the daily close-loop mail job sends one digest per assignee per day (overdue first), through the same mail relay as the Risk Analysis mail, and records it so nobody gets two the same day; a day the relay fails is tried again on the next run. A task's mail address is the department person's or advisor's, or the one given when the task was created; a task without one gets no mail. Nobody with nothing due gets a mail.",
|      "whenToChange": "Once follow-up tasks are in use and people want a reminder without opening the web app.",
|      "card": "Task reminders",
|      "info": {
|        "what": "Once a day, mails each person whose follow-up tasks are overdue, due soon or have a reminder today.",
|        "whenOn": "When on, the daily close-loop mail job sends one digest per assignee per day (overdue first), through the same mail relay as the Risk Analysis mail, and records it so nobody gets two the same day; a day the relay fails is tried again on the next run. A task's mail address is the department person's or advisor's, or the one given when the task was created; a task without one gets no mail. Nobody with nothing due gets a mail.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "off",
|        "recommended": "Keep the default. Change it when: Once follow-up tasks are in use and people want a reminder without opening the web app.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_TaskDigest_SendMail/"
|      }
|    },
|    {
|      "name": "SI_Pro_TechnicalReview_DayOfMonth",
|      "label": "Monthly review day (technical owners)",
|      "group": "Mail & notifications",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "1",
|      "description": "The day of the month (1 to 28) from which the technical owners' review of the previous month is sent.",
|      "purpose": "The day of the month from which the technical owners' review of the previous month is sent.",
|      "effect": "The review goes out on the first daily run on or after this day; a day the mail relay fails is retried the next day.",
|      "whenToChange": "To send it after your monthly patch window, so the review shows what the window fixed.",
|      "unit": "day of the month (1-28)",
|      "card": "Mails to departments",
|      "needs": "SI_Pro_TechnicalReview_SendMail",
|      "info": {
|        "what": "The day of the month from which the technical owners' review of the previous month is sent.",
|        "whenChanged": "The review goes out on the first daily run on or after this day; a day the mail relay fails is retried the next day.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"Monthly review to technical owners\" is on. A SecurityInsight Pro licence.",
|        "default": "1",
|        "recommended": "Keep the default. Change it when: To send it after your monthly patch window, so the review shows what the window fixed.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_TechnicalReview_DayOfMonth/"
|      }
|    },
|    {
|      "name": "SI_Pro_TechnicalReview_SendMail",
|      "label": "Monthly review to technical owners",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "off",
|      "description": "Send each department's technical owners a monthly review (statuses, what is still seen after its window, what has no decision yet). Off by default. Sent by the close-loop mail job through the same relay as the Risk Analysis mail.",
|      "purpose": "Sends each department's technical owners a monthly mail to review their findings.",
|      "effect": "When on, the daily close-loop mail job sends each department its review of the previous month from the chosen day on, once per month, through the same mail relay as the Risk Analysis mail. Nothing is closed or changed by it.",
|      "whenToChange": "Once departments and their technical owners are set up and the governance log is in use.",
|      "card": "Mails to departments",
|      "info": {
|        "what": "Sends each department's technical owners a monthly mail to review their findings.",
|        "whenOn": "When on, the daily close-loop mail job sends each department its review of the previous month from the chosen day on, once per month, through the same mail relay as the Risk Analysis mail. Nothing is closed or changed by it.",
|        "whenOff": "Off is the default: none of what \"On\" describes happens.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "off",
|        "recommended": "Keep the default. Change it when: Once departments and their technical owners are set up and the governance log is in use.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Pro_TechnicalReview_SendMail/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_GraceDays_CloudResource",
|      "label": "Protection Score: accepted lifecycle for cloud resources (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30 days",
|      "description": "The protection score's accepted lifecycle for cloud resources (Azure), in days (default 30).",
|      "purpose": "The protection score's accepted lifecycle for cloud resources (Azure): how many days a Very High or High finding may be open before it counts in the \"within Accepted Lifecycle\" view.",
|      "effect": "Only a PATCH finding (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle) gets this grace; every other finding has its own (SI_ProtectionScore_OtherGraceDays_*, default 0). A cloud resource patch finding younger than this (its age: the fix's release date, else the source's first-seen, else SI's first detection) does not lower the \"within Accepted Lifecycle\" protection score; the Actual Risks view always counts it. A finding with no date always counts. 0 = both views count it at once.",
|      "whenToChange": "Your patching or remediation process gives cloud resources a different grace (for example 14 days for identities).",
|      "card": "Protection score",
|      "info": {
|        "what": "The protection score's accepted lifecycle for cloud resources (Azure): how many days a Very High or High finding may be open before it counts in the \"within Accepted Lifecycle\" view.",
|        "whenChanged": "Only a PATCH finding (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle) gets this grace; every other finding has its own (SI_ProtectionScore_OtherGraceDays_*, default 0). A cloud resource patch finding younger than this (its age: the fix's release date, else the source's first-seen, else SI's first detection) does not lower the \"within Accepted Lifecycle\" protection score; the Actual Risks view always counts it. A finding with no date always counts. 0 = both views count it at once.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "30 days",
|        "recommended": "Keep the default. Change it when: Your patching or remediation process gives cloud resources a different grace (for example 14 days for identities).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_GraceDays_CloudResource/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_GraceDays_Device",
|      "label": "Protection Score: accepted lifecycle for devices (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30 days",
|      "description": "The protection score (the share of active assets in good standing, 0-100, higher is better; the Executive overview, report, management mail and wall board): the accepted lifecycle -- days a Very High / High finding may be open before it counts in the \"within accepted lifecycle\" view -- per asset type. Default 30 each; 0 = the view equals the technical one.",
|      "purpose": "The protection score's accepted lifecycle for devices: how many days a Very High or High finding may be open before it counts in the \"within Accepted Lifecycle\" view.",
|      "effect": "Only a PATCH finding (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle) gets this grace; every other finding has its own (SI_ProtectionScore_OtherGraceDays_*, default 0). A device patch finding younger than this (its age: the fix's release date, else the source's first-seen, else SI's first detection) does not lower the \"within Accepted Lifecycle\" protection score; the Actual Risks view always counts it. A finding with no date always counts. 0 = both views count it at once.",
|      "whenToChange": "Your patching or remediation process gives devices a different grace (for example 14 days for identities).",
|      "card": "Protection score",
|      "info": {
|        "what": "The protection score's accepted lifecycle for devices: how many days a Very High or High finding may be open before it counts in the \"within Accepted Lifecycle\" view.",
|        "whenChanged": "Only a PATCH finding (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle) gets this grace; every other finding has its own (SI_ProtectionScore_OtherGraceDays_*, default 0). A device patch finding younger than this (its age: the fix's release date, else the source's first-seen, else SI's first detection) does not lower the \"within Accepted Lifecycle\" protection score; the Actual Risks view always counts it. A finding with no date always counts. 0 = both views count it at once.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "30 days",
|        "recommended": "Keep the default. Change it when: Your patching or remediation process gives devices a different grace (for example 14 days for identities).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_GraceDays_Device/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_GraceDays_Identity",
|      "label": "Protection Score: accepted lifecycle for identities (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30 days",
|      "description": "The protection score's accepted lifecycle for identities, in days (default 30).",
|      "purpose": "The protection score's accepted lifecycle for identities: how many days a Very High or High finding may be open before it counts in the \"within Accepted Lifecycle\" view.",
|      "effect": "Only a PATCH finding (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle) gets this grace; every other finding has its own (SI_ProtectionScore_OtherGraceDays_*, default 0). A identity patch finding younger than this (its age: the fix's release date, else the source's first-seen, else SI's first detection) does not lower the \"within Accepted Lifecycle\" protection score; the Actual Risks view always counts it. A finding with no date always counts. 0 = both views count it at once.",
|      "whenToChange": "Your patching or remediation process gives identities a different grace (for example 14 days for identities).",
|      "card": "Protection score",
|      "info": {
|        "what": "The protection score's accepted lifecycle for identities: how many days a Very High or High finding may be open before it counts in the \"within Accepted Lifecycle\" view.",
|        "whenChanged": "Only a PATCH finding (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle) gets this grace; every other finding has its own (SI_ProtectionScore_OtherGraceDays_*, default 0). A identity patch finding younger than this (its age: the fix's release date, else the source's first-seen, else SI's first detection) does not lower the \"within Accepted Lifecycle\" protection score; the Actual Risks view always counts it. A finding with no date always counts. 0 = both views count it at once.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "30 days",
|        "recommended": "Keep the default. Change it when: Your patching or remediation process gives identities a different grace (for example 14 days for identities).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_GraceDays_Identity/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_GraceDays_PublicIp",
|      "label": "Protection Score: accepted lifecycle for public IPs (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "30 days",
|      "description": "The protection score's accepted lifecycle for public IP addresses, in days (default 30).",
|      "purpose": "The protection score's accepted lifecycle for public IP addresses: how many days a Very High or High finding may be open before it counts in the \"within Accepted Lifecycle\" view.",
|      "effect": "Only a PATCH finding (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle) gets this grace; every other finding has its own (SI_ProtectionScore_OtherGraceDays_*, default 0). A public IP patch finding younger than this (its age: the fix's release date, else the source's first-seen, else SI's first detection) does not lower the \"within Accepted Lifecycle\" protection score; the Actual Risks view always counts it. A finding with no date always counts. 0 = both views count it at once.",
|      "whenToChange": "Your patching or remediation process gives public IPs a different grace (for example 14 days for identities).",
|      "card": "Protection score",
|      "info": {
|        "what": "The protection score's accepted lifecycle for public IP addresses: how many days a Very High or High finding may be open before it counts in the \"within Accepted Lifecycle\" view.",
|        "whenChanged": "Only a PATCH finding (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle) gets this grace; every other finding has its own (SI_ProtectionScore_OtherGraceDays_*, default 0). A public IP patch finding younger than this (its age: the fix's release date, else the source's first-seen, else SI's first detection) does not lower the \"within Accepted Lifecycle\" protection score; the Actual Risks view always counts it. A finding with no date always counts. 0 = both views count it at once.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "30 days",
|        "recommended": "Keep the default. Change it when: Your patching or remediation process gives public IPs a different grace (for example 14 days for identities).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_GraceDays_PublicIp/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_OtherGraceDays_CloudResource",
|      "label": "Protection Score: grace for Azure findings (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "0 days: it counts from the day it is found",
|      "description": "The protection score's grace for findings on cloud resources (Azure) that are not patches, in days (default 0).",
|      "purpose": "How many days a Very High or High finding on a cloud resource that is not a patch (an Azure / Defender for Cloud recommendation, an attack path) may be open before it counts in the \"within Accepted Lifecycle\" view.",
|      "effect": "0: such a finding is a risk from day one in both views. A higher number gives it a grace (its age: the source's first-seen, else SI's first detection); a finding with no date always counts.",
|      "whenToChange": "Your cloud team has an agreed time to fix recommendations (for example 30 days).",
|      "unit": "days",
|      "min": 0,
|      "max": 3650,
|      "card": "Protection score",
|      "info": {
|        "what": "How many days a Very High or High finding on a cloud resource that is not a patch (an Azure / Defender for Cloud recommendation, an attack path) may be open before it counts in the \"within Accepted Lifecycle\" view.",
|        "whenChanged": "0: such a finding is a risk from day one in both views. A higher number gives it a grace (its age: the source's first-seen, else SI's first detection); a finding with no date always counts.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "0 days: it counts from the day it is found",
|        "recommended": "Keep the default. Change it when: Your cloud team has an agreed time to fix recommendations (for example 30 days).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_OtherGraceDays_CloudResource/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_OtherGraceDays_Device",
|      "label": "Protection Score: grace for other device findings (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "0 days: it counts from the day it is found",
|      "description": "(#860) The accepted lifecycle above is for PATCH findings only (a vulnerability with a vendor fix: a fix release date, a recommended update or a patch cycle). Every other finding -- configuration, identity, Azure, attack paths -- has its own grace per asset type, in days; default 0 = it counts as a risk from the day it is found.",
|      "purpose": "How many days a Very High or High device finding that is NOT a patch (a configuration, an attack path, a vulnerability with no vendor fix) may be open before it counts in the \"within Accepted Lifecycle\" view.",
|      "effect": "0: such a finding is a risk from day one in both views. A higher number gives it a grace like a patch's (its age: the source's first-seen, else SI's first detection); a finding with no date always counts.",
|      "whenToChange": "Your process accepts a time to fix configuration findings too (for example 14 days).",
|      "unit": "days",
|      "min": 0,
|      "max": 3650,
|      "card": "Protection score",
|      "info": {
|        "what": "How many days a Very High or High device finding that is NOT a patch (a configuration, an attack path, a vulnerability with no vendor fix) may be open before it counts in the \"within Accepted Lifecycle\" view.",
|        "whenChanged": "0: such a finding is a risk from day one in both views. A higher number gives it a grace like a patch's (its age: the source's first-seen, else SI's first detection); a finding with no date always counts.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "0 days: it counts from the day it is found",
|        "recommended": "Keep the default. Change it when: Your process accepts a time to fix configuration findings too (for example 14 days).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_OtherGraceDays_Device/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_OtherGraceDays_Identity",
|      "label": "Protection Score: grace for identity findings (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "0 days: it counts from the day it is found",
|      "description": "The protection score's grace for identity findings (not patches), in days (default 0).",
|      "purpose": "How many days a Very High or High identity finding (MFA, roles, sign-ins, attack paths -- anything that is not a patch) may be open before it counts in the \"within Accepted Lifecycle\" view.",
|      "effect": "0: such a finding is a risk from day one in both views. A higher number gives it a grace (its age: the source's first-seen, else SI's first detection); a finding with no date always counts.",
|      "whenToChange": "Your identity team has an agreed time to fix (for example 7 days).",
|      "unit": "days",
|      "min": 0,
|      "max": 3650,
|      "card": "Protection score",
|      "info": {
|        "what": "How many days a Very High or High identity finding (MFA, roles, sign-ins, attack paths -- anything that is not a patch) may be open before it counts in the \"within Accepted Lifecycle\" view.",
|        "whenChanged": "0: such a finding is a risk from day one in both views. A higher number gives it a grace (its age: the source's first-seen, else SI's first detection); a finding with no date always counts.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "0 days: it counts from the day it is found",
|        "recommended": "Keep the default. Change it when: Your identity team has an agreed time to fix (for example 7 days).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_OtherGraceDays_Identity/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_OtherGraceDays_PublicIp",
|      "label": "Protection Score: grace for other public IP findings (days)",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "0 days: it counts from the day it is found",
|      "description": "The protection score's grace for findings on public IPs that are not patches, in days (default 0).",
|      "purpose": "How many days a Very High or High finding on a public IP that is not a patch (an open port, an exposed service) may be open before it counts in the \"within Accepted Lifecycle\" view.",
|      "effect": "0: such a finding is a risk from day one in both views. A higher number gives it a grace (its age: the source's first-seen, else SI's first detection); a finding with no date always counts.",
|      "whenToChange": "Your network team has an agreed time to close exposures.",
|      "unit": "days",
|      "min": 0,
|      "max": 3650,
|      "card": "Protection score",
|      "info": {
|        "what": "How many days a Very High or High finding on a public IP that is not a patch (an open port, an exposed service) may be open before it counts in the \"within Accepted Lifecycle\" view.",
|        "whenChanged": "0: such a finding is a risk from day one in both views. A higher number gives it a grace (its age: the source's first-seen, else SI's first detection); a finding with no date always counts.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "0 days: it counts from the day it is found",
|        "recommended": "Keep the default. Change it when: Your network team has an agreed time to close exposures.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_OtherGraceDays_PublicIp/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_Severities",
|      "label": "Protection score: severities that count",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Very High, Critical, High",
|      "description": "The severities that take an asset out of good standing. Default 'Very High,Critical,High'.",
|      "purpose": "The finding severities that take an asset out of good standing in the protection score.",
|      "effect": "An asset with an open, non-exempted finding of one of these severities is not in good standing. Separate with commas.",
|      "whenToChange": "Also count Medium findings, for a stricter score.",
|      "card": "Protection score",
|      "info": {
|        "what": "The finding severities that take an asset out of good standing in the protection score.",
|        "whenChanged": "An asset with an open, non-exempted finding of one of these severities is not in good standing. Separate with commas.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Very High, Critical, High",
|        "recommended": "Keep the default. Change it when: Also count Medium findings, for a stricter score.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_Severities/"
|      }
|    },
|    {
|      "name": "SI_ProtectionScore_TierWeights",
|      "label": "Protection score: tier weights",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "8,4,2,1 (an unclassified asset weighs as Tier 3)",
|      "description": "The protection score's tier weights, Tier 0..3 (an unclassified asset weighs as Tier 3). Default '8,4,2,1'.",
|      "purpose": "How much an asset of each tier weighs in the protection score, Tier 0 to Tier 3, separated by commas.",
|      "effect": "A Tier 0 asset out of good standing lowers the score as much as eight Tier 3 assets with the default. Four numbers, 0 or more; anything else = the default.",
|      "whenToChange": "Your management weighs tiers differently.",
|      "card": "Protection score",
|      "info": {
|        "what": "How much an asset of each tier weighs in the protection score, Tier 0 to Tier 3, separated by commas.",
|        "whenChanged": "A Tier 0 asset out of good standing lowers the score as much as eight Tier 3 assets with the default. Four numbers, 0 or more; anything else = the default.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "8,4,2,1 (an unclassified asset weighs as Tier 3)",
|        "recommended": "Keep the default. Change it when: Your management weighs tiers differently.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ProtectionScore_TierWeights/"
|      }
|    },
|    {
|      "name": "SI_PublicIp_DcrName",
|      "label": "Public IP data collection rule",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "dcr-si-publicip-profile",
|      "defaultText": "dcr-si-publicip-profile (the standard naming pattern).",
|      "description": "Data collection rule name the public-IP engine ingests its results through; defaults to dcr-si-publicip-profile.",
|      "purpose": "Names the data collection rule the public IP engine sends its results through.",
|      "effect": "Results are ingested through the named rule instead. A name that does not exist, or matches a rule from another install, makes ingestion fail or land in the wrong place.",
|      "whenToChange": "Only when a same-named rule from another install collides, or you deployed a uniquely named rule.",
|      "info": {
|        "what": "Names the data collection rule the public IP engine sends its results through.",
|        "whenChanged": "Results are ingested through the named rule instead. A name that does not exist, or matches a rule from another install, makes ingestion fail or land in the wrong place.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: publicip.",
|        "default": "dcr-si-publicip-profile (the standard naming pattern).",
|        "recommended": "Keep the default. Change it when: Only when a same-named rule from another install collides, or you deployed a uniquely named rule.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PublicIp_DcrName/"
|      }
|    },
|    {
|      "name": "SI_PublicIP_DiscoverySource",
|      "label": "Public IP discovery source",
|      "group": "Collection scope & limits",
|      "type": "enum",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": "profile-cl",
|      "defaultText": "profile-cl: public IPs of already classified servers, plus your extra targets.",
|      "description": "How to find IPs to scan. Three modes: 'profile-cl' (DEFAULT) -- Tier 0-N servers from SI_Endpoint_Profile_CL + SI_Azure_Profile_CL + customer extras. Preserves the legacy \"scan only IPs attached to assets we already classified\" behaviour. Recommended. 'arg-eg' -- ARG publicIPAddresses + EG NodeLabel + extras. Broader coverage; no per-IP tier or cmdb context. 'union' -- All sources merged. Maximum coverage; Profile_CL metadata wins on same-IP collisions.",
|      "purpose": "Chooses where the engine finds public IP addresses to check: classified assets (profile-cl), Azure and Defender inventory (arg-eg), or both (union).",
|      "effect": "arg-eg covers every Azure public IP and Defender node but without tier or CMDB context; union checks everything. Broader modes mean more addresses, longer runs and more Shodan lookups. Unknown values fall back to profile-cl.",
|      "whenToChange": "When you want Azure public IPs that are not attached to a classified asset to be checked too.",
|      "values": [
|        "profile-cl",
|        "arg-eg",
|        "union"
|      ],
|      "valueLabels": {
|        "profile-cl": "Classified servers (and your extra addresses)",
|        "arg-eg": "Azure and Defender inventory",
|        "union": "Both"
|      },
|      "card": "Public IP checks (Shodan)",
|      "info": {
|        "what": "Chooses where the engine finds public IP addresses to check: classified assets (profile-cl), Azure and Defender inventory (arg-eg), or both (union).",
|        "whenChanged": "arg-eg covers every Azure public IP and Defender node but without tier or CMDB context; union checks everything. Broader modes mean more addresses, longer runs and more Shodan lookups. Unknown values fall back to profile-cl.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "profile-cl: public IPs of already classified servers, plus your extra targets.",
|        "recommended": "Keep the default. Change it when: When you want Azure public IPs that are not attached to a classified asset to be checked too.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PublicIP_DiscoverySource/"
|      }
|    },
|    {
|      "name": "SI_PublicIP_ExtraTargets",
|      "label": "Extra public IPs to scan",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Empty: only discovered addresses are checked.",
|      "description": "Customer-supplied extra targets (partner / supply-chain IPs to monitor).",
|      "purpose": "A list of additional public IP addresses to check every run, such as partner or supply-chain addresses.",
|      "effect": "Listed addresses are always added to the candidate set and looked up in Shodan, adding a lookup per address. They carry no tier or CMDB details unless given in the public IP schema overlay file.",
|      "whenToChange": "When you want to watch external addresses you care about but that SecurityInsight cannot discover.",
|      "card": "Public IP checks (Shodan)",
|      "info": {
|        "what": "A list of additional public IP addresses to check every run, such as partner or supply-chain addresses.",
|        "whenChanged": "Listed addresses are always added to the candidate set and looked up in Shodan, adding a lookup per address. They carry no tier or CMDB details unless given in the public IP schema overlay file.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "Empty: only discovered addresses are checked.",
|        "recommended": "Keep the default. Change it when: When you want to watch external addresses you care about but that SecurityInsight cannot discover.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PublicIP_ExtraTargets/"
|      }
|    },
|    {
|      "name": "SI_PublicIp_TableName",
|      "label": "Public IP table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "SI_PublicIP_Profile",
|      "defaultText": "SI_PublicIP_Profile (stored as SI_PublicIP_Profile_CL).",
|      "description": "--- public IP --------------------------------------------------------------- Destination overrides (defaults: SI_PublicIP_Profile_CL via dcr-si-publicip-profile).",
|      "purpose": "Names the Log Analytics table the public IP engine writes to.",
|      "effect": "Results go to the named table. Reports, risk analysis and the web app read the standard name, so a different name hides public IP data from them.",
|      "whenToChange": "Practically never; keep the standard name.",
|      "info": {
|        "what": "Names the Log Analytics table the public IP engine writes to.",
|        "whenChanged": "Results go to the named table. Reports, risk analysis and the web app read the standard name, so a different name hides public IP data from them.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: publicip.",
|        "default": "SI_PublicIP_Profile (stored as SI_PublicIP_Profile_CL).",
|        "recommended": "Keep the default. Change it when: Practically never; keep the standard name.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_PublicIp_TableName/"
|      }
|    },
|    {
|      "name": "SI_RA_ExcelExport_Detailed",
|      "label": "Excel workbook of the detailed report",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off",
|      "description": "The detailed workbook is off by default: the detailed results can hold millions of rows, and every row is in the web app.",
|      "purpose": "Whether a Risk Analysis detailed run writes its results to an Excel workbook. The detailed results can hold millions of rows; they are in the web app.",
|      "effect": "On: the detailed run writes its workbook, as long as the results are not larger than a workbook can hold here -- above that no workbook is written and the Settings page shows the switch greyed out. Off: no workbook is written; the mail says the results are in the web app. Every row is in the web app and in Log Analytics either way.",
|      "whenToChange": "Switch it on only when someone needs the detailed results as a file.",
|      "card": "Risk Analysis report mails",
|      "info": {
|        "what": "Whether a Risk Analysis detailed run writes its results to an Excel workbook. The detailed results can hold millions of rows; they are in the web app.",
|        "whenOn": "the detailed run writes its workbook, as long as the results are not larger than a workbook can hold here -- above that no workbook is written and the Settings page shows the switch greyed out.",
|        "whenOff": "no workbook is written; the mail says the results are in the web app. Every row is in the web app and in Log Analytics either way.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Off",
|        "recommended": "Keep the default. Change it when: Switch it on only when someone needs the detailed results as a file.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RA_ExcelExport_Detailed/"
|      }
|    },
|    {
|      "name": "SI_RA_ExcelExport_Summary",
|      "label": "Excel workbook of the summary report",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "The Excel workbook of each Risk Analysis report, on or off: the summary workbook is written, the detailed one is not (every row is in the web app). Above the size a workbook holds the detailed workbook is not written even when on.",
|      "purpose": "Whether a Risk Analysis summary run writes its results to an Excel workbook (attached to the summary mail when it fits).",
|      "effect": "On: the summary run writes its workbook. Off: no workbook is written; the mail says the results are in the web app. The results themselves are the same either way: every row is in the web app and in Log Analytics.",
|      "whenToChange": "Switch it off when nobody uses the summary workbook.",
|      "card": "Risk Analysis report mails",
|      "info": {
|        "what": "Whether a Risk Analysis summary run writes its results to an Excel workbook (attached to the summary mail when it fits).",
|        "whenOn": "the summary run writes its workbook.",
|        "whenOff": "no workbook is written; the mail says the results are in the web app. The results themselves are the same either way: every row is in the web app and in Log Analytics.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "On",
|        "recommended": "Keep the default. Change it when: Switch it off when nobody uses the summary workbook.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RA_ExcelExport_Summary/"
|      }
|    },
|    {
|      "name": "SI_RA_Findings",
|      "label": "Copy findings per CI to Log Analytics (SI_Finding_CL)",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off: the findings per CI are kept in the database only",
|      "description": "--- Copy findings per CI to Log Analytics (SI_Finding_CL) -- optional, off by default --- After each Risk Analysis Detailed run, copies the de-duplicated findings (one row per CI and finding) into your Log Analytics workspace, for your own workbooks, Sentinel or KQL. SecurityInsight itself does not need it: its pages read the findings from its database. On a large estate the copy can take hours and adds ingestion cost. Not the report rows (SendToLogAnalytics, SI_RiskAnalysis_Detailed_CL).",
|      "purpose": "Optional. After each Risk Analysis Detailed run, copies the de-duplicated findings (one row per CI and finding) into your Log Analytics workspace, for your own workbooks, Sentinel or KQL. SecurityInsight itself does not need it: its pages read the findings from its database. On a large estate the copy can take hours and adds Log Analytics ingestion cost. Off by default.",
|      "effect": "On: at the end of every Risk Analysis Detailed run its findings per CI are also posted to SI_Finding_CL, and the run ends when the copy has ended. On a large estate that is hours, and it costs ingestion for every finding, every run. The data sync reads that copy back only when it is the newest and whole; otherwise it makes the findings per CI from the database, as it does with the copy off. Off: nothing is copied. This is not the Risk Analysis report rows (SI_RiskAnalysis_Detailed_CL): they are their own optional output, Copy Risk Analysis report rows to Log Analytics, off by default.",
|      "whenToChange": "Only when your own workbooks, Sentinel rules or KQL queries read SI_Finding_CL; leave off otherwise.",
|      "card": "Where collected data goes",
|      "hint": "Off = the findings per CI stay in the database. On = also a copy in Log Analytics (can take hours, costs ingestion).",
|      "info": {
|        "what": "Optional. After each Risk Analysis Detailed run, copies the de-duplicated findings (one row per CI and finding) into your Log Analytics workspace, for your own workbooks, Sentinel or KQL. SecurityInsight itself does not need it: its pages read the findings from its database. On a large estate the copy can take hours and adds Log Analytics ingestion cost. Off by default.",
|        "whenOn": "at the end of every Risk Analysis Detailed run its findings per CI are also posted to SI_Finding_CL, and the run ends when the copy has ended. On a large estate that is hours, and it costs ingestion for every finding, every run. The data sync reads that copy back only when it is the newest and whole; otherwise it makes the findings per CI from the database, as it does with the copy off.",
|        "whenOff": "nothing is copied. This is not the Risk Analysis report rows (SI_RiskAnalysis_Detailed_CL): they are their own optional output, Copy Risk Analysis report rows to Log Analytics, off by default.",
|        "risk": "Longer Risk Analysis Detailed runs and Log Analytics ingestion cost for every finding, every run. SecurityInsight itself does not need the copy. Reversible: turn it off and the next run copies nothing.",
|        "requires": "Nothing else.",
|        "default": "Off: the findings per CI are kept in the database only",
|        "recommended": "Off, unless your own workbooks, Sentinel rules or KQL read SI_Finding_CL.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RA_Findings/",
|        "confirmWhen": "on",
|        "confirm": "Every Risk Analysis Detailed run will also copy its findings per CI to Log Analytics (SI_Finding_CL). On a large estate the copy takes hours and the run ends only when it has ended; it adds ingestion cost."
|      }
|    },
|    {
|      "name": "SI_RA_PartsInParallel_Max",
|      "label": "Risk Analysis parts asked at a time (most)",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "6 (never more than 4 per processor core)",
|      "description": "The most parts of one Risk Analysis report asked from Defender at a time (the next parts' answers are on their way while a part is processed). Adapts by itself: starts at 2, more while Defender answers quickly, fewer when it asks to slow down. 1 = one part at a time.",
|      "purpose": "A large Risk Analysis report is asked from Microsoft Defender in parts. While one part is processed (risk scores, the database), the next parts are already asked, so Defender and SecurityInsight work at the same time. This is the most parts asked at a time.",
|      "effect": "The number adapts by itself: each report starts at 2, asks more while Defender answers quickly, and halves at once when Defender asks to slow down (it then waits as long as Defender says). A higher maximum lets a large report finish sooner when Defender keeps up; 1 asks one part at a time. The parts are processed in their order either way: the stored findings are the same.",
|      "whenToChange": "Most installs never should. Set 1 only if support asks you to; lower it if other tools in the tenant share Defender's advanced hunting limits.",
|      "unit": "parts",
|      "info": {
|        "what": "A large Risk Analysis report is asked from Microsoft Defender in parts. While one part is processed (risk scores, the database), the next parts are already asked, so Defender and SecurityInsight work at the same time. This is the most parts asked at a time.",
|        "whenChanged": "The number adapts by itself: each report starts at 2, asks more while Defender answers quickly, and halves at once when Defender asks to slow down (it then waits as long as Defender says). A higher maximum lets a large report finish sooner when Defender keeps up; 1 asks one part at a time. The parts are processed in their order either way: the stored findings are the same.",
|        "risk": "Only changes how many parts of a report are asked from Defender at a time, so how long Risk Analysis takes: 1 makes a large report take much longer; a higher number can make Defender ask SecurityInsight to slow down more often (it then does). The findings are the same either way. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "6 (never more than 4 per processor core)",
|        "recommended": "Keep 6 (the default).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RA_PartsInParallel_Max/"
|      }
|    },
|    {
|      "name": "SI_RA_SourceFirstSeen",
|      "label": "Read Defender's first sighting of each vulnerability",
|      "group": "Risk Analysis -- mails and executive view",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On",
|      "description": "Risk Analysis reads Defender's software vulnerabilities export once per run (Vulnerability.Read.All) for the first time each CVE was seen on each device (si_source_first_seen; the protection score's accepted-lifecycle view ages findings by it). on | off. Default on.",
|      "purpose": "Risk Analysis reads Defender for Endpoint's software vulnerabilities export once per run for the first time each CVE was seen on each device (si_source_first_seen).",
|      "effect": "The protection score's \"within Accepted Lifecycle\" view ages a vulnerability by Defender's own first sighting instead of SecurityInsight's first detection. Off: the export is not read and the vulnerability findings carry no source first-seen.",
|      "whenToChange": "Turn it off only when the export takes too long or the permission Vulnerability.Read.All is not granted.",
|      "card": "Protection score",
|      "info": {
|        "what": "Risk Analysis reads Defender for Endpoint's software vulnerabilities export once per run for the first time each CVE was seen on each device (si_source_first_seen).",
|        "whenChanged": "The protection score's \"within Accepted Lifecycle\" view ages a vulnerability by Defender's own first sighting instead of SecurityInsight's first detection. Off: the export is not read and the vulnerability findings carry no source first-seen.",
|        "risk": "Changes how the headline figures are presented in the mails and the executive view; the findings themselves are unchanged. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "On",
|        "recommended": "Keep the default. Change it when: Turn it off only when the export takes too long or the permission Vulnerability.Read.All is not granted.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RA_SourceFirstSeen/"
|      }
|    },
|    {
|      "name": "SI_RA_StaleDeviceFilter",
|      "label": "Risk Analysis stale device filter",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: no devices are filtered out",
|      "description": "'off' (default)|'lenient'|'strict'",
|      "purpose": "Optionally removes devices not seen recently from the heavy attack-path Risk Analysis reports: off, lenient or strict.",
|      "effect": "lenient drops devices last seen longer ago than SI_ActiveStaleDays; strict also drops devices with no last-seen date. Smaller, faster reports, but findings on those devices are hidden.",
|      "whenToChange": "Only if attack-path reports are swamped by devices that no longer exist.",
|      "info": {
|        "what": "Optionally removes devices not seen recently from the heavy attack-path Risk Analysis reports: off, lenient or strict.",
|        "whenChanged": "lenient drops devices last seen longer ago than SI_ActiveStaleDays; strict also drops devices with no last-seen date. Smaller, faster reports, but findings on those devices are hidden.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Off: no devices are filtered out",
|        "recommended": "Keep the default. Change it when: Only if attack-path reports are swamped by devices that no longer exist.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RA_StaleDeviceFilter/"
|      }
|    },
|    {
|      "name": "SI_RATop50_BlobContainer",
|      "label": "Shared top-50 cache container",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "sistaging",
|      "description": "Where the shared Top-50 asset cache lives. Unused in 'PerReport' mode.",
|      "purpose": "The storage container holding the shared top-50 risk summary, so several hosts or containers reuse one summary instead of each building it.",
|      "effect": "The shared summary is read from and written to this container in the staging storage account. Hosts pointing at different containers each build their own summary.",
|      "whenToChange": "Practically never; only if the staging container was renamed.",
|      "info": {
|        "what": "The storage container holding the shared top-50 risk summary, so several hosts or containers reuse one summary instead of each building it.",
|        "whenChanged": "The shared summary is read from and written to this container in the staging storage account. Hosts pointing at different containers each build their own summary.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "sistaging",
|        "recommended": "Keep the default. Change it when: Practically never; only if the staging container was renamed.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RATop50_BlobContainer/"
|      }
|    },
|    {
|      "name": "SI_RATop50_BlobName",
|      "label": "Shared top-50 cache file",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "risk-analysis/RiskAnalysis_Top50_Shared.json",
|      "description": "Blob path of the shared top-50 risk cache, so several hosts or containers reuse one AI summary instead of each building it; defaults to risk-analysis/RiskAnalysis_Top50_Shared.json.",
|      "purpose": "The file path, inside the container, of the shared top-50 risk summary that several hosts or containers reuse.",
|      "effect": "The shared summary is stored under this path. Hosts using different paths each build their own summary, which costs extra time and AI calls.",
|      "whenToChange": "Practically never; only to keep separate installs from sharing one summary.",
|      "info": {
|        "what": "The file path, inside the container, of the shared top-50 risk summary that several hosts or containers reuse.",
|        "whenChanged": "The shared summary is stored under this path. Hosts using different paths each build their own summary, which costs extra time and AI calls.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "risk-analysis/RiskAnalysis_Top50_Shared.json",
|        "recommended": "Keep the default. Change it when: Practically never; only to keep separate installs from sharing one summary.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RATop50_BlobName/"
|      }
|    },
|    {
|      "name": "SI_RebuildAuthBlock",
|      "label": "Re-pull sign-in from Key Vault",
|      "group": "Sign-in & Azure resources",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: existing credentials are kept and only tested",
|      "description": "Force Bootstrap-Auth.ps1 to re-pull from KV even when SI_SPN_AppId is already present in this file (rotates a leaked secret from the vault).",
|      "purpose": "Makes the authentication setup script re-read service principal credentials from Key Vault and rewrite them, even when they are already in the configuration file.",
|      "effect": "When on, the next setup run replaces the sign-in block in your configuration file with fresh values from Key Vault, for example after rotating a secret.",
|      "whenToChange": "Only after rotating or replacing the service principal credential in Key Vault.",
|      "setupOnly": true,
|      "info": {
|        "what": "Makes the authentication setup script re-read service principal credentials from Key Vault and rewrite them, even when they are already in the configuration file.",
|        "whenOn": "When on, the next setup run replaces the sign-in block in your configuration file with fresh values from Key Vault, for example after rotating a secret.",
|        "whenOff": "existing credentials are kept and only tested",
|        "risk": "The next setup run REPLACES the sign-in block in your configuration file with fresh values from Key Vault. Wrong Key Vault values stop every run until corrected. Reversible from a configuration backup.",
|        "requires": "Nothing else.",
|        "default": "Off: existing credentials are kept and only tested",
|        "recommended": "Off; on once after rotating a secret.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RebuildAuthBlock/",
|        "confirmWhen": "on",
|        "confirm": "When on, the next setup run replaces the sign-in block in your configuration file with fresh values from Key Vault, for example after rotating a secret. The next setup run REPLACES the sign-in block in your configuration file with fresh values from Key Vault. Wrong Key Vault values stop every run until corrected. Reversible from a configuration backup."
|      }
|    },
|    {
|      "name": "SI_RequireMdeActive_Endpoint",
|      "label": "Only Defender-active endpoints",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: a device seen recently by Defender, Exposure Management or Entra is kept",
|      "description": "TIGHTEN: MDE-active only",
|      "purpose": "Narrows the endpoint inventory to devices that Defender for Endpoint reports as active or recently seen.",
|      "effect": "On drops devices known only to Exposure Management or Entra, such as some Azure VMs, personal and IoT devices: fewer rows, but less coverage. Ignored when SI_IncludeInactive_Endpoint is on.",
|      "whenToChange": "Only if you want the inventory to match the Defender portal's active device list.",
|      "card": "Which assets are included",
|      "info": {
|        "what": "Narrows the endpoint inventory to devices that Defender for Endpoint reports as active or recently seen.",
|        "whenOn": "On drops devices known only to Exposure Management or Entra, such as some Azure VMs, personal and IoT devices: fewer rows, but less coverage. Ignored when SI_IncludeInactive_Endpoint is on.",
|        "whenOff": "a device seen recently by Defender, Exposure Management or Entra is kept",
|        "risk": "Drops every device known only to Exposure Management or Entra (some Azure VMs, personal and IoT devices): those devices disappear from profiles and reports, and their exposure with them. Reversible: the next run includes them again.",
|        "requires": "Nothing else.",
|        "default": "Off: a device seen recently by Defender, Exposure Management or Entra is kept",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RequireMdeActive_Endpoint/",
|        "confirmWhen": "on",
|        "confirm": "On drops devices known only to Exposure Management or Entra, such as some Azure VMs, personal and IoT devices: fewer rows, but less coverage. Ignored when SI_IncludeInactive_Endpoint is on. Drops every device known only to Exposure Management or Entra (some Azure VMs, personal and IoT devices): those devices disappear from profiles and reports, and their exposure with them. Reversible: the next run includes them again."
|      }
|    },
|    {
|      "name": "SI_RequireRecentSignIn_Identity",
|      "label": "Require recent identity sign-in",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Off: identities without recent or available sign-in data are still published",
|      "description": "--- identity engine --------------------------------------------------------- 3.0 includes identities whose sign-in history is unavailable. $true restores the 2.2 rule: a sign-in within SI_ActiveStaleDays is REQUIRED (fewer identities, and any without sign-in data are excluded).",
|      "purpose": "Restores the older, stricter rule that an identity must have signed in recently to be published.",
|      "effect": "On also drops every identity without a sign-in within SI_ActiveStaleDays, including ones whose sign-in history is unavailable: fewer rows, but real accounts may be missing.",
|      "whenToChange": "Only if you need the behaviour of the previous major version.",
|      "card": "Which assets are included",
|      "info": {
|        "what": "Restores the older, stricter rule that an identity must have signed in recently to be published.",
|        "whenOn": "On also drops every identity without a sign-in within SI_ActiveStaleDays, including ones whose sign-in history is unavailable: fewer rows, but real accounts may be missing.",
|        "whenOff": "identities without recent or available sign-in data are still published",
|        "risk": "Drops every identity without a recent or available sign-in, including privileged accounts that are rarely used: they disappear from profiles and reports. Reversible: the next run includes them again.",
|        "requires": "Nothing else.",
|        "default": "Off: identities without recent or available sign-in data are still published",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RequireRecentSignIn_Identity/",
|        "confirmWhen": "on",
|        "confirm": "On also drops every identity without a sign-in within SI_ActiveStaleDays, including ones whose sign-in history is unavailable: fewer rows, but real accounts may be missing. Drops every identity without a recent or available sign-in, including privileged accounts that are rarely used: they disappear from profiles and reports. Reversible: the next run includes them again."
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_BuildSummaryByAI",
|      "label": "AI summary in the report mail (container jobs)",
|      "group": "AI",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the jobs follow your general AI summary setting, otherwise off.",
|      "description": "When on, the risk-analysis container job asks Azure OpenAI to write an AI summary of the findings; off by default.",
|      "purpose": "Decides whether the risk-analysis container jobs ask Azure OpenAI to write a summary of the findings.",
|      "effect": "When on, each report run makes AI calls, adding cost and run time; the run stops if Azure OpenAI details are missing. When off, reports have no AI summary.",
|      "whenToChange": "When you want AI-written summaries in scheduled container reports.",
|      "card": "Where AI is used",
|      "hint": "When the reports run as container jobs.",
|      "setupOnly": true,
|      "info": {
|        "what": "Decides whether the risk-analysis container jobs ask Azure OpenAI to write a summary of the findings.",
|        "whenOn": "When on, each report run makes AI calls, adding cost and run time; the run stops if Azure OpenAI details are missing. When off, reports have no AI summary.",
|        "whenOff": "Not set: the jobs follow your general AI summary setting, otherwise off.",
|        "risk": "Report content is sent to YOUR Azure OpenAI deployment for a summary, and each run costs; a run stops if Azure OpenAI is not configured. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: the jobs follow your general AI summary setting, otherwise off.",
|        "recommended": "As your organisation prefers.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_BuildSummaryByAI/",
|        "confirmWhen": "on",
|        "confirm": "When on, each report run makes AI calls, adding cost and run time; the run stops if Azure OpenAI details are missing. When off, reports have no AI summary. Report content is sent to YOUR Azure OpenAI deployment for a summary, and each run costs; a run stops if Azure OpenAI is not configured. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_DceIngestionUri",
|      "label": "Risk analysis ingestion address",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Falls back to SI_DceIngestionUri, else found automatically from the endpoint name.",
|      "description": "auto-resolved from DceName -- rarely set explicitly",
|      "purpose": "The data collection endpoint address risk analysis sends its results to in Log Analytics.",
|      "effect": "Forces results to this address. A wrong address makes Log Analytics ingestion fail; the Excel and JSON output are still written.",
|      "whenToChange": "Rarely; only when the address cannot be found automatically.",
|      "info": {
|        "what": "The data collection endpoint address risk analysis sends its results to in Log Analytics.",
|        "whenChanged": "Forces results to this address. A wrong address makes Log Analytics ingestion fail; the Excel and JSON output are still written.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Falls back to SI_DceIngestionUri, else found automatically from the endpoint name.",
|        "recommended": "Keep the default. Change it when: Rarely; only when the address cannot be found automatically.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_DceIngestionUri/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_DceName",
|      "label": "Risk analysis collection endpoint",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Falls back to SI_DceName, then DceName, then the standard SecurityInsight endpoint name.",
|      "description": "override: falls back to $global:DceName",
|      "purpose": "Names the data collection endpoint risk analysis uses for its Log Analytics results.",
|      "effect": "Risk analysis ingests through the named endpoint instead of the shared one. A wrong name makes ingestion fail; local output is still written.",
|      "whenToChange": "Only when risk analysis must use a different endpoint than the other engines.",
|      "info": {
|        "what": "Names the data collection endpoint risk analysis uses for its Log Analytics results.",
|        "whenChanged": "Risk analysis ingests through the named endpoint instead of the shared one. A wrong name makes ingestion fail; local output is still written.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Falls back to SI_DceName, then DceName, then the standard SecurityInsight endpoint name.",
|        "recommended": "Keep the default. Change it when: Only when risk analysis must use a different endpoint than the other engines.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_DceName/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_DcrName_Detailed",
|      "label": "Detailed report data collection rule",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "dcr-si-risk-analysis-detailed",
|      "description": "Data collection rule name used to send Detailed risk-analysis rows to Log Analytics; defaults to dcr-si-risk-analysis-detailed.",
|      "purpose": "The name of the data collection rule the detailed Risk Analysis rows are sent through to Log Analytics.",
|      "effect": "Detailed rows are sent through the named rule. A wrong name makes the detailed report ingest fail.",
|      "whenToChange": "Only if you renamed the rule or must avoid a name clash with another install.",
|      "info": {
|        "what": "The name of the data collection rule the detailed Risk Analysis rows are sent through to Log Analytics.",
|        "whenChanged": "Detailed rows are sent through the named rule. A wrong name makes the detailed report ingest fail.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "dcr-si-risk-analysis-detailed",
|        "recommended": "Keep the default. Change it when: Only if you renamed the rule or must avoid a name clash with another install.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_DcrName_Detailed/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_DcrName_Summary",
|      "label": "Summary report data collection rule",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "dcr-si-risk-analysis-summary",
|      "description": "Data collection rule name used to send Summary risk-analysis rows to Log Analytics; defaults to dcr-si-risk-analysis-summary.",
|      "purpose": "The name of the data collection rule the summary Risk Analysis rows are sent through to Log Analytics.",
|      "effect": "Summary rows are sent through the named rule. A wrong name makes the summary report ingest fail.",
|      "whenToChange": "Only if you renamed the rule or must avoid a name clash with another install.",
|      "info": {
|        "what": "The name of the data collection rule the summary Risk Analysis rows are sent through to Log Analytics.",
|        "whenChanged": "Summary rows are sent through the named rule. A wrong name makes the summary report ingest fail.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "dcr-si-risk-analysis-summary",
|        "recommended": "Keep the default. Change it when: Only if you renamed the rule or must avoid a name clash with another install.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_DcrName_Summary/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_DcrResourceGroup",
|      "label": "Risk Analysis rule resource group",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Uses SI_DcrResourceGroup (then DcrResourceGroup); if none is set, the standard SecurityInsight rules group.",
|      "description": "Two DCRs (one per table) -- HARDCODED in the engine ('dcr-si-risk-analysis-summary' + 'dcr-si-risk-analysis-detailed'); customer doesn't pick the names. EVERYTHING AUTO-RESOLVES. The solution-wide shared defaults (Layer 0, SecurityInsight.shared-defaults.ps1 in _lib) set $global:WorkspaceName, $global:DceName, $global:DceResourceGroup, $global:DcrResourceGroup to the canonical SecurityInsight layout. The engine auto-creates anything missing (workspace, DCE, DCE RG, DCR RG) and assigns the SPN the roles it needs. SI_RiskAnalysis_* per-engine overrides win over the shared short names. Only set them if this engine needs to deviate from the solution baseline.",
|      "purpose": "Resource group holding the data collection rules Risk Analysis uses to send its results to Log Analytics, when it should differ from the solution-wide one.",
|      "effect": "Risk Analysis looks up, and creates if missing, its two collection rules in this resource group. A wrong group means new rules are created there, separate from the rest of the solution.",
|      "whenToChange": "Rarely; only when Risk Analysis must ingest through rules kept apart from the other engines.",
|      "info": {
|        "what": "Resource group holding the data collection rules Risk Analysis uses to send its results to Log Analytics, when it should differ from the solution-wide one.",
|        "whenChanged": "Risk Analysis looks up, and creates if missing, its two collection rules in this resource group. A wrong group means new rules are created there, separate from the rest of the solution.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Uses SI_DcrResourceGroup (then DcrResourceGroup); if none is set, the standard SecurityInsight rules group.",
|        "recommended": "Keep the default. Change it when: Rarely; only when Risk Analysis must ingest through rules kept apart from the other engines.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_DcrResourceGroup/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_ExportContainer",
|      "label": "Report storage container",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "sistaging",
|      "description": "Storage container the risk-analysis container job saves its Excel and JSON reports to; defaults to sistaging.",
|      "purpose": "The storage container in your staging storage account where the risk-analysis container jobs save their reports.",
|      "effect": "Reports are saved to this container. It is ignored when a full export destination is set, or when no staging storage account is configured.",
|      "whenToChange": "Only if reports must be kept apart from the staging data.",
|      "setupOnly": true,
|      "info": {
|        "what": "The storage container in your staging storage account where the risk-analysis container jobs save their reports.",
|        "whenChanged": "Reports are saved to this container. It is ignored when a full export destination is set, or when no staging storage account is configured.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "sistaging",
|        "recommended": "Keep the default. Change it when: Only if reports must be kept apart from the staging data.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_ExportContainer/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_ExportDestination",
|      "label": "Risk Analysis report export location",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Built at setup from the staging storage account, folder risk-analysis in the staging container.",
|      "description": "Full storage URL the risk-analysis container job saves its reports to; when empty it is built from the storage account, export container and export prefix.",
|      "purpose": "Storage URL where container-hosted Risk Analysis jobs save their report workbooks and data files.",
|      "effect": "Read by container setup and passed to the Risk Analysis jobs. Reports are uploaded to this URL instead; the identity must be able to write there. On a server install the ExportDestination setting is used instead.",
|      "whenToChange": "When reports must land in a different storage account or container. Re-run setup for it to take effect.",
|      "setupOnly": true,
|      "info": {
|        "what": "Storage URL where container-hosted Risk Analysis jobs save their report workbooks and data files.",
|        "whenChanged": "Read by container setup and passed to the Risk Analysis jobs. Reports are uploaded to this URL instead; the identity must be able to write there. On a server install the ExportDestination setting is used instead.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Built at setup from the staging storage account, folder risk-analysis in the staging container.",
|        "recommended": "Keep the default. Change it when: When reports must land in a different storage account or container. Re-run setup for it to take effect.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_ExportDestination/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_ExportPrefix",
|      "label": "Report storage folder",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "risk-analysis",
|      "description": "Folder inside the export container where the risk-analysis container job saves its reports; defaults to risk-analysis.",
|      "purpose": "The folder inside the report storage container where the risk-analysis container jobs save their reports.",
|      "effect": "Reports are saved under this folder; empty saves them at the container's top level. Ignored when a full export destination is set.",
|      "whenToChange": "Only if your report readers expect another folder.",
|      "setupOnly": true,
|      "info": {
|        "what": "The folder inside the report storage container where the risk-analysis container jobs save their reports.",
|        "whenChanged": "Reports are saved under this folder; empty saves them at the container's top level. Ignored when a full export destination is set.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "risk-analysis",
|        "recommended": "Keep the default. Change it when: Only if your report readers expect another folder.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_ExportPrefix/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_Mode",
|      "label": "Container report mode",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Summary",
|      "description": "Whether the scheduled risk-analysis container job produces the Summary or the Detailed report; must be Summary or Detailed and defaults to Summary.",
|      "purpose": "Summary or Detailed, for the scheduled Summary report job; used only when the report template's name does not say which.",
|      "effect": "Decides which report and Log Analytics table the job uses when a custom template does not name its mode. With the shipped templates the template decides and this has no effect; a separate job builds the Detailed report.",
|      "whenToChange": "Only with a custom report template whose name contains neither Summary nor Detailed.",
|      "setupOnly": true,
|      "info": {
|        "what": "Summary or Detailed, for the scheduled Summary report job; used only when the report template's name does not say which.",
|        "whenChanged": "Decides which report and Log Analytics table the job uses when a custom template does not name its mode. With the shipped templates the template decides and this has no effect; a separate job builds the Detailed report.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Summary",
|        "recommended": "Keep the default. Change it when: Only with a custom report template whose name contains neither Summary nor Detailed.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_Mode/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_ReportTemplate",
|      "label": "Container summary report template",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Your default Summary template if set, otherwise the shipped Summary template",
|      "description": "RiskAnalysis-in-container knobs.",
|      "purpose": "The report template the scheduled Summary risk-analysis container job uses.",
|      "effect": "The Summary job builds this template instead. A Detailed template here makes that job build a Detailed report.",
|      "whenToChange": "When the scheduled Summary job should use your own template.",
|      "setupOnly": true,
|      "info": {
|        "what": "The report template the scheduled Summary risk-analysis container job uses.",
|        "whenChanged": "The Summary job builds this template instead. A Detailed template here makes that job build a Detailed report.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Your default Summary template if set, otherwise the shipped Summary template",
|        "recommended": "Keep the default. Change it when: When the scheduled Summary job should use your own template.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_ReportTemplate/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_SendToLogAnalytics",
|      "label": "Copy Risk Analysis report rows to Log Analytics (container jobs, at setup)",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the jobs follow Copy Risk Analysis report rows to Log Analytics, which is off by default.",
|      "description": "When on, the risk-analysis container jobs are made with the copy of their report rows to Log Analytics switched on; not set = they follow Copy Risk Analysis report rows to Log Analytics, off by default.",
|      "purpose": "Optional, at setup only: whether the Risk Analysis container jobs are made with the copy of their report rows to Log Analytics (SI_RiskAnalysis_Detailed_CL) switched on. SecurityInsight itself does not need it: its pages read the results from its database. Off by default.",
|      "effect": "On: the jobs are made with the copy on (see Copy Risk Analysis report rows to Log Analytics). Not set or off: the jobs follow that setting, off by default.",
|      "whenToChange": "Only when your own workbooks, Sentinel rules or KQL read the report rows in Log Analytics; leave it not set otherwise.",
|      "card": "Report mode and output",
|      "hint": "When the reports run as container jobs.",
|      "setupOnly": true,
|      "info": {
|        "what": "Optional, at setup only: whether the Risk Analysis container jobs are made with the copy of their report rows to Log Analytics (SI_RiskAnalysis_Detailed_CL) switched on. SecurityInsight itself does not need it: its pages read the results from its database. Off by default.",
|        "whenOn": "the jobs are made with the copy on (see Copy Risk Analysis report rows to Log Analytics). Not set or off: the jobs follow that setting, off by default.",
|        "whenOff": "Not set: the jobs follow Copy Risk Analysis report rows to Log Analytics, which is off by default.",
|        "risk": "Log Analytics ingestion cost for every report row, every run. SecurityInsight itself does not need the copy. Reversible: Copy Risk Analysis report rows to Log Analytics turns it off again.",
|        "requires": "Nothing else.",
|        "default": "Not set: the jobs follow Copy Risk Analysis report rows to Log Analytics, which is off by default.",
|        "recommended": "Not set (off).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_SendToLogAnalytics/",
|        "confirmWhen": "on",
|        "confirm": "The Risk Analysis jobs made at setup will copy their report rows to Log Analytics after every run; it adds ingestion cost."
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_TableName_Detailed",
|      "label": "Detailed Risk Analysis table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "SI_RiskAnalysis_Detailed",
|      "defaultText": "SI_RiskAnalysis_Detailed (stored as SI_RiskAnalysis_Detailed_CL).",
|      "description": "Log Analytics table that receives Detailed risk-analysis rows; defaults to SI_RiskAnalysis_Detailed.",
|      "purpose": "Name of the Log Analytics table that receives rows from the Detailed Risk Analysis report.",
|      "effect": "Detailed results are written to a different table. Workbooks, queries and the trend engine that read the standard table will no longer see new data unless they are changed too.",
|      "whenToChange": "Almost never; only to avoid a clash with an existing table of the same name.",
|      "info": {
|        "what": "Name of the Log Analytics table that receives rows from the Detailed Risk Analysis report.",
|        "whenChanged": "Detailed results are written to a different table. Workbooks, queries and the trend engine that read the standard table will no longer see new data unless they are changed too.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: risk-analysis.",
|        "default": "SI_RiskAnalysis_Detailed (stored as SI_RiskAnalysis_Detailed_CL).",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a clash with an existing table of the same name.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_TableName_Detailed/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_TableName_Summary",
|      "label": "Summary Risk Analysis table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "SI_RiskAnalysis_Summary",
|      "defaultText": "SI_RiskAnalysis_Summary (stored as SI_RiskAnalysis_Summary_CL).",
|      "description": "Custom table base names (engine appends _CL when LA creates the table).",
|      "purpose": "Name of the Log Analytics table that receives rows from the Summary Risk Analysis report.",
|      "effect": "Summary results are written to a different table. Anything reading the standard table, such as workbooks, queries and trend, stops seeing new data unless changed too.",
|      "whenToChange": "Almost never; only to avoid a clash with an existing table of the same name.",
|      "info": {
|        "what": "Name of the Log Analytics table that receives rows from the Summary Risk Analysis report.",
|        "whenChanged": "Summary results are written to a different table. Anything reading the standard table, such as workbooks, queries and trend, stops seeing new data unless changed too.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: risk-analysis.",
|        "default": "SI_RiskAnalysis_Summary (stored as SI_RiskAnalysis_Summary_CL).",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a clash with an existing table of the same name.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_TableName_Summary/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_WorkspaceName",
|      "label": "Risk Analysis workspace name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Uses SI_WorkspaceName (then WorkspaceName); if none, the standard SecurityInsight workspace name.",
|      "description": "override: falls back to $global:WorkspaceName",
|      "purpose": "Name of the Log Analytics workspace Risk Analysis writes its results to, when it should differ from the solution-wide workspace.",
|      "effect": "Risk Analysis results go to this workspace, which is created if it does not exist. Ignored when SI_RiskAnalysis_WorkspaceResourceId or a workspace resource id is set.",
|      "whenToChange": "Only when Risk Analysis results must go to a separate workspace from collection data.",
|      "info": {
|        "what": "Name of the Log Analytics workspace Risk Analysis writes its results to, when it should differ from the solution-wide workspace.",
|        "whenChanged": "Risk Analysis results go to this workspace, which is created if it does not exist. Ignored when SI_RiskAnalysis_WorkspaceResourceId or a workspace resource id is set.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Uses SI_WorkspaceName (then WorkspaceName); if none, the standard SecurityInsight workspace name.",
|        "recommended": "Keep the default. Change it when: Only when Risk Analysis results must go to a separate workspace from collection data.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_WorkspaceName/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_WorkspaceResourceGroup",
|      "label": "Risk Analysis workspace resource group",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Uses WorkspaceResourceGroup; if not set, the standard SecurityInsight resource group.",
|      "description": "override: falls back to $global:WorkspaceResourceGroup",
|      "purpose": "Resource group used to find or create the Risk Analysis workspace when it is given by name.",
|      "effect": "Changes where Risk Analysis looks for, and creates, its workspace when only a workspace name is known. Has no effect when a full workspace resource id is set.",
|      "whenToChange": "Only with SI_RiskAnalysis_WorkspaceName, when that workspace lives in a different resource group.",
|      "info": {
|        "what": "Resource group used to find or create the Risk Analysis workspace when it is given by name.",
|        "whenChanged": "Changes where Risk Analysis looks for, and creates, its workspace when only a workspace name is known. Has no effect when a full workspace resource id is set.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Uses WorkspaceResourceGroup; if not set, the standard SecurityInsight resource group.",
|        "recommended": "Keep the default. Change it when: Only with SI_RiskAnalysis_WorkspaceName, when that workspace lives in a different resource group.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_WorkspaceResourceGroup/"
|      }
|    },
|    {
|      "name": "SI_RiskAnalysis_WorkspaceResourceId",
|      "label": "Risk Analysis workspace resource id",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Uses SI_WorkspaceResourceId (then WorkspaceResourceId); otherwise the workspace is found by name.",
|      "description": "RA-specific workspace + DCR overrides (override the shared values in section 2).",
|      "purpose": "Full resource id of the Log Analytics workspace Risk Analysis writes to and reads collected data from, overriding the shared workspace.",
|      "effect": "Risk Analysis ingests its results into, and reads the SecurityInsight tables from, this workspace, which may be in another subscription. A workspace without the collected data gives empty or partial reports.",
|      "whenToChange": "Only for split setups where Risk Analysis uses a different workspace than the rest of the solution.",
|      "info": {
|        "what": "Full resource id of the Log Analytics workspace Risk Analysis writes to and reads collected data from, overriding the shared workspace.",
|        "whenChanged": "Risk Analysis ingests its results into, and reads the SecurityInsight tables from, this workspace, which may be in another subscription. A workspace without the collected data gives empty or partial reports.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Uses SI_WorkspaceResourceId (then WorkspaceResourceId); otherwise the workspace is found by name.",
|        "recommended": "Keep the default. Change it when: Only for split setups where Risk Analysis uses a different workspace than the rest of the solution.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskAnalysis_WorkspaceResourceId/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_GlobalWeight_Azure",
|      "label": "Azure share of overall score",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0.20",
|      "description": "Share of the overall risk score contributed by Azure findings, as a fraction; defaults to 0.20.",
|      "purpose": "How much the Azure score counts in the overall risk score, relative to the other domains.",
|      "effect": "A higher value makes Azure findings move the overall score more and the other domains less. Individual findings and their scores do not change.",
|      "whenToChange": "Only if Azure matters more or less to your organisation than the default balance.",
|      "info": {
|        "what": "How much the Azure score counts in the overall risk score, relative to the other domains.",
|        "whenChanged": "A higher value makes Azure findings move the overall score more and the other domains less. Individual findings and their scores do not change.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "0.20",
|        "recommended": "Keep the default. Change it when: Only if Azure matters more or less to your organisation than the default balance.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_GlobalWeight_Azure/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_GlobalWeight_Endpoint",
|      "label": "Endpoint share of overall score",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0.30",
|      "description": "--- Risk scoring: domain weights (RA) ------------------------------------- Relative weight of each domain in the cross-domain risk score. Defaults sum to 1.0. Raising one domain lowers the others' relative influence.",
|      "purpose": "How much the endpoint score counts in the overall risk score, relative to the other domains.",
|      "effect": "A higher value makes endpoint findings move the overall score more and the other domains less. Individual findings and their scores do not change.",
|      "whenToChange": "Only if endpoints matter more or less to your organisation than the default balance.",
|      "info": {
|        "what": "How much the endpoint score counts in the overall risk score, relative to the other domains.",
|        "whenChanged": "A higher value makes endpoint findings move the overall score more and the other domains less. Individual findings and their scores do not change.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "0.30",
|        "recommended": "Keep the default. Change it when: Only if endpoints matter more or less to your organisation than the default balance.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_GlobalWeight_Endpoint/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_GlobalWeight_Identity",
|      "label": "Identity share of overall score",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0.30",
|      "description": "Share of the overall risk score contributed by identity findings, as a fraction; defaults to 0.30.",
|      "purpose": "How much the identity score counts in the overall risk score, relative to the other domains.",
|      "effect": "A higher value makes identity findings move the overall score more and the other domains less. Individual findings and their scores do not change.",
|      "whenToChange": "Only if identities matter more or less to your organisation than the default balance.",
|      "info": {
|        "what": "How much the identity score counts in the overall risk score, relative to the other domains.",
|        "whenChanged": "A higher value makes identity findings move the overall score more and the other domains less. Individual findings and their scores do not change.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "0.30",
|        "recommended": "Keep the default. Change it when: Only if identities matter more or less to your organisation than the default balance.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_GlobalWeight_Identity/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_GlobalWeight_PublicIP",
|      "label": "Public IP share of overall score",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0.20",
|      "description": "Share of the overall risk score contributed by public-IP findings, as a fraction; defaults to 0.20.",
|      "purpose": "How much the public IP score counts in the overall risk score, relative to the other domains.",
|      "effect": "A higher value makes public IP findings move the overall score more and the other domains less. Individual findings and their scores do not change.",
|      "whenToChange": "Only if internet exposure matters more or less to your organisation than the default balance.",
|      "info": {
|        "what": "How much the public IP score counts in the overall risk score, relative to the other domains.",
|        "whenChanged": "A higher value makes public IP findings move the overall score more and the other domains less. Individual findings and their scores do not change.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "0.20",
|        "recommended": "Keep the default. Change it when: Only if internet exposure matters more or less to your organisation than the default balance.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_GlobalWeight_PublicIP/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_SeverityWeight_Critical",
|      "label": "Critical finding weight",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "10",
|      "description": "--- Risk scoring: severity weights (RA) ----------------------------------- What each severity band contributes before tier multiplication.",
|      "purpose": "How heavily a Critical finding lowers the score in the management risk score (on a 0 to 10 scale, where 10 is the full penalty).",
|      "effect": "A lower value makes Critical findings pull the domain and overall scores down less. Values above 10 act as 10. The original per-finding risk score is not affected.",
|      "whenToChange": "Rarely; only to tune the management score to your own risk appetite.",
|      "info": {
|        "what": "How heavily a Critical finding lowers the score in the management risk score (on a 0 to 10 scale, where 10 is the full penalty).",
|        "whenChanged": "A lower value makes Critical findings pull the domain and overall scores down less. Values above 10 act as 10. The original per-finding risk score is not affected.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "10",
|        "recommended": "Keep the default. Change it when: Rarely; only to tune the management score to your own risk appetite.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_SeverityWeight_Critical/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_SeverityWeight_High",
|      "label": "High severity weight",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "5 (Critical is 10, Medium 2, Low 1)",
|      "description": "Score weight given to a High (or Medium-High) severity finding in the risk report; defaults to 5.0.",
|      "purpose": "Sets how heavily a High (or Medium-High) severity finding counts in the Risk Analysis score columns used for management reporting.",
|      "effect": "A higher weight lowers the secure-score value of High findings and raises their share of the domain and overall scores. The original risk score columns are not affected.",
|      "whenToChange": "Most installs never should; change only to align the scores with your own risk model.",
|      "info": {
|        "what": "Sets how heavily a High (or Medium-High) severity finding counts in the Risk Analysis score columns used for management reporting.",
|        "whenChanged": "A higher weight lowers the secure-score value of High findings and raises their share of the domain and overall scores. The original risk score columns are not affected.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "5 (Critical is 10, Medium 2, Low 1)",
|        "recommended": "Keep the default. Change it when: Most installs never should; change only to align the scores with your own risk model.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_SeverityWeight_High/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_SeverityWeight_Low",
|      "label": "Low severity weight",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1",
|      "description": "Score weight given to a Low severity finding in the risk report; defaults to 1.0.",
|      "purpose": "Sets how heavily a Low severity finding counts in the Risk Analysis score columns used for management reporting.",
|      "effect": "A higher weight lowers the secure-score value of Low findings and gives them more influence on the domain and overall scores. The original risk score columns are not affected.",
|      "whenToChange": "Most installs never should; change only to align the scores with your own risk model.",
|      "info": {
|        "what": "Sets how heavily a Low severity finding counts in the Risk Analysis score columns used for management reporting.",
|        "whenChanged": "A higher weight lowers the secure-score value of Low findings and gives them more influence on the domain and overall scores. The original risk score columns are not affected.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "1",
|        "recommended": "Keep the default. Change it when: Most installs never should; change only to align the scores with your own risk model.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_SeverityWeight_Low/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_SeverityWeight_Medium",
|      "label": "Medium severity weight",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "2",
|      "description": "Score weight given to a Medium severity finding in the risk report; defaults to 2.0.",
|      "purpose": "Sets how heavily a Medium severity finding counts in the Risk Analysis score columns used for management reporting.",
|      "effect": "A higher weight lowers the secure-score value of Medium findings and gives them more influence on the domain and overall scores. The original risk score columns are not affected.",
|      "whenToChange": "Most installs never should; change only to align the scores with your own risk model.",
|      "info": {
|        "what": "Sets how heavily a Medium severity finding counts in the Risk Analysis score columns used for management reporting.",
|        "whenChanged": "A higher weight lowers the secure-score value of Medium findings and gives them more influence on the domain and overall scores. The original risk score columns are not affected.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "2",
|        "recommended": "Keep the default. Change it when: Most installs never should; change only to align the scores with your own risk model.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_SeverityWeight_Medium/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_TierMultiplier_T0",
|      "label": "Tier 0 score multiplier",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "4 (four times a Tier 2 asset)",
|      "description": "--- Risk scoring: tier multipliers (RA) ----------------------------------- How much an asset's criticality tier amplifies its score. T0 = 4x a T2 asset.",
|      "purpose": "Sets how much more a finding on a Tier 0 (most critical) asset counts in the Risk Analysis domain and overall scores.",
|      "effect": "A higher value makes Tier 0 findings dominate the domain and overall scores; a lower value spreads attention to less critical assets. The original risk score columns are not affected.",
|      "whenToChange": "Most installs never should; change only if your tier model weighs critical assets differently.",
|      "info": {
|        "what": "Sets how much more a finding on a Tier 0 (most critical) asset counts in the Risk Analysis domain and overall scores.",
|        "whenChanged": "A higher value makes Tier 0 findings dominate the domain and overall scores; a lower value spreads attention to less critical assets. The original risk score columns are not affected.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "4 (four times a Tier 2 asset)",
|        "recommended": "Keep the default. Change it when: Most installs never should; change only if your tier model weighs critical assets differently.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_TierMultiplier_T0/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_TierMultiplier_T1",
|      "label": "Tier 1 score multiplier",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "2 (twice a Tier 2 asset)",
|      "description": "Multiplier applied to the risk score of findings on Tier 1 assets; defaults to 2.0.",
|      "purpose": "Sets how much a finding on a Tier 1 asset counts in the Risk Analysis domain and overall scores.",
|      "effect": "A higher value gives Tier 1 findings more influence on the domain and overall scores. The original risk score columns are not affected.",
|      "whenToChange": "Most installs never should; change only if your tier model weighs assets differently.",
|      "info": {
|        "what": "Sets how much a finding on a Tier 1 asset counts in the Risk Analysis domain and overall scores.",
|        "whenChanged": "A higher value gives Tier 1 findings more influence on the domain and overall scores. The original risk score columns are not affected.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "2 (twice a Tier 2 asset)",
|        "recommended": "Keep the default. Change it when: Most installs never should; change only if your tier model weighs assets differently.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_TierMultiplier_T1/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_TierMultiplier_T2",
|      "label": "Tier 2 score multiplier",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "1 (the baseline); assets with no tier also count 1",
|      "description": "Multiplier applied to the risk score of findings on Tier 2 assets; defaults to 1.0.",
|      "purpose": "Sets how much a finding on a Tier 2 asset counts in the Risk Analysis domain and overall scores; the baseline the other tiers compare to.",
|      "effect": "Changing it shifts the balance between Tier 2 assets and the other tiers in the domain and overall scores. The original risk score columns are not affected.",
|      "whenToChange": "Most installs never should; change only if your tier model weighs assets differently.",
|      "info": {
|        "what": "Sets how much a finding on a Tier 2 asset counts in the Risk Analysis domain and overall scores; the baseline the other tiers compare to.",
|        "whenChanged": "Changing it shifts the balance between Tier 2 assets and the other tiers in the domain and overall scores. The original risk score columns are not affected.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "1 (the baseline); assets with no tier also count 1",
|        "recommended": "Keep the default. Change it when: Most installs never should; change only if your tier model weighs assets differently.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_TierMultiplier_T2/"
|      }
|    },
|    {
|      "name": "SI_RiskReport_TierMultiplier_T3",
|      "label": "Tier 3 score multiplier",
|      "group": "Risk Analysis reports",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0.5 (half a Tier 2 asset)",
|      "description": "Multiplier applied to the risk score of findings on Tier 3 assets; defaults to 0.5.",
|      "purpose": "Sets how much a finding on a Tier 3 (least critical) asset counts in the Risk Analysis domain and overall scores.",
|      "effect": "A higher value gives low-criticality assets more influence on the domain and overall scores; a lower value nearly ignores them. The original risk score columns are not affected.",
|      "whenToChange": "Most installs never should; change only if your tier model weighs assets differently.",
|      "info": {
|        "what": "Sets how much a finding on a Tier 3 (least critical) asset counts in the Risk Analysis domain and overall scores.",
|        "whenChanged": "A higher value gives low-criticality assets more influence on the domain and overall scores; a lower value nearly ignores them. The original risk score columns are not affected.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "0.5 (half a Tier 2 asset)",
|        "recommended": "Keep the default. Change it when: Most installs never should; change only if your tier model weighs assets differently.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_RiskReport_TierMultiplier_T3/"
|      }
|    },
|    {
|      "name": "SI_SchemaCatalogDcr",
|      "label": "Schema catalog collection rule",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "dcr-si-schema-catalog",
|      "description": "Optional: override the default schema-catalog DCR / table names.",
|      "purpose": "Name of the data collection rule schema discovery uses to send its catalog of found data fields to Log Analytics.",
|      "effect": "Schema catalog rows are sent through this rule instead. A rule that does not match the catalog table makes the catalog stop arriving.",
|      "whenToChange": "Almost never; only to avoid a name clash with an existing rule.",
|      "info": {
|        "what": "Name of the data collection rule schema discovery uses to send its catalog of found data fields to Log Analytics.",
|        "whenChanged": "Schema catalog rows are sent through this rule instead. A rule that does not match the catalog table makes the catalog stop arriving.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "dcr-si-schema-catalog",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a name clash with an existing rule.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SchemaCatalogDcr/"
|      }
|    },
|    {
|      "name": "SI_SchemaCatalogTable",
|      "label": "Schema catalog table name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "SI_SchemaCatalog (stored as SI_SchemaCatalog_CL).",
|      "description": "default",
|      "purpose": "Log Analytics table receiving the schema catalog: new data fields, relationships and draft proposals found by schema discovery.",
|      "effect": "Schema discovery writes its catalog to this table. Queries reading the standard table will no longer see new rows.",
|      "whenToChange": "Almost never; only to avoid a clash with an existing table.",
|      "info": {
|        "what": "Log Analytics table receiving the schema catalog: new data fields, relationships and draft proposals found by schema discovery.",
|        "whenChanged": "Schema discovery writes its catalog to this table. Queries reading the standard table will no longer see new rows.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "SI_SchemaCatalog (stored as SI_SchemaCatalog_CL).",
|        "recommended": "Keep the default. Change it when: Almost never; only to avoid a clash with an existing table.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SchemaCatalogTable/"
|      }
|    },
|    {
|      "name": "SI_SchemaProposeAiCeiling",
|      "label": "Schema discovery AI budget",
|      "group": "AI",
|      "type": "number",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "5 US dollars per run.",
|      "description": "AI cost ceiling for one schema-discovery run (USD; per-finding ~$0.01).",
|      "purpose": "Maximum estimated AI spend, in US dollars, for drafting rules from new findings in one schema-discovery run.",
|      "effect": "Raising it lets more new findings get an AI-drafted rule per run, at higher AI cost. Findings beyond the budget wait for the next weekly run.",
|      "whenToChange": "Lower it to cap AI cost; raise it if many findings keep being deferred.",
|      "unit": "USD",
|      "card": "AI spending",
|      "info": {
|        "what": "Maximum estimated AI spend, in US dollars, for drafting rules from new findings in one schema-discovery run.",
|        "whenChanged": "Raising it lets more new findings get an AI-drafted rule per run, at higher AI cost. Findings beyond the budget wait for the next weekly run.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Nothing else.",
|        "default": "5 US dollars per run.",
|        "recommended": "Keep the default. Change it when: Lower it to cap AI cost; raise it if many findings keep being deferred.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SchemaProposeAiCeiling/"
|      }
|    },
|    {
|      "name": "SI_SchemaTables",
|      "label": "Schema discovery hunting tables",
|      "group": "Collection scope & limits",
|      "type": "list",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "A shipped list of 17 high-signal tables (device, identity, alert, email, cloud app, exposure graph).",
|      "description": "Override the curated hunting-table list (default = 16 high-signal tables).",
|      "purpose": "List of Defender advanced-hunting tables whose columns schema discovery checks for new fields.",
|      "effect": "Replaces the shipped list entirely. Fewer tables means a faster run but new fields elsewhere go unnoticed; tables you cannot query cause errors for that table.",
|      "whenToChange": "Only to add newly released tables or drop ones your licences do not include.",
|      "info": {
|        "what": "List of Defender advanced-hunting tables whose columns schema discovery checks for new fields.",
|        "whenChanged": "Replaces the shipped list entirely. Fewer tables means a faster run but new fields elsewhere go unnoticed; tables you cannot query cause errors for that table.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "A shipped list of 17 high-signal tables (device, identity, alert, email, cloud app, exposure graph).",
|        "recommended": "Keep the default. Change it when: Only to add newly released tables or drop ones your licences do not include.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SchemaTables/"
|      }
|    },
|    {
|      "name": "SI_Shodan_ApiKey",
|      "label": "Shodan API key",
|      "group": "Collection scope & limits",
|      "type": "text",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": true,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: older SHODAN_ApiKey name or SHODAN_API_KEY environment variable is tried; else Shodan lookups are skipped.",
|      "description": "canonical SI-prefixed alias",
|      "purpose": "The Shodan API key used to look up what is exposed on your public IP addresses.",
|      "effect": "With a key, each address is enriched with open ports, services and vulnerabilities from Shodan, using your Shodan plan's quota. Without it the engine still writes rows, but every Shodan field is empty.",
|      "whenToChange": "Set it when you use the public IP engine; rotate it when you reset the key in Shodan.",
|      "card": "Public IP checks (Shodan)",
|      "info": {
|        "what": "The Shodan API key used to look up what is exposed on your public IP addresses.",
|        "whenChanged": "With a key, each address is enriched with open ports, services and vulnerabilities from Shodan, using your Shodan plan's quota. Without it the engine still writes rows, but every Shodan field is empty.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Kept in the install's Key Vault. Read by: publicip.",
|        "default": "Not set: older SHODAN_ApiKey name or SHODAN_API_KEY environment variable is tried; else Shodan lookups are skipped.",
|        "recommended": "Keep the default. Change it when: Set it when you use the public IP engine; rotate it when you reset the key in Shodan.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_ApiKey/"
|      }
|    },
|    {
|      "name": "SI_Shodan_AssetLimit",
|      "label": "Shodan address limit (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0: no limit (every candidate address).",
|      "description": "Maximum number of public IP addresses sent to Shodan per run; 0 (default) means no limit.",
|      "purpose": "Caps how many public IP addresses are checked per run.",
|      "effect": "A positive number trims the candidate list to that many addresses, so the run is shorter and uses fewer Shodan lookups, but results are incomplete.",
|      "whenToChange": "Only for testing or a quick trial run.",
|      "unit": "assets",
|      "info": {
|        "what": "Caps how many public IP addresses are checked per run.",
|        "whenChanged": "A positive number trims the candidate list to that many addresses, so the run is shorter and uses fewer Shodan lookups, but results are incomplete.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "0: no limit (every candidate address).",
|        "recommended": "Keep the default. Change it when: Only for testing or a quick trial run.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_AssetLimit/"
|      }
|    },
|    {
|      "name": "SI_Shodan_ForceFreshScan",
|      "label": "Shodan fresh scans",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off: cached and existing Shodan data only, no scan credits spent.",
|      "description": "Set ForceFreshScan = $true and schedule the launcher to run at 02:00 + 03:00 (and optionally 04:00). First run submits + waits up to 5 min, persisting scan_id to data/shodan-pending-scans.json if it can't sync-complete. Later runs check pending state + a skip-if-recent guard (data/shodan-last-fresh-scan.json) so credits don't burn on duplicate submits. Defaults are OFF -- cache-only mode -- so passive enrichment doesn't burn scan credits. Turn ON in LauncherConfig.custom.ps1 when you want fresh data.",
|      "purpose": "Asks Shodan to actively re-scan your addresses before reading results, instead of using only data Shodan already has.",
|      "effect": "On, a batch scan is submitted (at most once per fresh scan interval) and the run waits for it; if it does not finish in time the run writes no rows and the next run picks it up. Spends Shodan scan credits.",
|      "whenToChange": "When you need current results and your Shodan plan has scan credits; schedule extra runs a few hours apart.",
|      "card": "Public IP checks (Shodan)",
|      "info": {
|        "what": "Asks Shodan to actively re-scan your addresses before reading results, instead of using only data Shodan already has.",
|        "whenOn": "On, a batch scan is submitted (at most once per fresh scan interval) and the run waits for it; if it does not finish in time the run writes no rows and the next run picks it up. Spends Shodan scan credits.",
|        "whenOff": "cached and existing Shodan data only, no scan credits spent.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "Off: cached and existing Shodan data only, no scan credits spent.",
|        "recommended": "Keep the default. Change it when: When you need current results and your Shodan plan has scan credits; schedule extra runs a few hours apart.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_ForceFreshScan/"
|      }
|    },
|    {
|      "name": "SI_Shodan_FreshScanIntervalHours",
|      "label": "Shodan fresh scan interval",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 20,
|      "defaultText": "20 hours.",
|      "description": "don't re-submit within this window",
|      "purpose": "The minimum time between two fresh Shodan scans when fresh scans are on.",
|      "effect": "Lower values submit new scans more often, spending more scan credits; higher values reuse the last scan longer. Only matters when SI_Shodan_ForceFreshScan is on.",
|      "whenToChange": "When your schedule or Shodan credit budget calls for more or fewer scans.",
|      "unit": "hours",
|      "info": {
|        "what": "The minimum time between two fresh Shodan scans when fresh scans are on.",
|        "whenChanged": "Lower values submit new scans more often, spending more scan credits; higher values reuse the last scan longer. Only matters when SI_Shodan_ForceFreshScan is on.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "20 hours.",
|        "recommended": "Keep the default. Change it when: When your schedule or Shodan credit budget calls for more or fewer scans.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_FreshScanIntervalHours/"
|      }
|    },
|    {
|      "name": "SI_Shodan_LastFreshScanPath",
|      "label": "Shodan last scan state file",
|      "group": "Collection scope & limits",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "A file in the solution's data folder.",
|      "description": "default: a file in the solution's data folder",
|      "purpose": "Where the engine records when the last fresh Shodan scan finished.",
|      "effect": "The interval check reads this file. Pointing it somewhere that is lost between runs means scans may be re-submitted early, spending extra credits.",
|      "whenToChange": "Only when the data folder is not kept between runs.",
|      "info": {
|        "what": "Where the engine records when the last fresh Shodan scan finished.",
|        "whenChanged": "The interval check reads this file. Pointing it somewhere that is lost between runs means scans may be re-submitted early, spending extra credits.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "A file in the solution's data folder.",
|        "recommended": "Keep the default. Change it when: Only when the data folder is not kept between runs.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_LastFreshScanPath/"
|      }
|    },
|    {
|      "name": "SI_Shodan_LookbackDays",
|      "label": "Public IP discovery lookback",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 8,
|      "defaultText": "8 days.",
|      "description": "Lookback window for Profile_CL discovery (days). Latest snapshot per PrimaryEntityId within this window is used. Default 8 days.",
|      "purpose": "How far back the engine looks in the endpoint and Azure profile tables to find classified assets with public IPs.",
|      "effect": "Each asset's latest snapshot within the window is used. A shorter window drops assets not seen recently; a longer one keeps retired assets in scope.",
|      "whenToChange": "When profiling runs less often than weekly.",
|      "unit": "days",
|      "info": {
|        "what": "How far back the engine looks in the endpoint and Azure profile tables to find classified assets with public IPs.",
|        "whenChanged": "Each asset's latest snapshot within the window is used. A shorter window drops assets not seen recently; a longer one keeps retired assets in scope.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "8 days.",
|        "recommended": "Keep the default. Change it when: When profiling runs less often than weekly.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_LookbackDays/"
|      }
|    },
|    {
|      "name": "SI_Shodan_PendingScansPath",
|      "label": "Shodan pending scan state file",
|      "group": "Collection scope & limits",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "A file in the solution's data folder.",
|      "description": "default: a file in the solution's data folder",
|      "purpose": "Where the engine remembers a submitted Shodan scan that has not finished yet.",
|      "effect": "The next run reads this file to collect the pending scan. If the file is lost between runs, the scan result is not picked up and a new scan may be submitted.",
|      "whenToChange": "Only when the data folder is not kept between runs.",
|      "info": {
|        "what": "Where the engine remembers a submitted Shodan scan that has not finished yet.",
|        "whenChanged": "The next run reads this file to collect the pending scan. If the file is lost between runs, the scan result is not picked up and a new scan may be submitted.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "A file in the solution's data folder.",
|        "recommended": "Keep the default. Change it when: Only when the data folder is not kept between runs.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_PendingScansPath/"
|      }
|    },
|    {
|      "name": "SI_Shodan_ScanPollIntervalSec",
|      "label": "Shodan scan poll interval",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 30,
|      "defaultText": "30 seconds.",
|      "description": "default 30 seconds between scan-status checks",
|      "purpose": "How often the engine checks whether a submitted fresh Shodan scan has finished.",
|      "effect": "Shorter checks notice completion sooner but make more status calls; longer checks may wait past completion. Only used with fresh scans on.",
|      "whenToChange": "Rarely; the default suits most installs.",
|      "unit": "seconds",
|      "info": {
|        "what": "How often the engine checks whether a submitted fresh Shodan scan has finished.",
|        "whenChanged": "Shorter checks notice completion sooner but make more status calls; longer checks may wait past completion. Only used with fresh scans on.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "30 seconds.",
|        "recommended": "Keep the default. Change it when: Rarely; the default suits most installs.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_ScanPollIntervalSec/"
|      }
|    },
|    {
|      "name": "SI_Shodan_ScanWaitMaxSec",
|      "label": "Shodan scan wait limit",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 300,
|      "defaultText": "300 seconds (5 minutes).",
|      "description": "5-min sync deadline per run",
|      "purpose": "How long one run waits for a submitted fresh Shodan scan to finish.",
|      "effect": "Longer waits make the run take longer but finish more scans in the same run; if the limit passes, the run writes no rows and the next run collects the scan.",
|      "whenToChange": "When scans routinely take longer than five minutes for your address count.",
|      "unit": "seconds",
|      "info": {
|        "what": "How long one run waits for a submitted fresh Shodan scan to finish.",
|        "whenChanged": "Longer waits make the run take longer but finish more scans in the same run; if the limit passes, the run writes no rows and the next run collects the scan.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "300 seconds (5 minutes).",
|        "recommended": "Keep the default. Change it when: When scans routinely take longer than five minutes for your address count.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_ScanWaitMaxSec/"
|      }
|    },
|    {
|      "name": "SI_Shodan_ServerOnly",
|      "label": "Scan server IPs only",
|      "group": "Collection scope & limits",
|      "type": "bool",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": true,
|      "defaultText": "On: only servers' public IPs are checked.",
|      "description": "Server-only filter for Profile_CL discovery from SI_Endpoint_Profile_CL. Workstation PublicIp = user's home/cafe/cellular ISP NAT, not a scannable asset the customer owns. Default $true.",
|      "purpose": "Limits endpoint-derived public IPs to servers, because a workstation's public IP is usually a home or mobile network you do not own.",
|      "effect": "Off adds workstation public IPs, which are mostly internet provider addresses: more lookups and results that do not describe your own exposure.",
|      "whenToChange": "Almost never.",
|      "info": {
|        "what": "Limits endpoint-derived public IPs to servers, because a workstation's public IP is usually a home or mobile network you do not own.",
|        "whenOn": "only servers' public IPs are checked.",
|        "whenOff": "Off adds workstation public IPs, which are mostly internet provider addresses: more lookups and results that do not describe your own exposure.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "On: only servers' public IPs are checked.",
|        "recommended": "Keep the default. Change it when: Almost never.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_ServerOnly/"
|      }
|    },
|    {
|      "name": "SI_Shodan_ThrottleMs",
|      "label": "Shodan call spacing",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 1100,
|      "defaultText": "1100 milliseconds (about one call per second).",
|      "description": "1 req/sec (Shodan free-tier rate)",
|      "purpose": "Pause between live Shodan lookups so the engine stays within Shodan's rate limit.",
|      "effect": "A lower value speeds up large runs but may hit Shodan's rate limit and cause failed lookups on lower plans. Cached lookups are not delayed.",
|      "whenToChange": "Lower it only if your Shodan plan allows faster calls.",
|      "unit": "milliseconds",
|      "info": {
|        "what": "Pause between live Shodan lookups so the engine stays within Shodan's rate limit.",
|        "whenChanged": "A lower value speeds up large runs but may hit Shodan's rate limit and cause failed lookups on lower plans. Cached lookups are not delayed.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "1100 milliseconds (about one call per second).",
|        "recommended": "Keep the default. Change it when: Lower it only if your Shodan plan allows faster calls.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_ThrottleMs/"
|      }
|    },
|    {
|      "name": "SI_Shodan_TierMax",
|      "label": "Highest tier to check",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": 3,
|      "defaultText": "3: all tiers (0 to 3).",
|      "description": "default 3 = scan all tiers (T0-T3). Lower to 1 for T0/T1 only (Shodan cost control).",
|      "purpose": "Checks public IPs only for assets at or below this privilege tier (0 is most critical).",
|      "effect": "Lowering it, for example to 1, checks only the most critical assets, cutting Shodan lookups and cost but leaving lower-tier exposure unchecked.",
|      "whenToChange": "To control Shodan cost on a small plan.",
|      "card": "Public IP checks (Shodan)",
|      "hint": "0 is the most critical tier.",
|      "info": {
|        "what": "Checks public IPs only for assets at or below this privilege tier (0 is most critical).",
|        "whenChanged": "Lowering it, for example to 1, checks only the most critical assets, cutting Shodan lookups and cost but leaving lower-tier exposure unchecked.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "3: all tiers (0 to 3).",
|        "recommended": "Keep the default. Change it when: To control Shodan cost on a small plan.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_TierMax/"
|      }
|    },
|    {
|      "name": "SI_Shodan_TimeoutSec",
|      "label": "Shodan call timeout",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 15,
|      "defaultText": "15 seconds.",
|      "description": "Per-call timeout (seconds) for both /host and /scan submissions.",
|      "purpose": "How long each Shodan lookup or scan submission may take before it is abandoned.",
|      "effect": "Longer timeouts tolerate a slow service at the cost of longer runs; shorter ones fail faster, leaving that address without Shodan data for the run.",
|      "whenToChange": "Only if lookups time out on a slow network.",
|      "unit": "seconds",
|      "info": {
|        "what": "How long each Shodan lookup or scan submission may take before it is abandoned.",
|        "whenChanged": "Longer timeouts tolerate a slow service at the cost of longer runs; shorter ones fail faster, leaving that address without Shodan data for the run.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "15 seconds.",
|        "recommended": "Keep the default. Change it when: Only if lookups time out on a slow network.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Shodan_TimeoutSec/"
|      }
|    },
|    {
|      "name": "SI_ShodanCacheAgeDays",
|      "label": "Shodan cache age",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 7,
|      "defaultText": "7 days.",
|      "description": "Cache + spend guards.",
|      "purpose": "How long a stored Shodan result is reused before the address is looked up again.",
|      "effect": "Shorter means fresher data but more live Shodan calls and longer runs; longer saves calls but results can be out of date.",
|      "whenToChange": "When you need fresher exposure data or must save Shodan quota.",
|      "unit": "days",
|      "info": {
|        "what": "How long a stored Shodan result is reused before the address is looked up again.",
|        "whenChanged": "Shorter means fresher data but more live Shodan calls and longer runs; longer saves calls but results can be out of date.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "7 days.",
|        "recommended": "Keep the default. Change it when: When you need fresher exposure data or must save Shodan quota.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ShodanCacheAgeDays/"
|      }
|    },
|    {
|      "name": "SI_ShodanMonthlyCreditCap",
|      "label": "Shodan monthly credit cap",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": 4000,
|      "defaultText": "4000 credits per month.",
|      "description": "Shodan monthly credit cap -- soft ceiling. The engine refuses new live calls when the rolling-month counter exceeds this. Default 4000 (matches a typical Small Business plan). Bump or lower based on your subscription tier.",
|      "purpose": "A safety ceiling on the Shodan scan credits spent per month, by per-address on-demand scans and by the batch fresh scan.",
|      "effect": "A scan that would take the month past the cap is refused (the batch fresh scan counts one credit per address), and so is any scan while the month's count cannot be read. Normal host lookups are not limited.",
|      "whenToChange": "Match it to your Shodan plan's monthly scan credits.",
|      "unit": "credits",
|      "card": "Public IP checks (Shodan)",
|      "info": {
|        "what": "A safety ceiling on the Shodan scan credits spent per month, by per-address on-demand scans and by the batch fresh scan.",
|        "whenChanged": "A scan that would take the month past the cap is refused (the batch fresh scan counts one credit per address), and so is any scan while the month's count cannot be read. Normal host lookups are not limited.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: publicip.",
|        "default": "4000 credits per month.",
|        "recommended": "Keep the default. Change it when: Match it to your Shodan plan's monthly scan credits.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_ShodanMonthlyCreditCap/"
|      }
|    },
|    {
|      "name": "SI_SignalMap_PromptVersion",
|      "label": "AI signal map version",
|      "group": "AI",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "v1",
|      "description": "Bump to invalidate the cached per-engine signal-map weights (forces re-AI).",
|      "purpose": "A version label for the stored AI signal weights per engine and asset type; changing it makes the engines ask the AI again.",
|      "effect": "A new value ignores the stored weights and rebuilds them with fresh AI calls on the next run, which adds AI cost once. Keeping the value reuses the stored weights.",
|      "whenToChange": "Only when you want the AI signal weights rebuilt, for example after a model change.",
|      "info": {
|        "what": "A version label for the stored AI signal weights per engine and asset type; changing it makes the engines ask the AI again.",
|        "whenChanged": "A new value ignores the stored weights and rebuilds them with fresh AI calls on the next run, which adds AI cost once. Keeping the value reuses the stored weights.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Nothing else.",
|        "default": "v1",
|        "recommended": "Keep the default. Change it when: Only when you want the AI signal weights rebuilt, for example after a model change.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SignalMap_PromptVersion/"
|      }
|    },
|    {
|      "name": "SI_SignInBatchSize",
|      "label": "Sign-in query batch size",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "200 users per query.",
|      "description": "default 200 user ids per sign-in query batch",
|      "purpose": "How many users are looked up in one sign-in log query during identity sign-in enrichment.",
|      "effect": "Larger batches mean fewer queries but each is heavier and may hit query size or memory limits; smaller batches are safer but slower.",
|      "whenToChange": "Only if sign-in queries fail on size limits or run too slowly.",
|      "unit": "users",
|      "info": {
|        "what": "How many users are looked up in one sign-in log query during identity sign-in enrichment.",
|        "whenChanged": "Larger batches mean fewer queries but each is heavier and may hit query size or memory limits; smaller batches are safer but slower.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "200 users per query.",
|        "recommended": "Keep the default. Change it when: Only if sign-in queries fail on size limits or run too slowly.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SignInBatchSize/"
|      }
|    },
|    {
|      "name": "SI_SignInLookbackDays",
|      "label": "Sign-in history window",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "7 days.",
|      "description": "How many days of sign-in history identity enrichment looks back over; defaults to 7.",
|      "purpose": "How many days of sign-in and device logon history the identity and endpoint enrichment look back over.",
|      "effect": "A longer window catches less frequent sign-ins and device users but makes the queries slower and costlier; a shorter one is cheaper but may miss occasional use.",
|      "whenToChange": "When weekly activity is too short a window for your users' patterns.",
|      "unit": "days",
|      "info": {
|        "what": "How many days of sign-in and device logon history the identity and endpoint enrichment look back over.",
|        "whenChanged": "A longer window catches less frequent sign-ins and device users but makes the queries slower and costlier; a shorter one is cheaper but may miss occasional use.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "7 days.",
|        "recommended": "Keep the default. Change it when: When weekly activity is too short a window for your users' patterns.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SignInLookbackDays/"
|      }
|    },
|    {
|      "name": "SI_SimulateCLRowCount",
|      "label": "Simulated table row count",
|      "group": "Advanced / diagnostics",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off (no simulation)",
|      "description": "Simulation only -- forces a synthetic CL row count for scale testing.",
|      "purpose": "Test-only setting that pads the data Risk Analysis reads from your workspace with synthetic rows, to test behaviour at large scale on a small tenant.",
|      "effect": "Risk Analysis handles the extra synthetic rows, so runs get slower and heavier; the fake rows never match real assets and do not appear in the report. A warning is shown while active.",
|      "whenToChange": "Never in normal use; only for scale testing. Usually set by the launcher's asset-simulation option.",
|      "unit": "rows",
|      "info": {
|        "what": "Test-only setting that pads the data Risk Analysis reads from your workspace with synthetic rows, to test behaviour at large scale on a small tenant.",
|        "whenChanged": "Risk Analysis handles the extra synthetic rows, so runs get slower and heavier; the fake rows never match real assets and do not appear in the report. A warning is shown while active.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Off (no simulation)",
|        "recommended": "Keep the default. Change it when: Never in normal use; only for scale testing. Usually set by the launcher's asset-simulation option.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SimulateCLRowCount/"
|      }
|    },
|    {
|      "name": "SI_SingleProcess",
|      "label": "Keep stage data in memory",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: data between stages goes through staging storage.",
|      "description": "Single-process mode (no parallel runspaces; easier debugging, slower).",
|      "purpose": "Makes the profiling engines pass data between stages in memory instead of through the staging storage account.",
|      "effect": "On a single server run this can be much faster. It must stay off for parallel container jobs, where each worker only sees its own memory.",
|      "whenToChange": "Only for single-server troubleshooting or speed tests; leave off otherwise.",
|      "info": {
|        "what": "Makes the profiling engines pass data between stages in memory instead of through the staging storage account.",
|        "whenOn": "On a single server run this can be much faster. It must stay off for parallel container jobs, where each worker only sees its own memory.",
|        "whenOff": "data between stages goes through staging storage.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Off: data between stages goes through staging storage.",
|        "recommended": "Keep the default. Change it when: Only for single-server troubleshooting or speed tests; leave off otherwise.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SingleProcess/"
|      }
|    },
|    {
|      "name": "SI_Sinks_Azure",
|      "label": "Azure collection outputs",
|      "group": "Data & retention",
|      "type": "list",
|      "engines": [
|        "azure"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": [
|        "LA",
|        "JSON",
|        "Excel"
|      ],
|      "defaultText": "All three: Log Analytics, JSON and Excel",
|      "description": "Sinks -- which destinations to write the engine's output to. Allowed entries: 'LA' (Log Analytics), 'JSON', 'Excel'.",
|      "purpose": "Chooses where the Azure collection writes its results: Log Analytics (LA), JSON files and/or Excel files.",
|      "effect": "Leaving out LA means no Azure data in your workspace, so Risk Analysis and workbooks miss it; the collected records still go to the database. Leaving out JSON or Excel only saves local files and time.",
|      "whenToChange": "Most installs never should; drop file outputs if nobody uses them.",
|      "card": "Where collected data goes",
|      "info": {
|        "what": "Chooses where the Azure collection writes its results: Log Analytics (LA), JSON files and/or Excel files.",
|        "whenChanged": "Leaving out LA means no Azure data in your workspace, so Risk Analysis and workbooks miss it; the collected records still go to the database. Leaving out JSON or Excel only saves local files and time.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "Read by: azure.",
|        "default": "All three: Log Analytics, JSON and Excel",
|        "recommended": "Keep the default. Change it when: Most installs never should; drop file outputs if nobody uses them.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Sinks_Azure/"
|      }
|    },
|    {
|      "name": "SI_Sinks_Endpoint",
|      "label": "Endpoint collection outputs",
|      "group": "Data & retention",
|      "type": "list",
|      "engines": [
|        "endpoint"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": [
|        "LA",
|        "JSON",
|        "Excel"
|      ],
|      "defaultText": "All three: Log Analytics, JSON and Excel",
|      "description": "Per-engine sinks: any subset of @('LA','JSON','Excel'). Default = all three.",
|      "purpose": "Chooses where the endpoint collection writes its results: Log Analytics (LA), JSON files and/or Excel files.",
|      "effect": "Leaving out LA means no endpoint data in your workspace, so Risk Analysis and workbooks miss it; the collected records still go to the database. Leaving out JSON or Excel only saves local files and time.",
|      "whenToChange": "Most installs never should; drop file outputs if nobody uses them.",
|      "card": "Where collected data goes",
|      "info": {
|        "what": "Chooses where the endpoint collection writes its results: Log Analytics (LA), JSON files and/or Excel files.",
|        "whenChanged": "Leaving out LA means no endpoint data in your workspace, so Risk Analysis and workbooks miss it; the collected records still go to the database. Leaving out JSON or Excel only saves local files and time.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "Read by: endpoint.",
|        "default": "All three: Log Analytics, JSON and Excel",
|        "recommended": "Keep the default. Change it when: Most installs never should; drop file outputs if nobody uses them.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Sinks_Endpoint/"
|      }
|    },
|    {
|      "name": "SI_Sinks_Identity",
|      "label": "Identity collection outputs",
|      "group": "Data & retention",
|      "type": "list",
|      "engines": [
|        "identity"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": [
|        "LA",
|        "JSON",
|        "Excel"
|      ],
|      "defaultText": "All three: Log Analytics, JSON and Excel",
|      "description": "Sinks -- which destinations to write the engine's output to. Allowed entries: 'LA' (Log Analytics), 'JSON', 'Excel'.",
|      "purpose": "Chooses where the identity collection writes its results: Log Analytics (LA), JSON files and/or Excel files.",
|      "effect": "Leaving out LA means no identity data in your workspace, so Risk Analysis and workbooks miss it; the collected records still go to the database. Leaving out JSON or Excel only saves local files and time.",
|      "whenToChange": "Most installs never should; drop file outputs if nobody uses them.",
|      "card": "Where collected data goes",
|      "info": {
|        "what": "Chooses where the identity collection writes its results: Log Analytics (LA), JSON files and/or Excel files.",
|        "whenChanged": "Leaving out LA means no identity data in your workspace, so Risk Analysis and workbooks miss it; the collected records still go to the database. Leaving out JSON or Excel only saves local files and time.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "Read by: identity.",
|        "default": "All three: Log Analytics, JSON and Excel",
|        "recommended": "Keep the default. Change it when: Most installs never should; drop file outputs if nobody uses them.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Sinks_Identity/"
|      }
|    },
|    {
|      "name": "SI_Sinks_PublicIp",
|      "label": "Public IP collection outputs",
|      "group": "Data & retention",
|      "type": "list",
|      "engines": [
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": [
|        "LA",
|        "JSON",
|        "Excel"
|      ],
|      "defaultText": "All three: Log Analytics, JSON and Excel",
|      "description": "Sinks -- which destinations to write the engine's output to. Allowed entries: 'LA' (Log Analytics), 'JSON', 'Excel'.",
|      "purpose": "Chooses where the public IP collection writes its results: Log Analytics (LA), JSON files and/or Excel files.",
|      "effect": "Leaving out LA means no public IP data in your workspace, so Risk Analysis and workbooks miss it; the collected records still go to the database. Leaving out JSON or Excel only saves local files and time.",
|      "whenToChange": "Most installs never should; drop file outputs if nobody uses them.",
|      "card": "Where collected data goes",
|      "info": {
|        "what": "Chooses where the public IP collection writes its results: Log Analytics (LA), JSON files and/or Excel files.",
|        "whenChanged": "Leaving out LA means no public IP data in your workspace, so Risk Analysis and workbooks miss it; the collected records still go to the database. Leaving out JSON or Excel only saves local files and time.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "Read by: publicip.",
|        "default": "All three: Log Analytics, JSON and Excel",
|        "recommended": "Keep the default. Change it when: Most installs never should; drop file outputs if nobody uses them.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Sinks_PublicIp/"
|      }
|    },
|    {
|      "name": "SI_SPN_AppId",
|      "label": "Service principal app id",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Taken from SpnClientId or the platform; if none, managed identity",
|      "description": "Service principal instead: set SI_AuthMethod = 'Certificate' (recommended) or 'Secret', then fill in the app below.",
|      "purpose": "Application (client) id of the service principal the engines sign in as when not using managed identity.",
|      "effect": "Decides which app registration reads data and ingests results; that app needs the required Graph, Azure and Log Analytics permissions. Without it, no service principal sign-in happens.",
|      "whenToChange": "Set during setup when you use a service principal; change when moving to a different app.",
|      "card": "How SecurityInsight signs in",
|      "info": {
|        "what": "Application (client) id of the service principal the engines sign in as when not using managed identity.",
|        "whenChanged": "Decides which app registration reads data and ingests results; that app needs the required Graph, Azure and Log Analytics permissions. Without it, no service principal sign-in happens.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Taken from SpnClientId or the platform; if none, managed identity",
|        "recommended": "Keep the default. Change it when: Set during setup when you use a service principal; change when moving to a different app.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SPN_AppId/"
|      }
|    },
|    {
|      "name": "SI_SPN_CertStoreLocation",
|      "label": "Certificate store location",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Detected: the store that holds the certificate with its key, else LocalMachine",
|      "description": "or 'CurrentUser'",
|      "purpose": "Which Windows certificate store (LocalMachine or CurrentUser) holds the sign-in certificate of the service principal.",
|      "effect": "Forces the store used for certificate sign-in. A wrong store makes certificate sign-in fail. Containers always use CurrentUser.",
|      "whenToChange": "Rarely; only if automatic detection picks the wrong store on your host.",
|      "info": {
|        "what": "Which Windows certificate store (LocalMachine or CurrentUser) holds the sign-in certificate of the service principal.",
|        "whenChanged": "Forces the store used for certificate sign-in. A wrong store makes certificate sign-in fail. Containers always use CurrentUser.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Detected: the store that holds the certificate with its key, else LocalMachine",
|        "recommended": "Keep the default. Change it when: Rarely; only if automatic detection picks the wrong store on your host.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SPN_CertStoreLocation/"
|      }
|    },
|    {
|      "name": "SI_SPN_CertThumbprint",
|      "label": "Sign-in certificate thumbprint",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Taken from the platform's certificate setting if present; else no certificate sign-in",
|      "description": "Thumbprint of the service principal's certificate (with its private key in the machine or user certificate store); used when SI_AuthMethod is Certificate.",
|      "purpose": "Thumbprint of the service principal's certificate, with its private key in the certificate store, used for certificate sign-in.",
|      "effect": "Lets the engines, ingestion and SQL connections sign in with this certificate. A wrong or missing certificate makes certificate sign-in fail; with both certificate and secret set, the certificate is preferred.",
|      "whenToChange": "Set at install and when the certificate is renewed.",
|      "card": "How SecurityInsight signs in",
|      "info": {
|        "what": "Thumbprint of the service principal's certificate, with its private key in the certificate store, used for certificate sign-in.",
|        "whenChanged": "Lets the engines, ingestion and SQL connections sign in with this certificate. A wrong or missing certificate makes certificate sign-in fail; with both certificate and secret set, the certificate is preferred.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Taken from the platform's certificate setting if present; else no certificate sign-in",
|        "recommended": "Keep the default. Change it when: Set at install and when the certificate is renewed.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SPN_CertThumbprint/"
|      }
|    },
|    {
|      "name": "SI_SPN_ObjectId",
|      "label": "Service principal object id",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Looked up from the app id at run start",
|      "description": "SP ObjectId, NOT AppId",
|      "purpose": "Object id (not app id) of the service principal, used to grant it rights on data collection rules and storage.",
|      "effect": "If it cannot be found, infrastructure preparation is skipped and new data collection rules may lack the ingest permission. A wrong id grants rights to the wrong principal.",
|      "whenToChange": "Only when the automatic lookup fails because the signing-in identity cannot read service principals.",
|      "info": {
|        "what": "Object id (not app id) of the service principal, used to grant it rights on data collection rules and storage.",
|        "whenChanged": "If it cannot be found, infrastructure preparation is skipped and new data collection rules may lack the ingest permission. A wrong id grants rights to the wrong principal.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Looked up from the app id at run start",
|        "recommended": "Keep the default. Change it when: Only when the automatic lookup fails because the signing-in identity cannot read service principals.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SPN_ObjectId/"
|      }
|    },
|    {
|      "name": "SI_SPN_Secret",
|      "label": "Service principal client secret",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": true,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: certificate or managed identity is used",
|      "description": "Secret only; rotate via your Key Vault procedure",
|      "purpose": "Client secret of the service principal when the sign-in method is Secret.",
|      "effect": "Enables secret-based sign-in. If a certificate thumbprint is also set, the certificate wins and the secret is ignored. Secrets expire and must be rotated.",
|      "whenToChange": "Only when you cannot use managed identity or a certificate; rotate via your Key Vault procedure.",
|      "card": "How SecurityInsight signs in",
|      "info": {
|        "what": "Client secret of the service principal when the sign-in method is Secret.",
|        "whenChanged": "Enables secret-based sign-in. If a certificate thumbprint is also set, the certificate wins and the secret is ignored. Secrets expire and must be rotated.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Kept in the install's Key Vault.",
|        "default": "Not set: certificate or managed identity is used",
|        "recommended": "Keep the default. Change it when: Only when you cannot use managed identity or a certificate; rotate via your Key Vault procedure.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SPN_Secret/"
|      }
|    },
|    {
|      "name": "SI_SPN_TenantId",
|      "label": "Service principal tenant id",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Taken from SpnTenantId, the platform, or the managed identity's sign-in",
|      "description": "v2.2 uses ONE SPN for everything: Defender Graph reads, ARG, and Log Analytics DCR ingest. SPN must hold ThreatHunting.Read.All, Device.Read.All, User.Read.All, Application.Read.All Graph app-roles + Reader on the sub + Monitoring Metrics Publisher on the DCR RG + Storage Blob/Table/Queue Data Contributor on the staging account (storage is reached only with this identity). These four are REQUIRED. Bootstrap-Auth.ps1 pulls them from KV when blank.",
|      "purpose": "The Entra tenant the service principal signs in to, for data reads and Log Analytics ingestion.",
|      "effect": "Decides which tenant is read. A wrong value makes sign-in fail or targets the wrong tenant.",
|      "whenToChange": "Set during setup when you use a service principal.",
|      "card": "How SecurityInsight signs in",
|      "info": {
|        "what": "The Entra tenant the service principal signs in to, for data reads and Log Analytics ingestion.",
|        "whenChanged": "Decides which tenant is read. A wrong value makes sign-in fail or targets the wrong tenant.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Taken from SpnTenantId, the platform, or the managed identity's sign-in",
|        "recommended": "Keep the default. Change it when: Set during setup when you use a service principal.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SPN_TenantId/"
|      }
|    },
|    {
|      "name": "SI_SqlPacing_Enabled",
|      "label": "Slow down large writes when the database is busy",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On",
|      "description": "DATABASE WRITE PACE: the large writers (Risk Analysis storing its findings, the data sync preparing the views, the removal of old collections) read how busy the database is before each batch. Above the high mark (the highest of log write, data reads and CPU, in percent of the tier) they pause and write smaller batches; below the low mark they go back to full pace. Nothing is left out -- only slower while the database is saturated. On by default; $false switches it off.",
|      "purpose": "Whether the large database writers (Risk Analysis storing its findings, the data sync preparing the views, the removal of old collections) look at how busy the database is before each batch.",
|      "effect": "On: while the database is at its limit (log write, data reads or CPU above the high mark), each writer pauses before its next batch and writes smaller batches, so the web app and the other jobs keep a share; below the low mark it writes at full pace again. Nothing is left out -- the same rows are written, only slower while the database is saturated. Off: the writers always write at full pace.",
|      "whenToChange": "Leave it on. Switch it off only if support asks you to.",
|      "card": "Database write pace",
|      "info": {
|        "what": "Whether the large database writers (Risk Analysis storing its findings, the data sync preparing the views, the removal of old collections) look at how busy the database is before each batch.",
|        "whenOn": "while the database is at its limit (log write, data reads or CPU above the high mark), each writer pauses before its next batch and writes smaller batches, so the web app and the other jobs keep a share; below the low mark it writes at full pace again. Nothing is left out -- the same rows are written, only slower while the database is saturated.",
|        "whenOff": "the writers always write at full pace.",
|        "risk": "Off: on a busy database the large writers keep it at its limit for as long as the daily run writes, and the web app is slow meanwhile. No data is changed either way. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "On",
|        "recommended": "On (the default).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SqlPacing_Enabled/"
|      }
|    },
|    {
|      "name": "SI_SqlPacing_HighPercent",
|      "label": "Database busy above (percent)",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "85",
|      "description": "The database load (percent) above which the writers slow down. Default 85.",
|      "purpose": "The database load (the highest of log write, data reads and CPU, in percent of what its tier allows) above which the large writers slow down.",
|      "effect": "Lower: the writers make room for the web app sooner, and a full run takes longer on a busy database. Higher: the writers keep their pace until the database is closer to its limit. A value that is not a number from 1 to 100 uses 85.",
|      "whenToChange": "Lower it if the web app is slow during the daily run; raise it if the run must finish sooner and nobody uses the web app then.",
|      "unit": "percent",
|      "min": 1,
|      "max": 100,
|      "card": "Database write pace",
|      "needs": "SI_SqlPacing_Enabled",
|      "info": {
|        "what": "The database load (the highest of log write, data reads and CPU, in percent of what its tier allows) above which the large writers slow down.",
|        "whenChanged": "Lower: the writers make room for the web app sooner, and a full run takes longer on a busy database. Higher: the writers keep their pace until the database is closer to its limit. A value that is not a number from 1 to 100 uses 85.",
|        "risk": "Only changes how soon the large writers slow down: a lower value gives the web app more room and makes a full run take longer on a busy database. No data is changed. Reversible at once.",
|        "requires": "Works only while \"Slow down large writes when the database is busy\" is on.",
|        "default": "85",
|        "recommended": "Keep 85.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SqlPacing_HighPercent/"
|      }
|    },
|    {
|      "name": "SI_SqlPacing_LowPercent",
|      "label": "Database calm again below (percent)",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "70",
|      "description": "The database load (percent) below which they go back to full pace. Default 70; must be below the high mark.",
|      "purpose": "The database load below which the large writers go back to their full pace after they slowed down.",
|      "effect": "Between this and the busy mark a writer keeps the pause it has. Must be below the busy mark; a value at or above it uses the busy mark minus 15.",
|      "whenToChange": "Rarely. Lower it if the writers speed up and slow down again and again.",
|      "unit": "percent",
|      "min": 0,
|      "max": 99,
|      "card": "Database write pace",
|      "needs": "SI_SqlPacing_Enabled",
|      "info": {
|        "what": "The database load below which the large writers go back to their full pace after they slowed down.",
|        "whenChanged": "Between this and the busy mark a writer keeps the pause it has. Must be below the busy mark; a value at or above it uses the busy mark minus 15.",
|        "risk": "Only changes when the large writers go back to full pace. No data is changed. Reversible at once.",
|        "requires": "Works only while \"Slow down large writes when the database is busy\" is on.",
|        "default": "70",
|        "recommended": "Keep 70.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SqlPacing_LowPercent/"
|      }
|    },
|    {
|      "name": "SI_StagingPath",
|      "label": "Risk Analysis local staging folder",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "A staging folder under the output path, else the temp folder",
|      "description": "Optional staging directory override (defaults under SI_StorageAccount sistaging).",
|      "purpose": "A local folder where Risk Analysis writes its temporary query files and query error details.",
|      "effect": "Moves Risk Analysis's temporary query files to this folder. It does not change the staging storage account.",
|      "whenToChange": "Only if the default folder is not writable or too small on your host.",
|      "info": {
|        "what": "A local folder where Risk Analysis writes its temporary query files and query error details.",
|        "whenChanged": "Moves Risk Analysis's temporary query files to this folder. It does not change the staging storage account.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "A staging folder under the output path, else the temp folder",
|        "recommended": "Keep the default. Change it when: Only if the default folder is not writable or too small on your host.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_StagingPath/"
|      }
|    },
|    {
|      "name": "SI_StorageAccount",
|      "label": "Staging storage account",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: collection engines stop with an error",
|      "description": "REQUIRED for v2.2 collection engines: the storage account for the 'sistaging' container (per-asset shards, cache JSONs, schema diffs). It is reached only with the signed-in identity, which needs Storage Blob/Table/Queue Data Contributor on it.",
|      "purpose": "The storage account the collection engines use for staging data, caches, the shared catalog and the identity ledger.",
|      "effect": "Required for endpoint, identity, Azure and public IP collection. It is reached only with the signed-in identity, which needs the Storage Blob, Queue and Table Data Contributor roles on it. Changing it starts staging and caches from empty.",
|      "whenToChange": "Set at install; change only when moving to a new storage account.",
|      "card": "Storage",
|      "info": {
|        "what": "The storage account the collection engines use for staging data, caches, the shared catalog and the identity ledger.",
|        "whenChanged": "Required for endpoint, identity, Azure and public IP collection. It is reached only with the signed-in identity, which needs the Storage Blob, Queue and Table Data Contributor roles on it. Changing it starts staging and caches from empty.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: azure, endpoint, identity, publicip.",
|        "default": "Not set: collection engines stop with an error",
|        "recommended": "Keep the default. Change it when: Set at install; change only when moving to a new storage account.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_StorageAccount/"
|      }
|    },
|    {
|      "name": "SI_StorageResourceGroup",
|      "label": "Storage account resource group",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Same resource group as the workspace (or the data collection rules)",
|      "description": "Resource group of the SecurityInsight storage account, used when setup checks or creates the storage account and its permissions; defaults to the workspace's resource group.",
|      "purpose": "Names the Azure resource group that holds the SecurityInsight storage account. Setup creates the account and grants its permissions there; a collection run only checks that the account is there.",
|      "effect": "Setup looks the storage account up, creates it and grants permissions in this resource group; a run that does not find it there says so in one line and creates nothing. A wrong value makes setup create a second account in the wrong place.",
|      "whenToChange": "Only when your storage account lives in a different resource group from the workspace; setup normally writes it.",
|      "card": "Storage",
|      "info": {
|        "what": "Names the Azure resource group that holds the SecurityInsight storage account. Setup creates the account and grants its permissions there; a collection run only checks that the account is there.",
|        "whenChanged": "Setup looks the storage account up, creates it and grants permissions in this resource group; a run that does not find it there says so in one line and creates nothing. A wrong value makes setup create a second account in the wrong place.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Same resource group as the workspace (or the data collection rules)",
|        "recommended": "Keep the default. Change it when: Only when your storage account lives in a different resource group from the workspace; setup normally writes it.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_StorageResourceGroup/"
|      }
|    },
|    {
|      "name": "SI_SystemPrompt_azure",
|      "label": "Azure AI instructions",
|      "group": "AI",
|      "type": "text",
|      "engines": [
|        "azure"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The built-in Azure classification instructions.",
|      "description": "System prompt override for the Azure AI Classify call. $null = ship default from engine/asset-profiling/stages/Invoke-Classify.ps1.",
|      "purpose": "Replaces the built-in instructions sent to Azure OpenAI when it classifies Azure resources.",
|      "effect": "Changes how AI decides tiers and service types for Azure resources. A poorly written prompt can produce wrong tiers or unreadable answers, which fall back to a default tier. Has no effect while AI is off for the Azure engine.",
|      "whenToChange": "Rarely; only to tune AI classification for your estate.",
|      "info": {
|        "what": "Replaces the built-in instructions sent to Azure OpenAI when it classifies Azure resources.",
|        "whenChanged": "Changes how AI decides tiers and service types for Azure resources. A poorly written prompt can produce wrong tiers or unreadable answers, which fall back to a default tier. Has no effect while AI is off for the Azure engine.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: azure.",
|        "default": "The built-in Azure classification instructions.",
|        "recommended": "Keep the default. Change it when: Rarely; only to tune AI classification for your estate.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SystemPrompt_azure/"
|      }
|    },
|    {
|      "name": "SI_SystemPrompt_endpoint",
|      "label": "Endpoint AI instructions",
|      "group": "AI",
|      "type": "text",
|      "engines": [
|        "endpoint"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The built-in device classification instructions.",
|      "description": "AI system-prompt override for the Endpoint Classify call.",
|      "purpose": "Replaces the built-in instructions sent to Azure OpenAI when it classifies devices.",
|      "effect": "Changes how AI decides tiers and service types for devices. A poorly written prompt can produce wrong tiers or unreadable answers, which fall back to a default tier. Has no effect while AI is off for endpoints.",
|      "whenToChange": "Rarely; only to tune AI classification for your estate.",
|      "info": {
|        "what": "Replaces the built-in instructions sent to Azure OpenAI when it classifies devices.",
|        "whenChanged": "Changes how AI decides tiers and service types for devices. A poorly written prompt can produce wrong tiers or unreadable answers, which fall back to a default tier. Has no effect while AI is off for endpoints.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: endpoint.",
|        "default": "The built-in device classification instructions.",
|        "recommended": "Keep the default. Change it when: Rarely; only to tune AI classification for your estate.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SystemPrompt_endpoint/"
|      }
|    },
|    {
|      "name": "SI_SystemPrompt_identity",
|      "label": "Identity AI instructions",
|      "group": "AI",
|      "type": "text",
|      "engines": [
|        "identity"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not used; identity classification never uses AI.",
|      "description": "AI system-prompt override -- engine HARD-DISABLES identity AI today, so this is read but currently no-op; here for forward-compat.",
|      "purpose": "Reserved for replacing the AI instructions for identity classification.",
|      "effect": "No effect today: the identity engine never calls AI, so this text is never sent.",
|      "whenToChange": "Never at present; it is kept for future use.",
|      "info": {
|        "what": "Reserved for replacing the AI instructions for identity classification.",
|        "whenChanged": "No effect today: the identity engine never calls AI, so this text is never sent.",
|        "risk": "Affects whether and how AI is used: when AI is used, asset data is sent to YOUR Azure OpenAI deployment, and it costs per call. Reversible at once; results already produced stay.",
|        "requires": "Read by: identity.",
|        "default": "Not used; identity classification never uses AI.",
|        "recommended": "Keep the default. Change it when: Never at present; it is kept for future use.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_SystemPrompt_identity/"
|      }
|    },
|    {
|      "name": "SI_TableNamePattern",
|      "label": "Profile table name pattern",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "SI_{0}_Profile",
|      "description": "v2.2 LA table + DCR naming patterns. {0} placeholder is filled with engine name. Defaults: 'SI_{0}_Profile' + 'dcr-si-{0}-profile'. Override only if you maintain a parallel naming scheme.",
|      "purpose": "The pattern used to name each collection engine's Log Analytics table, where {0} is replaced by the engine name.",
|      "effect": "Changing it sends collection data to new tables; reports and workbooks expecting the standard names will not find the data.",
|      "whenToChange": "Only if you maintain a parallel naming scheme; most installs never should.",
|      "info": {
|        "what": "The pattern used to name each collection engine's Log Analytics table, where {0} is replaced by the engine name.",
|        "whenChanged": "Changing it sends collection data to new tables; reports and workbooks expecting the standard names will not find the data.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "SI_{0}_Profile",
|        "recommended": "Keep the default. Change it when: Only if you maintain a parallel naming scheme; most installs never should.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_TableNamePattern/"
|      }
|    },
|    {
|      "name": "SI_Telemetry_Enabled",
|      "label": "Status reports to Invardia",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "One status report a day and one short report per engine run (which engine, ok / warning / failed, how long, the stage and the kind of error). Community: anonymous -- a random install id, no tenant, no host name, no error text, counts only as ranges. Pro: identified by the install key, with the error text shortened and secrets removed. On by default; $false sends nothing at all.",
|      "purpose": "Whether the install sends Invardia one status report a day and one short report per engine run: which engine ran, whether it ended ok, with warnings or failed, how long it took, the stage and the kind of error. Community reports are anonymous (a random install id; no tenant, host name or error text; counts only as ranges). Pro reports are identified by the install key and carry the error text with secrets removed.",
|      "effect": "Off sends nothing at all: no report is built, no file is written and Invardia is never contacted for this. For Pro, Invardia then cannot see failed or silent runs and warn you about them.",
|      "whenToChange": "Turn it off if your organisation does not allow status reports to leave the environment.",
|      "card": "Licence and updates",
|      "info": {
|        "what": "Whether the install sends Invardia one status report a day and one short report per engine run: which engine ran, whether it ended ok, with warnings or failed, how long it took, the stage and the kind of error. Community reports are anonymous (a random install id; no tenant, host name or error text; counts only as ranges). Pro reports are identified by the install key and carry the error text with secrets removed.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "Off sends nothing at all: no report is built, no file is written and Invardia is never contacted for this. For Pro, Invardia then cannot see failed or silent runs and warn you about them.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "Nothing else.",
|        "default": "On",
|        "recommended": "Keep the default. Change it when: Turn it off if your organisation does not allow status reports to leave the environment.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Telemetry_Enabled/"
|      }
|    },
|    {
|      "name": "SI_Telemetry_Endpoint",
|      "label": "Status report address",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Invardia's report address (https://invardia.com/api/uplink/v1/report)",
|      "description": "Where the reports go (https only). Default: Invardia's report address.",
|      "purpose": "The https address the status reports are sent to.",
|      "effect": "Reports go to this address instead. Only https addresses are used; anything else sends nothing.",
|      "whenToChange": "Practically never; only if Invardia tells you to use another address.",
|      "info": {
|        "what": "The https address the status reports are sent to.",
|        "whenChanged": "Reports go to this address instead. Only https addresses are used; anything else sends nothing.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Invardia's report address (https://invardia.com/api/uplink/v1/report)",
|        "recommended": "Keep the default. Change it when: Practically never; only if Invardia tells you to use another address.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Telemetry_Endpoint/"
|      }
|    },
|    {
|      "name": "SI_Telemetry_SendEndpoints",
|      "label": "Send this install's links to Invardia",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On -- switch it off to send no links",
|      "description": "Whether the daily status report (Pro, with an install key) carries this install's own links -- the web app's and the MCP server's addresses -- so Invardia's mails about this environment can open it. On by default; switch it off to send no links.",
|      "purpose": "Pro installs with an install key can send Invardia this install's own links -- the web app's and the MCP server's addresses -- with the daily status report, so every mail Invardia sends about this environment carries an Open SecurityInsight button. Only the addresses are sent: no names, no secrets.",
|      "effect": "On: the daily status report carries the web app's and the MCP server's addresses (read from the install's own hosting). Off: it carries no links. A failed run's report links to the run health page either way.",
|      "whenToChange": "Switch it off only if Invardia should not see this install's web app and MCP addresses.",
|      "card": "Licence and updates",
|      "info": {
|        "what": "Pro installs with an install key can send Invardia this install's own links -- the web app's and the MCP server's addresses -- with the daily status report, so every mail Invardia sends about this environment carries an Open SecurityInsight button. Only the addresses are sent: no names, no secrets.",
|        "whenOn": "the daily status report carries the web app's and the MCP server's addresses (read from the install's own hosting).",
|        "whenOff": "it carries no links. A failed run's report links to the run health page either way.",
|        "risk": "Changes only what Invardia sees: the web app's and the MCP server's addresses; nothing in your tenant changes. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "On -- switch it off to send no links",
|        "recommended": "Keep the default (on).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Telemetry_SendEndpoints/"
|      }
|    },
|    {
|      "name": "SI_Telemetry_SendHealth",
|      "label": "Send the data health result to Invardia",
|      "group": "Data & retention",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On -- switch it off to send nothing about data health",
|      "description": "Send the daily data health result (counts only) to Invardia. On by default; switched off, nothing about data health is sent.",
|      "purpose": "Pro installs with an install key send Invardia the daily data health result -- the state and, per source and report, how many records were checked, found, missing and different. Counts only: no names, ids or values.",
|      "effect": "On: every daily check, and at once when the state changes, the counts go to Invardia, which uses them to hold an update ring from moving on. Off: nothing about data health is sent.",
|      "whenToChange": "Keep it on. Switch it off only if your organisation does not allow the data health counts to leave the environment.",
|      "card": "Data health",
|      "info": {
|        "what": "Pro installs with an install key send Invardia the daily data health result -- the state and, per source and report, how many records were checked, found, missing and different. Counts only: no names, ids or values.",
|        "whenOn": "every daily check, and at once when the state changes, the counts go to Invardia, which uses them to hold an update ring from moving on.",
|        "whenOff": "nothing about data health is sent.",
|        "risk": "On: the daily data health counts go to Invardia (no names or ids); an Unhealthy install then holds the update ring from moving on. Off: Invardia does not know the data health of this install. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "On -- switch it off to send nothing about data health",
|        "recommended": "Keep the default. Change it when: Keep it on. Switch it off only if your organisation does not allow the data health counts to leave the environment.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Telemetry_SendHealth/"
|      }
|    },
|    {
|      "name": "SI_Telemetry_SetupControls",
|      "label": "Setup report to Invardia",
|      "group": "Data & retention",
|      "type": "enum",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "all: every control, SecurityInsight's own too (sent again with only the minimum list when Invardia does not take it)",
|      "description": "Which controls the daily setup report to Invardia carries (Pro, with an install key): 'all' (default) = the framework's minimum control list and SecurityInsight's own controls (when Invardia does not take that report, it goes again once with only the minimum list); 'minimum' = only the framework's minimum list; 'off' = no setup report.",
|      "purpose": "Pro installs with an install key send Invardia one setup report a day: a list of critical settings (updater, update ring, install key, licence, mail, permissions, last run, backup) with ok / missing / wrong / unknown, so Invardia can see what is not set up and help you. No secrets, no names of people and no error text are sent.",
|      "effect": "'all' (the default) sends the minimum list every product shares and SecurityInsight's own controls (SQL database reachable, job layout, run limits, last daily run, data sources, last CI build, Log Analytics ingestion, licence edition); when Invardia does not take that report, it is sent again once with only the minimum list, and the run log says so. 'minimum' sends only the minimum list. 'off' sends no setup report; the daily status report and the run reports are not affected. Status reports to Invardia off (SI_Telemetry_Enabled) turns this off too.",
|      "whenToChange": "Keep 'all'. Choose 'minimum' to send only the shared list, or 'off' if your organisation does not allow the setup state to leave the environment.",
|      "values": [
|        "minimum",
|        "all",
|        "off"
|      ],
|      "card": "Licence and updates",
|      "hint": "all = also SecurityInsight's own controls (default). minimum = the shared control list only. off = no setup report.",
|      "info": {
|        "what": "Pro installs with an install key send Invardia one setup report a day: a list of critical settings (updater, update ring, install key, licence, mail, permissions, last run, backup) with ok / missing / wrong / unknown, so Invardia can see what is not set up and help you. No secrets, no names of people and no error text are sent.",
|        "whenChanged": "'all' (the default) sends the minimum list every product shares and SecurityInsight's own controls (SQL database reachable, job layout, run limits, last daily run, data sources, last CI build, Log Analytics ingestion, licence edition); when Invardia does not take that report, it is sent again once with only the minimum list, and the run log says so. 'minimum' sends only the minimum list. 'off' sends no setup report; the daily status report and the run reports are not affected. Status reports to Invardia off (SI_Telemetry_Enabled) turns this off too.",
|        "risk": "Changes only what Invardia sees about this install's setup; nothing in your tenant changes. When Invardia does not take the full list ('all'), the report goes again once with the minimum list; the daily status report and the run reports are not affected. 'off' means Invardia cannot see a missing setting and offer help.",
|        "requires": "Nothing else.",
|        "default": "all: every control, SecurityInsight's own too (sent again with only the minimum list when Invardia does not take it)",
|        "recommended": "Keep the default (all).",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Telemetry_SetupControls/"
|      }
|    },
|    {
|      "name": "SI_TenantDomain",
|      "label": "Tenant domain in mails and links",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Read from Microsoft Graph for mail subjects; the tenant id is used in portal links",
|      "description": "Tenant domain shown in the risk score links (default: the tenant id) and, with the tenant id, in the mail subjects (default: the tenant's onmicrosoft.com domain, read from Microsoft Graph).",
|      "purpose": "Tenant domain shown in report mail subjects and used in the Azure portal links Risk Analysis adds to findings on Azure resources.",
|      "effect": "Changes the domain in mail subjects and how Azure portal links are written; links work either way. A wrong domain mislabels the mails and opens links in the wrong directory.",
|      "whenToChange": "Optional; set it if the run cannot read the domain from Microsoft Graph, or you prefer another domain in subjects and links.",
|      "card": "Sources and links",
|      "info": {
|        "what": "Tenant domain shown in report mail subjects and used in the Azure portal links Risk Analysis adds to findings on Azure resources.",
|        "whenChanged": "Changes the domain in mail subjects and how Azure portal links are written; links work either way. A wrong domain mislabels the mails and opens links in the wrong directory.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Nothing else.",
|        "default": "Read from Microsoft Graph for mail subjects; the tenant id is used in portal links",
|        "recommended": "Keep the default. Change it when: Optional; set it if the run cannot read the domain from Microsoft Graph, or you prefer another domain in subjects and links.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_TenantDomain/"
|      }
|    },
|    {
|      "name": "SI_Throttle_StuckHours",
|      "label": "Stuck on throttling after (hours)",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "6",
|      "description": "THROTTLE-IS-NORMAL: a run Microsoft only throttled is shown as throttled, is never mailed and runs again at its next scheduled time. The ONE alert (\"stuck\") goes out when a job has been throttled on every run for this many hours, or this many runs in a row -- whichever comes first, never on one run alone. The next run that completes clears it.",
|      "purpose": "How long a job may keep being throttled by Microsoft, without completing, before the one \"stuck\" alert is sent.",
|      "effect": "A throttled run is normal: it is shown as throttled, it is not mailed, and the job runs again at its next scheduled time. When a job has been throttled on every run for this many hours (and at least two runs), one alert says it is stuck. Whichever comes first of this and the number of runs below. The next run that completes clears it.",
|      "whenToChange": "Raise it if you get the alert for jobs that catch up by themselves; lower it if you need to know sooner.",
|      "unit": "hours",
|      "card": "Other checks",
|      "needs": "SI_Guard_JobRunThrottledStuck_Enabled",
|      "info": {
|        "what": "How long a job may keep being throttled by Microsoft, without completing, before the one \"stuck\" alert is sent.",
|        "whenChanged": "A throttled run is normal: it is shown as throttled, it is not mailed, and the job runs again at its next scheduled time. When a job has been throttled on every run for this many hours (and at least two runs), one alert says it is stuck. Whichever comes first of this and the number of runs below. The next run that completes clears it.",
|        "risk": "A safety check protects your data from a broken run; changing it changes when a step is held or stopped. Reversible at once.",
|        "requires": "Works only while \"Job stuck on throttling\" is on.",
|        "default": "6",
|        "recommended": "Keep the default. Change it when: Raise it if you get the alert for jobs that catch up by themselves; lower it if you need to know sooner.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Throttle_StuckHours/"
|      }
|    },
|    {
|      "name": "SI_Throttle_StuckRuns",
|      "label": "Stuck on throttling after (runs)",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "12",
|      "description": "How many throttled runs in a row, without one that completes, send the one \"stuck\" alert (whichever comes first).",
|      "purpose": "How many throttled runs in a row, without one that completes, send the one \"stuck\" alert.",
|      "effect": "When a job has been throttled this many runs in a row, one alert says it is stuck -- whichever comes first of this and the number of hours above. The next run that completes clears it.",
|      "whenToChange": "Raise it for jobs that run very often; lower it if you need to know sooner.",
|      "unit": "runs",
|      "card": "Other checks",
|      "needs": "SI_Guard_JobRunThrottledStuck_Enabled",
|      "info": {
|        "what": "How many throttled runs in a row, without one that completes, send the one \"stuck\" alert.",
|        "whenChanged": "When a job has been throttled this many runs in a row, one alert says it is stuck -- whichever comes first of this and the number of hours above. The next run that completes clears it.",
|        "risk": "A safety check protects your data from a broken run; changing it changes when a step is held or stopped. Reversible at once.",
|        "requires": "Works only while \"Job stuck on throttling\" is on.",
|        "default": "12",
|        "recommended": "Keep the default. Change it when: Raise it for jobs that run very often; lower it if you need to know sooner.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Throttle_StuckRuns/"
|      }
|    },
|    {
|      "name": "SI_TierCadence_Default",
|      "label": "Re-check interval, unknown tier",
|      "group": "Collection scope & limits",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "24 hours",
|      "description": "used when cached tier is null/unknown",
|      "purpose": "How often an asset whose privilege tier is not yet known is re-processed when the per-asset skip schedule is in use.",
|      "effect": "Shorter intervals refresh such assets more often at the cost of run time; longer ones skip them more. Only applies when the fingerprint cache is turned on and the run is not a full run.",
|      "whenToChange": "Rarely; only when you run incremental profiling with the fingerprint cache on.",
|      "unit": "hours",
|      "info": {
|        "what": "How often an asset whose privilege tier is not yet known is re-processed when the per-asset skip schedule is in use.",
|        "whenChanged": "Shorter intervals refresh such assets more often at the cost of run time; longer ones skip them more. Only applies when the fingerprint cache is turned on and the run is not a full run.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Nothing else.",
|        "default": "24 hours",
|        "recommended": "Keep the default. Change it when: Rarely; only when you run incremental profiling with the fingerprint cache on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_TierCadence_Default/"
|      }
|    },
|    {
|      "name": "SI_TierCadence_T0",
|      "label": "Re-check interval, tier 0",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 12,
|      "defaultText": "12 hours",
|      "description": "--- Tier-driven cadence (asset-profiling Stage Collect skip gate) --- Strings: '12h', '24h', '3d', '7d', or combos like '1d12h'. Engine defaults: T0='12h' T1='24h' T2='3d' T3='7d' Default='24h'",
|      "purpose": "How often tier 0 assets (domain controllers, break-glass and global admins) are re-processed when the per-asset skip schedule is in use.",
|      "effect": "A number is read as hours; text such as '3d' also works. Shorter keeps the most critical assets fresher but costs run time. Only applies with the fingerprint cache on and outside full runs.",
|      "whenToChange": "Rarely; only when you run incremental profiling with the fingerprint cache on.",
|      "unit": "hours",
|      "info": {
|        "what": "How often tier 0 assets (domain controllers, break-glass and global admins) are re-processed when the per-asset skip schedule is in use.",
|        "whenChanged": "A number is read as hours; text such as '3d' also works. Shorter keeps the most critical assets fresher but costs run time. Only applies with the fingerprint cache on and outside full runs.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: azure, endpoint, identity, publicip.",
|        "default": "12 hours",
|        "recommended": "Keep the default. Change it when: Rarely; only when you run incremental profiling with the fingerprint cache on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_TierCadence_T0/"
|      }
|    },
|    {
|      "name": "SI_TierCadence_T1",
|      "label": "Re-check interval, tier 1",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 24,
|      "defaultText": "24 hours",
|      "description": "production servers, privileged users",
|      "purpose": "How often tier 1 assets (production servers, privileged users) are re-processed when the per-asset skip schedule is in use.",
|      "effect": "A number is read as hours; text such as '3d' also works. Shorter means fresher data and longer runs. Only applies with the fingerprint cache on and outside full runs.",
|      "whenToChange": "Rarely; only when you run incremental profiling with the fingerprint cache on.",
|      "unit": "hours",
|      "info": {
|        "what": "How often tier 1 assets (production servers, privileged users) are re-processed when the per-asset skip schedule is in use.",
|        "whenChanged": "A number is read as hours; text such as '3d' also works. Shorter means fresher data and longer runs. Only applies with the fingerprint cache on and outside full runs.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: azure, endpoint, identity, publicip.",
|        "default": "24 hours",
|        "recommended": "Keep the default. Change it when: Rarely; only when you run incremental profiling with the fingerprint cache on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_TierCadence_T1/"
|      }
|    },
|    {
|      "name": "SI_TierCadence_T2",
|      "label": "Re-check interval, tier 2",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 72,
|      "defaultText": "3 days",
|      "description": "workstations, regular users",
|      "purpose": "How often tier 2 assets (workstations, regular users) are re-processed when the per-asset skip schedule is in use.",
|      "effect": "A number is read as hours; text such as '3d' also works. Shorter means fresher data and longer runs. Only applies with the fingerprint cache on and outside full runs.",
|      "whenToChange": "Rarely; only when you run incremental profiling with the fingerprint cache on.",
|      "unit": "hours",
|      "info": {
|        "what": "How often tier 2 assets (workstations, regular users) are re-processed when the per-asset skip schedule is in use.",
|        "whenChanged": "A number is read as hours; text such as '3d' also works. Shorter means fresher data and longer runs. Only applies with the fingerprint cache on and outside full runs.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: azure, endpoint, identity, publicip.",
|        "default": "3 days",
|        "recommended": "Keep the default. Change it when: Rarely; only when you run incremental profiling with the fingerprint cache on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_TierCadence_T2/"
|      }
|    },
|    {
|      "name": "SI_TierCadence_T3",
|      "label": "Re-check interval, tier 3",
|      "group": "Collection scope & limits",
|      "type": "int",
|      "engines": [
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 168,
|      "defaultText": "7 days",
|      "description": "test/dev, externals, guests, shadow IT",
|      "purpose": "How often tier 3 assets (test and development, externals, guests, unmanaged) are re-processed when the per-asset skip schedule is in use.",
|      "effect": "A number is read as hours; text such as '7d' also works. Shorter means fresher data and longer runs. Only applies with the fingerprint cache on and outside full runs.",
|      "whenToChange": "Rarely; only when you run incremental profiling with the fingerprint cache on.",
|      "unit": "hours",
|      "info": {
|        "what": "How often tier 3 assets (test and development, externals, guests, unmanaged) are re-processed when the per-asset skip schedule is in use.",
|        "whenChanged": "A number is read as hours; text such as '7d' also works. Shorter means fresher data and longer runs. Only applies with the fingerprint cache on and outside full runs.",
|        "risk": "Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.",
|        "requires": "Read by: azure, endpoint, identity, publicip.",
|        "default": "7 days",
|        "recommended": "Keep the default. Change it when: Rarely; only when you run incremental profiling with the fingerprint cache on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_TierCadence_T3/"
|      }
|    },
|    {
|      "name": "SI_Trend_AtEndOfRiskAnalysis",
|      "label": "Write the risk trend at the end of Risk Analysis",
|      "group": "Schedules & what runs",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On",
|      "description": "Risk Analysis writes the day's risk trend row itself at the end of a summary run (the trend job is then not needed).",
|      "purpose": "Whether a Risk Analysis summary run writes the day's risk trend row itself, from the rows it has just published.",
|      "effect": "On: one trend row per day, written by Risk Analysis -- the separate risk trend job is not needed and waits for a run by hand. Off: no trend row unless the risk trend job runs. A run that was partial writes no row (a gap, not a drop).",
|      "whenToChange": "Only when you run the risk trend job on its own schedule instead.",
|      "info": {
|        "what": "Whether a Risk Analysis summary run writes the day's risk trend row itself, from the rows it has just published.",
|        "whenOn": "one trend row per day, written by Risk Analysis -- the separate risk trend job is not needed and waits for a run by hand.",
|        "whenOff": "no trend row unless the risk trend job runs. A run that was partial writes no row (a gap, not a drop).",
|        "risk": "Changes when or whether jobs run: a job that does not run leaves its data older until it runs again. Reversible at once; nothing already collected is changed.",
|        "requires": "Nothing else.",
|        "default": "On",
|        "recommended": "Keep the default. Change it when: Only when you run the risk trend job on its own schedule instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Trend_AtEndOfRiskAnalysis/"
|      }
|    },
|    {
|      "name": "SI_Trend_DcrName",
|      "label": "Trend data collection rule name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "asset-trend"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "The engine's own rule name for the trend table.",
|      "description": "A different DCR name for SI_Trend_CL (default: the engine's own).",
|      "purpose": "The name of the data collection rule the trend engine publishes its daily rollup through.",
|      "effect": "Sends the trend rollup through a differently named data collection rule. A wrong name means the rollup is published through a rule you did not intend, or fails to publish.",
|      "whenToChange": "Only when the default rule name clashes with an existing one in your workspace.",
|      "info": {
|        "what": "The name of the data collection rule the trend engine publishes its daily rollup through.",
|        "whenChanged": "Sends the trend rollup through a differently named data collection rule. A wrong name means the rollup is published through a rule you did not intend, or fails to publish.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Read by: asset-trend.",
|        "default": "The engine's own rule name for the trend table.",
|        "recommended": "Keep the default. Change it when: Only when the default rule name clashes with an existing one in your workspace.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Trend_DcrName/"
|      }
|    },
|    {
|      "name": "SI_Trend_DryRun",
|      "label": "Trend dry run",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "asset-trend"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: the rollup is published every run.",
|      "description": "$true computes and prints the rollup without publishing it.",
|      "purpose": "Lets the trend engine compute and print its rollup without publishing anything.",
|      "effect": "When on, nothing is written to the trend table, so the trend line and weekly history get a gap for every dry-run day. A command-line switch on the run wins over this value.",
|      "whenToChange": "For a first trial run, or while checking numbers; switch it back off afterwards.",
|      "info": {
|        "what": "Lets the trend engine compute and print its rollup without publishing anything.",
|        "whenOn": "When on, nothing is written to the trend table, so the trend line and weekly history get a gap for every dry-run day. A command-line switch on the run wins over this value.",
|        "whenOff": "the rollup is published every run.",
|        "risk": "No trend rows are written while it is on: the trend line and weekly history get a gap for every such day, which cannot be filled later. Reversible from the next day.",
|        "requires": "Read by: asset-trend.",
|        "default": "Off: the rollup is published every run.",
|        "recommended": "Off.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Trend_DryRun/",
|        "confirmWhen": "on",
|        "confirm": "When on, nothing is written to the trend table, so the trend line and weekly history get a gap for every dry-run day. A command-line switch on the run wins over this value. No trend rows are written while it is on: the trend line and weekly history get a gap for every such day, which cannot be filled later. Reversible from the next day."
|      }
|    },
|    {
|      "name": "SI_Trend_Grain",
|      "label": "Trend source detail level",
|      "group": "Risk Analysis reports",
|      "type": "text",
|      "engines": [
|        "asset-trend"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "Summary",
|      "defaultText": "Summary (the Risk Analysis summary results).",
|      "description": "--- trend (asset-trend engine) ----------------------------------------------",
|      "purpose": "Chooses whether the trend rollup is built from the Risk Analysis summary results or the detailed per-asset results.",
|      "effect": "'Detailed' rolls up from the detailed Risk Analysis table instead, which only helps if your reports publish at that level. Any value other than Summary or Detailed falls back to Summary with a warning.",
|      "whenToChange": "Only if your Risk Analysis reports are published at the detailed level and you want the trend built from that.",
|      "info": {
|        "what": "Chooses whether the trend rollup is built from the Risk Analysis summary results or the detailed per-asset results.",
|        "whenChanged": "'Detailed' rolls up from the detailed Risk Analysis table instead, which only helps if your reports publish at that level. Any value other than Summary or Detailed falls back to Summary with a warning.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: asset-trend.",
|        "default": "Summary (the Risk Analysis summary results).",
|        "recommended": "Keep the default. Change it when: Only if your Risk Analysis reports are published at the detailed level and you want the trend built from that.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Trend_Grain/"
|      }
|    },
|    {
|      "name": "SI_Trend_Weeks",
|      "label": "Weekly rate weeks shown",
|      "group": "Risk Analysis reports",
|      "type": "int",
|      "engines": [
|        "asset-trend"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": 12,
|      "defaultText": "12 weeks.",
|      "description": "weeks -ShowWeeklyRate looks back over",
|      "purpose": "How many weeks the printed weekly opened/closed view covers when the trend engine is run by hand with the weekly rate view.",
|      "effect": "Only changes how many weeks are printed when a person asks for the weekly rate view on a VM run. The weekly history that is stored is unaffected, and scheduled container runs do not print the view.",
|      "whenToChange": "Rarely; when you want a longer or shorter printed history during a manual run.",
|      "unit": "weeks",
|      "info": {
|        "what": "How many weeks the printed weekly opened/closed view covers when the trend engine is run by hand with the weekly rate view.",
|        "whenChanged": "Only changes how many weeks are printed when a person asks for the weekly rate view on a VM run. The weekly history that is stored is unaffected, and scheduled container runs do not print the view.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: asset-trend.",
|        "default": "12 weeks.",
|        "recommended": "Keep the default. Change it when: Rarely; when you want a longer or shorter printed history during a manual run.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Trend_Weeks/"
|      }
|    },
|    {
|      "name": "SI_UAMI_ClientId",
|      "label": "Managed identity client id (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Copied from SI_ManagedIdentityClientId; empty means system-assigned",
|      "description": "Client id of a user-assigned managed identity that container jobs use to sign in instead of the service principal, when managed-identity sign-in is enabled.",
|      "purpose": "Client id of a user-assigned managed identity; the older name for SI_ManagedIdentityClientId, and the one container jobs and ingestion read.",
|      "effect": "Selects the user-assigned identity used for sign-in and ingestion. Several ingestion paths use managed identity only when this is set.",
|      "whenToChange": "Rarely; set SI_ManagedIdentityClientId instead, unless configuring a container job directly.",
|      "info": {
|        "what": "Client id of a user-assigned managed identity; the older name for SI_ManagedIdentityClientId, and the one container jobs and ingestion read.",
|        "whenChanged": "Selects the user-assigned identity used for sign-in and ingestion. Several ingestion paths use managed identity only when this is set.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Copied from SI_ManagedIdentityClientId; empty means system-assigned",
|        "recommended": "Keep the default. Change it when: Rarely; set SI_ManagedIdentityClientId instead, unless configuring a container job directly.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_UAMI_ClientId/"
|      }
|    },
|    {
|      "name": "SI_Update_RenameDisplayNames",
|      "label": "Rename to the agreed names",
|      "group": "Sign-in & Azure resources",
|      "type": "bool",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "On",
|      "description": "SecurityInsight Pro: the update gives this install's directory objects the names a new install gets -- the engine's application \"SecurityInsight Engine\", the web app's sign-in application \"SecurityInsight\", the SQL admin group shown as \"SecurityInsight SQL admins\" -- only from SecurityInsight's earlier names (a name you chose is kept), each once, read back and put back if it does not take. On by default; $false leaves the names as they are (the update only says what it would do).",
|      "purpose": "Whether the update gives this installation's directory objects the names a new installation gets: the engine's application \"SecurityInsight Engine\", the web app's sign-in application \"SecurityInsight\" and the SQL admin group shown as \"SecurityInsight SQL admins\". Only SecurityInsight's earlier names are renamed; a name you chose is kept. Each object is renamed once, read back, and put back if the rename does not take. Azure resources keep their names.",
|      "effect": "Off: the update renames nothing and only says, one line each, what it would rename. Where the updater's identity may not rename an application or the SQL admin group, the update says so in one line and an administrator renames with setup\\Set-SIDisplayNames.ps1.",
|      "whenToChange": "Turn it off only when your own processes still look for SecurityInsight's applications or the SQL admin group by their earlier names; turn it on again once they use the new names.",
|      "card": "Licence and updates",
|      "info": {
|        "what": "Whether the update gives this installation's directory objects the names a new installation gets: the engine's application \"SecurityInsight Engine\", the web app's sign-in application \"SecurityInsight\" and the SQL admin group shown as \"SecurityInsight SQL admins\". Only SecurityInsight's earlier names are renamed; a name you chose is kept. Each object is renamed once, read back, and put back if the rename does not take. Azure resources keep their names.",
|        "whenOn": "On is the default: it works as described under \"What it does\".",
|        "whenOff": "the update renames nothing and only says, one line each, what it would rename. Where the updater's identity may not rename an application or the SQL admin group, the update says so in one line and an administrator renames with setup\\Set-SIDisplayNames.ps1.",
|        "risk": "SecurityInsight's applications and the SQL admin group keep their earlier names, unlike a new installation. Nothing else changes. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "On",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Update_RenameDisplayNames/",
|        "confirmWhen": "off",
|        "confirm": "the update renames nothing and only says, one line each, what it would rename. Where the updater's identity may not rename an application or the SQL admin group, the update says so in one line and an administrator renames with setup\\Set-SIDisplayNames.ps1. SecurityInsight's applications and the SQL admin group keep their earlier names, unlike a new installation. Nothing else changes. Reversible at once."
|      }
|    },
|    {
|      "name": "SI_UpdateRing",
|      "label": "Update ring",
|      "group": "Sign-in & Azure resources",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: the ring the installation recorded at install time (from its resource-group name), until the updater records the ring it updates by",
|      "description": "SecurityInsight Pro: this install's update ring (0 dev, 1 internal, 2 early release, 3 broad), recorded with the install so the web app shows it before the updater has run. Not set = the ring in the resource-group name.",
|      "purpose": "The update ring this installation belongs to: 0 = development, 1 = internal test, 2 = early release, 3 = broad. It is shown in the header (UPDATE RING) and recorded with the installation, so the ring is known from the day it is installed -- also before the updater job has run.",
|      "effect": "The header shows this ring and setup records it as the installation's ring. Once the updater job has run, the header shows the ring the updater actually updated by -- which ring an installation receives releases on is decided by the update service, not by this setting.",
|      "whenToChange": "Once, when the installation's ring is not shown, or was recorded wrongly at install time.",
|      "min": 0,
|      "max": 3,
|      "card": "Licence and updates",
|      "info": {
|        "what": "The update ring this installation belongs to: 0 = development, 1 = internal test, 2 = early release, 3 = broad. It is shown in the header (UPDATE RING) and recorded with the installation, so the ring is known from the day it is installed -- also before the updater job has run.",
|        "whenChanged": "The header shows this ring and setup records it as the installation's ring. Once the updater job has run, the header shows the ring the updater actually updated by -- which ring an installation receives releases on is decided by the update service, not by this setting.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Not set: the ring the installation recorded at install time (from its resource-group name), until the updater records the ring it updates by",
|        "recommended": "Keep the default. Change it when: Once, when the installation's ring is not shown, or was recorded wrongly at install time.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_UpdateRing/"
|      }
|    },
|    {
|      "name": "SI_Verbose",
|      "label": "Verbose diagnostic logging",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Off: normal log detail.",
|      "description": "Verbose engine logging (writes Properties.run.debug into every profile row).",
|      "purpose": "Adds detailed diagnostic lines (routing, timing, merge statistics, samples) to the run log.",
|      "effect": "Run logs become much longer and more detailed, which helps support find problems. Collected data and reports are unchanged.",
|      "whenToChange": "When investigating a problem or when support asks for it; turn off again afterwards.",
|      "info": {
|        "what": "Adds detailed diagnostic lines (routing, timing, merge statistics, samples) to the run log.",
|        "whenOn": "Run logs become much longer and more detailed, which helps support find problems. Collected data and reports are unchanged.",
|        "whenOff": "normal log detail.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Off: normal log detail.",
|        "recommended": "Keep the default. Change it when: When investigating a problem or when support asks for it; turn off again afterwards.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_Verbose/"
|      }
|    },
|    {
|      "name": "SI_VulnSync_CloseAfterRuns",
|      "label": "Runs before a vulnerability closes",
|      "group": "Data & retention",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "2 runs",
|      "description": "How many complete runs in a row a vulnerability must be missing from an asset before the close-loop closes it as fixed. Each run only counts when the asset itself was seen in that run with its vulnerability data; a run in which the asset was not seen counts for nothing and keeps the vulnerability open. Default 2, at least 1. Raise it if devices report a vulnerability on and off.",
|      "purpose": "How many complete runs in a row a vulnerability must be missing from an asset that was seen before the close-loop marks it fixed.",
|      "effect": "Higher avoids closing and reopening vulnerabilities that devices report on and off, but confirms real fixes later. Runs where the asset was not seen do not count. Below 1 is raised to 1; non-numbers use 2.",
|      "whenToChange": "Raise it if vulnerabilities keep closing and reopening on the same devices.",
|      "unit": "runs",
|      "min": 1,
|      "card": "Counting and closing findings",
|      "info": {
|        "what": "How many complete runs in a row a vulnerability must be missing from an asset that was seen before the close-loop marks it fixed.",
|        "whenChanged": "Higher avoids closing and reopening vulnerabilities that devices report on and off, but confirms real fixes later. Runs where the asset was not seen do not count. Below 1 is raised to 1; non-numbers use 2.",
|        "risk": "Changes how long data is kept or how quickly assets are treated as gone. Shortening a retention DELETES older data at the next clean-up and that cannot be undone; shortening a grace period retires assets (and closes their findings) sooner. Lengthening is safe but uses more storage.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "2 runs",
|        "recommended": "Keep the default. Change it when: Raise it if vulnerabilities keep closing and reopening on the same devices.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_VulnSync_CloseAfterRuns/"
|      }
|    },
|    {
|      "name": "SI_VulnSync_CollapseFloor",
|      "label": "Vulnerabilities: share that must still be reported",
|      "group": "Guards (safety checks)",
|      "type": "number",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0.5 (half)",
|      "description": "The share of the open records that must still be reported (0 to 1).",
|      "purpose": "The share (0 to 1) of the open vulnerability records the newest results must still report before anything may close.",
|      "effect": "When fewer of the open records are still reported, the run looks like a partial collection and closes nothing. 0 switches this check off; 1 forbids every close.",
|      "whenToChange": "Lower it if your estate legitimately shrinks a lot between runs.",
|      "min": 0,
|      "max": 1,
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorCollapse_Enabled",
|      "info": {
|        "what": "The share (0 to 1) of the open vulnerability records the newest results must still report before anything may close.",
|        "whenChanged": "When fewer of the open records are still reported, the run looks like a partial collection and closes nothing. 0 switches this check off; 1 forbids every close.",
|        "risk": "A safety check protects your data from a broken run; changing it changes when a step is held or stopped. Reversible at once.",
|        "requires": "Works only while \"Vulnerabilities: result far smaller than usual\" is on. A SecurityInsight Pro licence.",
|        "default": "0.5 (half)",
|        "recommended": "Keep the default. Change it when: Lower it if your estate legitimately shrinks a lot between runs.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_VulnSync_CollapseFloor/"
|      }
|    },
|    {
|      "name": "SI_VulnSync_MaxCloseAbsolute",
|      "label": "Vulnerability close limit (number of records)",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "0 = no limit on the number (only the share counts)",
|      "description": "The number limit: 0 = none (the default for vulnerabilities).",
|      "purpose": "An optional limit on HOW MANY vulnerability records the connector may close in one run, on top of the share above.",
|      "effect": "0: only the share of the open records decides -- a patch round that closes hundreds of records out of thousands goes through. Above 0: a run that would close more records than this is held as well.",
|      "whenToChange": "Leave it at 0 for vulnerabilities. Set a number only if you want a hard cap regardless of the size of your estate.",
|      "min": 0,
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorCloseCeiling_Enabled",
|      "info": {
|        "what": "An optional limit on HOW MANY vulnerability records the connector may close in one run, on top of the share above.",
|        "whenChanged": "0: only the share of the open records decides -- a patch round that closes hundreds of records out of thousands goes through. Above 0: a run that would close more records than this is held as well.",
|        "risk": "A safety check protects your data from a broken run; changing it changes when a step is held or stopped. Reversible at once.",
|        "requires": "Works only while \"Vulnerability close limit\" is on. A SecurityInsight Pro licence.",
|        "default": "0 = no limit on the number (only the share counts)",
|        "recommended": "Keep the default. Change it when: Leave it at 0 for vulnerabilities. Set a number only if you want a hard cap regardless of the size of your estate.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_VulnSync_MaxCloseAbsolute/"
|      }
|    },
|    {
|      "name": "SI_VulnSync_MaxClosePercent",
|      "label": "Vulnerability close limit (% of open records)",
|      "group": "Guards (safety checks)",
|      "type": "int",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "10 %",
|      "description": "The vulnerability close limit: the share of the open records (default 10), an optional number (default 0 = no number limit -- a patch round closes hundreds), and the share that must still be reported (0 to 1, default 0.5).",
|      "purpose": "The largest share of the open vulnerability records the connector may close in one run before it holds the closes for an Admin to release.",
|      "effect": "A run that would close more than this share of the open records closes none of them and holds them (Guards page: release once). Only the records that really close count -- not first absences, held or out-of-scope records, and not closes a fresh Defender assessment confirms.",
|      "whenToChange": "Raise it if your patch rounds regularly fix more than this share at once.",
|      "unit": "%",
|      "min": 0,
|      "max": 100,
|      "card": "Vulnerability connector checks",
|      "needs": "SI_Guard_VulnConnectorCloseCeiling_Enabled",
|      "info": {
|        "what": "The largest share of the open vulnerability records the connector may close in one run before it holds the closes for an Admin to release.",
|        "whenChanged": "A run that would close more than this share of the open records closes none of them and holds them (Guards page: release once). Only the records that really close count -- not first absences, held or out-of-scope records, and not closes a fresh Defender assessment confirms.",
|        "risk": "A safety check protects your data from a broken run; changing it changes when a step is held or stopped. Reversible at once.",
|        "requires": "Works only while \"Vulnerability close limit\" is on. A SecurityInsight Pro licence.",
|        "default": "10 %",
|        "recommended": "Keep the default. Change it when: Raise it if your patch rounds regularly fix more than this share at once.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_VulnSync_MaxClosePercent/"
|      }
|    },
|    {
|      "name": "SI_VulnSync_Run",
|      "label": "Vulnerability connectors: plan only",
|      "group": "Connectors & CMDB",
|      "type": "enum",
|      "engines": [],
|      "edition": "pro",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: each connector's own mode decides",
|      "description": "Vulnerability connectors: 'plan' keeps every connector in plan mode whatever its own mode; not set = each connector's mode.",
|      "purpose": "plan keeps every vulnerability connector in plan mode, whatever mode each connector has; it writes nothing.",
|      "effect": "plan: no vulnerability, ticket or row is written or closed by any connector; each run reports what it would do. apply or not set: each connector runs in its own mode.",
|      "whenToChange": "To pause every vulnerability connector at once, for example during a change in ServiceNow.",
|      "values": [
|        "plan",
|        "apply"
|      ],
|      "info": {
|        "what": "plan keeps every vulnerability connector in plan mode, whatever mode each connector has; it writes nothing.",
|        "whenChanged": "plan: no vulnerability, ticket or row is written or closed by any connector; each run reports what it would do. apply or not set: each connector runs in its own mode.",
|        "risk": "plan stops every vulnerability connector from writing or closing anything until it is cleared; nothing is lost, the next run catches up. Reversible at once.",
|        "requires": "A SecurityInsight Pro licence.",
|        "default": "Not set: each connector's own mode decides",
|        "recommended": "Leave it empty.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_VulnSync_Run/"
|      }
|    },
|    {
|      "name": "SI_WorkspaceName",
|      "label": "Log Analytics workspace name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "log-platform-management-securityinsight when the resource id gives none",
|      "description": "Name of the Log Analytics workspace SecurityInsight writes its data to and reads from.",
|      "purpose": "Name of the Log Analytics workspace SecurityInsight writes its data to and reads from.",
|      "effect": "Used when creating a missing workspace and in run messages; Risk Analysis uses it when no workspace resource id is set. A wrong name can make setup create a new workspace.",
|      "whenToChange": "Set at install; the workspace resource id is the main setting.",
|      "card": "Log Analytics",
|      "info": {
|        "what": "Name of the Log Analytics workspace SecurityInsight writes its data to and reads from.",
|        "whenChanged": "Used when creating a missing workspace and in run messages; Risk Analysis uses it when no workspace resource id is set. A wrong name can make setup create a new workspace.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "log-platform-management-securityinsight when the resource id gives none",
|        "recommended": "Keep the default. Change it when: Set at install; the workspace resource id is the main setting.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_WorkspaceName/"
|      }
|    },
|    {
|      "name": "SI_WorkspaceResourceGroup",
|      "label": "Workspace resource group",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Taken from the workspace resource id; otherwise 'rg-securityinsight'",
|      "description": "--- Infrastructure + misc -------------------------------------------------- Resource groups of the workspace and the storage account. Setup creates both there; a collection run creates no Azure resource and assigns no role -- it only checks that they are there.",
|      "purpose": "Names the Azure resource group of the Log Analytics workspace the engines write to.",
|      "effect": "The workspace is looked up in this resource group (setup creates it there). A collection run creates nothing: a workspace it does not find is said in one line, and the send fails.",
|      "whenToChange": "Set once during setup to match your workspace; change only if the workspace moves.",
|      "card": "Log Analytics",
|      "info": {
|        "what": "Names the Azure resource group of the Log Analytics workspace the engines write to.",
|        "whenChanged": "The workspace is looked up in this resource group (setup creates it there). A collection run creates nothing: a workspace it does not find is said in one line, and the send fails.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Taken from the workspace resource id; otherwise 'rg-securityinsight'",
|        "recommended": "Keep the default. Change it when: Set once during setup to match your workspace; change only if the workspace moves.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_WorkspaceResourceGroup/"
|      }
|    },
|    {
|      "name": "SI_WorkspaceResourceId",
|      "label": "Log Analytics workspace",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: correlation, CMDB and vulnerability engines stop; others fall back",
|      "description": "REQUIRED for v2.2: full /subscriptions/.../workspaces/<ws> ARM resource ID. Engines that ingest to LA need this (the v2.1 short name was deprecated).",
|      "purpose": "Full Azure resource id of the Log Analytics workspace all engines write to and query.",
|      "effect": "Decides where all SecurityInsight data lands and is read from; also gives the subscription for ingestion. Changing it starts a new data history in the new workspace.",
|      "whenToChange": "Set at install; change only when moving to another workspace.",
|      "card": "Log Analytics",
|      "info": {
|        "what": "Full Azure resource id of the Log Analytics workspace all engines write to and query.",
|        "whenChanged": "Decides where all SecurityInsight data lands and is read from; also gives the subscription for ingestion. Changing it starts a new data history in the new workspace.",
|        "risk": "Affects how the jobs sign in or which Azure resources they use. A wrong value stops the affected jobs at their next run (nothing is changed or deleted); a broader identity or right gives the jobs more access than they need. Reversible: correct it and run again.",
|        "requires": "Nothing else.",
|        "default": "Not set: correlation, CMDB and vulnerability engines stop; others fall back",
|        "recommended": "Keep the default. Change it when: Set at install; change only when moving to another workspace.",
|        "docUrl": "https://invardia.com/docs/si/settings/SI_WorkspaceResourceId/"
|      }
|    },
|    {
|      "name": "SMTP_UseSSL",
|      "label": "Encrypted mail connection",
|      "group": "Mail & notifications",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: Risk Analysis mail fails (run continues); the daily close-loop mail sends unencrypted",
|      "description": "Whether e-mails of risk-analysis reports are sent to the SMTP server over an encrypted (SSL/TLS) connection.",
|      "purpose": "Whether report e-mails are sent to the mail server over an encrypted (SSL/TLS) connection.",
|      "effect": "On: the connection is encrypted, as most cloud relays require. Off: plain connection, typical for an internal relay on port 25. A mismatch with the server makes sending fail.",
|      "whenToChange": "Set it to match your mail server; setup asks for it.",
|      "card": "Mail server",
|      "hint": "Must match the mail server.",
|      "info": {
|        "what": "Whether report e-mails are sent to the mail server over an encrypted (SSL/TLS) connection.",
|        "whenOn": "the connection is encrypted, as most cloud relays require.",
|        "whenOff": "plain connection, typical for an internal relay on port 25. A mismatch with the server makes sending fail.",
|        "risk": "Report mails (with asset and finding details) travel unencrypted to the mail server: only acceptable on an internal relay. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Not set: Risk Analysis mail fails (run continues); the daily close-loop mail sends unencrypted",
|        "recommended": "On.",
|        "docUrl": "https://invardia.com/docs/si/settings/SMTP_UseSSL/",
|        "confirmWhen": "off",
|        "confirm": "plain connection, typical for an internal relay on port 25. A mismatch with the server makes sending fail. Report mails (with asset and finding details) travel unencrypted to the mail server: only acceptable on an internal relay. Reversible at once."
|      }
|    },
|    {
|      "name": "SMTPFrom",
|      "label": "Mail sender address",
|      "group": "Mail & notifications",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Left empty: the mail server user name",
|      "description": "verified-sender address (From header).",
|      "purpose": "The From address on every mail.",
|      "effect": "Sets who the mail appears to come from. A sender the relay has not verified gets the mail rejected. With no sender at all and anonymous mail, mail is skipped with a warning.",
|      "whenToChange": "Set it whenever mail is on; use an address your mail relay accepts as sender.",
|      "card": "Mail server",
|      "hint": "Use an address your mail server accepts as sender.",
|      "info": {
|        "what": "The From address on every mail.",
|        "whenChanged": "Sets who the mail appears to come from. A sender the relay has not verified gets the mail rejected. With no sender at all and anonymous mail, mail is skipped with a warning.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Left empty: the mail server user name",
|        "recommended": "Keep the default. Change it when: Set it whenever mail is on; use an address your mail relay accepts as sender.",
|        "docUrl": "https://invardia.com/docs/si/settings/SMTPFrom/"
|      }
|    },
|    {
|      "name": "SMTPPassword",
|      "label": "Mail server password",
|      "group": "Mail & notifications",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": true,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: signed-in mail cannot start; containers read it from your Key Vault",
|      "description": "Password (or app password) for the SMTP account used to send risk-analysis report e-mails; required when sending with authentication.",
|      "purpose": "Password (or app password) of the mail server account.",
|      "effect": "Needed whenever mail is sent with sign-in. Without it, a Risk Analysis run with mail on stops at start and the daily close-loop mail is not sent.",
|      "whenToChange": "Set it when you turn mail on with a relay that needs sign-in, and when the password changes.",
|      "card": "Mail server",
|      "needs": "!Mail_SendAnonymous",
|      "info": {
|        "what": "Password (or app password) of the mail server account.",
|        "whenChanged": "Needed whenever mail is sent with sign-in. Without it, a Risk Analysis run with mail on stops at start and the daily close-loop mail is not sent.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Works only while \"Send mail without sign-in\" is off. Kept in the install's Key Vault. Read by: risk-analysis.",
|        "default": "Not set: signed-in mail cannot start; containers read it from your Key Vault",
|        "recommended": "Keep the default. Change it when: Set it when you turn mail on with a relay that needs sign-in, and when the password changes.",
|        "docUrl": "https://invardia.com/docs/si/settings/SMTPPassword/"
|      }
|    },
|    {
|      "name": "SMTPPort",
|      "label": "Mail server port",
|      "group": "Mail & notifications",
|      "type": "int",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Needed for report mails, e.g. 587",
|      "description": "25=plain/STARTTLS, 465=SMTPS, 587=submission",
|      "purpose": "The network port of the mail server used for report e-mails, for example 25, 465 or 587.",
|      "effect": "Must match the mail server and the encryption setting; a wrong port makes sending fail (the run itself continues).",
|      "whenToChange": "Set it to match your mail server; setup asks for it.",
|      "card": "Mail server",
|      "hint": "Usually 587 with an encrypted connection, 25 without.",
|      "info": {
|        "what": "The network port of the mail server used for report e-mails, for example 25, 465 or 587.",
|        "whenChanged": "Must match the mail server and the encryption setting; a wrong port makes sending fail (the run itself continues).",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Needed for report mails, e.g. 587",
|        "recommended": "Keep the default. Change it when: Set it to match your mail server; setup asks for it.",
|        "docUrl": "https://invardia.com/docs/si/settings/SMTPPort/"
|      }
|    },
|    {
|      "name": "SmtpServer",
|      "label": "Mail server",
|      "group": "Mail & notifications",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: no mail can be sent (reports are still written)",
|      "description": "your relay's host name",
|      "purpose": "Host name of the mail server (SMTP relay) every SecurityInsight mail is sent through.",
|      "effect": "All Risk Analysis and close-loop mail goes through this server. Without it, sending fails with an error but the run completes.",
|      "whenToChange": "Set it when you turn report mail on.",
|      "card": "Mail server",
|      "info": {
|        "what": "Host name of the mail server (SMTP relay) every SecurityInsight mail is sent through.",
|        "whenChanged": "All Risk Analysis and close-loop mail goes through this server. Without it, sending fails with an error but the run completes.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Not set: no mail can be sent (reports are still written)",
|        "recommended": "Keep the default. Change it when: Set it when you turn report mail on.",
|        "docUrl": "https://invardia.com/docs/si/settings/SmtpServer/"
|      }
|    },
|    {
|      "name": "SMTPUser",
|      "label": "Mail server user name",
|      "group": "Mail & notifications",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": null,
|      "defaultText": "Not set: signed-in mail cannot start; some installs read it from your Key Vault",
|      "description": "--- SMTP credential resolution ---------------------------------------------- Convention (canonical, post-v2.2.366):",
|      "purpose": "User name of the mail server account that sends the mails.",
|      "effect": "Needed with the password whenever mail is sent with sign-in. Without it, a Risk Analysis run with mail on stops at start, unless anonymous mail is on.",
|      "whenToChange": "Set it when you turn mail on with a relay that needs sign-in.",
|      "card": "Mail server",
|      "needs": "!Mail_SendAnonymous",
|      "info": {
|        "what": "User name of the mail server account that sends the mails.",
|        "whenChanged": "Needed with the password whenever mail is sent with sign-in. Without it, a Risk Analysis run with mail on stops at start, unless anonymous mail is on.",
|        "risk": "A wrong value can mean that alerts and reports go to the wrong people or to nobody, or that mail stops; no collected data is changed. Reversible at once: change it back.",
|        "requires": "Works only while \"Send mail without sign-in\" is off. Read by: risk-analysis.",
|        "default": "Not set: signed-in mail cannot start; some installs read it from your Key Vault",
|        "recommended": "Keep the default. Change it when: Set it when you turn mail on with a relay that needs sign-in.",
|        "docUrl": "https://invardia.com/docs/si/settings/SMTPUser/"
|      }
|    },
|    {
|      "name": "SpnCertificateThumbprint",
|      "label": "Certificate thumbprint (launcher name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "asset-tagging",
|        "asset-trend",
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Copied from SI_SPN_CertThumbprint; empty means no certificate sign-in",
|      "description": "Thumbprint of the certificate (in the local certificate store) the service principal signs in with; the recommended alternative to a client secret.",
|      "purpose": "Thumbprint of the certificate in the local certificate store that the service principal signs in with; the recommended alternative to a client secret.",
|      "effect": "When set with an app id, the launchers sign in with the certificate. A thumbprint that is not in the store makes sign-in fail.",
|      "whenToChange": "When you sign in with a certificate and do not use the SI_SPN_ names.",
|      "info": {
|        "what": "Thumbprint of the certificate in the local certificate store that the service principal signs in with; the recommended alternative to a client secret.",
|        "whenChanged": "When set with an app id, the launchers sign in with the certificate. A thumbprint that is not in the store makes sign-in fail.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: asset-tagging, asset-trend, azure, endpoint, identity, publicip, risk-analysis.",
|        "default": "Copied from SI_SPN_CertThumbprint; empty means no certificate sign-in",
|        "recommended": "Keep the default. Change it when: When you sign in with a certificate and do not use the SI_SPN_ names.",
|        "docUrl": "https://invardia.com/docs/si/settings/SpnCertificateThumbprint/"
|      }
|    },
|    {
|      "name": "SpnClientId",
|      "label": "App id (launcher name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "asset-tagging",
|        "asset-trend",
|        "azure",
|        "endpoint",
|        "identity",
|        "privilege-tier-classifier",
|        "publicip",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Copied from SI_SPN_AppId",
|      "description": "Application (client) id of the service principal the engines sign in as; older name kept in step with SI_SPN_AppId.",
|      "purpose": "Application (client) id of the service principal the launchers sign in as; older name kept in step with SI_SPN_AppId.",
|      "effect": "Used by the launchers for certificate, Key Vault and secret sign-in; without it those methods stop with an error.",
|      "whenToChange": "Rarely; set SI_SPN_AppId instead.",
|      "info": {
|        "what": "Application (client) id of the service principal the launchers sign in as; older name kept in step with SI_SPN_AppId.",
|        "whenChanged": "Used by the launchers for certificate, Key Vault and secret sign-in; without it those methods stop with an error.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: asset-tagging, asset-trend, azure, endpoint, identity, privilege-tier-classifier, publicip, risk-analysis.",
|        "default": "Copied from SI_SPN_AppId",
|        "recommended": "Keep the default. Change it when: Rarely; set SI_SPN_AppId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SpnClientId/"
|      }
|    },
|    {
|      "name": "SpnClientSecret",
|      "label": "Client secret (launcher name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "asset-trend",
|        "azure",
|        "endpoint",
|        "identity",
|        "privilege-tier-classifier",
|        "publicip",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": true,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Copied from SI_SPN_Secret; not set means no secret sign-in",
|      "description": "Client secret of the service principal the engines sign in as, used when no certificate thumbprint is set; prefer a certificate or Key Vault.",
|      "purpose": "Plain client secret the launchers sign in with when no managed identity, Key Vault secret or certificate is configured.",
|      "effect": "Enables plain-secret sign-in, which the launcher warns is for testing only. Storing a secret in a file is a security risk.",
|      "whenToChange": "Only in labs; prefer managed identity, a certificate or a Key Vault secret.",
|      "info": {
|        "what": "Plain client secret the launchers sign in with when no managed identity, Key Vault secret or certificate is configured.",
|        "whenChanged": "Enables plain-secret sign-in, which the launcher warns is for testing only. Storing a secret in a file is a security risk.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Kept in the install's Key Vault. Read by: asset-trend, azure, endpoint, identity, privilege-tier-classifier, publicip, risk-analysis.",
|        "default": "Copied from SI_SPN_Secret; not set means no secret sign-in",
|        "recommended": "Keep the default. Change it when: Only in labs; prefer managed identity, a certificate or a Key Vault secret.",
|        "docUrl": "https://invardia.com/docs/si/settings/SpnClientSecret/"
|      }
|    },
|    {
|      "name": "SpnKeyVaultName",
|      "label": "Key Vault name (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "asset-tagging",
|        "asset-trend",
|        "azure",
|        "endpoint",
|        "identity",
|        "privilege-tier-classifier",
|        "publicip",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_KeyVaultName is used; no vault means no vault reads",
|      "description": "Name of the Azure Key Vault SecurityInsight reads its service principal secret and other credentials from; older name accepted alongside SI_KeyVaultName.",
|      "purpose": "Name of the Azure Key Vault holding the service principal secret and other credentials; older name accepted alongside SI_KeyVaultName.",
|      "effect": "With a secret name, the launchers read the client secret from this vault using the host's managed identity. SI_KeyVaultName wins when both are set.",
|      "whenToChange": "Rarely; set SI_KeyVaultName instead on new installs.",
|      "info": {
|        "what": "Name of the Azure Key Vault holding the service principal secret and other credentials; older name accepted alongside SI_KeyVaultName.",
|        "whenChanged": "With a secret name, the launchers read the client secret from this vault using the host's managed identity. SI_KeyVaultName wins when both are set.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: asset-tagging, asset-trend, azure, endpoint, identity, privilege-tier-classifier, publicip, risk-analysis.",
|        "default": "Not set: SI_KeyVaultName is used; no vault means no vault reads",
|        "recommended": "Keep the default. Change it when: Rarely; set SI_KeyVaultName instead on new installs.",
|        "docUrl": "https://invardia.com/docs/si/settings/SpnKeyVaultName/"
|      }
|    },
|    {
|      "name": "SpnSecretName",
|      "label": "Key Vault secret name",
|      "group": "Sign-in & Azure resources",
|      "type": "text",
|      "engines": [
|        "asset-tagging",
|        "asset-trend",
|        "azure",
|        "endpoint",
|        "identity",
|        "privilege-tier-classifier",
|        "publicip",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": true,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: the secret is not read from Key Vault",
|      "description": "Name of the Key Vault secret that holds the service principal's client secret, used when no certificate thumbprint or direct secret is set.",
|      "purpose": "Name of the Key Vault secret that holds the service principal's client secret.",
|      "effect": "With a vault name and app id, the launchers fetch the client secret from Key Vault at each run, so no secret is stored on disk. A wrong name stops the run.",
|      "whenToChange": "When the service principal secret is kept in Key Vault rather than using a certificate or managed identity.",
|      "info": {
|        "what": "Name of the Key Vault secret that holds the service principal's client secret.",
|        "whenChanged": "With a vault name and app id, the launchers fetch the client secret from Key Vault at each run, so no secret is stored on disk. A wrong name stops the run.",
|        "risk": "A credential: kept only in the install's Key Vault, never shown again after it is saved. A wrong value stops the steps that use it until it is corrected; nothing else is changed.",
|        "requires": "Kept in the install's Key Vault. Read by: asset-tagging, asset-trend, azure, endpoint, identity, privilege-tier-classifier, publicip, risk-analysis.",
|        "default": "Not set: the secret is not read from Key Vault",
|        "recommended": "Keep the default. Change it when: When the service principal secret is kept in Key Vault rather than using a certificate or managed identity.",
|        "docUrl": "https://invardia.com/docs/si/settings/SpnSecretName/"
|      }
|    },
|    {
|      "name": "SpnTenantId",
|      "label": "Tenant id (launcher name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "asset-tagging",
|        "asset-trend",
|        "azure",
|        "endpoint",
|        "identity",
|        "privilege-tier-classifier",
|        "publicip",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Copied from SI_SPN_TenantId; with managed identity, read from the sign-in",
|      "description": "Method 2 -- SPN + Key Vault secret:",
|      "purpose": "The Entra tenant id the launchers sign in to; older name kept in step with SI_SPN_TenantId.",
|      "effect": "Required for service principal sign-in; without it and without managed identity the launcher stops with an error.",
|      "whenToChange": "Rarely; set SI_SPN_TenantId instead.",
|      "info": {
|        "what": "The Entra tenant id the launchers sign in to; older name kept in step with SI_SPN_TenantId.",
|        "whenChanged": "Required for service principal sign-in; without it and without managed identity the launcher stops with an error.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: asset-tagging, asset-trend, azure, endpoint, identity, privilege-tier-classifier, publicip, risk-analysis.",
|        "default": "Copied from SI_SPN_TenantId; with managed identity, read from the sign-in",
|        "recommended": "Keep the default. Change it when: Rarely; set SI_SPN_TenantId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/SpnTenantId/"
|      }
|    },
|    {
|      "name": "SubscriptionId",
|      "label": "Azure subscription (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Derived from the workspace resource id, else the signed-in subscription",
|      "description": "--- Subscription --- INTERNAL (AF) mode: the platform-defaults.ps1 layer sets $global:MainLogAnalyticsWorkspaceSubId; Initialize-LauncherConfig derives $global:SubscriptionId from it after all layers load (see the \"derived defaults\" step at the bottom of Initialize-LauncherConfig.ps1), so this eager assignment below is just a safety hint -- it's a no-op at Layer 0. COMMUNITY mode: customer sets $global:SubscriptionId directly in LauncherConfig.custom.ps1.",
|      "purpose": "Older name for the subscription Risk Analysis uses to find or create its workspace and ingestion resources.",
|      "effect": "Risk Analysis uses it first when resolving the workspace; other engines use it only when SI_AzSubscriptionId and the workspace resource id give none. A wrong value points at the wrong subscription.",
|      "whenToChange": "Rarely; prefer setting the full workspace resource id.",
|      "info": {
|        "what": "Older name for the subscription Risk Analysis uses to find or create its workspace and ingestion resources.",
|        "whenChanged": "Risk Analysis uses it first when resolving the workspace; other engines use it only when SI_AzSubscriptionId and the workspace resource id give none. A wrong value points at the wrong subscription.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Derived from the workspace resource id, else the signed-in subscription",
|        "recommended": "Keep the default. Change it when: Rarely; prefer setting the full workspace resource id.",
|        "docUrl": "https://invardia.com/docs/si/settings/SubscriptionId/"
|      }
|    },
|    {
|      "name": "Summary",
|      "label": "Run Summary report",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off; with neither Summary nor Detailed set, the Summary report is still built by default.",
|      "description": "Run-mode + scope flags.",
|      "purpose": "Run-mode switch telling Risk Analysis to build the Summary report and use the Summary mail settings and table.",
|      "effect": "Selects the Summary report template, its mail recipients and its Log Analytics table. Setting it together with Detailed stops the run with an error.",
|      "whenToChange": "Normally set by the launcher or container job, not in the configuration file.",
|      "info": {
|        "what": "Run-mode switch telling Risk Analysis to build the Summary report and use the Summary mail settings and table.",
|        "whenOn": "Selects the Summary report template, its mail recipients and its Log Analytics table. Setting it together with Detailed stops the run with an error.",
|        "whenOff": "with neither Summary nor Detailed set, the Summary report is still built by default.",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off; with neither Summary nor Detailed set, the Summary report is still built by default.",
|        "recommended": "Keep the default. Change it when: Normally set by the launcher or container job, not in the configuration file.",
|        "docUrl": "https://invardia.com/docs/si/settings/Summary/"
|      }
|    },
|    {
|      "name": "UseManagedIdentity",
|      "label": "Managed identity on (launcher name)",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [
|        "asset-trend",
|        "azure",
|        "endpoint",
|        "identity",
|        "privilege-tier-classifier",
|        "publicip",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "On when no service principal is configured; otherwise off",
|      "description": "--- Launcher auth surface (community-vm + internal-vm launcher dispatch) --- The launchers (NOT the engines) read $global:Spn* + $global:UseManagedIdentity to decide HOW to log in to Azure. Pick ONE method block. The launcher then also exports the resolved values into SI_SPN_* for engine consumption, so you don't usually need both blocks set. Method 1 -- Managed Identity:",
|      "purpose": "Tells the launchers to sign in with the host's managed identity; set automatically by the sign-in method choice.",
|      "effect": "When on, launchers sign in as the Azure VM's or Arc server's identity (or a user-assigned one), and that identity needs the permissions.",
|      "whenToChange": "Rarely; set SI_AuthMethod instead.",
|      "info": {
|        "what": "Tells the launchers to sign in with the host's managed identity; set automatically by the sign-in method choice.",
|        "whenOn": "when no service principal is configured; otherwise off",
|        "whenOff": "When on, launchers sign in as the Azure VM's or Arc server's identity (or a user-assigned one), and that identity needs the permissions.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: asset-trend, azure, endpoint, identity, privilege-tier-classifier, publicip, risk-analysis.",
|        "default": "On when no service principal is configured; otherwise off",
|        "recommended": "Keep the default. Change it when: Rarely; set SI_AuthMethod instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/UseManagedIdentity/"
|      }
|    },
|    {
|      "name": "WhatIfMode",
|      "label": "Dry run",
|      "group": "Advanced / diagnostics",
|      "type": "bool",
|      "engines": [
|        "azure",
|        "endpoint",
|        "identity",
|        "publicip",
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": false,
|      "defaultText": "Off: a normal run.",
|      "description": "Dry run. Here, in the configuration, only asset tagging reads it (report only, no tag changed). Every other engine ignores it here and publishes as normal; start that one run with -WhatIfMode for a dry run instead.",
|      "purpose": "Requests a run that shows what would change without changing anything.",
|      "effect": "In the configuration it is read only by asset tagging, which then only reports the tags it would apply or remove. Every other engine ignores it in the configuration (scheduled runs always publish, and each run says the value was ignored): a dry run of profiling, Risk Analysis or the tier classifier is asked for per run -- start the launcher with -WhatIfMode, or set SI_WHATIF=1 on one container job execution. Such a run says so at its start and its end. Profiling and Risk Analysis then write their results to local files only -- nothing goes to Log Analytics, the mail, the export location or the caches; the run-health record says dry run. The tier classifier writes its result beside the catalog, never over it.",
|      "whenToChange": "In the configuration: only before the first real asset-tagging run. To preview any other engine, use -WhatIfMode on that one run.",
|      "info": {
|        "what": "Requests a run that shows what would change without changing anything.",
|        "whenOn": "In the configuration it is read only by asset tagging, which then only reports the tags it would apply or remove. Every other engine ignores it in the configuration (scheduled runs always publish, and each run says the value was ignored): a dry run of profiling, Risk Analysis or the tier classifier is asked for per run -- start the launcher with -WhatIfMode, or set SI_WHATIF=1 on one container job execution. Such a run says so at its start and its end. Profiling and Risk Analysis then write their results to local files only -- nothing goes to Log Analytics, the mail, the export location or the caches; the run-health record says dry run. The tier classifier writes its result beside the catalog, never over it.",
|        "whenOff": "a normal run.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: azure, endpoint, identity, publicip, risk-analysis.",
|        "default": "Off: a normal run.",
|        "recommended": "Keep the default. Change it when: In the configuration: only before the first real asset-tagging run. To preview any other engine, use -WhatIfMode on that one run.",
|        "docUrl": "https://invardia.com/docs/si/settings/WhatIfMode/"
|      }
|    },
|    {
|      "name": "WorkspaceName",
|      "label": "Workspace name (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "log-platform-management-securityinsight",
|      "defaultText": "log-platform-management-securityinsight",
|      "description": "Legacy short aliases (still read by the launchers + Setup script + RA fallback):",
|      "purpose": "Older name for the Log Analytics workspace name, read by Risk Analysis and setup checks.",
|      "effect": "Used by Risk Analysis only when no workspace resource id and no SI_WorkspaceName is set; it may then find or create a workspace with this name.",
|      "whenToChange": "Never on new installs; set SI_WorkspaceResourceId instead.",
|      "info": {
|        "what": "Older name for the Log Analytics workspace name, read by Risk Analysis and setup checks.",
|        "whenChanged": "Used by Risk Analysis only when no workspace resource id and no SI_WorkspaceName is set; it may then find or create a workspace with this name.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "log-platform-management-securityinsight",
|        "recommended": "Keep the default. Change it when: Never on new installs; set SI_WorkspaceResourceId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/WorkspaceName/"
|      }
|    },
|    {
|      "name": "WorkspaceResourceGroup",
|      "label": "Workspace resource group (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": "rg-securityinsight",
|      "defaultText": "rg-securityinsight",
|      "description": "Resource group of the Log Analytics workspace used when risk-analysis results are sent to Log Analytics; a risk-analysis-specific override takes precedence when set.",
|      "purpose": "Resource group of the Log Analytics workspace, used by Risk Analysis when it must find or create the workspace.",
|      "effect": "Used when SI_RiskAnalysis_WorkspaceResourceGroup is not set; its region also decides where missing resources are created. A wrong group can create a new workspace.",
|      "whenToChange": "Rarely; prefer setting the full workspace resource id.",
|      "info": {
|        "what": "Resource group of the Log Analytics workspace, used by Risk Analysis when it must find or create the workspace.",
|        "whenChanged": "Used when SI_RiskAnalysis_WorkspaceResourceGroup is not set; its region also decides where missing resources are created. A wrong group can create a new workspace.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Read by: risk-analysis.",
|        "default": "rg-securityinsight",
|        "recommended": "Keep the default. Change it when: Rarely; prefer setting the full workspace resource id.",
|        "docUrl": "https://invardia.com/docs/si/settings/WorkspaceResourceGroup/"
|      }
|    },
|    {
|      "name": "WorkspaceResourceId",
|      "label": "Workspace resource id (older name)",
|      "group": "Advanced / diagnostics",
|      "type": "text",
|      "engines": [],
|      "edition": "community",
|      "secret": false,
|      "advanced": true,
|      "default": null,
|      "defaultText": "Not set: SI_WorkspaceResourceId is used",
|      "description": "RA falls back to this when SI_WorkspaceResourceId is unset",
|      "purpose": "Older name for the full workspace resource id, read by Risk Analysis when the newer setting is not set.",
|      "effect": "Used only when SI_RiskAnalysis_WorkspaceResourceId and SI_WorkspaceResourceId are not set. A wrong value sends Risk Analysis data and queries to another workspace.",
|      "whenToChange": "Never on new installs; set SI_WorkspaceResourceId instead.",
|      "info": {
|        "what": "Older name for the full workspace resource id, read by Risk Analysis when the newer setting is not set.",
|        "whenChanged": "Used only when SI_RiskAnalysis_WorkspaceResourceId and SI_WorkspaceResourceId are not set. A wrong value sends Risk Analysis data and queries to another workspace.",
|        "risk": "A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.",
|        "requires": "Nothing else.",
|        "default": "Not set: SI_WorkspaceResourceId is used",
|        "recommended": "Keep the default. Change it when: Never on new installs; set SI_WorkspaceResourceId instead.",
|        "docUrl": "https://invardia.com/docs/si/settings/WorkspaceResourceId/"
|      }
|    },
|    {
|      "name": "WriteJsonOutput",
|      "label": "Risk report JSON copy",
|      "group": "Risk Analysis reports",
|      "type": "bool",
|      "engines": [
|        "risk-analysis"
|      ],
|      "edition": "community",
|      "secret": false,
|      "advanced": false,
|      "default": false,
|      "defaultText": "Off (shipped default)",
|      "description": "RiskAnalysis: write a JSON copy of the report next to the .xlsx. Default OFF (the shipped risk-analysis defaults set it); set $true when a downstream tool or the viewer needs it.",
|      "purpose": "Also writes the Risk Analysis report as a JSON file next to the Excel file, for tools that read machine-readable data.",
|      "effect": "On: an extra JSON file is written and uploaded with the Excel file; slightly more disk space and run time.",
|      "whenToChange": "Turn on when another tool or pipeline needs the report as JSON.",
|      "card": "Report mode and output",
|      "info": {
|        "what": "Also writes the Risk Analysis report as a JSON file next to the Excel file, for tools that read machine-readable data.",
|        "whenOn": "an extra JSON file is written and uploaded with the Excel file; slightly more disk space and run time.",
|        "whenOff": "(shipped default)",
|        "risk": "Changes what the Risk Analysis reports show, how findings are filtered or scored, or where reports go, from the next run; earlier reports are unchanged. Hiding findings can make real exposure invisible to readers. Reversible: change it back.",
|        "requires": "Read by: risk-analysis.",
|        "default": "Off (shipped default)",
|        "recommended": "Keep the default. Change it when: Turn on when another tool or pipeline needs the report as JSON.",
|        "docUrl": "https://invardia.com/docs/si/settings/WriteJsonOutput/"
|      }
|    }
|  ],
|  "retired": [
|    "SI_PrestageInfra",
|    "SI_ServiceNow_DirectWrite",
|    "SI_ServiceNow_ImportSetMaxRows",
|    "SI_ServiceNow_ImportSetTable",
|    "SI_StorageKey",
|    "SI_UseStorageOAuth",
|    "SI_VulnSync_ServiceNowDirectWrite",
|    "SI_VulnSync_ServiceNowImportSetTable"
|  ]
|}
'@ }
$__siSupportFiles['launcher/_lib/SecurityInsight.shared-defaults.ps1'] = @{ Sha256 = '25fbd34ef415126d9429744be620d852b29b0a6dfc90465007418204d3c0c63c'; Text = @'
|#Requires -Version 5.1
|<#
|.SYNOPSIS
|    Solution-wide shared defaults for SecurityInsight engines.
|
|.DESCRIPTION
|    Loaded by Initialize-LauncherConfig as Layer 0 -- BEFORE any per-engine
|    defaults.ps1, platform-defaults, solution-custom or launcher-custom file.
|    Customer overrides (any later layer) win.
|
|    These four values define the canonical SecurityInsight infrastructure
|    layout that ALL engines in the solution share by default:
|
|        $global:WorkspaceName     = 'log-platform-management-securityinsight'
|        $global:DceName           = 'dce-securityinsight'
|        $global:DceResourceGroup  = 'rg-dce-securityinsight'
|        $global:DcrResourceGroup  = 'rg-dcr-securityinsight'
|
|    The ingestion engines (RiskAnalysis + IdentityAssetsCollectDefineTierIngestLog)
|    auto-create the Workspace + DCE + RGs if any are missing, and assign the
|    ingestion SPN the roles it needs. Customers only need to override when
|    deviating from this standard layout.
|
|    To override a value SOLUTION-WIDE (all SI engines):
|      edit SOLUTIONS/SecurityInsight/config/SecurityInsight.custom.ps1
|
|    To override for a SINGLE engine:
|      edit LauncherConfig.custom.ps1 in that engine's launcher folder.
|
|.NOTES
|    File         : SecurityInsight.shared-defaults.ps1
|    Solution     : SecurityInsight
|    Developed by : Morten Knudsen, Microsoft MVP
|#>
|
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '../../engine/_shared/SI-AzRest.ps1') }
|
|# --- Log Analytics workspace (shared by RiskAnalysis + Identity + Onboarding) ---
|$global:WorkspaceName          = 'log-platform-management-securityinsight'
|$global:WorkspaceResourceGroup = 'rg-securityinsight'
|
|# --- Data Collection Endpoint (shared across all SI ingestion engines) ---
|$global:DceName                = 'dce-securityinsight'
|$global:DceResourceGroup       = 'rg-dce-securityinsight'
|
|# --- Data Collection Rules (one RG holds ALL SI DCRs; DCR NAMES are engine-specific) ---
|$global:DcrResourceGroup       = 'rg-dcr-securityinsight'
|
|# --- Region (used when the engine has to create any missing infra) ---
|$global:Location               = 'westeurope'
|
|# --- Fingerprint cache (default = DISABLED, opt-in) ---
|# The fingerprint cache (Azure Table 'sifingerprint') stores per-asset hash +
|# computed SI_Tier verdict so the Collect stage can SKIP assets whose source
|# signals haven't changed since the prior run (cadence-not-due short-circuit).
|#
|# Default is OFF because:
|#   (a) tenants running ForceFullRun=true on every cron tick (the common case)
|#       never read the cache -- the writes are pure overhead + 64KB property
|#       limit collisions on identity rows with large role/permission JSON;
|#   (b) the cache writes generate transcript noise (PS>TerminatingError(Invoke-
|#       RestMethod) lines) that obscure real errors during operator review;
|#   (c) when disabled, the Collect skip-gate degrades to "ForceFullRun-only" --
|#       safe because the engine still emits every row, just without the
|#       per-asset shortcut.
|#
|# Customers running incremental (ForceFullRun=$false) WHERE the cache actually
|# saves classifier work opt in via:
|#   $global:SI_FingerprintCache_Enabled = $true   # in SecurityInsight.custom.ps1
|#
|# Containers are unaffected either way -- the cache is a per-asset optimization,
|# not a coordination mechanism. KEDA replicas don't share state through it.
|$global:SI_FingerprintCache_Enabled = $false
|
|# --- Mail ---
|# Your own SMTP relay kept by choice: the Pro web app then stops suggesting the move to an Office 365 shared mailbox.
|# Mail is sent the same way either way.
|$global:SI_Mail_SmtpKept = $false
|
|# --- Copy findings per CI to Log Analytics (SI_Finding_CL) -- optional, OFF by default ---
|# After each Risk Analysis Detailed run, copies the de-duplicated findings (one row per CI and finding) into the Log
|# Analytics workspace, for your own workbooks, Sentinel or KQL. SecurityInsight itself does not need it: its pages read the
|# findings from its database. On a large estate the copy can take hours and adds ingestion cost. Not the report rows
|# (SendToLogAnalytics -> SI_RiskAnalysis_Detailed_CL: their own optional output, off by default -- #830). Read by Risk Analysis and the data sync
|# (engine\risk-analysis\_shared\RA-Findings.ps1, Test-SIFindingsCopyOn): on only for $true / 'on'.
|$global:SI_RA_Findings = $false
|
|# --- Disabled accounts and devices: one setting per stage ---
|# A disabled user, service principal / managed identity or computer = its account is disabled in its own directory
|# (Entra accountEnabled = false, AD userAccountControl disabled), never inferred from inactivity. The state is read
|# on every run, so an account that is enabled again is included again everywhere. A stage that leaves disabled
|# assets out says how many in its log, and their open findings, actions and tickets are kept as they are (never
|# resolved or closed) until the account is enabled again. Read by engine\_shared\SI-DisabledAssets.ps1.
|$global:SI_DisabledAssets_Collect      = $true    # collected from the sources
|$global:SI_DisabledAssets_Correlate    = $true    # take part in CI correlation (needs collection)
|$global:SI_DisabledAssets_RiskAnalysis = $false   # reach the Risk Analysis reports (needs collection)
|$global:SI_DisabledAssets_StateActions = $false   # finding / vulnerability lifecycle, close-loop, ticket open and close (needs collection)
|$global:SI_DisabledAssets_Connectors   = $false   # sent out by connectors and exports (needs collection)
|
|# --- A customer's choice: Exposure Graph identities that get no asset (#1056) ---
|# Off by default -- an install that does not turn them on works exactly as before. On (per install, the customer's own
|# choice): the identity collection records no asset for the objects below, counts them in its log and on the Data health
|# page, and their existing CIs retire with a reason naming the setting. Real users, groups, devices and findings are not
|# affected. Read by engine\asset-profiling\shared\SI-IdentityScopeChoice.ps1.
|$global:SI_Identity_SkipNeverSyncedAd         = $false   # OFF by default; on: on-prem AD accounts never synced to Entra become assets only while privileged (for tenants with very many of them; decides instead of the next one while on)
|$global:SI_Identity_SkipNeverSyncedDisabledAd = $true    # on-prem AD accounts never synced to Entra: only enabled or privileged ones become assets
|$global:SI_Identity_SkipDeletedGroups         = $true    # groups: only those Entra ID still has (active or recently deleted) become assets
|
|# --- The users' sign-in methods in full, read in the background ---
|# Every property of every sign-in method of a user (and the device of a Windows Hello / Authenticator method) needs one read
|# per user, which Microsoft throttles: about 8-9 hours at 150,000 users. The collections never make it -- its own job
|# (caj-si-signin-methods, every 15 minutes) reads users in the background, privileged first, and the collections take what it saved (with its read date; not read
|# yet = unknown, never no). Read by engine\asset-profiling\shared\SI-SignInMethodsChoice.ps1.
|$global:SI_Identity_SignInMethodsPerUser     = 'all'   # all = every member user | privileged = privileged users only | off = the tenant-wide registration report only
|$global:SI_Identity_SignInMethodsMaxAgeDays  = 90      # a user's detail is read again at the latest after this many days (sooner when its methods change)
|$global:SI_Identity_SignInMethodsFillMinutes = 8       # minutes of background reading per 15-minute run
|
|# --- Retire at once on proof of deletion (#1057) ---
|# Off by default -- an install that does not turn them on works exactly as before. On (per install, per source): an asset
|# whose source PROVES it deleted (never merely missing) retires at once instead of after the grace period, and its open
|# vulnerabilities close as 'asset deleted in <source>'. Read by engine\data-model\SI-DeletionProof.ps1.
|$global:SI_DeletionProof_Entra  = $false   # a user, device or group in Entra ID's deleted items retires at once
|$global:SI_DeletionProof_Azure  = $false   # an Azure resource with a Delete in the resource changes retires at once
|$global:SI_DeletionProof_Intune = $false   # a managed device deleted in Intune's audit events retires at once
|
|# --- CI build ---
|# Every CI is rebuilt in full at least this often (days); the runs between build only the CIs whose input changed.
|# 0 = a full build every run. Read by engine\data-model\SI-CiBuildSql.ps1 (Get-SICiFullReconcileDecision).
|$global:SI_CiBuild_FullReconcileDays  = 7
|# One asset never holds the CI build: the seconds the rules of ONE asset may take. An asset that takes longer is not fully
|# evaluated in that run -- nothing of the half evaluation is stored: it keeps what it had from its last complete evaluation
|# (a new asset is left out), is named in the run log and is evaluated again in the next run. 0 = no limit.
|# Read by engine\data-model\SI-CiEnrich.ps1 (Get-SICiRulesBudgetSeconds).
|$global:SI_CiRulesBudgetSeconds       = 60
|
|# --- Subscription ---
|# INTERNAL (AF) mode: the platform-defaults.ps1 layer sets
|# $global:MainLogAnalyticsWorkspaceSubId; Initialize-LauncherConfig derives
|# $global:SubscriptionId from it after all layers load (see the "derived
|# defaults" step at the bottom of Initialize-LauncherConfig.ps1), so this
|# eager assignment below is just a safety hint -- it's a no-op at Layer 0.
|# COMMUNITY mode: customer sets $global:SubscriptionId directly in LauncherConfig.custom.ps1.
|$global:SubscriptionId         = $global:MainLogAnalyticsWorkspaceSubId
|
|# --- SPN bridge: v2.3 -> v2.2 SI engine contract -----------------------------
|# 16 engine sites (Invoke-RiskAnalysis, Invoke-SIEngineRun, Send-SIRunHealthRow,
|# Build-IdentityProfileRow, Invoke-Output) still read $global:SI_SPN_*. v2.3
|# platform sign-in sets $global:HighPriv_Modern_* + $global:AzureTenantId.
|# Bridge here so customer custom files don't need to repeat the mapping. All
|# four assignments are conditional ("if not already set") so a customer can
|# still override any of them later in custom.ps1 if needed.
|if (-not $global:SI_SPN_TenantId -and $global:AzureTenantId) {
|    $global:SI_SPN_TenantId = $global:AzureTenantId
|}
|if (-not $global:SI_SPN_AppId -and $global:HighPriv_Modern_ApplicationID_Azure) {
|    $global:SI_SPN_AppId = $global:HighPriv_Modern_ApplicationID_Azure
|}
|if (-not $global:SI_SPN_Secret -and $global:HighPriv_Modern_Secret_Azure) {
|    $global:SI_SPN_Secret = $global:HighPriv_Modern_Secret_Azure
|}
|if (-not $global:SI_SPN_ObjectId -and $global:SI_SPN_AppId) {
|    try {
|        $global:SI_SPN_ObjectId = (Get-SIAzADServicePrincipal -ApplicationId $global:SI_SPN_AppId -ErrorAction Stop).Id
|    } catch {
|        Write-Verbose ("SI shared-defaults: SPN ObjectId lookup failed -- engines that need it will retry: $($_.Exception.Message)")
|    }
|}
|
|# --- SMTP credential resolution ----------------------------------------------
|# Convention (canonical, post-v2.2.366):
|#   $global:SMTPUser     = SMTP relay LOGIN (auth username)
|#   $global:SMTPPassword = SMTP relay PASSWORD
|#   $global:SMTPFrom     = visible from-address header on outbound mail
|#
|# INTERNAL automation pattern (this is your case):
|#   Platform-defaults sets $global:SMTPUser to the FROM ADDRESS (legacy
|#   convention -- the variable name is "SMTPUser" but its content is semantically
|#   the from-address). The actual SMTP relay LOGIN + PASSWORD live in Key Vault
|#   under secret names 'SMTPuser' + 'SMTPpassword'. When we have a platform
|#   Context AND Mail_SendAnonymous is OFF, we:
|#     1. Promote platform-defaults' $global:SMTPUser -> $global:SMTPFrom
|#     2. Force-pull SMTPUser + SMTPPassword from KV (override the from-value)
|#   Bridges from $global:HighPriv_SMTP_* (if your platform-defaults uses those)
|#   are honored as a final fallback.
|#
|# COMMUNITY pattern (no platform Context):
|#   Customer sets the actual login in $global:SMTPUser via custom.ps1 directly.
|#   No promote, no KV pull (skipped silently). Customer sets SMTPFrom too if
|#   different from SMTPUser.
|
|# 1. INTERNAL automation: promote from-address + force-pull KV creds
|# v2.2.384 -- gate flipped from `-eq $false` to `-ne $true`. The previous gate
|# only fired when SOMETHING upstream (Layer 1b or earlier) had explicitly set
|# $global:Mail_SendAnonymous = $false. Most launchers set it via Layer 4
|# (LauncherConfig.defaults), which runs AFTER this Layer 2 file -- so at gate
|# evaluation time the variable was still $null, and `$null -eq $false` evaluates
|# to $false in PowerShell, so the KV pull silently no-op'd. The new condition
|# fires whenever Context is present UNLESS the customer has explicitly opted
|# in to anonymous SMTP via $global:Mail_SendAnonymous = $true (which still
|# correctly bypasses KV credential resolution).
|if ($global:Context -and ($global:Mail_SendAnonymous -ne $true)) {
|    # the platform Key Vault is read natively (auth\SI-PlatformConnect.ps1, plain REST -- no PowerShell module)
|    if (-not (Get-Command -Name Get-SIPlatformSecret -ErrorAction SilentlyContinue)) {
|        $_siPlatformConnect = [System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'auth', 'SI-PlatformConnect.ps1')
|        if (Test-Path -LiteralPath $_siPlatformConnect) { . $_siPlatformConnect }
|    }
|    # Promote platform-defaults' SMTPUser -> SMTPFrom (preserves the from address)
|    if (-not $global:SMTPFrom -and $global:SMTPUser) {
|        $global:SMTPFrom = $global:SMTPUser
|        $global:SMTPUser = $null   # clear so KV pull below populates the actual login
|        Write-Verbose "SI shared-defaults: promoted platform-defaults `$global:SMTPUser to `$global:SMTPFrom (legacy convention); will pull actual SMTPUser+Password from KV below"
|    }
|    # Force-pull SMTPUser from KV (overrides any earlier value)
|    if (-not $global:SMTPUser) {
|        foreach ($_smtpKvName in @('SMTPuser','SMTP-User')) {
|            try {
|                $_val = Get-SIPlatformSecret -Context $global:Context -Name $_smtpKvName -AsPlainText -ErrorAction Stop
|                if ($_val) {
|                    $global:SMTPUser = $_val
|                    Write-Verbose ("SI shared-defaults: SMTPUser resolved from KV name '$_smtpKvName' (internal automation, Anonymous=false)")
|                    break
|                }
|            } catch {
|                Write-Verbose ("SI shared-defaults: KV name '$_smtpKvName' not present -- trying next ($($_.Exception.Message))")
|            }
|        }
|    }
|    # Pull SMTPPassword from KV
|    if (-not $global:SMTPPassword) {
|        foreach ($_smtpKvName in @('SMTPpassword','SMTP-Password')) {
|            try {
|                $_val = Get-SIPlatformSecret -Context $global:Context -Name $_smtpKvName -AsPlainText -ErrorAction Stop
|                if ($_val) {
|                    $global:SMTPPassword = $_val
|                    Write-Verbose ("SI shared-defaults: SMTPPassword resolved from KV name '$_smtpKvName' (internal automation, Anonymous=false)")
|                    break
|                }
|            } catch {
|                Write-Verbose ("SI shared-defaults: KV name '$_smtpKvName' not present -- trying next ($($_.Exception.Message))")
|            }
|        }
|    }
|}
|
|# 2. Final fallback bridges from HighPriv_SMTP_* (fire only if still unset)
|if (-not $global:SMTPUser     -and $global:HighPriv_SMTP_UserName) { $global:SMTPUser     = $global:HighPriv_SMTP_UserName }
|if (-not $global:SMTPPassword -and $global:HighPriv_SMTP_Password) { $global:SMTPPassword = $global:HighPriv_SMTP_Password }
|if (-not $global:SMTPFrom     -and $global:HighPriv_SMTP_From)     { $global:SMTPFrom     = $global:HighPriv_SMTP_From }
|
|# 3. Log resolved values (length-only for password) so operators can verify at run start
|Write-Host ("[shared-defaults] SMTP resolved: From={0} | User={1} | Password=[len={2}] | Anonymous={3} | Context={4}" -f `
|    ($(if ($global:SMTPFrom) { $global:SMTPFrom } else { '<NULL>' })), `
|    ($(if ($global:SMTPUser) { $global:SMTPUser } else { '<NULL>' })), `
|    ($(if ($global:SMTPPassword) { ([string]$global:SMTPPassword).Length } else { 0 })), `
|    ($(if ($null -ne $global:Mail_SendAnonymous) { $global:Mail_SendAnonymous } else { '<unset>' })), `
|    ($(if ($global:Context) { 'present' } else { 'absent' })))
'@ }
$__siSupportFiles['risk-analysis-detection/RiskAnalysis_Queries_Locked.yaml'] = @{ Sha256 = '15d277a7e1d7d7e4cf21566d2bac44ef2cadc21ba36eed6b5e9414b1b1d1f212'; Text = @'
|Reports:
|    - ReportName: Device_Missing_CVEs_Summary
|      ReportPurpose: This report highlights open endpoint CVEs (every age, unless a minimum age is set), excluding out-of-scope assets, and prioritizes
|        them using asset criticality, tag-based tiering, and exploit and exposure risk factors to focus remediation on the most
|        critical and likely exploitable vulnerabilities.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - IssueList
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // CVE MIN-age filter (only show CVEs older than SI_CveMinAgeDays). Engine
|          // substitutes SI_CveMinAgeDays from per-report exclude.custom.json
|          // (CveMinAgeDays). 0 = no age filter (default; show all).
|          // The keep-set explicitly includes isnull(CVELastModified) -- DELIBERATE,
|          // a CVE is not dropped just because the lastModifiedDate metadata is missing.
|          // Report   Device_Missing_CVEs_Summary
|          // Purpose  Overdue endpoint CVEs prioritised by criticality + exploit + exposure.
|          // Output   One row per (Tier x Severity) bucket; lists carry detail.
|          //
|          // #505 -- THE ASSET COMES FROM THE CI (SI_CI_CL). Tier, CMDB values, tags and the asset risk factors
|          // (internet exposed, unsupported OS) are the CI's. The FINDINGS still come from the providers (Exposure
|          // Graph CVE edges + Defender vulnerability management) and are tied to their CI through _ciKey, the CI's
|          // link ids. DeviceKey is the Defender device id (EG EntityIds SenseDeviceId, DeviceTvm DeviceId), else
|          // the EG node id -- the same ids the CI links, so the hybrid path buckets both sides alike.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|
|          let _Assets =
|              ExposureGraphNodes
|              // v2.2.420 (audit #57.1b) -- HEDGED across property paths (NodeProperties is a payload bag, not a schema).
|              | where tostring(coalesce(NodeProperties.rawData.deviceCategory,
|                                        NodeProperties.raw.deviceCategory,
|                                        NodeProperties.deviceCategory)) == "Endpoint"
|              | extend EG_IsExcluded = tobool(coalesce(NodeProperties.rawData.isExcluded, NodeProperties.raw.isExcluded))
|              | where EG_IsExcluded == false
|              | extend _ids = tostring(EntityIds)
|              | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|              | project
|                  AssetNodeId = NodeId,
|                  AssetName   = NodeName,
|                  AssetLabel  = NodeLabel,
|                  MdeDeviceId,
|                  EG_IsExcluded
|              // v2.2.429 -- PARTITION THE EG WORK here (the identical bucket block below is the safety net).
|              | extend DeviceKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(AssetNodeId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              ;
|
|          // v2.2.212 -- 3-let architecture (materialize() of filtered edges + _RelevantFindingIds + separate _Findings).
|          let _AssetNodeIdSet = _Assets | distinct AssetNodeId;
|          let _OurAffectingEdges = materialize(
|              ExposureGraphEdges
|              | where EdgeLabel has "affecting"
|              | where TargetNodeId in (_AssetNodeIdSet)
|          );
|          let _RelevantFindingIds = _OurAffectingEdges | distinct SourceNodeId;
|          let _Findings =
|              ExposureGraphNodes
|              | where NodeLabel startswith "cve"
|              | where Categories has_any ("vulnerability_finding")
|              | where NodeId in (_RelevantFindingIds)
|              //__CVE_FILTER_BEGIN__
|              | where 1 == 1
|              //__CVE_FILTER_END__
|              | project FindingNodeId            = NodeId,
|                        FindingName              = NodeName,
|                        FindingLabel             = NodeLabel,
|                        FindingCategories        = Categories,
|                        FindingSeverity          = tostring(NodeProperties.rawData.severity),
|                        FindingCvssScore         = todouble(NodeProperties.rawData.cvssScore),
|                        FindingHasExploit        = tobool(NodeProperties.rawData.hasExploit),
|                        FindingIsExploitVerified = tobool(NodeProperties.rawData.isExploitVerified),
|                        FindingIsInExploitKit    = tobool(NodeProperties.rawData.isInExploitKit),
|                        FindingIsZeroDay         = tobool(NodeProperties.rawData.isZeroDay),
|                        CVELastModified          = todatetime(NodeProperties.rawData.lastModifiedDate),
|                        FindingDescription       = tostring(NodeProperties.rawData.description),
|                        FindingReferenceUrl      = tostring(coalesce(NodeProperties.rawData.referenceUrl, NodeProperties.rawData.url));
|
|          // v2.2.215 -- pre-collapse the multi-NodeId fanout at the edge level (one device, many EG node ids --
|          // they share the Defender device id, so they collapse onto one DeviceKey).
|          let _DeviceMap =
|              _Assets
|              | project AssetNodeId, DeviceKey, AssetName, AssetLabel, MdeDeviceId;
|
|          let _DeviceFindingEdges =
|              _OurAffectingEdges
|              | join kind=inner (_DeviceMap) on $left.TargetNodeId == $right.AssetNodeId
|              | summarize
|                  EdgeLabels  = make_set(EdgeLabel),
|                  AssetName   = any(AssetName),
|                  AssetLabel  = any(AssetLabel),
|                  MdeDeviceId = min(tostring(MdeDeviceId))
|                  by DeviceKey, SourceNodeId;
|
|          // #690 (28) -- when Defender vulnerability management holds the same device and CVE, ITS severity is the one shown (the MDE
|          // portal shows it), the graph's only where vulnerability management lacks the pair
|          let _TvmSeverityByPair =
|              DeviceTvmSoftwareVulnerabilities
|              | extend DeviceKey = tolower(tostring(DeviceId)), _cveKey = toupper(tostring(CveId))
|              | where DeviceKey in (_DeviceMap | distinct DeviceKey)
|              | summarize TvmPairSeverity = take_any(tostring(VulnerabilitySeverityLevel)) by DeviceKey, _cveKey;
|          let _AssetFindingEdges =
|              _DeviceFindingEdges
|              | join kind=inner (_Findings) on $left.SourceNodeId == $right.FindingNodeId
|              | extend _cveKey = toupper(tostring(FindingName))
|              | join kind=leftouter (_TvmSeverityByPair) on DeviceKey, _cveKey
|              | extend FindingSeverity = iff(isnotempty(TvmPairSeverity), TvmPairSeverity, FindingSeverity)
|              | project DeviceKey, AssetName, AssetLabel, MdeDeviceId, EdgeLabels,
|                        FindingName, FindingLabel, FindingCategories,
|                        FindingSeverity, FindingCvssScore,
|                        FindingHasExploit, FindingIsExploitVerified, FindingIsInExploitKit, FindingIsZeroDay,
|                        CVELastModified, FindingDescription, FindingReferenceUrl;
|
|          // #150 -- EVERY CVE DEFENDER VULNERABILITY MANAGEMENT REPORTS, NOT ONLY THOSE THE GRAPH CARRIES.
|          // Vulnerability-management rows the graph lacks are ADDED, same columns, same DeviceKey, de-duplicated
|          // on device + CVE. #505 -- the pair key is the Defender device id, no longer a host name.
|          let _egCvePairs = _AssetFindingEdges
|              | distinct _pairKey = strcat(DeviceKey, "|", toupper(FindingName));
|          // #880 -- THE SLICE'S OWN DEVICES: vulnerability management is read for the devices of THIS slice only (the same key
|          // and hash as the slice filter on the union below), so a slice reads its own share of the table, not all of it before
|          // the joins. Without slices the block is a no-op and every device is kept -- the rows are the same either way.
|          let _sliceTvmDevices = DeviceTvmSoftwareVulnerabilities
|              | summarize by DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              | project DeviceKey;
|          let _TvmOnly = DeviceTvmSoftwareVulnerabilities
|              | where tolower(tostring(DeviceId)) in (_sliceTvmDevices)
|              | summarize DeviceName = any(DeviceName), TvmSeverity = any(VulnerabilitySeverityLevel) by DeviceId, CveId
|              | join kind=leftouter (union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime)[]), (DeviceInfo) | extend ExclusionReason = tostring(column_ifexists("ExclusionReason", "")) | summarize arg_max(Timestamp, ExclusionReason) by DeviceId) on DeviceId
|              // an MDE-excluded device is dropped from the graph rows (EG_IsExcluded) -- drop it here too
|              | where isempty(ExclusionReason)
|              | join kind=leftouter (DeviceTvmSoftwareVulnerabilitiesKB | project CveId, CvssScore, IsExploitAvailable, LastModifiedTime, PublishedDate, VulnerabilityDescription) on CveId
|              //__CVE_FILTER_TVM_BEGIN__
|              | where 1 == 1
|              //__CVE_FILTER_TVM_END__
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              | extend _pairKey = strcat(DeviceKey, "|", toupper(CveId))
|              | join kind=leftanti (_egCvePairs) on _pairKey
|              | project
|                  DeviceKey,
|                  AssetName                = tostring(DeviceName),
|                  AssetLabel               = "device",
|                  MdeDeviceId              = DeviceKey,
|                  EdgeLabels               = dynamic(["vulnerability management"]),
|                  FindingName              = tostring(CveId),
|                  FindingLabel             = "cve",
|                  FindingCategories        = dynamic(["vulnerability_finding"]),
|                  FindingSeverity          = tostring(TvmSeverity),
|                  FindingCvssScore         = todouble(CvssScore),
|                  FindingHasExploit        = tobool(IsExploitAvailable),
|                  FindingIsExploitVerified = false,
|                  FindingIsInExploitKit    = false,
|                  FindingIsZeroDay         = false,
|                  CVELastModified          = todatetime(LastModifiedTime),
|                  FindingDescription       = tostring(VulnerabilityDescription),
|                  FindingReferenceUrl      = strcat("https://nvd.nist.gov/vuln/detail/", tostring(CveId));
|
|          union _AssetFindingEdges, _TvmOnly
|              | where (SI_CveMinAgeDays == 0) or (isnull(CVELastModified)) or (CVELastModified < ago(SI_CveMinAgeDays * 1d))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // #505 -- the finding's CI, by the Defender device id or the EG node id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(AssetName)),     tostring(AssetName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  tostring(DeviceKey))
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, tostring(DeviceKey))
|              | extend AssetType = iif(isnotempty(tostring(si_class)), "Endpoint", tostring(AssetLabel))
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.endpoint.fields[].
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend Impact = FindingCvssScore
|              | extend SecuritySeverity = case(
|                  tolower(FindingSeverity) == "critical", "Very High",
|                  tolower(FindingSeverity) == "high",     "High",
|                  tolower(FindingSeverity) == "medium",   "Medium",
|                  tolower(FindingSeverity) == "low",      "Low",
|                  "Low")
|              | where not (FindingName in (SI_ExcludedCves))
|              | extend HasExploit        = FindingHasExploit
|              | extend IsExploitVerified = FindingIsExploitVerified
|              | extend IsInExploitKit    = FindingIsInExploitKit
|              | extend IsZeroDay         = FindingIsZeroDay
|              | extend CveUrl = iif(isempty(FindingReferenceUrl), strcat("https://nvd.nist.gov/vuln/detail/", FindingName), FindingReferenceUrl)
|              // the fix of each finding (Defender vulnerability management, by device and CVE) -- the security update Defender recommends,
|              // its id and the affected software as Name Version (Vendor), listed per Summary row below
|              | extend _swKey = strcat(tolower(tostring(MdeDeviceId)), "|", toupper(tostring(FindingName)))
|              | join kind=leftouter (DeviceTvmSoftwareVulnerabilities
|                  | where tolower(tostring(DeviceId)) in (_sliceTvmDevices)
|                  | extend _swKey = strcat(tolower(tostring(DeviceId)), "|", toupper(tostring(CveId)))
|                  | extend _swDisplay = strcat(trim(" ", strcat(tostring(SoftwareName), " ", tostring(SoftwareVersion))), iff(isempty(tostring(SoftwareVendor)), "", strcat(" (", tostring(SoftwareVendor), ")")))
|                  | extend _fixUpdate = tostring(RecommendedSecurityUpdate), _fixUpdateId = tostring(column_ifexists("RecommendedSecurityUpdateId", ""))
|                  | extend _cveTagText = strcat_array(todynamic(column_ifexists("CveTags", dynamic([]))), ";")
|                  | summarize _swDisplaySet = make_set_if(_swDisplay, isnotempty(trim(" ", _swDisplay)), 8),
|                              _fixUpdateSet = make_set_if(_fixUpdate, isnotempty(_fixUpdate), 8),
|                              _fixUpdateIdSet = make_set_if(_fixUpdateId, isnotempty(_fixUpdateId), 8),
|                              _cveTagSet = make_set_if(_cveTagText, isnotempty(_cveTagText), 8) by _swKey) on _swKey
|              | extend _swText = strcat_array(coalesce(_swDisplaySet, dynamic([])), ";"),
|                       _fixText = strcat_array(coalesce(_fixUpdateSet, dynamic([])), ";"),
|                       _fixIdText = strcat_array(coalesce(_fixUpdateIdSet, dynamic([])), ";"),
|                       _cveTagRow = strcat_array(coalesce(_cveTagSet, dynamic([])), ";")
|              // the CVE's own context from the Defender knowledge base -- when it was published and its EPSS score
|              | extend _cveUpper = toupper(tostring(FindingName))
|              | join kind=leftouter (DeviceTvmSoftwareVulnerabilitiesKB
|                  | extend _kbEpss = round(todouble(column_ifexists("EpssScore", real(null))), 5)
|                  | project CveId = toupper(tostring(CveId)), _kbPublished = todatetime(PublishedDate), _kbEpss) on $left._cveUpper == $right.CveId
|              // finding factors (exploit, RCE) -- the report evaluates them on the provider finding
|              | extend RF_P_ExploitSignals  = iff(HasExploit == true or IsExploitVerified == true or IsInExploitKit == true or IsZeroDay == true, 1, 0)
|              | extend RF_C_RemoteCodeExec  = iff(HasExploit == true or IsExploitVerified == true or IsInExploitKit == true, 1, 0)
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              | extend RiskFactor_Probability = RF_P_ExploitSignals + array_length(RF_P_CiFactors)
|              | extend RiskFactor_Consequence = RF_C_RemoteCodeExec
|              | extend RiskFactor_Consequence_Detailed = strcat_array(array_concat(
|                  iff(RF_C_RemoteCodeExec == 1, dynamic(["RemoteCodeExecutionRisk"]), dynamic([]))), ";")
|              | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|                  iff(RF_P_ExploitSignals  == 1, dynamic(["ExploitSignals"]),     dynamic([])),
|                  RF_P_CiFactorNames), ";")
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain    = "Endpoint"
|              | extend ConfigurationName = "Update vulnerable software"
|              | extend ConfigurationId   = "CVE"
|              | extend Category          = "Vulnerabilities"
|              | extend Subcategory       = "CVEs (Missing Updates)"
|              // si_exploited_cves -- the CVE ids of the row that have a known exploit (HasExploit, as the Detailed report and
|              // the finding carry it). tostring() keeps the bucket merge recounting UniqueIssues from IssueList alone
|              | summarize
|                  UniqueIssues              = dcount(FindingName),
|                  ImpactedAssetsList        = make_set(AssetName),
|                  ImpactedAssetPairs        = make_set(strcat(AssetName, "|", AssetId)),
|                  IssueList                 = make_set(FindingName),
|                  si_exploited_cves         = make_set_if(tostring(FindingName), HasExploit == true),
|                  MoreDetails               = strcat_array(make_set(strcat(FindingName, " => ", CveUrl)), "; "),
|                  _swAll                    = make_set_if(_swText, isnotempty(_swText)),
|                  _fixAll                   = make_set_if(_fixText, isnotempty(_fixText)),
|                  _fixIdAll                 = make_set_if(_fixIdText, isnotempty(_fixIdText)),
|                  _cveTagAll                = make_set_if(_cveTagRow, isnotempty(_cveTagRow)),
|                  si_epss                   = max(_kbEpss),
|                  si_published              = min(_kbPublished),
|                  RiskFactor_Consequence    = max(RiskFactor_Consequence),
|                  RiskFactor_Consequence_Detailed = strcat_array(make_set_if(RiskFactor_Consequence_Detailed, isnotempty(RiskFactor_Consequence_Detailed)), ";"),
|                  RiskScore_Weight_Factor   = max(RiskScore_Weight_Factor),
|                  RiskFactor_Weight         = max(RiskFactor_Weight),
|                  RiskScore_Weight_Detailed = any(RiskScore_Weight_Detailed),
|                  Impact                    = max(Impact),
|                  arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|                  MdeDeviceId               = min(tostring(MdeDeviceId)),
|                  EntraAccountObjectId      = min(tostring("")),
|                  AzureResourceId           = min(tostring("")),
|                  AssetId                   = min(AssetId),
|                  MITRE_Tactics             = min(tostring(column_ifexists("MITRE_Tactics",""))),
|                  MITRE_Techniques          = min(tostring(column_ifexists("MITRE_Techniques",""))),
|                  ComplianceTags            = min(tostring(column_ifexists("ComplianceTags","")))
|                by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                   CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|                   cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|              // audit #25 -- the count is derived from the list that is actually DISPLAYED
|              | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|              // how many of the row's CVE ids have a known exploit (0 when none -- the stored row always says it)
|              | extend si_exploited_cve_count = array_length(si_exploited_cves)
|              // the row's fixes and affected software, each value once (a finding may carry several, joined with ;)
|              | extend si_affected_software = iff(array_length(_swAll) == 0, "", strcat_array(set_difference(set_union(split(strcat_array(_swAll, ";"), ";"), dynamic([])), dynamic([""])), ";")),
|                       si_fix_recommended_update = iff(array_length(_fixAll) == 0, "", strcat_array(set_difference(set_union(split(strcat_array(_fixAll, ";"), ";"), dynamic([])), dynamic([""])), ";")),
|                       si_fix_recommended_update_id = iff(array_length(_fixIdAll) == 0, "", strcat_array(set_difference(set_union(split(strcat_array(_fixIdAll, ";"), ";"), dynamic([])), dynamic([""])), ";"))
|              | extend si_fix_remediation = iff(isnotempty(si_fix_recommended_update),
|                  strcat("Install the security updates ", replace_string(si_fix_recommended_update, ";", ", "), " on the impacted devices; update the other affected software to versions that fix the listed CVEs."),
|                  "Update the affected software on the impacted devices to versions that fix the listed CVEs.")
|              | extend si_cve_tags = iff(array_length(_cveTagAll) == 0, "", strcat_array(set_difference(set_union(split(strcat_array(_cveTagAll, ";"), ";"), dynamic([])), dynamic([""])), ";"))
|              | project
|                  SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Consequence_Detailed, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetPairs, UniqueIssues,
|                  IssueList, si_exploited_cves, si_exploited_cve_count, MoreDetails,
|                  si_affected_software, si_fix_recommended_update, si_fix_recommended_update_id, si_fix_remediation,
|                  si_epss, si_published, si_cve_tags
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, ImpactedAssetCount desc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|          // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|          // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|          // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, IssueList, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_description <- FindingDescription, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation
|          // si si_fix_recommended_update <- si_fix_recommended_update, si_fix_recommended_update_id <- si_fix_recommended_update_id, si_affected_software <- si_affected_software, si_epss <- si_epss
|          // si si_cve_tags <- si_cve_tags, si_fix_reference <- RecommendedSecurityUpdate, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics
|          // si si_mitre_techniques <- MITRE_Techniques, si_reference_url <- CveUrl, si_published <- si_published, si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_Missing_CVEs_Detailed
|      ReportPurpose: Per-row detail of overdue endpoint CVEs, prioritised by asset criticality, exploit signals, and exposure.
|        Same CL-correlation pattern as the Summary, but emits one row per (Asset x CVE) with full per-CVE context.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      # Every severity and every tier is in scope (#643, owner 2026-10-13 "Follow scope 0-3") -- the
|      # report shows what Defender shows; the risk score ranks it.
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // CVE MIN-age filter (only show CVEs older than SI_CveMinAgeDays). Engine
|          // substitutes SI_CveMinAgeDays from per-report exclude.custom.json
|          // (CveMinAgeDays). 0 = no age filter (default; show all).
|          // The keep-set explicitly includes isnull(CVELastModified) -- DELIBERATE,
|          // a CVE is not dropped just because the lastModifiedDate metadata is missing.
|          // Report   Device_Missing_CVEs_Detailed
|          // Purpose  Per-row detail of overdue endpoint CVEs prioritised by criticality + exploit + exposure.
|          // Output   One row per (Asset x CVE), with the per-CVE context (CVE id, URL, exploit flags, description, last-modified date).
|          // Mirrors  Device_Missing_CVEs_Summary; differs only in skipping the final summarize.
|          //
|          // #505 -- THE ASSET COMES FROM THE CI (SI_CI_CL). Tier, CMDB values, tags and the asset risk factors
|          // (internet exposed, unsupported OS) are the CI's. The FINDINGS still come from the providers (Exposure
|          // Graph CVE edges + Defender vulnerability management) and are tied to their CI through _ciKey, the CI's
|          // link ids. DeviceKey is the Defender device id (EG EntityIds SenseDeviceId, DeviceTvm DeviceId), else
|          // the EG node id -- the same ids the CI links, so the hybrid path buckets both sides alike.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|
|          let _Assets =
|              ExposureGraphNodes
|              // v2.2.420 (audit #57.1b) -- HEDGED across property paths (NodeProperties is a payload bag, not a schema).
|              | where tostring(coalesce(NodeProperties.rawData.deviceCategory,
|                                        NodeProperties.raw.deviceCategory,
|                                        NodeProperties.deviceCategory)) == "Endpoint"
|              | extend EG_IsExcluded = tobool(coalesce(NodeProperties.rawData.isExcluded, NodeProperties.raw.isExcluded))
|              | where EG_IsExcluded == false
|              | extend _ids = tostring(EntityIds)
|              | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|              | project
|                  AssetNodeId = NodeId,
|                  AssetName   = NodeName,
|                  AssetLabel  = NodeLabel,
|                  MdeDeviceId,
|                  EG_IsExcluded
|              // v2.2.429 -- PARTITION THE EG WORK here (the identical bucket block below is the safety net).
|              | extend DeviceKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(AssetNodeId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              ;
|
|          // v2.2.212 -- 3-let architecture (materialize() of filtered edges + _RelevantFindingIds + separate _Findings).
|          let _AssetNodeIdSet = _Assets | distinct AssetNodeId;
|          let _OurAffectingEdges = materialize(
|              ExposureGraphEdges
|              | where EdgeLabel has "affecting"
|              | where TargetNodeId in (_AssetNodeIdSet)
|          );
|          let _RelevantFindingIds = _OurAffectingEdges | distinct SourceNodeId;
|          let _Findings =
|              ExposureGraphNodes
|              | where NodeLabel startswith "cve"
|              | where Categories has_any ("vulnerability_finding")
|              | where NodeId in (_RelevantFindingIds)
|              //__CVE_FILTER_BEGIN__
|              | where 1 == 1
|              //__CVE_FILTER_END__
|              | project FindingNodeId            = NodeId,
|                        FindingName              = NodeName,
|                        FindingLabel             = NodeLabel,
|                        FindingCategories        = Categories,
|                        FindingSeverity          = tostring(NodeProperties.rawData.severity),
|                        FindingCvssScore         = todouble(NodeProperties.rawData.cvssScore),
|                        FindingHasExploit        = tobool(NodeProperties.rawData.hasExploit),
|                        FindingIsExploitVerified = tobool(NodeProperties.rawData.isExploitVerified),
|                        FindingIsInExploitKit    = tobool(NodeProperties.rawData.isInExploitKit),
|                        FindingIsZeroDay         = tobool(NodeProperties.rawData.isZeroDay),
|                        CVELastModified          = todatetime(NodeProperties.rawData.lastModifiedDate),
|                        FindingDescription       = tostring(NodeProperties.rawData.description),
|                        FindingReferenceUrl      = tostring(coalesce(NodeProperties.rawData.referenceUrl, NodeProperties.rawData.url));
|
|          // v2.2.215 -- pre-collapse the multi-NodeId fanout at the edge level (one device, many EG node ids --
|          // they share the Defender device id, so they collapse onto one DeviceKey).
|          let _DeviceMap =
|              _Assets
|              | project AssetNodeId, DeviceKey, AssetName, AssetLabel, MdeDeviceId;
|
|          let _DeviceFindingEdges =
|              _OurAffectingEdges
|              | join kind=inner (_DeviceMap) on $left.TargetNodeId == $right.AssetNodeId
|              | summarize
|                  EdgeLabels  = make_set(EdgeLabel),
|                  AssetName   = any(AssetName),
|                  AssetLabel  = any(AssetLabel),
|                  MdeDeviceId = min(tostring(MdeDeviceId))
|                  by DeviceKey, SourceNodeId;
|
|          // #690 (28) -- when Defender vulnerability management holds the same device and CVE, ITS severity is the one shown (the MDE
|          // portal shows it), the graph's only where vulnerability management lacks the pair
|          let _TvmSeverityByPair =
|              DeviceTvmSoftwareVulnerabilities
|              | extend DeviceKey = tolower(tostring(DeviceId)), _cveKey = toupper(tostring(CveId))
|              | where DeviceKey in (_DeviceMap | distinct DeviceKey)
|              | summarize TvmPairSeverity = take_any(tostring(VulnerabilitySeverityLevel)) by DeviceKey, _cveKey;
|          let _AssetFindingEdges =
|              _DeviceFindingEdges
|              | join kind=inner (_Findings) on $left.SourceNodeId == $right.FindingNodeId
|              | extend _cveKey = toupper(tostring(FindingName))
|              | join kind=leftouter (_TvmSeverityByPair) on DeviceKey, _cveKey
|              | extend FindingSeverity = iff(isnotempty(TvmPairSeverity), TvmPairSeverity, FindingSeverity)
|              | project DeviceKey, AssetName, AssetLabel, MdeDeviceId, EdgeLabels,
|                        FindingName, FindingLabel, FindingCategories,
|                        FindingSeverity, FindingCvssScore,
|                        FindingHasExploit, FindingIsExploitVerified, FindingIsInExploitKit, FindingIsZeroDay,
|                        CVELastModified, FindingDescription, FindingReferenceUrl, _fromGraph = true;
|
|          // #150 -- EVERY CVE DEFENDER VULNERABILITY MANAGEMENT REPORTS, NOT ONLY THOSE THE GRAPH CARRIES.
|          // Vulnerability-management rows the graph lacks are ADDED, same columns, same DeviceKey, de-duplicated
|          // on device + CVE. #505 -- the pair key is the Defender device id, no longer a host name.
|          let _egCvePairs = _AssetFindingEdges
|              | distinct _pairKey = strcat(DeviceKey, "|", toupper(FindingName));
|          // #880 -- THE SLICE'S OWN DEVICES: vulnerability management is read for the devices of THIS slice only (the same key
|          // and hash as the slice filter on the union below), so a slice reads its own share of the table, not all of it before
|          // the joins. Without slices the block is a no-op and every device is kept -- the rows are the same either way.
|          let _sliceTvmDevices = DeviceTvmSoftwareVulnerabilities
|              | summarize by DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              | project DeviceKey;
|          let _TvmOnly = DeviceTvmSoftwareVulnerabilities
|              | where tolower(tostring(DeviceId)) in (_sliceTvmDevices)
|              | summarize DeviceName = any(DeviceName), TvmSeverity = any(VulnerabilitySeverityLevel) by DeviceId, CveId
|              | join kind=leftouter (union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime)[]), (DeviceInfo) | extend ExclusionReason = tostring(column_ifexists("ExclusionReason", "")) | summarize arg_max(Timestamp, ExclusionReason) by DeviceId) on DeviceId
|              // an MDE-excluded device is dropped from the graph rows (EG_IsExcluded) -- drop it here too
|              | where isempty(ExclusionReason)
|              | join kind=leftouter (DeviceTvmSoftwareVulnerabilitiesKB | project CveId, CvssScore, IsExploitAvailable, LastModifiedTime, PublishedDate, VulnerabilityDescription) on CveId
|              //__CVE_FILTER_TVM_BEGIN__
|              | where 1 == 1
|              //__CVE_FILTER_TVM_END__
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              | extend _pairKey = strcat(DeviceKey, "|", toupper(CveId))
|              | join kind=leftanti (_egCvePairs) on _pairKey
|              | project
|                  DeviceKey,
|                  AssetName                = tostring(DeviceName),
|                  AssetLabel               = "device",
|                  MdeDeviceId              = DeviceKey,
|                  EdgeLabels               = dynamic(["vulnerability management"]),
|                  FindingName              = tostring(CveId),
|                  FindingLabel             = "cve",
|                  FindingCategories        = dynamic(["vulnerability_finding"]),
|                  FindingSeverity          = tostring(TvmSeverity),
|                  FindingCvssScore         = todouble(CvssScore),
|                  FindingHasExploit        = tobool(IsExploitAvailable),
|                  FindingIsExploitVerified = false,
|                  FindingIsInExploitKit    = false,
|                  FindingIsZeroDay         = false,
|                  CVELastModified          = todatetime(LastModifiedTime),
|                  FindingDescription       = tostring(VulnerabilityDescription),
|                  FindingReferenceUrl      = strcat("https://nvd.nist.gov/vuln/detail/", tostring(CveId)),
|                  _fromGraph               = false;
|
|          // #666 -- the devices of the tenant exposed to each CVE, counted in advanced hunting (Defender vulnerability
|          // management, every device that is not excluded, the whole tenant and not only this slice). Each device once per CVE.
|          let _cveExposedDevices = DeviceTvmSoftwareVulnerabilities
|              | summarize by _expCve = toupper(tostring(CveId)), _expDevice = tolower(tostring(DeviceId))
|              | where isnotempty(_expCve) and isnotempty(_expDevice)
|              | join kind=leftanti (union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime)[]), (DeviceInfo)
|                  | extend ExclusionReason = tostring(column_ifexists("ExclusionReason", ""))
|                  | summarize arg_max(Timestamp, ExclusionReason) by DeviceId
|                  | where isnotempty(ExclusionReason)
|                  | project _expDevice = tolower(tostring(DeviceId))
|                  | where isnotempty(_expDevice)) on _expDevice
|              | summarize _expDevices = count() by _expCve
|              | where isnotempty(_expCve);
|
|          union _AssetFindingEdges, _TvmOnly
|              | where (SI_CveMinAgeDays == 0) or (isnull(CVELastModified)) or (CVELastModified < ago(SI_CveMinAgeDays * 1d))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // #505 -- the finding's CI, by the Defender device id or the EG node id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(AssetName)),     tostring(AssetName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  tostring(DeviceKey))
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, tostring(DeviceKey))
|              | extend AssetType = iif(isnotempty(tostring(si_class)), "Endpoint", tostring(AssetLabel))
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.endpoint.fields[].
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend Impact = FindingCvssScore
|              | extend SecuritySeverity = case(
|                  tolower(FindingSeverity) == "critical", "Very High",
|                  tolower(FindingSeverity) == "high",     "High",
|                  tolower(FindingSeverity) == "medium",   "Medium",
|                  tolower(FindingSeverity) == "low",      "Low",
|                  "Low")
|              | where not (FindingName in (SI_ExcludedCves))
|              | extend HasExploit        = FindingHasExploit
|              | extend IsExploitVerified = FindingIsExploitVerified
|              | extend IsInExploitKit    = FindingIsInExploitKit
|              | extend IsZeroDay         = FindingIsZeroDay
|              | extend CveUrl = iif(isempty(FindingReferenceUrl), strcat("https://nvd.nist.gov/vuln/detail/", FindingName), FindingReferenceUrl)
|              // the CVE's description from the Defender knowledge base when the graph node carries none
|              | extend _cveUpper = toupper(tostring(FindingName))
|              // and the CVE's own context from the same knowledge base -- when it was published, its EPSS score, its CVSS vector and
|              // whether Defender supports it (a column a tenant does not have yet reads as empty, never as an error)
|              | join kind=leftouter (DeviceTvmSoftwareVulnerabilitiesKB
|                  | extend _kbEpss = todouble(column_ifexists("EpssScore", real(null))), _kbVector = tostring(column_ifexists("CvssVector", "")), _kbSupport = tostring(column_ifexists("CveSupportability", ""))
|                  | project CveId = toupper(tostring(CveId)), _kbDescription = tostring(VulnerabilityDescription), _kbPublished = todatetime(PublishedDate), _kbEpss, _kbVector, _kbSupport) on $left._cveUpper == $right.CveId
|              | extend CVSSDesc = iff(isnotempty(tostring(FindingDescription)), tostring(FindingDescription), tostring(_kbDescription))
|              | extend si_reference_url = tostring(CveUrl), si_published = _kbPublished, si_epss = round(_kbEpss, 5), si_cvss_vector = _kbVector, si_cve_supportability = _kbSupport
|              // #666 -- the exposed devices of the CVE (counted above) and the graph's verified exploit and exploit kit. A row the
|              // graph does not carry leaves both unknown (empty), never false. A CVE no device is exposed to stays unknown too.
|              | join kind=leftouter (_cveExposedDevices) on $left._cveUpper == $right._expCve
|              | extend si_exposed_devices = toint(_expDevices),
|                       si_exploit_verified = iff(_fromGraph == true, FindingIsExploitVerified, bool(null)),
|                       si_in_exploit_kit = iff(_fromGraph == true, FindingIsInExploitKit, bool(null))
|              // #560 #561 the affected software of the device and CVE (Defender vulnerability management) -- the finding's product, vendor, version
|              // and fix, so the classification rows can tell a SQL Server CVE from an operating-system CVE on the same server
|              // the fix of the finding -- the security update Defender recommends and its id, the affected software as Name Version (Vendor)
|              | extend _swKey = strcat(tolower(tostring(MdeDeviceId)), "|", toupper(tostring(FindingName)))
|              | join kind=leftouter (DeviceTvmSoftwareVulnerabilities
|                  | where tolower(tostring(DeviceId)) in (_sliceTvmDevices)
|                  | extend _swKey = strcat(tolower(tostring(DeviceId)), "|", toupper(tostring(CveId)))
|                  | extend _swDisplay = strcat(trim(" ", strcat(tostring(SoftwareName), " ", tostring(SoftwareVersion))), iff(isempty(tostring(SoftwareVendor)), "", strcat(" (", tostring(SoftwareVendor), ")")))
|                  | extend _fixUpdate = tostring(RecommendedSecurityUpdate), _fixUpdateId = tostring(column_ifexists("RecommendedSecurityUpdateId", ""))
|                  | extend _cveTagText = strcat_array(todynamic(column_ifexists("CveTags", dynamic([]))), ";"), _cveMitigation = tostring(column_ifexists("CveMitigationStatus", ""))
|                  | extend _invKey = strcat(tolower(tostring(DeviceId)), "|", tolower(tostring(SoftwareVendor)), "|", tolower(tostring(SoftwareName)), "|", tostring(SoftwareVersion))
|                  | join kind=leftouter (DeviceTvmSoftwareInventory
|                      | where tolower(tostring(DeviceId)) in (_sliceTvmDevices)
|                      | extend _eosStatus = tostring(column_ifexists("EndOfSupportStatus", "")), _eosDate = todatetime(column_ifexists("EndOfSupportDate", datetime(null)))
|                      | where isnotempty(_eosStatus)
|                      | extend _invKey = iff(isempty(tostring(DeviceId)) or isempty(tostring(SoftwareName)), "", strcat(tolower(tostring(DeviceId)), "|", tolower(tostring(SoftwareVendor)), "|", tolower(tostring(SoftwareName)), "|", tostring(SoftwareVersion)))
|                      | where isnotempty(_invKey)
|                      | summarize _eosStatus = take_any(_eosStatus), _eosDate = min(_eosDate) by _invKey) on _invKey
|                  | join kind=leftouter (union isfuzzy=true (datatable(DeviceId:string)[]), (DeviceTvmSoftwareEvidenceBeta)
|                      | where tolower(tostring(DeviceId)) in (_sliceTvmDevices)
|                      | extend _invKey = iff(isempty(tostring(DeviceId)) or isempty(tostring(column_ifexists("SoftwareName", ""))), "", strcat(tolower(tostring(DeviceId)), "|", tolower(tostring(column_ifexists("SoftwareVendor", ""))), "|", tolower(tostring(column_ifexists("SoftwareName", ""))), "|", tostring(column_ifexists("SoftwareVersion", ""))))
|                      | where isnotempty(_invKey)
|                      | extend _evDisk = todynamic(column_ifexists("DiskPaths", dynamic([]))), _evRegistry = todynamic(column_ifexists("RegistryPaths", dynamic([])))
|                      | extend _evPaths = array_slice(array_concat(coalesce(_evDisk, dynamic([])), coalesce(_evRegistry, dynamic([]))), 0, 4)
|                      | where array_length(_evPaths) > 0
|                      | summarize _evPaths = take_any(_evPaths) by _invKey) on _invKey
|                  | extend _evPathText = strcat_array(coalesce(_evPaths, dynamic([])), ";")
|                  | summarize SI_AffectedVendorSet = make_set(tolower(tostring(SoftwareVendor)), 8), SI_AffectedProductSet = make_set(tolower(tostring(SoftwareName)), 8),
|                              SI_AffectedVersionSet = make_set(tostring(SoftwareVersion), 8), SI_FixReferenceSet = make_set(tostring(RecommendedSecurityUpdate), 8),
|                              _swDisplaySet = make_set_if(_swDisplay, isnotempty(trim(" ", _swDisplay)), 8),
|                              _fixUpdateSet = make_set_if(_fixUpdate, isnotempty(_fixUpdate), 8),
|                              _fixUpdateIdSet = make_set_if(_fixUpdateId, isnotempty(_fixUpdateId), 8),
|                              _cveTagSet = make_set_if(_cveTagText, isnotempty(_cveTagText), 8),
|                              _cveMitigationSet = make_set_if(_cveMitigation, isnotempty(_cveMitigation), 4),
|                              _eosStatusSet = make_set_if(_eosStatus, isnotempty(_eosStatus), 4),
|                              _eosDateMin = min(_eosDate),
|                              _evPathSet = make_set_if(_evPathText, isnotempty(_evPathText), 4) by _swKey) on _swKey
|              | extend SI_AffectedVendor = strcat_array(SI_AffectedVendorSet, ";"), SI_AffectedProduct = strcat_array(SI_AffectedProductSet, ";"),
|                       SI_AffectedVersion = strcat_array(SI_AffectedVersionSet, ";"), SI_FixReference = strcat_array(SI_FixReferenceSet, ";")
|              // the CVE as Defender tags it on this device (ZeroDay, NoSecurityUpdate), its mitigation status, whether the affected
|              // software is past or near its end of support, and where on the device the software was found (a few paths per finding)
|              | extend si_cve_tags = strcat_array(coalesce(_cveTagSet, dynamic([])), ";"),
|                       si_cve_mitigation_status = strcat_array(coalesce(_cveMitigationSet, dynamic([])), ";"),
|                       si_eos_status = strcat_array(coalesce(_eosStatusSet, dynamic([])), ";"),
|                       si_eos_date = _eosDateMin,
|                       si_affected_path = strcat_array(coalesce(_evPathSet, dynamic([])), ";")
|              | extend si_affected_software = strcat_array(coalesce(_swDisplaySet, dynamic([])), ";"),
|                       si_fix_recommended_update = strcat_array(coalesce(_fixUpdateSet, dynamic([])), ";"),
|                       si_fix_recommended_update_id = strcat_array(coalesce(_fixUpdateIdSet, dynamic([])), ";")
|              | extend si_fix_remediation = case(
|                  isnotempty(si_fix_recommended_update), strcat("Install the security update ", strcat_array(_fixUpdateSet, ", "), " on the device."),
|                  isnotempty(si_affected_software),      strcat("Update ", strcat_array(_swDisplaySet, ", "), " to a version that fixes ", FindingName, "."),
|                  strcat("Update the affected software to a version that fixes ", FindingName, "."))
|              // finding factors (exploit, RCE) -- the report evaluates them on the provider finding
|              | extend RF_P_ExploitSignals  = iff(HasExploit == true or IsExploitVerified == true or IsInExploitKit == true or IsZeroDay == true, 1, 0)
|              | extend RF_C_RemoteCodeExec  = iff(HasExploit == true or IsExploitVerified == true or IsInExploitKit == true, 1, 0)
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              | extend RiskFactor_Probability = RF_P_ExploitSignals + array_length(RF_P_CiFactors)
|              | extend RiskFactor_Consequence = RF_C_RemoteCodeExec
|              | extend RiskFactor_Consequence_Detailed = strcat_array(array_concat(
|                  iff(RF_C_RemoteCodeExec == 1, dynamic(["RemoteCodeExecutionRisk"]), dynamic([]))), ";")
|              | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|                  iff(RF_P_ExploitSignals  == 1, dynamic(["ExploitSignals"]),     dynamic([])),
|                  RF_P_CiFactorNames), ";")
|              | extend CriticalityTier = toint(si_tier)
|              // #643 NO tier filter of its own -- the report follows its declared scope (CriticalityTierLevelScope, the scope
|              // block's SI_ScopeTiers), so a Tier 3 device's CVEs are in it, ranked by their risk score. A device without a tier
|              // yet passes; the engine gives it the tier the rules give it, then applies the declared scope -- the same answer
|              // it gets once it has that tier. (A hidden Detailed-only default of tiers 0-2 dropped every Tier 3 CVE until 2026-10-13.)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain    = "Endpoint"
|              | extend ConfigurationName = "Update vulnerable software"
|              // ConfigurationId carries the per-row CVE id so (AssetName, ConfigurationId) is unique per row.
|              | extend ConfigurationId   = FindingName
|              | extend Category          = "Vulnerabilities"
|              | extend Subcategory       = "CVEs (Missing Updates)"
|              | project
|                  SecurityDomain, Category, Subcategory,
|                  ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Consequence_Detailed, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  HasExploit, IsExploitVerified, IsInExploitKit, IsZeroDay,
|                  CVELastModified, CVSSDesc,
|                  SI_AffectedVendor, SI_AffectedProduct, SI_AffectedVersion, SI_FixReference,
|                  si_affected_software, si_fix_recommended_update, si_fix_recommended_update_id, si_fix_remediation,
|                  MdeDeviceId = tostring(MdeDeviceId),
|                  si_reference_url, si_published, si_epss, si_cvss_vector, si_cve_supportability,
|                  si_cve_tags, si_cve_mitigation_status, si_eos_status, si_eos_date, si_affected_path,
|                  si_exposed_devices, si_exploit_verified, si_in_exploit_kit
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, Impact desc, AssetName asc, ConfigurationId asc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|          // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|          // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|          // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_description <- CVSSDesc, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation
|          // si si_fix_recommended_update <- si_fix_recommended_update, si_fix_recommended_update_id <- si_fix_recommended_update_id, si_affected_software <- si_affected_software, si_epss <- si_epss
|          // si si_cvss_vector <- si_cvss_vector, si_cve_supportability <- si_cve_supportability, si_cve_tags <- si_cve_tags, si_cve_mitigation_status <- si_cve_mitigation_status
|          // si si_eos_status <- si_eos_status, si_eos_date <- si_eos_date, si_affected_path <- si_affected_path, si_exploit_verified <- si_exploit_verified
|          // si si_in_exploit_kit <- si_in_exploit_kit, si_exposed_devices <- si_exposed_devices, si_fix_reference <- SI_FixReference, si_reference_url <- si_reference_url
|          // si si_published <- si_published, si_affected_product <- SI_AffectedProduct, si_affected_vendor <- SI_AffectedVendor, si_affected_version <- SI_AffectedVersion
|          // si si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_Recommendations_Summary
|      ReportPurpose: Non-compliant TVM secure configuration controls on endpoints, prioritised by criticality + exposure + legacy-OS.
|        Same CI pattern as Device_Missing_CVEs_Summary -- tier, tags, the asset risk factors and the CMDB values come from
|        the CI (SI_CI_CL, requirement 505), joined on the Defender device id.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Device_Recommendations_Summary
|          // Purpose  Non-compliant TVM secure configuration controls on endpoints, prioritised by criticality + exposure + legacy-OS.
|          // Output   One row per (Tier x Severity x ConfigurationId x cmdb*) bucket; lists carry impacted-asset detail.
|          //
|          // #505 -- THE ASSET COMES FROM THE CI (SI_CI_CL). Tier, CMDB values, tags and the asset risk factors
|          // (internet exposed, unsupported OS) are the CI's. The FINDINGS are the Defender secure-configuration
|          // assessments, tied to their CI through _ciKey by the Defender device id (DeviceId, lower-cased).
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          // Step 0c  Excluded ConfigurationIds -- block-marker substituted by engine from the per-report exclude.custom.json.
|
|          // Step 0e  Optional category/subcategory description lookups. Empty when key is missing.
|          let CategoryLookup = datatable(Category:string, CategoryDescription:string)
|          [
|            "Security controls", "Endpoint protection and attack-surface policies that block common malware and attacker techniques.",
|            "Network",           "Network security policies that limit attack surface and lateral movement.",
|            "BitLocker",         "Full-disk encryption to prevent data exposure on lost or stolen devices.",
|            "OS",                "Operating system baseline hardening and core protections.",
|            "Credentials",       "Controls that prevent credential theft and reuse.",
|            "Browser",           "Safe browsing and web threat protections.",
|            "Application",       "Application control and exploit protection to restrict unauthorized code execution.",
|            "Device",            "General endpoint configuration and health requirements.",
|            "Audit",             "Monitoring-focused baselines to validate configuration posture."
|          ];
|          let SubCategoryLookup = datatable(Subcategory:string, SubCategoryDescription:string)
|          [
|            "EDR",                        "Defender for Endpoint sensor presence and reporting health.",
|            "Attack Surface Reduction",   "Blocks common malware execution paths from email, web and Office content.",
|            "Firewall",                   "Enforces inbound/outbound traffic policy and host firewall state.",
|            "Antivirus",                  "Ensures Microsoft Defender Antivirus is active and properly configured.",
|            "BitLocker",                  "Enforces full-disk encryption and key escrow.",
|            "Exploit Guard",              "Hardens OS/apps against memory corruption and exploit chains.",
|            "Authentication",             "Strengthens sign-in security and protects credential boundaries.",
|            "Remote Access",              "Restricts remote shell/administrative entry points.",
|            "TLS/Communication",          "Requires secure protocols and prevents crypto downgrade.",
|            "Removable Storage",          "Controls external media to reduce malware risk and data exfiltration."
|          ];
|
|          let lookback       = 30d;
|          let onlyApplicable = true;
|
|          // Step 1  Latest DeviceInfo per device (DeviceName for the impacted-asset list).
|          let DeviceInfoLatest =
|              union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime, DeviceName:string, OSPlatform:string)[]), (DeviceInfo)
|              | where Timestamp >= ago(lookback)
|              | summarize arg_max(Timestamp, *) by DeviceId
|              | project
|                  DeviceId,
|                  DI_DeviceName  = DeviceName;
|
|          // Step 2  Load TVM secure configuration data and KB enrichment.
|          let TVM_Base =
|              DeviceTvmSecureConfigurationAssessment
|              | where Timestamp >= ago(lookback)
|              // #690 (12) the LATEST assessment of each device and setting decides -- taken before the applicable filter, so a
|              // setting whose newest assessment says it no longer applies is not reported from an older row
|              | summarize arg_max(Timestamp, *) by DeviceId, ConfigurationId
|              | where iff(onlyApplicable, IsApplicable == 1, true)
|              | where not (ConfigurationId in (SI_ExcludedConfigurationIds))
|              | join kind=leftouter (
|                  DeviceTvmSecureConfigurationAssessmentKB
|                  | project
|                      ConfigurationId,
|                      KB_ConfigurationName        = ConfigurationName,
|                      KB_ConfigurationCategory    = ConfigurationCategory,
|                      KB_ConfigurationSubcategory = ConfigurationSubcategory,
|                      KB_Impact                   = toint(ConfigurationImpact),
|                      KB_RiskDescription          = tostring(RiskDescription),
|                      KB_Description              = tostring(ConfigurationDescription),
|                      KB_Remediation              = tostring(RemediationOptions),
|                      KB_MitreTactics             = column_ifexists("RelatedMitreTactics", dynamic([])),
|                      KB_MitreTechniques          = column_ifexists("RelatedMitreTechniques", dynamic([])),
|                      KB_Tags                     = Tags,
|                      KB_Benchmarks               = ConfigurationBenchmarks
|                ) on ConfigurationId
|              | extend ImpactInt = toint(coalesce(KB_Impact, toint(ConfigurationImpact)))
|              | extend
|                  Category          = coalesce(KB_ConfigurationCategory, ConfigurationCategory),
|                  Subcategory       = coalesce(KB_ConfigurationSubcategory, tostring(column_ifexists("ConfigurationSubcategory", ""))),
|                  ConfigurationName = coalesce(KB_ConfigurationName, tostring(ConfigurationId)),
|                  IsCompliant       = tobool(IsCompliant),
|                  MITRE_Tactics     = strcat_array(KB_MitreTactics, ";"),
|                  MITRE_Techniques  = strcat_array(KB_MitreTechniques, ";"),
|                  ComplianceTags    = strcat_array(array_concat(coalesce(KB_Tags, dynamic([])), coalesce(KB_Benchmarks, dynamic([]))), ";")
|              | extend SecuritySeverity = case(
|                  ImpactInt == 10, "Very High",
|                  ImpactInt == 9,  "High",
|                  ImpactInt == 8,  "Medium-High",
|                  ImpactInt >= 5,  "Medium",
|                  "Low")
|              | summarize arg_max(Timestamp, *) by DeviceId, ConfigurationId
|              | where IsCompliant == false
|              | lookup CategoryLookup on Category
|              | lookup SubCategoryLookup on Subcategory
|              | extend
|                  CategoryDescription    = coalesce(CategoryDescription, ""),
|                  SubCategoryDescription = coalesce(SubCategoryDescription, "");
|
|          // Step 3  Join the TVM findings to DeviceInfo (name) and to their CI (by the Defender device id).
|          TVM_Base
|              | join kind=leftouter (DeviceInfoLatest) on DeviceId
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // #505 -- the finding's CI, by the Defender device id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(DI_DeviceName)), tostring(DI_DeviceName),
|                  isnotempty(tostring(DeviceName)),    tostring(DeviceName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  DeviceKey)
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.endpoint.fields[].
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100   // basis-100, 100 = 1.0x = no lift
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain = "Endpoint"
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              // the engine overrides RiskFactor_Consequence from the RiskFactor_Consequence_Detailed token count
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|              | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|              | summarize
|                  UniqueIssues              = dcount(ConfigurationId),
|                  ImpactedAssetsList        = make_set(AssetName),
|                  ImpactedAssetPairs        = make_set(strcat(AssetName, "|", AssetId)),
|                  ConfigurationDescription  = take_anyif(KB_Description, isnotempty(KB_Description)),
|                  RiskDescription           = take_anyif(KB_RiskDescription, isnotempty(KB_RiskDescription)),
|                  si_fix_remediation        = take_anyif(KB_Remediation, isnotempty(KB_Remediation)),
|                  RiskFactor_Consequence    = max(RiskFactor_Consequence),
|                  RiskScore_Weight_Factor   = max(RiskScore_Weight_Factor),
|                  RiskFactor_Weight         = max(RiskFactor_Weight),
|                  RiskScore_Weight_Detailed = any(RiskScore_Weight_Detailed),
|                  Impact                    = max(ImpactInt),
|                  arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|                  MdeDeviceId               = min(tostring(DeviceKey)),
|                  EntraAccountObjectId      = min(tostring("")),
|                  AzureResourceId           = min(tostring("")),
|                  AssetId                   = min(AssetId),
|                  MITRE_Tactics             = min(tostring(column_ifexists("MITRE_Tactics",""))),
|                  MITRE_Techniques          = min(tostring(column_ifexists("MITRE_Techniques",""))),
|                  ComplianceTags            = min(tostring(column_ifexists("ComplianceTags","")))
|                by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                   CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|                   cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|              // audit #25 -- the count is derived from the list that is actually DISPLAYED
|              | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|              | project
|                  SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetPairs, UniqueIssues,
|                  ConfigurationDescription, RiskDescription, si_fix_remediation
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, ImpactedAssetCount desc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|          // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|          // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|          // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_description <- ConfigurationDescription, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation
|          // si si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques, si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_Recommendations_Detailed
|      ReportPurpose: Per-row detail of non-compliant TVM secure configuration controls on endpoints, prioritised by criticality + exposure + legacy-OS.
|        Same CL-correlation pattern as Device_Recommendations_Summary; differs only in skipping the final summarize and emitting one row per (Asset x ConfigurationId) with full per-row context (RecommendedAction, RemediationOptions, Benchmarks, etc.).
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      # Low + Medium intentionally excluded from Detailed scope -- TVM configuration
|      # baselines are hygiene-heavy at Medium tier (CIS-style optional hardening) and
|      # produce 80K+ per-(Asset x ConfigurationId) rows on 13K-asset tenants. Summary
|      # variant aggregates the full distribution; LA still receives every row.
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - RecommendedAction
|      - RemediationOptions
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Device_Recommendations_Detailed
|          // Purpose  Per-row detail of non-compliant TVM secure configuration controls on endpoints, prioritised by criticality + exposure + legacy-OS.
|          // Output   One row per (Asset x ConfigurationId), with the per-row context (RecommendedAction, RemediationOptions, Benchmarks ...).
|          // Mirrors  Device_Recommendations_Summary.
|          //
|          // #505 -- THE ASSET COMES FROM THE CI (SI_CI_CL). Tier, CMDB values, tags and the asset risk factors
|          // (internet exposed, unsupported OS) are the CI's. The FINDINGS are the Defender secure-configuration
|          // assessments, tied to their CI through _ciKey by the Defender device id (DeviceId, lower-cased).
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          // Step 0c  Excluded ConfigurationIds -- block-marker substituted by engine from the per-report exclude.custom.json.
|
|          // Step 0e  Optional category/subcategory description lookups. Empty when key is missing.
|          let CategoryLookup = datatable(Category:string, CategoryDescription:string)
|          [
|            "Security controls", "Endpoint protection and attack-surface policies that block common malware and attacker techniques.",
|            "Network",           "Network security policies that limit attack surface and lateral movement.",
|            "BitLocker",         "Full-disk encryption to prevent data exposure on lost or stolen devices.",
|            "OS",                "Operating system baseline hardening and core protections.",
|            "Credentials",       "Controls that prevent credential theft and reuse.",
|            "Browser",           "Safe browsing and web threat protections.",
|            "Application",       "Application control and exploit protection to restrict unauthorized code execution.",
|            "Device",            "General endpoint configuration and health requirements.",
|            "Audit",             "Monitoring-focused baselines to validate configuration posture."
|          ];
|          let SubCategoryLookup = datatable(Subcategory:string, SubCategoryDescription:string)
|          [
|            "EDR",                        "Defender for Endpoint sensor presence and reporting health.",
|            "Attack Surface Reduction",   "Blocks common malware execution paths from email, web and Office content.",
|            "Firewall",                   "Enforces inbound/outbound traffic policy and host firewall state.",
|            "Antivirus",                  "Ensures Microsoft Defender Antivirus is active and properly configured.",
|            "BitLocker",                  "Enforces full-disk encryption and key escrow.",
|            "Exploit Guard",              "Hardens OS/apps against memory corruption and exploit chains.",
|            "Authentication",             "Strengthens sign-in security and protects credential boundaries.",
|            "Remote Access",              "Restricts remote shell/administrative entry points.",
|            "TLS/Communication",          "Requires secure protocols and prevents crypto downgrade.",
|            "Removable Storage",          "Controls external media to reduce malware risk and data exfiltration."
|          ];
|
|          let lookback       = 30d;
|          let onlyApplicable = true;
|
|          // Step 1  Latest DeviceInfo per device (DeviceName + OS for display).
|          let DeviceInfoLatest =
|              union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime, DeviceName:string, OSPlatform:string)[]), (DeviceInfo)
|              | where Timestamp >= ago(lookback)
|              | summarize arg_max(Timestamp, *) by DeviceId
|              | project
|                  DeviceId,
|                  DI_DeviceName  = DeviceName,
|                  DI_OSPlatform  = tostring(OSPlatform);
|
|          // Step 2  Load TVM secure configuration data and KB enrichment.
|          let TVM_Base =
|              DeviceTvmSecureConfigurationAssessment
|              | where Timestamp >= ago(lookback)
|              // #690 (12) the LATEST assessment of each device and setting decides -- taken before the applicable filter, so a
|              // setting whose newest assessment says it no longer applies is not reported from an older row
|              | summarize arg_max(Timestamp, *) by DeviceId, ConfigurationId
|              | where iff(onlyApplicable, IsApplicable == 1, true)
|              | where not (ConfigurationId in (SI_ExcludedConfigurationIds))
|              | join kind=leftouter (
|                  DeviceTvmSecureConfigurationAssessmentKB
|                  | project
|                      ConfigurationId,
|                      KB_ConfigurationName        = ConfigurationName,
|                      KB_ConfigurationCategory    = ConfigurationCategory,
|                      KB_ConfigurationSubcategory = ConfigurationSubcategory,
|                      KB_Impact                   = toint(ConfigurationImpact),
|                      KB_RiskDescription          = tostring(RiskDescription),
|                      KB_Description              = tostring(ConfigurationDescription),
|                      KB_Remediation              = tostring(RemediationOptions),
|                      KB_Benchmarks               = ConfigurationBenchmarks,
|                      KB_MitreTactics             = column_ifexists("RelatedMitreTactics", dynamic([])),
|                      KB_MitreTechniques          = column_ifexists("RelatedMitreTechniques", dynamic([])),
|                      KB_Tags                     = Tags
|                ) on ConfigurationId
|              | extend ImpactInt = toint(coalesce(KB_Impact, toint(ConfigurationImpact)))
|              | extend
|                  Category          = coalesce(KB_ConfigurationCategory, ConfigurationCategory),
|                  Subcategory       = coalesce(KB_ConfigurationSubcategory, tostring(column_ifexists("ConfigurationSubcategory", ""))),
|                  ConfigurationName = coalesce(KB_ConfigurationName, tostring(ConfigurationId)),
|                  IsCompliant       = tobool(IsCompliant),
|                  IsApplicable      = tobool(IsApplicable),
|                  MITRE_Tactics     = strcat_array(KB_MitreTactics, ";"),
|                  MITRE_Techniques  = strcat_array(KB_MitreTechniques, ";"),
|                  ComplianceTags    = strcat_array(array_concat(coalesce(KB_Tags, dynamic([])), coalesce(KB_Benchmarks, dynamic([]))), ";")
|              | extend
|                  RecommendedAction = case(
|                      ImpactInt >= 9, "Fix immediately - Security Change Queue / Intune / GPO rollout",
|                      ImpactInt == 8, "Schedule within quarterly hardening cycle",
|                      ImpactInt >= 5 and ImpactInt < 8, "Fix opportunistically (during upgrades / refresh)",
|                      "Monitor, document as baseline exceptions"),
|                  SecuritySeverity = case(
|                      ImpactInt == 10, "Very High",
|                      ImpactInt == 9,  "High",
|                      ImpactInt == 8,  "Medium-High",
|                      ImpactInt >= 5,  "Medium",
|                      "Low"),
|                  SecuritySeverityDescription = case(
|                      ImpactInt == 10, "If this configuration is not applied, attackers gain a major foothold or common attack vector remains wide open.",
|                      ImpactInt == 9,  "Strongly recommended to fix ASAP; commonly exploited by real-world malware and ransomware.",
|                      ImpactInt == 8,  "Important baseline security hardening; reduces attack surface and lateral movement.",
|                      ImpactInt >= 5,  "Security best practice; helps reduce exposure but less frequently exploited.",
|                      "Hardening / hygiene controls; helps, but attackers less likely to target.")
|              | summarize arg_max(Timestamp, *) by DeviceId, ConfigurationId
|              | where IsCompliant == false
|              | lookup CategoryLookup on Category
|              | lookup SubCategoryLookup on Subcategory
|              | extend
|                  CategoryDescription    = coalesce(CategoryDescription, ""),
|                  SubCategoryDescription = coalesce(SubCategoryDescription, "");
|
|          // Step 3  Join the TVM findings to DeviceInfo (name, OS) and to their CI (by the Defender device id).
|          TVM_Base
|              | join kind=leftouter (DeviceInfoLatest) on DeviceId
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // #505 -- the finding's CI, by the Defender device id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(DI_DeviceName)), tostring(DI_DeviceName),
|                  isnotempty(tostring(DeviceName)),    tostring(DeviceName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  DeviceKey)
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|              | extend AssetType = "Endpoint"
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.endpoint.fields[].
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100   // basis-100, 100 = 1.0x = no lift
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain = "Endpoint"
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              // the engine overrides RiskFactor_Consequence from the RiskFactor_Consequence_Detailed token count
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|              | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|              // what Defender found on the device for this setting (the offending value) and whether applying the fix is
|              // expected to affect users -- columns a tenant does not have read as empty
|              | extend _siContext = tostring(column_ifexists("Context", "")), _siImpactFlag = tobool(column_ifexists("IsExpectedUserImpact", bool(null)))
|              | extend _siEvidence = iff(_siContext in ("", "[]", "[[]]", "null"), "", substring(_siContext, 0, 4000)),
|                       _siUserImpact = case(_siImpactFlag == true, "User impact expected", _siImpactFlag == false, "No user impact expected", "")
|              | project
|                  SecurityDomain, Category, Subcategory,
|                  ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  Impact = ImpactInt, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  OSPlatform = coalesce(DI_OSPlatform, OSPlatform),
|                  IsCompliant, IsApplicable,
|                  RecommendedAction,
|                  RiskDescription          = KB_RiskDescription,
|                  ConfigurationDescription = KB_Description,
|                  RemediationOptions       = KB_Remediation,
|                  si_fix_remediation       = KB_Remediation,
|                  Benchmarks               = KB_Benchmarks,
|                  CategoryDescription, SubCategoryDescription,
|                  SecuritySeverityDescription,
|                  MdeDeviceId              = DeviceKey,
|                  MITRE_Tactics, MITRE_Techniques, ComplianceTags,
|                  si_evidence              = _siEvidence,
|                  si_user_impact           = _siUserImpact
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, Impact desc, AssetName asc, ConfigurationId asc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|          // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|          // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|          // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RecommendedAction, RemediationOptions, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_description <- ConfigurationDescription, si_remediation <- RemediationOptions, si_fix_remediation <- RemediationOptions
|          // si si_evidence <- si_evidence, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|          // si si_user_impact <- si_user_impact, si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_EndOfSupport_Software_Summary
|      ReportPurpose: >-
|        Software on endpoints that is past or near its end of support (Defender vulnerability management), prioritised by asset criticality and exposure. The asset (tier, tags, risk factors, CMDB values) comes from the CI, joined on the Defender device id. One row per finding with the impacted devices listed.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Device_EndOfSupport_Software_Summary
|          // Purpose  Endpoints with software that has reached or is nearing its end of support, from Defender vulnerability management, on the CI of the device.
|          // The asset comes from the CI (SI_CI_CL), the findings from Defender advanced hunting, tied through the Defender device id.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          let _src =
|              DeviceTvmSoftwareInventory
|              | extend _eosStatus = tostring(column_ifexists("EndOfSupportStatus", "")), _eosDate = todatetime(column_ifexists("EndOfSupportDate", datetime(null))), _cpe = tostring(column_ifexists("ProductCodeCpe", ""))
|              | where isnotempty(_eosStatus) and _eosStatus !~ "None"
|              | extend SoftwareVendor = tostring(SoftwareVendor), SoftwareName = tostring(SoftwareName), SoftwareVersion = tostring(SoftwareVersion)
|              // #690 (13) the inventory's own device name -- the name shown when DeviceInfo has no row for the device
|              | summarize _eosStatus = take_any(_eosStatus), _eosDate = min(_eosDate), _cpe = take_anyif(_cpe, isnotempty(_cpe)), _invDeviceName = take_anyif(tostring(DeviceName), isnotempty(tostring(DeviceName))) by DeviceId, SoftwareVendor, SoftwareName, SoftwareVersion
|              | extend _ended = (isnotnull(_eosDate) and _eosDate <= now()) or (isnull(_eosDate) and _eosStatus startswith "EOS")
|              | extend _days = iff(isnull(_eosDate), int(null), toint(datetime_diff("day", _eosDate, now())))
|              | extend ImpactInt = case(_ended, 9, isnotnull(_days) and _days <= 90, 8, 5)
|              | extend Category = "Vulnerabilities", Subcategory = "End of support software"
|              | extend _swShort = trim(" ", strcat(SoftwareName, " ", SoftwareVersion))
|              | extend ConfigurationName = strcat(iff(_ended, "Software past its end of support - ", "Software nearing its end of support - "), _swShort)
|              | extend ConfigurationId = tolower(strcat("eos:", SoftwareVendor, ":", SoftwareName, ":", SoftwareVersion))
|              | extend si_affected_software = strcat(_swShort, iff(isempty(SoftwareVendor), "", strcat(" (", SoftwareVendor, ")"))),
|                       SI_AffectedVendor = tolower(SoftwareVendor), SI_AffectedProduct = tolower(SoftwareName), SI_AffectedVersion = SoftwareVersion,
|                       si_affected_cpe = coalesce(_cpe, ""), si_eos_status = _eosStatus, si_eos_date = _eosDate,
|                       si_certificate_expiry = datetime(null), si_certificate_thumbprint = "",
|                       si_evidence = strcat(_eosStatus, iff(isnull(_eosDate), "", strcat(", support ends ", format_datetime(_eosDate, "yyyy-MM-dd")))),
|                       si_fix_remediation = strcat("Upgrade ", SoftwareName, " to a version the vendor still supports, or remove it from the device.");
|
|          // the newest device row -- its name and operating system for display, and whether Defender excludes the device
|          let DeviceInfoLatest =
|              union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime, DeviceName:string, OSPlatform:string)[]), (DeviceInfo)
|              | where Timestamp >= ago(30d)
|              | extend DI_Excluded = tostring(column_ifexists("ExclusionReason", ""))
|              | summarize arg_max(Timestamp, *) by DeviceId
|              | project DeviceId, DI_DeviceName = DeviceName, DI_OSPlatform = tostring(OSPlatform), DI_Excluded;
|
|          _src
|              | extend DeviceId = tostring(DeviceId)
|              | join kind=leftouter (DeviceInfoLatest) on DeviceId
|              // a device Defender excludes is not reported
|              | where isempty(DI_Excluded)
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // the finding's CI, by the Defender device id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(DI_DeviceName)), tostring(DI_DeviceName),
|                  isnotempty(tostring(_invDeviceName)), tostring(_invDeviceName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  DeviceKey)
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|              | extend AssetType = "Endpoint"
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend SecuritySeverity = case(
|                  ImpactInt >= 10, "Very High",
|                  ImpactInt == 9,  "High",
|                  ImpactInt == 8,  "Medium-High",
|                  ImpactInt >= 5,  "Medium",
|                  "Low")
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain = "Endpoint"
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              // the engine overrides RiskFactor_Consequence from the RiskFactor_Consequence_Detailed token count
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|              | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|              | summarize
|                  UniqueIssues              = dcount(ConfigurationId),
|                  ImpactedAssetsList        = make_set(AssetName),
|                  ImpactedAssetPairs        = make_set(strcat(AssetName, "|", AssetId)),
|                  si_fix_remediation        = take_anyif(si_fix_remediation, isnotempty(si_fix_remediation)),
|                  si_evidence               = take_anyif(si_evidence, isnotempty(si_evidence)),
|                  si_affected_software      = take_anyif(si_affected_software, isnotempty(si_affected_software)),
|                  si_eos_status             = take_anyif(si_eos_status, isnotempty(si_eos_status)),
|                  si_eos_date               = min(si_eos_date),
|                  si_certificate_expiry     = min(si_certificate_expiry),
|                  RiskFactor_Consequence    = max(RiskFactor_Consequence),
|                  RiskScore_Weight_Factor   = max(RiskScore_Weight_Factor),
|                  RiskFactor_Weight         = max(RiskFactor_Weight),
|                  RiskScore_Weight_Detailed = any(RiskScore_Weight_Detailed),
|                  Impact                    = max(ImpactInt),
|                  arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|                  MdeDeviceId               = min(tostring(DeviceKey)),
|                  EntraAccountObjectId      = min(tostring("")),
|                  AzureResourceId           = min(tostring("")),
|                  AssetId                   = min(AssetId)
|                by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                   CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|                   cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|              | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|              | project
|                  SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetPairs, UniqueIssues,
|                  si_fix_remediation, si_evidence, si_affected_software, si_eos_status, si_eos_date, si_certificate_expiry
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, ImpactedAssetCount desc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|          // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|          // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|          // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_affected_software <- si_affected_software
|          // si si_eos_status <- si_eos_status, si_eos_date <- si_eos_date, si_evidence <- si_evidence, si_certificate_expiry <- si_certificate_expiry
|          // si si_certificate_thumbprint <- si_certificate_thumbprint, si_affected_product <- SI_AffectedProduct, si_affected_vendor <- SI_AffectedVendor, si_affected_version <- SI_AffectedVersion
|          // si si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_EndOfSupport_Software_Detailed
|      ReportPurpose: >-
|        Software on endpoints that is past or near its end of support (Defender vulnerability management), prioritised by asset criticality and exposure. The asset (tier, tags, risk factors, CMDB values) comes from the CI, joined on the Defender device id. One row per device and finding.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Device_EndOfSupport_Software_Detailed
|          // Purpose  Endpoints with software that has reached or is nearing its end of support, from Defender vulnerability management, on the CI of the device.
|          // The asset comes from the CI (SI_CI_CL), the findings from Defender advanced hunting, tied through the Defender device id.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          let _src =
|              DeviceTvmSoftwareInventory
|              | extend _eosStatus = tostring(column_ifexists("EndOfSupportStatus", "")), _eosDate = todatetime(column_ifexists("EndOfSupportDate", datetime(null))), _cpe = tostring(column_ifexists("ProductCodeCpe", ""))
|              | where isnotempty(_eosStatus) and _eosStatus !~ "None"
|              | extend SoftwareVendor = tostring(SoftwareVendor), SoftwareName = tostring(SoftwareName), SoftwareVersion = tostring(SoftwareVersion)
|              // #690 (13) the inventory's own device name -- the name shown when DeviceInfo has no row for the device
|              | summarize _eosStatus = take_any(_eosStatus), _eosDate = min(_eosDate), _cpe = take_anyif(_cpe, isnotempty(_cpe)), _invDeviceName = take_anyif(tostring(DeviceName), isnotempty(tostring(DeviceName))) by DeviceId, SoftwareVendor, SoftwareName, SoftwareVersion
|              | extend _ended = (isnotnull(_eosDate) and _eosDate <= now()) or (isnull(_eosDate) and _eosStatus startswith "EOS")
|              | extend _days = iff(isnull(_eosDate), int(null), toint(datetime_diff("day", _eosDate, now())))
|              | extend ImpactInt = case(_ended, 9, isnotnull(_days) and _days <= 90, 8, 5)
|              | extend Category = "Vulnerabilities", Subcategory = "End of support software"
|              | extend _swShort = trim(" ", strcat(SoftwareName, " ", SoftwareVersion))
|              | extend ConfigurationName = strcat(iff(_ended, "Software past its end of support - ", "Software nearing its end of support - "), _swShort)
|              | extend ConfigurationId = tolower(strcat("eos:", SoftwareVendor, ":", SoftwareName, ":", SoftwareVersion))
|              | extend si_affected_software = strcat(_swShort, iff(isempty(SoftwareVendor), "", strcat(" (", SoftwareVendor, ")"))),
|                       SI_AffectedVendor = tolower(SoftwareVendor), SI_AffectedProduct = tolower(SoftwareName), SI_AffectedVersion = SoftwareVersion,
|                       si_affected_cpe = coalesce(_cpe, ""), si_eos_status = _eosStatus, si_eos_date = _eosDate,
|                       si_certificate_expiry = datetime(null), si_certificate_thumbprint = "",
|                       si_evidence = strcat(_eosStatus, iff(isnull(_eosDate), "", strcat(", support ends ", format_datetime(_eosDate, "yyyy-MM-dd")))),
|                       si_fix_remediation = strcat("Upgrade ", SoftwareName, " to a version the vendor still supports, or remove it from the device.");
|
|          // the newest device row -- its name and operating system for display, and whether Defender excludes the device
|          let DeviceInfoLatest =
|              union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime, DeviceName:string, OSPlatform:string)[]), (DeviceInfo)
|              | where Timestamp >= ago(30d)
|              | extend DI_Excluded = tostring(column_ifexists("ExclusionReason", ""))
|              | summarize arg_max(Timestamp, *) by DeviceId
|              | project DeviceId, DI_DeviceName = DeviceName, DI_OSPlatform = tostring(OSPlatform), DI_Excluded;
|
|          _src
|              | extend DeviceId = tostring(DeviceId)
|              | join kind=leftouter (DeviceInfoLatest) on DeviceId
|              // a device Defender excludes is not reported
|              | where isempty(DI_Excluded)
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // the finding's CI, by the Defender device id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(DI_DeviceName)), tostring(DI_DeviceName),
|                  isnotempty(tostring(_invDeviceName)), tostring(_invDeviceName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  DeviceKey)
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|              | extend AssetType = "Endpoint"
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend SecuritySeverity = case(
|                  ImpactInt >= 10, "Very High",
|                  ImpactInt == 9,  "High",
|                  ImpactInt == 8,  "Medium-High",
|                  ImpactInt >= 5,  "Medium",
|                  "Low")
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain = "Endpoint"
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              // the engine overrides RiskFactor_Consequence from the RiskFactor_Consequence_Detailed token count
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|              | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|              | project
|                  SecurityDomain, Category, Subcategory,
|                  ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  Impact = ImpactInt, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  OSPlatform = DI_OSPlatform,
|                  MdeDeviceId = DeviceKey,
|                  si_evidence, si_fix_remediation, si_affected_software,
|                  SI_AffectedVendor, SI_AffectedProduct, SI_AffectedVersion, si_affected_cpe,
|                  si_eos_status, si_eos_date, si_certificate_expiry, si_certificate_thumbprint
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, Impact desc, AssetName asc, ConfigurationId asc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|          // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|          // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|          // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_affected_software <- si_affected_software
|          // si si_eos_status <- si_eos_status, si_eos_date <- si_eos_date, si_evidence <- si_evidence, si_certificate_expiry <- si_certificate_expiry
|          // si si_certificate_thumbprint <- si_certificate_thumbprint, si_affected_product <- SI_AffectedProduct, si_affected_vendor <- SI_AffectedVendor, si_affected_version <- SI_AffectedVersion
|          // si si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_Certificates_Summary
|      ReportPurpose: >-
|        Certificates on endpoints that expire within 30 days, expired in the last 30 days, or use a weak key or signature (Defender vulnerability management certificate inventory), one finding per device and kind of problem with the certificates listed. Needs the Defender Vulnerability Management add-on; without it the report is empty. One row per finding with the impacted devices listed.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Device_Certificates_Summary
|          // Purpose  Endpoints with expiring, recently expired and weak certificates, from Defender vulnerability management, on the CI of the device.
|          // The asset comes from the CI (SI_CI_CL), the findings from Defender advanced hunting, tied through the Defender device id.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          let _src =
|              union isfuzzy=true (datatable(DeviceId:string)[]), (DeviceTvmCertificateInfo)
|              | extend _thumb = tostring(column_ifexists("Thumbprint", "")), _exp = todatetime(column_ifexists("ExpirationDate", datetime(null))), _alg = tolower(tostring(column_ifexists("SignatureAlgorithm", ""))),
|                       _key = toint(column_ifexists("KeySize", int(null))), _friendly = tostring(column_ifexists("FriendlyName", "")), _to = todynamic(column_ifexists("IssuedTo", dynamic(null))),
|                       _by = todynamic(column_ifexists("IssuedBy", dynamic(null)))
|              | where isnotempty(_thumb)
|              | summarize _exp = max(_exp), _alg = take_any(_alg), _key = max(_key), _friendly = take_any(_friendly), _to = take_any(_to), _by = take_any(_by) by DeviceId, _thumb
|              | extend _valid = isnull(_exp) or _exp >= now()
|              // #690 (29) -- Defender writes the algorithm as ONE token (sha1rsa, md5rsa, sha1dsa) and has matches whole terms only, so
|              // the test reads the token's start (the hash) and its end (the key type). A DSA key is weak below 2048 bits as an RSA key
|              // is -- an ECDSA key is not measured in the same bits and is left to the signature test.
|              | extend _weakAlg = _valid and (_alg startswith "sha1" or _alg startswith "md5" or _alg startswith "md2" or _alg startswith "md4"),
|                       _weakKey = _valid and (_alg endswith "rsa" or (_alg endswith "dsa" and not(_alg endswith "ecdsa"))) and isnotnull(_key) and _key > 0 and _key < 2048,
|                       _expiring = isnotnull(_exp) and _exp >= now() and _exp < now() + 30d,
|                       _expired = isnotnull(_exp) and _exp < now() and _exp > now() - 30d
|              | where _weakAlg or _weakKey or _expiring or _expired
|              // every problem a certificate has is its own finding (a weak certificate that also expires is listed under both)
|              | extend _kinds = array_concat(iff(_expiring, dynamic(["expiring"]), dynamic([])), iff(_expired, dynamic(["expired"]), dynamic([])),
|                                             iff(_weakAlg, dynamic(["weak-signature"]), dynamic([])), iff(_weakKey, dynamic(["weak-key"]), dynamic([])))
|              | mv-expand _kind = _kinds to typeof(string)
|              // every weak certificate is listed, a self-signed root (issued to itself) is labelled (owner 2026-10-15 "List all, label roots")
|              | extend _root = isnotempty(tostring(_to)) and tostring(_to) == tostring(_by)
|              | extend _subject = case(isnotempty(tostring(_to.CommonName)), tostring(_to.CommonName), isnotempty(tostring(_to.commonName)), tostring(_to.commonName), isnotempty(_friendly), _friendly, _thumb)
|              | extend _item = strcat(_subject, " [", _thumb, "]", iff(_root, " (self-signed root)", ""), iff(isnull(_exp), "", strcat(" expires ", format_datetime(_exp, "yyyy-MM-dd"))))
|              | summarize _n = count(), _nRoot = countif(_root), _soonest = min(_exp), _itemsOther = make_set_if(_item, not(_root), 10), _itemsRoot = make_set_if(_item, _root, 10), _firstThumb = take_any(_thumb) by DeviceId, _kind
|              | extend _items = array_concat(_itemsOther, _itemsRoot)
|              | extend _daysLeft = iff(isnull(_soonest), int(null), toint(datetime_diff("day", _soonest, now())))
|              | extend ImpactInt = case(_kind == "weak-signature", 8, _kind == "weak-key", 8, _kind == "expiring" and _daysLeft <= 7, 8, 5)
|              | extend Category = "Security controls", Subcategory = "Certificates"
|              | extend ConfigurationName = case(
|                  _kind == "expiring",       "Certificates that expire within 30 days",
|                  _kind == "expired",        "Certificates that expired in the last 30 days",
|                  _kind == "weak-signature", "Certificates signed with a weak algorithm (SHA-1, MD5 or MD2)",
|                  "Certificates with an RSA or DSA key shorter than 2048 bits")
|              | extend ConfigurationId = strcat("certificate:", _kind)
|              | extend si_affected_software = "", SI_AffectedVendor = "", SI_AffectedProduct = "", SI_AffectedVersion = "", si_affected_cpe = "",
|                       si_eos_status = "", si_eos_date = datetime(null),
|                       si_certificate_expiry = _soonest, si_certificate_thumbprint = iff(_n == 1, _firstThumb, ""),
|                       si_evidence = strcat(tostring(_n), " certificate(s)", iff(_nRoot > 0, strcat(", ", tostring(_nRoot), " of them self-signed root(s)"), ""), " - ", strcat_array(_items, " / "), iff(_n > array_length(_items), " ...", "")),
|                       si_fix_remediation = case(
|                          _kind == "expiring", "Renew the listed certificates before they expire and install the new ones on the device.",
|                          _kind == "expired",  "Replace the listed certificates with valid ones, or remove them when nothing uses them any more.",
|                          strcat("Reissue the listed certificates with SHA-256 or stronger and an RSA or DSA key of at least 2048 bits, then remove the old ones.",
|                                 iff(_nRoot > 0, " A self-signed root is trusted because it is in the store, not by its own signature -- remove an old root when nothing relies on it.", "")));
|
|          // the newest device row -- its name and operating system for display, and whether Defender excludes the device
|          let DeviceInfoLatest =
|              union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime, DeviceName:string, OSPlatform:string)[]), (DeviceInfo)
|              | where Timestamp >= ago(30d)
|              | extend DI_Excluded = tostring(column_ifexists("ExclusionReason", ""))
|              | summarize arg_max(Timestamp, *) by DeviceId
|              | project DeviceId, DI_DeviceName = DeviceName, DI_OSPlatform = tostring(OSPlatform), DI_Excluded;
|
|          _src
|              | extend DeviceId = tostring(DeviceId)
|              | join kind=leftouter (DeviceInfoLatest) on DeviceId
|              // a device Defender excludes is not reported
|              | where isempty(DI_Excluded)
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // the finding's CI, by the Defender device id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(DI_DeviceName)), tostring(DI_DeviceName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  DeviceKey)
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|              | extend AssetType = "Endpoint"
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend SecuritySeverity = case(
|                  ImpactInt >= 10, "Very High",
|                  ImpactInt == 9,  "High",
|                  ImpactInt == 8,  "Medium-High",
|                  ImpactInt >= 5,  "Medium",
|                  "Low")
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain = "Endpoint"
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              // the engine overrides RiskFactor_Consequence from the RiskFactor_Consequence_Detailed token count
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|              | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|              | summarize
|                  UniqueIssues              = dcount(ConfigurationId),
|                  ImpactedAssetsList        = make_set(AssetName),
|                  ImpactedAssetPairs        = make_set(strcat(AssetName, "|", AssetId)),
|                  si_fix_remediation        = take_anyif(si_fix_remediation, isnotempty(si_fix_remediation)),
|                  si_evidence               = take_anyif(si_evidence, isnotempty(si_evidence)),
|                  si_affected_software      = take_anyif(si_affected_software, isnotempty(si_affected_software)),
|                  si_eos_status             = take_anyif(si_eos_status, isnotempty(si_eos_status)),
|                  si_eos_date               = min(si_eos_date),
|                  si_certificate_expiry     = min(si_certificate_expiry),
|                  RiskFactor_Consequence    = max(RiskFactor_Consequence),
|                  RiskScore_Weight_Factor   = max(RiskScore_Weight_Factor),
|                  RiskFactor_Weight         = max(RiskFactor_Weight),
|                  RiskScore_Weight_Detailed = any(RiskScore_Weight_Detailed),
|                  Impact                    = max(ImpactInt),
|                  arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|                  MdeDeviceId               = min(tostring(DeviceKey)),
|                  EntraAccountObjectId      = min(tostring("")),
|                  AzureResourceId           = min(tostring("")),
|                  AssetId                   = min(AssetId)
|                by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                   CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|                   cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|              | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|              | project
|                  SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetPairs, UniqueIssues,
|                  si_fix_remediation, si_evidence, si_affected_software, si_eos_status, si_eos_date, si_certificate_expiry
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, ImpactedAssetCount desc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|          // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|          // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|          // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_affected_software <- si_affected_software
|          // si si_eos_status <- si_eos_status, si_eos_date <- si_eos_date, si_evidence <- si_evidence, si_certificate_expiry <- si_certificate_expiry
|          // si si_certificate_thumbprint <- si_certificate_thumbprint, si_affected_product <- SI_AffectedProduct, si_affected_vendor <- SI_AffectedVendor, si_affected_version <- SI_AffectedVersion
|          // si si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_Certificates_Detailed
|      ReportPurpose: >-
|        Certificates on endpoints that expire within 30 days, expired in the last 30 days, or use a weak key or signature (Defender vulnerability management certificate inventory), one finding per device and kind of problem with the certificates listed. Needs the Defender Vulnerability Management add-on; without it the report is empty. One row per device and finding.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Device_Certificates_Detailed
|          // Purpose  Endpoints with expiring, recently expired and weak certificates, from Defender vulnerability management, on the CI of the device.
|          // The asset comes from the CI (SI_CI_CL), the findings from Defender advanced hunting, tied through the Defender device id.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          let _src =
|              union isfuzzy=true (datatable(DeviceId:string)[]), (DeviceTvmCertificateInfo)
|              | extend _thumb = tostring(column_ifexists("Thumbprint", "")), _exp = todatetime(column_ifexists("ExpirationDate", datetime(null))), _alg = tolower(tostring(column_ifexists("SignatureAlgorithm", ""))),
|                       _key = toint(column_ifexists("KeySize", int(null))), _friendly = tostring(column_ifexists("FriendlyName", "")), _to = todynamic(column_ifexists("IssuedTo", dynamic(null))),
|                       _by = todynamic(column_ifexists("IssuedBy", dynamic(null)))
|              | where isnotempty(_thumb)
|              | summarize _exp = max(_exp), _alg = take_any(_alg), _key = max(_key), _friendly = take_any(_friendly), _to = take_any(_to), _by = take_any(_by) by DeviceId, _thumb
|              | extend _valid = isnull(_exp) or _exp >= now()
|              // #690 (29) -- Defender writes the algorithm as ONE token (sha1rsa, md5rsa, sha1dsa) and has matches whole terms only, so
|              // the test reads the token's start (the hash) and its end (the key type). A DSA key is weak below 2048 bits as an RSA key
|              // is -- an ECDSA key is not measured in the same bits and is left to the signature test.
|              | extend _weakAlg = _valid and (_alg startswith "sha1" or _alg startswith "md5" or _alg startswith "md2" or _alg startswith "md4"),
|                       _weakKey = _valid and (_alg endswith "rsa" or (_alg endswith "dsa" and not(_alg endswith "ecdsa"))) and isnotnull(_key) and _key > 0 and _key < 2048,
|                       _expiring = isnotnull(_exp) and _exp >= now() and _exp < now() + 30d,
|                       _expired = isnotnull(_exp) and _exp < now() and _exp > now() - 30d
|              | where _weakAlg or _weakKey or _expiring or _expired
|              // every problem a certificate has is its own finding (a weak certificate that also expires is listed under both)
|              | extend _kinds = array_concat(iff(_expiring, dynamic(["expiring"]), dynamic([])), iff(_expired, dynamic(["expired"]), dynamic([])),
|                                             iff(_weakAlg, dynamic(["weak-signature"]), dynamic([])), iff(_weakKey, dynamic(["weak-key"]), dynamic([])))
|              | mv-expand _kind = _kinds to typeof(string)
|              // every weak certificate is listed, a self-signed root (issued to itself) is labelled (owner 2026-10-15 "List all, label roots")
|              | extend _root = isnotempty(tostring(_to)) and tostring(_to) == tostring(_by)
|              | extend _subject = case(isnotempty(tostring(_to.CommonName)), tostring(_to.CommonName), isnotempty(tostring(_to.commonName)), tostring(_to.commonName), isnotempty(_friendly), _friendly, _thumb)
|              | extend _item = strcat(_subject, " [", _thumb, "]", iff(_root, " (self-signed root)", ""), iff(isnull(_exp), "", strcat(" expires ", format_datetime(_exp, "yyyy-MM-dd"))))
|              | summarize _n = count(), _nRoot = countif(_root), _soonest = min(_exp), _itemsOther = make_set_if(_item, not(_root), 10), _itemsRoot = make_set_if(_item, _root, 10), _firstThumb = take_any(_thumb) by DeviceId, _kind
|              | extend _items = array_concat(_itemsOther, _itemsRoot)
|              | extend _daysLeft = iff(isnull(_soonest), int(null), toint(datetime_diff("day", _soonest, now())))
|              | extend ImpactInt = case(_kind == "weak-signature", 8, _kind == "weak-key", 8, _kind == "expiring" and _daysLeft <= 7, 8, 5)
|              | extend Category = "Security controls", Subcategory = "Certificates"
|              | extend ConfigurationName = case(
|                  _kind == "expiring",       "Certificates that expire within 30 days",
|                  _kind == "expired",        "Certificates that expired in the last 30 days",
|                  _kind == "weak-signature", "Certificates signed with a weak algorithm (SHA-1, MD5 or MD2)",
|                  "Certificates with an RSA or DSA key shorter than 2048 bits")
|              | extend ConfigurationId = strcat("certificate:", _kind)
|              | extend si_affected_software = "", SI_AffectedVendor = "", SI_AffectedProduct = "", SI_AffectedVersion = "", si_affected_cpe = "",
|                       si_eos_status = "", si_eos_date = datetime(null),
|                       si_certificate_expiry = _soonest, si_certificate_thumbprint = iff(_n == 1, _firstThumb, ""),
|                       si_evidence = strcat(tostring(_n), " certificate(s)", iff(_nRoot > 0, strcat(", ", tostring(_nRoot), " of them self-signed root(s)"), ""), " - ", strcat_array(_items, " / "), iff(_n > array_length(_items), " ...", "")),
|                       si_fix_remediation = case(
|                          _kind == "expiring", "Renew the listed certificates before they expire and install the new ones on the device.",
|                          _kind == "expired",  "Replace the listed certificates with valid ones, or remove them when nothing uses them any more.",
|                          strcat("Reissue the listed certificates with SHA-256 or stronger and an RSA or DSA key of at least 2048 bits, then remove the old ones.",
|                                 iff(_nRoot > 0, " A self-signed root is trusted because it is in the store, not by its own signature -- remove an old root when nothing relies on it.", "")));
|
|          // the newest device row -- its name and operating system for display, and whether Defender excludes the device
|          let DeviceInfoLatest =
|              union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime, DeviceName:string, OSPlatform:string)[]), (DeviceInfo)
|              | where Timestamp >= ago(30d)
|              | extend DI_Excluded = tostring(column_ifexists("ExclusionReason", ""))
|              | summarize arg_max(Timestamp, *) by DeviceId
|              | project DeviceId, DI_DeviceName = DeviceName, DI_OSPlatform = tostring(OSPlatform), DI_Excluded;
|
|          _src
|              | extend DeviceId = tostring(DeviceId)
|              | join kind=leftouter (DeviceInfoLatest) on DeviceId
|              // a device Defender excludes is not reported
|              | where isempty(DI_Excluded)
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // the finding's CI, by the Defender device id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(DI_DeviceName)), tostring(DI_DeviceName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  DeviceKey)
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|              | extend AssetType = "Endpoint"
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend SecuritySeverity = case(
|                  ImpactInt >= 10, "Very High",
|                  ImpactInt == 9,  "High",
|                  ImpactInt == 8,  "Medium-High",
|                  ImpactInt >= 5,  "Medium",
|                  "Low")
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain = "Endpoint"
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              // the engine overrides RiskFactor_Consequence from the RiskFactor_Consequence_Detailed token count
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|              | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|              | project
|                  SecurityDomain, Category, Subcategory,
|                  ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  Impact = ImpactInt, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  OSPlatform = DI_OSPlatform,
|                  MdeDeviceId = DeviceKey,
|                  si_evidence, si_fix_remediation, si_affected_software,
|                  SI_AffectedVendor, SI_AffectedProduct, SI_AffectedVersion, si_affected_cpe,
|                  si_eos_status, si_eos_date, si_certificate_expiry, si_certificate_thumbprint
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, Impact desc, AssetName asc, ConfigurationId asc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|          // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|          // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|          // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_affected_software <- si_affected_software
|          // si si_eos_status <- si_eos_status, si_eos_date <- si_eos_date, si_evidence <- si_evidence, si_certificate_expiry <- si_certificate_expiry
|          // si si_certificate_thumbprint <- si_certificate_thumbprint, si_affected_product <- SI_AffectedProduct, si_affected_vendor <- SI_AffectedVendor, si_affected_version <- SI_AffectedVersion
|          // si si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_BrowserExtensions_Summary
|      ReportPurpose: >-
|        Browser extensions on endpoints that Defender vulnerability management rates High or Critical risk because of the permissions they hold, one finding per device and extension. Needs the Defender Vulnerability Management add-on; without it the report is empty. One row per finding with the impacted devices listed.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Device_BrowserExtensions_Summary
|          // Purpose  Endpoints with high-risk browser extensions, from Defender vulnerability management, on the CI of the device.
|          // The asset comes from the CI (SI_CI_CL), the findings from Defender advanced hunting, tied through the Defender device id.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          let _src =
|              union isfuzzy=true (datatable(DeviceId:string)[]), (DeviceTvmBrowserExtensions)
|              | extend _risk = tostring(column_ifexists("ExtensionRisk", "")), _extId = tostring(column_ifexists("ExtensionId", "")), _extName = tostring(column_ifexists("ExtensionName", "")),
|                       _extVer = tostring(column_ifexists("ExtensionVersion", "")), _extVendor = tostring(column_ifexists("ExtensionVendor", "")), _browser = tostring(column_ifexists("BrowserName", "")),
|                       _on = tobool(column_ifexists("IsActivated", bool(null)))
|              | where _risk in~ ("Critical", "High") and isnotempty(_extId)
|              | summarize _risk = take_any(_risk), _extName = take_any(_extName), _extVer = max(_extVer), _extVendor = take_any(_extVendor), _browsers = make_set(_browser, 6), _on = max(toint(_on)) by DeviceId, _extId
|              | extend _extName = iff(isempty(_extName), _extId, _extName)
|              | extend ImpactInt = case(_on == 0, 5, _risk =~ "Critical", 9, 8)
|              | extend Category = "Browser", Subcategory = "Browser extensions"
|              | extend ConfigurationName = strcat("High-risk browser extension - ", _extName)
|              | extend ConfigurationId = strcat("browser-extension:", tolower(_extId))
|              | extend si_affected_software = strcat(trim(" ", strcat(_extName, " ", _extVer)), iff(isempty(_extVendor), "", strcat(" (", _extVendor, ")"))),
|                       SI_AffectedVendor = tolower(_extVendor), SI_AffectedProduct = tolower(_extName), SI_AffectedVersion = _extVer, si_affected_cpe = "",
|                       si_eos_status = "", si_eos_date = datetime(null), si_certificate_expiry = datetime(null), si_certificate_thumbprint = "",
|                       si_evidence = strcat("Risk ", _risk, " in ", strcat_array(_browsers, ", "), case(isnull(_on), "", _on == 0, " (installed, not turned on)", " (turned on)")),
|                       si_fix_remediation = strcat("Remove the extension ", _extName, " from the browser on the device, or block it by browser policy, unless the business needs it and accepts the permissions it holds.");
|
|          // the newest device row -- its name and operating system for display, and whether Defender excludes the device
|          let DeviceInfoLatest =
|              union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime, DeviceName:string, OSPlatform:string)[]), (DeviceInfo)
|              | where Timestamp >= ago(30d)
|              | extend DI_Excluded = tostring(column_ifexists("ExclusionReason", ""))
|              | summarize arg_max(Timestamp, *) by DeviceId
|              | project DeviceId, DI_DeviceName = DeviceName, DI_OSPlatform = tostring(OSPlatform), DI_Excluded;
|
|          _src
|              | extend DeviceId = tostring(DeviceId)
|              | join kind=leftouter (DeviceInfoLatest) on DeviceId
|              // a device Defender excludes is not reported
|              | where isempty(DI_Excluded)
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // the finding's CI, by the Defender device id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(DI_DeviceName)), tostring(DI_DeviceName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  DeviceKey)
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|              | extend AssetType = "Endpoint"
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend SecuritySeverity = case(
|                  ImpactInt >= 10, "Very High",
|                  ImpactInt == 9,  "High",
|                  ImpactInt == 8,  "Medium-High",
|                  ImpactInt >= 5,  "Medium",
|                  "Low")
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain = "Endpoint"
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              // the engine overrides RiskFactor_Consequence from the RiskFactor_Consequence_Detailed token count
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|              | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|              | summarize
|                  UniqueIssues              = dcount(ConfigurationId),
|                  ImpactedAssetsList        = make_set(AssetName),
|                  ImpactedAssetPairs        = make_set(strcat(AssetName, "|", AssetId)),
|                  si_fix_remediation        = take_anyif(si_fix_remediation, isnotempty(si_fix_remediation)),
|                  si_evidence               = take_anyif(si_evidence, isnotempty(si_evidence)),
|                  si_affected_software      = take_anyif(si_affected_software, isnotempty(si_affected_software)),
|                  si_eos_status             = take_anyif(si_eos_status, isnotempty(si_eos_status)),
|                  si_eos_date               = min(si_eos_date),
|                  si_certificate_expiry     = min(si_certificate_expiry),
|                  RiskFactor_Consequence    = max(RiskFactor_Consequence),
|                  RiskScore_Weight_Factor   = max(RiskScore_Weight_Factor),
|                  RiskFactor_Weight         = max(RiskFactor_Weight),
|                  RiskScore_Weight_Detailed = any(RiskScore_Weight_Detailed),
|                  Impact                    = max(ImpactInt),
|                  arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|                  MdeDeviceId               = min(tostring(DeviceKey)),
|                  EntraAccountObjectId      = min(tostring("")),
|                  AzureResourceId           = min(tostring("")),
|                  AssetId                   = min(AssetId)
|                by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                   CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|                   cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|              | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|              | project
|                  SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetPairs, UniqueIssues,
|                  si_fix_remediation, si_evidence, si_affected_software, si_eos_status, si_eos_date, si_certificate_expiry
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, ImpactedAssetCount desc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|          // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|          // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|          // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_affected_software <- si_affected_software
|          // si si_eos_status <- si_eos_status, si_eos_date <- si_eos_date, si_evidence <- si_evidence, si_certificate_expiry <- si_certificate_expiry
|          // si si_certificate_thumbprint <- si_certificate_thumbprint, si_affected_product <- SI_AffectedProduct, si_affected_vendor <- SI_AffectedVendor, si_affected_version <- SI_AffectedVersion
|          // si si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Device_BrowserExtensions_Detailed
|      ReportPurpose: >-
|        Browser extensions on endpoints that Defender vulnerability management rates High or Critical risk because of the permissions they hold, one finding per device and extension. Needs the Defender Vulnerability Management add-on; without it the report is empty. One row per device and finding.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Device_BrowserExtensions_Detailed
|          // Purpose  Endpoints with high-risk browser extensions, from Defender vulnerability management, on the CI of the device.
|          // The asset comes from the CI (SI_CI_CL), the findings from Defender advanced hunting, tied through the Defender device id.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          let _src =
|              union isfuzzy=true (datatable(DeviceId:string)[]), (DeviceTvmBrowserExtensions)
|              | extend _risk = tostring(column_ifexists("ExtensionRisk", "")), _extId = tostring(column_ifexists("ExtensionId", "")), _extName = tostring(column_ifexists("ExtensionName", "")),
|                       _extVer = tostring(column_ifexists("ExtensionVersion", "")), _extVendor = tostring(column_ifexists("ExtensionVendor", "")), _browser = tostring(column_ifexists("BrowserName", "")),
|                       _on = tobool(column_ifexists("IsActivated", bool(null)))
|              | where _risk in~ ("Critical", "High") and isnotempty(_extId)
|              | summarize _risk = take_any(_risk), _extName = take_any(_extName), _extVer = max(_extVer), _extVendor = take_any(_extVendor), _browsers = make_set(_browser, 6), _on = max(toint(_on)) by DeviceId, _extId
|              | extend _extName = iff(isempty(_extName), _extId, _extName)
|              | extend ImpactInt = case(_on == 0, 5, _risk =~ "Critical", 9, 8)
|              | extend Category = "Browser", Subcategory = "Browser extensions"
|              | extend ConfigurationName = strcat("High-risk browser extension - ", _extName)
|              | extend ConfigurationId = strcat("browser-extension:", tolower(_extId))
|              | extend si_affected_software = strcat(trim(" ", strcat(_extName, " ", _extVer)), iff(isempty(_extVendor), "", strcat(" (", _extVendor, ")"))),
|                       SI_AffectedVendor = tolower(_extVendor), SI_AffectedProduct = tolower(_extName), SI_AffectedVersion = _extVer, si_affected_cpe = "",
|                       si_eos_status = "", si_eos_date = datetime(null), si_certificate_expiry = datetime(null), si_certificate_thumbprint = "",
|                       si_evidence = strcat("Risk ", _risk, " in ", strcat_array(_browsers, ", "), case(isnull(_on), "", _on == 0, " (installed, not turned on)", " (turned on)")),
|                       si_fix_remediation = strcat("Remove the extension ", _extName, " from the browser on the device, or block it by browser policy, unless the business needs it and accepts the permissions it holds.");
|
|          // the newest device row -- its name and operating system for display, and whether Defender excludes the device
|          let DeviceInfoLatest =
|              union isfuzzy=true (datatable(DeviceId:string, Timestamp:datetime, DeviceName:string, OSPlatform:string)[]), (DeviceInfo)
|              | where Timestamp >= ago(30d)
|              | extend DI_Excluded = tostring(column_ifexists("ExclusionReason", ""))
|              | summarize arg_max(Timestamp, *) by DeviceId
|              | project DeviceId, DI_DeviceName = DeviceName, DI_OSPlatform = tostring(OSPlatform), DI_Excluded;
|
|          _src
|              | extend DeviceId = tostring(DeviceId)
|              | join kind=leftouter (DeviceInfoLatest) on DeviceId
|              // a device Defender excludes is not reported
|              | where isempty(DI_Excluded)
|              | extend DeviceKey = tolower(tostring(DeviceId))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              // the finding's CI, by the Defender device id it carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend AssetName = case(
|                  isnotempty(tostring(DI_DeviceName)), tostring(DI_DeviceName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  DeviceKey)
|              | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|              | extend AssetType = "Endpoint"
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend SecuritySeverity = case(
|                  ImpactInt >= 10, "Very High",
|                  ImpactInt == 9,  "High",
|                  ImpactInt == 8,  "Medium-High",
|                  ImpactInt >= 5,  "Medium",
|                  "Low")
|              | extend CriticalityTier = toint(si_tier)
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain = "Endpoint"
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              // the engine overrides RiskFactor_Consequence from the RiskFactor_Consequence_Detailed token count
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|              | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|              | project
|                  SecurityDomain, Category, Subcategory,
|                  ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  Impact = ImpactInt, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  OSPlatform = DI_OSPlatform,
|                  MdeDeviceId = DeviceKey,
|                  si_evidence, si_fix_remediation, si_affected_software,
|                  SI_AffectedVendor, SI_AffectedProduct, SI_AffectedVersion, si_affected_cpe,
|                  si_eos_status, si_eos_date, si_certificate_expiry, si_certificate_thumbprint
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, Impact desc, AssetName asc, ConfigurationId asc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|          // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|          // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|          // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_affected_software <- si_affected_software
|          // si si_eos_status <- si_eos_status, si_eos_date <- si_eos_date, si_evidence <- si_evidence, si_certificate_expiry <- si_certificate_expiry
|          // si si_certificate_thumbprint <- si_certificate_thumbprint, si_affected_product <- SI_AffectedProduct, si_affected_vendor <- SI_AffectedVendor, si_affected_version <- SI_AffectedVersion
|          // si si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Azure_Recommendations_Summary
|      LookupNeededKeys:
|      - Lookup: _dfcPairs
|        Column: _dfcKey
|        Keys: |-
|          | extend _dfcKey = strcat("h", tostring(hash(strcat(tolower(tostring(AssetName)), "|", tolower(tostring(FindingName))))))
|          | extend _dfcIdKey = iff(isnotempty(AssetArmId), strcat("h", tostring(hash(strcat(AssetArmId, "|", tolower(tostring(FindingName)))))), "-")
|          | extend _egRecArm = tolower(tostring(EdgePropsAny.rawData.recommendationAzureResourceId))
|          | extend _dfcAkKey = iff(_egRecArm matches regex @"/providers/microsoft\.security/assessments/[^/]+$", strcat("h", tostring(hash(strcat(extract(@"^(.*)/providers/microsoft\.security/assessments/[^/]+$", 1, _egRecArm), "|", extract(@"/assessments/([^/]+)$", 1, _egRecArm))))), "-")
|          | project __siNeeded = pack_array(_dfcKey, _dfcIdKey, _dfcAkKey)
|      ReportPurpose: Azure ExposureGraph recommendations prioritised by criticality + Internet-Exposed + risk factors.
|        Same CI pattern as Device_Missing_CVEs_Summary -- tier, tags and the CMDB values come from
|        the CI (SI_CI_CL, requirement 505), joined on the lower-cased ARM id (_ciKey).
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - Recommendation
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Azure_Recommendations_Summary
|          // Purpose  Azure ExposureGraph recommendations prioritised by criticality + Internet-Exposed + edge risk factors.
|          // Output   One row per (Tier x Severity x ConfigurationName x cmdb*) bucket; lists carry impacted-asset detail.
|          //
|          // #505 -- THE ASSET COMES FROM THE CI (SI_CI_CL). Tier, CMDB values, tags and the internet-exposed factor are the
|          // CI's. The FINDINGS still come from the Exposure Graph (recommendation edges) and are tied to their CI through
|          // _ciKey. DeviceKey is the lower-cased ARM resource id the graph node carries (EntityIds), for a subscription or
|          // resource-group node the ARM id of that scope, else the Defender device id, else the node id -- the same ids the
|          // CI links, so the hybrid path buckets both sides alike.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("cloud_resource", "device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          // #192 a subscription-level recommendation takes the subscription's most critical CI.
|          // #675 read on its own, once per run, never from the sliced _ciLink -- a query slice holds only its share of the
|          // subscription's CIs, so the minimum over that share could be a less critical tier than the subscription has.
|          //__SI_CI_SUBTIER_BEGIN__
|              let _subTierG =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("cloud_resource", "device")
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where _ciKey startswith "/subscriptions/"
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | extend _sub = tostring(split(_ciKey, "/")[2])
|                  | where isnotempty(_sub)
|                  | summarize Tier_BySub = min(toint(column_ifexists("si_tier", int(null)))) by _sub;
|          //__SI_CI_SUBTIER_END__
|
|          // Step 0c  Excluded ConfigurationIds -- block-marker substituted by engine from the per-report exclude.custom.json.
|          // Items are matched against the recommendation FindingName (e.g. "Storage account public access disabled").
|
|          // #147 -- (resource, recommendation) pairs the Defender recommendation reports already carry. The graph
|          // report drops ONLY those, so a recommendation is reported once; everything the graph knows beyond
|          // Defender (e.g. per-setting machine baselines) stays. Latest snapshot only; a missing or empty table
|          // removes nothing. The final project stays OUTSIDE the union -- the engine pre-fetches this binding and
|          // reads that last project for the column list of an empty result.
|          // #278 the engine empties this block when the Defender recommendation report of the same grain is NOT in
|          // the run -- handing findings to a report that does not run puts them in no report at all.
|          //__DEFENDER_HANDOFF_BEGIN__
|          // The pairs are compared as strcat("h", hash(text)) on both sides -- the lookup is inlined into every bucket of the
|          // Advanced Hunting request (1 MB cap). The "h" keeps the inlined column a string (an all-digit column is inlined as long).
|          let _dfcPairs = union isfuzzy=true
|              (datatable(_dfcKey:string)[]),
|              (SI_AzureRecommendation_CL
|                  | where TimeGenerated > ago(8d)
|                  // #200 the ARM id pair too -- the graph names a VM by the machine, Defender by its Azure name.
|                  // #349 and the (resource, assessment key) pair -- the graph edge names the Defender assessment it came from.
|                  | extend _akL = tolower(tostring(column_ifexists("AssessmentKey", "")))
|                  | summarize _keys = make_set(strcat("h", tostring(hash(strcat(tolower(tostring(ResourceName)), "|", tolower(tostring(Recommendation))))))),
|                              _ids = make_set_if(strcat("h", tostring(hash(strcat(tolower(tostring(ResourceIdLower)), "|", tolower(tostring(Recommendation)))))), isnotempty(ResourceIdLower)),
|                              _aks = make_set_if(strcat("h", tostring(hash(strcat(tolower(tostring(ResourceIdLower)), "|", _akL)))), isnotempty(ResourceIdLower) and isnotempty(_akL)) by CollectionTime
|                  | top 1 by CollectionTime desc
|                  | extend _keys = array_concat(_keys, _ids, _aks)
|                  | mv-expand _dfcKey = _keys to typeof(string))
|              | project _dfcKey;
|          //__DEFENDER_HANDOFF_END__
|
|          // #349 -- Defender's own severity and security issue per assessment key, for a recommendation whose node
|          // the graph has lost (see _AssetFindingEdges_orphan). Latest snapshot per key. A missing table leaves it empty.
|          // This is a lookup, not a hand-off, so it stays outside the hand-off block above.
|          let _dfcRecByKey = union isfuzzy=true
|              (datatable(_akKey:string, _akSeverity:string, _akIssue:string)[]),
|              (SI_AzureRecommendation_CL
|                  | where TimeGenerated > ago(8d)
|                  | extend _akKey = tolower(tostring(column_ifexists("AssessmentKey", "")))
|                  | where isnotempty(_akKey) and isnotempty(tostring(Severity))
|                  | summarize arg_max(CollectionTime, Severity, SecurityIssue) by _akKey
|                  | project _akKey, _akSeverity = tostring(Severity), _akIssue = tostring(SecurityIssue))
|              | project _akKey, _akSeverity, _akIssue;
|
|          let _Assets =
|              ExposureGraphNodes
|              // v2.2.417 -- NodeLabel is the durable identifier (environmentName stopped discriminating on 2026-08-10).
|              | where NodeLabel startswith "microsoft." or NodeLabel in ("subscriptions", "resourcegroups")
|              | extend EG_IsCustomerFacing = tobool(coalesce(NodeProperties.rawData.isCustomerFacing, NodeProperties.raw.isCustomerFacing))
|              | extend EG_IsExcluded       = tobool(coalesce(NodeProperties.rawData.isExcluded,       NodeProperties.raw.isExcluded))
|              | where isnull(EG_IsExcluded) or EG_IsExcluded == false
|              | extend _ids = tostring(EntityIds)
|              | extend _armId = tolower(coalesce(extract(@'"type"\s*:\s*"AzureResourceId"\s*,\s*"id"\s*:\s*"([^"]+)"', 1, _ids), extract(@'"id"\s*:\s*"([^"]+)"\s*,\s*"type"\s*:\s*"AzureResourceId"', 1, _ids)))
|              | extend _senseId = tolower(coalesce(extract(@'"type"\s*:\s*"SenseDeviceId"\s*,\s*"id"\s*:\s*"([^"]+)"', 1, _ids), extract(@'"id"\s*:\s*"([^"]+)"\s*,\s*"type"\s*:\s*"SenseDeviceId"', 1, _ids)))
|              // #78 -- a subscription or resource-group node carries its scope in rawData.hierarchyIdentifier (the subscription
|              // guid on both kinds), so the scope's ARM id is built from it, switched on NodeLabel.
|              | extend _egHierarchyId = tolower(tostring(NodeProperties.rawData.hierarchyIdentifier))
|              | extend _scopeArmId = case(
|                    NodeLabel == "subscriptions"  and isnotempty(_egHierarchyId), strcat("/subscriptions/", _egHierarchyId),
|                    NodeLabel == "resourcegroups" and isnotempty(_egHierarchyId), strcat("/subscriptions/", _egHierarchyId, "/resourcegroups/", tolower(tostring(NodeName))),
|                    "")
|              | extend AssetArmId = iff(isnotempty(_armId), _armId, _scopeArmId)
|              | extend DeviceKey = case(isnotempty(AssetArmId), AssetArmId, isnotempty(_senseId), _senseId, tolower(NodeId))
|              | project
|                  AssetNodeId = NodeId,
|                  AssetName   = NodeName,
|                  AssetLabel  = NodeLabel,
|                  AssetArmId,
|                  DeviceKey,
|                  EG_IsCustomerFacing,
|                  EG_IsExcluded;
|
|          let _Findings =
|              ExposureGraphNodes
|              | mv-expand Category = Categories
|              | where tostring(Category) contains "finding"
|              | where NodeLabel !contains "cve"
|              | project FindingNodeId = NodeId, FindingName = NodeName, FindingLabel = NodeLabel,
|                        FindingCategories = Categories, FindingProps = NodeProperties;
|
|          let _Edges =
|              ExposureGraphEdges
|              | where EdgeLabel has "affecting"
|              | extend EdgeProps = column_ifexists("EdgeProperties", dynamic({}))
|              | project SourceNodeId, TargetNodeId, EdgeLabel, EdgeProps;
|
|          let _AssetFindingEdges_oneway =
|              _Edges
|              | join kind=inner (_Assets)   on $left.SourceNodeId == $right.AssetNodeId
|              | join kind=inner (_Findings) on $left.TargetNodeId == $right.FindingNodeId
|              | project AssetNodeId, AssetName, AssetLabel, AssetArmId, DeviceKey, EG_IsCustomerFacing, EG_IsExcluded,
|                        FindingName, FindingLabel, FindingCategories, FindingProps,
|                        EdgeLabel, EdgeProps;
|
|          let _AssetFindingEdges_otherway =
|              _Edges
|              | join kind=inner (_Assets)   on $left.TargetNodeId == $right.AssetNodeId
|              | join kind=inner (_Findings) on $left.SourceNodeId == $right.FindingNodeId
|              | project AssetNodeId, AssetName, AssetLabel, AssetArmId, DeviceKey, EG_IsCustomerFacing, EG_IsExcluded,
|                        FindingName, FindingLabel, FindingCategories, FindingProps,
|                        EdgeLabel, EdgeProps;
|
|          // #349 -- A RECOMMENDATION EDGE WHOSE RECOMMENDATION NODE IS MISSING. The graph keeps "affecting" edges after
|          // the recommendation's own node has gone from ExposureGraphNodes, and absence is not remediation, so the row is
|          // rebuilt from the edge itself. The edge carries the recommendation's name, label and categories (SourceNode*) and
|          // the Defender assessment it came from. Severity and security issue come from Defender by that key (_dfcRecByKey),
|          // and only where Defender has no row for it from the risk level the graph puts on the edge. A dangling edge whose
|          // ASSET node is missing has nothing to report on and stays out.
|          let _AssetFindingEdges_orphan =
|              ExposureGraphEdges
|              | where EdgeLabel has "affecting"
|              | where tostring(SourceNodeCategories) contains "finding" and SourceNodeLabel !contains "cve"
|              | join kind=leftanti (ExposureGraphNodes | project NodeId) on $left.SourceNodeId == $right.NodeId
|              | extend EdgeProps = column_ifexists("EdgeProperties", dynamic({}))
|              | extend _akKey = tolower(extract(@"/assessments/([^/]+)$", 1, tostring(EdgeProps.rawData.recommendationAzureResourceId)))
|              | join kind=leftouter (_dfcRecByKey) on _akKey
|              | extend _akSeverity = iff(isnotempty(_akSeverity), _akSeverity, tostring(EdgeProps.rawData.risk.riskLevel))
|              | join kind=inner (_Assets) on $left.TargetNodeId == $right.AssetNodeId
|              | project AssetNodeId, AssetName, AssetLabel, AssetArmId, DeviceKey, EG_IsCustomerFacing, EG_IsExcluded,
|                        FindingName = SourceNodeName, FindingLabel = SourceNodeLabel, FindingCategories = SourceNodeCategories,
|                        FindingProps = bag_pack("rawData", bag_pack("severity", _akSeverity, "securityIssue", bag_pack("securityIssue", _akIssue), "assessmentKey", _akKey)),
|                        EdgeLabel, EdgeProps;
|
|          let _AssetFindingEdges = union _AssetFindingEdges_oneway, _AssetFindingEdges_otherway, _AssetFindingEdges_orphan;
|
|          _AssetFindingEdges
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              | where not (FindingName in (SI_ExcludedConfigurationIds)) and not (trim(@"\s+", tostring(FindingName)) in (SI_ExcludedConfigurationIds))
|              | summarize
|                  AssetArmId            = any(AssetArmId),
|                  DeviceKey             = any(DeviceKey),
|                  EdgeLabels            = make_set(EdgeLabel),
|                  EdgePropsAny          = any(EdgeProps),
|                  FindingLabel          = any(FindingLabel),
|                  FindingCategories     = any(FindingCategories),
|                  FindingProps          = any(FindingProps),
|                  EG_IsCustomerFacing   = any(EG_IsCustomerFacing),
|                  EG_IsExcluded         = any(EG_IsExcluded)
|                by AssetNodeId, AssetName, AssetLabel, FindingName
|              // The hand-off lookup _dfcPairs has no per-asset key. When it is too large to travel whole in every slice, the
|              // engine asks the graph, per slice, which pair keys the rows at this point can have and inlines only those pairs
|              // (the report field LookupNeededKeys). Everything below this line is unchanged by that.
|              //__SI_LOOKUP_KEYS_HERE__
|              // #505 -- the finding's CI, by the ARM id / Defender device id / node id the graph node carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend _dfcKey = strcat("h", tostring(hash(strcat(tolower(tostring(AssetName)), "|", tolower(tostring(FindingName))))))
|              // #673 the three anti-joins below sit between markers the engine can take out (SI_RA_DefenderFilterInEngine)
|              // -- it then removes the same rows itself against the Defender list held in SQL, and the query returns the three keys.
|              // Pasted as it is, the query still de-duplicates on its own.
|              //__SI_DFC_ANTIJOIN_BEGIN__
|              | join kind=leftanti (_dfcPairs) on _dfcKey
|              | project-away _dfcKey
|              //__SI_DFC_ANTIJOIN_END__
|              | extend AssetName = case(
|                  isnotempty(tostring(AssetName)),     tostring(AssetName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  tostring(DeviceKey))
|              | extend AssetId   = case(
|                  isnotempty(si_ci_id),   tostring(si_ci_id),
|                  isnotempty(AssetArmId), strcat("az:", AssetArmId),
|                  tostring(AssetNodeId))
|              | extend AssetType = case(si_class == "device", "Endpoint", isnotempty(tostring(AssetLabel)), tostring(AssetLabel), "Azure")
|              | extend AzureResourceId = AssetArmId
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              // #200 the same drop by ARM id. Defender names a VM by its Azure name, the graph by the machine, so the name pair
|              // above never matched a VM. The ARM id the graph node carries is the ARM id Defender reports.
|              | extend _dfcIdKey = iff(isnotempty(AssetArmId), strcat("h", tostring(hash(strcat(AssetArmId, "|", tolower(tostring(FindingName)))))), "-")
|              //__SI_DFC_ANTIJOIN_BEGIN__
|              | join kind=leftanti (_dfcPairs) on $left._dfcIdKey == $right._dfcKey
|              | project-away _dfcIdKey
|              //__SI_DFC_ANTIJOIN_END__
|              // #349 the same drop by the Defender assessment the graph edge names -- its resource and assessment key.
|              | extend _egRecArm = tolower(tostring(EdgePropsAny.rawData.recommendationAzureResourceId))
|              | extend _dfcAkKey = iff(_egRecArm matches regex @"/providers/microsoft\.security/assessments/[^/]+$", strcat("h", tostring(hash(strcat(extract(@"^(.*)/providers/microsoft\.security/assessments/[^/]+$", 1, _egRecArm), "|", extract(@"/assessments/([^/]+)$", 1, _egRecArm))))), "-")
|              //__SI_DFC_ANTIJOIN_BEGIN__
|              | join kind=leftanti (_dfcPairs) on $left._dfcAkKey == $right._dfcKey
|              | project-away _egRecArm, _dfcAkKey
|              //__SI_DFC_ANTIJOIN_END__
|              // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100   // basis-100, 100 = 1.0x = no lift
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend Properties =
|                  bag_merge(
|                      bag_pack("finding", FindingProps),
|                      bag_pack("raw", iif(isnull(FindingProps.rawData), dynamic({}), FindingProps.rawData)),
|                      bag_pack("edge", EdgePropsAny)
|                  )
|              | extend Subcategory = tostring(Properties.raw.securityIssue.securityIssue)
|              // finding factors -- the distinct risk factors the graph puts on the recommendation edge
|              | extend RiskFactorsArray = todynamic(Properties.edge.rawData.risk.riskFactors)
|              | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|              | mv-apply rf = RiskFactorsArray on (
|                  where isnotempty(trim(" ", tostring(rf)))
|                  | summarize RiskFactorSet = make_set(tostring(rf)))
|              | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              | extend RiskFactor_Probability = array_length(RiskFactorSet) + array_length(RF_P_CiFactors)
|              | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|              | extend RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(array_concat(
|                  RiskFactorSet,
|                  RF_P_CiFactorNames)), ";")
|              | extend Severity = tostring(Properties.raw.severity)
|              // #690 (37) a finding without a severity on its node is never dropped -- the risk level the graph puts on the
|              // edge is the source severity next, else the report's owner-defined severity (severity model, Low)
|              | extend Severity = iff(isnotempty(Severity), Severity, tostring(Properties.edge.rawData.risk.riskLevel))
|              | extend SecuritySeverity = case(
|                  tolower(Severity) == "critical", "Very High",
|                  tolower(Severity) == "high",     "High",
|                  tolower(Severity) == "medium",   "Medium",
|                  tolower(Severity) == "low",      "Low",
|                  "Low")
|              | extend Impact = case(
|                  tolower(Severity) == "critical", 10.0,
|                  tolower(Severity) == "high",     9.0,
|                  tolower(Severity) == "medium",   7.0,
|                  tolower(Severity) == "low",      3.0,
|                  0.0)
|              // #192 a subscription-level row no CI links takes the subscription's most critical CI.
|              | extend _subK = iff(AssetArmId matches regex @"^/subscriptions/[^/]+/?$", tostring(split(AssetArmId, "/")[2]), "")
|              | join kind=leftouter (_subTierG) on $left._subK == $right._sub
|              | extend CriticalityTier = iff(isnull(si_tier) and isnotempty(_subK), toint(Tier_BySub), toint(si_tier))
|              | project-away _subK, _sub, Tier_BySub
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain    = "Azure"
|              | extend Category          = tostring(FindingLabel)
|              // #690 (14) the graph writes some recommendation names with leading spaces -- the name and id are shown trimmed
|              // (the hand-off to the Defender report keeps comparing the name as the graph writes it)
|              | extend ConfigurationName = trim(@"\s+", tostring(FindingName))
|              | extend ConfigurationId   = "Recommendation"
|              | summarize
|                  UniqueIssues              = dcount(FindingName),
|                  ImpactedAssetsList        = make_set(AssetName),
|                  ImpactedAssetPairs        = make_set(strcat(AssetName, "|", AssetId)),
|                  RiskFactor_Consequence    = max(RiskFactor_Consequence),
|                  RiskScore_Weight_Factor   = max(RiskScore_Weight_Factor),
|                  RiskFactor_Weight         = max(RiskFactor_Weight),
|                  RiskScore_Weight_Detailed = any(RiskScore_Weight_Detailed),
|                  Impact                    = max(Impact),
|                  arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|                  MdeDeviceId               = min(tostring("")),
|                  EntraAccountObjectId      = min(tostring("")),
|                  AzureResourceId           = min(tostring(AzureResourceId)),
|                  AssetId                   = min(AssetId),
|                  MITRE_Tactics             = min(tostring(column_ifexists("MITRE_Tactics",""))),
|                  MITRE_Techniques          = min(tostring(column_ifexists("MITRE_Techniques",""))),
|                  ComplianceTags            = min(tostring(column_ifexists("ComplianceTags","")))
|                by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                   CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|                   cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|              // audit #25 -- the count is derived from the list that is actually DISPLAYED
|              | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|              | project
|                  SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetPairs, UniqueIssues
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, ImpactedAssetCount desc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|          // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|          // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|          // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, Recommendation, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|          // si si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|
|    - ReportName: Azure_Recommendations_Detailed
|      LookupNeededKeys:
|      - Lookup: _dfcPairs
|        Column: _dfcKey
|        Keys: |-
|          | extend _dfcKey = strcat("h", tostring(hash(strcat(tolower(tostring(AssetName)), "|", tolower(tostring(FindingName))))))
|          | extend _dfcIdKey = iff(isnotempty(AssetArmId), strcat("h", tostring(hash(strcat(AssetArmId, "|", tolower(tostring(FindingName)))))), "-")
|          | extend _egRecArm = tolower(tostring(EdgePropsAny.rawData.recommendationAzureResourceId))
|          | extend _dfcAkKey = iff(_egRecArm matches regex @"/providers/microsoft\.security/assessments/[^/]+$", strcat("h", tostring(hash(strcat(extract(@"^(.*)/providers/microsoft\.security/assessments/[^/]+$", 1, _egRecArm), "|", extract(@"/assessments/([^/]+)$", 1, _egRecArm))))), "-")
|          | project __siNeeded = pack_array(_dfcKey, _dfcIdKey, _dfcAkKey)
|      ReportPurpose: Per-row detail of Azure ExposureGraph recommendations, prioritised by criticality + Internet-Exposed + edge risk factors.
|        Same CL-correlation pattern as Azure_Recommendations_Summary; differs only in skipping the final summarize and emitting one row per
|        (Asset x Recommendation) with full per-row context (AzureResourceId, EG_IsCustomerFacing, RiskFactorSet, etc.).
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      # Low + Medium intentionally excluded from Detailed scope -- Azure EG recommendations
|      # are hygiene-heavy at Medium tier (cost/perf/best-practice drift, not security risk)
|      # and per-(Asset x Recommendation) rows explode at scale. Summary aggregates the full
|      # distribution; LA still receives every row.
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Azure_Recommendations_Detailed
|          // Purpose  Per-row detail of Azure ExposureGraph recommendations, prioritised by criticality + Internet-Exposed + edge risk factors.
|          // Output   One row per (Asset x Recommendation), with per-row context (AzureResourceId, EG_IsCustomerFacing, RiskFactorSet, etc.).
|          //
|          // #505 -- THE ASSET COMES FROM THE CI (SI_CI_CL). Tier, CMDB values, tags and the internet-exposed factor are the
|          // CI's. The FINDINGS still come from the Exposure Graph (recommendation edges) and are tied to their CI through
|          // _ciKey. DeviceKey is the lower-cased ARM resource id the graph node carries (EntityIds), for a subscription or
|          // resource-group node the ARM id of that scope, else the Defender device id, else the node id -- the same ids the
|          // CI links, so the hybrid path buckets both sides alike.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("cloud_resource", "device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|
|          // #192 a subscription-level recommendation takes the subscription's most critical CI.
|          // #675 read on its own, once per run, never from the sliced _ciLink -- a query slice holds only its share of the
|          // subscription's CIs, so the minimum over that share could be a less critical tier than the subscription has.
|          //__SI_CI_SUBTIER_BEGIN__
|              let _subTierG =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("cloud_resource", "device")
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where _ciKey startswith "/subscriptions/"
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | extend _sub = tostring(split(_ciKey, "/")[2])
|                  | where isnotempty(_sub)
|                  | summarize Tier_BySub = min(toint(column_ifexists("si_tier", int(null)))) by _sub;
|          //__SI_CI_SUBTIER_END__
|
|          // Step 0c  Excluded ConfigurationIds -- block-marker substituted by engine from the per-report exclude.custom.json.
|          // Items are matched against the recommendation FindingName (e.g. "Storage account public access disabled").
|
|          // #147 -- (resource, recommendation) pairs the Defender recommendation reports already carry. The graph
|          // report drops ONLY those, so a recommendation is reported once; everything the graph knows beyond
|          // Defender (e.g. per-setting machine baselines) stays. Latest snapshot only; a missing or empty table
|          // removes nothing. The final project stays OUTSIDE the union -- the engine pre-fetches this binding and
|          // reads that last project for the column list of an empty result.
|          // #278 the engine empties this block when the Defender recommendation report of the same grain is NOT in
|          // the run -- handing findings to a report that does not run puts them in no report at all.
|          //__DEFENDER_HANDOFF_BEGIN__
|          // The pairs are compared as strcat("h", hash(text)) on both sides -- the lookup is inlined into every bucket of the
|          // Advanced Hunting request (1 MB cap). The "h" keeps the inlined column a string (an all-digit column is inlined as long).
|          let _dfcPairs = union isfuzzy=true
|              (datatable(_dfcKey:string)[]),
|              (SI_AzureRecommendation_CL
|                  | where TimeGenerated > ago(8d)
|                  // #200 the ARM id pair too -- the graph names a VM by the machine, Defender by its Azure name.
|                  // #349 and the (resource, assessment key) pair -- the graph edge names the Defender assessment it came from.
|                  | extend _akL = tolower(tostring(column_ifexists("AssessmentKey", "")))
|                  | summarize _keys = make_set(strcat("h", tostring(hash(strcat(tolower(tostring(ResourceName)), "|", tolower(tostring(Recommendation))))))),
|                              _ids = make_set_if(strcat("h", tostring(hash(strcat(tolower(tostring(ResourceIdLower)), "|", tolower(tostring(Recommendation)))))), isnotempty(ResourceIdLower)),
|                              _aks = make_set_if(strcat("h", tostring(hash(strcat(tolower(tostring(ResourceIdLower)), "|", _akL)))), isnotempty(ResourceIdLower) and isnotempty(_akL)) by CollectionTime
|                  | top 1 by CollectionTime desc
|                  | extend _keys = array_concat(_keys, _ids, _aks)
|                  | mv-expand _dfcKey = _keys to typeof(string))
|              | project _dfcKey;
|          //__DEFENDER_HANDOFF_END__
|
|          // #349 -- Defender's own severity and security issue per assessment key, for a recommendation whose node
|          // the graph has lost (see _AssetFindingEdges_orphan). Latest snapshot per key. A missing table leaves it empty.
|          // This is a lookup, not a hand-off, so it stays outside the hand-off block above.
|          let _dfcRecByKey = union isfuzzy=true
|              (datatable(_akKey:string, _akSeverity:string, _akIssue:string)[]),
|              (SI_AzureRecommendation_CL
|                  | where TimeGenerated > ago(8d)
|                  | extend _akKey = tolower(tostring(column_ifexists("AssessmentKey", "")))
|                  | where isnotempty(_akKey) and isnotempty(tostring(Severity))
|                  | summarize arg_max(CollectionTime, Severity, SecurityIssue) by _akKey
|                  | project _akKey, _akSeverity = tostring(Severity), _akIssue = tostring(SecurityIssue))
|              | project _akKey, _akSeverity, _akIssue;
|
|          let _Assets =
|              ExposureGraphNodes
|              // v2.2.417 -- NodeLabel is the durable identifier (environmentName stopped discriminating on 2026-08-10).
|              | where NodeLabel startswith "microsoft." or NodeLabel in ("subscriptions", "resourcegroups")
|              | extend EG_IsCustomerFacing = tobool(coalesce(NodeProperties.rawData.isCustomerFacing, NodeProperties.raw.isCustomerFacing))
|              | extend EG_IsExcluded       = tobool(coalesce(NodeProperties.rawData.isExcluded,       NodeProperties.raw.isExcluded))
|              | where isnull(EG_IsExcluded) or EG_IsExcluded == false
|              | extend _ids = tostring(EntityIds)
|              | extend _armId = tolower(coalesce(extract(@'"type"\s*:\s*"AzureResourceId"\s*,\s*"id"\s*:\s*"([^"]+)"', 1, _ids), extract(@'"id"\s*:\s*"([^"]+)"\s*,\s*"type"\s*:\s*"AzureResourceId"', 1, _ids)))
|              | extend _senseId = tolower(coalesce(extract(@'"type"\s*:\s*"SenseDeviceId"\s*,\s*"id"\s*:\s*"([^"]+)"', 1, _ids), extract(@'"id"\s*:\s*"([^"]+)"\s*,\s*"type"\s*:\s*"SenseDeviceId"', 1, _ids)))
|              // #78 -- a subscription or resource-group node carries its scope in rawData.hierarchyIdentifier (the subscription
|              // guid on both kinds), so the scope's ARM id is built from it, switched on NodeLabel.
|              | extend _egHierarchyId = tolower(tostring(NodeProperties.rawData.hierarchyIdentifier))
|              | extend _scopeArmId = case(
|                    NodeLabel == "subscriptions"  and isnotempty(_egHierarchyId), strcat("/subscriptions/", _egHierarchyId),
|                    NodeLabel == "resourcegroups" and isnotempty(_egHierarchyId), strcat("/subscriptions/", _egHierarchyId, "/resourcegroups/", tolower(tostring(NodeName))),
|                    "")
|              | extend AssetArmId = iff(isnotempty(_armId), _armId, _scopeArmId)
|              | extend DeviceKey = case(isnotempty(AssetArmId), AssetArmId, isnotempty(_senseId), _senseId, tolower(NodeId))
|              | project
|                  AssetNodeId = NodeId,
|                  AssetName   = NodeName,
|                  AssetLabel  = NodeLabel,
|                  AssetArmId,
|                  DeviceKey,
|                  EG_IsCustomerFacing,
|                  EG_IsExcluded;
|
|          let _Findings =
|              ExposureGraphNodes
|              | mv-expand Category = Categories
|              | where tostring(Category) contains "finding"
|              | where NodeLabel !contains "cve"
|              | project FindingNodeId = NodeId, FindingName = NodeName, FindingLabel = NodeLabel,
|                        FindingCategories = Categories, FindingProps = NodeProperties;
|
|          let _Edges =
|              ExposureGraphEdges
|              | where EdgeLabel has "affecting"
|              | extend EdgeProps = column_ifexists("EdgeProperties", dynamic({}))
|              | project SourceNodeId, TargetNodeId, EdgeLabel, EdgeProps;
|
|          let _AssetFindingEdges_oneway =
|              _Edges
|              | join kind=inner (_Assets)   on $left.SourceNodeId == $right.AssetNodeId
|              | join kind=inner (_Findings) on $left.TargetNodeId == $right.FindingNodeId
|              | project AssetNodeId, AssetName, AssetLabel, AssetArmId, DeviceKey, EG_IsCustomerFacing, EG_IsExcluded,
|                        FindingName, FindingLabel, FindingCategories, FindingProps,
|                        EdgeLabel, EdgeProps;
|
|          let _AssetFindingEdges_otherway =
|              _Edges
|              | join kind=inner (_Assets)   on $left.TargetNodeId == $right.AssetNodeId
|              | join kind=inner (_Findings) on $left.SourceNodeId == $right.FindingNodeId
|              | project AssetNodeId, AssetName, AssetLabel, AssetArmId, DeviceKey, EG_IsCustomerFacing, EG_IsExcluded,
|                        FindingName, FindingLabel, FindingCategories, FindingProps,
|                        EdgeLabel, EdgeProps;
|
|          // #349 -- A RECOMMENDATION EDGE WHOSE RECOMMENDATION NODE IS MISSING. The graph keeps "affecting" edges after
|          // the recommendation's own node has gone from ExposureGraphNodes, and absence is not remediation, so the row is
|          // rebuilt from the edge itself. The edge carries the recommendation's name, label and categories (SourceNode*) and
|          // the Defender assessment it came from. Severity and security issue come from Defender by that key (_dfcRecByKey),
|          // and only where Defender has no row for it from the risk level the graph puts on the edge. A dangling edge whose
|          // ASSET node is missing has nothing to report on and stays out.
|          let _AssetFindingEdges_orphan =
|              ExposureGraphEdges
|              | where EdgeLabel has "affecting"
|              | where tostring(SourceNodeCategories) contains "finding" and SourceNodeLabel !contains "cve"
|              | join kind=leftanti (ExposureGraphNodes | project NodeId) on $left.SourceNodeId == $right.NodeId
|              | extend EdgeProps = column_ifexists("EdgeProperties", dynamic({}))
|              | extend _akKey = tolower(extract(@"/assessments/([^/]+)$", 1, tostring(EdgeProps.rawData.recommendationAzureResourceId)))
|              | join kind=leftouter (_dfcRecByKey) on _akKey
|              | extend _akSeverity = iff(isnotempty(_akSeverity), _akSeverity, tostring(EdgeProps.rawData.risk.riskLevel))
|              | join kind=inner (_Assets) on $left.TargetNodeId == $right.AssetNodeId
|              | project AssetNodeId, AssetName, AssetLabel, AssetArmId, DeviceKey, EG_IsCustomerFacing, EG_IsExcluded,
|                        FindingName = SourceNodeName, FindingLabel = SourceNodeLabel, FindingCategories = SourceNodeCategories,
|                        FindingProps = bag_pack("rawData", bag_pack("severity", _akSeverity, "securityIssue", bag_pack("securityIssue", _akIssue), "assessmentKey", _akKey)),
|                        EdgeLabel, EdgeProps;
|
|          let _AssetFindingEdges = union _AssetFindingEdges_oneway, _AssetFindingEdges_otherway, _AssetFindingEdges_orphan;
|
|          _AssetFindingEdges
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              | where not (FindingName in (SI_ExcludedConfigurationIds)) and not (trim(@"\s+", tostring(FindingName)) in (SI_ExcludedConfigurationIds))
|              | summarize
|                  AssetArmId            = any(AssetArmId),
|                  DeviceKey             = any(DeviceKey),
|                  EdgeLabels            = make_set(EdgeLabel),
|                  EdgePropsAny          = any(EdgeProps),
|                  FindingLabel          = any(FindingLabel),
|                  FindingCategories     = any(FindingCategories),
|                  FindingProps          = any(FindingProps),
|                  EG_IsCustomerFacing   = any(EG_IsCustomerFacing),
|                  EG_IsExcluded         = any(EG_IsExcluded)
|                by AssetNodeId, AssetName, AssetLabel, FindingName
|              // The hand-off lookup _dfcPairs has no per-asset key. When it is too large to travel whole in every slice, the
|              // engine asks the graph, per slice, which pair keys the rows at this point can have and inlines only those pairs
|              // (the report field LookupNeededKeys). Everything below this line is unchanged by that.
|              //__SI_LOOKUP_KEYS_HERE__
|              // #505 -- the finding's CI, by the ARM id / Defender device id / node id the graph node carries (never a name)
|              | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend _dfcKey = strcat("h", tostring(hash(strcat(tolower(tostring(AssetName)), "|", tolower(tostring(FindingName))))))
|              // #673 the three anti-joins below sit between markers the engine can take out (SI_RA_DefenderFilterInEngine)
|              // -- it then removes the same rows itself against the Defender list held in SQL, and the query returns the three keys.
|              // Pasted as it is, the query still de-duplicates on its own.
|              //__SI_DFC_ANTIJOIN_BEGIN__
|              | join kind=leftanti (_dfcPairs) on _dfcKey
|              | project-away _dfcKey
|              //__SI_DFC_ANTIJOIN_END__
|              | extend AssetName = case(
|                  isnotempty(tostring(AssetName)),     tostring(AssetName),
|                  isnotempty(tostring(si_asset_name)), tostring(si_asset_name),
|                  tostring(DeviceKey))
|              | extend AssetId   = case(
|                  isnotempty(si_ci_id),   tostring(si_ci_id),
|                  isnotempty(AssetArmId), strcat("az:", AssetArmId),
|                  tostring(AssetNodeId))
|              | extend AssetType = case(si_class == "device", "Endpoint", isnotempty(tostring(AssetLabel)), tostring(AssetLabel), "Azure")
|              // #690 (38) the resource is the one the Defender assessment on the edge names (the resource the portal shows),
|              // rolled up to its parent like the Defender recommendation report, else the ARM id of the node itself -- a graph node can
|              // carry two ARM ids (a VM moved to another subscription keeps its old id first)
|              | extend _assessedRes = extract(@"^(.*)/providers/microsoft\.security/assessments/[^/]+$", 1, tolower(tostring(EdgePropsAny.rawData.recommendationAzureResourceId)))
|              | extend AzureResourceId = coalesce(iff(_assessedRes contains "/securityentitydata/", substring(_assessedRes, 0, indexof(_assessedRes, "/securityentitydata/")), _assessedRes), AssetArmId)
|              | project-away _assessedRes
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              // #200 the same drop by ARM id. Defender names a VM by its Azure name, the graph by the machine, so the name pair
|              // above never matched a VM. The ARM id the graph node carries is the ARM id Defender reports.
|              | extend _dfcIdKey = iff(isnotempty(AssetArmId), strcat("h", tostring(hash(strcat(AssetArmId, "|", tolower(tostring(FindingName)))))), "-")
|              //__SI_DFC_ANTIJOIN_BEGIN__
|              | join kind=leftanti (_dfcPairs) on $left._dfcIdKey == $right._dfcKey
|              | project-away _dfcIdKey
|              //__SI_DFC_ANTIJOIN_END__
|              // #349 the same drop by the Defender assessment the graph edge names -- its resource and assessment key.
|              | extend _egRecArm = tolower(tostring(EdgePropsAny.rawData.recommendationAzureResourceId))
|              | extend _dfcAkKey = iff(_egRecArm matches regex @"/providers/microsoft\.security/assessments/[^/]+$", strcat("h", tostring(hash(strcat(extract(@"^(.*)/providers/microsoft\.security/assessments/[^/]+$", 1, _egRecArm), "|", extract(@"/assessments/([^/]+)$", 1, _egRecArm))))), "-")
|              //__SI_DFC_ANTIJOIN_BEGIN__
|              | join kind=leftanti (_dfcPairs) on $left._dfcAkKey == $right._dfcKey
|              | project-away _egRecArm, _dfcAkKey
|              //__SI_DFC_ANTIJOIN_END__
|              // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100   // basis-100, 100 = 1.0x = no lift
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend Properties =
|                  bag_merge(
|                      bag_pack("finding", FindingProps),
|                      bag_pack("raw", iif(isnull(FindingProps.rawData), dynamic({}), FindingProps.rawData)),
|                      bag_pack("edge", EdgePropsAny)
|                  )
|              | extend Subcategory = tostring(Properties.raw.securityIssue.securityIssue)
|              // finding factors -- the distinct risk factors the graph puts on the recommendation edge
|              | extend RiskFactorsArray = todynamic(Properties.edge.rawData.risk.riskFactors)
|              | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|              | mv-apply rf = RiskFactorsArray on (
|                  where isnotempty(trim(" ", tostring(rf)))
|                  | summarize RiskFactorSet = make_set(tostring(rf)))
|              | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              | extend RiskFactor_Probability = array_length(RiskFactorSet) + array_length(RF_P_CiFactors)
|              | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|              | extend RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(array_concat(
|                  RiskFactorSet,
|                  RF_P_CiFactorNames)), ";")
|              | extend Severity = tostring(Properties.raw.severity)
|              // #690 (37) a finding without a severity on its node is never dropped -- the risk level the graph puts on the
|              // edge is the source severity next, else the report's owner-defined severity (severity model, Low)
|              | extend Severity = iff(isnotempty(Severity), Severity, tostring(Properties.edge.rawData.risk.riskLevel))
|              | extend SecuritySeverity = case(
|                  tolower(Severity) == "critical", "Very High",
|                  tolower(Severity) == "high",     "High",
|                  tolower(Severity) == "medium",   "Medium",
|                  tolower(Severity) == "low",      "Low",
|                  "Low")
|              | extend Impact = case(
|                  tolower(Severity) == "critical", 10.0,
|                  tolower(Severity) == "high",     9.0,
|                  tolower(Severity) == "medium",   7.0,
|                  tolower(Severity) == "low",      3.0,
|                  0.0)
|              // #192 a subscription-level row no CI links takes the subscription's most critical CI.
|              | extend _subK = iff(AssetArmId matches regex @"^/subscriptions/[^/]+/?$", tostring(split(AssetArmId, "/")[2]), "")
|              | join kind=leftouter (_subTierG) on $left._subK == $right._sub
|              | extend CriticalityTier = iff(isnull(si_tier) and isnotempty(_subK), toint(Tier_BySub), toint(si_tier))
|              | project-away _subK, _sub, Tier_BySub
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              | extend SecurityDomain    = "Azure"
|              | extend Category          = tostring(FindingLabel)
|              // #690 (14) the graph writes some recommendation names with leading spaces -- the name and id are shown trimmed
|              // (the hand-off to the Defender report keeps comparing the name as the graph writes it)
|              | extend ConfigurationName = trim(@"\s+", tostring(FindingName))
|              // ConfigurationId carries the per-row recommendation id so (AssetName, ConfigurationId) is unique per row.
|              // Engine dedup keys on ConfigurationId via $cnInName -- this is what keeps Detailed rows alive.
|              | extend ConfigurationId   = trim(@"\s+", tostring(FindingName))
|              | project
|                  SecurityDomain, Category, Subcategory,
|                  ConfigurationName, ConfigurationId,
|                            AssetName,
|                            AssetId,
|                            AssetType,
|                  AzureResourceId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  EG_IsCustomerFacing
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, Impact desc, AssetName asc, ConfigurationId asc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|          // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|          // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|          // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|
|    - ReportName: Azure_DefenderRecommendations_Summary
|      ReportPurpose: >-
|        Every Defender for Cloud (Secure Score) recommendation, summarised per recommendation x tier x severity with the impacted assets listed; container-image and cloud-posture entities rolled up to their parent. The Exposure Graph is not required.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - ImpactedEntityCount
|      - SubFindingCount
|      - RecommendedAction
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Azure_DefenderRecommendations_Summary
|          // #147 -- EVERY Defender for Cloud (Secure Score) recommendation, collected by the azure engine into
|          // SI_AzureRecommendation_CL (container-image and cloud-posture entities rolled up to their parent with
|          // the affected entities listed). This is the BASE of the report -- nothing depends on the Exposure Graph.
|          // #505 -- THE ASSET COMES FROM THE CI (SI_CI_CL). Each recommendation is tied to its CI by the lower-cased
|          // ARM resource id (_ciKey). Tier, CMDB values, tags and the internet-exposed factor are the CI's.
|          // union isfuzzy -- an install that has not collected yet returns an empty report, never a failed one.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("cloud_resource", "device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|          let _recAll = union isfuzzy=true
|              (datatable(CollectionTime:datetime, ResourceId:string, ResourceIdLower:string, ResourceName:string, ResourceType:string, RowKind:string, Recommendation:string, AssessmentKey:string, Severity:string, RecommendationCategory:string, SecurityIssue:string, Categories:string, Tactics:string, RiskFactors:string, PortalLink:string, MaxCvssScore:string, AffectedEntityKind:string, AffectedEntities:string, SubscriptionId:string, ResourceGroup:string, Description:string, Remediation:string, SubFindingMaxSeverity:string, SubFindings:string)[]),
|              (SI_AzureRecommendation_CL | where TimeGenerated > ago(8d))
|              // #278 the two counts are NOT declared in the stub above. A Log Analytics column type is fixed by whoever
|              // created the table (int on one install, long on another), and a typed stub that disagrees splits the column.
|              // Read whatever type the table has, or null when there is no table yet.
|              | extend AffectedEntityCount = toint(column_ifexists("AffectedEntityCount", int(null))), SubFindingCount = toint(column_ifexists("SubFindingCount", int(null)));
|          let _recLatest = toscalar(_recAll | summarize max(CollectionTime));
|          let _rec = _recAll
|              | where CollectionTime == _recLatest
|              | extend _k = tolower(tostring(ResourceIdLower))
|              // #692 the slices of a large tenant -- one per hash of the recommendation's resource (every row has a key)
|              | extend DeviceKey = iff(isnotempty(_k), _k, strcat("rec|", tolower(tostring(Recommendation)), "|", tolower(tostring(SubscriptionId))))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              ;
|
|
|          // #190 a subscription-level finding governs everything in the subscription, so its most critical CI sets the tier.
|          // #690 (14) read on its own, once per run, never from the sliced _ciLink (the #675 fix of the graph report) -- a query
|          // slice holds only its share of the subscription's CIs, so the minimum over that share could be a less critical tier.
|          //__SI_CI_SUBTIER_BEGIN__
|              let _subTierG =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("cloud_resource", "device")
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where _ciKey startswith "/subscriptions/"
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | extend _sub = tostring(split(_ciKey, "/")[2])
|                  | where isnotempty(_sub)
|                  | summarize Tier_BySub = min(toint(column_ifexists("si_tier", int(null)))) by _sub;
|          //__SI_CI_SUBTIER_END__
|
|          _rec
|              // #505 -- the recommendation's CI, by the lower-cased ARM resource id (never a name)
|              | join kind=leftouter (_ciLink) on $left._k == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend _sub = iff(RowKind == "Subscription" or tolower(ResourceType) startswith "microsoft.security/pricings", tolower(tostring(SubscriptionId)), "")
|              | join kind=leftouter (_subTierG) on _sub
|              // #190 a child resource no CI links (a SQL server's encryption protector) takes its parent's tier.
|              | extend _seg = split(_k, "/")
|              | extend _kp = iff(isempty(si_ci_id) and array_length(_seg) > 9, strcat_array(array_slice(_seg, 0, array_length(_seg) - 3), "/"), "")
|              | join kind=leftouter (_ciLink | project _kp = _ciKey, Tier_ByParent = si_tier) on _kp
|              | where not (Recommendation in (SI_ExcludedConfigurationIds)) and not (AssessmentKey in (SI_ExcludedConfigurationIds))
|              | extend AssetName = case(isnotempty(si_asset_name), si_asset_name, isnotempty(ResourceName), ResourceName, ResourceId)
|              | extend AssetId   = case(isnotempty(si_ci_id), si_ci_id, strcat("az:", ResourceIdLower))
|              | extend AssetType = case(RowKind == "Subscription", "Subscription", isnotempty(ResourceType), ResourceType, "Azure")
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              // finding factors -- the risk factors Defender puts on the recommendation
|              | extend _rf = split(RiskFactors, "; ")
|              | mv-apply rf = _rf on (where isnotempty(trim(" ", tostring(rf))) | summarize RiskFactorSet = make_set(tostring(rf)))
|              | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              | extend RiskFactor_Probability = array_length(RiskFactorSet) + array_length(RF_P_CiFactors)
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(array_concat(
|                  RiskFactorSet,
|                  RF_P_CiFactorNames)), ";")
|              | extend SecuritySeverity = case(
|                  tolower(Severity) == "critical", "Very High",
|                  tolower(Severity) == "high",     "High",
|                  tolower(Severity) == "medium",   "Medium",
|                  tolower(Severity) == "low",      "Low",
|                  "Low")
|              | extend Impact = case(
|                  tolower(Severity) == "critical", 10.0,
|                  tolower(Severity) == "high",     9.0,
|                  tolower(Severity) == "medium",   7.0,
|                  tolower(Severity) == "low",      3.0,
|                  0.0)
|              | extend CriticalityTier = toint(array_sort_asc(pack_array(toint(si_tier), toint(Tier_BySub), toint(Tier_ByParent)))[0])
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend SecurityDomain    = "Azure"
|              | extend Category          = iff(isnotempty(RecommendationCategory), RecommendationCategory, "Defender for Cloud")
|              | extend Subcategory       = SecurityIssue
|              | extend ConfigurationName = Recommendation
|              | extend PortalUrl         = iff(isnotempty(PortalLink) and not(PortalLink startswith "http"), strcat("https://", PortalLink), PortalLink)
|              // what Defender for Cloud knows around the recommendation -- every column read with column_ifexists, so a table
|              // that has not received a column yet gives an empty cell, never a failed report
|              | extend MITRE_Tactics = replace_string(tostring(column_ifexists("Tactics", "")), "; ", ";"),
|                       MITRE_Techniques = replace_string(tostring(column_ifexists("Techniques", "")), "; ", ";"),
|                       ComplianceTags = tostring(column_ifexists("ComplianceTags", "")),
|                       si_source_first_detected = todatetime(column_ifexists("FirstEvaluated", "")),
|                       si_last_seen = todatetime(column_ifexists("StatusChanged", "")),
|                       si_fix_owner = tostring(column_ifexists("GovernanceOwner", "")),
|                       si_fix_due_date = todatetime(column_ifexists("GovernanceDueDate", "")),
|                       si_fix_grace_period = tostring(column_ifexists("GovernanceGracePeriod", "")),
|                       si_secure_score_control = tostring(column_ifexists("SecureScoreControl", "")),
|                       si_secure_score_gain = todouble(column_ifexists("SecureScoreGain", "")),
|                       si_attack_path_count = toint(column_ifexists("AttackPathCount", "")),
|                       si_attack_paths = tostring(column_ifexists("AttackPaths", "")),
|                       si_policy_definition_id = tostring(column_ifexists("PolicyDefinitionId", "")),
|                       si_status_cause = trim(" ", strcat(tostring(column_ifexists("StatusCause", "")), " ", tostring(column_ifexists("StatusDescription", "")))),
|                       si_affected_software = tostring(column_ifexists("SubFindingProducts", "")),
|                       SI_FixReference = tostring(column_ifexists("SubFindingFixedVersions", "")),
|                       SubFindingRemediation = tostring(column_ifexists("SubFindingRemediation", "")),
|                       si_image_digest = tostring(column_ifexists("ImageDigest", "")),
|                       si_image_repository = tostring(column_ifexists("ImageRepository", ""))
|              | extend ConfigurationId   = "Recommendation"
|              | summarize
|                  ImpactedAssetsList        = make_set(AssetName),
|                  ImpactedAssetPairs        = make_set(strcat(AssetName, "|", AssetId)),
|                  ImpactedEntityCount       = sum(AffectedEntityCount),
|                  RiskFactor_Consequence    = max(RiskFactor_Consequence),
|                  RiskScore_Weight_Factor   = max(RiskScore_Weight_Factor),
|                  RiskFactor_Weight         = max(RiskFactor_Weight),
|                  RiskScore_Weight_Detailed = any(RiskScore_Weight_Detailed),
|                  Impact                    = max(Impact),
|                  arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|                  PortalUrl                 = any(PortalUrl),
|                  RecommendedAction         = take_any(Remediation),
|                  si_fix_remediation        = take_anyif(Remediation, isnotempty(Remediation)),
|                  MITRE_Tactics             = take_anyif(MITRE_Tactics, isnotempty(MITRE_Tactics)),
|                  MITRE_Techniques          = take_anyif(MITRE_Techniques, isnotempty(MITRE_Techniques)),
|                  ComplianceTags            = take_anyif(ComplianceTags, isnotempty(ComplianceTags)),
|                  si_source_first_detected  = min(si_source_first_detected),
|                  si_last_seen              = max(si_last_seen),
|                  si_secure_score_control   = take_anyif(si_secure_score_control, isnotempty(si_secure_score_control)),
|                  si_secure_score_gain      = max(si_secure_score_gain),
|                  si_attack_path_count      = max(si_attack_path_count),
|                  _fixOwners                = make_set_if(si_fix_owner, isnotempty(si_fix_owner), 20),
|                  si_fix_due_date           = min(si_fix_due_date),
|                  SubFindingCount           = sum(SubFindingCount)
|                by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                   CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|                   cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|              | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|              // #692 the owners as an extend (not inside the project) -- a group the slices split is merged into one row again
|              | extend si_fix_owner = strcat_array(_fixOwners, ", ")
|              | project
|                  SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetPairs, ImpactedEntityCount, SubFindingCount, RecommendedAction, PortalUrl, si_fix_remediation,
|                  MITRE_Tactics, MITRE_Techniques, ComplianceTags, si_source_first_detected, si_last_seen,
|                  si_secure_score_control, si_secure_score_gain, si_attack_path_count, si_fix_owner, si_fix_due_date
|              | order by CriticalityTier asc, RiskScore_Weight_Factor desc, ImpactedAssetCount desc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|          // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|          // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|          // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, ImpactedEntityCount, SubFindingCount, RecommendedAction, MoreDetails
|          // out AssetDetectedInReportName
|          // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_cvss <- MaxCvssScore
|          // si si_category <- Category, si_subcategory <- Subcategory, si_description <- Description, si_remediation <- RecommendedAction
|          // si si_fix_remediation <- si_fix_remediation, si_affected_software <- si_affected_software, si_source_first_detected <- si_source_first_detected, si_source_first_seen <- si_source_first_detected
|          // si si_last_seen <- si_last_seen, si_fix_owner <- si_fix_owner, si_fix_due_date <- si_fix_due_date, si_fix_grace_period <- si_fix_grace_period
|          // si si_secure_score_control <- si_secure_score_control, si_secure_score_gain <- si_secure_score_gain, si_attack_path_count <- si_attack_path_count, si_attack_paths <- si_attack_paths
|          // si si_policy_definition_id <- si_policy_definition_id, si_status_cause <- si_status_cause, si_image_digest <- si_image_digest, si_image_repository <- si_image_repository
|          // si si_fix_reference <- SI_FixReference, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|          // si si_portal_link <- PortalUrl, si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|    - ReportName: Azure_DefenderRecommendations_Detailed
|      ReportPurpose: >-
|        Every Defender for Cloud (Secure Score) recommendation, one row per (resource x recommendation); container-image and cloud-posture entities rolled up to their parent with the affected entities listed. Tier / cmdb / exclusion from the Azure profile by ARM id. The Exposure Graph is not required.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - AffectedEntityKind
|      - AffectedEntityCount
|      - AffectedEntities
|      - SubFindingCount
|      - SubFindingMaxSeverity
|      - SubFindings
|      - RecommendedAction
|      - ConfigurationDescription
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "overdue", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Azure_DefenderRecommendations_Detailed
|          // #147 -- EVERY Defender for Cloud (Secure Score) recommendation, collected by the azure engine into
|          // SI_AzureRecommendation_CL (container-image and cloud-posture entities rolled up to their parent with
|          // the affected entities listed). This is the BASE of the report -- nothing depends on the Exposure Graph.
|          // #505 -- THE ASSET COMES FROM THE CI (SI_CI_CL). Each recommendation is tied to its CI by the lower-cased
|          // ARM resource id (_ciKey). Tier, CMDB values, tags and the internet-exposed factor are the CI's.
|          // union isfuzzy -- an install that has not collected yet returns an empty report, never a failed one.
|          //__SI_CI_LINK_BEGIN__
|              let _ciLink =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("cloud_resource", "device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "overdue", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "overdue": "Overdue", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                      summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                                _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                    )
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where isnotempty(_ciKey)
|                  | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|          //__SI_CI_LINK_END__
|          let _recAll = union isfuzzy=true
|              (datatable(CollectionTime:datetime, ResourceId:string, ResourceIdLower:string, ResourceName:string, ResourceType:string, RowKind:string, Recommendation:string, AssessmentKey:string, Severity:string, RecommendationCategory:string, SecurityIssue:string, Categories:string, Tactics:string, RiskFactors:string, PortalLink:string, MaxCvssScore:string, AffectedEntityKind:string, AffectedEntities:string, SubscriptionId:string, ResourceGroup:string, Description:string, Remediation:string, SubFindingMaxSeverity:string, SubFindings:string)[]),
|              (SI_AzureRecommendation_CL | where TimeGenerated > ago(8d))
|              // #278 the two counts are NOT declared in the stub above. A Log Analytics column type is fixed by whoever
|              // created the table (int on one install, long on another), and a typed stub that disagrees splits the column.
|              // Read whatever type the table has, or null when there is no table yet.
|              | extend AffectedEntityCount = toint(column_ifexists("AffectedEntityCount", int(null))), SubFindingCount = toint(column_ifexists("SubFindingCount", int(null)));
|          let _recLatest = toscalar(_recAll | summarize max(CollectionTime));
|          let _rec = _recAll
|              | where CollectionTime == _recLatest
|              | extend _k = tolower(tostring(ResourceIdLower))
|              // #692 the slices of a large tenant -- one per hash of the recommendation's resource (every row has a key)
|              | extend DeviceKey = iff(isnotempty(_k), _k, strcat("rec|", tolower(tostring(Recommendation)), "|", tolower(tostring(SubscriptionId))))
|              //__BUCKET_FILTER_BEGIN__
|              | where 1 == 1
|              //__BUCKET_FILTER_END__
|              ;
|
|
|          // #190 a subscription-level finding governs everything in the subscription, so its most critical CI sets the tier.
|          // #690 (14) read on its own, once per run, never from the sliced _ciLink (the #675 fix of the graph report) -- a query
|          // slice holds only its share of the subscription's CIs, so the minimum over that share could be a less critical tier.
|          //__SI_CI_SUBTIER_BEGIN__
|              let _subTierG =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("cloud_resource", "device")
|                  | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                  | mv-expand _ciKey = _ciKeys to typeof(string)
|                  | where _ciKey startswith "/subscriptions/"
|                  | summarize arg_max(_ciBuild, *) by _ciKey
|                  | extend _sub = tostring(split(_ciKey, "/")[2])
|                  | where isnotempty(_sub)
|                  | summarize Tier_BySub = min(toint(column_ifexists("si_tier", int(null)))) by _sub;
|          //__SI_CI_SUBTIER_END__
|
|          _rec
|              // #505 -- the recommendation's CI, by the lower-cased ARM resource id (never a name)
|              | join kind=leftouter (_ciLink) on $left._k == $right._ciKey
|              | where coalesce(si_in_scope_, true)
|              | extend _sub = iff(RowKind == "Subscription" or tolower(ResourceType) startswith "microsoft.security/pricings", tolower(tostring(SubscriptionId)), "")
|              | join kind=leftouter (_subTierG) on _sub
|              // #190 a child resource no CI links (a SQL server's encryption protector) takes its parent's tier.
|              | extend _seg = split(_k, "/")
|              | extend _kp = iff(isempty(si_ci_id) and array_length(_seg) > 9, strcat_array(array_slice(_seg, 0, array_length(_seg) - 3), "/"), "")
|              | join kind=leftouter (_ciLink | project _kp = _ciKey, Tier_ByParent = si_tier) on _kp
|              | where not (Recommendation in (SI_ExcludedConfigurationIds)) and not (AssessmentKey in (SI_ExcludedConfigurationIds))
|              | extend AssetName = case(isnotempty(si_asset_name), si_asset_name, isnotempty(ResourceName), ResourceName, ResourceId)
|              | extend AssetId   = case(isnotempty(si_ci_id), si_ci_id, strcat("az:", ResourceIdLower))
|              | extend AssetType = case(RowKind == "Subscription", "Subscription", isnotempty(ResourceType), ResourceType, "Azure")
|              | extend cmdbId = tostring(si_cmdb_id), cmdbName = tostring(si_cmdb_name), cmdbCriticality = tostring(si_cmdb_criticality), cmdbDataSensitivity = tostring(si_cmdb_data_sensitivity)
|              // finding factors -- the risk factors Defender puts on the recommendation
|              | extend _rf = split(RiskFactors, "; ")
|              | mv-apply rf = _rf on (where isnotempty(trim(" ", tostring(rf))) | summarize RiskFactorSet = make_set(tostring(rf)))
|              | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|              // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|              | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|              | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|              | extend RiskFactor_Probability = array_length(RiskFactorSet) + array_length(RF_P_CiFactors)
|              | extend RiskFactor_Consequence = 0
|              | extend RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(array_concat(
|                  RiskFactorSet,
|                  RF_P_CiFactorNames)), ";")
|              | extend SecuritySeverity = case(
|                  tolower(Severity) == "critical", "Very High",
|                  tolower(Severity) == "high",     "High",
|                  tolower(Severity) == "medium",   "Medium",
|                  tolower(Severity) == "low",      "Low",
|                  "Low")
|              | extend Impact = case(
|                  tolower(Severity) == "critical", 10.0,
|                  tolower(Severity) == "high",     9.0,
|                  tolower(Severity) == "medium",   7.0,
|                  tolower(Severity) == "low",      3.0,
|                  0.0)
|              | extend CriticalityTier = toint(array_sort_asc(pack_array(toint(si_tier), toint(Tier_BySub), toint(Tier_ByParent)))[0])
|              | extend CriticalityTierLevel = case(
|                  CriticalityTier == 0, "Critical - tier 0",
|                  CriticalityTier == 1, "High - tier 1",
|                  CriticalityTier == 2, "Medium - tier 2",
|                  CriticalityTier == 3, "Low - tier 3",
|                  "")
|              //__WEIGHTED_FACTORS_BEGIN__
|              | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|              | extend RiskScore_Weight_Factor   = 100
|              | extend RiskFactor_Weight         = 100
|              //__WEIGHTED_FACTORS_END__
|              | extend SecurityDomain    = "Azure"
|              | extend Category          = iff(isnotempty(RecommendationCategory), RecommendationCategory, "Defender for Cloud")
|              | extend Subcategory       = SecurityIssue
|              | extend ConfigurationName = Recommendation
|              | extend PortalUrl         = iff(isnotempty(PortalLink) and not(PortalLink startswith "http"), strcat("https://", PortalLink), PortalLink)
|              // what Defender for Cloud knows around the recommendation -- every column read with column_ifexists, so a table
|              // that has not received a column yet gives an empty cell, never a failed report
|              | extend MITRE_Tactics = replace_string(tostring(column_ifexists("Tactics", "")), "; ", ";"),
|                       MITRE_Techniques = replace_string(tostring(column_ifexists("Techniques", "")), "; ", ";"),
|                       ComplianceTags = tostring(column_ifexists("ComplianceTags", "")),
|                       si_source_first_detected = todatetime(column_ifexists("FirstEvaluated", "")),
|                       si_last_seen = todatetime(column_ifexists("StatusChanged", "")),
|                       si_fix_owner = tostring(column_ifexists("GovernanceOwner", "")),
|                       si_fix_due_date = todatetime(column_ifexists("GovernanceDueDate", "")),
|                       si_fix_grace_period = tostring(column_ifexists("GovernanceGracePeriod", "")),
|                       si_secure_score_control = tostring(column_ifexists("SecureScoreControl", "")),
|                       si_secure_score_gain = todouble(column_ifexists("SecureScoreGain", "")),
|                       si_attack_path_count = toint(column_ifexists("AttackPathCount", "")),
|                       si_attack_paths = tostring(column_ifexists("AttackPaths", "")),
|                       si_policy_definition_id = tostring(column_ifexists("PolicyDefinitionId", "")),
|                       si_status_cause = trim(" ", strcat(tostring(column_ifexists("StatusCause", "")), " ", tostring(column_ifexists("StatusDescription", "")))),
|                       si_affected_software = tostring(column_ifexists("SubFindingProducts", "")),
|                       SI_FixReference = tostring(column_ifexists("SubFindingFixedVersions", "")),
|                       SubFindingRemediation = tostring(column_ifexists("SubFindingRemediation", "")),
|                       si_image_digest = tostring(column_ifexists("ImageDigest", "")),
|                       si_image_repository = tostring(column_ifexists("ImageRepository", ""))
|              | extend ConfigurationId   = AssessmentKey
|              | project
|                  SecurityDomain, Category, Subcategory,
|                  ConfigurationName, ConfigurationId,
|                  AssetName, AssetId, AssetType,
|                  AzureResourceId = ResourceId,
|                  Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  AffectedEntityKind, AffectedEntityCount, AffectedEntities,
|                  SubFindingCount, SubFindingMaxSeverity, SubFindings,
|                  RecommendedAction = Remediation, si_fix_remediation = Remediation, ConfigurationDescription = Description,
|                  Tactics, MaxCvssScore, PortalUrl,
|                  MITRE_Tactics, MITRE_Techniques, ComplianceTags, si_source_first_detected, si_last_seen,
|                  si_fix_owner, si_fix_due_date, si_fix_grace_period,
|                  si_secure_score_control, si_secure_score_gain, si_attack_path_count, si_attack_paths,
|                  si_policy_definition_id, si_status_cause,
|                  si_affected_software, SI_FixReference, SubFindingRemediation, si_image_digest, si_image_repository,
|                  UserImpact = tostring(column_ifexists("UserImpact", "")), ImplementationEffort = tostring(column_ifexists("ImplementationEffort", "")),
|                  DefenderRiskLevel = tostring(column_ifexists("RiskLevel", "")), Threats = tostring(column_ifexists("Threats", ""))
|              | order by CriticalityTier asc, Impact desc, AssetName asc, ConfigurationId asc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|          // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|          // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|          // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, AffectedEntityKind, AffectedEntityCount, AffectedEntities, SubFindingCount
|          // out SubFindingMaxSeverity, SubFindings, RecommendedAction, ConfigurationDescription, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_cvss <- MaxCvssScore
|          // si si_category <- Category, si_subcategory <- Subcategory, si_description <- ConfigurationDescription, si_remediation <- RecommendedAction
|          // si si_fix_remediation <- si_fix_remediation, si_affected_software <- si_affected_software, si_source_first_detected <- si_source_first_detected, si_source_first_seen <- si_source_first_detected
|          // si si_last_seen <- si_last_seen, si_fix_owner <- si_fix_owner, si_fix_due_date <- si_fix_due_date, si_fix_grace_period <- si_fix_grace_period
|          // si si_secure_score_control <- si_secure_score_control, si_secure_score_gain <- si_secure_score_gain, si_attack_path_count <- si_attack_path_count, si_attack_paths <- si_attack_paths
|          // si si_policy_definition_id <- si_policy_definition_id, si_status_cause <- si_status_cause, si_image_digest <- si_image_digest, si_image_repository <- si_image_repository
|          // si si_fix_reference <- SI_FixReference, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|          // si si_portal_link <- PortalUrl, si_user_impact <- UserImpact, si_remediation_effort <- ImplementationEffort, si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_Github_to_Azure_Resources
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|          | project __siNeeded = pack_array(TargetCiKey)
|      ReportPurpose: Credential-driven attack paths from GitHub to Azure targets, prioritized by FINAL TARGET business impact.
|        EG provides the path detection + lateral-movement scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - UniqueIssues
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - IssueList
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // the objects inside each subscription and resource group, from the graph's own contains edges -- a role on a scope is
|        // reported on the objects inside it, never on the scope itself (owner 2026-10-19)
|        let _SI_ScopeContains = ExposureGraphEdges
|            | where EdgeLabel =~ "contains" and SourceNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")
|            | project _ScopeNodeId = SourceNodeId, _ChildId = TargetNodeId, _ChildName = TargetNodeName, _ChildLabel = TargetNodeLabel;
|        let _SI_ScopeMembers = union
|            (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel),
|            (_SI_ScopeContains | where _ChildLabel in~ ("resourcegroups", "microsoft.resources/resourcegroups") | project _ScopeNodeId, _RgNodeId = _ChildId
|                | join kind=inner (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _RgNodeId = _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel) on _RgNodeId
|                | project _ScopeNodeId, _MemberId, _MemberName, _MemberLabel)
|            | summarize _MemberName = take_any(_MemberName), _MemberLabel = take_any(_MemberLabel) by _ScopeNodeId, _MemberId;
|        // =================================================================================================
|        // REPORT  Credential driven attack paths from GitHub to Azure using Exposure Graph
|        // =================================================================================================
|        //
|        // Report purpose
|        // Identify credentials stored in GitHub workflows or repositories and trace credential driven
|        // attack paths into Azure targets. Paths are prioritized by the business impact of the FINAL TARGET.
|        //
|        // Interpretation guard and priority rules
|        // - Priority is driven by the TARGET criticality tier first
|        // - Then by tier escalation where source tier is higher than target tier
|        // - Then by Internet exposure where target exposure is weighted higher than source exposure
|        // - GitHub sources are treated as Internet exposed and low trust by default
|        // - A low tier source can never outrank a tier 0 or tier 1 target
|        //
|        // Output description
|        // Detailed output produces one row per unique credential to target attack path enriched with
|        // - Internet exposure flags
|        // - Asset tier from tags
|        // - Legacy operating system and end of support signals
|        // - Risk factor probability including detailed breakdown
|        // - Attack path priority score and severity
|        // - Human readable attack path strings
|        //
|        // Collapsed summary output merges duplicates caused by many credentials or sources
|        // - Collapse key uses source identity target triple
|        // - Summaries include RiskFactor_Probability_Detailed and DetailedScore derived from target
|        //
|        // Query steps overview
|        // Step 0  Define legacy operating system reference lists
|        // Step 1  Build Nodes catalog as enrichment backbone
|        // Step 2  Normalize node labels to avoid filter issues
|        // Step 3  Identify credentials stored in GitHub workflows and repositories
|        // Step 4  Hop 1 credential authenticates as an identity
|        // Step 5  Hop 2 identity can reach Azure target resources
|        // Step 6  Assemble attack paths and de duplicate
|        // Step 7  Enrich source target intermediate and credential using Nodes catalog
|        // Step 8  Calculate tier escalation lateral movement and priority score
|        // Step 9  Build human readable AttackPath and AttackPathDetailed
|        // Step 10 Emit detailed output table
|        // Step 11 Collapse to unique logical path
|        // Step 12 Build main summary
|        // Step 13 Build probability detail summary
|        // Step 14 Build probability detail score summary
|        // Step 15 Emit final collapsed output
|        // =================================================================================================
|
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Build node catalog used to enrich attack paths
|        // - Bucket filtering is applied once at node scope using DeviceKey
|        let Nodes =
|            ExposureGraphNodes
|            | extend CategoriesStr = tolower(tostring(Categories))
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|
|            | extend AssetName = NodeNameNorm
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend DeviceKey = NodeCiKey
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend CriticalityRuleBased =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.ruleBasedCriticalityLevel)
|                ))
|            | extend EgCriticalityRuleNames =
|                coalesce(
|                    strcat_array(NodeProperties.criticalityLevelProps[0].ruleNames, ", "),
|                    strcat_array(NodeProperties.rawData.criticalityLevel.ruleNames, ", "),
|                    ""
|                )
|
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    NodeProperties.rawData.isCustomerFacing,
|                    NodeProperties.raw.isCustomerFacing,
|                    false
|                ))
|
|            | extend IsExcluded =
|                tobool(coalesce(
|                    NodeProperties.rawData.isExcluded,
|                    NodeProperties.raw.isExcluded,
|                    false
|                ))
|
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|
|            // the exclusion tags (the scope block, from the Exclusions page and the shipped list)
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            | extend CriticalityTier = toint(coalesce(CriticalityTierFromTag, 3))
|            | extend CriticalityTierLevel =
|                case(
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    NodeProperties.rawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|
|            | mv-apply rf = array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                ) on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize ScoreParts = make_set(strcat(tostring(rf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName          = NodeNameNorm,
|                NodeLabel,
|                Categories        = CategoriesStr,
|                NodeProperties,
|                EgCriticalityLevel,
|                CriticalityTier,
|                CriticalityTierLevel,
|                CriticalityRuleBased,
|                EgCriticalityRuleNames,
|                IsInternetExposed,
|                IsExcluded,
|                EgNodeTags,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactorsArray,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence;
|
|        // Step 2  Normalize labels to avoid typos breaking filters
|        let NormalizeLabel = (s:string) { tolower(trim(" ", replace_string(s, " ", ""))) };
|
|        // Step 3  Identify credentials stored in GitHub workflows and repositories
|        // Fixes applied
|        // - GitHub graph label variations are common, allow a small set of normalized variants
|        // - Also support reverse edge direction (credential contains github object) with isfuzzy union
|        let GitHubSourceLabelAllow =
|            dynamic([
|                "githubworkflow",
|                "githubrepository",
|                "githubactionsworkflow",
|                "githubactions",
|                "github"
|            ]);
|
|        let CredentialLabelAllow =
|            dynamic([
|                "azure-active-directory-app-secret",
|                "user-azure-cli-secret",
|                "azure-storage-shared-access-signature",
|                "azure-storage-connection-string",
|                "azure-database-connection-string",
|                "azure-active-directory-user-credentials",
|                "service-principal-azure-cli-secret",
|                "azure-app-configuration-key"
|            ]);
|
|        let GitHubCredentials_Forward =
|            ExposureGraphEdges
|            | where EdgeLabel in ("contains", "defined in")
|            | extend SourceNodeLabelNorm = NormalizeLabel(SourceNodeLabel),
|                     TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where SourceNodeLabelNorm in (GitHubSourceLabelAllow)
|            | where TargetNodeLabelNorm in (CredentialLabelAllow)
|            | project
|                SourceGitHubNodeId    = SourceNodeId,
|                SourceGitHubNodeName  = SourceNodeName,
|                SourceGitHubNodeLabel = SourceNodeLabel,
|                CredentialNodeId      = TargetNodeId,
|                CredentialNodeName    = TargetNodeName,
|                CredentialNodeLabel   = TargetNodeLabel;
|
|        let GitHubCredentials_Reverse =
|            ExposureGraphEdges
|            | where EdgeLabel in ("contains", "defined in")
|            | extend SourceNodeLabelNorm = NormalizeLabel(SourceNodeLabel),
|                     TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where TargetNodeLabelNorm in (GitHubSourceLabelAllow)
|            | where SourceNodeLabelNorm in (CredentialLabelAllow)
|            | project
|                SourceGitHubNodeId    = TargetNodeId,
|                SourceGitHubNodeName  = TargetNodeName,
|                SourceGitHubNodeLabel = TargetNodeLabel,
|                CredentialNodeId      = SourceNodeId,
|                CredentialNodeName    = SourceNodeName,
|                CredentialNodeLabel   = SourceNodeLabel;
|
|        let GitHubCredentials =
|            union isfuzzy=true GitHubCredentials_Forward, GitHubCredentials_Reverse
|            | summarize
|                GitHubSources          = make_set(SourceGitHubNodeName),
|                GitHubSourceTypes      = make_set(SourceGitHubNodeLabel),
|                GitHubSourceCount      = dcount(SourceGitHubNodeId),
|                FirstGitHubSource      = any(SourceGitHubNodeId),
|                FirstGitHubSourceName  = any(SourceGitHubNodeName),
|                FirstGitHubSourceLabel = any(SourceGitHubNodeLabel),
|                CredentialNodeName     = any(CredentialNodeName),
|                CredentialNodeLabel    = any(CredentialNodeLabel),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                CredentialNodeId;
|
|        // Step 4  Hop 1 credential authenticates as an identity
|        // Fixes applied
|        // - Many graphs store the identity as Source and credential as Target, support both directions
|        // v2.2.419 (audit #56.2b) -- BOUND both directions to the credentials found in Step 3.
|        // These two scanned every "has credentials of" / "can authenticate as" /
|        // "can authenticate to" edge in the tenant, on the assumption that the Step 6 join would
|        // keep the work small. It does not: a join constrains the RESULT, not the SCAN, so the hop
|        // set stayed tenant-wide however the report was bucketed. Identical defect to #56 in
|        // Credential_Based_Lateral_Movement.
|        // Provably lossless: GitHubCredentials is summarized `by CredentialNodeId`, and Step 6 does
|        // `join kind=inner (Hop1) on CredentialNodeId`, so the semi-join removes EXACTLY the rows
|        // that inner join would discard. Note the two directions key the credential to opposite
|        // ends of the edge, so each is bounded on the end IT projects as CredentialNodeId.
|        let _GhCredIds = GitHubCredentials | distinct CredentialNodeId;
|        let Hop1_Forward =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has credentials of", "can authenticate as", "can authenticate to")
|            | where SourceNodeId in (_GhCredIds)
|            | project
|                CredentialNodeId           = SourceNodeId,
|                Hop1_EdgeLabel             = EdgeLabel,
|                IntermediateIdentityId     = TargetNodeId,
|                IntermediateIdentity       = TargetNodeName,
|                IntermediateIdentityLabel  = TargetNodeLabel;
|
|        let Hop1_Reverse =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has credentials of", "can authenticate as", "can authenticate to")
|            | where TargetNodeId in (_GhCredIds)
|            | project
|                CredentialNodeId           = TargetNodeId,
|                Hop1_EdgeLabel             = EdgeLabel,
|                IntermediateIdentityId     = SourceNodeId,
|                IntermediateIdentity       = SourceNodeName,
|                IntermediateIdentityLabel  = SourceNodeLabel;
|
|        let Hop1 =
|            union isfuzzy=true Hop1_Forward, Hop1_Reverse;
|
|        // Step 5  Hop 2 identity can reach Azure target resources
|        let Hop2 =
|            ExposureGraphEdges
|            | where EdgeLabel in ("can authenticate to", "has permissions to", "has role on")
|            // v2.2.419 (audit #56.2b) -- bound to the identities Hop 1 actually reached. Step 6 does
|            // `join kind=inner (Hop2) on $left.IntermediateIdentityId == $right.Hop2_SourceIdentityId`,
|            // so this removes EXACTLY the rows that inner join would discard. This is the more
|            // dangerous of the two hops -- its target list includes `subscriptions` and
|            // `resourcegroups`, node types that legitimately carry thousands of inbound edges, so
|            // left tenant-wide it is what turns the join into a cartesian product on a hub identity.
|            | where SourceNodeId in (Hop1 | distinct IntermediateIdentityId)
|            // #677 the slices are cut on the path's FINAL TARGET (TargetNodeId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            // a subscription or resource group target is replaced by the objects inside it -- once per object, so an object reached
|            // directly and through its resource group and subscription is one path (owner 2026-10-19)
|            | join kind=leftouter (_SI_ScopeMembers) on $left.TargetNodeId == $right._ScopeNodeId
|            | where isnotempty(_MemberId) or not(TargetNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups"))
|            | extend TargetNodeId = iff(isnotempty(_MemberId), _MemberId, TargetNodeId), TargetNodeName = iff(isnotempty(_MemberId), _MemberName, TargetNodeName), TargetNodeLabel = iff(isnotempty(_MemberId), _MemberLabel, TargetNodeLabel)
|            | extend _SI_ViaScope = isnotempty(_MemberId)
|            | project-away _ScopeNodeId, _MemberId, _MemberName, _MemberLabel
|            | extend DeviceKey = TargetNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | extend TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where _SI_ViaScope or TargetNodeLabelNorm in (
|                "microsoft.compute/virtualmachines",
|                "microsoft.storage/storageaccounts",
|                "microsoft.keyvault/vaults",
|                "microsoft.sql/servers",
|                "microsoft.sql/servers/databases",
|                "microsoft.cognitiveservices/accounts",
|                "microsoft.cognitiveservices/accounts_openai",
|                "subscriptions",
|                "resourcegroups",
|                "blobcontainer"
|            )
|            | project
|                Hop2_SourceIdentityId = SourceNodeId,
|                Hop2_EdgeLabel        = EdgeLabel,
|                FinalTargetId         = TargetNodeId,
|                FinalTargetName       = TargetNodeName,
|                FinalTargetLabel      = TargetNodeLabel;
|
|        // Step 6  Assemble attack paths and de duplicate
|        // Fixes applied
|        // - Original summarize by CredentialNodeId, FinalTargetId collapsed away IntermediateIdentityId
|        //   which breaks PathKey later and can create null or wrong joins
|        // - Stable detailed grain should include CredentialNodeId, IntermediateIdentityId, FinalTargetId
|        let Detailed =
|            GitHubCredentials
|            | join kind=inner (Hop1) on CredentialNodeId
|            | join kind=inner (Hop2) on $left.IntermediateIdentityId == $right.Hop2_SourceIdentityId
|            | where FirstGitHubSource != FinalTargetId
|            | summarize
|                GitHubSources          = any(GitHubSources),
|                GitHubSourceTypes      = any(GitHubSourceTypes),
|                GitHubSourceCount      = any(GitHubSourceCount),
|                FirstGitHubSource      = any(FirstGitHubSource),
|                FirstGitHubSourceName  = any(FirstGitHubSourceName),
|                FirstGitHubSourceLabel = any(FirstGitHubSourceLabel),
|
|                CredentialNodeName     = any(CredentialNodeName),
|                CredentialNodeLabel    = any(CredentialNodeLabel),
|
|                IntermediateIdentity      = any(IntermediateIdentity),
|                IntermediateIdentityLabel = any(IntermediateIdentityLabel),
|
|                Hop1Edge = any(Hop1_EdgeLabel),
|                Hop2Edge = any(Hop2_EdgeLabel),
|
|                FinalTargetName  = any(FinalTargetName),
|                FinalTargetLabel = any(FinalTargetLabel)
|              by
|                CredentialNodeId,
|                IntermediateIdentityId,
|                FinalTargetId;
|
|        // Step 7  Enrich source target intermediate and credential using Nodes catalog
|        let DetailedEnriched =
|            Detailed
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    TargetNodeId                = NodeId,
|                    TargetNodeCiKey = NodeCiKey,
|                    TargetRiskFactorSet = RiskFactorSet,
|                    TargetNodeName              = NodeName,
|                    TargetNodeLabel             = NodeLabel,
|                    TargetCriticalityTier       = CriticalityTier,
|                    TargetCriticalityTierLevel  = CriticalityTierLevel,
|                    TargetIsInternetExposed     = IsInternetExposed,
|                    TargetIsExcluded            = IsExcluded,
|                    TargetAssetTierByTag        = AssetTierByTag,
|                    TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                    TargetRiskProb              = RiskFactor_Probability,
|                    TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                    TargetNodeProperties        = NodeProperties
|            ) on $left.FinalTargetId == $right.TargetNodeId
|
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    IntermediateNodeId                = NodeId,
|                    IntermediateNodeName              = NodeName,
|                    IntermediateNodeLabel             = NodeLabel,
|                    IntermediateCriticalityTier       = CriticalityTier,
|                    IntermediateCriticalityTierLevel  = CriticalityTierLevel,
|                    IntermediateIsInternetExposed     = IsInternetExposed,
|                    IntermediateIsExcluded            = IsExcluded,
|                    IntermediateAssetTierByTag        = AssetTierByTag,
|                    IntermediateLegacyEndOfSupport    = LegacyEndOfSupport,
|                    IntermediateRiskProb              = RiskFactor_Probability,
|                    IntermediateRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    IntermediateRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                    IntermediateNodeProperties        = NodeProperties
|            ) on $left.IntermediateIdentityId == $right.IntermediateNodeId
|
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    CredentialNodeId_join    = NodeId,
|                    CredentialNodeName_join  = NodeName,
|                    CredentialNodeLabel_join = NodeLabel,
|                    CredentialNodeProperties = NodeProperties
|            ) on $left.CredentialNodeId == $right.CredentialNodeId_join
|
|            // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|            // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|            | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|            // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|            // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|            // the keys its own rows have (the report field LookupNeededKeys).
|            //__SI_LOOKUP_KEYS_HERE__
|            | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|            | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|            | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                     si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|            | project-away _peerKey, peer_*
|            | where coalesce(si_in_scope_, true)
|            | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(FinalTargetId))
|            | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|            | extend TargetCriticalityTierLevel = case(TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|            // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|            | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|            | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|            | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|            | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|            | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|            | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|            | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|            | project-away _tgtRf, _tgtScore
|            | extend
|                cmdbId            = si_cmdb_id,
|                cmdbName            = si_cmdb_name,
|                cmdbCriticality     = si_cmdb_criticality,
|                cmdbDataSensitivity = si_cmdb_data_sensitivity
|
|            // GitHub sources are treated as internet exposed and low trust by default
|            // Fixes applied
|            // - SourceCriticalityTier and SourceCriticalityTierLevel were taken from Nodes join on FirstGitHubSource
|            //   but GitHub nodes often are not in Nodes catalog or lack tier, so set safe defaults directly
|            | extend SourceIsInternetExposed = true
|            | extend SourceCriticalityTier = 3
|            | extend SourceCriticalityTierLevel = "Low - tier 3"
|            | extend SourceAssetTierByTag = ""
|            | extend SourceLegacyEndOfSupport = 0
|            | extend SourceRiskProb = 0
|            | extend SourceRiskProbDetailed = ""
|            | extend SourceRiskProbDetailedScore = ""
|
|            // Step 8  Calculate tier escalation lateral movement and priority score
|            | extend TierEscalation =
|                case(
|                    isnotempty(SourceCriticalityTier) and isnotempty(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier,
|                        SourceCriticalityTier - TargetCriticalityTier,
|                    0
|                )
|            | extend IsLateralMovement = TierEscalation > 0
|            | extend LateralMovementType =
|                case(
|                    TierEscalation >= 3, "Privilege escalation large tier jump",
|                    TierEscalation == 2, "Privilege escalation two tiers",
|                    TierEscalation == 1, "Privilege escalation one tier",
|                    "Direct access same tier"
|                )
|
|            | extend TargetTierWeight =
|                case(
|                    TargetCriticalityTier == 0, 100,
|                    TargetCriticalityTier == 1, 60,
|                    TargetCriticalityTier == 2, 30,
|                    10
|                )
|            | extend EscalationWeight = TierEscalation * 10
|            | extend ExposureWeight   = iff(TargetIsInternetExposed == true, 8, 0) + 3
|            | extend SourceTierAmplifier =
|                case(
|                    SourceCriticalityTier == 0, 8,
|                    SourceCriticalityTier == 1, 5,
|                    SourceCriticalityTier == 2, 2,
|                    0
|                )
|
|            | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|
|            | extend AttackPathPriority =
|                case(
|                    AttackPathPriorityScore >= 90,  "Very High",
|                    AttackPathPriorityScore >= 60,  "High",
|                    AttackPathPriorityScore >= 30,  "Medium-High",
|                    AttackPathPriorityScore >= 15,  "Medium",
|                    "Low"
|                )
|
|            // Step 9  Build human readable AttackPath and AttackPathDetailed
|            | extend InternetExposureTarget = iff(TargetIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|            | extend InternetExposureSource = "Internet-Exposed"
|
|            | extend AttackPath =
|                strcat(
|                    FirstGitHubSourceLabel, " [", FirstGitHubSourceName, "] -> ",
|                    CredentialNodeLabel, " [", CredentialNodeName, "] -> ",
|                    IntermediateIdentityLabel, " [", IntermediateIdentity, "] -> ",
|                    FinalTargetLabel, " [", FinalTargetName, "]"
|                )
|
|            | extend AttackPathDetailed =
|                strcat(
|                    "SOURCE ", FirstGitHubSourceLabel, " [", FirstGitHubSourceName, "] ",
|                    "tier ", tostring(SourceCriticalityTier), " ", SourceCriticalityTierLevel, " | ", InternetExposureSource,
|                    iff(GitHubSourceCount > 1, strcat(" | + ", tostring(GitHubSourceCount - 1), " other GitHub source(s)"), ""),
|                    " -> CREDENTIAL ", CredentialNodeLabel, " [", CredentialNodeName, "] ",
|                    " -> IDENTITY ", IntermediateIdentityLabel, " [", IntermediateIdentity, "] ",
|                    " -> TARGET ", FinalTargetLabel, " [", FinalTargetName, "] ",
|                    "tier ", tostring(TargetCriticalityTier), " ", TargetCriticalityTierLevel, " | ", InternetExposureTarget,
|                    " | escalation ", tostring(TierEscalation),
|                    " | ", LateralMovementType
|                );
|
|        // Step 10 Emit detailed output table
|        let DetailedOutput =
|            DetailedEnriched
|            | extend SecurityDomain = "Azure"
|            | extend Category = "AttackPath_GitHubToAzure"
|            | extend Subcategory =
|                case(
|                    TierEscalation >= 3, strcat("GitHub to Tier ", tostring(TargetCriticalityTier), " - Critical Supply Chain Risk"),
|                    TierEscalation >= 2, strcat("GitHub to Tier ", tostring(TargetCriticalityTier), " - High Supply Chain Risk"),
|                    TierEscalation >= 1, strcat("GitHub to Tier ", tostring(TargetCriticalityTier), " - Moderate Supply Chain Risk"),
|                    "GitHub to Azure - Direct Access"
|                )
|            | project
|                SecurityDomain,
|                Category,
|                Subcategory,
|
|                AttackPathPriority,
|                AttackPathPriorityScore,
|                TierEscalation,
|                IsLateralMovement,
|                LateralMovementType,
|                EscalationWeight,
|                ExposureWeight,
|
|                FirstGitHubSource,
|                FirstGitHubSourceName,
|                FirstGitHubSourceLabel,
|                TotalGitHubSourcesWithCredential = GitHubSourceCount,
|                AllGitHubSources = GitHubSources,
|                GitHubSourceTypes,
|
|                CredentialNodeId,
|                CredentialNodeName,
|                CredentialNodeLabel,
|
|                IntermediateIdentityId,
|                IntermediateIdentity,
|                IntermediateIdentityType = IntermediateIdentityLabel,
|
|                FinalTargetId,
|                FinalTarget = FinalTargetName,
|                FinalTargetType = FinalTargetLabel,
|
|                CriticalityTier = TargetCriticalityTier,
|                CriticalityTierLevel = TargetCriticalityTierLevel,
|                TargetAssetTierByTag,
|                TargetIsInternetExposed,
|                TargetLegacyEndOfSupport,
|                TargetRiskProb,
|                TargetRiskProbDetailed,
|                TargetRiskProbDetailedScore,
|
|                IntermediateCriticalityTier,
|                IntermediateCriticalityTierLevel,
|                IntermediateIsInternetExposed,
|                IntermediateLegacyEndOfSupport,
|                IntermediateRiskProb,
|                IntermediateRiskProbDetailed,
|                IntermediateRiskProbDetailedScore,
|
|                Hop1Edge,
|                Hop2Edge,
|
|                AttackPath,
|                AttackPathDetailed,
|
|                IntermediateNodeProperties,
|                TargetNodeProperties,
|                CredentialNodeProperties;
|
|        // Step 11 Collapse to unique logical path
|        // Fixes applied
|        // - Collapse key uses source identity target triple but now uses stable IDs
|        // - Summary uses credential label set, impacted assets are GitHub sources
|        let CollapsedPaths =
|            DetailedEnriched
|            | extend PathKey = strcat(FirstGitHubSource, "->", IntermediateIdentityId, "->", FinalTargetId)
|            | extend SecurityDomain =
|                case(
|                    FinalTargetLabel in ("device","computer-account","microsoft.compute/virtualmachines"), "Endpoint",
|                    "Azure"
|                )
|            | extend
|                Category    = "Attack Paths",
|                SubCategory = "LateralMovement",
|                ConfigurationName = tostring(LateralMovementType),
|                SecuritySeverity  = tostring(AttackPathPriority),
|                RiskFactor_Consequence = 0
|            | summarize
|                AttackPathPriorityScore_Path = max(AttackPathPriorityScore),
|                AttackPathPriority_Path      = any(AttackPathPriority),
|
|                TargetCriticalityTier_Path      = any(TargetCriticalityTier),
|                TargetCriticalityTierLevel_Path = any(TargetCriticalityTierLevel),
|                TargetRiskProb_Path             = max(TargetRiskProb),
|
|                TargetRiskProbDetailed_Path      = any(TargetRiskProbDetailed),
|                TargetRiskProbDetailedScore_Path = any(TargetRiskProbDetailedScore),
|
|                // the FINAL TARGET's CMDB values (its CI)
|                cmdbId_Path              = any(cmdbId),
|                cmdbName_Path            = any(cmdbName),
|                cmdbCriticality_Path     = any(cmdbCriticality),
|                cmdbDataSensitivity_Path = any(cmdbDataSensitivity),
|
|                CredentialLabels_Path = make_set(tostring(CredentialNodeLabel)),
|                SourceAssets_Path     = make_set(tostring(FirstGitHubSourceName)),
|                // TargetAssets_Path is what AssetCount (dcount(FinalTargetId)) actually counts --
|                // the Azure resources under attack. ImpactedAssets below uses this so the
|                // asset-count and the asset-names match the same entity (targets).
|                TargetAssets_Path     = make_set(tostring(FinalTargetName)),
|                TotalIssues_Path      = count(),
|                TargetAssetId = any(TargetAssetId)
|              by
|                PathKey,
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                FinalTargetId;
|
|        // Step 12 Build main summary
|        // cmdbCriticality + cmdbDataSensitivity in by-clause so cmdb-bucketed rows survive
|        // (matches Summary pattern in Device_Missing_CVEs_Summary). SummaryDetail / SummaryDetailScore
|        // include them in their by-clauses too so the final left-outer joins line up.
|        let SummaryMain =
|            CollapsedPaths
|            | summarize
|                ConfigurationId = strcat_array(array_sort_asc(make_set(strcat_array(CredentialLabels_Path, ";"))), ";"),
|
|                SecuritySeverity = any(AttackPathPriority_Path),
|                CriticalityTier = toint(any(TargetCriticalityTier_Path)),
|                CriticalityTierLevel = tostring(any(TargetCriticalityTierLevel_Path)),
|
|                RiskFactor_Consequence = 0,
|                RiskFactor_Probability = max(TargetRiskProb_Path),
|
|                AssetCount   = dcount(FinalTargetId),
|                TotalIssues  = sum(TotalIssues_Path),
|
|                ImpactedAssets = strcat_array(array_sort_asc(make_set(strcat_array(TargetAssets_Path, ";"))), ";"),
|                ImpactedAssetPairs = make_set(strcat(strcat_array(TargetAssets_Path, ";"), "|", tostring(TargetAssetId)))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        // Step 13 Build probability detail summary
|        let SummaryDetail =
|            CollapsedPaths
|            | extend _d = split(tostring(TargetRiskProbDetailed_Path), ";")
|            | mv-expand _d to typeof(string)
|            | extend _d = trim(" ", _d)
|            | where isnotempty(_d)
|            | summarize
|                RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(make_set(_d)), ";"),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        // Step 14 Build probability detail score summary
|        let SummaryDetailScore =
|            CollapsedPaths
|            | extend _s = split(tostring(TargetRiskProbDetailedScore_Path), ";")
|            | mv-expand _s to typeof(string)
|            | extend _s = trim(" ", _s)
|            | where isnotempty(_s)
|            | summarize
|                RiskFactor_Probability_DetailedScore = strcat_array(array_sort_asc(make_set(_s)), ";"),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        // Step 15 Emit final collapsed output
|        SummaryMain
|        | join kind=leftouter SummaryDetail      on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        | join kind=leftouter SummaryDetailScore on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            SubCategory,
|            ConfigurationName,
|            ConfigurationId,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AssetCount,
|            TotalIssues,
|            ImpactedAssets, ImpactedAssetPairs
|        | order by
|            RiskScore_Weight_Factor desc,
|            RiskFactor_Probability desc,
|            CriticalityTier asc,
|            TotalIssues desc,
|            AssetCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, UniqueIssues, ImpactedAssetsList, ImpactedAssetIds, IssueList, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|
|    - ReportName: Attack_Paths_Detailed_Github_to_Azure_Resources
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|          | project __siNeeded = pack_array(TargetCiKey)
|      ReportPurpose: Per-row detail of credential-driven attack paths from GitHub to Azure targets, prioritized by FINAL TARGET business impact.
|        EG drives path detection + lateral-movement scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // the objects inside each subscription and resource group, from the graph's own contains edges -- a role on a scope is
|        // reported on the objects inside it, never on the scope itself (owner 2026-10-19)
|        let _SI_ScopeContains = ExposureGraphEdges
|            | where EdgeLabel =~ "contains" and SourceNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")
|            | project _ScopeNodeId = SourceNodeId, _ChildId = TargetNodeId, _ChildName = TargetNodeName, _ChildLabel = TargetNodeLabel;
|        let _SI_ScopeMembers = union
|            (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel),
|            (_SI_ScopeContains | where _ChildLabel in~ ("resourcegroups", "microsoft.resources/resourcegroups") | project _ScopeNodeId, _RgNodeId = _ChildId
|                | join kind=inner (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _RgNodeId = _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel) on _RgNodeId
|                | project _ScopeNodeId, _MemberId, _MemberName, _MemberLabel)
|            | summarize _MemberName = take_any(_MemberName), _MemberLabel = take_any(_MemberLabel) by _ScopeNodeId, _MemberId;
|        // =================================================================================================
|        // REPORT  Credential driven attack paths from GitHub to Azure using Exposure Graph
|        // =================================================================================================
|        //
|        // Report purpose
|        // Identify credentials stored in GitHub workflows or repositories and trace credential driven
|        // attack paths into Azure targets. Paths are prioritized by the business impact of the FINAL TARGET.
|        //
|        // Interpretation guard and priority rules
|        // - Priority is driven by the TARGET criticality tier first
|        // - Then by tier escalation where source tier is higher than target tier
|        // - Then by Internet exposure where target exposure is weighted higher than source exposure
|        // - GitHub sources are treated as Internet exposed and low trust by default
|        // - A low tier source can never outrank a tier 0 or tier 1 target
|        //
|        // Output description
|        // One row per unique credential to target attack path enriched with
|        // - Internet exposure flags
|        // - Asset tier from tags
|        // - Legacy operating system and end of support signals
|        // - Risk factor probability including detailed breakdown
|        // - Attack path priority score and severity
|        // - Human readable attack path strings
|        //
|        // Query steps overview
|        // Step 0  Define legacy operating system reference lists
|        // Step 1  Build Nodes catalog as enrichment backbone
|        // Step 2  Normalize node labels to avoid filter issues
|        // Step 3  Identify credentials stored in GitHub workflows and repositories
|        // Step 4  Hop 1 credential authenticates as an identity
|        // Step 5  Hop 2 identity can reach Azure target resources
|        // Step 6  De duplicate attack paths to a stable grain
|        // Step 7  Enrich source and target nodes using Nodes catalog
|        // Step 8  Calculate tier escalation lateral movement and priority score
|        // Step 9  Build human readable AttackPath and AttackPathDetailed
|        // Step 10 Project final report columns and apply ordering
|        // =================================================================================================
|
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Build node catalog used to enrich attack paths (UPDATED to match your standard context)
|        let Nodes =
|            ExposureGraphNodes
|            | extend CategoriesStr = tolower(tostring(Categories))
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend DeviceKey = NodeCiKey
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|
|            // Criticality extraction from multiple possible fields
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend CriticalityRuleBased =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.ruleBasedCriticalityLevel)
|                ))
|            | extend EgCriticalityRuleNames =
|                coalesce(
|                    strcat_array(NodeProperties.criticalityLevelProps[0].ruleNames, ", "),
|                    strcat_array(NodeProperties.rawData.criticalityLevel.ruleNames, ", "),
|                    ""
|                )
|
|            // Internet exposure flag derived from graph property isCustomerFacing renamed
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    NodeProperties.rawData.isCustomerFacing,
|                    NodeProperties.raw.isCustomerFacing,
|                    false
|                ))
|
|            // Exclusion flag
|            | extend IsExcluded =
|                tobool(coalesce(
|                    NodeProperties.rawData.isExcluded,
|                    NodeProperties.raw.isExcluded,
|                    false
|                ))
|
|            // Normalize rawData and raw for tag and OS reading
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|
|            // AssetTierByTag preferred bag key AssetTier fallback tag array scan
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|
|            // the exclusion tags (the scope block, from the Exclusions page and the shipped list)
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|
|            // Tag fallback mapping only used when Defender criticality is missing
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|
|            // Prefer Defender criticality over tag
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            | extend CriticalityTier = toint(coalesce(CriticalityTierFromTag, 3))
|            | extend CriticalityTierLevel =
|                case(
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|
|            // LegacyEndOfSupport detection same as CVE report
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|
|            // Risk factors on nodes count distinct plus Internet-Exposed plus LegacyEoS
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    NodeProperties.rawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|
|            | mv-apply rf = array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                ) on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize ScoreParts = make_set(strcat(tostring(rf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName          = NodeNameNorm,
|                NodeLabel,
|                Categories        = CategoriesStr,
|                NodeProperties,
|                EgCriticalityLevel,
|                CriticalityTier,
|                CriticalityTierLevel,
|                CriticalityRuleBased,
|                EgCriticalityRuleNames,
|                IsInternetExposed,
|                IsExcluded,
|                EgNodeTags,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactorsArray,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence;
|
|        // Step 2  Normalize labels to avoid typos breaking filters
|        let NormalizeLabel = (s:string) { tolower(trim(" ", replace_string(s, " ", ""))) };
|
|        // Step 3  Find credentials in GitHub workflows/repositories
|        let GitHubCredentials =
|            ExposureGraphEdges
|            | where EdgeLabel in ("contains", "defined in")
|            | extend SourceNodeLabelNorm = NormalizeLabel(SourceNodeLabel),
|                     TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where SourceNodeLabelNorm in ("githubworkflow", "githubrepository")
|            | where TargetNodeLabelNorm in (
|                "azure-active-directory-app-secret",
|                "user-azure-cli-secret",
|                "azure-storage-shared-access-signature",
|                "azure-storage-connection-string",
|                "azure-database-connection-string",
|                "azure-active-directory-user-credentials",
|                "service-principal-azure-cli-secret",
|                "azure-app-configuration-key"
|            )
|            | project
|                SourceGitHubNodeId    = SourceNodeId,
|                SourceGitHubNodeName  = SourceNodeName,
|                SourceGitHubNodeLabel = SourceNodeLabel,
|                CredentialNodeId      = TargetNodeId,
|                CredentialNodeName    = TargetNodeName,
|                CredentialNodeLabel   = TargetNodeLabel
|            | summarize
|                GitHubSources          = make_set(SourceGitHubNodeName),
|                GitHubSourceTypes      = make_set(SourceGitHubNodeLabel),
|                GitHubSourceCount      = dcount(SourceGitHubNodeId),
|                FirstGitHubSource      = any(SourceGitHubNodeId),
|                FirstGitHubSourceName  = any(SourceGitHubNodeName),
|                FirstGitHubSourceLabel = any(SourceGitHubNodeLabel),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by CredentialNodeId, CredentialNodeName, CredentialNodeLabel;
|
|        // v2.2.419 (audit #56.2b) -- hop-bounding sets. This variant expresses its hops as INLINE
|        // join subqueries rather than named lets, so the bounds are hoisted here to be referenced
|        // below. Without them each hop scanned every matching edge in the tenant, because a join
|        // constrains the RESULT and not the SCAN. Same defect and same lossless remedy as #56.
|        let _GhCredIds = GitHubCredentials | distinct CredentialNodeId;
|        let _GhHop1IdentityIds =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has credentials of", "can authenticate as", "can authenticate to")
|            | where SourceNodeId in (_GhCredIds)
|            | distinct TargetNodeId;
|
|        // Step 4  Main attack path query GitHub Credential -> Identity
|        GitHubCredentials
|        | join kind=inner (
|            ExposureGraphEdges
|            | where EdgeLabel in ("has credentials of", "can authenticate as", "can authenticate to")
|            // bound to the credentials found in Step 3 -- exactly what the ON clause below requires
|            | where SourceNodeId in (_GhCredIds)
|            | project
|                Hop1_SourceCredentialId = SourceNodeId,
|                Hop1_EdgeLabel          = EdgeLabel,
|                IntermediateIdentityId  = TargetNodeId,
|                IntermediateIdentity    = TargetNodeName,
|                IntermediateIdentityLabel = TargetNodeLabel
|        ) on $left.CredentialNodeId == $right.Hop1_SourceCredentialId
|
|        // Step 5  Hop 2 Identity -> Azure Target
|        | join kind=inner (
|            ExposureGraphEdges
|            | where EdgeLabel in ("can authenticate to", "has permissions to", "has role on")
|            // bound to the identities Hop 1 reached -- exactly what the ON clause below requires
|            | where SourceNodeId in (_GhHop1IdentityIds)
|            // #677 the slices are cut on the path's FINAL TARGET (TargetNodeId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            // a subscription or resource group target is replaced by the objects inside it -- once per object, so an object reached
|            // directly and through its resource group and subscription is one path (owner 2026-10-19)
|            | join kind=leftouter (_SI_ScopeMembers) on $left.TargetNodeId == $right._ScopeNodeId
|            | where isnotempty(_MemberId) or not(TargetNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups"))
|            | extend TargetNodeId = iff(isnotempty(_MemberId), _MemberId, TargetNodeId), TargetNodeName = iff(isnotempty(_MemberId), _MemberName, TargetNodeName), TargetNodeLabel = iff(isnotempty(_MemberId), _MemberLabel, TargetNodeLabel)
|            | extend _SI_ViaScope = isnotempty(_MemberId)
|            | project-away _ScopeNodeId, _MemberId, _MemberName, _MemberLabel
|            | extend DeviceKey = TargetNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | extend TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where _SI_ViaScope or TargetNodeLabelNorm in (
|                "microsoft.compute/virtualmachines",
|                "microsoft.storage/storageaccounts",
|                "microsoft.keyvault/vaults",
|                "microsoft.sql/servers",
|                "microsoft.sql/servers/databases",
|                "microsoft.cognitiveservices/accounts",
|                "microsoft.cognitiveservices/accounts_openai",
|                "subscriptions",
|                "resourcegroups",
|                "blobcontainer"
|            )
|            | project
|                Hop2_SourceIdentityId = SourceNodeId,
|                Hop2_EdgeLabel        = EdgeLabel,
|                FinalTargetId         = TargetNodeId,
|                FinalTargetName       = TargetNodeName,
|                FinalTargetLabel      = TargetNodeLabel
|        ) on $left.IntermediateIdentityId == $right.Hop2_SourceIdentityId
|
|        // Optional avoid ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Â ÃƒÂ¢Ã¢â€šÂ¬Ã¢â€žÂ¢ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã†â€™Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã¢â‚¬Â¦Ãƒâ€šÃ‚Â¡ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â‚¬Å¡Ã‚Â¬Ãƒâ€šÃ‚Â¦ÃƒÆ’Ã†â€™Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã¢â‚¬Â¦ÃƒÂ¢Ã¢â€šÂ¬Ã…â€œGitHub sourceÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Â ÃƒÂ¢Ã¢â€šÂ¬Ã¢â€žÂ¢ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã†â€™Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã¢â‚¬Â¦Ãƒâ€šÃ‚Â¡ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â‚¬Å¡Ã‚Â¬Ãƒâ€¦Ã‚Â¡ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â == ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Â ÃƒÂ¢Ã¢â€šÂ¬Ã¢â€žÂ¢ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã†â€™Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã¢â‚¬Â¦Ãƒâ€šÃ‚Â¡ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â‚¬Å¡Ã‚Â¬Ãƒâ€šÃ‚Â¦ÃƒÆ’Ã†â€™Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã¢â‚¬Â¦ÃƒÂ¢Ã¢â€šÂ¬Ã…â€œtarget assetÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Â ÃƒÂ¢Ã¢â€šÂ¬Ã¢â€žÂ¢ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã†â€™Ãƒâ€šÃ‚Â¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã¢â‚¬Â¦Ãƒâ€šÃ‚Â¡ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã†â€™Ãƒâ€ Ã¢â‚¬â„¢ÃƒÆ’Ã‚Â¢ÃƒÂ¢Ã¢â‚¬Å¡Ã‚Â¬Ãƒâ€¦Ã‚Â¡ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â scenarios (usually not needed but safe)
|        | where FirstGitHubSource != FinalTargetId
|
|        // Step 6  De-duplicate to stable grain
|        | summarize
|            GitHubSources          = any(GitHubSources),
|            GitHubSourceTypes      = any(GitHubSourceTypes),
|            GitHubSourceCount      = any(GitHubSourceCount),
|            FirstGitHubSource      = any(FirstGitHubSource),
|            FirstGitHubSourceName  = any(FirstGitHubSourceName),
|            FirstGitHubSourceLabel = any(FirstGitHubSourceLabel),
|
|            CredentialNodeName     = any(CredentialNodeName),
|            CredentialNodeLabel    = any(CredentialNodeLabel),
|
|            IntermediateIdentityId    = any(IntermediateIdentityId),
|            IntermediateIdentity      = any(IntermediateIdentity),
|            IntermediateIdentityLabel = any(IntermediateIdentityLabel),
|
|            Hop1Edge = any(Hop1_EdgeLabel),
|            Hop2Edge = any(Hop2_EdgeLabel),
|
|            FinalTargetName  = any(FinalTargetName),
|            FinalTargetLabel = any(FinalTargetLabel)
|          by CredentialNodeId, FinalTargetId
|
|        // Step 7  Enrich SOURCE + TARGET using Nodes (context-standard fields)
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                SourceNodeId                = NodeId,
|                SourceNodeCiKey = NodeCiKey,
|                SourceNodeName              = NodeName,
|                SourceNodeLabel             = NodeLabel,
|                SourceCriticalityTier       = CriticalityTier,
|                SourceCriticalityTierLevel  = CriticalityTierLevel,
|                SourceIsInternetExposed     = IsInternetExposed,
|                SourceIsExcluded            = IsExcluded,
|                SourceAssetTierByTag        = AssetTierByTag,
|                SourceLegacyEndOfSupport    = LegacyEndOfSupport,
|                SourceRiskProb              = RiskFactor_Probability,
|                SourceRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                SourceRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                SourceNodeProperties        = NodeProperties
|        ) on $left.FirstGitHubSource == $right.SourceNodeId
|
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                TargetNodeId                = NodeId,
|                TargetNodeCiKey = NodeCiKey,
|                TargetRiskFactorSet = RiskFactorSet,
|                TargetNodeName              = NodeName,
|                TargetNodeLabel             = NodeLabel,
|                TargetCriticalityTier       = CriticalityTier,
|                TargetCriticalityTierLevel  = CriticalityTierLevel,
|                TargetIsInternetExposed     = IsInternetExposed,
|                TargetIsExcluded            = IsExcluded,
|                TargetAssetTierByTag        = AssetTierByTag,
|                TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                TargetRiskProb              = RiskFactor_Probability,
|                TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                TargetNodeProperties        = NodeProperties
|        ) on $left.FinalTargetId == $right.TargetNodeId
|
|        // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|        // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|        // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|        // the keys its own rows have (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(si_in_scope_, true)
|        | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(FinalTargetId))
|        | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|        | extend TargetCriticalityTierLevel = case(TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|        | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|        // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|
|        // Step 8  Apply your standard prioritization logic (GitHub treated as Internet-exposed / low trust)
|        | extend
|            // GitHub is internet-facing by default (override if Nodes is missing or false)
|            SourceIsInternetExposed = true,
|            // GitHub treated as low trust force source tier=3 if Nodes did not map it
|            SourceCriticalityTier   = toint(coalesce(SourceCriticalityTier, 3)),
|            SourceCriticalityTierLevel = tostring(coalesce(SourceCriticalityTierLevel, "Low - tier 3"))
|
|        // Tier escalation (only if source tier > target tier)
|        | extend TierEscalation =
|            case(
|                isnotempty(SourceCriticalityTier) and isnotempty(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier,
|                    SourceCriticalityTier - TargetCriticalityTier,
|                0
|            )
|        | extend IsLateralMovement = TierEscalation > 0
|        | extend LateralMovementType =
|            case(
|                TierEscalation >= 3, "Privilege escalation large tier jump",
|                TierEscalation == 2, "Privilege escalation two tiers",
|                TierEscalation == 1, "Privilege escalation one tier",
|                "Direct access same tier"
|            )
|
|        // Standard AttackPathPriorityScore components
|        | extend TargetTierWeight =
|            case(
|                TargetCriticalityTier == 0, 100,
|                TargetCriticalityTier == 1, 60,
|                TargetCriticalityTier == 2, 30,
|                10
|            )
|        | extend EscalationWeight = TierEscalation * 10
|        | extend ExposureWeight   = iff(TargetIsInternetExposed == true, 8, 0) + iff(SourceIsInternetExposed == true, 3, 0)
|        | extend SourceTierAmplifier =
|            case(
|                SourceCriticalityTier == 0, 8,
|                SourceCriticalityTier == 1, 5,
|                SourceCriticalityTier == 2, 2,
|                0
|            )
|        | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|
|        | extend AttackPathPriority =
|            case(
|                AttackPathPriorityScore >= 90,  "Very High",
|                AttackPathPriorityScore >= 60,  "High",
|                AttackPathPriorityScore >= 30,  "Medium-High",
|                AttackPathPriorityScore >= 15,  "Medium",
|                "Low"
|            )
|
|        // Step 9  Human readable paths and Internet-Exposed wording
|        | extend InternetExposureTarget = iff(TargetIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|        | extend InternetExposureSource = iff(SourceIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|
|        | extend AttackPath =
|            strcat(
|                FirstGitHubSourceLabel, " [", FirstGitHubSourceName, "] -> ",
|                CredentialNodeLabel, " [", CredentialNodeName, "] -> ",
|                IntermediateIdentityLabel, " [", IntermediateIdentity, "] -> ",
|                FinalTargetLabel, " [", FinalTargetName, "]"
|            )
|
|        | extend AttackPathDetailed =
|            strcat(
|                "SOURCE ", FirstGitHubSourceLabel, " [", FirstGitHubSourceName, "] ",
|                "tier ", tostring(SourceCriticalityTier), " ", SourceCriticalityTierLevel, " | ", InternetExposureSource,
|                iff(GitHubSourceCount > 1, strcat(" | + ", tostring(GitHubSourceCount - 1), " other GitHub source(s)"), ""),
|                " -> CREDENTIAL ", CredentialNodeLabel, " [", CredentialNodeName, "] ",
|                " -> IDENTITY ", IntermediateIdentityLabel, " [", IntermediateIdentity, "] ",
|                " -> TARGET ", FinalTargetLabel, " [", FinalTargetName, "] ",
|                "tier ", tostring(TargetCriticalityTier), " ", TargetCriticalityTierLevel, " | ", InternetExposureTarget,
|                " | escalation ", tostring(TierEscalation),
|                " | ", LateralMovementType
|            )
|
|        // Final projection (keeps your original taxonomy fields but aligned to the context-standard logic)
|        | extend SecurityDomain = "Azure"
|        | extend Category = "AttackPath_GitHubToAzure"
|        | extend Subcategory =
|            case(
|                TierEscalation >= 3, strcat("GitHub to Tier ", tostring(TargetCriticalityTier), " - Critical Supply Chain Risk"),
|                TierEscalation >= 2, strcat("GitHub to Tier ", tostring(TargetCriticalityTier), " - High Supply Chain Risk"),
|                TierEscalation >= 1, strcat("GitHub to Tier ", tostring(TargetCriticalityTier), " - Moderate Supply Chain Risk"),
|                "GitHub to Azure - Direct Access"
|            )
|        // Per-row identity columns expected by engine dedup (AssetName, ConfigurationName/Id).
|        // ConfigurationId carries the FINAL TARGET id so (AssetName, ConfigurationId) is unique per row.
|        | extend
|            AssetName         = FinalTargetName,
|            AssetLabel        = FinalTargetLabel,
|            ConfigurationName = tostring(LateralMovementType),
|            ConfigurationId   = tostring(FinalTargetId),
|            SecuritySeverity  = tostring(AttackPathPriority),
|            Impact            = todouble(AttackPathPriorityScore),
|            CriticalityTier      = TargetCriticalityTier,
|            CriticalityTierLevel = TargetCriticalityTierLevel,
|            RiskFactor_Consequence = 0,
|            RiskFactor_Probability = TargetRiskProb,
|            RiskFactor_Probability_Detailed      = TargetRiskProbDetailed,
|            RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            Subcategory,
|            ConfigurationName,
|            ConfigurationId,
|            AssetName,
|            AssetId=coalesce(column_ifexists("AssetId", ""), column_ifexists("TargetAssetId", ""), column_ifexists("ConfigurationId", "")),
|            AssetType=coalesce(column_ifexists("AssetType", ""), column_ifexists("AssetLabel", ""), "Azure"),
|            Impact,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AttackPath,
|            AttackPathDetailed,
|            AttackPathPriority,
|            AttackPathPriorityScore,
|            TierEscalation,
|            IsLateralMovement,
|            LateralMovementType,
|            FirstGitHubSource,
|            FirstGitHubSourceName,
|            FirstGitHubSourceLabel,
|            TotalGitHubSourcesWithCredential = GitHubSourceCount,
|            AllGitHubSources = GitHubSources,
|            GitHubSourceTypes,
|            CredentialNodeId,
|            CredentialNodeName,
|            CredentialNodeLabel,
|            IntermediateIdentityId,
|            IntermediateIdentity,
|            IntermediateIdentityType = IntermediateIdentityLabel,
|            FinalTargetId,
|            FinalTarget = FinalTargetName,
|            FinalTargetType = FinalTargetLabel,
|            TargetAssetTierByTag,
|            TargetIsInternetExposed,
|            TargetLegacyEndOfSupport,
|            SourceAssetTierByTag,
|            SourceLegacyEndOfSupport,
|            Hop1Edge,
|            Hop2Edge,
|            SourceNodeProperties,
|            TargetNodeProperties
|        | order by RiskScore_Weight_Factor desc, AttackPathPriorityScore desc, TierEscalation desc, CriticalityTier asc, AssetName asc, ConfigurationId asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_Public_IP_to_VM_with_CVE_Exploitation
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(ExposedResourceNodeId)))
|          | project __siNeeded = pack_array(TargetCiKey)
|      ReportPurpose: Internet-exposed vulnerable assets prioritized by FINAL TARGET business impact.
|        EG provides the path detection (PublicIP -> ExposedResource <- CVE) + scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - UniqueIssues
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - IssueList
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "has_secret": "ClientSecret", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  Internet exposed assets with vulnerabilities using Exposure Graph
|        // =================================================================================================
|        //
|        // Report purpose
|        // Identify Azure and endpoint resources that are connected to Public IP addresses and are affected by CVEs.
|        // Each finding represents an internet reachable resource with at least one known vulnerability.
|        // Results are prioritized by the business impact of the exposed resource and by CVE severity signals.
|        //
|        // Interpretation guard and priority rules
|        // - Priority is driven by the exposed TARGET resource criticality tier first
|        // - Internet exposure is implied by the presence of a Public IP connection
|        // - CVE severity increases priority as an additional amplifier
|        // - Target criticality tier comes from Defender criticality when present with tag fallback
|        // - RiskFactor probability is derived from graph risk factors plus Internet-Exposed plus LegacyEndOfSupport
|        //
|        // Output description detailed table
|        // One row per unique PublicIP -> ExposedResource -> CVE combination enriched with
|        // - Target criticality tier and tier label
|        // - Target Internet exposure flags and tag derived asset tier
|        // - Target legacy OS end of support signal
|        // - Target risk probability including detailed breakdown fields
|        // - CVE severity text and a numeric CVESeverityScore
|        // - Priority score and mapped severity label
|        // - Human readable AttackPath and AttackPathDetailed strings
|        //
|        // Output description collapsed summary
|        // One row per report grain grouped by SecurityDomain Category SubCategory ConfigurationName where
|        // - Duplicate paths are collapsed so repeated Public IPs or CVEs do not inflate counts
|        // - ConfigurationId becomes a semicolon list of distinct CVE names in the group
|        // - ImpactedAssets becomes a semicolon list of distinct exposed resources
|        // - RiskFactor_Probability_Detailed fields are preserved via split expand and re aggregation
|        //
|        // Query steps overview
|        // Step 0  Define legacy operating system reference lists
|        // Step 1  Build Nodes catalog as enrichment backbone
|        // Step 2  Normalize node labels to avoid filter issues
|        // Step 3  Identify Public IP connections to resources
|        // Step 4  Identify CVEs affecting resources
|        // Step 5  Join Public IP connections with CVE affected resources and de duplicate to stable grain
|        // Step 6  Enrich exposed resource using Nodes and enrich CVE node for severity text
|        // Step 7  Compute CVE severity score and target tier weighted priority score
|        // Step 8  Create AttackPath and AttackPathDetailed strings and project detailed output table
|        // Step 9  Create DetailedForSummary table with only required columns for collapsing
|        // Step 10 Collapse to unique logical PathKey to prevent count inflation
|        // Step 11 Build SummaryMain counts and key fields
|        // Step 12 Re build RiskFactor_Probability_Detailed and DetailedScore via split expand and re aggregation
|        // Step 13 Join summary parts and output final collapsed summary ordering
|        // =================================================================================================
|
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "exploit_available", "exploit_kit", "has_secret", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "multitenant_app", "network_no_user_action", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "publisher_not_verified", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "exploit_available", "exploit_kit", "has_secret", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "multitenant_app", "network_no_user_action", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "publisher_not_verified", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "has_secret": "ClientSecret", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Build node catalog used to enrich attack paths
|        let Nodes =
|            ExposureGraphNodes
|            | extend CategoriesStr = tolower(tostring(Categories))
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|
|            | extend AssetName = NodeNameNorm
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend DeviceKey = NodeCiKey
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend CriticalityRuleBased =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.ruleBasedCriticalityLevel)
|                ))
|            | extend EgCriticalityRuleNames =
|                coalesce(
|                    strcat_array(NodeProperties.criticalityLevelProps[0].ruleNames, ", "),
|                    strcat_array(NodeProperties.rawData.criticalityLevel.ruleNames, ", "),
|                    ""
|                )
|
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    NodeProperties.rawData.isCustomerFacing,
|                    NodeProperties.raw.isCustomerFacing,
|                    false
|                ))
|
|            | extend IsExcluded =
|                tobool(coalesce(
|                    NodeProperties.rawData.isExcluded,
|                    NodeProperties.raw.isExcluded,
|                    false
|                ))
|
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|
|            // the exclusion tags (the scope block, from the Exclusions page and the shipped list)
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            | extend CriticalityTier = toint(coalesce(CriticalityTierFromTag, 3))
|            | extend CriticalityTierLevel =
|                case(
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    NodeProperties.rawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|
|            | mv-apply rf = array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                ) on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize ScoreParts = make_set(strcat(tostring(rf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|
|            // CVESeverity only makes sense for CVE nodes but keeping it for compatibility
|            | extend CVESeverity =
|                tostring(coalesce(
|                    NodeProperties.rawData.severity,
|                    NodeProperties.rawData.Severity,
|                    NodeProperties.rawData.cvssScore,
|                    ""
|                ))
|
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName          = NodeNameNorm,
|                NodeLabel,
|                Categories        = CategoriesStr,
|                NodeProperties,
|                EgCriticalityLevel,
|                CriticalityTier,
|                CriticalityTierLevel,
|                CriticalityRuleBased,
|                EgCriticalityRuleNames,
|                IsInternetExposed,
|                IsExcluded,
|                EgNodeTags,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactorsArray,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence,
|                CVESeverity;
|
|        // Step 2  Normalize labels to avoid typos breaking filters
|        let NormalizeLabel = (s:string) { tolower(trim(" ", replace_string(s, " ", ""))) };
|
|        // Step 3  Find Public IPs connected to resources
|        // Fixes applied
|        // - Public IP edges can point in either direction, include both directions (union)
|        // - Include NIC pivot without losing VM mapping (keep NIC as an exposed resource too)
|        // - The graph's routing nodes are labelled "IP address" (an Azure public IP resource is
|        //   microsoft.network/publicipaddresses) -- both, compared ignoring case
|        // - A network interface the address routes to is followed one hop to its machine, and the machine is tied to the
|        //   graph node of the same name that carries its CVEs (a virtual-machine node and a node with the Defender device id)
|        let PublicIPConnections_Forward =
|            ExposureGraphEdges
|            | where SourceNodeLabel in~ ("microsoft.network/publicipaddresses", "IP address")
|            | where EdgeLabel in~ ("routes traffic to", "contains", "connected to", "assigned to")
|            | project
|                PublicIPNodeId           = SourceNodeId,
|                PublicIPNodeName         = SourceNodeName,
|                ExposedResourceNodeId    = TargetNodeId,
|                ExposedResourceNodeName  = TargetNodeName,
|                ExposedResourceNodeLabel = TargetNodeLabel;
|
|        let PublicIPConnections_Reverse =
|            ExposureGraphEdges
|            | where TargetNodeLabel in~ ("microsoft.network/publicipaddresses", "IP address")
|            | where EdgeLabel in~ ("routes traffic to", "contains", "connected to", "assigned to")
|            | project
|                PublicIPNodeId           = TargetNodeId,
|                PublicIPNodeName         = TargetNodeName,
|                ExposedResourceNodeId    = SourceNodeId,
|                ExposedResourceNodeName  = SourceNodeName,
|                ExposedResourceNodeLabel = SourceNodeLabel;
|
|        let _PublicIpDirect = union isfuzzy=true PublicIPConnections_Forward, PublicIPConnections_Reverse;
|        let _NicToMachine =
|            ExposureGraphEdges
|            | where SourceNodeLabel =~ "microsoft.network/networkinterfaces"
|            | where EdgeLabel =~ "routes traffic to"
|            | where NormalizeLabel(TargetNodeLabel) in ("microsoft.compute/virtualmachines", "device")
|            | project NicNodeId = SourceNodeId, MachineNodeId = TargetNodeId, MachineNodeName = TargetNodeName, MachineNodeLabel = TargetNodeLabel;
|        let _PublicIpMachines =
|            union
|                (_PublicIpDirect | project PublicIPNodeId, PublicIPNodeName, MachineNodeId = ExposedResourceNodeId, MachineNodeName = ExposedResourceNodeName, MachineNodeLabel = ExposedResourceNodeLabel),
|                (_PublicIpDirect | join kind=inner (_NicToMachine) on $left.ExposedResourceNodeId == $right.NicNodeId | project PublicIPNodeId, PublicIPNodeName, MachineNodeId, MachineNodeName, MachineNodeLabel);
|        let _CveCarrierNodes =
|            ExposureGraphEdges
|            | where SourceNodeLabel =~ "Cve"
|            | where EdgeLabel =~ "affecting"
|            | where NormalizeLabel(TargetNodeLabel) in ("microsoft.compute/virtualmachines", "device")
|            | project CarrierNodeId = TargetNodeId, CarrierNodeName = TargetNodeName, CarrierNodeLabel = TargetNodeLabel
|            | distinct CarrierNodeId, CarrierNodeName, CarrierNodeLabel
|            | extend _carrierName = tolower(CarrierNodeName)
|            | where isnotempty(_carrierName);
|        let _PublicIpExposed =
|            union
|                (_PublicIpMachines | project PublicIPNodeId, PublicIPNodeName, ExposedResourceNodeId = MachineNodeId, ExposedResourceNodeName = MachineNodeName, ExposedResourceNodeLabel = MachineNodeLabel),
|                (_PublicIpMachines
|                    | where NormalizeLabel(MachineNodeLabel) in ("microsoft.compute/virtualmachines", "device")
|                    | extend _machineName = tolower(MachineNodeName)
|                    | join kind=inner (_CveCarrierNodes) on $left._machineName == $right._carrierName
|                    | where CarrierNodeId != MachineNodeId
|                    | project PublicIPNodeId, PublicIPNodeName, ExposedResourceNodeId = CarrierNodeId, ExposedResourceNodeName = CarrierNodeName, ExposedResourceNodeLabel = CarrierNodeLabel);
|
|        let PublicIPConnections =
|            _PublicIpExposed
|            | extend ExposedLabelNorm = NormalizeLabel(ExposedResourceNodeLabel)
|            | where ExposedLabelNorm in (
|                "microsoft.network/networkinterfaces",
|                "microsoft.compute/virtualmachines",
|                "device",
|                "computer-account"
|            )
|            | summarize
|                PublicIPs         = make_set(PublicIPNodeName),
|                PublicIPCount     = dcount(PublicIPNodeId),
|                FirstPublicIPId   = any(PublicIPNodeId),
|                FirstPublicIPName = any(PublicIPNodeName),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by ExposedResourceNodeId, ExposedResourceNodeName, ExposedResourceNodeLabel
|            // #677 the slices are cut on the path's FINAL TARGET (ExposedResourceNodeId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            | extend DeviceKey = ExposedResourceNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | project-away DeviceKey;
|
|        // Step 3b  The CVEs in scope -- the customer CVE filters (SI_CVE_MinSeverity / MinCvssScore / RequireExploit /
|        // MaxPublishedAgeDays, substituted by the engine) and the report exclusions (excluded CVEs, minimum age)
|        let _ScopedCveNodeIds =
|            ExposureGraphNodes
|            | where NodeLabel =~ "Cve" or NodeLabel startswith "cve"
|              //__CVE_FILTER_BEGIN__
|              | where 1 == 1
|              //__CVE_FILTER_END__
|            | where SI_InScopeCve(NodeName, todatetime(coalesce(NodeProperties.rawData.lastModifiedDate, NodeProperties.raw.lastModifiedDate)))
|            | distinct NodeId;
|
|        // Step 4  Find CVEs affecting resources
|        // Fixes applied
|        // - CVE edges can point either direction depending on graph shape, include both directions
|        let CVEsAffectingResources_Forward =
|            ExposureGraphEdges
|            | where SourceNodeLabel == "Cve"
|            | where EdgeLabel == "affecting"
|            | project
|                CVENodeId                 = SourceNodeId,
|                CVENodeName               = SourceNodeName,
|                AffectedResourceNodeId    = TargetNodeId,
|                AffectedResourceNodeName  = TargetNodeName,
|                AffectedResourceNodeLabel = TargetNodeLabel;
|
|        let CVEsAffectingResources_Reverse =
|            ExposureGraphEdges
|            | where TargetNodeLabel == "Cve"
|            | where EdgeLabel == "affecting"
|            | project
|                CVENodeId                 = TargetNodeId,
|                CVENodeName               = TargetNodeName,
|                AffectedResourceNodeId    = SourceNodeId,
|                AffectedResourceNodeName  = SourceNodeName,
|                AffectedResourceNodeLabel = SourceNodeLabel;
|
|        let CVEsAffectingResources =
|            union isfuzzy=true CVEsAffectingResources_Forward, CVEsAffectingResources_Reverse
|            | where CVENodeId in (_ScopedCveNodeIds)
|            | extend TargetNodeLabelNorm = NormalizeLabel(AffectedResourceNodeLabel)
|            | where TargetNodeLabelNorm in (
|                "microsoft.compute/virtualmachines",
|                "device",
|                "computer-account",
|                "microsoft.network/networkinterfaces"
|            )
|            | summarize
|                CVEs         = make_set(CVENodeName),
|                CVECount     = dcount(CVENodeId),
|                FirstCVEId   = any(CVENodeId),
|                FirstCVEName = any(CVENodeName),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by AffectedResourceNodeId, AffectedResourceNodeName, AffectedResourceNodeLabel;
|
|        // Step 5  Join Public IP connections with CVE affected resources and de duplicate to stable grain
|        // Fixes applied
|        // - Original summarize grouped by ExposedResourceNodeId but also by FirstPublicIPId and FirstCVEId
|        //   which are aggregated values and can create unstable grains
|        // - Stable grain should be (PublicIPNodeId, ExposedResourceNodeId, CVENodeId)
|        let Paths =
|            PublicIPConnections
|            | join kind=inner (CVEsAffectingResources) on $left.ExposedResourceNodeId == $right.AffectedResourceNodeId
|            | extend PublicIPNodeId = FirstPublicIPId
|            | extend CVENodeId      = FirstCVEId
|            | summarize
|                PublicIPs               = any(PublicIPs),
|                PublicIPCount           = any(PublicIPCount),
|                FirstPublicIPName       = any(FirstPublicIPName),
|
|                CVEs                    = any(CVEs),
|                CVECount                = any(CVECount),
|                FirstCVEName            = any(FirstCVEName),
|
|                ExposedResourceNodeName  = any(ExposedResourceNodeName),
|                ExposedResourceNodeLabel = any(ExposedResourceNodeLabel)
|              by
|                PublicIPNodeId,
|                ExposedResourceNodeId,
|                CVENodeId;
|
|        // Step 6  Enrich exposed resource using Nodes and enrich CVE node for severity text
|        // Step 7  Compute CVE severity score and target tier weighted priority score
|        // Step 8  Create AttackPath and AttackPathDetailed strings and project detailed output table
|        let Detailed =
|            Paths
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    TargetNodeId                = NodeId,
|                    TargetNodeCiKey = NodeCiKey,
|                    TargetRiskFactorSet = RiskFactorSet,
|                    TargetNodeName              = NodeName,
|                    TargetNodeLabel             = NodeLabel,
|                    TargetCriticalityTier       = CriticalityTier,
|                    TargetCriticalityTierLevel  = CriticalityTierLevel,
|                    TargetCriticalityRuleBased  = CriticalityRuleBased,
|                    TargetCriticalityRuleNames  = EgCriticalityRuleNames,
|                    TargetIsInternetExposed     = IsInternetExposed,
|                    TargetIsExcluded            = IsExcluded,
|                    TargetAssetTierByTag        = AssetTierByTag,
|                    TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                    TargetRiskProb              = RiskFactor_Probability,
|                    TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                    TargetNodeProperties        = NodeProperties
|            ) on $left.ExposedResourceNodeId == $right.TargetNodeId
|
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    PublicIPNodeId_join    = NodeId,
|                    PublicIPNodeName_join  = NodeName,
|                    PublicIPNodeProperties = NodeProperties
|            ) on $left.PublicIPNodeId == $right.PublicIPNodeId_join
|
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    CVENodeId_join     = NodeId,
|                    CVENodeName_join   = NodeName,
|                    CVESeverity_join   = CVESeverity,
|                    CVENodeProperties  = NodeProperties
|            ) on $left.CVENodeId == $right.CVENodeId_join
|
|            // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|            // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|            | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|            // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|            // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|            // the keys its own rows have (the report field LookupNeededKeys).
|            //__SI_LOOKUP_KEYS_HERE__
|            | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(ExposedResourceNodeId)))
|            | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|            | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                     si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|            | project-away _peerKey, peer_*
|            | where coalesce(si_in_scope_, true)
|            | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(ExposedResourceNodeId))
|            | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|            | extend TargetCriticalityTierLevel = case(TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|            // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|            | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|            | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|            | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|            | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|            | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|            | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|            | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|            | project-away _tgtRf, _tgtScore
|            | extend
|                cmdbId            = si_cmdb_id,
|                cmdbName            = si_cmdb_name,
|                cmdbCriticality     = si_cmdb_criticality,
|                cmdbDataSensitivity = si_cmdb_data_sensitivity
|
|            | extend CVESev = tostring(coalesce(CVESeverity_join, ""))
|
|            | extend CVESeverityScore =
|                case(
|                    tolower(CVESev) has "critical", 5,
|                    tolower(CVESev) has "high",     4,
|                    tolower(CVESev) has "medium",   3,
|                    tolower(CVESev) has "low",      2,
|                    1
|                )
|
|            | extend TargetTierWeight =
|                case(
|                    TargetCriticalityTier == 0, 100,
|                    TargetCriticalityTier == 1, 60,
|                    TargetCriticalityTier == 2, 30,
|                    10
|                )
|
|            // Internet exposure is implied by Public IP connection
|            | extend ExposureWeight = 8
|
|            | extend AttackPathPriorityScore = TargetTierWeight + ExposureWeight + (CVESeverityScore * 2)
|
|            | extend AttackPathPriority =
|                case(
|                    AttackPathPriorityScore >= 90,  "Very High",
|                    AttackPathPriorityScore >= 60,  "High",
|                    AttackPathPriorityScore >= 30,  "Medium-High",
|                    AttackPathPriorityScore >= 15,  "Medium",
|                    "Low"
|                )
|
|            | extend AttackPath =
|                strcat(
|                    "PublicIP [", PublicIPNodeName_join, "] -> ",
|                    ExposedResourceNodeLabel, " [", ExposedResourceNodeName, "] <- ",
|                    "CVE [", FirstCVEName, "]"
|                )
|
|            | extend AttackPathDetailed =
|                strcat(
|                    "PUBLICIP [", PublicIPNodeName_join, "] ",
|                    " -> TARGET ", ExposedResourceNodeLabel, " [", ExposedResourceNodeName, "] ",
|                    "tier ", tostring(TargetCriticalityTier), " ", tostring(TargetCriticalityTierLevel),
|                    " | CVE [", FirstCVEName, "]",
|                    " | CVESeverity ", CVESev
|                )
|
|            | extend SecurityDomain = "Azure"
|            | extend Category = "Attack Paths"
|            | extend SubCategory = "InternetExposedVulnerability"
|            | extend ConfigurationName = "PublicIPWithCVE"
|            | extend ConfigurationId = tostring(FirstCVEName)
|            | extend SecuritySeverity = AttackPathPriority
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | project
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                ConfigurationId,
|
|                SecuritySeverity,
|                AttackPathPriorityScore,
|
|                ExposedResourceNodeId,
|                ExposedResourceNodeName,
|                ExposedResourceNodeLabel,
|
|                TargetCriticalityTier,
|                TargetCriticalityTierLevel,
|                TargetCriticalityRuleBased,
|                TargetCriticalityRuleNames,
|
|                TargetAssetTierByTag,
|                TargetLegacyEndOfSupport,
|                TargetRiskProb,
|                TargetRiskProbDetailed,
|                TargetRiskProbDetailedScore,
|
|                PublicIPNodeId,
|                PublicIPName = PublicIPNodeName_join,
|
|                CVENodeId,
|                CVEName = FirstCVEName,
|                CVESev,
|                CVESeverityScore,
|
|                AttackPath,
|                AttackPathDetailed,
|
|                TargetNodeProperties,
|                PublicIPNodeProperties,
|                CVENodeProperties,
|
|                cmdbId,
|                cmdbName,
|                cmdbCriticality,
|                cmdbDataSensitivity,
|                TargetAssetId;
|
|        // ===================== COLLAPSED SUMMARY VERSION (FINAL OUTPUT) =====================
|
|        // Step 9  Create DetailedForSummary table with only required columns for collapsing
|        let DetailedForSummary =
|            Detailed
|            | project
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|
|                ExposedResourceNodeId,
|                ExposedResourceNodeName,
|
|                TargetCriticalityTier,
|                TargetCriticalityTierLevel,
|                TargetRiskProb,
|                TargetRiskProbDetailed,
|                TargetRiskProbDetailedScore,
|
|                cmdbId,
|                cmdbName,
|                cmdbCriticality,
|                cmdbDataSensitivity,
|
|                AttackPathPriorityScore,
|                SecuritySeverity,
|
|                PublicIPNodeId,
|                PublicIPName,
|                CVENodeId,
|                CVEName,
|                TargetAssetId;
|
|        // Step 10 Collapse to unique logical PathKey to prevent count inflation
|        // Fixes applied
|        // - Use the true IDs for uniqueness instead of aggregated First* fields
|        let CollapsedPaths =
|            DetailedForSummary
|            | extend PathKey = strcat(PublicIPNodeId, "->", ExposedResourceNodeId, "->", CVENodeId)
|            | summarize
|                AttackPathPriorityScore_Path = max(AttackPathPriorityScore),
|                SecuritySeverity_Path        = any(SecuritySeverity),
|
|                TargetCriticalityTier_Path      = any(TargetCriticalityTier),
|                TargetCriticalityTierLevel_Path = any(TargetCriticalityTierLevel),
|                TargetRiskProb_Path             = max(TargetRiskProb),
|
|                TargetRiskProbDetailed_Path      = any(TargetRiskProbDetailed),
|                TargetRiskProbDetailedScore_Path = any(TargetRiskProbDetailedScore),
|
|                // the FINAL TARGET's CMDB values (its CI)
|                cmdbId_Path              = any(cmdbId),
|                cmdbName_Path            = any(cmdbName),
|                cmdbCriticality_Path     = any(cmdbCriticality),
|                cmdbDataSensitivity_Path = any(cmdbDataSensitivity),
|
|                CVEs_Path       = make_set(tostring(CVEName)),
|                PublicIPs_Path  = make_set(tostring(PublicIPName)),
|
|                SourceAssets_Path = make_set(tostring(ExposedResourceNodeName)),
|                TotalIssues_Path  = count(),
|                TargetAssetId = any(TargetAssetId)
|              by
|                PathKey,
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                ExposedResourceNodeId;
|
|        // Step 11 Build SummaryMain counts and key fields
|        // cmdbCriticality + cmdbDataSensitivity in by-clause so cmdb-bucketed rows survive.
|        let SummaryMain =
|            CollapsedPaths
|            | summarize
|                ConfigurationId = strcat_array(array_sort_asc(make_set(strcat_array(CVEs_Path, ";"))), ";"),
|
|                SecuritySeverity = any(SecuritySeverity_Path),
|                CriticalityTier = toint(any(TargetCriticalityTier_Path)),
|                CriticalityTierLevel = tostring(any(TargetCriticalityTierLevel_Path)),
|
|                RiskFactor_Consequence = 0,
|                RiskFactor_Probability = max(TargetRiskProb_Path),
|
|                AssetCount   = dcount(ExposedResourceNodeId),
|                TotalIssues  = sum(TotalIssues_Path),
|
|                ImpactedAssets = strcat_array(array_sort_asc(make_set(strcat_array(SourceAssets_Path, ";"))), ";"),
|                ImpactedAssetPairs = make_set(strcat(strcat_array(SourceAssets_Path, ";"), "|", tostring(TargetAssetId)))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        // Step 12 Re build RiskFactor_Probability_Detailed and DetailedScore via split expand and re aggregation
|        let SummaryDetail =
|            CollapsedPaths
|            | extend _d = split(tostring(TargetRiskProbDetailed_Path), ";")
|            | mv-expand _d to typeof(string)
|            | extend _d = trim(" ", _d)
|            | where isnotempty(_d)
|            | summarize
|                RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(make_set(_d)), ";"),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        let SummaryDetailScore =
|            CollapsedPaths
|            | extend _s = split(tostring(TargetRiskProbDetailedScore_Path), ";")
|            | mv-expand _s to typeof(string)
|            | extend _s = trim(" ", _s)
|            | where isnotempty(_s)
|            | summarize
|                RiskFactor_Probability_DetailedScore = strcat_array(array_sort_asc(make_set(_s)), ";"),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        // Step 13 Join summary parts and output final collapsed summary ordering
|        SummaryMain
|        | join kind=leftouter SummaryDetail      on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        | join kind=leftouter SummaryDetailScore on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            SubCategory,
|            ConfigurationName,
|            ConfigurationId,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AssetCount,
|            TotalIssues,
|            ImpactedAssets, ImpactedAssetPairs
|        | order by
|            RiskScore_Weight_Factor desc,
|            RiskFactor_Probability desc,
|            CriticalityTier asc,
|            TotalIssues desc,
|            AssetCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, UniqueIssues, ImpactedAssetsList, ImpactedAssetIds, IssueList, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|
|    - ReportName: Attack_Paths_Detailed_Public_IP_to_VM_with_CVE_Exploitation
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(ExposedResourceNodeId)))
|          | project __siNeeded = pack_array(TargetCiKey)
|      ReportPurpose: Per-row detail of internet-exposed vulnerable assets prioritized by FINAL TARGET business impact.
|        EG drives path detection (PublicIP -> ExposedResource <- CVE) + scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "has_secret": "ClientSecret", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // REPORT  Internet exposed assets with vulnerabilities using Exposure Graph
|        // =================================================================================================
|        //
|        // Report purpose
|        // Identify resources that are reachable from a Public IP and have CVEs affecting them.
|        // Results are prioritized by the business impact of the exposed resource.
|        // Uses the same enrichment backbone as your credential driven attack path reports.
|        //
|        // Interpretation guard and priority rules
|        // - Priority is driven by the EXPOSED RESOURCE criticality tier first
|        // - Internet exposure is explicit because a Public IP is the entry point
|        // - Legacy end of support and risk factors increase probability scoring
|        // - CVE severity is included as supporting signal not the primary driver
|        //
|        // Output description
|        // One row per exposed resource with at least one Public IP connection and at least one CVE
|        // Includes enrichment fields
|        // - IsInternetExposed
|        // - AssetTierByTag
|        // - LegacyEndOfSupport
|        // - RiskFactor_Probability and detailed breakdown
|        // - AttackPathPriorityScore and severity
|        // - Human readable AttackPath strings
|        //
|        // Query steps overview
|        // Step 0  Define legacy operating system reference lists
|        // Step 1  Build Nodes catalog as enrichment backbone
|        // Step 2  Normalize node labels to avoid filter issues
|        // Step 3  Find Public IP connections to resources
|        // Step 4  Find CVEs affecting resources
|        // Step 5  Join Public IP connections with CVEs and de duplicate
|        // Step 6  Enrich exposed resource and CVE using Nodes
|        // Step 7  Compute CVE severity score and attack path priority score
|        // Step 8  Build AttackPath and AttackPathDetailed
|        // Step 9  Project final columns and apply ordering
|        // =================================================================================================
|
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "exploit_available", "exploit_kit", "has_secret", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "multitenant_app", "network_no_user_action", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "publisher_not_verified", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "exploit_available", "exploit_kit", "has_secret", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "multitenant_app", "network_no_user_action", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "publisher_not_verified", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "has_secret": "ClientSecret", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Build node catalog used to enrich results (context standard)
|        let Nodes =
|            ExposureGraphNodes
|            | extend CategoriesStr = tolower(tostring(Categories))
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend DeviceKey = NodeCiKey
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend CriticalityRuleBased =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.ruleBasedCriticalityLevel)
|                ))
|            | extend EgCriticalityRuleNames =
|                coalesce(
|                    strcat_array(NodeProperties.criticalityLevelProps[0].ruleNames, ", "),
|                    strcat_array(NodeProperties.rawData.criticalityLevel.ruleNames, ", "),
|                    ""
|                )
|
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    NodeProperties.rawData.isCustomerFacing,
|                    NodeProperties.raw.isCustomerFacing,
|                    false
|                ))
|
|            | extend IsExcluded =
|                tobool(coalesce(
|                    NodeProperties.rawData.isExcluded,
|                    NodeProperties.raw.isExcluded,
|                    false
|                ))
|
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|
|            // the exclusion tags (the scope block, from the Exclusions page and the shipped list)
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            | extend CriticalityTier = toint(coalesce(CriticalityTierFromTag, 3))
|            | extend CriticalityTierLevel =
|                case(
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    NodeProperties.rawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|
|            | mv-apply rf = array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                ) on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize ScoreParts = make_set(strcat(tostring(rf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|
|            | extend CVESeverity =
|                tostring(coalesce(
|                    NodeProperties.rawData.severity,
|                    NodeProperties.rawData.Severity,
|                    NodeProperties.rawData.cvssScore,
|                    ""
|                ))
|
|            | extend IsEntryPoint =
|                        (CategoriesStr has "ip_address")
|                     or (CategoriesStr has "device")
|                     or (CategoriesStr has "virtual_machine")
|                     or (CategoriesStr has "computer"),
|                     IsAzureResource =
|                        (CategoriesStr has "environmentazure")
|                     or (CategoriesStr has "environmentcloud")
|
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName          = NodeNameNorm,
|                NodeLabel,
|                Categories        = CategoriesStr,
|                NodeProperties,
|                EgCriticalityLevel,
|                CriticalityTier,
|                CriticalityTierLevel,
|                CriticalityRuleBased,
|                EgCriticalityRuleNames,
|                IsInternetExposed,
|                IsExcluded,
|                EgNodeTags,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactorsArray,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence,
|                CVESeverity,
|                IsEntryPoint,
|                IsAzureResource;
|
|        // Step 2  Helper to avoid label typos or spaces
|        let NormalizeLabel = (s:string) { tolower(trim(" ", replace_string(s, " ", ""))) };
|
|        // Step 3  Find Public IPs connected to resources
|        // The graph's routing nodes are labelled "IP address" (an Azure public IP resource is
|        // microsoft.network/publicipaddresses) -- both, compared ignoring case. A network interface the address routes
|        // to is followed one hop to its machine, and the machine is tied to the graph node of the same name that carries
|        // its CVEs (one machine can have a virtual-machine node and a node with the Defender device id).
|        let _PublicIpHop =
|            ExposureGraphEdges
|            | where SourceNodeLabel in~ ("microsoft.network/publicipaddresses", "IP address")
|            | where EdgeLabel in~ ("routes traffic to", "contains")
|            | project PublicIPNodeId = SourceNodeId, PublicIPNodeName = SourceNodeName, HopNodeId = TargetNodeId, HopNodeName = TargetNodeName, HopNodeLabel = TargetNodeLabel;
|        let _NicToMachine =
|            ExposureGraphEdges
|            | where SourceNodeLabel =~ "microsoft.network/networkinterfaces"
|            | where EdgeLabel =~ "routes traffic to"
|            | where NormalizeLabel(TargetNodeLabel) in ("microsoft.compute/virtualmachines", "device")
|            | project NicNodeId = SourceNodeId, MachineNodeId = TargetNodeId, MachineNodeName = TargetNodeName, MachineNodeLabel = TargetNodeLabel;
|        let _PublicIpMachines =
|            union
|                (_PublicIpHop | project PublicIPNodeId, PublicIPNodeName, MachineNodeId = HopNodeId, MachineNodeName = HopNodeName, MachineNodeLabel = HopNodeLabel),
|                (_PublicIpHop | join kind=inner (_NicToMachine) on $left.HopNodeId == $right.NicNodeId | project PublicIPNodeId, PublicIPNodeName, MachineNodeId, MachineNodeName, MachineNodeLabel);
|        let _CveCarrierNodes =
|            ExposureGraphEdges
|            | where SourceNodeLabel =~ "Cve"
|            | where EdgeLabel =~ "affecting"
|            | where NormalizeLabel(TargetNodeLabel) in ("microsoft.compute/virtualmachines", "device")
|            | project CarrierNodeId = TargetNodeId, CarrierNodeName = TargetNodeName, CarrierNodeLabel = TargetNodeLabel
|            | distinct CarrierNodeId, CarrierNodeName, CarrierNodeLabel
|            | extend _carrierName = tolower(CarrierNodeName)
|            | where isnotempty(_carrierName);
|        let _PublicIpExposed =
|            union
|                (_PublicIpMachines | project PublicIPNodeId, PublicIPNodeName, ExposedResourceNodeId = MachineNodeId, ExposedResourceNodeName = MachineNodeName, ExposedResourceNodeLabel = MachineNodeLabel),
|                (_PublicIpMachines
|                    | where NormalizeLabel(MachineNodeLabel) in ("microsoft.compute/virtualmachines", "device")
|                    | extend _machineName = tolower(MachineNodeName)
|                    | join kind=inner (_CveCarrierNodes) on $left._machineName == $right._carrierName
|                    | where CarrierNodeId != MachineNodeId
|                    | project PublicIPNodeId, PublicIPNodeName, ExposedResourceNodeId = CarrierNodeId, ExposedResourceNodeName = CarrierNodeName, ExposedResourceNodeLabel = CarrierNodeLabel);
|        let PublicIPConnections =
|            _PublicIpExposed
|            | where NormalizeLabel(ExposedResourceNodeLabel) in (
|                "microsoft.network/networkinterfaces",
|                "microsoft.compute/virtualmachines",
|                "device"
|            )
|            | summarize
|                PublicIPs         = make_set(PublicIPNodeName),
|                PublicIPCount     = dcount(PublicIPNodeId),
|                FirstPublicIP     = any(PublicIPNodeId),
|                FirstPublicIPName = any(PublicIPNodeName),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by ExposedResourceNodeId, ExposedResourceNodeName, ExposedResourceNodeLabel
|            // #677 the slices are cut on the path's FINAL TARGET (ExposedResourceNodeId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            | extend DeviceKey = ExposedResourceNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | project-away DeviceKey;
|
|        // Step 3b  The CVEs in scope -- the customer CVE filters (SI_CVE_MinSeverity / MinCvssScore / RequireExploit /
|        // MaxPublishedAgeDays, substituted by the engine) and the report exclusions (excluded CVEs, minimum age)
|        let _ScopedCveNodeIds =
|            ExposureGraphNodes
|            | where NodeLabel =~ "Cve" or NodeLabel startswith "cve"
|              //__CVE_FILTER_BEGIN__
|              | where 1 == 1
|              //__CVE_FILTER_END__
|            | where SI_InScopeCve(NodeName, todatetime(coalesce(NodeProperties.rawData.lastModifiedDate, NodeProperties.raw.lastModifiedDate)))
|            | distinct NodeId;
|
|        // Step 4  Find CVEs affecting resources
|        let CVEsAffectingResources =
|            ExposureGraphEdges
|            | where SourceNodeLabel == "Cve"
|            | where SourceNodeId in (_ScopedCveNodeIds)
|            | where EdgeLabel == "affecting"
|            | extend TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where TargetNodeLabelNorm in (
|                "microsoft.compute/virtualmachines",
|                "device",
|                "computer-account"
|            )
|            | project
|                CVENodeId                  = SourceNodeId,
|                CVENodeName                = SourceNodeName,
|                AffectedResourceNodeId     = TargetNodeId,
|                AffectedResourceNodeName   = TargetNodeName,
|                AffectedResourceNodeLabel  = TargetNodeLabel
|            | summarize
|                CVEs         = make_set(CVENodeName),
|                CVECount     = dcount(CVENodeId),
|                FirstCVE     = any(CVENodeId),
|                FirstCVEName = any(CVENodeName),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by AffectedResourceNodeId, AffectedResourceNodeName, AffectedResourceNodeLabel;
|
|        // Step 5  Join Public IPs with CVEs and de duplicate
|        PublicIPConnections
|        | join kind=inner CVEsAffectingResources on $left.ExposedResourceNodeId == $right.AffectedResourceNodeId
|        | summarize
|            PublicIPs         = any(PublicIPs),
|            PublicIPCount     = any(PublicIPCount),
|            FirstPublicIPName = any(FirstPublicIPName),
|
|            CVEs              = any(CVEs),
|            CVECount          = any(CVECount),
|            FirstCVEName      = any(FirstCVEName),
|            FirstCVE          = any(FirstCVE)
|          by ExposedResourceNodeId, ExposedResourceNodeName, ExposedResourceNodeLabel
|
|        // Step 6  Enrich exposed resource and CVE using Nodes
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                TargetNodeId                = NodeId,
|                TargetNodeCiKey = NodeCiKey,
|                TargetRiskFactorSet = RiskFactorSet,
|                TargetNodeName              = NodeName,
|                TargetNodeLabel             = NodeLabel,
|                TargetCriticalityTier       = CriticalityTier,
|                TargetCriticalityTierLevel  = CriticalityTierLevel,
|                TargetCriticalityRuleBased  = CriticalityRuleBased,
|                TargetCriticalityRuleNames  = EgCriticalityRuleNames,
|                TargetIsInternetExposed     = IsInternetExposed,
|                TargetIsExcluded            = IsExcluded,
|                TargetAssetTierByTag        = AssetTierByTag,
|                TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                TargetRiskProb              = RiskFactor_Probability,
|                TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                TargetNodeProperties        = NodeProperties
|        ) on $left.ExposedResourceNodeId == $right.TargetNodeId
|
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                CVENodeId_join      = NodeId,
|                CVENodeName_join    = NodeName,
|                CVESeverity_join    = CVESeverity,
|                CVENodeProperties   = NodeProperties
|        ) on $left.FirstCVE == $right.CVENodeId_join
|
|        // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|        // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|        // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|        // the keys its own rows have (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(ExposedResourceNodeId)))
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(si_in_scope_, true)
|        | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(ExposedResourceNodeId))
|        | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|        | extend TargetCriticalityTierLevel = case(TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|        | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|        // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|
|        // Step 7  Compute CVE severity score and attack path priority score
|        | extend CVESev = tostring(coalesce(CVESeverity_join, ""))
|
|        | extend CVESeverityScore =
|            case(
|                tolower(CVESev) has "critical", 5,
|                tolower(CVESev) has "high", 4,
|                tolower(CVESev) has "medium", 3,
|                tolower(CVESev) has "low", 2,
|                1
|            )
|
|        | extend
|            SourceIsInternetExposed = true,
|            SourceCriticalityTier   = 3,
|            SourceCriticalityTierLevel = "Low - tier 3"
|
|        | extend TierEscalation =
|            case(
|                SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier,
|                0
|            )
|
|        | extend IsLateralMovement = TierEscalation > 0
|        | extend LateralMovementType =
|            case(
|                TierEscalation >= 3, "Privilege escalation large tier jump",
|                TierEscalation == 2, "Privilege escalation two tiers",
|                TierEscalation == 1, "Privilege escalation one tier",
|                "Direct access same tier"
|            )
|
|        | extend TargetTierWeight =
|            case(
|                TargetCriticalityTier == 0, 100,
|                TargetCriticalityTier == 1, 60,
|                TargetCriticalityTier == 2, 30,
|                10
|            )
|
|        | extend EscalationWeight = TierEscalation * 10
|        | extend ExposureWeight   = 8
|        | extend SourceTierAmplifier = 0
|        | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|
|        | extend AttackPathPriority =
|            case(
|                AttackPathPriorityScore >= 90,  "Very High",
|                AttackPathPriorityScore >= 60,  "High",
|                AttackPathPriorityScore >= 30,  "Medium-High",
|                AttackPathPriorityScore >= 15,  "Medium",
|                "Low"
|            )
|
|        | extend SecuritySeverityScore =
|            case(
|                TargetCriticalityTier == 0 and CVESeverityScore >= 4, 10,
|                TargetCriticalityTier == 0 and CVESeverityScore >= 3, 9,
|                TargetCriticalityTier == 1 and CVESeverityScore >= 4, 8,
|                TargetCriticalityTier == 1 and CVESeverityScore >= 3, 7,
|                TargetCriticalityTier == 2 and CVESeverityScore >= 4, 6,
|                CVESeverityScore >= 4, 5,
|                CVESeverityScore >= 3, 4,
|                3
|            )
|
|        | extend SecuritySeverityLevel =
|            case(
|                SecuritySeverityScore >= 9, "Very High",
|                SecuritySeverityScore >= 7, "Very High",
|                SecuritySeverityScore >= 5, "High",
|                SecuritySeverityScore >= 3, "Medium-High",
|                "Medium"
|            )
|
|        | extend SecurityDomain = "Azure"
|        | extend Category = "AttackPath_PublicIPWithCVE"
|        | extend Subcategory =
|            case(
|                TargetCriticalityTier == 0 and CVESeverityScore >= 4, "Tier 0 - Internet-Exposed with Critical CVE",
|                TargetCriticalityTier == 0, "Tier 0 - Internet-Exposed with Vulnerability",
|                TargetCriticalityTier == 1 and CVESeverityScore >= 4, "Tier 1 - Internet-Exposed with Critical CVE",
|                TargetCriticalityTier == 1, "Tier 1 - Internet-Exposed with Vulnerability",
|                CVESeverityScore >= 4, "Internet-Exposed with Critical CVE",
|                "Internet-Exposed with Vulnerability"
|            )
|
|        // Step 8  Build AttackPath and AttackPathDetailed
|        | extend AttackPath =
|            strcat(
|                "Public IP [", FirstPublicIPName, "] -> ",
|                ExposedResourceNodeLabel, " [", ExposedResourceNodeName, "] <- ",
|                "CVE [", FirstCVEName, "]"
|            )
|
|        | extend AttackPathDetailed =
|            strcat(
|                "PUBLIC IP [", FirstPublicIPName, "] ",
|                iff(PublicIPCount > 1, strcat("| + ", tostring(PublicIPCount - 1), " other IP(s)"), ""),
|                " -> EXPOSED ", ExposedResourceNodeLabel, " [", ExposedResourceNodeName, "] ",
|                "tier ", tostring(TargetCriticalityTier), " ", TargetCriticalityTierLevel, " | Internet-Exposed",
|                " | AssetTierByTag ", tostring(TargetAssetTierByTag),
|                " | LegacyEndOfSupport ", tostring(TargetLegacyEndOfSupport),
|                " <- CVE [", FirstCVEName, "] ",
|                "severity ", CVESev,
|                iff(CVECount > 1, strcat("| + ", tostring(CVECount - 1), " other CVE(s)"), "")
|            )
|
|        // Per-row identity columns expected by engine dedup (AssetName, ConfigurationName/Id).
|        // ConfigurationId carries the FINAL TARGET id so (AssetName, ConfigurationId) is unique per row.
|        | extend
|            AssetName              = ExposedResourceNodeName,
|            AssetLabel             = ExposedResourceNodeLabel,
|            ConfigurationName      = tostring(LateralMovementType),
|            ConfigurationId        = tostring(ExposedResourceNodeId),
|            CriticalityTier        = TargetCriticalityTier,
|            CriticalityTierLevel   = TargetCriticalityTierLevel,
|            RiskFactor_Consequence = 0,
|            RiskFactor_Probability = TargetRiskProb,
|            RiskFactor_Probability_Detailed      = TargetRiskProbDetailed,
|            RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore,
|            Impact                 = todouble(AttackPathPriorityScore)
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|
|        // Step 9  Project final columns and apply ordering
|        | order by RiskScore_Weight_Factor desc, AttackPathPriorityScore desc, CriticalityTier asc, CVESeverityScore desc
|
|        | project
|            SecurityDomain,
|            Category,
|            Subcategory,
|            ConfigurationName,
|            ConfigurationId,
|            AssetName,
|            AssetId=coalesce(column_ifexists("AssetId", ""), column_ifexists("TargetAssetId", ""), column_ifexists("ConfigurationId", "")),
|            AssetType=coalesce(column_ifexists("AssetType", ""), column_ifexists("AssetLabel", ""), "Azure"),
|            Impact,
|            SecuritySeverity = SecuritySeverityLevel,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AttackPath,
|            AttackPathDetailed,
|            AttackPathPriority,
|            AttackPathPriorityScore,
|            TierEscalation,
|            IsLateralMovement,
|            LateralMovementType,
|            EscalationWeight,
|            ExposureWeight,
|            PublicIPAddress = FirstPublicIPName,
|            TotalPublicIPs = PublicIPCount,
|            AllPublicIPs = PublicIPs,
|            CVE = FirstCVEName,
|            TotalCVEs = CVECount,
|            AllCVEs = CVEs,
|            CVESeverity = CVESev,
|            ExposedResource = ExposedResourceNodeName,
|            ExposedResourceType = ExposedResourceNodeLabel,
|            CriticalityRuleBased = TargetCriticalityRuleBased,
|            CriticalityRuleNames = TargetCriticalityRuleNames,
|            IsInternetExposed = true,
|            AssetTierByTag = TargetAssetTierByTag,
|            LegacyEndOfSupport = TargetLegacyEndOfSupport,
|            SecurityScore = SecuritySeverityScore,
|            TargetNodeProperties,
|            CVENodeProperties
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_Identity_Group_Membership_to_Privileged_Resources
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(IdentityNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: Group-membership privilege paths to Azure resources prioritized by FINAL TARGET business impact.
|        EG provides path detection (Identity -> Group -> Target) + scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - UniqueIssues
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - IssueList
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // the objects inside each subscription and resource group, from the graph's own contains edges -- a role on a scope is
|        // reported on the objects inside it, never on the scope itself (owner 2026-10-19)
|        let _SI_ScopeContains = ExposureGraphEdges
|            | where EdgeLabel =~ "contains" and SourceNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")
|            | project _ScopeNodeId = SourceNodeId, _ChildId = TargetNodeId, _ChildName = TargetNodeName, _ChildLabel = TargetNodeLabel;
|        let _SI_ScopeMembers = union
|            (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel),
|            (_SI_ScopeContains | where _ChildLabel in~ ("resourcegroups", "microsoft.resources/resourcegroups") | project _ScopeNodeId, _RgNodeId = _ChildId
|                | join kind=inner (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _RgNodeId = _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel) on _RgNodeId
|                | project _ScopeNodeId, _MemberId, _MemberName, _MemberLabel)
|            | summarize _MemberName = take_any(_MemberName), _MemberLabel = take_any(_MemberLabel) by _ScopeNodeId, _MemberId;
|        // =================================================================================================
|        // REPORT  Group membership privilege paths to Azure resources using Exposure Graph
|        // =================================================================================================
|        //
|        // Report purpose
|        // Identify identities that are members of groups and where those groups have permissions or roles on
|        // privileged Azure targets. Enrich each path with the standard node context and prioritize by the
|        // business impact of the final target. Provide both detailed rows and a collapsed summary output.
|        //
|        // Interpretation guard and priority rules
|        // - Priority is driven by the target criticality tier first
|        // - Then by tier escalation where source tier is higher than target tier
|        // - Then by internet exposure where target exposure is weighted higher than source exposure
|        // - The source identity matters as an amplifier but the target drives the priority
|        //
|        // Query steps overview
|        // Step 0  Define legacy operating system reference lists
|        // Step 1  Build Nodes catalog as enrichment backbone using standard context fields
|        // Step 2  Find group permissions or roles on Azure targets  (declared FIRST since 2026-08-08
|        //          so the membership scan below can be pruned to only groups that hold such access)
|        // Step 3  Find identity to group membership edges at stable grain, pruned by step 2
|        // Step 4  Assemble Identity -> Group -> Target paths at stable grain
|        // Step 5  Enrich source identity and target using Nodes
|        // Step 6  Apply prioritization logic and build attack path strings
|        // Step 7  Build detailed output table
|        // Step 8  Collapse to unique logical path key so identity spam does not multiply counts
|        // Step 9  Build summary counts and key fields
|        // Step 10 Rebuild probability detail fields via split expand and re aggregation
|        // Step 11 Emit final collapsed summary ordering
|        // =================================================================================================
|
|
|
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Build node catalog used to enrich attack paths
|        // Fixes applied
|        // - NodeCiKey (= DeviceKey), AssetName defined in Nodes scope
|        // - Slice filter on the path's final target, not on the node scope (#677)
|        let Nodes =
|            ExposureGraphNodes
|            | extend CategoriesStr = tolower(tostring(Categories))
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend AssetName = NodeNameNorm
|
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend DeviceKey = NodeCiKey
|
|            // (no slice filter here since #677 -- the paths are cut on their final target)
|            // DeviceKey stays for distinct counting
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend CriticalityRuleBased =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.ruleBasedCriticalityLevel)
|                ))
|            | extend EgCriticalityRuleNames =
|                coalesce(
|                    strcat_array(NodeProperties.criticalityLevelProps[0].ruleNames, ", "),
|                    strcat_array(NodeProperties.rawData.criticalityLevel.ruleNames, ", "),
|                    ""
|                )
|
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    NodeProperties.rawData.isCustomerFacing,
|                    NodeProperties.raw.isCustomerFacing,
|                    false
|                ))
|
|            | extend IsExcluded =
|                tobool(coalesce(
|                    NodeProperties.rawData.isExcluded,
|                    NodeProperties.raw.isExcluded,
|                    false
|                ))
|
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|
|            // the exclusion tags (the scope block, from the Exclusions page and the shipped list)
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            | extend CriticalityTier = toint(coalesce(CriticalityTierFromTag, 3))
|            | extend CriticalityTierLevel =
|                case(
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    NodeProperties.rawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|
|            | extend _ScoreFactors =
|                array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                )
|            | mv-apply sf = _ScoreFactors on (
|                where isnotempty(trim(" ", tostring(sf)))
|                | summarize ScoreParts = make_set(strcat(tostring(sf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName          = NodeNameNorm,
|                NodeLabel,
|                NodeProperties,
|                CriticalityTier,
|                CriticalityTierLevel,
|                CriticalityRuleBased,
|                EgCriticalityRuleNames,
|                IsInternetExposed,
|                IsExcluded,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence;
|
|
|        // Step 2  Find group permissions or roles on Azure targets
|        // NOTE  this let is declared BEFORE the membership let (they were the other way round until
|        // 2026-08-08) so the membership scan can be pruned by it. See the PRUNE note in step 3.
|        let GroupAccessToTargets =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has role on", "has permissions to")
|            | where SourceNodeLabel == "group"
|            | where TargetNodeLabel in (
|                "subscriptions",
|                "resourcegroups",
|                "microsoft.keyvault/vaults",
|                "microsoft.storage/storageaccounts",
|                "microsoft.sql/servers",
|                "microsoft.compute/virtualmachines",
|                "microsoft.cognitiveservices/accounts"
|            )
|            // a subscription or resource group target is replaced by the objects inside it -- once per object, so an object reached
|            // directly and through its resource group and subscription is one path (owner 2026-10-19)
|            | join kind=leftouter (_SI_ScopeMembers) on $left.TargetNodeId == $right._ScopeNodeId
|            | where isnotempty(_MemberId) or not(TargetNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups"))
|            | extend TargetNodeId = iff(isnotempty(_MemberId), _MemberId, TargetNodeId), TargetNodeName = iff(isnotempty(_MemberId), _MemberName, TargetNodeName), TargetNodeLabel = iff(isnotempty(_MemberId), _MemberLabel, TargetNodeLabel)
|            | extend _SI_ViaScope = isnotempty(_MemberId)
|            | project-away _ScopeNodeId, _MemberId, _MemberName, _MemberLabel
|            // distinct edge grain -- EG can carry several edge rows for the same group/target pair
|            // (different role definitions). They collapse in step 4's summarize anyway, so removing
|            // them HERE avoids multiplying them across every member of the group first.
|            | summarize by
|                GroupNodeId      = SourceNodeId,
|                EdgeLabel        = EdgeLabel,
|                FinalTargetId    = TargetNodeId,
|                FinalTargetName  = TargetNodeName,
|                FinalTargetLabel = TargetNodeLabel
|            // #677 the slices are cut on the path's FINAL TARGET (FinalTargetId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            | extend DeviceKey = FinalTargetId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | project-away DeviceKey;
|
|
|        // Only the groups that actually hold access on one of the Azure target types above. Usually a
|        // tiny fraction of all groups in the tenant.
|        let GroupsWithAzureAccess =
|            GroupAccessToTargets
|            | distinct GroupNodeId;
|
|
|        // Step 3  Find identity to group membership edges at stable grain
|        // PRUNE (2026-08-08)  the membership scan is restricted to GroupsWithAzureAccess. This is
|        // SEMANTICALLY IDENTICAL -- step 4 inner-joins these two sets on GroupNodeId, so any member
|        // of a group with no Azure access was always discarded -- but it discards them BEFORE the
|        // cartesian instead of after. Without it this let materialises EVERY "member of" edge in the
|        // tenant and the join expands to (members x targets) per group, which is what made this
|        // report run 10 x 900s deterministic timeouts and return 0 rows on 2026-08-08 while the
|        // whole rest of the Summary template finished in ~25 minutes. Bucketing could not rescue it
|        // because the bucket filter lands on the CL enrichment let, not on this EG expansion, which
|        // is exactly what the engine's FUTILE-PRUNE message reports.
|        let IdentityGroupMembership =
|            ExposureGraphEdges
|            | where EdgeLabel == "member of"
|            | where SourceNodeLabel in ("user", "serviceprincipal", "managedidentity")
|            | where TargetNodeLabel == "group"
|            | where TargetNodeId in (GroupsWithAzureAccess)
|            | summarize by
|                IdentityNodeId    = SourceNodeId,
|                IdentityNodeName  = SourceNodeName,
|                IdentityNodeLabel = SourceNodeLabel,
|                GroupNodeId       = TargetNodeId,
|                GroupNodeName     = TargetNodeName;
|
|
|        // Step 4  Assemble Identity -> Group -> Target paths at stable grain
|        let Paths =
|            IdentityGroupMembership
|            | join kind=inner (GroupAccessToTargets) on GroupNodeId
|            | project
|                IdentityNodeId,
|                IdentityNodeName,
|                IdentityNodeLabel,
|                GroupNodeId,
|                GroupNodeName,
|                EdgeLabel,
|                FinalTargetId,
|                FinalTargetName,
|                FinalTargetLabel
|            | summarize by
|                IdentityNodeId,
|                GroupNodeId,
|                FinalTargetId,
|                IdentityNodeName,
|                IdentityNodeLabel,
|                GroupNodeName,
|                EdgeLabel,
|                FinalTargetName,
|                FinalTargetLabel;
|
|
|        // Step 5-7  Build the detailed output table
|        let Detailed =
|            Paths
|
|            // Enrich identity
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    SourceNodeId                = NodeId,
|                    SourceNodeCiKey = NodeCiKey,
|                    SourceRiskFactorSet = RiskFactorSet,
|                    SourceNodeName              = NodeName,
|                    SourceNodeLabel             = NodeLabel,
|                    SourceCriticalityTier       = CriticalityTier,
|                    SourceCriticalityTierLevel  = CriticalityTierLevel,
|                    SourceIsInternetExposed     = IsInternetExposed,
|                    SourceIsExcluded            = IsExcluded,
|                    SourceAssetTierByTag        = AssetTierByTag,
|                    SourceLegacyEndOfSupport    = LegacyEndOfSupport,
|                    SourceRiskProb              = RiskFactor_Probability,
|                    SourceRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    SourceRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                    SourceNodeProperties        = NodeProperties
|            ) on $left.IdentityNodeId == $right.SourceNodeId
|
|            // Enrich target
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    TargetNodeId                = NodeId,
|                    TargetNodeCiKey = NodeCiKey,
|                    TargetRiskFactorSet = RiskFactorSet,
|                    TargetNodeName              = NodeName,
|                    TargetNodeLabel             = NodeLabel,
|                    TargetCriticalityTier       = CriticalityTier,
|                    TargetCriticalityTierLevel  = CriticalityTierLevel,
|                    TargetCriticalityRuleBased  = CriticalityRuleBased,
|                    TargetCriticalityRuleNames  = EgCriticalityRuleNames,
|                    TargetIsInternetExposed     = IsInternetExposed,
|                    TargetIsExcluded            = IsExcluded,
|                    TargetAssetTierByTag        = AssetTierByTag,
|                    TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                    TargetRiskProb              = RiskFactor_Probability,
|                    TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                    TargetNodeProperties        = NodeProperties
|            ) on $left.FinalTargetId == $right.TargetNodeId
|
|            // Group context for strings and counts
|            | join kind=leftouter (
|                IdentityGroupMembership
|                | summarize
|                    IdentitiesInGroup     = make_set(IdentityNodeName),
|                    IdentityTypesInGroup  = make_set(IdentityNodeLabel),
|                    IdentityCountInGroup  = dcount(IdentityNodeId),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|                  by GroupNodeId
|            ) on GroupNodeId
|
|            // the SOURCE's CI (#505) -- tier (the EG criticality only where the CI has no tier) and the asset factors,
|            // the same way as the target. A source without a CI keeps its EG tier and has no asset factors.
|            | extend SourceRiskFactorSet = iff(isnull(SourceRiskFactorSet), dynamic([]), SourceRiskFactorSet)
|            // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|            // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|            // the keys its own rows have (the report field LookupNeededKeys).
|            //__SI_LOOKUP_KEYS_HERE__
|            | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(IdentityNodeId)))
|            | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|            | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|            | extend Source_si_ci_id = peer_ci_id, Source_si_tier = peer_tier, Source_si_rf_p = peer_rf_p, Source_si_rf_names = peer_rf_names
|            | project-away _peerKey, peer_*
|            | extend SourceAssetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(IdentityNodeId))
|            | extend SourceCriticalityTier = toint(coalesce(Source_si_tier, SourceCriticalityTier))
|            | extend SourceCriticalityTierLevel = case(SourceCriticalityTier == 0, "Critical - tier 0", SourceCriticalityTier == 1, "High - tier 1", SourceCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend _srcIds = coalesce(Source_si_rf_p, dynamic([])), _srcNames = coalesce(Source_si_rf_names, dynamic([]))
|            | extend SourceIsInternetExposed = set_has_element(_srcIds, "internet_exposed"), SourceLegacyEndOfSupport = iff(set_has_element(_srcIds, "unsupported_os"), 1, 0)
|            | extend _srcRf = array_concat(SourceRiskFactorSet, _srcNames)
|            | extend SourceRiskProb = array_length(SourceRiskFactorSet) + array_length(_srcIds)
|            | extend SourceRiskProbDetailed = strcat_array(array_sort_asc(_srcRf), ";")
|            | mv-apply _rf = _srcRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _srcScore = make_set(strcat(_rf, "=1")))
|            | extend SourceRiskProbDetailedScore = strcat_array(array_sort_asc(_srcScore), ";")
|            | project-away _srcRf, _srcScore, _srcIds, _srcNames
|            // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|            // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|            | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|            | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|            | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                     si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|            | project-away _peerKey, peer_*
|            | where coalesce(si_in_scope_, true)
|            | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(FinalTargetId))
|            | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|            | extend TargetCriticalityTierLevel = case(TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|            // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|            | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|            | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|            | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|            | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|            | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|            | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|            | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|            | project-away _tgtRf, _tgtScore
|            | extend
|                cmdbId            = si_cmdb_id,
|                cmdbName            = si_cmdb_name,
|                cmdbCriticality     = si_cmdb_criticality,
|                cmdbDataSensitivity = si_cmdb_data_sensitivity
|
|            | extend TierEscalation =
|                case(
|                    isnotempty(SourceCriticalityTier) and isnotempty(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier,
|                        SourceCriticalityTier - TargetCriticalityTier,
|                    0
|                )
|            | extend IsLateralMovement = TierEscalation > 0
|            | extend LateralMovementType =
|                case(
|                    TierEscalation >= 3, "Privilege escalation large tier jump",
|                    TierEscalation == 2, "Privilege escalation two tiers",
|                    TierEscalation == 1, "Privilege escalation one tier",
|                    "Direct access same tier"
|                )
|
|            | extend TargetTierWeight =
|                case(
|                    TargetCriticalityTier == 0, 100,
|                    TargetCriticalityTier == 1, 60,
|                    TargetCriticalityTier == 2, 30,
|                    10
|                )
|            | extend EscalationWeight = TierEscalation * 10
|            | extend ExposureWeight   = iff(TargetIsInternetExposed == true, 8, 0) + iff(SourceIsInternetExposed == true, 3, 0)
|            | extend SourceTierAmplifier =
|                case(
|                    SourceCriticalityTier == 0, 8,
|                    SourceCriticalityTier == 1, 5,
|                    SourceCriticalityTier == 2, 2,
|                    0
|                )
|            | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|
|            | extend AttackPathPriority =
|                case(
|                    AttackPathPriorityScore >= 90,  "Very High",
|                    AttackPathPriorityScore >= 60,  "High",
|                    AttackPathPriorityScore >= 30,  "Medium-High",
|                    AttackPathPriorityScore >= 15,  "Medium",
|                    "Low"
|                )
|
|            | extend InternetExposureTarget = iff(TargetIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|            | extend InternetExposureSource = iff(SourceIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|
|            | extend AttackPath =
|                strcat(
|                    IdentityNodeLabel, " [", IdentityNodeName, "] -> ",
|                    "group [", GroupNodeName, "] -> ",
|                    TargetNodeLabel, " [", FinalTargetName, "]"
|                )
|
|            | extend AttackPathDetailed =
|                strcat(
|                    "SOURCE ", IdentityNodeLabel, " [", IdentityNodeName, "] ",
|                    "tier ", tostring(SourceCriticalityTier), " ", tostring(SourceCriticalityTierLevel), " | ", InternetExposureSource,
|                    iff(IdentityCountInGroup > 1, strcat(" | + ", tostring(IdentityCountInGroup - 1), " other identity/ies"), ""),
|                    " -> GROUP [", GroupNodeName, "] ",
|                    " -> TARGET ", TargetNodeLabel, " [", FinalTargetName, "] ",
|                    "tier ", tostring(TargetCriticalityTier), " ", tostring(TargetCriticalityTierLevel), " | ", InternetExposureTarget,
|                    " | escalation ", tostring(TierEscalation),
|                    " | ", LateralMovementType
|                )
|
|            | extend SecurityDomain = "Azure"
|            | extend Category = "Attack Paths"
|            | extend SubCategory = "GroupMembershipPrivilege"
|            | extend ConfigurationName = tostring(LateralMovementType)
|            | extend SecuritySeverity  = tostring(AttackPathPriority)
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | project
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|
|                SecuritySeverity,
|                AttackPathPriorityScore,
|                TierEscalation,
|                IsLateralMovement,
|                LateralMovementType,
|
|                GroupNodeId,
|                GroupNodeName,
|                EdgeLabel,
|
|                IdentityNodeId,
|                IdentityNodeName,
|                IdentityNodeLabel,
|
|                TotalIdentitiesInGroup = IdentityCountInGroup,
|                AllIdentities = IdentitiesInGroup,
|
|                FinalTargetId,
|                FinalTarget = FinalTargetName,
|                FinalTargetType = FinalTargetLabel,
|
|                TargetCriticalityTier,
|                TargetCriticalityTierLevel,
|                TargetAssetTierByTag,
|                TargetIsInternetExposed,
|                TargetLegacyEndOfSupport,
|                TargetRiskProb,
|                TargetRiskProbDetailed,
|                TargetRiskProbDetailedScore,
|
|                cmdbId,
|                cmdbName,
|                cmdbCriticality,
|                cmdbDataSensitivity,
|
|                AttackPath,
|                AttackPathDetailed,
|
|                SourceNodeProperties,
|                TargetNodeProperties,
|                TargetAssetId;
|
|
|        // ===================== COLLAPSED SUMMARY VERSION FINAL OUTPUT =====================
|
|        // Step 8  Collapse to unique logical path key so identity spam does not multiply counts
|        let CollapsedPaths =
|            Detailed
|            | extend PathKey = strcat(IdentityNodeId, "->", GroupNodeId, "->", FinalTargetId)
|            | summarize
|                AttackPathPriorityScore_Path = max(AttackPathPriorityScore),
|                SecuritySeverity_Path        = any(SecuritySeverity),
|
|                TargetCriticalityTier_Path      = any(TargetCriticalityTier),
|                TargetCriticalityTierLevel_Path = any(TargetCriticalityTierLevel),
|                TargetRiskProb_Path             = max(TargetRiskProb),
|
|                TargetRiskProbDetailed_Path      = any(TargetRiskProbDetailed),
|                TargetRiskProbDetailedScore_Path = any(TargetRiskProbDetailedScore),
|
|                // the FINAL TARGET's CMDB values (its CI)
|                cmdbId_Path              = any(cmdbId),
|                cmdbName_Path            = any(cmdbName),
|                cmdbCriticality_Path     = any(cmdbCriticality),
|                cmdbDataSensitivity_Path = any(cmdbDataSensitivity),
|
|                IdentityTypes_Path     = make_set(tostring(IdentityNodeLabel)),
|                SourceIdentities_Path  = make_set(tostring(IdentityNodeName)),
|                TargetAssets_Path      = make_set(tostring(FinalTarget)),
|                TotalIssues_Path       = count(),
|                TargetAssetId = any(TargetAssetId)
|              by
|                PathKey,
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                FinalTargetId;
|
|
|        // Step 9  Main summary counts stay correct
|        // cmdbCriticality + cmdbDataSensitivity in by-clause so cmdb-bucketed rows survive.
|        let SummaryMain =
|            CollapsedPaths
|            | summarize
|                ConfigurationId = strcat_array(array_sort_asc(make_set(strcat_array(IdentityTypes_Path, ";"))), ";"),
|
|                SecuritySeverity = any(SecuritySeverity_Path),
|                CriticalityTier = toint(any(TargetCriticalityTier_Path)),
|                CriticalityTierLevel = tostring(any(TargetCriticalityTierLevel_Path)),
|
|                RiskFactor_Consequence = 0,
|                RiskFactor_Probability = max(TargetRiskProb_Path),
|
|                AssetCount   = dcount(FinalTargetId),
|                TotalIssues  = sum(TotalIssues_Path),
|
|                ImpactedAssets = strcat_array(array_sort_asc(make_set(strcat_array(TargetAssets_Path, ";"))), ";"),
|                ImpactedAssetPairs = make_set(strcat(strcat_array(TargetAssets_Path, ";"), "|", tostring(TargetAssetId)))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|
|        // Step 10  Rebuild probability detail strings
|        let SummaryDetail =
|            CollapsedPaths
|            | extend _d = split(tostring(TargetRiskProbDetailed_Path), ";")
|            | mv-expand _d to typeof(string)
|            | extend _d = trim(" ", _d)
|            | where isnotempty(_d)
|            | summarize
|                RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(make_set(_d)), ";"),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        let SummaryDetailScore =
|            CollapsedPaths
|            | extend _s = split(tostring(TargetRiskProbDetailedScore_Path), ";")
|            | mv-expand _s to typeof(string)
|            | extend _s = trim(" ", _s)
|            | where isnotempty(_s)
|            | summarize
|                RiskFactor_Probability_DetailedScore = strcat_array(array_sort_asc(make_set(_s)), ";"),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|
|        // Step 11  Final output
|        SummaryMain
|        | join kind=leftouter SummaryDetail      on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        | join kind=leftouter SummaryDetailScore on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            SubCategory,
|            ConfigurationName,
|            ConfigurationId,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AssetCount,
|            TotalIssues,
|            ImpactedAssets, ImpactedAssetPairs
|        | order by
|            RiskScore_Weight_Factor desc,
|            RiskFactor_Probability desc,
|            CriticalityTier asc,
|            TotalIssues desc,
|            AssetCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, UniqueIssues, ImpactedAssetsList, ImpactedAssetIds, IssueList, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|
|    - ReportName: Attack_Paths_Detailed_Identity_Group_Membership_to_Privileged_Resources
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(FirstIdentityId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: Per-row detail of group-membership privilege paths to Azure resources prioritized by FINAL TARGET business impact.
|        EG drives path detection (Identity -> Group -> Target) + scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // the objects inside each subscription and resource group, from the graph's own contains edges -- a role on a scope is
|        // reported on the objects inside it, never on the scope itself (owner 2026-10-19)
|        let _SI_ScopeContains = ExposureGraphEdges
|            | where EdgeLabel =~ "contains" and SourceNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")
|            | project _ScopeNodeId = SourceNodeId, _ChildId = TargetNodeId, _ChildName = TargetNodeName, _ChildLabel = TargetNodeLabel;
|        let _SI_ScopeMembers = union
|            (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel),
|            (_SI_ScopeContains | where _ChildLabel in~ ("resourcegroups", "microsoft.resources/resourcegroups") | project _ScopeNodeId, _RgNodeId = _ChildId
|                | join kind=inner (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _RgNodeId = _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel) on _RgNodeId
|                | project _ScopeNodeId, _MemberId, _MemberName, _MemberLabel)
|            | summarize _MemberName = take_any(_MemberName), _MemberLabel = take_any(_MemberLabel) by _ScopeNodeId, _MemberId;
|        // =================================================================================================
|        // REPORT  Group membership privilege paths to Azure resources using Exposure Graph
|        // =================================================================================================
|        //
|        // Report purpose
|        // Identify identities that are members of groups and where those groups have permissions or roles on
|        // privileged Azure targets. Enrich each path with the standard node context and prioritize by the
|        // business impact of the FINAL TARGET.
|        //
|        // Interpretation guard and priority rules
|        // - Priority is driven by the TARGET criticality tier first
|        // - Then by tier escalation where source tier is higher than target tier
|        // - Then by internet exposure where target exposure is weighted higher than source exposure
|        // - The source identity matters as an amplifier but the target drives the priority
|        //
|        // Output description detailed rows
|        // One row per unique path
|        // Identity -> Group -> Target
|        // Enriched with
|        // - IsInternetExposed for source and target
|        // - AssetTierByTag for source and target
|        // - LegacyEndOfSupport for source and target
|        // - RiskFactor probability fields including detailed breakdown for source and target
|        // - AttackPathPriorityScore components and mapped severity label
|        // - Human readable AttackPath and AttackPathDetailed strings
|        //
|        // Query steps overview
|        // Step 0  Define legacy operating system reference lists
|        // Step 1  Build Nodes catalog as enrichment backbone using standard context fields
|        // Step 2  Find identities in groups and de duplicate to a stable group membership grain
|        // Step 3  Find group permissions or roles on Azure targets
|        // Step 4  Assemble Identity -> Group -> Target paths and de duplicate
|        // Step 5  Enrich source identity and target using Nodes catalog
|        // Step 6  Apply standard prioritization logic and build attack path strings
|        // Step 7  Project detailed output columns and apply ordering
|        // =================================================================================================
|
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Build node catalog used to enrich attack paths
|        let Nodes =
|            ExposureGraphNodes
|            | extend CategoriesStr = tolower(tostring(Categories))
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend DeviceKey = NodeCiKey
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend CriticalityRuleBased =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.ruleBasedCriticalityLevel)
|                ))
|            | extend EgCriticalityRuleNames =
|                coalesce(
|                    strcat_array(NodeProperties.criticalityLevelProps[0].ruleNames, ", "),
|                    strcat_array(NodeProperties.rawData.criticalityLevel.ruleNames, ", "),
|                    ""
|                )
|
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    NodeProperties.rawData.isCustomerFacing,
|                    NodeProperties.raw.isCustomerFacing,
|                    false
|                ))
|
|            | extend IsExcluded =
|                tobool(coalesce(
|                    NodeProperties.rawData.isExcluded,
|                    NodeProperties.raw.isExcluded,
|                    false
|                ))
|
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|
|            // the exclusion tags (the scope block, from the Exclusions page and the shipped list)
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            | extend CriticalityTier = toint(coalesce(CriticalityTierFromTag, 3))
|            | extend CriticalityTierLevel =
|                case(
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    NodeProperties.rawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|
|            | mv-apply rf = array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                ) on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize ScoreParts = make_set(strcat(tostring(rf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName          = NodeNameNorm,
|                NodeLabel,
|                Categories        = CategoriesStr,
|                NodeProperties,
|                EgCriticalityLevel,
|                CriticalityTier,
|                CriticalityTierLevel,
|                CriticalityRuleBased,
|                EgCriticalityRuleNames,
|                IsInternetExposed,
|                IsExcluded,
|                EgNodeTags,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactorsArray,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence;
|
|        // Step 2  Find identities in groups and de duplicate
|        let IdentityGroupMembership =
|            ExposureGraphEdges
|            | where EdgeLabel == "member of"
|            | where SourceNodeLabel in ("user", "serviceprincipal", "managedidentity")
|            | where TargetNodeLabel == "group"
|            | project
|                IdentityNodeId    = SourceNodeId,
|                IdentityNodeName  = SourceNodeName,
|                IdentityNodeLabel = SourceNodeLabel,
|                GroupNodeId       = TargetNodeId,
|                GroupNodeName     = TargetNodeName
|            | summarize
|                Identities        = make_set(IdentityNodeName),
|                IdentityTypes     = make_set(IdentityNodeLabel),
|                IdentityCount     = dcount(IdentityNodeId),
|                FirstIdentityId   = any(IdentityNodeId),
|                FirstIdentityName = any(IdentityNodeName),
|                FirstIdentityLabel= any(IdentityNodeLabel),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by GroupNodeId, GroupNodeName;
|
|        // Step 3  Find group permissions or roles on Azure targets
|        let GroupAccessToTargets =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has role on", "has permissions to")
|            | where SourceNodeLabel == "group"
|            | where TargetNodeLabel in (
|                "subscriptions",
|                "resourcegroups",
|                "microsoft.keyvault/vaults",
|                "microsoft.storage/storageaccounts",
|                "microsoft.sql/servers",
|                "microsoft.compute/virtualmachines",
|                "microsoft.cognitiveservices/accounts"
|            )
|            // a subscription or resource group target is replaced by the objects inside it -- once per object, so an object reached
|            // directly and through its resource group and subscription is one path (owner 2026-10-19)
|            | join kind=leftouter (_SI_ScopeMembers) on $left.TargetNodeId == $right._ScopeNodeId
|            | where isnotempty(_MemberId) or not(TargetNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups"))
|            | extend TargetNodeId = iff(isnotempty(_MemberId), _MemberId, TargetNodeId), TargetNodeName = iff(isnotempty(_MemberId), _MemberName, TargetNodeName), TargetNodeLabel = iff(isnotempty(_MemberId), _MemberLabel, TargetNodeLabel)
|            | extend _SI_ViaScope = isnotempty(_MemberId)
|            | project-away _ScopeNodeId, _MemberId, _MemberName, _MemberLabel
|            | project
|                GroupNodeId      = SourceNodeId,
|                EdgeLabel        = EdgeLabel,
|                FinalTargetId    = TargetNodeId,
|                FinalTargetName  = TargetNodeName,
|                FinalTargetLabel = TargetNodeLabel
|            // #677 the slices are cut on the path's FINAL TARGET (FinalTargetId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            | extend DeviceKey = FinalTargetId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | project-away DeviceKey;
|
|        // Step 4  Assemble Identity -> Group -> Target paths and de duplicate
|        let Paths =
|            IdentityGroupMembership
|            | join kind=inner (GroupAccessToTargets) on GroupNodeId
|            | summarize
|                Identities         = any(Identities),
|                IdentityTypes      = any(IdentityTypes),
|                IdentityCount      = any(IdentityCount),
|                FirstIdentityId    = any(FirstIdentityId),
|                FirstIdentityName  = any(FirstIdentityName),
|                FirstIdentityLabel = any(FirstIdentityLabel),
|                GroupNodeName      = any(GroupNodeName),
|                EdgeLabel          = any(EdgeLabel),
|                FinalTargetName    = any(FinalTargetName),
|                FinalTargetLabel   = any(FinalTargetLabel),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by FinalTargetId, GroupNodeId;
|
|        // Step 5-7  Enrich source and target and apply standard prioritization logic
|        Paths
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                SourceNodeId                = NodeId,
|                SourceNodeCiKey = NodeCiKey,
|                SourceRiskFactorSet = RiskFactorSet,
|                SourceNodeName              = NodeName,
|                SourceNodeLabel             = NodeLabel,
|                SourceCriticalityTier       = CriticalityTier,
|                SourceCriticalityTierLevel  = CriticalityTierLevel,
|                SourceIsInternetExposed     = IsInternetExposed,
|                SourceIsExcluded            = IsExcluded,
|                SourceAssetTierByTag        = AssetTierByTag,
|                SourceLegacyEndOfSupport    = LegacyEndOfSupport,
|                SourceRiskProb              = RiskFactor_Probability,
|                SourceRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                SourceRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                SourceNodeProperties        = NodeProperties
|        ) on $left.FirstIdentityId == $right.SourceNodeId
|
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                TargetNodeId                = NodeId,
|                TargetNodeCiKey = NodeCiKey,
|                TargetRiskFactorSet = RiskFactorSet,
|                TargetNodeName              = NodeName,
|                TargetNodeLabel             = NodeLabel,
|                TargetCriticalityTier       = CriticalityTier,
|                TargetCriticalityTierLevel  = CriticalityTierLevel,
|                TargetCriticalityRuleBased  = CriticalityRuleBased,
|                TargetCriticalityRuleNames  = EgCriticalityRuleNames,
|                TargetIsInternetExposed     = IsInternetExposed,
|                TargetIsExcluded            = IsExcluded,
|                TargetAssetTierByTag        = AssetTierByTag,
|                TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                TargetRiskProb              = RiskFactor_Probability,
|                TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                TargetNodeProperties        = NodeProperties
|        ) on $left.FinalTargetId == $right.TargetNodeId
|
|        // the SOURCE's CI (#505) -- tier (the EG criticality only where the CI has no tier) and the asset factors,
|        // the same way as the target. A source without a CI keeps its EG tier and has no asset factors.
|        | extend SourceRiskFactorSet = iff(isnull(SourceRiskFactorSet), dynamic([]), SourceRiskFactorSet)
|        // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|        // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|        // the keys its own rows have (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(FirstIdentityId)))
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|        | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|        | extend Source_si_ci_id = peer_ci_id, Source_si_tier = peer_tier, Source_si_rf_p = peer_rf_p, Source_si_rf_names = peer_rf_names
|        | project-away _peerKey, peer_*
|        | extend SourceAssetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(FirstIdentityId))
|        | extend SourceCriticalityTier = toint(coalesce(Source_si_tier, SourceCriticalityTier))
|        | extend SourceCriticalityTierLevel = case(SourceCriticalityTier == 0, "Critical - tier 0", SourceCriticalityTier == 1, "High - tier 1", SourceCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|        | extend _srcIds = coalesce(Source_si_rf_p, dynamic([])), _srcNames = coalesce(Source_si_rf_names, dynamic([]))
|        | extend SourceIsInternetExposed = set_has_element(_srcIds, "internet_exposed"), SourceLegacyEndOfSupport = iff(set_has_element(_srcIds, "unsupported_os"), 1, 0)
|        | extend _srcRf = array_concat(SourceRiskFactorSet, _srcNames)
|        | extend SourceRiskProb = array_length(SourceRiskFactorSet) + array_length(_srcIds)
|        | extend SourceRiskProbDetailed = strcat_array(array_sort_asc(_srcRf), ";")
|        | mv-apply _rf = _srcRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _srcScore = make_set(strcat(_rf, "=1")))
|        | extend SourceRiskProbDetailedScore = strcat_array(array_sort_asc(_srcScore), ";")
|        | project-away _srcRf, _srcScore, _srcIds, _srcNames
|        // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|        // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(si_in_scope_, true)
|        | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(FinalTargetId))
|        | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|        | extend TargetCriticalityTierLevel = case(TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|        | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|        // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|
|        // Step 6  Attack path prioritization logic
|        | extend TierEscalation =
|            case(
|                isnotempty(SourceCriticalityTier) and isnotempty(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier,
|                    SourceCriticalityTier - TargetCriticalityTier,
|                0
|            )
|        | extend IsLateralMovement = TierEscalation > 0
|        | extend LateralMovementType =
|            case(
|                TierEscalation >= 3, "Privilege escalation large tier jump",
|                TierEscalation == 2, "Privilege escalation two tiers",
|                TierEscalation == 1, "Privilege escalation one tier",
|                "Direct access same tier"
|            )
|
|        | extend TargetTierWeight =
|            case(
|                TargetCriticalityTier == 0, 100,
|                TargetCriticalityTier == 1, 60,
|                TargetCriticalityTier == 2, 30,
|                10
|            )
|        | extend EscalationWeight = TierEscalation * 10
|        | extend ExposureWeight   = iff(TargetIsInternetExposed == true, 8, 0) + iff(SourceIsInternetExposed == true, 3, 0)
|        | extend SourceTierAmplifier =
|            case(
|                SourceCriticalityTier == 0, 8,
|                SourceCriticalityTier == 1, 5,
|                SourceCriticalityTier == 2, 2,
|                0
|            )
|        | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|
|        | extend AttackPathPriority =
|            case(
|                AttackPathPriorityScore >= 90,  "Very High",
|                AttackPathPriorityScore >= 60,  "High",
|                AttackPathPriorityScore >= 30,  "Medium-High",
|                AttackPathPriorityScore >= 15,  "Medium",
|                "Low"
|            )
|
|        // Step 7  Human readable paths
|        | extend InternetExposureTarget = iff(TargetIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|        | extend InternetExposureSource = iff(SourceIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|
|        | extend AttackPath =
|            strcat(
|                FirstIdentityLabel, " [", FirstIdentityName, "] -> ",
|                "group [", GroupNodeName, "] -> ",
|                TargetNodeLabel, " [", FinalTargetName, "]"
|            )
|
|        | extend AttackPathDetailed =
|            strcat(
|                "SOURCE ", FirstIdentityLabel, " [", FirstIdentityName, "] ",
|                "tier ", tostring(SourceCriticalityTier), " ", tostring(SourceCriticalityTierLevel), " | ", InternetExposureSource,
|                iff(IdentityCount > 1, strcat(" | + ", tostring(IdentityCount - 1), " other identity/ies"), ""),
|                " -> GROUP [", GroupNodeName, "] ",
|                " -> TARGET ", TargetNodeLabel, " [", FinalTargetName, "] ",
|                "tier ", tostring(TargetCriticalityTier), " ", tostring(TargetCriticalityTierLevel), " | ", InternetExposureTarget,
|                " | escalation ", tostring(TierEscalation),
|                " | ", LateralMovementType
|            )
|
|        | extend SecurityDomain = "Azure"
|        | extend Category = "Attack Paths"
|        | extend Subcategory = "GroupMembershipPrivilege"
|        // Per-row identity columns expected by engine dedup (AssetName, ConfigurationName/Id).
|        // ConfigurationId carries the FINAL TARGET id so (AssetName, ConfigurationId) is unique per row.
|        | extend
|            AssetName              = FinalTargetName,
|            AssetLabel             = FinalTargetLabel,
|            ConfigurationName      = tostring(LateralMovementType),
|            ConfigurationId        = tostring(FinalTargetId),
|            SecuritySeverity       = tostring(AttackPathPriority),
|            Impact                 = todouble(AttackPathPriorityScore),
|            CriticalityTier        = TargetCriticalityTier,
|            CriticalityTierLevel   = TargetCriticalityTierLevel,
|            RiskFactor_Consequence = 0,
|            RiskFactor_Probability = TargetRiskProb,
|            RiskFactor_Probability_Detailed      = TargetRiskProbDetailed,
|            RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            Subcategory,
|            ConfigurationName,
|            ConfigurationId,
|            AssetName,
|            AssetId=coalesce(column_ifexists("AssetId", ""), column_ifexists("TargetAssetId", ""), column_ifexists("ConfigurationId", "")),
|            AssetType=coalesce(column_ifexists("AssetType", ""), column_ifexists("AssetLabel", ""), "Azure"),
|            Impact,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AttackPath,
|            AttackPathDetailed,
|            AttackPathPriority,
|            AttackPathPriorityScore,
|            TierEscalation,
|            IsLateralMovement,
|            LateralMovementType,
|            EscalationWeight,
|            ExposureWeight,
|            GroupNodeId,
|            GroupNodeName,
|            EdgeLabel,
|            FirstIdentityId,
|            FirstIdentityName,
|            FirstIdentityLabel,
|            TotalIdentitiesInGroup = IdentityCount,
|            AllIdentities = Identities,
|            IdentityTypes,
|            FinalTargetId,
|            FinalTarget = FinalTargetName,
|            FinalTargetType = FinalTargetLabel,
|            TargetCriticalityRuleBased,
|            TargetCriticalityRuleNames,
|            TargetAssetTierByTag,
|            TargetIsInternetExposed,
|            TargetLegacyEndOfSupport,
|            SourceCriticalityTier,
|            SourceCriticalityTierLevel,
|            SourceAssetTierByTag,
|            SourceIsInternetExposed,
|            SourceLegacyEndOfSupport,
|            SourceRiskProb,
|            SourceRiskProbDetailed,
|            SourceRiskProbDetailedScore,
|            SourceNodeProperties,
|            TargetNodeProperties
|
|        | order by RiskScore_Weight_Factor desc, AttackPathPriorityScore desc, TierEscalation desc, CriticalityTier asc, FinalTarget asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_Data_Sensitivity_to_Exposed_Credentials
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(IdentityNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(DataLocationNodeId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: Credential-driven attack paths to sensitive data locations prioritized by FINAL TARGET business impact.
|        EG provides path detection (ExposedCredential -> Identity -> DataLocation <- DataSensitivityScan) + scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - UniqueIssues
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - IssueList
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  Exposed credentials enabling access to sensitive data locations using Exposure Graph
|        // =================================================================================================
|        //
|        // Report purpose
|        // Identify sensitive data locations and the credential driven attack paths that can reach them.
|        // The path shape is
|        // ExposedCredential -> Identity -> DataLocation <- DataSensitivityScan
|        // Results are enriched using the standard Nodes context and prioritized by the business impact of the
|        // final target which is the data location. Output is a collapsed summary suitable for your risk engine.
|        //
|        // Interpretation guard and priority rules
|        // - Priority is driven by the target criticality tier first
|        // - Then by tier escalation where source tier is higher than target tier
|        // - Then by internet exposure where target exposure is weighted higher than source exposure
|        // - The source identity matters as an amplifier but the target drives the priority
|        //
|        // Output description summary rows
|        // One row per ConfigurationName which is LateralMovementType grouped within the report taxonomy
|        // and collapsed so many credentials and identities do not multiply the counts.
|        // RiskFactor detailed strings are rebuilt from TargetRiskProbDetailed and TargetRiskProbDetailedScore.
|        //
|        // Query steps overview
|        // Step 0  Define legacy operating system reference lists
|        // Step 1  Build Nodes catalog as enrichment backbone using standard context fields
|        // Step 2  Normalize labels for allowlists
|        // Step 3  Identify sensitive data locations from dataSensitivityScan edges
|        // Step 4  Identify identity access to data locations
|        // Step 5  Identify exposed credentials linked to identities and filter to credential allowlist
|        // Step 6  Build detailed enriched table as Detailed
|        // Step 7  Collapse to PathKey so credential spam does not multiply counts
|        // Step 8  Build SummaryMain with correct counts
|        // Step 9  Rebuild RiskFactor_Probability_Detailed via split expand and re aggregation
|        // Step 10 Rebuild RiskFactor_Probability_DetailedScore via split expand and re aggregation
|        // Step 11 Join summary parts and output final collapsed summary ordering
|        // =================================================================================================
|
|
|
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Build node catalog used to enrich attack paths
|        // Fixes applied
|        // - NodeCiKey (= DeviceKey), AssetName defined in Nodes scope
|        // - Slice filter on the path's final target, not on the node scope (#677)
|        // - RawData and Raw extracted once and then reused
|        let Nodes =
|            ExposureGraphNodes
|            | extend CategoriesStr = tolower(tostring(Categories))
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend AssetName     = NodeNameNorm
|
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend DeviceKey = NodeCiKey
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(RawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend CriticalityRuleBased =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].ruleBasedCriticalityLevel),
|                    tostring(RawData.criticalityLevel.ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.ruleBasedCriticalityLevel)
|                ))
|            | extend EgCriticalityRuleNames =
|                coalesce(
|                    strcat_array(NodeProperties.criticalityLevelProps[0].ruleNames, ", "),
|                    strcat_array(RawData.criticalityLevel.ruleNames, ", "),
|                    ""
|                )
|
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    RawData.isCustomerFacing,
|                    Raw.isCustomerFacing,
|                    false
|                ))
|
|            | extend IsExcluded =
|                tobool(coalesce(
|                    RawData.isExcluded,
|                    Raw.isExcluded,
|                    false
|                ))
|
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|
|            // the exclusion tags (the scope block, from the Exclusions page and the shipped list)
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            | extend CriticalityTier = toint(coalesce(CriticalityTierFromTag, 3))
|            | extend CriticalityTierLevel =
|                case(
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    RawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|
|            | extend _ScoreFactors =
|                array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                )
|            | mv-apply sf = _ScoreFactors on (
|                where isnotempty(trim(" ", tostring(sf)))
|                | summarize ScoreParts = make_set(strcat(tostring(sf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName          = NodeNameNorm,
|                NodeLabel,
|                NodeProperties,
|                CriticalityTier,
|                CriticalityTierLevel,
|                CriticalityRuleBased,
|                EgCriticalityRuleNames,
|                IsInternetExposed,
|                IsExcluded,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence;
|
|
|        // Step 2  Normalize labels to avoid typos breaking allowlists
|        let NormalizeLabel = (s:string) { tolower(trim(" ", replace_string(s, " ", ""))) };
|
|
|        // Step 3  Data location allowlist normalized
|        let DataLocationLabels =
|            dynamic([
|                "blobcontainer",
|                "microsoft.storage/storageaccounts",
|                "microsoft.sql/servers/databases",
|                "microsoft.sql/servers",
|                "microsoft.storage/storageaccounts/blobservices/containers",
|                "microsoft.storage/storageaccounts/fileservices/shares"
|            ]);
|
|
|        // Step 4  Credential allowlist normalized
|        let CredentialLabels =
|            dynamic([
|                "azure-storage-shared-access-signature",
|                "azure-storage-connection-string",
|                "azure-database-connection-string",
|                "azure-active-directory-app-secret",
|                "service-principal-azure-cli-secret",
|                "user-azure-cli-secret",
|                "azure-active-directory-user-credentials",
|                "entra-usercookie"
|            ]);
|
|
|        // Step 5  Find sensitive data locations
|        let SensitiveDataLocations =
|            ExposureGraphEdges
|            | extend TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where SourceNodeLabel == "dataSensitivityScan"
|            // #677 the slices are cut on the path's FINAL TARGET (TargetNodeId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            | extend DeviceKey = TargetNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | where EdgeLabel in ("defined in", "contains")
|            | where TargetNodeLabelNorm in (DataLocationLabels)
|            | project
|                SensitiveDataNodeId   = SourceNodeId,
|                SensitiveDataNodeName = SourceNodeName,
|                DataLocationNodeId    = TargetNodeId,
|                DataLocationNodeName  = TargetNodeName,
|                DataLocationNodeLabel = TargetNodeLabel;
|
|
|        // Step 6  Identity to data location access edges
|        // v2.2.419 (audit #56.2b) -- bound to the data locations a sensitivity scan actually found.
|        // This scanned every permission/role/access edge to any data-location-shaped node in the
|        // tenant. The Step 8 `join kind=inner SensitiveDataLocations on DataLocationNodeId` then
|        // discarded most of them -- but a join constrains the RESULT, not the SCAN, so the set was
|        // still materialised in full. Provably lossless: this removes exactly the rows that inner
|        // join would drop. Same defect and remedy as #56.
|        let _DsDataLocIds = SensitiveDataLocations | distinct DataLocationNodeId;
|        let IdentityAccessToData =
|            ExposureGraphEdges
|            | extend TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where EdgeLabel in ("has permissions to", "has role on", "can authenticate to", "has access to", "can access")
|            | where TargetNodeLabelNorm in (DataLocationLabels)
|            | where TargetNodeId in (_DsDataLocIds)
|            | project
|                IdentityNodeId     = SourceNodeId,
|                DataLocationNodeId = TargetNodeId;
|        // Identities that actually reach sensitive data -- the only ones the Step 8 credential
|        // inner join can keep, so both credential-edge directions below are bounded by it.
|        let _DsIdentityIds = IdentityAccessToData | distinct IdentityNodeId;
|
|
|        // Step 7  Credential exposure edges support both directions
|        let ExposedCredentialsToIdentity =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has credentials of", "can authenticate as", "can authenticate to")
|            // v2.2.419 (#56.2b) -- identity is the TARGET in this direction, so bound that end.
|            | where TargetNodeId in (_DsIdentityIds)
|            | project
|                CredentialNodeId    = SourceNodeId,
|                CredentialName      = SourceNodeName,
|                CredentialLabel     = SourceNodeLabel,
|                IdentityNodeId      = TargetNodeId;
|
|        let IdentityToExposedCredentials =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has credentials of", "uses credential", "uses credentials", "authenticated by")
|            // v2.2.419 (#56.2b) -- identity is the SOURCE in this direction, so bound that end.
|            | where SourceNodeId in (_DsIdentityIds)
|            | project
|                IdentityNodeId      = SourceNodeId,
|                CredentialNodeId    = TargetNodeId,
|                CredentialName      = TargetNodeName,
|                CredentialLabel     = TargetNodeLabel;
|
|        let ExposedCreds =
|            union isfuzzy=true ExposedCredentialsToIdentity, IdentityToExposedCredentials
|            | extend CredentialNodeLabelNorm = NormalizeLabel(CredentialLabel)
|            | where CredentialNodeLabelNorm in (CredentialLabels);
|
|
|        // Step 8  Build the detailed output table
|        let Detailed =
|            IdentityAccessToData
|            | join kind=inner SensitiveDataLocations on DataLocationNodeId
|            | join kind=inner (
|                ExposedCreds
|                | project-rename IdentityNodeId_join = IdentityNodeId
|            ) on $left.IdentityNodeId == $right.IdentityNodeId_join
|            | project
|                DataLocationNodeId,
|                DataLocationNodeName,
|                DataLocationNodeLabel,
|                SensitiveDataNodeId,
|                SensitiveDataNodeName,
|                IdentityNodeId,
|                CredentialNodeId,
|                CredentialName,
|                CredentialLabel
|            | summarize
|                SensitiveDataItems = make_set(SensitiveDataNodeName),
|                SensitiveDataCount = dcount(SensitiveDataNodeId),
|
|                ExposedCredentials     = make_set(CredentialName),
|                ExposedCredentialTypes = make_set(CredentialLabel),
|                ExposedCredentialCount = dcount(CredentialNodeId)
|              by
|                DataLocationNodeId,
|                DataLocationNodeName,
|                DataLocationNodeLabel,
|                IdentityNodeId,
|                CredentialNodeId,
|                CredentialName,
|                CredentialLabel
|
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    TargetNodeId                = NodeId,
|                    TargetNodeCiKey = NodeCiKey,
|                    TargetRiskFactorSet = RiskFactorSet,
|                    TargetCriticalityTier       = CriticalityTier,
|                    TargetCriticalityTierLevel  = CriticalityTierLevel,
|                    TargetCriticalityRuleBased  = CriticalityRuleBased,
|                    TargetCriticalityRuleNames  = EgCriticalityRuleNames,
|                    TargetIsInternetExposed     = IsInternetExposed,
|                    TargetAssetTierByTag        = AssetTierByTag,
|                    TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                    TargetRiskProb              = RiskFactor_Probability,
|                    TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore
|            ) on $left.DataLocationNodeId == $right.TargetNodeId
|
|            | join kind=leftouter (
|                Nodes
|                | project-rename
|                    SourceNodeId                = NodeId,
|                    SourceNodeCiKey = NodeCiKey,
|                    SourceRiskFactorSet = RiskFactorSet,
|                    SourceCriticalityTier       = CriticalityTier,
|                    SourceCriticalityTierLevel  = CriticalityTierLevel,
|                    SourceIsInternetExposed     = IsInternetExposed,
|                    SourceAssetTierByTag        = AssetTierByTag,
|                    SourceLegacyEndOfSupport    = LegacyEndOfSupport,
|                    SourceRiskProb              = RiskFactor_Probability,
|                    SourceRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    SourceRiskProbDetailedScore = RiskFactor_Probability_DetailedScore
|            ) on $left.IdentityNodeId == $right.SourceNodeId
|
|            // the SOURCE's CI (#505) -- tier (the EG criticality only where the CI has no tier) and the asset factors,
|            // the same way as the target. A source without a CI keeps its EG tier and has no asset factors.
|            | extend SourceRiskFactorSet = iff(isnull(SourceRiskFactorSet), dynamic([]), SourceRiskFactorSet)
|            // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|            // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|            // the keys its own rows have (the report field LookupNeededKeys).
|            //__SI_LOOKUP_KEYS_HERE__
|            | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(IdentityNodeId)))
|            | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(DataLocationNodeId)))
|            | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|            | extend Source_si_ci_id = peer_ci_id, Source_si_tier = peer_tier, Source_si_rf_p = peer_rf_p, Source_si_rf_names = peer_rf_names
|            | project-away _peerKey, peer_*
|            | extend SourceAssetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(IdentityNodeId))
|            | extend SourceCriticalityTier = toint(coalesce(Source_si_tier, SourceCriticalityTier))
|            | extend SourceCriticalityTierLevel = case(SourceCriticalityTier == 0, "Critical - tier 0", SourceCriticalityTier == 1, "High - tier 1", SourceCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend _srcIds = coalesce(Source_si_rf_p, dynamic([])), _srcNames = coalesce(Source_si_rf_names, dynamic([]))
|            | extend SourceIsInternetExposed = set_has_element(_srcIds, "internet_exposed"), SourceLegacyEndOfSupport = iff(set_has_element(_srcIds, "unsupported_os"), 1, 0)
|            | extend _srcRf = array_concat(SourceRiskFactorSet, _srcNames)
|            | extend SourceRiskProb = array_length(SourceRiskFactorSet) + array_length(_srcIds)
|            | extend SourceRiskProbDetailed = strcat_array(array_sort_asc(_srcRf), ";")
|            | mv-apply _rf = _srcRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _srcScore = make_set(strcat(_rf, "=1")))
|            | extend SourceRiskProbDetailedScore = strcat_array(array_sort_asc(_srcScore), ";")
|            | project-away _srcRf, _srcScore, _srcIds, _srcNames
|            // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|            // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|            | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|            | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|            | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                     si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|            | project-away _peerKey, peer_*
|            | where coalesce(si_in_scope_, true)
|            | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(DataLocationNodeId))
|            | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|            | extend TargetCriticalityTierLevel = case(TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|            // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|            | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|            | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|            | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|            | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|            | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|            | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|            | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|            | project-away _tgtRf, _tgtScore
|            | extend
|                cmdbId            = si_cmdb_id,
|                cmdbName            = si_cmdb_name,
|                cmdbCriticality     = si_cmdb_criticality,
|                cmdbDataSensitivity = si_cmdb_data_sensitivity
|
|            | extend TierEscalation =
|                case(
|                    isnotempty(SourceCriticalityTier) and isnotempty(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier,
|                        SourceCriticalityTier - TargetCriticalityTier,
|                    0
|                )
|            | extend IsLateralMovement = TierEscalation > 0
|            | extend LateralMovementType =
|                case(
|                    TierEscalation >= 3, "Privilege escalation large tier jump",
|                    TierEscalation == 2, "Privilege escalation two tiers",
|                    TierEscalation == 1, "Privilege escalation one tier",
|                    "Direct access same tier"
|                )
|
|            | extend TargetTierWeight =
|                case(
|                    TargetCriticalityTier == 0, 100,
|                    TargetCriticalityTier == 1, 60,
|                    TargetCriticalityTier == 2, 30,
|                    10
|                )
|            | extend EscalationWeight = TierEscalation * 10
|            | extend ExposureWeight   = iff(TargetIsInternetExposed == true, 8, 0) + iff(SourceIsInternetExposed == true, 3, 0)
|            | extend SourceTierAmplifier =
|                case(
|                    SourceCriticalityTier == 0, 8,
|                    SourceCriticalityTier == 1, 5,
|                    SourceCriticalityTier == 2, 2,
|                    0
|                )
|            | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|
|            | extend AttackPathPriority =
|                case(
|                    AttackPathPriorityScore >= 90,  "Very High",
|                    AttackPathPriorityScore >= 60,  "High",
|                    AttackPathPriorityScore >= 30,  "Medium-High",
|                    AttackPathPriorityScore >= 15,  "Medium",
|                    "Low"
|                )
|
|            | extend SecurityDomain = "Azure"
|            | extend Category = "Attack Paths"
|            | extend SubCategory = "SensitiveDataExposure"
|            | extend ConfigurationName = tostring(LateralMovementType)
|            | extend SecuritySeverity  = tostring(AttackPathPriority)
|            | extend RiskFactor_Consequence = 0;
|
|
|        // ===================== COLLAPSED SUMMARY VERSION FINAL OUTPUT =====================
|
|        // Step 9  Collapse to unique logical path so credential spam does not multiply counts
|        let CollapsedPaths =
|            Detailed
|            | extend PathKey = strcat(CredentialNodeId, "->", IdentityNodeId, "->", DataLocationNodeId)
|            | summarize
|                AttackPathPriorityScore_Path = max(AttackPathPriorityScore),
|                SecuritySeverity_Path        = any(SecuritySeverity),
|
|                TargetCriticalityTier_Path      = any(TargetCriticalityTier),
|                TargetCriticalityTierLevel_Path = any(TargetCriticalityTierLevel),
|                TargetRiskProb_Path             = max(TargetRiskProb),
|
|                TargetRiskProbDetailed_Path      = any(TargetRiskProbDetailed),
|                TargetRiskProbDetailedScore_Path = any(TargetRiskProbDetailedScore),
|
|                // the FINAL TARGET's CMDB values (its CI)
|                cmdbId_Path              = any(cmdbId),
|                cmdbName_Path            = any(cmdbName),
|                cmdbCriticality_Path     = any(cmdbCriticality),
|                cmdbDataSensitivity_Path = any(cmdbDataSensitivity),
|
|                CredentialTypes_Path = make_set(tostring(CredentialLabel)),
|                TargetAssets_Path    = make_set(tostring(DataLocationNodeName)),
|                TotalIssues_Path     = count(),
|                TargetAssetId = any(TargetAssetId)
|              by
|                PathKey,
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                DataLocationNodeId;
|
|
|        // Step 10  Main summary counts stay correct
|        // cmdbCriticality + cmdbDataSensitivity in by-clause so cmdb-bucketed rows survive.
|        let SummaryMain =
|            CollapsedPaths
|            | summarize
|                ConfigurationId = strcat_array(array_sort_asc(make_set(strcat_array(CredentialTypes_Path, ";"))), ";"),
|
|                SecuritySeverity = any(SecuritySeverity_Path),
|                CriticalityTier = toint(any(TargetCriticalityTier_Path)),
|                CriticalityTierLevel = tostring(any(TargetCriticalityTierLevel_Path)),
|
|                RiskFactor_Consequence = 0,
|                RiskFactor_Probability = max(TargetRiskProb_Path),
|
|                AssetCount   = dcount(DataLocationNodeId),
|                TotalIssues  = sum(TotalIssues_Path),
|
|                ImpactedAssets = strcat_array(array_sort_asc(make_set(strcat_array(TargetAssets_Path, ";"))), ";"),
|                ImpactedAssetPairs = make_set(strcat(strcat_array(TargetAssets_Path, ";"), "|", tostring(TargetAssetId)))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|
|        // Step 11  Rebuild probability detail fields via split expand and re aggregation
|        let SummaryDetail =
|            CollapsedPaths
|            | extend _d = split(tostring(TargetRiskProbDetailed_Path), ";")
|            | mv-expand _d to typeof(string)
|            | extend _d = trim(" ", _d)
|            | where isnotempty(_d)
|            | summarize
|                RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(make_set(_d)), ";"),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        let SummaryDetailScore =
|            CollapsedPaths
|            | extend _s = split(tostring(TargetRiskProbDetailedScore_Path), ";")
|            | mv-expand _s to typeof(string)
|            | extend _s = trim(" ", _s)
|            | where isnotempty(_s)
|            | summarize
|                RiskFactor_Probability_DetailedScore = strcat_array(array_sort_asc(make_set(_s)), ";"),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|
|        // Step 12  Final output
|        SummaryMain
|        | join kind=leftouter SummaryDetail      on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        | join kind=leftouter SummaryDetailScore on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            SubCategory,
|            ConfigurationName,
|            ConfigurationId,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AssetCount,
|            TotalIssues,
|            ImpactedAssets, ImpactedAssetPairs
|        | order by
|            RiskScore_Weight_Factor desc,
|            RiskFactor_Probability desc,
|            CriticalityTier asc,
|            TotalIssues desc,
|            AssetCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, UniqueIssues, ImpactedAssetsList, ImpactedAssetIds, IssueList, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Detailed_Data_Sensitivity_to_Exposed_Credentials
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(IdentityNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(DataLocationNodeId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: Per-row detail of credential-driven attack paths to sensitive data locations prioritized by FINAL TARGET business impact.
|        EG drives path detection (ExposedCredential -> Identity -> DataLocation <- DataSensitivityScan) + scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  Exposed credentials enabling access to sensitive data locations using Exposure Graph
|        // =================================================================================================
|        //
|        // Report purpose
|        // Identify sensitive data locations and the credential driven attack paths that can reach them.
|        // The path shape is
|        // ExposedCredential -> Identity -> DataLocation <- DataSensitivityScan
|        // Results are enriched using the standard Nodes context and prioritized by the business impact of the
|        // FINAL TARGET which is the data location.
|        //
|        // Interpretation guard and priority rules
|        // - Priority is driven by the TARGET criticality tier first
|        // - Then by tier escalation where source tier is higher than target tier
|        // - Then by internet exposure where target exposure is weighted higher than source exposure
|        // - A low tier credential source can never outrank a tier 0 or tier 1 target
|        //
|        // Output description detailed rows
|        // One row per unique ExposedCredential -> Identity -> DataLocation path enriched with
|        // - IsInternetExposed for credential source and target location
|        // - AssetTierByTag for source and target
|        // - LegacyEndOfSupport for source and target
|        // - RiskFactor probability fields including detailed breakdown for source and target
|        // - AttackPathPriorityScore and severity label
|        // - Human readable AttackPath and AttackPathDetailed strings
|        //
|        // Query steps overview
|        // Step 0  Define legacy operating system reference lists
|        // Step 1  Build Nodes catalog as enrichment backbone using standard context fields
|        // Step 2  Normalize labels for allowlists
|        // Step 3  Identify sensitive data locations from dataSensitivityScan edges
|        // Step 4  Identify identity access to data locations
|        // Step 5  Identify exposed credentials linked to identities and filter to credential allowlist
|        // Step 6  Assemble credential driven paths and de duplicate to stable grain
|        // Step 7  Enrich credential source identity and target location using Nodes
|        // Step 8  Apply standard prioritization logic and build attack path strings
|        // Step 9  Project detailed output columns and apply ordering
|        // =================================================================================================
|
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Build node catalog used to enrich attack paths
|        let Nodes =
|            ExposureGraphNodes
|            | extend CategoriesStr = tolower(tostring(Categories))
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend DeviceKey = NodeCiKey
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend CriticalityRuleBased =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.rawData.criticalityLevel.ruleBasedCriticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.ruleBasedCriticalityLevel)
|                ))
|            | extend EgCriticalityRuleNames =
|                coalesce(
|                    strcat_array(NodeProperties.criticalityLevelProps[0].ruleNames, ", "),
|                    strcat_array(NodeProperties.rawData.criticalityLevel.ruleNames, ", "),
|                    ""
|                )
|
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    NodeProperties.rawData.isCustomerFacing,
|                    NodeProperties.raw.isCustomerFacing,
|                    false
|                ))
|
|            | extend IsExcluded =
|                tobool(coalesce(
|                    NodeProperties.rawData.isExcluded,
|                    NodeProperties.raw.isExcluded,
|                    false
|                ))
|
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|
|            // the exclusion tags (the scope block, from the Exclusions page and the shipped list)
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            | extend CriticalityTier = toint(coalesce(CriticalityTierFromTag, 3))
|            | extend CriticalityTierLevel =
|                case(
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    NodeProperties.rawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|
|            | mv-apply rf = array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                ) on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize ScoreParts = make_set(strcat(tostring(rf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName          = NodeNameNorm,
|                NodeLabel,
|                NodeProperties,
|                CriticalityTier,
|                CriticalityTierLevel,
|                CriticalityRuleBased,
|                EgCriticalityRuleNames,
|                IsInternetExposed,
|                IsExcluded,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence;
|
|        // Step 2  Normalize labels to avoid typos breaking allowlists
|        let NormalizeLabel = (s:string) { tolower(trim(" ", replace_string(s, " ", ""))) };
|
|        // Step 3  Data location allowlist (normalized)
|        let DataLocationLabels =
|            dynamic([
|                "blobcontainer",
|                "microsoft.storage/storageaccounts",
|                "microsoft.sql/servers/databases",
|                "microsoft.sql/servers",
|                "microsoft.storage/storageaccounts/blobservices/containers",
|                "microsoft.storage/storageaccounts/fileservices/shares"
|            ]);
|
|        // Step 4  Credential allowlist (normalized)
|        let CredentialLabels =
|            dynamic([
|                "azure-storage-shared-access-signature",
|                "azure-storage-connection-string",
|                "azure-database-connection-string",
|                "azure-active-directory-app-secret",
|                "service-principal-azure-cli-secret",
|                "user-azure-cli-secret",
|                "azure-active-directory-user-credentials",
|                "entra-usercookie"
|            ]);
|
|        // Step 5  Find sensitive data locations
|        let SensitiveDataLocations =
|            ExposureGraphEdges
|            | extend TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where SourceNodeLabel == "dataSensitivityScan"
|            // #677 the slices are cut on the path's FINAL TARGET (TargetNodeId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            | extend DeviceKey = TargetNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | where EdgeLabel in ("defined in", "contains")
|            | where TargetNodeLabelNorm in (DataLocationLabels)
|            | project
|                SensitiveDataNodeId   = SourceNodeId,
|                SensitiveDataNodeName = SourceNodeName,
|                DataLocationNodeId    = TargetNodeId,
|                DataLocationNodeName  = TargetNodeName,
|                DataLocationNodeLabel = TargetNodeLabel;
|
|        // Step 6  Identity -> data location access edges
|        // v2.2.419 (audit #56.2b) -- same bounding as the Summary sibling. This variant projects
|        // three extra identity columns, which is why it needs its own copy of these lets.
|        let _DsDataLocIds = SensitiveDataLocations | distinct DataLocationNodeId;
|        let IdentityAccessToData =
|            ExposureGraphEdges
|            | extend TargetNodeLabelNorm = NormalizeLabel(TargetNodeLabel)
|            | where EdgeLabel in ("has permissions to", "has role on", "can authenticate to", "has access to", "can access")
|            | where TargetNodeLabelNorm in (DataLocationLabels)
|            | where TargetNodeId in (_DsDataLocIds)
|            | project
|                IdentityNodeId     = SourceNodeId,
|                IdentityNodeName   = SourceNodeName,
|                IdentityNodeLabel  = SourceNodeLabel,
|                DataLocationNodeId = TargetNodeId;
|        let _DsIdentityIds = IdentityAccessToData | distinct IdentityNodeId;
|
|        // Step 7  Credential exposure edges (support both directions)
|        let ExposedCredentialsToIdentity =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has credentials of", "can authenticate as", "can authenticate to")
|            | project
|                CredentialNodeId    = SourceNodeId,
|                CredentialNodeName  = SourceNodeName,
|                CredentialNodeLabel = SourceNodeLabel,
|                IdentityNodeId      = TargetNodeId;
|
|        let IdentityToExposedCredentials =
|            ExposureGraphEdges
|            | where EdgeLabel in ("has credentials of", "uses credential", "uses credentials", "authenticated by")
|            // v2.2.419 (#56.2b) -- identity is the SOURCE in this direction, so bound that end.
|            | where SourceNodeId in (_DsIdentityIds)
|            | project
|                IdentityNodeId      = SourceNodeId,
|                CredentialNodeId    = TargetNodeId,
|                CredentialNodeName  = TargetNodeName,
|                CredentialNodeLabel = TargetNodeLabel;
|
|        // Step 8  Union both forms and then filter credential types
|        let ExposedCreds =
|            union isfuzzy=true ExposedCredentialsToIdentity, IdentityToExposedCredentials
|            | extend CredentialNodeLabelNorm = NormalizeLabel(CredentialNodeLabel)
|            | where CredentialNodeLabelNorm in (CredentialLabels);
|
|        // Step 9  Assemble detailed paths and enrich source and target using Nodes
|        IdentityAccessToData
|        | join kind=inner SensitiveDataLocations on DataLocationNodeId
|        | join kind=inner ExposedCreds on IdentityNodeId
|        | summarize
|            SensitiveDataItems        = make_set(SensitiveDataNodeName),
|            SensitiveDataCount        = dcount(SensitiveDataNodeId),
|
|            CredentialNodeId          = any(CredentialNodeId),
|            CredentialName            = any(CredentialNodeName),
|            CredentialLabel           = any(CredentialNodeLabel),
|
|            ExposedCredentials        = make_set(CredentialNodeName),
|            ExposedCredentialTypes    = make_set(CredentialNodeLabel),
|            ExposedCredentialCount    = dcount(CredentialNodeId),
|
|            IdentityNodeId            = any(IdentityNodeId),
|            IdentityName              = any(IdentityNodeName),
|            IdentityLabel             = any(IdentityNodeLabel),
|
|            DataLocationNodeName      = any(DataLocationNodeName),
|            DataLocationNodeLabel     = any(DataLocationNodeLabel)
|          by DataLocationNodeId
|
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                TargetNodeId                = NodeId,
|                TargetNodeCiKey = NodeCiKey,
|                TargetRiskFactorSet = RiskFactorSet,
|                TargetNodeName              = NodeName,
|                TargetNodeLabel             = NodeLabel,
|                TargetCriticalityTier       = CriticalityTier,
|                TargetCriticalityTierLevel  = CriticalityTierLevel,
|                TargetCriticalityRuleBased  = CriticalityRuleBased,
|                TargetCriticalityRuleNames  = EgCriticalityRuleNames,
|                TargetIsInternetExposed     = IsInternetExposed,
|                TargetIsExcluded            = IsExcluded,
|                TargetAssetTierByTag        = AssetTierByTag,
|                TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                TargetRiskProb              = RiskFactor_Probability,
|                TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                TargetNodeProperties        = NodeProperties
|        ) on $left.DataLocationNodeId == $right.TargetNodeId
|
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                SourceNodeId                = NodeId,
|                SourceNodeCiKey = NodeCiKey,
|                SourceRiskFactorSet = RiskFactorSet,
|                SourceNodeName              = NodeName,
|                SourceNodeLabel             = NodeLabel,
|                SourceCriticalityTier       = CriticalityTier,
|                SourceCriticalityTierLevel  = CriticalityTierLevel,
|                SourceIsInternetExposed     = IsInternetExposed,
|                SourceIsExcluded            = IsExcluded,
|                SourceAssetTierByTag        = AssetTierByTag,
|                SourceLegacyEndOfSupport    = LegacyEndOfSupport,
|                SourceRiskProb              = RiskFactor_Probability,
|                SourceRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                SourceRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                SourceNodeProperties        = NodeProperties
|        ) on $left.IdentityNodeId == $right.SourceNodeId
|
|        | join kind=leftouter (
|            Nodes
|            | project-rename
|                CredentialNodeId_join       = NodeId,
|                CredentialNodeName_join     = NodeName,
|                CredentialNodeLabel_join    = NodeLabel,
|                CredentialIsInternetExposed = IsInternetExposed,
|                CredentialAssetTierByTag    = AssetTierByTag,
|                CredentialLegacyEndOfSupport= LegacyEndOfSupport,
|                CredentialRiskProb          = RiskFactor_Probability,
|                CredentialRiskProbDetailed  = RiskFactor_Probability_Detailed,
|                CredentialRiskProbDetailedScore = RiskFactor_Probability_DetailedScore,
|                CredentialNodeProperties    = NodeProperties
|        ) on $left.CredentialNodeId == $right.CredentialNodeId_join
|
|        // the SOURCE's CI (#505) -- tier (the EG criticality only where the CI has no tier) and the asset factors,
|        // the same way as the target. A source without a CI keeps its EG tier and has no asset factors.
|        | extend SourceRiskFactorSet = iff(isnull(SourceRiskFactorSet), dynamic([]), SourceRiskFactorSet)
|        // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|        // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|        // the keys its own rows have (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(IdentityNodeId)))
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(DataLocationNodeId)))
|        | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|        | extend Source_si_ci_id = peer_ci_id, Source_si_tier = peer_tier, Source_si_rf_p = peer_rf_p, Source_si_rf_names = peer_rf_names
|        | project-away _peerKey, peer_*
|        | extend SourceAssetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(IdentityNodeId))
|        | extend SourceCriticalityTier = toint(coalesce(Source_si_tier, SourceCriticalityTier))
|        | extend SourceCriticalityTierLevel = case(SourceCriticalityTier == 0, "Critical - tier 0", SourceCriticalityTier == 1, "High - tier 1", SourceCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|        | extend _srcIds = coalesce(Source_si_rf_p, dynamic([])), _srcNames = coalesce(Source_si_rf_names, dynamic([]))
|        | extend SourceIsInternetExposed = set_has_element(_srcIds, "internet_exposed"), SourceLegacyEndOfSupport = iff(set_has_element(_srcIds, "unsupported_os"), 1, 0)
|        | extend _srcRf = array_concat(SourceRiskFactorSet, _srcNames)
|        | extend SourceRiskProb = array_length(SourceRiskFactorSet) + array_length(_srcIds)
|        | extend SourceRiskProbDetailed = strcat_array(array_sort_asc(_srcRf), ";")
|        | mv-apply _rf = _srcRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _srcScore = make_set(strcat(_rf, "=1")))
|        | extend SourceRiskProbDetailedScore = strcat_array(array_sort_asc(_srcScore), ";")
|        | project-away _srcRf, _srcScore, _srcIds, _srcNames
|        // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|        // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(si_in_scope_, true)
|        | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(DataLocationNodeId))
|        | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|        | extend TargetCriticalityTierLevel = case(TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|        | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|        // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|
|        // Step 10  Apply standard prioritization logic based on FINAL TARGET
|        | extend TierEscalation =
|            case(
|                isnotempty(SourceCriticalityTier) and isnotempty(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier,
|                    SourceCriticalityTier - TargetCriticalityTier,
|                0
|            )
|        | extend IsLateralMovement = TierEscalation > 0
|        | extend LateralMovementType =
|            case(
|                TierEscalation >= 3, "Privilege escalation large tier jump",
|                TierEscalation == 2, "Privilege escalation two tiers",
|                TierEscalation == 1, "Privilege escalation one tier",
|                "Direct access same tier"
|            )
|
|        | extend TargetTierWeight =
|            case(
|                TargetCriticalityTier == 0, 100,
|                TargetCriticalityTier == 1, 60,
|                TargetCriticalityTier == 2, 30,
|                10
|            )
|        | extend EscalationWeight = TierEscalation * 10
|        | extend ExposureWeight   = iff(TargetIsInternetExposed == true, 8, 0) + iff(SourceIsInternetExposed == true, 3, 0)
|        | extend SourceTierAmplifier =
|            case(
|                SourceCriticalityTier == 0, 8,
|                SourceCriticalityTier == 1, 5,
|                SourceCriticalityTier == 2, 2,
|                0
|            )
|        | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|
|        | extend AttackPathPriority =
|            case(
|                AttackPathPriorityScore >= 90,  "Very High",
|                AttackPathPriorityScore >= 60,  "High",
|                AttackPathPriorityScore >= 30,  "Medium-High",
|                AttackPathPriorityScore >= 15,  "Medium",
|                "Low"
|            )
|
|        | extend InternetExposureTarget = iff(TargetIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|        | extend InternetExposureSource = iff(SourceIsInternetExposed == true, "Internet-Exposed", "Not Internet-Exposed")
|
|        | extend SecurityDomain = "Azure"
|        | extend Category = "Attack Paths"
|        | extend Subcategory = "SensitiveDataExposure"
|
|        // Step 11  Human readable paths
|        | extend AttackPath =
|            strcat(
|                CredentialLabel, " [", CredentialName, "] -> ",
|                IdentityLabel, " [", IdentityName, "] -> ",
|                DataLocationNodeLabel, " [", DataLocationNodeName, "]"
|            )
|
|        | extend AttackPathDetailed =
|            strcat(
|                "CREDENTIAL ", CredentialLabel, " [", CredentialName, "] ",
|                iff(ExposedCredentialCount > 1, strcat("| + ", tostring(ExposedCredentialCount - 1), " other credential(s) "), ""),
|                "-> IDENTITY ", IdentityLabel, " [", IdentityName, "] ",
|                "tier ", tostring(SourceCriticalityTier), " ", tostring(SourceCriticalityTierLevel), " | ", InternetExposureSource,
|                " -> TARGET ", DataLocationNodeLabel, " [", DataLocationNodeName, "] ",
|                "tier ", tostring(TargetCriticalityTier), " ", tostring(TargetCriticalityTierLevel), " | ", InternetExposureTarget,
|                " | escalation ", tostring(TierEscalation),
|                " | ", LateralMovementType,
|                " | sensitive items ", tostring(SensitiveDataCount)
|            )
|
|        // Per-row identity columns expected by engine dedup (AssetName, ConfigurationName/Id).
|        // ConfigurationId carries the FINAL TARGET id (DataLocationNodeId) so (AssetName, ConfigurationId) is unique per row.
|        | extend
|            AssetName              = DataLocationNodeName,
|            AssetLabel             = DataLocationNodeLabel,
|            ConfigurationName      = tostring(LateralMovementType),
|            ConfigurationId        = tostring(DataLocationNodeId),
|            SecuritySeverity       = tostring(AttackPathPriority),
|            Impact                 = todouble(AttackPathPriorityScore),
|            CriticalityTier        = TargetCriticalityTier,
|            CriticalityTierLevel   = TargetCriticalityTierLevel,
|            RiskFactor_Consequence = 0,
|            RiskFactor_Probability = TargetRiskProb,
|            RiskFactor_Probability_Detailed      = TargetRiskProbDetailed,
|            RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|
|        // Step 12  Final projection detailed output
|        | project
|            SecurityDomain,
|            Category,
|            Subcategory,
|            ConfigurationName,
|            ConfigurationId,
|            AssetName,
|            AssetId=coalesce(column_ifexists("AssetId", ""), column_ifexists("TargetAssetId", ""), column_ifexists("ConfigurationId", "")),
|            AssetType=coalesce(column_ifexists("AssetType", ""), column_ifexists("AssetLabel", ""), "Azure"),
|            Impact,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AttackPath,
|            AttackPathDetailed,
|            AttackPathPriority,
|            AttackPathPriorityScore,
|            TierEscalation,
|            IsLateralMovement,
|            LateralMovementType,
|            EscalationWeight,
|            ExposureWeight,
|            DataLocationNodeId,
|            DataLocationNodeName,
|            DataLocationNodeLabel,
|            SensitiveDataCount,
|            SensitiveDataItems,
|            CredentialNodeId,
|            CredentialName,
|            CredentialLabel,
|            ExposedCredentialCount,
|            ExposedCredentials,
|            ExposedCredentialTypes,
|            IdentityNodeId,
|            IdentityName,
|            IdentityLabel,
|            TargetAssetTierByTag,
|            TargetIsInternetExposed,
|            TargetLegacyEndOfSupport,
|            TargetCriticalityRuleBased,
|            TargetCriticalityRuleNames,
|            SourceCriticalityTier,
|            SourceCriticalityTierLevel,
|            SourceAssetTierByTag,
|            SourceIsInternetExposed,
|            SourceLegacyEndOfSupport,
|            SourceRiskProb,
|            SourceRiskProbDetailed,
|            SourceRiskProbDetailedScore,
|            CredentialIsInternetExposed,
|            CredentialAssetTierByTag,
|            CredentialLegacyEndOfSupport,
|            CredentialRiskProb,
|            CredentialRiskProbDetailed,
|            CredentialRiskProbDetailedScore,
|            SourceNodeProperties,
|            TargetNodeProperties,
|            CredentialNodeProperties
|
|        | order by RiskScore_Weight_Factor desc, AttackPathPriorityScore desc, TierEscalation desc, CriticalityTier asc, DataLocationNodeName asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|
|    - ReportName: Attack_Paths_Summary_Credential_Based_Lateral_Movement
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(FirstSourceAssetId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: Credential-driven lateral-movement paths to Azure and Endpoint targets prioritized by FINAL TARGET business impact.
|        EG provides path detection (SourceAsset -> Credential -> Identity -> AzureTarget) + scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - UniqueIssues
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - IssueList
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // the objects inside each subscription and resource group, from the graph's own contains edges -- a role on a scope is
|        // reported on the objects inside it, never on the scope itself (owner 2026-10-19)
|        let _SI_ScopeContains = ExposureGraphEdges
|            | where EdgeLabel =~ "contains" and SourceNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")
|            | project _ScopeNodeId = SourceNodeId, _ChildId = TargetNodeId, _ChildName = TargetNodeName, _ChildLabel = TargetNodeLabel;
|        let _SI_ScopeMembers = union
|            (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel),
|            (_SI_ScopeContains | where _ChildLabel in~ ("resourcegroups", "microsoft.resources/resourcegroups") | project _ScopeNodeId, _RgNodeId = _ChildId
|                | join kind=inner (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _RgNodeId = _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel) on _RgNodeId
|                | project _ScopeNodeId, _MemberId, _MemberName, _MemberLabel)
|            | summarize _MemberName = take_any(_MemberName), _MemberLabel = take_any(_MemberLabel) by _ScopeNodeId, _MemberId;
|        // =================================================================================================
|        // REPORT  Credential driven lateral movement paths to Azure and Endpoint targets using Exposure Graph
|        // Bucketing applied to the Hop 2 edges on the FINAL TARGET (#677) - each path in exactly one slice
|        // =================================================================================================
|
|        // Step 0  Legacy OS definitions for probability scoring
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Credential edges (not sliced since #677 -- every source of a credential is needed in its slice)
|        // EdgeLabel + SourceNodeLabel + TargetNodeLabel filters narrow the set BEFORE bucketing
|        // (the slice key is the Hop 2 TargetNodeId, the path's final target, see Step 3)
|        let CredentialEdges =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("contains", "defined in", "runs on", "has credentials of")
|            // #690 every credential the graph holds, wherever it sits -- a node of the secret category, or one of the credential
|            // labels below, compared case-insensitively (the graph writes entra-userCookie -- the exact-case entra-usercookie
|            // lost every session-cookie path). No list of source kinds -- the asset a credential sits on is the path's source,
|            // whatever its kind (the fixed lists reached 32 of 97 targets on a live install).
|            | where set_has_element(TargetNodeCategories, "secret") or TargetNodeLabel in~ (
|                "azure-active-directory-app-secret",
|                "user-azure-cli-secret",
|                "azure-storage-shared-access-signature",
|                "azure-storage-connection-string",
|                "azure-database-connection-string",
|                "azure-active-directory-user-credentials",
|                "service-principal-azure-cli-secret",
|                "entra-userCookie",
|                "lsa-secret",
|                "github-personal-access-token",
|                "azure-app-configuration-key",
|                "certificate",
|                "openai-api-key"
|            )
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|            | project
|                SourceNodeId, SourceNodeName, SourceNodeLabel,
|                TargetNodeId, TargetNodeName, TargetNodeLabel,
|                EdgeLabel;
|
|        // Step 2  Hop 1 edges -- BOUND to the credentials found in Step 1.
|        // v2.2.417 -- this previously claimed "no bucketing needed, naturally constrained by
|        // downstream join to CredentialEdges". That premise is FALSE. A join constrains the
|        // RESULT, not the SCAN -- Kusto still materialises every "has credentials of" /
|        // "can authenticate as" / "can authenticate to" edge in the tenant and only then
|        // discards non-matches. So this hop set never shrank, with or without bucketing, and
|        // the Step 7 inner joins exploded on hub identities (inbound x outbound edges). No
|        // bucket depth can split that, because a hub is a SINGLE node -- which is why
|        // sub-bucketing bisected forever with 3 of 4 children returning 0 rows in ~5s.
|        // The semi-join below removes EXACTLY the rows the Step 7 inner join would discard
|        // (CredentialsOnAssets groups by CredentialNodeId = CredentialEdges.TargetNodeId), so
|        // it is provably lossless -- and it makes bucketing actually work, because the hop set
|        // now shrinks WITH the bucket instead of staying tenant-wide.
|        let Hop1Edges =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("has credentials of", "can authenticate as", "can authenticate to")
|            | where SourceNodeId in (CredentialEdges | distinct TargetNodeId)
|            | project
|                SourceNodeId, SourceNodeName, SourceNodeLabel,
|                TargetNodeId, TargetNodeName, TargetNodeLabel,
|                EdgeLabel;
|
|        // Step 3  Hop 2 edges -- BOUND to the identities reached in Step 2.
|        // Same defect and same lossless remedy as Step 2. This set is the more dangerous of the
|        // two, because its TargetNodeLabel list includes "subscriptions" and "resourcegroups" --
|        // node types that legitimately carry thousands of inbound edges -- so leaving it
|        // tenant-wide is what turned the Step 7 join into a cartesian product on hub nodes.
|        let Hop2Edges =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("can authenticate to", "runs on", "has permissions to", "has role on")
|            // #690 every Azure resource the identity reaches (any microsoft.* type, startswith ignores case), the subscription and
|            // resource group scopes, devices and blob containers -- the fixed list of 21 types left out container registries,
|            // network interfaces, locks, ...
|            | where TargetNodeLabel startswith "microsoft." or TargetNodeLabel in~ ("subscriptions", "resourcegroups", "device", "computer-account", "BlobContainer")
|            | where SourceNodeId in (Hop1Edges | distinct TargetNodeId)
|            // #677 the slices are cut on the path's FINAL TARGET (TargetNodeId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            // a subscription or resource group target is replaced by the objects inside it -- once per object, so an object reached
|            // directly and through its resource group and subscription is one path (owner 2026-10-19)
|            | join kind=leftouter (_SI_ScopeMembers) on $left.TargetNodeId == $right._ScopeNodeId
|            | where isnotempty(_MemberId) or not(TargetNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups"))
|            | extend TargetNodeId = iff(isnotempty(_MemberId), _MemberId, TargetNodeId), TargetNodeName = iff(isnotempty(_MemberId), _MemberName, TargetNodeName), TargetNodeLabel = iff(isnotempty(_MemberId), _MemberLabel, TargetNodeLabel)
|            | extend _SI_ViaScope = isnotempty(_MemberId)
|            | project-away _ScopeNodeId, _MemberId, _MemberName, _MemberLabel
|            | extend DeviceKey = TargetNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | project
|                SourceNodeId, SourceNodeName, SourceNodeLabel,
|                TargetNodeId, TargetNodeName, TargetNodeLabel,
|                EdgeLabel;
|
|        // Step 4  Identify credentials on source assets
|        let CredentialsOnAssets =
|            CredentialEdges
|            | summarize
|                SourceAssets          = make_set(SourceNodeName),
|                SourceAssetTypes      = make_set(SourceNodeLabel),
|                SourceAssetCount      = dcount(SourceNodeId),
|                FirstSourceAssetId    = min(SourceNodeId),
|                FirstSourceAssetName  = any(SourceNodeName),
|                FirstSourceAssetLabel = any(SourceNodeLabel),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                CredentialNodeId  = TargetNodeId,
|                CredentialName    = TargetNodeName,
|                CredentialLabel   = TargetNodeLabel;
|
|        // Step 5  Hop 1 -- credential authenticates as identity
|        let Hop1 =
|            Hop1Edges
|            | project
|                CredentialNodeId          = SourceNodeId,
|                Hop1_EdgeLabel            = EdgeLabel,
|                IntermediateIdentityId    = TargetNodeId,
|                IntermediateIdentity      = TargetNodeName,
|                IntermediateIdentityLabel = TargetNodeLabel;
|
|        // Step 6  Hop 2 -- identity reaches target resource
|        let Hop2 =
|            Hop2Edges
|            | project
|                Hop2_SourceIdentityId = SourceNodeId,
|                Hop2_EdgeLabel        = EdgeLabel,
|                FinalTargetId         = TargetNodeId,
|                FinalTargetName       = TargetNodeName,
|                FinalTargetLabel      = TargetNodeLabel;
|
|        // Step 7  Assemble and stabilize paths
|        let Paths =
|            CredentialsOnAssets
|            | join kind=inner (Hop1) on CredentialNodeId
|            | join kind=inner (Hop2) on $left.IntermediateIdentityId == $right.Hop2_SourceIdentityId
|            | where FirstSourceAssetId != FinalTargetId
|            | summarize
|                FirstSourceAssetName      = any(FirstSourceAssetName),
|                FirstSourceAssetLabel     = any(FirstSourceAssetLabel),
|                CredentialName            = any(CredentialName),
|                CredentialLabel           = any(CredentialLabel),
|                IntermediateIdentity      = any(IntermediateIdentity),
|                IntermediateIdentityLabel = any(IntermediateIdentityLabel),
|                Hop1Edge                  = any(Hop1_EdgeLabel),
|                Hop2Edge                  = any(Hop2_EdgeLabel),
|                FinalTargetName           = any(FinalTargetName),
|                FinalTargetLabel          = any(FinalTargetLabel),
|                SourceAssets              = any(SourceAssets),
|                SourceAssetTypes          = any(SourceAssetTypes),
|                SourceAssetCount          = any(SourceAssetCount),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                FirstSourceAssetId,
|                CredentialNodeId,
|                IntermediateIdentityId,
|                FinalTargetId;
|
|        // Step 8  Collect node IDs that need enrichment
|        let EnrichIds =
|            union
|                (Paths | project NodeId = FirstSourceAssetId),
|                (Paths | project NodeId = CredentialNodeId),
|                (Paths | project NodeId = IntermediateIdentityId),
|                (Paths | project NodeId = FinalTargetId)
|            | where isnotempty(tostring(column_ifexists("NodeId", "")))
|            | summarize by NodeId;
|
|        // Step 9  Enrich only the nodes actually used in paths
|        let Nodes =
|            ExposureGraphNodes
|            | where NodeId in (EnrichIds | project NodeId)
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(RawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    RawData.isCustomerFacing,
|                    Raw.isCustomerFacing,
|                    false
|                ))
|            | extend IsExcluded =
|                tobool(coalesce(
|                    RawData.isExcluded,
|                    Raw.isExcluded,
|                    false
|                ))
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            // #690 a node without a tier tag keeps no tier (an empty level) -- never shown as tier 3
|            | extend CriticalityTier = toint(CriticalityTierFromTag)
|            | extend CriticalityTierLevel =
|                case(
|                    isnull(CriticalityTier), "",
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    RawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|            | extend _ScoreFactors =
|                array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                )
|            | mv-apply sf = _ScoreFactors on (
|                where isnotempty(trim(" ", tostring(sf)))
|                | summarize ScoreParts = make_set(strcat(tostring(sf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName              = NodeNameNorm,
|                NodeLabel,
|                CriticalityTier,
|                CriticalityTierLevel,
|                IsInternetExposed,
|                IsExcluded,
|                EgNodeTags,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence;
|
|        // Step 10  Enrich paths with node metadata
|        let Detailed =
|            Paths
|            | join kind=leftouter (
|                Nodes
|                | project
|                    SourceNodeId                = NodeId,
|                    SourceNodeCiKey = NodeCiKey,
|                    SourceRiskFactorSet = RiskFactorSet,
|                    SourceCriticalityTier       = CriticalityTier,
|                    SourceCriticalityTierLevel  = CriticalityTierLevel,
|                    SourceIsInternetExposed     = IsInternetExposed,
|                    SourceIsExcluded            = IsExcluded,
|                    SourceAssetTierByTag        = AssetTierByTag,
|                    SourceLegacyEndOfSupport    = LegacyEndOfSupport,
|                    SourceRiskProb              = RiskFactor_Probability,
|                    SourceRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    SourceRiskProbDetailedScore = RiskFactor_Probability_DetailedScore
|              ) on $left.FirstSourceAssetId == $right.SourceNodeId
|            | join kind=leftouter (
|                Nodes
|                | project
|                    IntermediateNodeId                = NodeId,
|                    IntermediateCriticalityTier       = CriticalityTier,
|                    IntermediateCriticalityTierLevel  = CriticalityTierLevel,
|                    IntermediateIsInternetExposed     = IsInternetExposed,
|                    IntermediateLegacyEndOfSupport    = LegacyEndOfSupport,
|                    IntermediateRiskProb              = RiskFactor_Probability,
|                    IntermediateRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    IntermediateRiskProbDetailedScore = RiskFactor_Probability_DetailedScore
|              ) on $left.IntermediateIdentityId == $right.IntermediateNodeId
|            | join kind=leftouter (
|                Nodes
|                | project
|                    TargetNodeId                = NodeId,
|                    TargetNodeCiKey = NodeCiKey,
|                    TargetRiskFactorSet = RiskFactorSet,
|                    TargetCriticalityTier       = CriticalityTier,
|                    TargetCriticalityTierLevel  = CriticalityTierLevel,
|                    TargetIsInternetExposed     = IsInternetExposed,
|                    TargetIsExcluded            = IsExcluded,
|                    TargetAssetTierByTag        = AssetTierByTag,
|                    TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                    TargetRiskProb              = RiskFactor_Probability,
|                    TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore
|              ) on $left.FinalTargetId == $right.TargetNodeId
|            // the SOURCE's CI (#505) -- tier (the EG criticality only where the CI has no tier) and the asset factors,
|            // the same way as the target. A source without a CI keeps its EG tier and has no asset factors.
|            | extend SourceRiskFactorSet = iff(isnull(SourceRiskFactorSet), dynamic([]), SourceRiskFactorSet)
|            // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|            // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|            // the keys its own rows have (the report field LookupNeededKeys).
|            //__SI_LOOKUP_KEYS_HERE__
|            | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(FirstSourceAssetId)))
|            | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|            | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|            | extend Source_si_ci_id = peer_ci_id, Source_si_tier = peer_tier, Source_si_rf_p = peer_rf_p, Source_si_rf_names = peer_rf_names
|            | project-away _peerKey, peer_*
|            | extend SourceAssetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(FirstSourceAssetId))
|            | extend SourceCriticalityTier = toint(coalesce(Source_si_tier, SourceCriticalityTier))
|            | extend SourceCriticalityTierLevel = case(isnull(SourceCriticalityTier), "", SourceCriticalityTier == 0, "Critical - tier 0", SourceCriticalityTier == 1, "High - tier 1", SourceCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend _srcIds = coalesce(Source_si_rf_p, dynamic([])), _srcNames = coalesce(Source_si_rf_names, dynamic([]))
|            | extend SourceIsInternetExposed = set_has_element(_srcIds, "internet_exposed"), SourceLegacyEndOfSupport = iff(set_has_element(_srcIds, "unsupported_os"), 1, 0)
|            | extend _srcRf = array_concat(SourceRiskFactorSet, _srcNames)
|            | extend SourceRiskProb = array_length(SourceRiskFactorSet) + array_length(_srcIds)
|            | extend SourceRiskProbDetailed = strcat_array(array_sort_asc(_srcRf), ";")
|            | mv-apply _rf = _srcRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _srcScore = make_set(strcat(_rf, "=1")))
|            | extend SourceRiskProbDetailedScore = strcat_array(array_sort_asc(_srcScore), ";")
|            | project-away _srcRf, _srcScore, _srcIds, _srcNames
|            // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|            // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|            | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|            | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|            | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                     si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|            | project-away _peerKey, peer_*
|            | where coalesce(si_in_scope_, true)
|            | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(FinalTargetId))
|            | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|            | extend TargetCriticalityTierLevel = case(isnull(TargetCriticalityTier), "", TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|            // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|            | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|            | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|            | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|            | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|            | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|            | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|            | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|            | project-away _tgtRf, _tgtScore
|            | extend
|                cmdbId            = si_cmdb_id,
|                cmdbName            = si_cmdb_name,
|                cmdbCriticality     = si_cmdb_criticality,
|                cmdbDataSensitivity = si_cmdb_data_sensitivity
|            | extend TierEscalation =
|                case(
|                    isnotempty(SourceCriticalityTier) and isnotempty(TargetCriticalityTier)
|                        and SourceCriticalityTier > TargetCriticalityTier,
|                        SourceCriticalityTier - TargetCriticalityTier,
|                    0
|                )
|            | extend LateralMovementType =
|                case(
|                    isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|                    TierEscalation >= 3, "Privilege escalation large tier jump",
|                    TierEscalation == 2, "Privilege escalation two tiers",
|                    TierEscalation == 1, "Privilege escalation one tier",
|                    "Direct access same tier"
|                )
|            | extend TargetTierWeight =
|                case(
|                    TargetCriticalityTier == 0, 100,
|                    TargetCriticalityTier == 1, 60,
|                    TargetCriticalityTier == 2, 30,
|                    10
|                )
|            | extend EscalationWeight    = TierEscalation * 10
|            | extend ExposureWeight      = iff(TargetIsInternetExposed == true, 8, 0)
|                                         + iff(SourceIsInternetExposed == true, 3, 0)
|            | extend SourceTierAmplifier =
|                case(
|                    SourceCriticalityTier == 0, 8,
|                    SourceCriticalityTier == 1, 5,
|                    SourceCriticalityTier == 2, 2,
|                    0
|                )
|            | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|            | extend AttackPathPriority =
|                case(
|                    AttackPathPriorityScore >= 90, "Very High",
|                    AttackPathPriorityScore >= 60, "High",
|                    AttackPathPriorityScore >= 30, "Medium-High",
|                    AttackPathPriorityScore >= 15, "Medium",
|                    "Low"
|                )
|            | project
|                AttackPathPriority,
|                AttackPathPriorityScore,
|                TierEscalation,
|                LateralMovementType,
|                FirstSourceAssetId,
|                FirstSourceAssetName,
|                FirstSourceAssetLabel,
|                IntermediateIdentityId,
|                IntermediateIdentity,
|                IntermediateIdentityLabel,
|                CredentialNodeId,
|                CredentialName,
|                CredentialLabel,
|                FinalTargetId,
|                FinalTargetName,
|                FinalTargetLabel,
|                TargetCriticalityTier,
|                TargetCriticalityTierLevel,
|                TargetAssetTierByTag,
|                TargetIsInternetExposed,
|                TargetLegacyEndOfSupport,
|                TargetRiskProb              = coalesce(TargetRiskProb, 0),
|                TargetRiskProbDetailed      = coalesce(TargetRiskProbDetailed, ""),
|                TargetRiskProbDetailedScore = coalesce(TargetRiskProbDetailedScore, ""),
|                SourceCriticalityTier,
|                SourceCriticalityTierLevel,
|                SourceIsInternetExposed,
|                SourceLegacyEndOfSupport,
|                SourceRiskProb              = coalesce(SourceRiskProb, 0),
|                SourceRiskProbDetailed      = coalesce(SourceRiskProbDetailed, ""),
|                SourceRiskProbDetailedScore = coalesce(SourceRiskProbDetailedScore, ""),
|                SourceAssetCount,
|                SourceAssets,
|                SourceAssetTypes,
|                Hop1Edge,
|                Hop2Edge,
|                cmdbId,
|                cmdbName,
|                cmdbCriticality,
|                cmdbDataSensitivity,
|                TargetAssetId;
|
|        // Step 11  Collapse to unique logical path key
|        let CollapsedPaths =
|            Detailed
|            | extend PathKey = strcat(FirstSourceAssetId, "->", IntermediateIdentityId, "->", FinalTargetId)
|            | extend SecurityDomain = "Azure"
|            | extend
|                Category               = "Attack Paths",
|                SubCategory            = "LateralMovement",
|                ConfigurationName      = tostring(LateralMovementType),
|                SecuritySeverity       = tostring(AttackPathPriority),
|                RiskFactor_Consequence = 0
|            | summarize
|                SecuritySeverity_Path            = any(SecuritySeverity),
|                TargetCriticalityTier_Path       = any(TargetCriticalityTier),
|                TargetCriticalityTierLevel_Path  = any(TargetCriticalityTierLevel),
|                TargetRiskProb_Path              = max(TargetRiskProb),
|                TargetRiskProbDetailed_Path      = any(TargetRiskProbDetailed),
|                TargetRiskProbDetailedScore_Path = any(TargetRiskProbDetailedScore),
|                // the FINAL TARGET's CMDB values (its CI)
|                cmdbId_Path              = any(cmdbId),
|                cmdbName_Path            = any(cmdbName),
|                cmdbCriticality_Path             = any(cmdbCriticality),
|                cmdbDataSensitivity_Path         = any(cmdbDataSensitivity),
|                CredentialLabels_Path            = make_set(tostring(CredentialLabel)),
|                SourceAssets_Path                = make_set(tostring(FirstSourceAssetName)),
|                // TargetAssets_Path is what AssetCount (dcount(FinalTargetId)) actually counts --
|                // the Azure resources under attack. ImpactedAssets below uses this so the
|                // asset-count and the asset-names match the same entity (targets).
|                TargetAssets_Path                = make_set(tostring(FinalTargetName)),
|                TotalIssues_Path                 = count(),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                PathKey,
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                FinalTargetId;
|
|        // Step 12  Summarize to report grain
|        // cmdbCriticality + cmdbDataSensitivity in by-clause so cmdb-bucketed rows survive.
|        let SummaryMain =
|            CollapsedPaths
|            | summarize
|                ConfigurationId        = strcat_array(array_sort_asc(make_set(strcat_array(CredentialLabels_Path, ";"))), ";"),
|                SecuritySeverity       = any(SecuritySeverity_Path),
|                CriticalityTier        = toint(any(TargetCriticalityTier_Path)),
|                CriticalityTierLevel   = tostring(any(TargetCriticalityTierLevel_Path)),
|                RiskFactor_Consequence = 0,
|                RiskFactor_Probability = max(TargetRiskProb_Path),
|                AssetCount             = dcount(FinalTargetId),
|                TotalIssues            = sum(TotalIssues_Path),
|                ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat_array(TargetAssets_Path, ";"))), ";"),
|                ImpactedAssetPairs = make_set(strcat(strcat_array(TargetAssets_Path, ";"), "|", tostring(AssetId))),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(tostring(column_ifexists("EntraAccountObjectId",""))),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(tostring(column_ifexists("TargetAssetId", ""))),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|              by
|                SecurityDomain,
|                Category,
|                SubCategory,
|                ConfigurationName,
|                cmdbId_Path,
|                cmdbName_Path,
|                cmdbCriticality_Path,
|                cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        // Step 13  Flatten probability detail strings
|        let SummaryDetail =
|            CollapsedPaths
|            | extend _d = split(tostring(TargetRiskProbDetailed_Path), ";")
|            | mv-expand _d to typeof(string)
|            | extend _d = trim(" ", _d)
|            | where isnotempty(_d)
|            | summarize RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(make_set(_d)), ";")
|              by SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId_Path, cmdbName_Path, cmdbCriticality_Path, cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        let SummaryDetailScore =
|            CollapsedPaths
|            | extend _s = split(tostring(TargetRiskProbDetailedScore_Path), ";")
|            | mv-expand _s to typeof(string)
|            | extend _s = trim(" ", _s)
|            | where isnotempty(_s)
|            | summarize RiskFactor_Probability_DetailedScore = strcat_array(array_sort_asc(make_set(_s)), ";")
|              by SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId_Path, cmdbName_Path, cmdbCriticality_Path, cmdbDataSensitivity_Path
|            | project-rename
|                cmdbId              = cmdbId_Path,
|                cmdbName            = cmdbName_Path,
|                cmdbCriticality     = cmdbCriticality_Path,
|                cmdbDataSensitivity = cmdbDataSensitivity_Path;
|
|        // Step 14  Final output
|        SummaryMain
|        | join kind=leftouter SummaryDetail      on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        | join kind=leftouter SummaryDetailScore on SecurityDomain, Category, SubCategory, ConfigurationName, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | project-away SecurityDomain1, Category1, SubCategory1, ConfigurationName1, cmdbId1, cmdbName1, cmdbCriticality1, cmdbDataSensitivity1
|        | extend AssetName = coalesce(column_ifexists("AssetName", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "), strcat_array(column_ifexists("TargetAssets_Path", dynamic([])), "; "), column_ifexists("ImpactedAssets", ""))
|        | extend AssetId   = coalesce(column_ifexists("AssetId", ""),   column_ifexists("TargetAssetId", ""),   column_ifexists("PathKey", ""), strcat_array(column_ifexists("SourceAssets_Path", dynamic([])), "; "))
|        | extend AssetType = coalesce(column_ifexists("AssetType", ""), column_ifexists("FirstGitHubSourceLabel", ""), column_ifexists("ExposedResourceNodeLabel", ""), column_ifexists("CredentialNodeLabel", ""), column_ifexists("IntermediateIdentityLabel", ""), column_ifexists("SourceNodeLabel", ""))
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            SubCategory,
|            ConfigurationName,
|            ConfigurationId,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            AssetCount,
|            TotalIssues,
|            ImpactedAssets, ImpactedAssetPairs
|        | order by
|            RiskScore_Weight_Factor desc,
|            RiskFactor_Probability desc,
|            CriticalityTier asc,
|            TotalIssues desc,
|            AssetCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, UniqueIssues, ImpactedAssetsList, ImpactedAssetIds, IssueList, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_Device_with_high_severity_vulnerabilities_allows_lateral_movement_Azure
|      # v2.2.418 -- per-report bucket FLOOR. On 2026-08-10 this report hit the 900s
|      # ceiling on bucket 2 of 2 and only completed through the sub-bucket recovery
|      # pass (~640s extra); the 4 children then returned in 105-286s each. That is the
|      # signature of a partition that is simply too coarse, not of a broken query.
|      # 🔑 Deliberately NOT the #56 semi-join treatment. That fix was provably lossless
|      # because the credential report is a chain of INNER JOINS, so bounding a hop only
|      # removed rows the join would discard anyway. This report is a real graph
|      # traversal -- `[bridge*0..3]` and `[inherit*0..2]` carry NO node predicates, so
|      # paths may legitimately pass through nodes outside RelevantNodes. Restricting
|      # the edge set here would silently DROP valid attack paths. Wrong tool.
|      # The engine ignores a cached count below this floor and re-probes from it
|      # (RA-AutoBucketing.ps1 ~:634), and AutoBucket may still escalate above it.
|      # BucketCount is metadata, not query text, so the query hash is unchanged.
|      BucketCount: 8
|      crossDomainBucketCoalesce:
|      # Source-device CL key drives the EG-side partition: the bucket filter sits on
|      # the VulnerableDevices source-node scan (the hot path before make-graph), and
|      # its AadDeviceId equals _SourceCmdb.Source_AadDeviceId for matched rows.
|      - ClColumn: Source_AadDeviceId
|        EgNativeKey: AadDeviceId
|      # Target Azure CL key is enriched downstream (post graph-match); declare it so
|      # the engine does not fall back to EG-filter suppression for this report.
|      - ClColumn: Target_AzureResourceId_Guid
|      ReportPurpose: Vulnerable-device-to-Azure-target attack paths prioritized by FINAL TARGET business impact.
|        EG provides path detection (VulnerableDevice -> Credential -> Identity -> AzureTarget) + scoring + tier;
|        the CI (SI_CI_CL, requirement 505) contributes the target asset's tier, risk factors and CMDB values (cmdbName, cmdbCriticality, cmdbDataSensitivity)
|        joined on the FINAL TARGET through the CI link key (_ciKey).
|      # v2.2.305 -- BucketCount removed; let AutoBucket calculate from default
|      # (2) and escalate only if needed. Graph-match shape doesn't cartesian-
|      # explode like the v2.2.277 4-hop join chain did, so the pre-set 64 is
|      # wasteful (~35s overhead per empty bucket).
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // v2.2.306 -- Summary variant of the graph-match shape used by the Detailed
|        // sibling. Same make-graph + graph-match traversal; instead of one row per
|        // (entry-device, target) path the output aggregates by (Subcategory, cmdb*)
|        // bucket. Bucket placeholder is INSIDE VulnerableDevices (before make-graph)
|        // so partitioning shrinks the graph SEED, not just the output rows.
|        //
|        // #505 -- GRAPH-ONLY PATH, CI END ASSET. The path (device -> credential / identity -> role -> Azure
|        // resource) is an Exposure Graph walk no SI field can express, so it stays a provider query. The
|        // analyzed asset is the ENTRY DEVICE, and its tier, CMDB values and asset risk factors (internet
|        // exposed, unsupported OS) come from its CI through _ciLink, keyed on the Defender device id
|        // (EG EntityIds SenseDeviceId), else the EG node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|
|        let VulnerableDevices = ExposureGraphNodes
|        | where set_has_element(Categories, "device")
|        // v2.2.420 (audit #57.1b) -- hedged across property paths. This gates the vulnerable-device attack
|        // paths, so a silent miss here reports "no attack paths" rather than "the source data moved".
|        | where tobool(coalesce(NodeProperties.rawData.highRiskVulnerabilityInsights.hasHighOrCritical,
|                                NodeProperties.raw.highRiskVulnerabilityInsights.hasHighOrCritical,
|                                NodeProperties.highRiskVulnerabilityInsights.hasHighOrCritical)) == true
|        // DeviceKey = the CI link key (Defender device id, else the EG node id), so the EG partition and the
|        // CI side bucket alike.
|        | extend _ids = tostring(EntityIds)
|        | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|        | extend DeviceKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(NodeId))
|        // Source-side bucket filter -- partitions 1M-device tenants BEFORE make-graph.
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | project NodeId, NodeName, NodeLabel, Categories, NodeProperties, DeviceKey;
|        let Identities = ExposureGraphNodes
|        | where set_has_element(Categories, "identity")
|        | project NodeId, NodeName, NodeLabel, Categories;
|        let Credentials = ExposureGraphNodes
|        | where set_has_element(Categories, "secret")
|        | project NodeId, NodeName, NodeLabel, Categories;
|        let AzureNodes = ExposureGraphNodes
|        | where set_has_element(Categories, "environmentAzure")
|        | project NodeId, NodeName, NodeLabel, Categories;
|        // #401 -- ONE node per NodeId. An Azure VM with a vulnerable device record is in VulnerableDevices
|        // AND in AzureNodes (without NodeProperties); make-graph keeps an arbitrary one of two rows with the
|        // same id. The vulnerable-device row wins.
|        let RelevantNodes = union VulnerableDevices, (union Credentials, Identities, AzureNodes | join kind=leftanti (VulnerableDevices | project NodeId) on NodeId);
|
|        // Source-device EG signals -- the count of EG riskFactors[] on the device (a report-scoped factor).
|        // Joined post-graph-match on EntryPointDeviceId == NodeId.
|        let _DeviceEnrichment = VulnerableDevices
|        | extend RawData = todynamic(NodeProperties).rawData
|        | extend RiskFactorsArray = todynamic(coalesce(RawData.risk.riskFactors, todynamic(NodeProperties).risk.riskFactors, dynamic([])))
|        | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|        | mv-apply rf = RiskFactorsArray on (
|            where isnotempty(trim(" ", tostring(rf)))
|            | summarize RiskFactorSet = make_set(tostring(rf))
|          )
|        | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|        | project NodeId, DeviceKey, RiskFactorSet;
|
|        // #690 the target labels as the Exposure Graph writes them, compared case-insensitively -- the graph labels a subscription
|        // node "subscriptions" (the ARM type microsoft.resources/subscriptions is kept for a graph that writes it). Matching the
|        // ARM type only left every subscription path out (23 of 135 paths on a live install).
|        let _Paths = ExposureGraphEdges
|        | where EdgeLabel in~ (
|            "contains",
|            "has credentials of", "frequently logged in by",
|            "can authenticate as",
|            "member of",
|            "has role on"
|          )
|        | make-graph SourceNodeId --> TargetNodeId with RelevantNodes on NodeId
|        | graph-match (Device)-[devEdge]->(CredOrIdent)-[bridge*0..3]->(Principal)-[role]->(RoleScope)-[inherit*0..2]->(AzureAsset)
|            where set_has_element(Device.Categories, "device")
|              and tobool(coalesce(Device.NodeProperties.rawData.highRiskVulnerabilityInsights.hasHighOrCritical,
|                                  Device.NodeProperties.raw.highRiskVulnerabilityInsights.hasHighOrCritical,
|                                  Device.NodeProperties.highRiskVulnerabilityInsights.hasHighOrCritical)) == true
|              and (set_has_element(CredOrIdent.Categories, "secret") or set_has_element(CredOrIdent.Categories, "identity"))
|              and set_has_element(AzureAsset.Categories, "environmentAzure")
|              and (AzureAsset.NodeLabel =~ "microsoft.storage/storageaccounts" or (RoleScope.NodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups") and AzureAsset.NodeLabel startswith "microsoft." and not(AzureAsset.NodeLabel startswith "microsoft.resources/") and not(AzureAsset.NodeLabel startswith "microsoft.authorization/")))
|              and devEdge.EdgeLabel in~ ("contains", "has credentials of", "frequently logged in by")
|              and role.EdgeLabel =~ "has role on"
|            project
|                EntryPointDeviceId = Device.NodeId,
|                EntryPointDevice   = Device.NodeName,
|                MaxCvssScore       = todouble(Device.NodeProperties.rawData.highRiskVulnerabilityInsights.maxCvssScore),
|                FirstHopLabel      = CredOrIdent.NodeLabel,
|                DeviceEdge         = devEdge.EdgeLabel,
|                TargetAzureAssetId = AzureAsset.NodeId,
|                TargetAzureAsset   = AzureAsset.NodeName,
|                TargetLabel        = AzureAsset.NodeLabel
|        | extend TargetType = case(
|            TargetLabel =~ "microsoft.storage/storageaccounts", "Storage account",
|            "Azure resource")
|        | extend AttackPathName = strcat(
|            "Device with high severity vulnerabilities allows lateral movement to Azure ",
|            iff(TargetType == "Storage account", "storage account", "resource"));
|
|        _Paths
|        | join kind=leftouter (_DeviceEnrichment) on $left.EntryPointDeviceId == $right.NodeId
|        // #505 -- the ENTRY DEVICE's CI (the analyzed asset), by the Defender device id or EG node id
|        | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|        | where coalesce(si_in_scope_, true)
|        // report-scoped factor -- the count of EG risk factors on the device
|        | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend Source_RiskFactor_Probability = coalesce(RF_P_RiskFactorsCount, 0) + array_length(RF_P_CiFactors)
|        | extend Source_RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(array_concat(
|            coalesce(RiskFactorSet, dynamic([])),
|            RF_P_CiFactorNames
|          )), ";")
|        | extend Source_AssetId        = iif(isnotempty(si_ci_id), si_ci_id, coalesce(DeviceKey, tolower(EntryPointDeviceId)))
|        // #690 a device without a tier keeps none (an empty level, kept by the scope filter) -- never shown as tier 3
|        | extend CriticalityTier      = toint(si_tier)
|        | extend cmdbId               = tostring(si_cmdb_id)
|        | extend cmdbName             = tostring(si_cmdb_name)
|        | extend cmdbCriticality      = tostring(si_cmdb_criticality)
|        | extend cmdbDataSensitivity  = tostring(si_cmdb_data_sensitivity)
|        | extend CriticalityTierLevel = case(
|            isnull(CriticalityTier), "",
|            CriticalityTier == 0, "Critical - tier 0",
|            CriticalityTier == 1, "High - tier 1",
|            CriticalityTier == 2, "Medium - tier 2",
|            "Low - tier 3")
|        | extend SecurityDomain = "Endpoint"
|        | extend Category       = "AttackPath_VulnerableDeviceToAzure"
|        | extend Subcategory    = TargetType
|        | extend ConfigurationName = AttackPathName
|        | extend ConfigurationId   = AttackPathName
|        // Aggregate to (Subcategory x cmdb*) buckets -- one row per attack-path category per
|        // criticality combo. ImpactedAssetPairs and AssetId name the ENTRY DEVICE (the analyzed asset),
|        // never the Azure target.
|        | summarize
|            Impact                    = max(MaxCvssScore),
|            UniqueIssues              = dcount(TargetAzureAssetId),
|            ImpactedAssetsList        = make_set(EntryPointDevice),
|            ImpactedAssetPairs        = make_set(strcat(EntryPointDevice, "|", Source_AssetId)),
|            IssueList                 = make_set(TargetAzureAsset),
|            AssetId                   = min(Source_AssetId),
|            EntryVectorTypes          = make_set(FirstHopLabel),
|            DeviceEdgeTypes           = make_set(DeviceEdge),
|            Max_Source_RiskFactor_Probability          = max(toint(Source_RiskFactor_Probability)),
|            RiskFactorIds = strcat_array(array_sort_asc(make_set_if(RiskFactorIds, isnotempty(RiskFactorIds))), ";"),
|            All_Source_RiskFactor_Probability_Detailed = make_set(Source_RiskFactor_Probability_Detailed)
|            by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|               CriticalityTier, CriticalityTierLevel,
|               cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // audit #25 -- the count is derived from the list that is actually DISPLAYED
|        | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|        | extend SecuritySeverity = case(
|            Impact >= 9.0, "Very High",
|            Impact >= 7.0, "High",
|            Impact >= 5.0, "Medium-High",
|            Impact >= 3.0, "Medium",
|            "Low")
|        | extend AssetName = strcat_array(ImpactedAssetsList, "; ")
|        | extend AssetType = Subcategory
|        // Consequence = 0 (engine auto-derives tokens). Probability = the source-device signal count
|        // (max across all paths in this group). CVSS already contributes via Impact -> SecuritySeverity.
|        | extend RiskFactor_Consequence          = 0
|        | extend RiskFactor_Probability          = coalesce(Max_Source_RiskFactor_Probability, 0)
|        | extend RiskFactor_Probability_Detailed = strcat_array(All_Source_RiskFactor_Probability_Detailed, ";")
|        // Engine weighted-factor block (cmdbCriticality * cmdbDataSensitivity multiplier).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName, AssetId, AssetType, Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|                  ImpactedAssetCount, UniqueIssues,
|                  ImpactedAssetsList, ImpactedAssetPairs, IssueList
|        | sort by RiskScore_Weight_Factor desc, RiskFactor_Probability desc, CriticalityTier asc, ImpactedAssetCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_cvss <- MaxCvssScore
|        // si si_category <- Category, si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Detailed_Device_with_high_severity_vulnerabilities_allows_lateral_movement_Azure
|      # v2.2.418 -- same bucket FLOOR as the Summary sibling. This variant did NOT time
|      # out on 2026-08-10, but it is the same graph traversal over the same seed set at
|      # a finer grain, so it sits on the same margin. Raised together deliberately --
|      # leaving the pair inconsistent would mean the next slow XDR day takes out the
|      # one nobody had looked at. See the Summary entry for why the #56 semi-join fix
|      # is NOT applicable to a make-graph traversal.
|      BucketCount: 8
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend TargetKey = tolower(TargetAzureAssetId)
|          | project __siNeeded = pack_array(TargetKey)
|      ReportPurpose: Per-row detail of credential-driven attack paths from vulnerable devices to Azure targets,
|        prioritized by FINAL TARGET business impact. EG drives path detection (VulnerableDevice -> Credential -> Identity -> AzureTarget) +
|        scoring; the CI (SI_CI_CL, requirement 505) contributes the target asset's tier, risk factors and CMDB values (cmdbName, cmdbCriticality, cmdbDataSensitivity)
|        joined on the FINAL TARGET through the CI link key (_ciKey).
|      # v2.2.306 -- bucket placeholder positioned INSIDE the VulnerableDevices
|      # let-binding (BEFORE make-graph). Each bucket then starts with 1/N source
|      # devices -> make-graph operates on a smaller seed -> graph-match walks a
|      # smaller subgraph -> compute scales sub-linearly with bucket count.
|      # Critical for scaling to 1M+ devices. AutoBucket calculates from default.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // v2.2.303 -- graph-match shape (replaces v2.2.295 cartesian).
|        //
|        // #505 -- GRAPH-ONLY PATH, CI END ASSETS. The path (device -> credential / identity -> role -> Azure
|        // resource) is an Exposure Graph walk no SI field can express, so it stays a provider query. Both
|        // ends take their SI context from their CI through _ciLink.
|        //   * the ENTRY DEVICE (the row's asset) -- name, id and its asset risk factors (internet exposed,
|        //     unsupported OS), keyed on the Defender device id (EG EntityIds SenseDeviceId), else the EG node id;
|        //   * the AZURE TARGET -- tier and CMDB values (as before), keyed on the target's EG node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device", "cloud_resource")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "internet_exposed", "known_exploited", "ms_criticality_high", "network_no_user_action", "not_onboarded", "old_vuln", "overdue", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "not_onboarded": "NotOnboarded", "old_vuln": "OldVuln", "overdue": "Overdue", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let VulnerableDevices = ExposureGraphNodes
|        | where set_has_element(Categories, "device")
|        // v2.2.420 (audit #57.1b) -- hedged across property paths. This gates the vulnerable-device attack
|        // paths, so a silent miss here reports "no attack paths" rather than "the source data moved".
|        | where tobool(coalesce(NodeProperties.rawData.highRiskVulnerabilityInsights.hasHighOrCritical,
|                                NodeProperties.raw.highRiskVulnerabilityInsights.hasHighOrCritical,
|                                NodeProperties.highRiskVulnerabilityInsights.hasHighOrCritical)) == true
|        // DeviceKey = the CI link key (Defender device id, else the EG node id), so the EG partition and the
|        // CI side bucket alike.
|        | extend _ids = tostring(EntityIds)
|        | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|        | extend DeviceKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(NodeId))
|        // Bucket filter at SOURCE -- partitions 1M-device tenants into shards BEFORE make-graph.
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | project NodeId, NodeName, NodeLabel, Categories, NodeProperties, DeviceKey;
|        let Identities = ExposureGraphNodes
|        | where set_has_element(Categories, "identity")
|        | project NodeId, NodeName, NodeLabel, Categories;
|        let Credentials = ExposureGraphNodes
|        | where set_has_element(Categories, "secret")
|        | project NodeId, NodeName, NodeLabel, Categories;
|        let AzureNodes = ExposureGraphNodes
|        | where set_has_element(Categories, "environmentAzure")
|        | project NodeId, NodeName, NodeLabel, Categories;
|        // #401 -- ONE node per NodeId. An Azure VM with a vulnerable device record is in VulnerableDevices
|        // AND in AzureNodes (without NodeProperties); make-graph keeps an arbitrary one of two rows with the
|        // same id. The vulnerable-device row wins.
|        let RelevantNodes = union VulnerableDevices, (union Credentials, Identities, AzureNodes | join kind=leftanti (VulnerableDevices | project NodeId) on NodeId);
|
|        // Source-device EG signals -- the count of EG riskFactors[] on the device (a report-scoped factor).
|        // Joined post-graph-match on EntryPointDeviceId == NodeId.
|        let _DeviceEnrichment = VulnerableDevices
|        | extend RawData = todynamic(NodeProperties).rawData
|        | extend RiskFactorsArray = todynamic(coalesce(RawData.risk.riskFactors, todynamic(NodeProperties).risk.riskFactors, dynamic([])))
|        | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|        | mv-apply rf = RiskFactorsArray on (
|            where isnotempty(trim(" ", tostring(rf)))
|            | summarize RiskFactorSet = make_set(tostring(rf))
|          )
|        | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|        | project NodeId, DeviceKey, RiskFactorSet;
|
|        // #690 the target labels as the Exposure Graph writes them, compared case-insensitively -- the graph labels a subscription
|        // node "subscriptions" (the ARM type microsoft.resources/subscriptions is kept for a graph that writes it). Matching the
|        // ARM type only left every subscription path out (23 of 135 paths on a live install).
|        let _Paths = ExposureGraphEdges
|        | where EdgeLabel in~ (
|            "contains",
|            "has credentials of", "frequently logged in by",
|            "can authenticate as",
|            "member of",
|            "has role on"
|          )
|        | make-graph SourceNodeId --> TargetNodeId with RelevantNodes on NodeId
|        | graph-match (Device)-[devEdge]->(CredOrIdent)-[bridge*0..3]->(Principal)-[role]->(RoleScope)-[inherit*0..2]->(AzureAsset)
|            where set_has_element(Device.Categories, "device")
|              and tobool(coalesce(Device.NodeProperties.rawData.highRiskVulnerabilityInsights.hasHighOrCritical,
|                                  Device.NodeProperties.raw.highRiskVulnerabilityInsights.hasHighOrCritical,
|                                  Device.NodeProperties.highRiskVulnerabilityInsights.hasHighOrCritical)) == true
|              and (set_has_element(CredOrIdent.Categories, "secret") or set_has_element(CredOrIdent.Categories, "identity"))
|              and set_has_element(AzureAsset.Categories, "environmentAzure")
|              and (AzureAsset.NodeLabel =~ "microsoft.storage/storageaccounts" or (RoleScope.NodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups") and AzureAsset.NodeLabel startswith "microsoft." and not(AzureAsset.NodeLabel startswith "microsoft.resources/") and not(AzureAsset.NodeLabel startswith "microsoft.authorization/")))
|              and devEdge.EdgeLabel in~ ("contains", "has credentials of", "frequently logged in by")
|              and role.EdgeLabel =~ "has role on"
|            project
|                EntryPointDeviceId = Device.NodeId,
|                EntryPointDevice   = Device.NodeName,
|                MaxCvssScore       = todouble(Device.NodeProperties.rawData.highRiskVulnerabilityInsights.maxCvssScore),
|                FirstHopNode       = CredOrIdent.NodeName,
|                FirstHopLabel      = CredOrIdent.NodeLabel,
|                FirstHopCategories = CredOrIdent.Categories,
|                DeviceEdge         = devEdge.EdgeLabel,
|                ReachedIdentity    = Principal.NodeName,
|                RoleScopeName      = RoleScope.NodeName,
|                RoleScopeLabel     = RoleScope.NodeLabel,
|                TargetAzureAssetId = AzureAsset.NodeId,
|                TargetAzureAsset   = AzureAsset.NodeName,
|                TargetLabel        = AzureAsset.NodeLabel
|        | extend EntryVector = case(
|                DeviceEdge =~ "contains" and FirstHopLabel == "entra-userCookie",                       "Entra session cookie",
|                DeviceEdge =~ "contains" and FirstHopLabel == "azure-active-directory-app-secret",      "AAD app secret",
|                DeviceEdge =~ "contains" and FirstHopLabel == "azure-active-directory-user-credentials", "Cached AAD user credentials",
|                DeviceEdge =~ "contains" and FirstHopLabel == "azure-storage-shared-access-signature",  "SAS token",
|                DeviceEdge =~ "contains" and FirstHopLabel == "azure-storage-connection-string",        "Storage connection string",
|                DeviceEdge =~ "contains" and FirstHopLabel == "azure-database-connection-string",       "DB connection string",
|                DeviceEdge =~ "contains" and FirstHopLabel == "azure-app-configuration-key",            "App Configuration key",
|                DeviceEdge =~ "contains" and FirstHopLabel == "github-personal-access-token",           "GitHub PAT",
|                DeviceEdge =~ "contains" and FirstHopLabel == "openai-api-key",                         "OpenAI API key",
|                DeviceEdge =~ "contains" and FirstHopLabel == "user-azure-cli-secret",                  "Cached Azure CLI token",
|                DeviceEdge =~ "contains",                                                                strcat("Other secret: ", tostring(FirstHopLabel)),
|                DeviceEdge =~ "has credentials of",                                                      "Owner / cached credential",
|                DeviceEdge =~ "frequently logged in by",                                                 "Interactive logon",
|                tostring(DeviceEdge))
|        | summarize
|                EntryVectors          = make_set(EntryVector),
|                DeviceEdges           = make_set(DeviceEdge),
|                CredentialNodes       = make_set(iff(set_has_element(FirstHopCategories, "secret"), FirstHopNode, ""), 10),
|                FirstHopLabels        = make_set(FirstHopLabel),
|                ReachedIdentities     = make_set(ReachedIdentity),
|                ViaRoleScope          = take_any(RoleScopeName),
|                ViaRoleScopeType      = take_any(RoleScopeLabel),
|                MaxCvssScore          = max(MaxCvssScore)
|            by EntryPointDeviceId, EntryPointDevice, TargetAzureAssetId, TargetAzureAsset, TargetLabel
|        | extend CredentialNodes = set_difference(CredentialNodes, dynamic([""]))
|        | extend TargetType = case(
|            TargetLabel =~ "microsoft.storage/storageaccounts", "Storage account",
|            "Azure resource")
|        | extend AttackPathName = strcat(
|            "Device with high severity vulnerabilities allows lateral movement to Azure ",
|            iff(TargetType == "Storage account", "storage account", "resource"));
|
|        _Paths
|        | join kind=leftouter (_DeviceEnrichment) on $left.EntryPointDeviceId == $right.NodeId
|        // #505 -- the ENTRY DEVICE's CI (the row's asset), by the Defender device id or EG node id
|        | join kind=leftouter (_ciLink) on $left.DeviceKey == $right._ciKey
|        | where coalesce(si_in_scope_, true)
|        // the AZURE TARGET's CI (tier, CMDB), by its EG node id
|        // #677 the Azure target's CI -- its own lookup (_ciPeer), joined here on the target's own key. The rows are sliced on
|        // the ENTRY DEVICE, so the target's CI is never cut with them -- it travels whole while it fits, else each slice gets
|        // only its own targets (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend TargetKey = tolower(TargetAzureAssetId)
|        | join kind=leftouter (_ciPeer) on $left.TargetKey == $right._peerKey
|        | extend Target_Tier = peer_tier, Target_cmdbId = peer_cmdb_id, Target_cmdbName = peer_cmdb_name,
|                 Target_cmdbCriticality = peer_cmdb_criticality, Target_cmdbDataSensitivity = peer_cmdb_data_sensitivity
|        | project-away _peerKey, peer_*
|        | extend cmdbId = tostring(Target_cmdbId), cmdbName = tostring(Target_cmdbName), cmdbCriticality = tostring(Target_cmdbCriticality), cmdbDataSensitivity = tostring(Target_cmdbDataSensitivity)
|        // #690 a target without a tier keeps none (an empty level, kept by the scope filter) -- never shown as tier 3
|        | extend CriticalityTier = toint(Target_Tier)
|        | extend CriticalityTierLevel = case(
|            isnull(CriticalityTier), "",
|            CriticalityTier == 0, "Critical - tier 0",
|            CriticalityTier == 1, "High - tier 1",
|            CriticalityTier == 2, "Medium - tier 2",
|            "Low - tier 3")
|        | extend SecurityDomain = "Endpoint"
|        | extend Category       = "AttackPath_VulnerableDeviceToAzure"
|        | extend Subcategory    = TargetType
|        | extend ConfigurationName = AttackPathName
|        | extend ConfigurationId   = strcat(EntryPointDevice, "->", iff(TargetType == "Storage account", TargetAzureAsset, TargetAzureAssetId))
|        | extend AssetName = iif(isnotempty(tostring(si_asset_name)), tostring(si_asset_name), EntryPointDevice)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, coalesce(DeviceKey, tolower(EntryPointDeviceId)))
|        | extend AssetType = iif(isnotempty(tostring(si_class)), "Endpoint", "Device")
|        | extend Impact = MaxCvssScore
|        | extend SecuritySeverity = case(
|            MaxCvssScore >= 9.0, "Very High",
|            MaxCvssScore >= 7.0, "High",
|            MaxCvssScore >= 5.0, "Medium-High",
|            MaxCvssScore >= 3.0, "Medium",
|            "Low")
|        // RiskFactor_Consequence stays 0 -- the engine auto-derives tokens from CriticalityTier + cmdb fields.
|        | extend RiskFactor_Consequence          = 0
|        // report-scoped factor -- the count of EG risk factors on the device
|        | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        // RiskFactor_Probability = COUNT of source-device signals, ADDED ON TOP of the engine's probBase.
|        // CVSS is not added here -- it already drives SecuritySeverity.
|        | extend RiskFactor_Probability          = coalesce(RF_P_RiskFactorsCount, 0) + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(array_concat(
|            coalesce(RiskFactorSet, dynamic([])),
|            RF_P_CiFactorNames
|          )), ";")
|        // Engine weighted-factor block. Substituted at run time from
|        // riskscore_weighted.schema.custom.json -> weightedRiskFactors.endpoint.fields[].
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName, AssetId, AssetType, Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|                  EntryPointDevice, EntryVectors, ReachedIdentities, TargetAzureAsset,
|                  ViaRoleScope, ViaRoleScopeType, MaxCvssScore, CredentialNodes
|        | sort by EntryPointDevice asc, TargetAzureAsset asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_cvss <- MaxCvssScore
|        // si si_category <- Category, si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Detailed_Credential_Based_Lateral_Movement
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(FirstSourceAssetId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: Per-row detail of credential-driven lateral-movement paths to Azure and Endpoint targets,
|        prioritized by FINAL TARGET business impact. EG drives path detection (SourceAsset -> Credential -> Identity -> AzureTarget) +
|        scoring + tier;
|        the end assets' CI (SI_CI_CL) gives tier (EG criticality only as fallback), CMDB values and asset risk factors, joined on _ciKey.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_InList_unsupported_os = (si_os_name:string, si_os_platform:string, si_os_version:string) { ((((tostring(si_os_name) matches regex @"(?i)^Windows7"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8($|\.)"))) or (((tostring(si_os_name) matches regex @"(?i)^Windows8\.1"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2003"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2008"))) or (((tostring(si_os_name) matches regex @"(?i)WindowsServer2012"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^CentOS 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 6(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^RHEL 7(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 11(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^SLES 12(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 14\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 16\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Ubuntu 18\.04(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 8(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 9(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Debian 10(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 30(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 31(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 32(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 33(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 34(\b|$)"))) or (((tostring(si_os_name) matches regex @"(?i)^Fedora 35(\b|$)"))) or ((tostring(si_os_platform) =~ "macos") and (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_os_version))) < 13))) };
|        //__SI_SCOPE_END__
|        // the objects inside each subscription and resource group, from the graph's own contains edges -- a role on a scope is
|        // reported on the objects inside it, never on the scope itself (owner 2026-10-19)
|        let _SI_ScopeContains = ExposureGraphEdges
|            | where EdgeLabel =~ "contains" and SourceNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")
|            | project _ScopeNodeId = SourceNodeId, _ChildId = TargetNodeId, _ChildName = TargetNodeName, _ChildLabel = TargetNodeLabel;
|        let _SI_ScopeMembers = union
|            (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel),
|            (_SI_ScopeContains | where _ChildLabel in~ ("resourcegroups", "microsoft.resources/resourcegroups") | project _ScopeNodeId, _RgNodeId = _ChildId
|                | join kind=inner (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _RgNodeId = _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel) on _RgNodeId
|                | project _ScopeNodeId, _MemberId, _MemberName, _MemberLabel)
|            | summarize _MemberName = take_any(_MemberName), _MemberLabel = take_any(_MemberLabel) by _ScopeNodeId, _MemberId;
|        // =================================================================================================
|        // REPORT  Credential driven lateral movement paths to Azure and Endpoint targets using Exposure Graph
|        // Bucketing applied to the Hop 2 edges on the FINAL TARGET (#677) - each path in exactly one slice
|        // =================================================================================================
|
|        // Step 0  Legacy OS definitions for probability scoring
|        // Step 0b  The end assets' CI (SI_CI_CL, #505) -- tier, CMDB values and asset risk factors.
|        // The path (edges, intermediate nodes, their EG criticality) stays an Exposure Graph walk. An end node is
|        // tied to its CI through _ciKey, by the id in its EntityIds (Defender device id, Azure resource id, Entra
|        // object id) or else its lower-cased node id.
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "expired_credentials", "expiring_credentials", "has_secret", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        // Step 1  Credential edges (not sliced since #677 -- every source of a credential is needed in its slice)
|        // EdgeLabel + SourceNodeLabel + TargetNodeLabel filters narrow the set BEFORE bucketing
|        // (the slice key is the Hop 2 TargetNodeId, the path's final target, see Step 3)
|        let CredentialEdges =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("contains", "defined in", "runs on", "has credentials of")
|            // #690 every credential the graph holds, wherever it sits -- a node of the secret category, or one of the credential
|            // labels below, compared case-insensitively (the graph writes entra-userCookie -- the exact-case entra-usercookie
|            // lost every session-cookie path). No list of source kinds -- the asset a credential sits on is the path's source,
|            // whatever its kind (the fixed lists reached 32 of 97 targets on a live install).
|            | where set_has_element(TargetNodeCategories, "secret") or TargetNodeLabel in~ (
|                "azure-active-directory-app-secret",
|                "user-azure-cli-secret",
|                "azure-storage-shared-access-signature",
|                "azure-storage-connection-string",
|                "azure-database-connection-string",
|                "azure-active-directory-user-credentials",
|                "service-principal-azure-cli-secret",
|                "entra-userCookie",
|                "lsa-secret",
|                "github-personal-access-token",
|                "azure-app-configuration-key",
|                "certificate",
|                "openai-api-key"
|            )
|            //__STALE_DEVICE_FILTER_BEGIN__
|            | where 1 == 1
|            //__STALE_DEVICE_FILTER_END__
|            | project
|                SourceNodeId, SourceNodeName, SourceNodeLabel,
|                TargetNodeId, TargetNodeName, TargetNodeLabel,
|                EdgeLabel;
|
|        // Step 2  Hop 1 edges -- BOUND to the credentials found in Step 1.
|        // v2.2.417 -- this previously claimed "no bucketing needed, naturally constrained by
|        // downstream join to CredentialEdges". That premise is FALSE. A join constrains the
|        // RESULT, not the SCAN -- Kusto still materialises every "has credentials of" /
|        // "can authenticate as" / "can authenticate to" edge in the tenant and only then
|        // discards non-matches. So this hop set never shrank, with or without bucketing, and
|        // the Step 7 inner joins exploded on hub identities (inbound x outbound edges). No
|        // bucket depth can split that, because a hub is a SINGLE node -- which is why
|        // sub-bucketing bisected forever with 3 of 4 children returning 0 rows in ~5s.
|        // The semi-join below removes EXACTLY the rows the Step 7 inner join would discard
|        // (CredentialsOnAssets groups by CredentialNodeId = CredentialEdges.TargetNodeId), so
|        // it is provably lossless -- and it makes bucketing actually work, because the hop set
|        // now shrinks WITH the bucket instead of staying tenant-wide.
|        let Hop1Edges =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("has credentials of", "can authenticate as", "can authenticate to")
|            | where SourceNodeId in (CredentialEdges | distinct TargetNodeId)
|            | project
|                SourceNodeId, SourceNodeName, SourceNodeLabel,
|                TargetNodeId, TargetNodeName, TargetNodeLabel,
|                EdgeLabel;
|
|        // Step 3  Hop 2 edges -- BOUND to the identities reached in Step 2.
|        // Same defect and same lossless remedy as Step 2. This set is the more dangerous of the
|        // two, because its TargetNodeLabel list includes "subscriptions" and "resourcegroups" --
|        // node types that legitimately carry thousands of inbound edges -- so leaving it
|        // tenant-wide is what turned the Step 7 join into a cartesian product on hub nodes.
|        let Hop2Edges =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("can authenticate to", "runs on", "has permissions to", "has role on")
|            // #690 every Azure resource the identity reaches (any microsoft.* type, startswith ignores case), the subscription and
|            // resource group scopes, devices and blob containers -- the fixed list of 21 types left out container registries,
|            // network interfaces, locks, ...
|            | where TargetNodeLabel startswith "microsoft." or TargetNodeLabel in~ ("subscriptions", "resourcegroups", "device", "computer-account", "BlobContainer")
|            | where SourceNodeId in (Hop1Edges | distinct TargetNodeId)
|            // #677 the slices are cut on the path's FINAL TARGET (TargetNodeId) -- every path is in exactly one slice, and every
|            // count over targets adds up over the slices. The CI of both ends is read after this, from _ciPeer.
|            // a subscription or resource group target is replaced by the objects inside it -- once per object, so an object reached
|            // directly and through its resource group and subscription is one path (owner 2026-10-19)
|            | join kind=leftouter (_SI_ScopeMembers) on $left.TargetNodeId == $right._ScopeNodeId
|            | where isnotempty(_MemberId) or not(TargetNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups"))
|            | extend TargetNodeId = iff(isnotempty(_MemberId), _MemberId, TargetNodeId), TargetNodeName = iff(isnotempty(_MemberId), _MemberName, TargetNodeName), TargetNodeLabel = iff(isnotempty(_MemberId), _MemberLabel, TargetNodeLabel)
|            | extend _SI_ViaScope = isnotempty(_MemberId)
|            | project-away _ScopeNodeId, _MemberId, _MemberName, _MemberLabel
|            | extend DeviceKey = TargetNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | project
|                SourceNodeId, SourceNodeName, SourceNodeLabel,
|                TargetNodeId, TargetNodeName, TargetNodeLabel,
|                EdgeLabel;
|
|        // Step 4  Credentials on source assets -- one row per (source asset, credential) (#690 -- the Detailed grain keeps every
|        // asset a credential sits on -- a credential found on three devices is three paths, each naming its own device)
|        let CredentialsOnAssets =
|            CredentialEdges
|            | summarize
|                FirstSourceAssetName  = take_any(SourceNodeName),
|                FirstSourceAssetLabel = take_any(SourceNodeLabel),
|                CredentialEdge        = strcat_array(array_sort_asc(make_set(EdgeLabel)), ", ")
|              by
|                FirstSourceAssetId = SourceNodeId,
|                CredentialNodeId   = TargetNodeId,
|                CredentialName     = TargetNodeName,
|                CredentialLabel    = TargetNodeLabel;
|
|        // Step 5  Hop 1 -- credential authenticates as identity
|        let Hop1 =
|            Hop1Edges
|            | project
|                CredentialNodeId          = SourceNodeId,
|                Hop1_EdgeLabel            = EdgeLabel,
|                IntermediateIdentityId    = TargetNodeId,
|                IntermediateIdentity      = TargetNodeName,
|                IntermediateIdentityLabel = TargetNodeLabel;
|
|        // Step 6  Hop 2 -- identity reaches target resource
|        let Hop2 =
|            Hop2Edges
|            | project
|                Hop2_SourceIdentityId = SourceNodeId,
|                Hop2_EdgeLabel        = EdgeLabel,
|                FinalTargetId         = TargetNodeId,
|                FinalTargetName       = TargetNodeName,
|                FinalTargetLabel      = TargetNodeLabel;
|
|        // Step 7  Assemble and stabilize paths
|        let Paths =
|            CredentialsOnAssets
|            | join kind=inner (Hop1) on CredentialNodeId
|            | join kind=inner (Hop2) on $left.IntermediateIdentityId == $right.Hop2_SourceIdentityId
|            | where FirstSourceAssetId != FinalTargetId
|            // one row per path -- source asset x credential x identity x target, every edge label between two hops kept
|            | summarize
|                FirstSourceAssetName      = take_any(FirstSourceAssetName),
|                FirstSourceAssetLabel     = take_any(FirstSourceAssetLabel),
|                CredentialName            = take_any(CredentialName),
|                CredentialLabel           = take_any(CredentialLabel),
|                CredentialEdge            = take_any(CredentialEdge),
|                IntermediateIdentity      = take_any(IntermediateIdentity),
|                IntermediateIdentityLabel = take_any(IntermediateIdentityLabel),
|                Hop1Edge                  = strcat_array(array_sort_asc(make_set(Hop1_EdgeLabel)), ", "),
|                Hop2Edge                  = strcat_array(array_sort_asc(make_set(Hop2_EdgeLabel)), ", "),
|                FinalTargetName           = take_any(FinalTargetName),
|                FinalTargetLabel          = take_any(FinalTargetLabel)
|              by
|                FirstSourceAssetId,
|                CredentialNodeId,
|                IntermediateIdentityId,
|                FinalTargetId;
|
|        // Step 8  Collect node IDs that need enrichment
|        let EnrichIds =
|            union
|                (Paths | project NodeId = FirstSourceAssetId),
|                (Paths | project NodeId = CredentialNodeId),
|                (Paths | project NodeId = IntermediateIdentityId),
|                (Paths | project NodeId = FinalTargetId)
|            | where isnotempty(tostring(column_ifexists("NodeId", "")))
|            | summarize by NodeId;
|
|        // Step 9  Enrich only the nodes actually used in paths
|        let Nodes =
|            ExposureGraphNodes
|            | where NodeId in (EnrichIds | project NodeId)
|            | extend NodeNameNorm  = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            // the node's CI key -- the id the CI links (Defender device id, Azure resource id, Entra object id), else the node id
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend Raw     = todynamic(todynamic(NodeProperties).raw)
|            | extend EgCriticalityLevel =
|                toint(coalesce(
|                    tostring(NodeProperties.criticalityLevelProps[0].criticalityLevel),
|                    tostring(RawData.criticalityLevel.criticalityLevel),
|                    tostring(NodeProperties.criticalityLevel.criticalityLevel)
|                ))
|            | extend IsInternetExposed =
|                tobool(coalesce(
|                    RawData.isCustomerFacing,
|                    Raw.isCustomerFacing,
|                    false
|                ))
|            | extend IsExcluded =
|                tobool(coalesce(
|                    RawData.isExcluded,
|                    Raw.isExcluded,
|                    false
|                ))
|            | extend tagsBag1 = todynamic(coalesce(RawData.tags, dynamic({})))
|            | extend tagsBag2 = todynamic(coalesce(todynamic(NodeProperties).tags, dynamic({})))
|            | extend tagsBag3 = todynamic(coalesce(Raw.tags, dynamic({})))
|            | extend AssetTierFromBag = tostring(coalesce(
|                tagsBag1.AssetTier, tagsBag2.AssetTier, tagsBag3.AssetTier,
|                tagsBag1["AssetTier--SI"], tagsBag2["AssetTier--SI"], tagsBag3["AssetTier--SI"]
|            ))
|            | extend deviceManualTags  = iff(isnull(RawData.deviceManualTags),  dynamic([]), todynamic(RawData.deviceManualTags))
|            | extend deviceDynamicTags = iff(isnull(RawData.deviceDynamicTags), dynamic([]), todynamic(RawData.deviceDynamicTags))
|            | extend tagsArray1        = iff(isnull(RawData.tags.tags),         dynamic([]), todynamic(RawData.tags.tags))
|            | extend _AllTags          = array_concat(array_concat(deviceManualTags, deviceDynamicTags), tagsArray1)
|            | extend EgNodeTags         = strcat_array(_AllTags, ";")
|            | where array_length(SI_ExcludedAssetTags) == 0 or not(tolower(EgNodeTags) has_any (SI_ExcludedAssetTags))
|            | extend _TierTagsFromText = extract_all(@"([^;]*--tier[0-3]--SI[^;]*)", EgNodeTags)
|            | extend AssetTierByTag =
|                case(
|                    isnotempty(AssetTierFromBag), AssetTierFromBag,
|                    array_length(_TierTagsFromText) > 0, strcat_array(array_sort_asc(_TierTagsFromText), ";"),
|                    ""
|                )
|            | extend CriticalityTierFromTag =
|                case(
|                    AssetTierByTag has "--tier0--SI" or tolower(AssetTierByTag) has "tier0" or AssetTierByTag == "0", 0,
|                    AssetTierByTag has "--tier1--SI" or tolower(AssetTierByTag) has "tier1" or AssetTierByTag == "1", 1,
|                    AssetTierByTag has "--tier2--SI" or tolower(AssetTierByTag) has "tier2" or AssetTierByTag == "2", 2,
|                    AssetTierByTag has "--tier3--SI" or tolower(AssetTierByTag) has "tier3" or AssetTierByTag == "3", 3,
|                    int(null)
|                )
|            // the node's SI tier tag (#677 -- a path end's CI tier is read after the slice filter, from _ciPeer) -- never the Exposure Graph criticality
|            // #690 a node without a tier tag keeps no tier (an empty level) -- never shown as tier 3
|            | extend CriticalityTier = toint(CriticalityTierFromTag)
|            | extend CriticalityTierLevel =
|                case(
|                    isnull(CriticalityTier), "",
|                    CriticalityTier == 0, "Critical - tier 0",
|                    CriticalityTier == 1, "High - tier 1",
|                    CriticalityTier == 2, "Medium - tier 2",
|                    "Low - tier 3"
|                )
|            | extend AssetOSPlatform =
|                tostring(coalesce(RawData.osPlatform, RawData.OSPlatform, RawData.platform, RawData.operatingSystem, RawData.os))
|            | extend AssetOSVersion =
|                tostring(coalesce(RawData.osVersion, RawData.OSVersion, RawData.version, RawData.operatingSystemVersion))
|            | extend AssetOSDistribution =
|                tostring(coalesce(RawData.osDistribution, RawData.OSDistribution, RawData.distribution))
|            // unsupported OS -- the catalog's unsupported_os list (the customer's own entries included), compiled by the engine
|            | extend LegacyEndOfSupport = iff(SI_InList_unsupported_os(iff(isnotempty(AssetOSDistribution), AssetOSDistribution, AssetOSPlatform), iff(tolower(AssetOSPlatform) has "mac", "macos", tolower(AssetOSPlatform)), AssetOSVersion), 1, 0)
|            | extend RiskFactorsArray =
|                todynamic(coalesce(
|                    RawData.risk.riskFactors,
|                    NodeProperties.risk.riskFactors,
|                    dynamic([])
|                ))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | extend RF_P_RiskFactorsCount = array_length(RiskFactorSet)
|            | extend EgInternetExposedFlag  = iff(IsInternetExposed == true, 1, 0)
|            | extend EgLegacyEoSFlag        = iff(LegacyEndOfSupport == 1, 1, 0)
|            | extend RiskFactor_Probability = RF_P_RiskFactorsCount + EgInternetExposedFlag + EgLegacyEoSFlag
|            | extend RiskFactor_Consequence = 0   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|            | extend RiskFactor_Probability_Detailed =
|                strcat_array(
|                    array_sort_asc(
|                        array_concat(
|                            RiskFactorSet,
|                            iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                            iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                        )
|                    ),
|                    ";"
|                )
|            | extend _ScoreFactors =
|                array_concat(
|                    RiskFactorSet,
|                    iff(EgInternetExposedFlag == 1, dynamic(["Internet-Exposed"]), dynamic([])),
|                    iff(EgLegacyEoSFlag == 1, dynamic(["LegacyEndOfSupport"]), dynamic([]))
|                )
|            | mv-apply sf = _ScoreFactors on (
|                where isnotempty(trim(" ", tostring(sf)))
|                | summarize ScoreParts = make_set(strcat(tostring(sf), "=1"))
|            )
|            | extend RiskFactor_Probability_DetailedScore =
|                strcat_array(array_sort_asc(coalesce(ScoreParts, dynamic([]))), ";")
|            | project
|                NodeId,
|                NodeCiKey,
|                RiskFactorSet,
|                NodeName              = NodeNameNorm,
|                NodeLabel,
|                CriticalityTier,
|                CriticalityTierLevel,
|                IsInternetExposed,
|                IsExcluded,
|                EgNodeTags,
|                AssetTierByTag,
|                LegacyEndOfSupport,
|                RiskFactor_Probability,
|                RiskFactor_Probability_Detailed,
|                RiskFactor_Probability_DetailedScore,
|                RiskFactor_Consequence;
|
|        // Step 10  Enrich paths with node metadata
|        let Detailed =
|            Paths
|            | join kind=leftouter (
|                Nodes
|                | project
|                    SourceNodeId                = NodeId,
|                    SourceNodeCiKey = NodeCiKey,
|                    SourceRiskFactorSet = RiskFactorSet,
|                    SourceCriticalityTier       = CriticalityTier,
|                    SourceCriticalityTierLevel  = CriticalityTierLevel,
|                    SourceIsInternetExposed     = IsInternetExposed,
|                    SourceIsExcluded            = IsExcluded,
|                    SourceAssetTierByTag        = AssetTierByTag,
|                    SourceLegacyEndOfSupport    = LegacyEndOfSupport,
|                    SourceRiskProb              = RiskFactor_Probability,
|                    SourceRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    SourceRiskProbDetailedScore = RiskFactor_Probability_DetailedScore
|              ) on $left.FirstSourceAssetId == $right.SourceNodeId
|            | join kind=leftouter (
|                Nodes
|                | project
|                    IntermediateNodeId                = NodeId,
|                    IntermediateCriticalityTier       = CriticalityTier,
|                    IntermediateCriticalityTierLevel  = CriticalityTierLevel,
|                    IntermediateIsInternetExposed     = IsInternetExposed,
|                    IntermediateLegacyEndOfSupport    = LegacyEndOfSupport,
|                    IntermediateRiskProb              = RiskFactor_Probability,
|                    IntermediateRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    IntermediateRiskProbDetailedScore = RiskFactor_Probability_DetailedScore
|              ) on $left.IntermediateIdentityId == $right.IntermediateNodeId
|            | join kind=leftouter (
|                Nodes
|                | project
|                    TargetNodeId                = NodeId,
|                    TargetNodeCiKey = NodeCiKey,
|                    TargetRiskFactorSet = RiskFactorSet,
|                    TargetCriticalityTier       = CriticalityTier,
|                    TargetCriticalityTierLevel  = CriticalityTierLevel,
|                    TargetIsInternetExposed     = IsInternetExposed,
|                    TargetIsExcluded            = IsExcluded,
|                    TargetAssetTierByTag        = AssetTierByTag,
|                    TargetLegacyEndOfSupport    = LegacyEndOfSupport,
|                    TargetRiskProb              = RiskFactor_Probability,
|                    TargetRiskProbDetailed      = RiskFactor_Probability_Detailed,
|                    TargetRiskProbDetailedScore = RiskFactor_Probability_DetailedScore
|              ) on $left.FinalTargetId == $right.TargetNodeId
|            // the SOURCE's CI (#505) -- tier (the EG criticality only where the CI has no tier) and the asset factors,
|            // the same way as the target. A source without a CI keeps its EG tier and has no asset factors.
|            | extend SourceRiskFactorSet = iff(isnull(SourceRiskFactorSet), dynamic([]), SourceRiskFactorSet)
|            // #677 the CI of the path's ends -- its own lookup (_ciPeer), on each end's own key. The rows are sliced on the
|            // final target, so neither end's CI is cut with them -- it travels whole while it fits, else each slice gets only
|            // the keys its own rows have (the report field LookupNeededKeys).
|            //__SI_LOOKUP_KEYS_HERE__
|            | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(FirstSourceAssetId)))
|            | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(FinalTargetId)))
|            | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|            | extend Source_si_ci_id = peer_ci_id, Source_si_tier = peer_tier, Source_si_rf_p = peer_rf_p, Source_si_rf_names = peer_rf_names
|            | project-away _peerKey, peer_*
|            | extend SourceAssetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(FirstSourceAssetId))
|            | extend SourceCriticalityTier = toint(coalesce(Source_si_tier, SourceCriticalityTier))
|            | extend SourceCriticalityTierLevel = case(isnull(SourceCriticalityTier), "", SourceCriticalityTier == 0, "Critical - tier 0", SourceCriticalityTier == 1, "High - tier 1", SourceCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend _srcIds = coalesce(Source_si_rf_p, dynamic([])), _srcNames = coalesce(Source_si_rf_names, dynamic([]))
|            | extend SourceIsInternetExposed = set_has_element(_srcIds, "internet_exposed"), SourceLegacyEndOfSupport = iff(set_has_element(_srcIds, "unsupported_os"), 1, 0)
|            | extend _srcRf = array_concat(SourceRiskFactorSet, _srcNames)
|            | extend SourceRiskProb = array_length(SourceRiskFactorSet) + array_length(_srcIds)
|            | extend SourceRiskProbDetailed = strcat_array(array_sort_asc(_srcRf), ";")
|            | mv-apply _rf = _srcRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _srcScore = make_set(strcat(_rf, "=1")))
|            | extend SourceRiskProbDetailedScore = strcat_array(array_sort_asc(_srcScore), ";")
|            | project-away _srcRf, _srcScore, _srcIds, _srcNames
|            // the FINAL TARGET's CI (#505) -- tier (the EG criticality only where the CI has no tier), CMDB values and
|            // the asset factors. A target without a CI keeps its EG tier and has no asset factors.
|            | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|            | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|            | extend si_ci_id = peer_ci_id, si_tier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                     si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, si_in_scope_ = tobool(column_ifexists("peer_in_scope", bool(null)))
|            | project-away _peerKey, peer_*
|            | where coalesce(si_in_scope_, true)
|            | extend TargetAssetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(FinalTargetId))
|            | extend TargetCriticalityTier = toint(coalesce(si_tier, TargetCriticalityTier))
|            | extend TargetCriticalityTierLevel = case(isnull(TargetCriticalityTier), "", TargetCriticalityTier == 0, "Critical - tier 0", TargetCriticalityTier == 1, "High - tier 1", TargetCriticalityTier == 2, "Medium - tier 2", "Low - tier 3")
|            | extend RF_P_RiskFactorsCount = array_length(TargetRiskFactorSet)
|            // the end asset's factors -- the set the engine feeds (its CI evaluation, the report's factors), shown by the catalog names
|            | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|            | extend TargetIsInternetExposed = set_has_element(TargetFactorIds, "internet_exposed"), TargetLegacyEndOfSupport = iff(set_has_element(TargetFactorIds, "unsupported_os"), 1, 0)
|            | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|            | extend TargetRiskProb = RF_P_RiskFactorsCount + array_length(TargetFactorIds)
|            | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|            | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|            | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|            | project-away _tgtRf, _tgtScore
|            | extend
|                cmdbId            = si_cmdb_id,
|                cmdbName            = si_cmdb_name,
|                cmdbCriticality     = si_cmdb_criticality,
|                cmdbDataSensitivity = si_cmdb_data_sensitivity
|            | extend TierEscalation =
|                case(
|                    isnotempty(SourceCriticalityTier) and isnotempty(TargetCriticalityTier)
|                        and SourceCriticalityTier > TargetCriticalityTier,
|                        SourceCriticalityTier - TargetCriticalityTier,
|                    0
|                )
|            | extend LateralMovementType =
|                case(
|                    isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|                    TierEscalation >= 3, "Privilege escalation large tier jump",
|                    TierEscalation == 2, "Privilege escalation two tiers",
|                    TierEscalation == 1, "Privilege escalation one tier",
|                    "Direct access same tier"
|                )
|            | extend TargetTierWeight =
|                case(
|                    TargetCriticalityTier == 0, 100,
|                    TargetCriticalityTier == 1, 60,
|                    TargetCriticalityTier == 2, 30,
|                    10
|                )
|            | extend EscalationWeight    = TierEscalation * 10
|            | extend ExposureWeight      = iff(TargetIsInternetExposed == true, 8, 0)
|                                         + iff(SourceIsInternetExposed == true, 3, 0)
|            | extend SourceTierAmplifier =
|                case(
|                    SourceCriticalityTier == 0, 8,
|                    SourceCriticalityTier == 1, 5,
|                    SourceCriticalityTier == 2, 2,
|                    0
|                )
|            | extend AttackPathPriorityScore = TargetTierWeight + EscalationWeight + ExposureWeight + SourceTierAmplifier
|            | extend AttackPathPriority =
|                case(
|                    AttackPathPriorityScore >= 90, "Very High",
|                    AttackPathPriorityScore >= 60, "High",
|                    AttackPathPriorityScore >= 30, "Medium-High",
|                    AttackPathPriorityScore >= 15, "Medium",
|                    "Low"
|                )
|            | project
|                AttackPathPriority,
|                AttackPathPriorityScore,
|                TierEscalation,
|                LateralMovementType,
|                FirstSourceAssetId,
|                FirstSourceAssetName,
|                FirstSourceAssetLabel,
|                IntermediateIdentityId,
|                IntermediateIdentity,
|                IntermediateIdentityLabel,
|                CredentialNodeId,
|                CredentialName,
|                CredentialLabel,
|                FinalTargetId,
|                FinalTargetName,
|                FinalTargetLabel,
|                TargetCriticalityTier,
|                TargetCriticalityTierLevel,
|                TargetAssetTierByTag,
|                TargetIsInternetExposed,
|                TargetLegacyEndOfSupport,
|                TargetRiskProb              = coalesce(TargetRiskProb, 0),
|                TargetRiskProbDetailed      = coalesce(TargetRiskProbDetailed, ""),
|                TargetRiskProbDetailedScore = coalesce(TargetRiskProbDetailedScore, ""),
|                SourceCriticalityTier,
|                SourceCriticalityTierLevel,
|                SourceIsInternetExposed,
|                SourceLegacyEndOfSupport,
|                SourceRiskProb              = coalesce(SourceRiskProb, 0),
|                SourceRiskProbDetailed      = coalesce(SourceRiskProbDetailed, ""),
|                SourceRiskProbDetailedScore = coalesce(SourceRiskProbDetailedScore, ""),
|                SourceAssetId,
|                CredentialEdge,
|                Hop1Edge,
|                Hop2Edge,
|                cmdbId,
|                cmdbName,
|                cmdbCriticality,
|                cmdbDataSensitivity,
|                TargetAssetId;
|
|        // Step 11  One row per path -- source asset x credential x identity x target (#690 -- this report summarised its paths to
|        // one row per lateral-movement type and CMDB values -- a Summary inside the Detailed report, naming no path, AssetId
|        // always empty). The row's asset is the path's SOURCE (where the credential sits -- the thing to clean) -- its CI id,
|        // else its graph node id. The tier is the TARGET's (what the path reaches), the source's tier is SourceCriticalityTier.
|        // ConfigurationId names the path by its graph node ids, so two paths never share one.
|        Detailed
|        | extend PathKey = strcat(FirstSourceAssetId, "->", CredentialNodeId, "->", IntermediateIdentityId, "->", FinalTargetId)
|        | extend SecurityDomain       = "Azure"
|        | extend Category             = "Attack Paths"
|        | extend SubCategory          = "LateralMovement"
|        | extend ConfigurationName    = tostring(LateralMovementType)
|        | extend ConfigurationId      = PathKey
|        | extend SecuritySeverity     = tostring(AttackPathPriority)
|        | extend CriticalityTier      = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = tostring(TargetCriticalityTierLevel)
|        | extend AssetName = iif(isnotempty(tostring(FirstSourceAssetName)), tostring(FirstSourceAssetName), tostring(FirstSourceAssetId))
|        | extend AssetId   = tostring(SourceAssetId)
|        | extend AssetType = tostring(FirstSourceAssetLabel)
|        | extend RiskFactor_Consequence               = 0
|        | extend RiskFactor_Probability               = TargetRiskProb
|        | extend RiskFactor_Probability_Detailed      = TargetRiskProbDetailed
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        // Weighted-factor block. Engine substitutes from riskscore_weighted.schema.custom.json -> weightedRiskFactors.azure.fields[].
|        // Portal-paste default below emits a readable Detailed text + Factor=100 (basis-100, 100 = 1.0x = no lift).
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            SubCategory,
|            ConfigurationName,
|            ConfigurationId,
|            AssetName,
|            AssetId,
|            AssetType,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor,
|            RiskFactor_Weight,
|            SourceCriticalityTier
|        | order by
|            RiskScore_Weight_Factor desc,
|            RiskFactor_Probability desc,
|            CriticalityTier asc,
|            AssetName asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_ServicePrincipal_Impersonates_Users
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: >-
|        Service principals (applications) the Exposure Graph says can impersonate users, grouped by the tier of the users they can act as and the tiers the path climbs. Exposure Graph drives the path; the CI (SI_CI_CL) gives the tier, CMDB values and asset risk factors of both ends.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  An application can impersonate users (Exposure Graph can-impersonate-as edges)
|        // Step 1  the application -> user edge.  Step 2  the user's tier and factors from the CI.
|        // Sliced on the path's SOURCE (the application) -- every path is in exactly one slice.
|        // =================================================================================================
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|        let ImpersonationEdges =
|            ExposureGraphEdges
|            | where EdgeLabel =~ "can impersonate as"
|            | where SourceNodeId != TargetNodeId
|            | extend DeviceKey = SourceNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | summarize PathEdge = strcat_array(array_sort_asc(make_set(EdgeLabel)), ", ") by SourceNodeId, TargetNodeId;
|        let EnrichIds =
|            union (ImpersonationEdges | project NodeId = SourceNodeId), (ImpersonationEdges | project NodeId = TargetNodeId)
|            | summarize by NodeId;
|        // the path's nodes -- the name and label the graph shows, the graph's own risk factors, and the CI key (the id the CI
|        // links -- Defender device id, Azure resource id, Entra object id -- else the node id). No tier is read from the graph.
|        let Nodes =
|            ExposureGraphNodes
|            | where NodeId in (EnrichIds)
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend NodeNameNorm = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend RiskFactorsArray = todynamic(coalesce(RawData.risk.riskFactors, NodeProperties.risk.riskFactors, dynamic([])))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | project NodeId, NodeCiKey, NodeName = NodeNameNorm, NodeLabel, RiskFactorSet;
|        let Paths =
|            ImpersonationEdges
|            | join kind=leftouter (Nodes | project SourceNodeId = NodeId, SourceNodeCiKey = NodeCiKey, SourceName = NodeName, SourceLabel = NodeLabel) on SourceNodeId
|            | join kind=leftouter (Nodes | project TargetNodeId = NodeId, TargetNodeCiKey = NodeCiKey, TargetName = NodeName, TargetLabel = NodeLabel, TargetRiskFactorSet = RiskFactorSet) on TargetNodeId
|            | project-away SourceNodeId1, TargetNodeId1
|            | extend PathKey = strcat(SourceNodeId, "->", TargetNodeId)
|            | extend RouteName = "Application can impersonate users";
|        Paths
|        // both ends' CI -- the lookup _ciPeer on each end's own key, after the slice filter (the row's tier, CMDB values and
|        // asset risk factors are the TARGET's; the source's tier is SourceCriticalityTier)
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|        | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|        | extend Source_si_ci_id = peer_ci_id, SourceCriticalityTier = peer_tier, Source_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend Target_si_ci_id = peer_ci_id, TargetCriticalityTier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, Target_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(Source_in_scope, true) and coalesce(Target_in_scope, true)
|        // the target's factors -- the graph's own risk factors and the CI's fed set, shown by the catalog names
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = array_length(TargetRiskFactorSet) + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        // the path's priority -- the target's tier and the tiers the path climbs (the attack-path bands of the severity model)
|        | extend TierEscalation = iff(isnotnull(SourceCriticalityTier) and isnotnull(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier, 0)
|        | extend LateralMovementType = case(
|            isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|            TierEscalation >= 3, "Privilege escalation large tier jump",
|            TierEscalation == 2, "Privilege escalation two tiers",
|            TierEscalation == 1, "Privilege escalation one tier",
|            "Direct access same tier")
|        | extend TargetTierWeight = case(TargetCriticalityTier == 0, 100, TargetCriticalityTier == 1, 60, TargetCriticalityTier == 2, 30, 10)
|        | extend AttackPathPriorityScore = TargetTierWeight + TierEscalation * 10
|        | extend AttackPathPriority = case(AttackPathPriorityScore >= 90, "Very High", AttackPathPriorityScore >= 60, "High", AttackPathPriorityScore >= 30, "Medium-High", AttackPathPriorityScore >= 15, "Medium", "Low")
|        // the tier is the TARGET's CI tier (what the path reaches) -- a target without a tier keeps an empty level
|        | extend CriticalityTier = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = tostring(AttackPathPriority)
|        | extend RiskFactor_Consequence = 0
|        | extend SecurityDomain = "Identity", Category = "Attack Paths", Subcategory = "Impersonation"
|        | extend ConfigurationName = strcat(RouteName, " -- ", LateralMovementType)
|        | extend RiskFactor_Probability = TargetRiskProb
|        | extend RiskFactor_Probability_Detailed = TargetRiskProbDetailed
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        | extend AssetName = iif(isnotempty(tostring(SourceName)), tostring(SourceName), tostring(SourceNodeId))
|        | extend si_ci_id = Source_si_ci_id
|        | extend _assetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(SourceNodeId))
|        | extend AssetType = tostring(SourceLabel)
|        // the slice key the bucket merge adds the counts up on
|        | extend DeviceKey = SourceNodeId
|        | extend ConfigurationId = "ATTACKPATH-APP-IMPERSONATES-USER"
|        | extend RouteImpact = "Applications that can impersonate users act with those users' access -- remove the impersonation permission (delegated or application) or limit it to the users the application must serve"
|        | summarize
|            AssetCount             = dcount(DeviceKey),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", _assetId)),
|            Impact                 = take_any(RouteImpact),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId                 = min(tostring(cmdbId)),
|            cmdbName               = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring("")),
|            EntraAccountObjectId   = min(tostring("")),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(_assetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Detailed_ServicePrincipal_Impersonates_Users
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: >-
|        Per row, a service principal (application) the Exposure Graph says can impersonate a user, and what that user reaches. Step one is the graph's can-impersonate-as edge (application to user), step two the impersonated user's own tier and asset risk factors from the CI (SI_CI_CL). The row's asset is the application (the permission to remove), its tier the impersonated user's; a path that climbs tiers is prioritised.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  An application can impersonate users (Exposure Graph can-impersonate-as edges)
|        // Step 1  the application -> user edge.  Step 2  the user's tier and factors from the CI.
|        // Sliced on the path's SOURCE (the application) -- every path is in exactly one slice.
|        // =================================================================================================
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|        let ImpersonationEdges =
|            ExposureGraphEdges
|            | where EdgeLabel =~ "can impersonate as"
|            | where SourceNodeId != TargetNodeId
|            | extend DeviceKey = SourceNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | summarize PathEdge = strcat_array(array_sort_asc(make_set(EdgeLabel)), ", ") by SourceNodeId, TargetNodeId;
|        let EnrichIds =
|            union (ImpersonationEdges | project NodeId = SourceNodeId), (ImpersonationEdges | project NodeId = TargetNodeId)
|            | summarize by NodeId;
|        // the path's nodes -- the name and label the graph shows, the graph's own risk factors, and the CI key (the id the CI
|        // links -- Defender device id, Azure resource id, Entra object id -- else the node id). No tier is read from the graph.
|        let Nodes =
|            ExposureGraphNodes
|            | where NodeId in (EnrichIds)
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend NodeNameNorm = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend RiskFactorsArray = todynamic(coalesce(RawData.risk.riskFactors, NodeProperties.risk.riskFactors, dynamic([])))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | project NodeId, NodeCiKey, NodeName = NodeNameNorm, NodeLabel, RiskFactorSet;
|        let Paths =
|            ImpersonationEdges
|            | join kind=leftouter (Nodes | project SourceNodeId = NodeId, SourceNodeCiKey = NodeCiKey, SourceName = NodeName, SourceLabel = NodeLabel) on SourceNodeId
|            | join kind=leftouter (Nodes | project TargetNodeId = NodeId, TargetNodeCiKey = NodeCiKey, TargetName = NodeName, TargetLabel = NodeLabel, TargetRiskFactorSet = RiskFactorSet) on TargetNodeId
|            | project-away SourceNodeId1, TargetNodeId1
|            | extend PathKey = strcat(SourceNodeId, "->", TargetNodeId)
|            | extend RouteName = "Application can impersonate users";
|        Paths
|        // both ends' CI -- the lookup _ciPeer on each end's own key, after the slice filter (the row's tier, CMDB values and
|        // asset risk factors are the TARGET's; the source's tier is SourceCriticalityTier)
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|        | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|        | extend Source_si_ci_id = peer_ci_id, SourceCriticalityTier = peer_tier, Source_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend Target_si_ci_id = peer_ci_id, TargetCriticalityTier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, Target_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(Source_in_scope, true) and coalesce(Target_in_scope, true)
|        // the target's factors -- the graph's own risk factors and the CI's fed set, shown by the catalog names
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = array_length(TargetRiskFactorSet) + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        // the path's priority -- the target's tier and the tiers the path climbs (the attack-path bands of the severity model)
|        | extend TierEscalation = iff(isnotnull(SourceCriticalityTier) and isnotnull(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier, 0)
|        | extend LateralMovementType = case(
|            isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|            TierEscalation >= 3, "Privilege escalation large tier jump",
|            TierEscalation == 2, "Privilege escalation two tiers",
|            TierEscalation == 1, "Privilege escalation one tier",
|            "Direct access same tier")
|        | extend TargetTierWeight = case(TargetCriticalityTier == 0, 100, TargetCriticalityTier == 1, 60, TargetCriticalityTier == 2, 30, 10)
|        | extend AttackPathPriorityScore = TargetTierWeight + TierEscalation * 10
|        | extend AttackPathPriority = case(AttackPathPriorityScore >= 90, "Very High", AttackPathPriorityScore >= 60, "High", AttackPathPriorityScore >= 30, "Medium-High", AttackPathPriorityScore >= 15, "Medium", "Low")
|        // the tier is the TARGET's CI tier (what the path reaches) -- a target without a tier keeps an empty level
|        | extend CriticalityTier = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = tostring(AttackPathPriority)
|        | extend RiskFactor_Consequence = 0
|        | extend SecurityDomain = "Identity", Category = "Attack Paths", Subcategory = "Impersonation"
|        | extend ConfigurationName = strcat(RouteName, " -- ", LateralMovementType)
|        | extend RiskFactor_Probability = TargetRiskProb
|        | extend RiskFactor_Probability_Detailed = TargetRiskProbDetailed
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        | extend AssetName = iif(isnotempty(tostring(SourceName)), tostring(SourceName), tostring(SourceNodeId))
|        | extend _assetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(SourceNodeId))
|        | extend AssetType = tostring(SourceLabel)
|        | extend Impact = strcat(AssetName, " can impersonate ", tostring(TargetName), " (", iff(isnull(TargetCriticalityTier), "no tier", strcat("tier ", tostring(TargetCriticalityTier))), ") and act with that user's access")
|        // one row per path -- the path names its graph node ids, so two paths never share a ConfigurationId
|        | extend ConfigurationId = PathKey
|        | extend AssetId = _assetId
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType, Impact,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight, SourceCriticalityTier
|        | order by RiskScore_Weight_Factor desc, RiskFactor_Probability desc, CriticalityTier asc, AssetName asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_Workload_ManagedIdentity_to_Azure_Resources
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|          | extend TargetParentCiKey = iff(TargetCiKey startswith "/subscriptions/" and array_length(split(TargetCiKey, "/")) > 9, strcat_array(array_slice(split(TargetCiKey, "/"), 0, 8), "/"), "")
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey, TargetParentCiKey)
|      ReportPurpose: >-
|        Workloads that sign in as a managed identity holding access to Azure resources, grouped by the tier of the resources reached and the tiers the path climbs. Exposure Graph drives the path; the CI (SI_CI_CL) gives the tier, CMDB values and asset risk factors of both ends.
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // the objects inside each subscription and resource group, from the graph's own contains edges -- a role on a scope is
|        // reported on the objects inside it, never on the scope itself (owner 2026-10-19)
|        let _SI_ScopeContains = ExposureGraphEdges
|            | where EdgeLabel =~ "contains" and SourceNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")
|            | project _ScopeNodeId = SourceNodeId, _ChildId = TargetNodeId, _ChildName = TargetNodeName, _ChildLabel = TargetNodeLabel;
|        let _SI_ScopeMembers = union
|            (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel),
|            (_SI_ScopeContains | where _ChildLabel in~ ("resourcegroups", "microsoft.resources/resourcegroups") | project _ScopeNodeId, _RgNodeId = _ChildId
|                | join kind=inner (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _RgNodeId = _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel) on _RgNodeId
|                | project _ScopeNodeId, _MemberId, _MemberName, _MemberLabel)
|            | summarize _MemberName = take_any(_MemberName), _MemberLabel = take_any(_MemberLabel) by _ScopeNodeId, _MemberId;
|        // =================================================================================================
|        // REPORT  A workload signs in as a managed identity that reaches Azure resources (Exposure Graph)
|        // Step 1  workload -> managed identity (can authenticate as).  Step 2  identity -> resource (role / permission).
|        // No credential node in between (that path is the credential-based report). Sliced on the workload.
|        // =================================================================================================
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "internet_exposed", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "internet_exposed", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|        // a target no CI links takes the tier its own resource tree gives it -- the top-level resource it belongs to (#190),
|        // else its subscription's most critical CI (#192) -- read on its own, never from a slice's share (#675)
|        //__SI_CI_SUBTIER_BEGIN__
|            let _subTierG =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device")
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where _ciKey startswith "/subscriptions/"
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | extend _sub = tostring(split(_ciKey, "/")[2])
|                | where isnotempty(_sub)
|                | summarize Tier_BySub = min(toint(column_ifexists("si_tier", int(null)))) by _sub;
|        //__SI_CI_SUBTIER_END__
|        let WorkloadIdentity =
|            ExposureGraphEdges
|            | where EdgeLabel =~ "can authenticate as"
|            | where TargetNodeLabel =~ "managedidentity"
|            | where not(set_has_element(SourceNodeCategories, "secret"))
|            | extend DeviceKey = SourceNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | summarize Hop1Edge = strcat_array(array_sort_asc(make_set(EdgeLabel)), ", ") by SourceNodeId, IntermediateNodeId = TargetNodeId;
|        // Step 2 is BOUND to the identities of step 1 (a semi-join, so the scan shrinks with the slice)
|        let IdentityAccess =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("has permissions to", "has role on")
|            | where TargetNodeLabel startswith "microsoft." or TargetNodeLabel in~ ("subscriptions", "resourcegroups", "BlobContainer")
|            | where SourceNodeId in (WorkloadIdentity | distinct IntermediateNodeId)
|            // a subscription or resource group target is replaced by the objects inside it -- once per object, so an object reached
|            // directly and through its resource group and subscription is one path (owner 2026-10-19)
|            | join kind=leftouter (_SI_ScopeMembers) on $left.TargetNodeId == $right._ScopeNodeId
|            | where isnotempty(_MemberId) or not(TargetNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups"))
|            | extend TargetNodeId = iff(isnotempty(_MemberId), _MemberId, TargetNodeId), TargetNodeName = iff(isnotempty(_MemberId), _MemberName, TargetNodeName), TargetNodeLabel = iff(isnotempty(_MemberId), _MemberLabel, TargetNodeLabel)
|            | extend _SI_ViaScope = isnotempty(_MemberId)
|            | project-away _ScopeNodeId, _MemberId, _MemberName, _MemberLabel
|            | summarize PathEdge = strcat_array(array_sort_asc(make_set(EdgeLabel)), ", ") by IntermediateNodeId = SourceNodeId, TargetNodeId;
|        let Joined =
|            WorkloadIdentity
|            | join kind=inner (IdentityAccess) on IntermediateNodeId
|            | project-away IntermediateNodeId1
|            | where SourceNodeId != TargetNodeId;
|        let EnrichIds =
|            union (Joined | project NodeId = SourceNodeId), (Joined | project NodeId = IntermediateNodeId), (Joined | project NodeId = TargetNodeId)
|            | summarize by NodeId;
|        // the path's nodes -- the name and label the graph shows, the graph's own risk factors, and the CI key (the id the CI
|        // links -- Defender device id, Azure resource id, Entra object id -- else the node id). No tier is read from the graph.
|        let Nodes =
|            ExposureGraphNodes
|            | where NodeId in (EnrichIds)
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend NodeNameNorm = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend RiskFactorsArray = todynamic(coalesce(RawData.risk.riskFactors, NodeProperties.risk.riskFactors, dynamic([])))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | project NodeId, NodeCiKey, NodeName = NodeNameNorm, NodeLabel, RiskFactorSet;
|        let Paths =
|            Joined
|            | join kind=leftouter (Nodes | project SourceNodeId = NodeId, SourceNodeCiKey = NodeCiKey, SourceName = NodeName, SourceLabel = NodeLabel) on SourceNodeId
|            | join kind=leftouter (Nodes | project IntermediateNodeId = NodeId, IntermediateName = NodeName) on IntermediateNodeId
|            | join kind=leftouter (Nodes | project TargetNodeId = NodeId, TargetNodeCiKey = NodeCiKey, TargetName = NodeName, TargetLabel = NodeLabel, TargetRiskFactorSet = RiskFactorSet) on TargetNodeId
|            | project-away SourceNodeId1, IntermediateNodeId1, TargetNodeId1
|            | extend PathKey = strcat(SourceNodeId, "->", IntermediateNodeId, "->", TargetNodeId)
|            | extend RouteName = "Workload signs in as a managed identity with access to Azure resources";
|        Paths
|        // both ends' CI -- the lookup _ciPeer on each end's own key, after the slice filter (the row's tier, CMDB values and
|        // asset risk factors are the TARGET's; the source's tier is SourceCriticalityTier)
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|        | extend TargetParentCiKey = iff(TargetCiKey startswith "/subscriptions/" and array_length(split(TargetCiKey, "/")) > 9, strcat_array(array_slice(split(TargetCiKey, "/"), 0, 8), "/"), "")
|        | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|        | extend Source_si_ci_id = peer_ci_id, SourceCriticalityTier = peer_tier, Source_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend Target_si_ci_id = peer_ci_id, TargetCriticalityTier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, Target_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | join kind=leftouter (_ciPeer | where isnotempty(_peerKey) | project TargetParentCiKey = _peerKey, Tier_ByParent = peer_tier) on TargetParentCiKey
|        | extend _tSub = iff(TargetCiKey startswith "/subscriptions/", tostring(split(TargetCiKey, "/")[2]), "")
|        | join kind=leftouter (_subTierG) on $left._tSub == $right._sub
|        | extend TargetTierFrom = case(isnotnull(TargetCriticalityTier), "ci", isnotnull(Tier_ByParent), "parent resource", isnotnull(Tier_BySub), "subscription", "")
|        | extend TargetCriticalityTier = coalesce(toint(TargetCriticalityTier), toint(Tier_ByParent), toint(Tier_BySub))
|        | project-away TargetParentCiKey1, _tSub, _sub, Tier_ByParent, Tier_BySub
|        | where coalesce(Source_in_scope, true) and coalesce(Target_in_scope, true)
|        // the target's factors -- the graph's own risk factors and the CI's fed set, shown by the catalog names
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = array_length(TargetRiskFactorSet) + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        // the path's priority -- the target's tier and the tiers the path climbs (the attack-path bands of the severity model)
|        | extend TierEscalation = iff(isnotnull(SourceCriticalityTier) and isnotnull(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier, 0)
|        | extend LateralMovementType = case(
|            isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|            TierEscalation >= 3, "Privilege escalation large tier jump",
|            TierEscalation == 2, "Privilege escalation two tiers",
|            TierEscalation == 1, "Privilege escalation one tier",
|            "Direct access same tier")
|        | extend TargetTierWeight = case(TargetCriticalityTier == 0, 100, TargetCriticalityTier == 1, 60, TargetCriticalityTier == 2, 30, 10)
|        | extend AttackPathPriorityScore = TargetTierWeight + TierEscalation * 10
|        | extend AttackPathPriority = case(AttackPathPriorityScore >= 90, "Very High", AttackPathPriorityScore >= 60, "High", AttackPathPriorityScore >= 30, "Medium-High", AttackPathPriorityScore >= 15, "Medium", "Low")
|        // the tier is the TARGET's (what the path reaches) -- its CI's, else its top-level resource's, else its subscription's
|        // most critical CI -- a target none of them gives a tier keeps an empty level
|        | extend CriticalityTier = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = tostring(AttackPathPriority)
|        | extend RiskFactor_Consequence = 0
|        | extend SecurityDomain = "Azure", Category = "Attack Paths", Subcategory = "WorkloadIdentity"
|        | extend ConfigurationName = strcat(RouteName, " -- ", LateralMovementType)
|        | extend RiskFactor_Probability = TargetRiskProb
|        | extend RiskFactor_Probability_Detailed = TargetRiskProbDetailed
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        | extend AssetName = iif(isnotempty(tostring(SourceName)), tostring(SourceName), tostring(SourceNodeId))
|        | extend si_ci_id = Source_si_ci_id
|        | extend _assetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(SourceNodeId))
|        | extend AssetType = tostring(SourceLabel)
|        // the slice key the bucket merge adds the counts up on
|        | extend DeviceKey = SourceNodeId
|        | extend ConfigurationId = "ATTACKPATH-WORKLOAD-MI-AZURE"
|        | extend RouteImpact = "Code running on these workloads acts as their managed identity -- give the identity only the roles the workload needs, on the narrowest scope, and protect the workload as the tier of what it reaches"
|        | summarize
|            AssetCount             = dcount(DeviceKey),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", _assetId)),
|            Impact                 = take_any(RouteImpact),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId                 = min(tostring(cmdbId)),
|            cmdbName               = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring("")),
|            EntraAccountObjectId   = min(tostring("")),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(_assetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Detailed_Workload_ManagedIdentity_to_Azure_Resources
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|          | extend TargetParentCiKey = iff(TargetCiKey startswith "/subscriptions/" and array_length(split(TargetCiKey, "/")) > 9, strcat_array(array_slice(split(TargetCiKey, "/"), 0, 8), "/"), "")
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey, TargetParentCiKey)
|      ReportPurpose: >-
|        Per row, a workload (virtual machine, container app, web app, function, database, AI service) that signs in as a managed identity, and an Azure resource that identity holds a role or permission on. Step one is the graph's can-authenticate-as edge (workload to managed identity), step two the identity's has-role-on / has-permissions-to edge to the resource. Whoever runs code on the workload reaches the resource. The row's asset is the workload, its tier the target resource's (CI).
|      SecurityDomain: Azure
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // the objects inside each subscription and resource group, from the graph's own contains edges -- a role on a scope is
|        // reported on the objects inside it, never on the scope itself (owner 2026-10-19)
|        let _SI_ScopeContains = ExposureGraphEdges
|            | where EdgeLabel =~ "contains" and SourceNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")
|            | project _ScopeNodeId = SourceNodeId, _ChildId = TargetNodeId, _ChildName = TargetNodeName, _ChildLabel = TargetNodeLabel;
|        let _SI_ScopeMembers = union
|            (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel),
|            (_SI_ScopeContains | where _ChildLabel in~ ("resourcegroups", "microsoft.resources/resourcegroups") | project _ScopeNodeId, _RgNodeId = _ChildId
|                | join kind=inner (_SI_ScopeContains | where not(_ChildLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups")) and not(_ChildLabel startswith "microsoft.authorization/") | project _RgNodeId = _ScopeNodeId, _MemberId = _ChildId, _MemberName = _ChildName, _MemberLabel = _ChildLabel) on _RgNodeId
|                | project _ScopeNodeId, _MemberId, _MemberName, _MemberLabel)
|            | summarize _MemberName = take_any(_MemberName), _MemberLabel = take_any(_MemberLabel) by _ScopeNodeId, _MemberId;
|        // =================================================================================================
|        // REPORT  A workload signs in as a managed identity that reaches Azure resources (Exposure Graph)
|        // Step 1  workload -> managed identity (can authenticate as).  Step 2  identity -> resource (role / permission).
|        // No credential node in between (that path is the credential-based report). Sliced on the workload.
|        // =================================================================================================
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "internet_exposed", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "internet_exposed", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|        // a target no CI links takes the tier its own resource tree gives it -- the top-level resource it belongs to (#190),
|        // else its subscription's most critical CI (#192) -- read on its own, never from a slice's share (#675)
|        //__SI_CI_SUBTIER_BEGIN__
|            let _subTierG =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device")
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where _ciKey startswith "/subscriptions/"
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | extend _sub = tostring(split(_ciKey, "/")[2])
|                | where isnotempty(_sub)
|                | summarize Tier_BySub = min(toint(column_ifexists("si_tier", int(null)))) by _sub;
|        //__SI_CI_SUBTIER_END__
|        let WorkloadIdentity =
|            ExposureGraphEdges
|            | where EdgeLabel =~ "can authenticate as"
|            | where TargetNodeLabel =~ "managedidentity"
|            | where not(set_has_element(SourceNodeCategories, "secret"))
|            | extend DeviceKey = SourceNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | summarize Hop1Edge = strcat_array(array_sort_asc(make_set(EdgeLabel)), ", ") by SourceNodeId, IntermediateNodeId = TargetNodeId;
|        // Step 2 is BOUND to the identities of step 1 (a semi-join, so the scan shrinks with the slice)
|        let IdentityAccess =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("has permissions to", "has role on")
|            | where TargetNodeLabel startswith "microsoft." or TargetNodeLabel in~ ("subscriptions", "resourcegroups", "BlobContainer")
|            | where SourceNodeId in (WorkloadIdentity | distinct IntermediateNodeId)
|            // a subscription or resource group target is replaced by the objects inside it -- once per object, so an object reached
|            // directly and through its resource group and subscription is one path (owner 2026-10-19)
|            | join kind=leftouter (_SI_ScopeMembers) on $left.TargetNodeId == $right._ScopeNodeId
|            | where isnotempty(_MemberId) or not(TargetNodeLabel in~ ("subscriptions", "resourcegroups", "microsoft.resources/subscriptions", "microsoft.resources/resourcegroups"))
|            | extend TargetNodeId = iff(isnotempty(_MemberId), _MemberId, TargetNodeId), TargetNodeName = iff(isnotempty(_MemberId), _MemberName, TargetNodeName), TargetNodeLabel = iff(isnotempty(_MemberId), _MemberLabel, TargetNodeLabel)
|            | extend _SI_ViaScope = isnotempty(_MemberId)
|            | project-away _ScopeNodeId, _MemberId, _MemberName, _MemberLabel
|            | summarize PathEdge = strcat_array(array_sort_asc(make_set(EdgeLabel)), ", ") by IntermediateNodeId = SourceNodeId, TargetNodeId;
|        let Joined =
|            WorkloadIdentity
|            | join kind=inner (IdentityAccess) on IntermediateNodeId
|            | project-away IntermediateNodeId1
|            | where SourceNodeId != TargetNodeId;
|        let EnrichIds =
|            union (Joined | project NodeId = SourceNodeId), (Joined | project NodeId = IntermediateNodeId), (Joined | project NodeId = TargetNodeId)
|            | summarize by NodeId;
|        // the path's nodes -- the name and label the graph shows, the graph's own risk factors, and the CI key (the id the CI
|        // links -- Defender device id, Azure resource id, Entra object id -- else the node id). No tier is read from the graph.
|        let Nodes =
|            ExposureGraphNodes
|            | where NodeId in (EnrichIds)
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend NodeNameNorm = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend RiskFactorsArray = todynamic(coalesce(RawData.risk.riskFactors, NodeProperties.risk.riskFactors, dynamic([])))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | project NodeId, NodeCiKey, NodeName = NodeNameNorm, NodeLabel, RiskFactorSet;
|        let Paths =
|            Joined
|            | join kind=leftouter (Nodes | project SourceNodeId = NodeId, SourceNodeCiKey = NodeCiKey, SourceName = NodeName, SourceLabel = NodeLabel) on SourceNodeId
|            | join kind=leftouter (Nodes | project IntermediateNodeId = NodeId, IntermediateName = NodeName) on IntermediateNodeId
|            | join kind=leftouter (Nodes | project TargetNodeId = NodeId, TargetNodeCiKey = NodeCiKey, TargetName = NodeName, TargetLabel = NodeLabel, TargetRiskFactorSet = RiskFactorSet) on TargetNodeId
|            | project-away SourceNodeId1, IntermediateNodeId1, TargetNodeId1
|            | extend PathKey = strcat(SourceNodeId, "->", IntermediateNodeId, "->", TargetNodeId)
|            | extend RouteName = "Workload signs in as a managed identity with access to Azure resources";
|        Paths
|        // both ends' CI -- the lookup _ciPeer on each end's own key, after the slice filter (the row's tier, CMDB values and
|        // asset risk factors are the TARGET's; the source's tier is SourceCriticalityTier)
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|        | extend TargetParentCiKey = iff(TargetCiKey startswith "/subscriptions/" and array_length(split(TargetCiKey, "/")) > 9, strcat_array(array_slice(split(TargetCiKey, "/"), 0, 8), "/"), "")
|        | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|        | extend Source_si_ci_id = peer_ci_id, SourceCriticalityTier = peer_tier, Source_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend Target_si_ci_id = peer_ci_id, TargetCriticalityTier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, Target_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | join kind=leftouter (_ciPeer | where isnotempty(_peerKey) | project TargetParentCiKey = _peerKey, Tier_ByParent = peer_tier) on TargetParentCiKey
|        | extend _tSub = iff(TargetCiKey startswith "/subscriptions/", tostring(split(TargetCiKey, "/")[2]), "")
|        | join kind=leftouter (_subTierG) on $left._tSub == $right._sub
|        | extend TargetTierFrom = case(isnotnull(TargetCriticalityTier), "ci", isnotnull(Tier_ByParent), "parent resource", isnotnull(Tier_BySub), "subscription", "")
|        | extend TargetCriticalityTier = coalesce(toint(TargetCriticalityTier), toint(Tier_ByParent), toint(Tier_BySub))
|        | project-away TargetParentCiKey1, _tSub, _sub, Tier_ByParent, Tier_BySub
|        | where coalesce(Source_in_scope, true) and coalesce(Target_in_scope, true)
|        // the target's factors -- the graph's own risk factors and the CI's fed set, shown by the catalog names
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = array_length(TargetRiskFactorSet) + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        // the path's priority -- the target's tier and the tiers the path climbs (the attack-path bands of the severity model)
|        | extend TierEscalation = iff(isnotnull(SourceCriticalityTier) and isnotnull(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier, 0)
|        | extend LateralMovementType = case(
|            isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|            TierEscalation >= 3, "Privilege escalation large tier jump",
|            TierEscalation == 2, "Privilege escalation two tiers",
|            TierEscalation == 1, "Privilege escalation one tier",
|            "Direct access same tier")
|        | extend TargetTierWeight = case(TargetCriticalityTier == 0, 100, TargetCriticalityTier == 1, 60, TargetCriticalityTier == 2, 30, 10)
|        | extend AttackPathPriorityScore = TargetTierWeight + TierEscalation * 10
|        | extend AttackPathPriority = case(AttackPathPriorityScore >= 90, "Very High", AttackPathPriorityScore >= 60, "High", AttackPathPriorityScore >= 30, "Medium-High", AttackPathPriorityScore >= 15, "Medium", "Low")
|        // the tier is the TARGET's (what the path reaches) -- its CI's, else its top-level resource's, else its subscription's
|        // most critical CI -- a target none of them gives a tier keeps an empty level
|        | extend CriticalityTier = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = tostring(AttackPathPriority)
|        | extend RiskFactor_Consequence = 0
|        | extend SecurityDomain = "Azure", Category = "Attack Paths", Subcategory = "WorkloadIdentity"
|        | extend ConfigurationName = strcat(RouteName, " -- ", LateralMovementType)
|        | extend RiskFactor_Probability = TargetRiskProb
|        | extend RiskFactor_Probability_Detailed = TargetRiskProbDetailed
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        | extend AssetName = iif(isnotempty(tostring(SourceName)), tostring(SourceName), tostring(SourceNodeId))
|        | extend _assetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(SourceNodeId))
|        | extend AssetType = tostring(SourceLabel)
|        | extend Impact = strcat(AssetName, " (", AssetType, ") signs in as the managed identity ", tostring(IntermediateName), ", which ", PathEdge, " ", tostring(TargetName), " (", tostring(TargetLabel), ", ", iff(isnull(TargetCriticalityTier), "no tier", strcat("tier ", tostring(TargetCriticalityTier))), ")")
|        // one row per path -- the path names its graph node ids, so two paths never share a ConfigurationId
|        | extend ConfigurationId = PathKey
|        | extend AssetId = _assetId
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType, Impact,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight, SourceCriticalityTier
|        | order by RiskScore_Weight_Factor desc, RiskFactor_Probability desc, CriticalityTier asc, AssetName asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_SignIn_Entitlement_to_Tier0_Servers
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: >-
|        Users who are entitled to sign in to or administer Tier 0 servers without being Tier 0 themselves, directly or through a group, grouped by the tiers the path climbs. Exposure Graph drives the path; the CI (SI_CI_CL) gives the tier, CMDB values and asset risk factors of both ends.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  Users entitled to sign in to Tier 0 servers (Exposure Graph role / permission edges)
|        // Step 1  user -> group (member of), or the user itself.  Step 2  user or group -> server (has role on / has permissions to).
|        // The logon EVENTS are the admin logon reports -- this reads the ENTITLEMENT only (no can-authenticate-to edge).
|        // Sliced on the user.
|        // =================================================================================================
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|        let ServerGrants =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("has role on", "has permissions to")
|            | where TargetNodeLabel in~ ("microsoft.compute/virtualmachines", "microsoft.hybridcompute/machines", "device", "computer-account")
|            | where SourceNodeLabel in~ ("user", "group")
|            | project GrantHolderId = SourceNodeId, GrantHolderLabel = SourceNodeLabel, TargetNodeId, AccessEdge = EdgeLabel;
|        let DirectGrants =
|            ServerGrants
|            | where GrantHolderLabel =~ "user"
|            | project SourceNodeId = GrantHolderId, IntermediateNodeId = "", TargetNodeId, AccessEdge;
|        let GroupGrants =
|            ExposureGraphEdges
|            | where EdgeLabel =~ "member of"
|            | where SourceNodeLabel =~ "user"
|            | where TargetNodeId in (ServerGrants | where GrantHolderLabel =~ "group" | distinct GrantHolderId)
|            | project SourceNodeId, IntermediateNodeId = TargetNodeId
|            | join kind=inner (ServerGrants | where GrantHolderLabel =~ "group" | project IntermediateNodeId = GrantHolderId, TargetNodeId, AccessEdge) on IntermediateNodeId
|            | project SourceNodeId, IntermediateNodeId, TargetNodeId, AccessEdge;
|        let Joined =
|            union DirectGrants, GroupGrants
|            | where SourceNodeId != TargetNodeId
|            | extend DeviceKey = SourceNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | summarize PathEdge = strcat_array(array_sort_asc(make_set(AccessEdge)), ", "), ViaGroupCount = dcountif(IntermediateNodeId, isnotempty(IntermediateNodeId)),
|                        Direct = max(toint(isempty(IntermediateNodeId))) by SourceNodeId, TargetNodeId;
|        let EnrichIds =
|            union (Joined | project NodeId = SourceNodeId), (Joined | project NodeId = TargetNodeId)
|            | summarize by NodeId;
|        // the path's nodes -- the name and label the graph shows, the graph's own risk factors, and the CI key (the id the CI
|        // links -- Defender device id, Azure resource id, Entra object id -- else the node id). No tier is read from the graph.
|        let Nodes =
|            ExposureGraphNodes
|            | where NodeId in (EnrichIds)
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend NodeNameNorm = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend RiskFactorsArray = todynamic(coalesce(RawData.risk.riskFactors, NodeProperties.risk.riskFactors, dynamic([])))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | project NodeId, NodeCiKey, NodeName = NodeNameNorm, NodeLabel, RiskFactorSet;
|        let Paths =
|            Joined
|            | join kind=leftouter (Nodes | project SourceNodeId = NodeId, SourceNodeCiKey = NodeCiKey, SourceName = NodeName, SourceLabel = NodeLabel) on SourceNodeId
|            | join kind=leftouter (Nodes | project TargetNodeId = NodeId, TargetNodeCiKey = NodeCiKey, TargetName = NodeName, TargetLabel = NodeLabel, TargetRiskFactorSet = RiskFactorSet) on TargetNodeId
|            | project-away SourceNodeId1, TargetNodeId1
|            | extend PathKey = strcat(SourceNodeId, "->", TargetNodeId)
|            | extend RouteName = "User entitled to sign in to a Tier 0 server";
|        Paths
|        // both ends' CI -- the lookup _ciPeer on each end's own key, after the slice filter (the row's tier, CMDB values and
|        // asset risk factors are the TARGET's; the source's tier is SourceCriticalityTier)
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|        | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|        | extend Source_si_ci_id = peer_ci_id, SourceCriticalityTier = peer_tier, Source_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend Target_si_ci_id = peer_ci_id, TargetCriticalityTier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, Target_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(Source_in_scope, true) and coalesce(Target_in_scope, true)
|        // the question -- the server is Tier 0 and the user is not (a user without a tier is not a known Tier 0 admin)
|        | where TargetCriticalityTier == 0
|        | where isnull(SourceCriticalityTier) or SourceCriticalityTier > 0
|        // the target's factors -- the graph's own risk factors and the CI's fed set, shown by the catalog names
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = array_length(TargetRiskFactorSet) + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        // the path's priority -- the target's tier and the tiers the path climbs (the attack-path bands of the severity model)
|        | extend TierEscalation = iff(isnotnull(SourceCriticalityTier) and isnotnull(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier, 0)
|        | extend LateralMovementType = case(
|            isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|            TierEscalation >= 3, "Privilege escalation large tier jump",
|            TierEscalation == 2, "Privilege escalation two tiers",
|            TierEscalation == 1, "Privilege escalation one tier",
|            "Direct access same tier")
|        | extend TargetTierWeight = case(TargetCriticalityTier == 0, 100, TargetCriticalityTier == 1, 60, TargetCriticalityTier == 2, 30, 10)
|        | extend AttackPathPriorityScore = TargetTierWeight + TierEscalation * 10
|        | extend AttackPathPriority = case(AttackPathPriorityScore >= 90, "Very High", AttackPathPriorityScore >= 60, "High", AttackPathPriorityScore >= 30, "Medium-High", AttackPathPriorityScore >= 15, "Medium", "Low")
|        // the tier is the TARGET's CI tier (what the path reaches) -- a target without a tier keeps an empty level
|        | extend CriticalityTier = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = tostring(AttackPathPriority)
|        | extend RiskFactor_Consequence = 0
|        | extend SecurityDomain = "Identity", Category = "Attack Paths", Subcategory = "SignInEntitlement"
|        | extend ConfigurationName = strcat(RouteName, " -- ", LateralMovementType)
|        | extend RiskFactor_Probability = TargetRiskProb
|        | extend RiskFactor_Probability_Detailed = TargetRiskProbDetailed
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        | extend AssetName = iif(isnotempty(tostring(SourceName)), tostring(SourceName), tostring(SourceNodeId))
|        | extend si_ci_id = Source_si_ci_id
|        | extend _assetId = iif(isnotempty(si_ci_id), si_ci_id, tostring(SourceNodeId))
|        | extend AssetType = tostring(SourceLabel)
|        // the slice key the bucket merge adds the counts up on
|        | extend DeviceKey = SourceNodeId
|        | extend ConfigurationId = "ATTACKPATH-ENTITLED-TIER0-SERVER"
|        | extend RouteImpact = "Accounts below Tier 0 that may sign in to or administer Tier 0 servers break the tier model -- give Tier 0 server access only to Tier 0 administration accounts (and the groups that hold it)"
|        | summarize
|            AssetCount             = dcount(DeviceKey),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", _assetId)),
|            Impact                 = take_any(RouteImpact),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId                 = min(tostring(cmdbId)),
|            cmdbName               = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring("")),
|            EntraAccountObjectId   = min(tostring("")),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(_assetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Detailed_SignIn_Entitlement_to_Tier0_Servers
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|          | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|          | project __siNeeded = pack_array(SourceCiKey, TargetCiKey)
|      ReportPurpose: >-
|        Per row, a user who is entitled to sign in to or administer a Tier 0 server and is not Tier 0 -- directly, or through a group the user is a member of. Step one is the user's group membership (member of), step two the role or permission the user or group holds on the virtual machine, Arc machine or device (has role on / has permissions to). It reads the entitlement, not the logon events (the admin logon reports cover those). The row's asset is the user, its tier the server's (CI).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  Users entitled to sign in to Tier 0 servers (Exposure Graph role / permission edges)
|        // Step 1  user -> group (member of), or the user itself.  Step 2  user or group -> server (has role on / has permissions to).
|        // The logon EVENTS are the admin logon reports -- this reads the ENTITLEMENT only (no can-authenticate-to edge).
|        // Sliced on the user.
|        // =================================================================================================
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("cloud_resource", "device", "identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|        let ServerGrants =
|            ExposureGraphEdges
|            | where EdgeLabel in~ ("has role on", "has permissions to")
|            | where TargetNodeLabel in~ ("microsoft.compute/virtualmachines", "microsoft.hybridcompute/machines", "device", "computer-account")
|            | where SourceNodeLabel in~ ("user", "group")
|            | project GrantHolderId = SourceNodeId, GrantHolderLabel = SourceNodeLabel, TargetNodeId, AccessEdge = EdgeLabel;
|        let DirectGrants =
|            ServerGrants
|            | where GrantHolderLabel =~ "user"
|            | project SourceNodeId = GrantHolderId, IntermediateNodeId = "", TargetNodeId, AccessEdge;
|        let GroupGrants =
|            ExposureGraphEdges
|            | where EdgeLabel =~ "member of"
|            | where SourceNodeLabel =~ "user"
|            | where TargetNodeId in (ServerGrants | where GrantHolderLabel =~ "group" | distinct GrantHolderId)
|            | project SourceNodeId, IntermediateNodeId = TargetNodeId
|            | join kind=inner (ServerGrants | where GrantHolderLabel =~ "group" | project IntermediateNodeId = GrantHolderId, TargetNodeId, AccessEdge) on IntermediateNodeId
|            | project SourceNodeId, IntermediateNodeId, TargetNodeId, AccessEdge;
|        let Joined =
|            union DirectGrants, GroupGrants
|            | where SourceNodeId != TargetNodeId
|            | extend DeviceKey = SourceNodeId
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | summarize PathEdge = strcat_array(array_sort_asc(make_set(AccessEdge)), ", "), ViaGroupCount = dcountif(IntermediateNodeId, isnotempty(IntermediateNodeId)),
|                        Direct = max(toint(isempty(IntermediateNodeId))) by SourceNodeId, TargetNodeId;
|        let EnrichIds =
|            union (Joined | project NodeId = SourceNodeId), (Joined | project NodeId = TargetNodeId)
|            | summarize by NodeId;
|        // the path's nodes -- the name and label the graph shows, the graph's own risk factors, and the CI key (the id the CI
|        // links -- Defender device id, Azure resource id, Entra object id -- else the node id). No tier is read from the graph.
|        let Nodes =
|            ExposureGraphNodes
|            | where NodeId in (EnrichIds)
|            | extend _ids = tostring(EntityIds)
|            | extend NodeCiKey = tolower(coalesce(
|                extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids),
|                extract('"type":"AzureResourceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AzureResourceId"', 1, _ids),
|                extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids),
|                tostring(NodeId)))
|            | extend NodeNameNorm = coalesce(NodeName, tostring(EntityIds[0].id), tostring(NodeId))
|            | extend RawData = todynamic(NodeProperties).rawData
|            | extend RiskFactorsArray = todynamic(coalesce(RawData.risk.riskFactors, NodeProperties.risk.riskFactors, dynamic([])))
|            | extend RiskFactorsArray = iff(isnull(RiskFactorsArray), dynamic([]), RiskFactorsArray)
|            | mv-apply rf = RiskFactorsArray on (
|                where isnotempty(trim(" ", tostring(rf)))
|                | summarize RiskFactorSet = make_set(tostring(rf))
|            )
|            | extend RiskFactorSet = coalesce(RiskFactorSet, dynamic([]))
|            | project NodeId, NodeCiKey, NodeName = NodeNameNorm, NodeLabel, RiskFactorSet;
|        let Paths =
|            Joined
|            | join kind=leftouter (Nodes | project SourceNodeId = NodeId, SourceNodeCiKey = NodeCiKey, SourceName = NodeName, SourceLabel = NodeLabel) on SourceNodeId
|            | join kind=leftouter (Nodes | project TargetNodeId = NodeId, TargetNodeCiKey = NodeCiKey, TargetName = NodeName, TargetLabel = NodeLabel, TargetRiskFactorSet = RiskFactorSet) on TargetNodeId
|            | project-away SourceNodeId1, TargetNodeId1
|            | extend PathKey = strcat(SourceNodeId, "->", TargetNodeId)
|            | extend RouteName = "User entitled to sign in to a Tier 0 server";
|        Paths
|        // both ends' CI -- the lookup _ciPeer on each end's own key, after the slice filter (the row's tier, CMDB values and
|        // asset risk factors are the TARGET's; the source's tier is SourceCriticalityTier)
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend SourceCiKey = iif(isnotempty(SourceNodeCiKey), SourceNodeCiKey, tolower(tostring(SourceNodeId)))
|        | extend TargetCiKey = iif(isnotempty(TargetNodeCiKey), TargetNodeCiKey, tolower(tostring(TargetNodeId)))
|        | join kind=leftouter (_ciPeer) on $left.SourceCiKey == $right._peerKey
|        | extend Source_si_ci_id = peer_ci_id, SourceCriticalityTier = peer_tier, Source_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | join kind=leftouter (_ciPeer) on $left.TargetCiKey == $right._peerKey
|        | extend Target_si_ci_id = peer_ci_id, TargetCriticalityTier = peer_tier, si_cmdb_id = peer_cmdb_id, si_cmdb_name = peer_cmdb_name, si_cmdb_criticality = peer_cmdb_criticality,
|                 si_cmdb_data_sensitivity = peer_cmdb_data_sensitivity, si_rf_p = peer_rf_p, si_rf_names_ = peer_rf_names, Target_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(Source_in_scope, true) and coalesce(Target_in_scope, true)
|        // the question -- the server is Tier 0 and the user is not (a user without a tier is not a known Tier 0 admin)
|        | where TargetCriticalityTier == 0
|        | where isnull(SourceCriticalityTier) or SourceCriticalityTier > 0
|        // the target's factors -- the graph's own risk factors and the CI's fed set, shown by the catalog names
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = array_length(TargetRiskFactorSet) + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        // the path's priority -- the target's tier and the tiers the path climbs (the attack-path bands of the severity model)
|        | extend TierEscalation = iff(isnotnull(SourceCriticalityTier) and isnotnull(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier, 0)
|        | extend LateralMovementType = case(
|            isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|            TierEscalation >= 3, "Privilege escalation large tier jump",
|            TierEscalation == 2, "Privilege escalation two tiers",
|            TierEscalation == 1, "Privilege escalation one tier",
|            "Direct access same tier")
|        | extend TargetTierWeight = case(TargetCriticalityTier == 0, 100, TargetCriticalityTier == 1, 60, TargetCriticalityTier == 2, 30, 10)
|        | extend AttackPathPriorityScore = TargetTierWeight + TierEscalation * 10
|        | extend AttackPathPriority = case(AttackPathPriorityScore >= 90, "Very High", AttackPathPriorityScore >= 60, "High", AttackPathPriorityScore >= 30, "Medium-High", AttackPathPriorityScore >= 15, "Medium", "Low")
|        // the tier is the TARGET's CI tier (what the path reaches) -- a target without a tier keeps an empty level
|        | extend CriticalityTier = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = tostring(AttackPathPriority)
|        | extend RiskFactor_Consequence = 0
|        | extend SecurityDomain = "Identity", Category = "Attack Paths", Subcategory = "SignInEntitlement"
|        | extend ConfigurationName = strcat(RouteName, " -- ", LateralMovementType)
|        | extend RiskFactor_Probability = TargetRiskProb
|        | extend RiskFactor_Probability_Detailed = TargetRiskProbDetailed
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        | extend AssetName = iif(isnotempty(tostring(SourceName)), tostring(SourceName), tostring(SourceNodeId))
|        | extend _assetId = iif(isnotempty(Source_si_ci_id), Source_si_ci_id, tostring(SourceNodeId))
|        | extend AssetType = tostring(SourceLabel)
|        | extend Impact = strcat(AssetName, " holds ", PathEdge, " on the Tier 0 server ", tostring(TargetName), iff(Direct == 1, " directly", ""), iff(ViaGroupCount > 0, strcat(iff(Direct == 1, " and", ""), " through ", tostring(ViaGroupCount), " group(s)"), ""), " but is ", iff(isnull(SourceCriticalityTier), "not tiered", strcat("tier ", tostring(SourceCriticalityTier))))
|        // one row per path -- the path names its graph node ids, so two paths never share a ConfigurationId
|        | extend ConfigurationId = PathKey
|        | extend AssetId = _assetId
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType, Impact,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight, SourceCriticalityTier
|        | order by RiskScore_Weight_Factor desc, RiskFactor_Probability desc, CriticalityTier asc, AssetName asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Summary_Owner_to_Privileged_Service_Principal
|      crossDomainBucketCoalesce:
|      - ClColumn: _ciKey
|        EgNativeKey: DeviceKey
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend OwnerCiKey = OwnerId
|          | project __siNeeded = pack_array(OwnerCiKey)
|      ReportPurpose: >-
|        Tier 0 and Tier 1 service principals owned by accounts on a less critical tier -- each owner can add a credential and sign in as the application. Both sides come from the CI (SI_CI_CL), the ownership from Entra.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  A lower-tier owner of a privileged application (the CI -- Entra ownership and the tiers)
|        // Step 1  owner -> application (ownership).  Step 2  the application's tier (its roles and permissions, CI).
|        // An owner can add a credential and sign in as the application. Sliced on the application.
|        // =================================================================================================
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|        _ciAsset
|        | where si_identity_type == "service_principal"
|        // the question -- a privileged application (its CI tier, Tier 0 or Tier 1)
|        | where si_tier in (0, 1)
|        // every owner of the application, wherever they own it (enterprise application, application registration or both)
|        | extend _owners = coalesce(todynamic(tostring(si_owners)), dynamic([]))
|        | mv-expand _ow = _owners to typeof(dynamic)
|        | extend OwnerId = tolower(tostring(_ow.id)), OwnerName = coalesce(tostring(_ow.upn), tostring(_ow.name), tostring(_ow.id)), OwnerOf = tostring(_ow["of"])
|        | where isnotempty(OwnerId)
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // the owner's CI -- the lookup _ciPeer on the owner's Entra object id, after the slice filter
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend OwnerCiKey = OwnerId
|        | join kind=leftouter (_ciPeer) on $left.OwnerCiKey == $right._peerKey
|        | extend Owner_si_ci_id = peer_ci_id, SourceCriticalityTier = peer_tier, OwnerFactorNames = coalesce(peer_rf_names, dynamic([])), Owner_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(Owner_in_scope, true)
|        // the question -- the owner is on a less critical tier than the application (an owner without a tier is not a known admin)
|        | where isnull(SourceCriticalityTier) or SourceCriticalityTier > si_tier
|        | extend TargetCriticalityTier = toint(si_tier), TargetRiskFactorSet = dynamic([])
|        | extend OwnerWhere = iff(tostring(_ow["of"]) == "application", "application registration", iff(tostring(_ow["of"]) == "service principal", "enterprise application", "enterprise application and application registration"))
|        // the target's factors -- the graph's own risk factors and the CI's fed set, shown by the catalog names
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = array_length(TargetRiskFactorSet) + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        // the path's priority -- the target's tier and the tiers the path climbs (the attack-path bands of the severity model)
|        | extend TierEscalation = iff(isnotnull(SourceCriticalityTier) and isnotnull(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier, 0)
|        | extend LateralMovementType = case(
|            isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|            TierEscalation >= 3, "Privilege escalation large tier jump",
|            TierEscalation == 2, "Privilege escalation two tiers",
|            TierEscalation == 1, "Privilege escalation one tier",
|            "Direct access same tier")
|        | extend TargetTierWeight = case(TargetCriticalityTier == 0, 100, TargetCriticalityTier == 1, 60, TargetCriticalityTier == 2, 30, 10)
|        | extend AttackPathPriorityScore = TargetTierWeight + TierEscalation * 10
|        | extend AttackPathPriority = case(AttackPathPriorityScore >= 90, "Very High", AttackPathPriorityScore >= 60, "High", AttackPathPriorityScore >= 30, "Medium-High", AttackPathPriorityScore >= 15, "Medium", "Low")
|        // the tier is the TARGET's CI tier (what the path reaches) -- a target without a tier keeps an empty level
|        | extend CriticalityTier = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = tostring(AttackPathPriority)
|        | extend RiskFactor_Consequence = 0
|        | extend SecurityDomain = "Identity", Category = "Attack Paths", Subcategory = "OwnerTakeover"
|        | extend ConfigurationName = strcat("Lower-tier owner of a privileged application -- ", LateralMovementType)
|        // the probability -- the application's factors and the OWNER's (an owner without MFA or with leaked credentials is the easier route)
|        | extend _ownerRf = OwnerFactorNames
|        | mv-apply _of = _ownerRf to typeof(string) on (where isnotempty(trim(" ", _of)) | summarize _ownerTokens = make_set(strcat("Owner", _of)))
|        | extend RiskFactor_Probability = TargetRiskProb + array_length(_ownerTokens)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(set_difference(array_concat(split(TargetRiskProbDetailed, ";"), _ownerTokens), dynamic([""]))), ";")
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        | project-away _ownerRf, _ownerTokens
|        | extend AssetName = coalesce(si_display_name, si_app_id, si_asset_name, si_ci_id)
|        | extend _assetId = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, si_identity_type, "Identity")
|        | extend ConfigurationId = "ATTACKPATH-OWNER-PRIVILEGED-APP"
|        | extend RouteImpact = "Owners of privileged applications can add a credential and sign in as them -- remove owners who are not administrators of the application's tier, or move the ownership to a Tier 0 / Tier 1 administration account"
|        | summarize
|            AssetCount             = dcount(DeviceKey),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            Impact                 = take_any(RouteImpact),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId                 = min(tostring(cmdbId)),
|            cmdbName               = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring("")),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(_assetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Attack_Paths_Detailed_Owner_to_Privileged_Service_Principal
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend OwnerCiKey = OwnerId
|          | project __siNeeded = pack_array(OwnerCiKey)
|      ReportPurpose: >-
|        Per row, an owner of a Tier 0 or Tier 1 service principal (enterprise application or its application registration) who is on a less critical tier than the application. An owner can add a credential to the application and sign in as it, so the owner's account is a route to the application's privileges. Step one is the ownership (Entra, from the CI), step two the application's own tier and privileges (CI). The row's asset is the application, its tier the application's; the owner's tier is SourceCriticalityTier.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // =================================================================================================
|        // REPORT  A lower-tier owner of a privileged application (the CI -- Entra ownership and the tiers)
|        // Step 1  owner -> application (ownership).  Step 2  the application's tier (its roles and permissions, CI).
|        // An owner can add a credential and sign in as the application. Sliced on the application.
|        // =================================================================================================
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|        _ciAsset
|        | where si_identity_type == "service_principal"
|        // the question -- a privileged application (its CI tier, Tier 0 or Tier 1)
|        | where si_tier in (0, 1)
|        // every owner of the application, wherever they own it (enterprise application, application registration or both)
|        | extend _owners = coalesce(todynamic(tostring(si_owners)), dynamic([]))
|        | mv-expand _ow = _owners to typeof(dynamic)
|        | extend OwnerId = tolower(tostring(_ow.id)), OwnerName = coalesce(tostring(_ow.upn), tostring(_ow.name), tostring(_ow.id)), OwnerOf = tostring(_ow["of"])
|        | where isnotempty(OwnerId)
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // the owner's CI -- the lookup _ciPeer on the owner's Entra object id, after the slice filter
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend OwnerCiKey = OwnerId
|        | join kind=leftouter (_ciPeer) on $left.OwnerCiKey == $right._peerKey
|        | extend Owner_si_ci_id = peer_ci_id, SourceCriticalityTier = peer_tier, OwnerFactorNames = coalesce(peer_rf_names, dynamic([])), Owner_in_scope = tobool(column_ifexists("peer_in_scope", bool(null)))
|        | project-away _peerKey, peer_*
|        | where coalesce(Owner_in_scope, true)
|        // the question -- the owner is on a less critical tier than the application (an owner without a tier is not a known admin)
|        | where isnull(SourceCriticalityTier) or SourceCriticalityTier > si_tier
|        | extend TargetCriticalityTier = toint(si_tier), TargetRiskFactorSet = dynamic([])
|        | extend OwnerWhere = iff(tostring(_ow["of"]) == "application", "application registration", iff(tostring(_ow["of"]) == "service principal", "enterprise application", "enterprise application and application registration"))
|        // the target's factors -- the graph's own risk factors and the CI's fed set, shown by the catalog names
|        | extend TargetRiskFactorSet = iff(isnull(TargetRiskFactorSet), dynamic([]), TargetRiskFactorSet)
|        | extend TargetFactorIds = coalesce(si_rf_p, dynamic([])), TargetFactorNames = coalesce(si_rf_names_, dynamic([]))
|        | extend _tgtRf = array_concat(TargetRiskFactorSet, TargetFactorNames)
|        | extend TargetRiskProb = array_length(TargetRiskFactorSet) + array_length(TargetFactorIds)
|        | extend TargetRiskProbDetailed = strcat_array(array_sort_asc(_tgtRf), ";")
|        | mv-apply _rf = _tgtRf to typeof(string) on (where isnotempty(trim(" ", _rf)) | summarize _tgtScore = make_set(strcat(_rf, "=1")))
|        | extend TargetRiskProbDetailedScore = strcat_array(array_sort_asc(_tgtScore), ";")
|        | project-away _tgtRf, _tgtScore
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        // the path's priority -- the target's tier and the tiers the path climbs (the attack-path bands of the severity model)
|        | extend TierEscalation = iff(isnotnull(SourceCriticalityTier) and isnotnull(TargetCriticalityTier) and SourceCriticalityTier > TargetCriticalityTier, SourceCriticalityTier - TargetCriticalityTier, 0)
|        | extend LateralMovementType = case(
|            isnull(SourceCriticalityTier) or isnull(TargetCriticalityTier), "Lateral movement, tier not known",
|            TierEscalation >= 3, "Privilege escalation large tier jump",
|            TierEscalation == 2, "Privilege escalation two tiers",
|            TierEscalation == 1, "Privilege escalation one tier",
|            "Direct access same tier")
|        | extend TargetTierWeight = case(TargetCriticalityTier == 0, 100, TargetCriticalityTier == 1, 60, TargetCriticalityTier == 2, 30, 10)
|        | extend AttackPathPriorityScore = TargetTierWeight + TierEscalation * 10
|        | extend AttackPathPriority = case(AttackPathPriorityScore >= 90, "Very High", AttackPathPriorityScore >= 60, "High", AttackPathPriorityScore >= 30, "Medium-High", AttackPathPriorityScore >= 15, "Medium", "Low")
|        // the tier is the TARGET's CI tier (what the path reaches) -- a target without a tier keeps an empty level
|        | extend CriticalityTier = toint(TargetCriticalityTier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = tostring(AttackPathPriority)
|        | extend RiskFactor_Consequence = 0
|        | extend SecurityDomain = "Identity", Category = "Attack Paths", Subcategory = "OwnerTakeover"
|        | extend ConfigurationName = strcat("Lower-tier owner of a privileged application -- ", LateralMovementType)
|        // the probability -- the application's factors and the OWNER's (an owner without MFA or with leaked credentials is the easier route)
|        | extend _ownerRf = OwnerFactorNames
|        | mv-apply _of = _ownerRf to typeof(string) on (where isnotempty(trim(" ", _of)) | summarize _ownerTokens = make_set(strcat("Owner", _of)))
|        | extend RiskFactor_Probability = TargetRiskProb + array_length(_ownerTokens)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_sort_asc(set_difference(array_concat(split(TargetRiskProbDetailed, ";"), _ownerTokens), dynamic([""]))), ";")
|        | extend RiskFactor_Probability_DetailedScore = TargetRiskProbDetailedScore
|        | project-away _ownerRf, _ownerTokens
|        | extend AssetName = coalesce(si_display_name, si_app_id, si_asset_name, si_ci_id)
|        | extend _assetId = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, si_identity_type, "Identity")
|        | extend Impact = strcat("Owned by ", OwnerName, " (", iff(isnull(SourceCriticalityTier), "not tiered", strcat("tier ", tostring(SourceCriticalityTier))), ", owner of the ", OwnerWhere, ") -- the owner can add a credential and sign in as this tier ", tostring(si_tier), " application")
|        // one row per owner and application
|        | extend ConfigurationId = strcat(OwnerId, "->", si_ci_id)
|        | extend AssetId = _assetId
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType, Impact,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactor_Probability_DetailedScore,
|            RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight, SourceCriticalityTier
|        | order by RiskScore_Weight_Factor desc, RiskFactor_Probability desc, CriticalityTier asc, AssetName asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_NoMFA_Summary
|      ReportPurpose: >
|        All enabled users with no MFA registration, across all tiers. Excludes accounts created within the last 7 days. Severity scales with tier.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_NoMFA_Summary
|        // Purpose  Enabled users without MFA registration, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type == "user"
|        // #690 (27) -- a user whose MFA registration was not read is LISTED and labelled by its cause, not readable from Entra (ConfigurationName), never dropped
|        | extend _mfaUnknown = isnull(si_mfa_registered) or coalesce(set_has_element(si_unknown_fields, "si_mfa_registered"), false)
|        | where si_mfa_registered == false or _mfaUnknown
|        | where coalesce(si_is_external, false) == false
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | where isnull(CreatedDays) or CreatedDays > 7
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = case(CriticalityTier == 0, "Very High", CriticalityTier == 1, "High", CriticalityTier == 2, "Medium", "Low")
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Authentication"
|        | extend Subcategory       = "MFA Registration"
|        | extend ConfigurationName = iff(_mfaUnknown, "User MFA registration not readable from Entra", "User missing MFA registration")
|        | extend ConfigurationId   = "IDENTITY-MFA-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_StaleUser_NoLogin180Days_Summary
|      ReportPurpose: >
|        Enabled user accounts with no interactive or non-interactive sign-in for 180+ days. Excludes guest/B2B accounts (handled separately). Stale privileged accounts are particularly dangerous as they may be forgotten but still retain active permissions.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_StaleUser_NoLogin180Days_Summary
|        // Purpose  Enabled member users with no sign-in for 180+ days, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_is_external, false) == false
|        | where not(si_external_user_state in ("Accepted", "PendingAcceptance"))
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        // #690 (27) -- an account whose last sign-in the CI could not decide is LISTED and labelled by its cause, no data source (ConfigurationName)
|        | where LastSignInDays > 180 or (LastSignInDays == -1 and CreatedDays > 180) or (isnull(LastSignInDays) and (isnull(CreatedDays) or CreatedDays > 180))
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Low"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Account Lifecycle"
|        | extend Subcategory       = "Stale Accounts"
|        | extend ConfigurationName = iff(isnull(LastSignInDays), "User account inactive for 180+ days - no data source for the last sign-in", "User account inactive for 180+ days")
|        | extend ConfigurationId   = "IDENTITY-STALE-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_StaleUser_NoLogin180Days_Detailed
|      ReportPurpose: >
|        Per-user detail for enabled accounts with no sign-in for 180+ days. Excludes guest/B2B. Includes last sign-in dates, role details, and tier.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_StaleUser_NoLogin180Days_Detailed
|        // Purpose  Enabled member users with no sign-in for 180+ days, one row per account, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_is_external, false) == false
|        | where not(si_external_user_state in ("Accepted", "PendingAcceptance"))
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        // #690 (27) -- an account whose last sign-in the CI could not decide is LISTED and labelled by its cause, no data source (ConfigurationName)
|        | where LastSignInDays > 180 or (LastSignInDays == -1 and CreatedDays > 180) or (isnull(LastSignInDays) and (isnull(CreatedDays) or CreatedDays > 180))
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Low"
|        | extend SecurityDomain     = "Identity"
|        | extend Category           = "Account Lifecycle"
|        | extend Subcategory        = "Stale Accounts"
|        | extend ConfigurationName  = iff(isnull(LastSignInDays), "User account inactive for 180+ days - no data source for the last sign-in", "User account inactive for 180+ days")
|        | extend ConfigurationId    = "IDENTITY-STALE-001"
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        // asset risk factors -- the CI's evaluation (data-model/risk-factors.locked.json), never this report's own
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_link_entra, Department = si_org_department,
|                  LastSignInDateTime = si_last_sign_in, LastSignInDays,
|                  CreatedDays, Tier = si_tier, IsPrivileged, EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, LastSignInDays desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_StaleGuest_NoLogin90Days_Summary
|      ReportPurpose: >
|        B2B guest/external collaborator accounts with no sign-in for 90+ days. Guests have a shorter stale threshold than internal users as they represent external access that should be regularly re-validated. Stale guest accounts are a common vector for supply chain and partner-related compromises.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_StaleGuest_NoLogin90Days_Summary
|        // Purpose  Enabled guest / external users with no sign-in for 90+ days, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where si_is_external == true or si_external_user_state in ("Accepted", "PendingAcceptance")
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        // #690 (27) -- a guest whose last sign-in the CI could not decide is LISTED and labelled by its cause, no data source (ConfigurationName)
|        | where LastSignInDays > 90 or (LastSignInDays == -1 and CreatedDays > 90) or (isnull(LastSignInDays) and (isnull(CreatedDays) or CreatedDays > 90))
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Low"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Account Lifecycle"
|        | extend Subcategory       = "Guest / External Access"
|        | extend ConfigurationName = iff(isnull(LastSignInDays), "Guest account inactive for 90+ days - no data source for the last sign-in", "Guest account inactive for 90+ days")
|        | extend ConfigurationId   = "IDENTITY-GUEST-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(si_display_name, " (", tostring(split(si_upn, '@')[1]), ")"))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(strcat(si_display_name, " (", tostring(split(si_upn, '@')[1]), ")"), "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedSPN_NoLogin180Days_Summary
|      ReportPurpose: >
|        Service Principals and Managed Identities with Tier 0/1 permissions (high-privilege app roles or directory roles) that have not authenticated for 180+ days. Dormant privileged workload identities are attractive targets as they may retain permissions long after the business use case has ended.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_high_privilege_app_permissions = dynamic(["RoleManagement.ReadWrite.Directory", "AppRoleAssignment.ReadWrite.All", "Directory.ReadWrite.All", "Application.ReadWrite.All", "Application.ReadWrite.OwnedBy", "Group.ReadWrite.All", "GroupMember.ReadWrite.All", "User.ReadWrite.All", "UserAuthenticationMethod.ReadWrite.All", "Policy.ReadWrite.ConditionalAccess", "Policy.ReadWrite.AuthenticationMethod", "Domain.ReadWrite.All", "IdentityRiskyUser.ReadWrite.All", "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementRBAC.ReadWrite.All", "RoleEligibilitySchedule.ReadWrite.Directory", "RoleAssignmentSchedule.ReadWrite.Directory", "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup", "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup", "RoleManagementPolicy.ReadWrite.Directory", "RoleManagementPolicy.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureAD", "PrivilegedAccess.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureResources", "Mail.ReadWrite", "Mail.Send", "full_access_as_app", "EWS.AccessAsApp", "Files.ReadWrite.All", "Sites.FullControl.All", "Sites.ReadWrite.All", "Exchange.ManageAsApp"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedSPN_NoLogin180Days_Summary
|        // Purpose  Enabled service principals / managed identities with no sign-in for 180+ days, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | where LastSignInDays > 180 or (LastSignInDays == -1 and CreatedDays > 180)
|        // privileged (the name and purpose) -- a Tier 0 / 1 application permission (data-model list high_privilege_app_permissions), the privilege tier catalog's high-risk permission, a Tier 0 / 1 Entra role (permanent or eligible), or a Tier 0 / 1 CI
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend HighPermissions = set_intersect(_permsD, SI_List_high_privilege_app_permissions)
|        | extend HighPermissions = iff(array_length(HighPermissions) > 0, HighPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_high_privilege_app_permissions)))))
|        // #690 the Azure side of privileged -- an Owner, Contributor or User Access Administrator role at any Azure scope (si_azure_role_assignments, one item or a list)
|        | extend AzurePrivilegedRoles = coalesce(extract_all(@'"RoleName"\s*:\s*"(Owner|Contributor|User Access Administrator)"', tostring(si_azure_role_assignments)), dynamic([]))
|        | extend _privKnown = isnotnull(si_high_risk_permission_grant) or isnotnull(si_privilege_tier_permanent) or isnotnull(si_tier) or array_length(_permsD) > 0 or isnotempty(tostring(si_azure_role_assignments))
|        | extend _isPrivileged = array_length(HighPermissions) > 0 or si_high_risk_permission_grant == true or si_privilege_tier_permanent in (0, 1) or si_privilege_tier_eligible in (0, 1) or si_tier in (0, 1) or array_length(AzurePrivilegedRoles) > 0
|        // a workload whose permissions and tier SI could not read stays in, labelled -- never dropped as not privileged
|        | where _isPrivileged or not(_privKnown)
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Stale Privileged Workloads"
|        | extend ConfigurationName = "Privileged SPN/MI inactive for 180+ days"
|        | extend ConfigurationId   = "IDENTITY-SPN-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedSPN_NoLogin180Days_Detailed
|      ReportPurpose: >
|        Per-SPN/MI detail for privileged workloads inactive for 180+ days. Includes permission details, credential info, and owner status.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_high_privilege_app_permissions = dynamic(["RoleManagement.ReadWrite.Directory", "AppRoleAssignment.ReadWrite.All", "Directory.ReadWrite.All", "Application.ReadWrite.All", "Application.ReadWrite.OwnedBy", "Group.ReadWrite.All", "GroupMember.ReadWrite.All", "User.ReadWrite.All", "UserAuthenticationMethod.ReadWrite.All", "Policy.ReadWrite.ConditionalAccess", "Policy.ReadWrite.AuthenticationMethod", "Domain.ReadWrite.All", "IdentityRiskyUser.ReadWrite.All", "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementRBAC.ReadWrite.All", "RoleEligibilitySchedule.ReadWrite.Directory", "RoleAssignmentSchedule.ReadWrite.Directory", "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup", "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup", "RoleManagementPolicy.ReadWrite.Directory", "RoleManagementPolicy.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureAD", "PrivilegedAccess.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureResources", "Mail.ReadWrite", "Mail.Send", "full_access_as_app", "EWS.AccessAsApp", "Files.ReadWrite.All", "Sites.FullControl.All", "Sites.ReadWrite.All", "Exchange.ManageAsApp"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedSPN_NoLogin180Days_Detailed
|        // Purpose  Enabled service principals / managed identities with no sign-in for 180+ days, one row per identity, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | where LastSignInDays > 180 or (LastSignInDays == -1 and CreatedDays > 180)
|        // privileged (the name and purpose) -- a Tier 0 / 1 application permission (data-model list high_privilege_app_permissions), the privilege tier catalog's high-risk permission, a Tier 0 / 1 Entra role (permanent or eligible), or a Tier 0 / 1 CI
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend HighPermissions = set_intersect(_permsD, SI_List_high_privilege_app_permissions)
|        | extend HighPermissions = iff(array_length(HighPermissions) > 0, HighPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_high_privilege_app_permissions)))))
|        // #690 the Azure side of privileged -- an Owner, Contributor or User Access Administrator role at any Azure scope (si_azure_role_assignments, one item or a list)
|        | extend AzurePrivilegedRoles = coalesce(extract_all(@'"RoleName"\s*:\s*"(Owner|Contributor|User Access Administrator)"', tostring(si_azure_role_assignments)), dynamic([]))
|        | extend _privKnown = isnotnull(si_high_risk_permission_grant) or isnotnull(si_privilege_tier_permanent) or isnotnull(si_tier) or array_length(_permsD) > 0 or isnotempty(tostring(si_azure_role_assignments))
|        | extend _isPrivileged = array_length(HighPermissions) > 0 or si_high_risk_permission_grant == true or si_privilege_tier_permanent in (0, 1) or si_privilege_tier_eligible in (0, 1) or si_tier in (0, 1) or array_length(AzurePrivilegedRoles) > 0
|        // a workload whose permissions and tier SI could not read stays in, labelled -- never dropped as not privileged
|        | where _isPrivileged or not(_privKnown)
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        | extend SecurityDomain     = "Identity"
|        | extend Category           = "Workload Identities"
|        | extend Subcategory        = "Stale Privileged Workloads"
|        | extend ConfigurationName  = "Privileged SPN/MI inactive for 180+ days"
|        | extend ConfigurationId    = "IDENTITY-SPN-001"
|        | extend _why = array_concat(HighPermissions,
|            iff(si_privilege_tier_permanent in (0, 1), pack_array(strcat("Tier ", tostring(si_privilege_tier_permanent), " Entra role")), dynamic([])),
|            iff(si_privilege_tier_eligible in (0, 1), pack_array(strcat("eligible Tier ", tostring(si_privilege_tier_eligible), " Entra role")), dynamic([])),
|            iff(si_high_risk_permission_grant == true and array_length(HighPermissions) == 0, dynamic(["a high-risk application permission"]), dynamic([])),
|            iff(si_tier in (0, 1), pack_array(strcat("CI tier ", tostring(si_tier))), dynamic([])),
|            iff(array_length(AzurePrivilegedRoles) > 0, pack_array(strcat("Azure ", strcat_array(set_union(AzurePrivilegedRoles, dynamic([])), " / "))), dynamic([])))
|        | extend Impact = iff(not(_privKnown), "Privilege not readable -- SI could not read this workload's permissions, roles or tier", strcat("Privileged - ", strcat_array(_why, ", ")))
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        // asset risk factors -- the CI's evaluation (data-model/risk-factors.locked.json), never this report's own
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | extend si_fix_remediation = strcat("Confirm with the owner that ", coalesce(si_display_name, si_asset_name), " is still needed", iff(isempty(si_owner), " (no owner is recorded)", strcat(" (owner - ", si_owner, ")")), ". ", iff(isnull(si_last_sign_in), "No sign-in is recorded for it", strcat("Its last sign-in was ", format_datetime(si_last_sign_in, "yyyy-MM-dd"))), ". If it is not needed, remove its roles and permissions and disable it. If it is needed, keep only the roles and permissions it uses.", iff(isempty(si_attached_resource), "", strcat(" It is the managed identity of ", si_attached_resource, ".")))
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  Impact,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_link_entra, ObjectType = si_identity_type, ServicePrincipalType = si_sp_type,
|                  LastSignInDateTime = si_last_sign_in, LastSignInDays, CreatedDays, Tier = si_tier,
|                  EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent, CredentialExpiryDays = si_credential_expiry_days,
|                  IsOrphanSPN = si_is_orphan_sp, IsManagedIdentity, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor,
|                  si_owner, si_owner_upns, si_credentials, si_attached_resource, si_fix_remediation
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_ExpiringCredentials_Summary
|      ReportPurpose: >
|        Service Principals with client secrets or certificates that have expired or will expire within 30 days. Expired credentials cause service outages. Credentials expiring on privileged SPNs are especially urgent as emergency secret rotation under pressure increases risk of mistakes or insecure handling.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_ExpiringCredentials_Summary
|        // Purpose  Service principals / managed identities with expired or expiring credentials, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | where si_credential_expiry_days between (-3650 .. 30)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Credential Hygiene"
|        | extend ConfigurationName = "SPN with expired or expiring credentials"
|        | extend ConfigurationId   = "IDENTITY-SPN-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_Orphan_NoOwner_Summary
|      ReportPurpose: >
|        Service Principals with no registered owner. Ownerless SPNs have no accountability for credential rotation, permission review, or decommissioning. Privileged orphaned SPNs are critical: no one is responsible for monitoring or revoking access.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_Orphan_NoOwner_Summary
|        // Purpose  Service principals with no registered owner, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type == "service_principal"
|        | where si_is_orphan_sp == true
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Low"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Orphaned Applications"
|        | extend ConfigurationName = "Service principal with no registered owner"
|        | extend ConfigurationId   = "IDENTITY-SPN-003"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PermanentPrivilegedRole_Summary
|      ReportPurpose: >
|        Privileged users with permanent (non-PIM) role assignments. Best practice requires all Tier 0/1 roles to be assigned via PIM (just-in-time) to reduce the standing attack surface. Permanent assignments mean the role is always active, even when not in use, providing a persistent target for attackers.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PermanentPrivilegedRole_Summary
|        // Purpose  Enabled users with a permanent (not PIM) privileged Entra role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_privilege_tier_permanent, 99) <= 1
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "Just-In-Time Access"
|        | extend ConfigurationName = "Permanent privileged role assignment - PIM not used"
|        | extend ConfigurationId   = "IDENTITY-PIM-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_ShadowAdmin_Summary
|      ReportPurpose: >
|        Users classified as shadow admins: they hold Tier 0/1 AD group membership (e.g. Domain Admins inherited via group nesting) but have no visible Entra ID role assignments. These accounts exercise privileged AD access that may not be tracked by standard Entra ID governance tooling, creating a blind spot in access reviews and PIM coverage.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_ShadowAdmin_Summary -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | where si_identity_type in ("user", "guest")
|        // #690 (29) -- a shadow admin is read from the CI fields -- critical AD group membership (si_ad_critical_groups, from the
|        // Exposure Graph and Defender for Identity) and NO Entra role, permanent or eligible. The profile flag si_is_shadow_admin
|        // is still honoured, but it is never set for an AD-only account (no Entra record) -- exactly the shadow admins.
|        // A dictionary-shaped value (type + data) is read through .data, and a missing role list is no role
|        // (array_length of null is null, never 0).
|        | extend _critAdGroups = iff(gettype(si_ad_critical_groups) == "dictionary", si_ad_critical_groups.data, si_ad_critical_groups)
|        | extend _hasCritAdGroup = coalesce(array_length(_critAdGroups), 0) > 0
|        | extend _entraRoleCount = coalesce(array_length(si_entra_roles_permanent), 0) + coalesce(array_length(si_entra_roles_eligible), 0)
|        | where coalesce(si_is_shadow_admin, false) == true or (_hasCritAdGroup and _entraRoleCount == 0)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "Shadow Admins"
|        | extend ConfigurationName = "Shadow admin - privileged AD access not visible in Entra ID"
|        | extend ConfigurationId   = "IDENTITY-SHADOW-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PasswordNeverExpires_Privileged_Summary
|      ReportPurpose: >
|        Privileged accounts with password-never-expires flag set. While passwordless and MFA mitigate this, a non-expiring password on a privileged account means a compromised credential remains valid indefinitely. Combined with no MFA or stale sign-in, this represents a critical unmanaged risk.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PasswordNeverExpires_Privileged_Summary -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | where si_identity_type in ("user", "guest")
|        // an UNKNOWN never-expires flag (no source could read it, e.g. a synced account) is listed and labelled
|        // PasswordNeverExpiresNoDataSource (the cause), never dropped
|        | extend _pneUnknown = isnull(si_password_never_expires) or set_has_element(si_unknown_fields, "si_password_never_expires")
|        | where coalesce(si_password_never_expires, false) == true or _pneUnknown
|        | extend si_rf_names_ = iff(_pneUnknown, array_concat(coalesce(si_rf_names_, dynamic([])), dynamic(["PasswordNeverExpiresNoDataSource"])), si_rf_names_)
|        | where coalesce(si_passwordless_only, false) == false
|        // #690 (23) -- the purpose is PRIVILEGED accounts -- a Tier 0/1 Entra role (permanent or eligible) or membership of a
|        // critical Active Directory group (Domain Admins and the like, the usual home of a never-expiring password)
|        | where coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1 or coalesce(array_length(iff(gettype(si_ad_critical_groups) == "dictionary", si_ad_critical_groups.data, si_ad_critical_groups)), 0) > 0
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Password Policy"
|        | extend Subcategory       = "Password Never Expires"
|        | extend ConfigurationName = "Privileged account with password-never-expires"
|        | extend ConfigurationId   = "IDENTITY-PWD-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_MultiTenant_HighPermission_SPN_Summary
|      ReportPurpose: >
|        Multi-tenant service principals (accessible from external tenants) with Tier 0/1 permissions. Multi-tenant apps expose credentials and permissions to external party control. If a partner tenant is compromised, the SPN can be leveraged to attack your tenant with full privileges.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_directory_write_permissions = dynamic(["Directory.ReadWrite.All"]);
|        let SI_List_high_privilege_app_permissions = dynamic(["RoleManagement.ReadWrite.Directory", "AppRoleAssignment.ReadWrite.All", "Directory.ReadWrite.All", "Application.ReadWrite.All", "Application.ReadWrite.OwnedBy", "Group.ReadWrite.All", "GroupMember.ReadWrite.All", "User.ReadWrite.All", "UserAuthenticationMethod.ReadWrite.All", "Policy.ReadWrite.ConditionalAccess", "Policy.ReadWrite.AuthenticationMethod", "Domain.ReadWrite.All", "IdentityRiskyUser.ReadWrite.All", "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementRBAC.ReadWrite.All", "RoleEligibilitySchedule.ReadWrite.Directory", "RoleAssignmentSchedule.ReadWrite.Directory", "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup", "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup", "RoleManagementPolicy.ReadWrite.Directory", "RoleManagementPolicy.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureAD", "PrivilegedAccess.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureResources", "Mail.ReadWrite", "Mail.Send", "full_access_as_app", "EWS.AccessAsApp", "Files.ReadWrite.All", "Sites.FullControl.All", "Sites.ReadWrite.All", "Exchange.ManageAsApp"]);
|        let SI_List_microsoft_first_party_tenants = dynamic(["f8cdef31-a31e-4b4a-93e4-5f571e91255a", "72f988bf-86f1-41af-91ab-2d7cd011db47"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_MultiTenant_HighPermission_SPN_Summary
|        // Purpose  Third-party multi-tenant service principals, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type == "service_principal"
|        | extend _perms = tostring(si_app_permissions)
|        | extend IsMultiTenant = si_is_third_party_multitenant
|        | where IsMultiTenant == true
|        // high privilege (the purpose) -- a Tier 0 / 1 application permission (data-model list high_privilege_app_permissions), the privilege tier catalog's high-risk permission, or a Tier 0 / 1 Entra role
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend HighPermissions = set_intersect(_permsD, SI_List_high_privilege_app_permissions)
|        | extend HighPermissions = iff(array_length(HighPermissions) > 0, HighPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_high_privilege_app_permissions)))))
|        | extend _privKnown = isnotnull(si_high_risk_permission_grant) or isnotnull(si_privilege_tier_permanent) or array_length(_permsD) > 0
|        | extend _isPrivileged = array_length(HighPermissions) > 0 or si_high_risk_permission_grant == true or si_privilege_tier_permanent in (0, 1)
|        // a service principal whose permissions SI could not read stays in, labelled -- never dropped as not privileged
|        | where _isPrivileged or not(_privKnown)
|        // Microsoft's own applications are owned by another tenant but are not a partner's -- kept, labelled apart (a view filters them)
|        | extend _isMicrosoft = tolower(si_app_owner_org_id) in (SI_List_microsoft_first_party_tenants)
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RF_P_HasDirectoryWrite = iff(_perms has_any (SI_List_directory_write_permissions), 1, 0)
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors) + RF_P_HasDirectoryWrite
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            RF_P_CiFactorNames,
|            iff(RF_P_HasDirectoryWrite == 1, dynamic(["HasDirectoryWrite"]),     dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("HasDirectoryWrite=", tostring(RF_P_HasDirectoryWrite))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = iff(_isMicrosoft, "Multi-Tenant Exposure - Microsoft first-party application", "Multi-Tenant Exposure")
|        | extend ConfigurationName = "Multi-tenant SPN with high-privilege permissions"
|        | extend ConfigurationId   = "IDENTITY-SPN-004"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_ExternalUser_PrivilegedRole_Summary
|      ReportPurpose: >
|        External/B2B guest users with Tier 0/1 Entra ID roles. External identities should never hold privileged directory roles. Their accounts are governed by their home tenant's security posture which may be significantly lower than yours. A compromised partner account with Global Admin in your tenant is a catastrophic risk.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_ExternalUser_PrivilegedRole_Summary
|        // Purpose  Enabled guest / external users, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where si_is_external == true or si_external_user_state in ("Accepted", "PendingAcceptance")
|        // #690 (23) -- the purpose is an external user WITH a Tier 0/1 Entra role, permanent or eligible
|        | where coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "External Identity Risk"
|        | extend ConfigurationName = "External user with privileged Entra ID role"
|        | extend ConfigurationId   = "IDENTITY-EXT-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(si_display_name, " (", tostring(split(si_upn, '@')[1]), ")"))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(strcat(si_display_name, " (", tostring(split(si_upn, '@')[1]), ")"), "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedUser_StalePassword_Summary
|      ReportPurpose: >
|        Privileged accounts whose password has not been changed in over 365 days. Long-lived passwords increase the window of exploitation if credentials were exposed in a breach that was never detected. Applies to accounts where password authentication is still a factor (non-passwordless-only accounts).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedUser_StalePassword_Summary -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_passwordless_only, false) == false
|        // an UNKNOWN password age (no date from any source) is listed and labelled PasswordAgeNoDataSource (the cause), never dropped
|        | extend _pwAgeUnknown = isnull(PasswordLastChangedDays) and not(set_has_element(si_rf_p, "old_password"))
|        | where set_has_element(si_rf_p, "old_password") or _pwAgeUnknown
|        // the report's question is a privileged ROLE -- the identity's role tier (a Tier 0 / Tier 1 Entra role held
|        // permanently or eligible) decides, and the account's own tier still counts (never fewer rows than before)
|        | extend _roleTier = min_of(coalesce(si_privilege_tier_permanent, 99), coalesce(si_privilege_tier_eligible, 99))
|        | where _roleTier <= 1 or isnull(si_tier) or si_tier in (0, 1)
|        | extend CriticalityTier = toint(case(isnull(si_tier) and _roleTier > 3, int(null), isnull(si_tier), _roleTier, _roleTier > 3, toint(si_tier), min_of(_roleTier, toint(si_tier))))
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        | extend _pwOver730       = iff(PasswordLastChangedDays > 730, 1, 0)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = _pwOver730 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            iff(_pwOver730      == 1, dynamic(["PasswordOver730Days"]),    dynamic([])),
|            iff(_pwAgeUnknown, dynamic(["PasswordAgeNoDataSource"]), dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("PasswordOver730Days=", tostring(_pwOver730))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Password Policy"
|        | extend Subcategory       = "Stale Passwords"
|        | extend ConfigurationName = "Privileged user with password unchanged for 365+ days"
|        | extend ConfigurationId   = "IDENTITY-PWD-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_MailboxAccess_Summary
|      ReportPurpose: >
|        Service Principals with mailbox-level Microsoft Graph permissions (Mail.ReadWrite, Mail.Send, MailboxSettings.ReadWrite or equivalent). These permissions allow an app to read all email in the organisation or send as any user - a high-value target for data exfiltration and business email compromise (BEC). SPNs with mailbox access and no active usage are especially concerning.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_mail_access_permissions = dynamic(["Mail.Read", "Mail.ReadWrite", "Mail.Send", "Mail.ReadBasic", "Mail.ReadBasic.All", "Mail-Advanced.ReadWrite.All", "MailboxSettings.ReadWrite", "MailboxItem.Read.All", "MailboxItem.ImportExport.All", "MailboxFolder.Read.All", "MailboxFolder.ReadWrite.All", "Mailbox.Migration", "full_access_as_app", "EWS.AccessAsApp", "EWS.AccessAsUser.All"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_MailboxAccess_Summary
|        // Purpose  Enabled service principals / managed identities with organisation-wide mailbox permissions, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | extend _perms = tostring(si_app_permissions)
|        | extend IsMultiTenant = si_is_third_party_multitenant
|        // every mail / mailbox application permission (data-model list mail_access_permissions), matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MatchedPermissions = set_intersect(_permsD, SI_List_mail_access_permissions)
|        | extend MatchedPermissions = iff(array_length(MatchedPermissions) > 0, MatchedPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_mail_access_permissions)))))
|        | where array_length(MatchedPermissions) > 0
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Low"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier <= 1, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Overprivileged Applications"
|        | extend ConfigurationName = "SPN with organisation-wide mailbox access"
|        | extend ConfigurationId   = "IDENTITY-SPN-005"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_HighValueTarget_MDIRisk_Summary
|      ReportPurpose: >
|        Identities flagged by Microsoft Defender for Identity as high or critical risk, cross-referenced with our asset tier classification. MDI risk signals include observed lateral movement, credential exposure, anomalous behaviour, and UEBA scoring. When a Tier 0/1 identity has elevated MDI risk, it indicates an active or recent threat that requires immediate investigation.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_HighValueTarget_MDIRisk_Summary
|        // Purpose  Enabled users that Defender for Identity rates high risk or at risk, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where si_mdi_risk_state in ("high", "at_risk")
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Threat Intelligence"
|        | extend Subcategory       = "MDI Risk Signals"
|        | extend ConfigurationName = "Identity with elevated MDI risk score"
|        | extend ConfigurationId   = "IDENTITY-THREAT-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedUser_SignIn_NonTrustedLocation_Summary
|      ReportPurpose: >
|        Privileged users (Tier 0/1) who have successfully signed in from a network location that is NOT defined as a trusted named location in Conditional Access. Admin accounts should only authenticate from managed, trusted networks (corporate VPN, PAW networks, known office IPs). Sign-in from an untrusted location on a privileged account is a strong indicator of credential compromise, policy bypass, or an admin using personal devices/networks for privileged tasks. Severity: Very High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedUser_SignIn_NonTrustedLocation_Summary
|        // Purpose  Privileged users with successful sign-ins from a network location that is not a trusted named location
|        // (30 days), one row per user.
|        // The sign-ins come from Entra's sign-in events in advanced hunting (EntraIdSignInEvents, interactive and
|        // non-interactive) -- SigninLogs is only in a workspace that receives Entra's diagnostic export, and where the
|        // install's workspace has none the report was silently empty (#690 (45)). A privileged user is an account Defender
|        // for Identity lists with an Entra role (AssignedRoles, or a PIM role), or a CI with a permanent privileged role or
|        // tier 0 / 1. Tier, CMDB values and factors come from the CI (_ciLink), joined on the Entra object id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        let _roleHolders =
|            IdentityInfo
|            | where Timestamp > ago(14d)
|            | where isnotempty(AccountObjectId)
|            | summarize arg_max(Timestamp, *) by AccountObjectId
|            | where Type == "User"
|            | extend HasEntraRole = coalesce(array_length(AssignedRoles), 0) > 0 or coalesce(array_length(bag_keys(PrivilegedEntraPimRoles)), 0) > 0
|            | extend RoleHolderKey = tolower(AccountObjectId)
|            | where isnotempty(RoleHolderKey)
|            | project RoleHolderKey, HasEntraRole;
|        EntraIdSignInEvents
|        | where Timestamp > ago(30d)
|        | where ErrorCode == 0
|        | extend UserKey = tolower(AccountObjectId)
|        | where isnotempty(UserKey)
|        // one row per sign-in, also when its location list is empty (mv-expand drops such a sign-in -- the untrusted case
|        // itself) -- a sign-in is from a trusted location when ANY of its locations is a trusted named location
|        | extend IsTrusted = iff(tostring(NetworkLocationDetails) has "trustedNamedLocation", 1, 0)
|        | where IsTrusted == 0
|        | summarize
|            NonTrustedSigninCount = count(),
|            LastNonTrustedSignin  = max(Timestamp),
|            UniqueIPs             = dcount(IPAddress),
|            SampleIPs             = strcat_array(make_set(IPAddress, 5), ";"),
|            Countries             = strcat_array(make_set(Country, 5), ";"),
|            SignInUpn             = tolower(take_any(AccountUpn)),
|            SignInDisplayName     = take_any(AccountDisplayName)
|          by UserKey
|        | join kind=leftouter _roleHolders on $left.UserKey == $right.RoleHolderKey
|        | extend DeviceKey = UserKey
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | where coalesce(si_in_scope_, true)
|        | extend HasPermanentPrivilegedRole = set_has_element(coalesce(si_rf_p, dynamic([])), "permanent_privileged_role")
|        | where coalesce(HasEntraRole, false) or HasPermanentPrivilegedRole or toint(si_tier) in (0, 1)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        // sign-in behaviour -- this report's own
|        | extend RF_P_Frequent       = iff(NonTrustedSigninCount > 5, 1, 0)
|        | extend RF_P_MultipleIPs    = iff(UniqueIPs > 3, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_Frequent + RF_P_MultipleIPs + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["NonTrustedLocationSignin"]),
|            iff(RF_P_Frequent    == 1, dynamic(["FrequentNonTrusted5plus"]),dynamic([])),
|            iff(RF_P_MultipleIPs == 1, dynamic(["MultipleUniqueIPs"]),      dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("NonTrustedLocationSignin=1;FrequentNonTrusted5plus=", tostring(RF_P_Frequent),
|                   ";MultipleUniqueIPs=", tostring(RF_P_MultipleIPs))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Sign-in Behaviour"
|        | extend Subcategory       = "Location Anomalies"
|        | extend ConfigurationName = "Privileged user signed in from non-trusted network location"
|        | extend ConfigurationId   = "IDENTITY-SIGNIN-001"
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, UserKey)
|        | extend AssetName = coalesce(si_asset_name, SignInDisplayName, SignInUpn, AssetId)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(AssetId),
|            TotalIssues            = sum(NonTrustedSigninCount),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", AssetId)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(UserKey),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(AssetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedUser_SignIn_NonTrustedLocation_Detailed
|      ReportPurpose: >
|        Per-user detail: privileged accounts with non-trusted location sign-ins. Shows sign-in count, IPs, countries, and last occurrence.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedUser_SignIn_NonTrustedLocation_Detailed
|        // Purpose  Privileged users with successful sign-ins from a network location that is not a trusted named location
|        // (30 days), one row per user.
|        // The sign-ins come from Entra's sign-in events in advanced hunting (EntraIdSignInEvents, interactive and
|        // non-interactive) -- SigninLogs is only in a workspace that receives Entra's diagnostic export, and where the
|        // install's workspace has none the report was silently empty (#690 (45)). A privileged user is an account Defender
|        // for Identity lists with an Entra role (AssignedRoles, or a PIM role), or a CI with a permanent privileged role or
|        // tier 0 / 1. Tier, CMDB values and factors come from the CI (_ciLink), joined on the Entra object id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        let _roleHolders =
|            IdentityInfo
|            | where Timestamp > ago(14d)
|            | where isnotempty(AccountObjectId)
|            | summarize arg_max(Timestamp, *) by AccountObjectId
|            | where Type == "User"
|            | extend HasEntraRole = coalesce(array_length(AssignedRoles), 0) > 0 or coalesce(array_length(bag_keys(PrivilegedEntraPimRoles)), 0) > 0
|            | extend RoleHolderKey = tolower(AccountObjectId)
|            | where isnotempty(RoleHolderKey)
|            | project RoleHolderKey, HasEntraRole;
|        EntraIdSignInEvents
|        | where Timestamp > ago(30d)
|        | where ErrorCode == 0
|        | extend UserKey = tolower(AccountObjectId)
|        | where isnotempty(UserKey)
|        // one row per sign-in, also when its location list is empty (mv-expand drops such a sign-in -- the untrusted case
|        // itself) -- a sign-in is from a trusted location when ANY of its locations is a trusted named location
|        | extend IsTrusted = iff(tostring(NetworkLocationDetails) has "trustedNamedLocation", 1, 0)
|        | where IsTrusted == 0
|        | summarize
|            NonTrustedSigninCount = count(),
|            LastNonTrustedSignin  = max(Timestamp),
|            UniqueIPs             = dcount(IPAddress),
|            SampleIPs             = strcat_array(make_set(IPAddress, 5), ";"),
|            Countries             = strcat_array(make_set(Country, 10), ";"),
|            SignInUpn             = tolower(take_any(AccountUpn)),
|            SignInDisplayName     = take_any(AccountDisplayName)
|          by UserKey
|        | join kind=leftouter _roleHolders on $left.UserKey == $right.RoleHolderKey
|        | extend DeviceKey = UserKey
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | where coalesce(si_in_scope_, true)
|        | extend HasPermanentPrivilegedRole = set_has_element(coalesce(si_rf_p, dynamic([])), "permanent_privileged_role")
|        | where coalesce(HasEntraRole, false) or HasPermanentPrivilegedRole or toint(si_tier) in (0, 1)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity      = "High"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Sign-in Behaviour"
|        | extend Subcategory           = "Location Anomalies"
|        | extend ConfigurationName     = "Privileged user signed in from non-trusted network location"
|        | extend ConfigurationId       = "IDENTITY-SIGNIN-001"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RF_P_Frequent       = iff(NonTrustedSigninCount > 5, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_Frequent + array_length(RF_P_CiFactors)
|        | extend AssetName = coalesce(si_asset_name, SignInDisplayName, SignInUpn, UserKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, UserKey)
|        | extend AssetType = "Identity"
|        // MFA as the CI's no_mfa factor says it (the link block carries the factors, not the field) -- unknown otherwise
|        | extend DisplayName = SignInDisplayName, Upn = SignInUpn, PrimaryEntityId = AssetId, Tier = si_tier, MfaIsRegistered = iff(set_has_element(RF_P_CiFactors, "no_mfa"), false, bool(null))
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  DisplayName, Upn, PrimaryEntityId, Tier, MfaIsRegistered, HasPermanentPrivilegedRole,
|                  NonTrustedSigninCount, LastNonTrustedSignin, UniqueIPs, SampleIPs, Countries,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, NonTrustedSigninCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_ServiceAccount_SignIn_NonTrustedLocation_Summary
|      ReportPurpose: >
|        Accounts classified as service accounts by MDI (MDI_IsServiceAccount = true) that have successfully authenticated from non-trusted network locations. Service accounts are expected to authenticate exclusively from known, trusted infrastructure (application servers, automation agents). Authentication from an untrusted location strongly suggests the service account credentials have been harvested and are being used by a threat actor. Severity: High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_ServiceAccount_SignIn_NonTrustedLocation_Summary -- the service accounts come from the CI (SI_CI_CL), REQUIREMENTS #505; their sign-ins join on the Entra object id.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        let ServiceAccounts =
|            _ciAsset
|            | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|            | where si_identity_type in ("user", "guest")
|            | where coalesce(si_is_service_account, false) == true
|            | extend CriticalityTier = toint(si_tier)
|            | extend EntraId = tolower(si_link_entra)
|            | project EntraId, DisplayName = coalesce(si_display_name, si_upn, si_asset_name), si_ci_id, si_rf_p,
|                      si_cmdb_id, si_cmdb_name, si_cmdb_criticality, si_cmdb_data_sensitivity, si_asset_type, si_link_entra,
|                      CriticalityTier, IsPrivileged;
|
|        let NonTrustedSignins =
|            union isfuzzy=true SigninLogs, AADNonInteractiveUserSignInLogs
|            | where TimeGenerated >= ago(90d)
|            | where ResultType == 0
|            | extend EntraId = tolower(tostring(UserId))
|            | where isnotempty(EntraId)
|            // one row per sign-in, also when its location list is empty (mv-expand drops such a sign-in -- the untrusted case
|            // itself) -- a sign-in is from a trusted location when ANY of its locations is a trusted named location
|            | extend IsTrusted = iff(tostring(NetworkLocationDetails) has "trustedNamedLocation", 1, 0)
|            | where IsTrusted == 0
|            | summarize
|                NonTrustedSigninCount = count(),
|                LastNonTrustedSignin  = max(TimeGenerated),
|                UniqueIPs             = dcount(IPAddress),
|                SampleIPs             = strcat_array(make_set(IPAddress, 5), ";"),
|                Countries             = strcat_array(make_set(Location, 10), ";")
|              by EntraId;
|
|        ServiceAccounts
|        | join kind=inner NonTrustedSignins on EntraId
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity    = "High"
|        | extend RF_P_Frequent       = iff(NonTrustedSigninCount > 3, 1, 0)
|        | extend RF_P_MultiCountry   = iff(array_length(split(Countries, ";")) > 1, 1, 0)
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = 1 + RF_P_Frequent + RF_P_MultiCountry
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["NonTrustedLocationSignin"]),
|            iff(RF_P_Frequent     == 1, dynamic(["FrequentNonTrusted3plus"]), dynamic([])),
|            iff(RF_P_MultiCountry == 1, dynamic(["MultipleCountries"]),       dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("NonTrustedLocationSignin=1;FrequentNonTrusted3plus=", tostring(RF_P_Frequent),
|                   ";MultipleCountries=", tostring(RF_P_MultiCountry))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Sign-in Behaviour"
|        | extend Subcategory       = "Location Anomalies"
|        | extend ConfigurationName = "Service account authenticated from non-trusted network location"
|        | extend ConfigurationId   = "IDENTITY-SIGNIN-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = DisplayName
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = sum(NonTrustedSigninCount),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            AssetId                = min(si_ci_id)
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_BreakGlass_SignIn_Detected_Summary
|      ReportPurpose: >
|        Any successful sign-in by an account flagged as a break-glass emergency account. Break-glass accounts are only valid for use during genuine catastrophic failures where normal admin access is unavailable. Every sign-in by a break-glass account must be investigated to confirm it was authorised and justified. This is an operational alert that should trigger an immediate review process. Severity: Very High (fixed)  --  all break-glass usage is critical regardless of context.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_BreakGlass_SignIn_Detected_Summary
|        // Purpose  Successful sign-ins by an emergency-access (break-glass) account in the last 30 days.
|        // The accounts come from the CI (si_is_break_glass, REQUIREMENTS #505), the sign-ins from SigninLogs (provider),
|        // joined on the Entra object id (SigninLogs UserId), never on the UPN.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        // #690 (23) -- the sign-ins themselves (interactive and non-interactive, successful, 30 days) where the tenant sends them to
|        // the workspace. A sign-in with no named location is NOT trusted -- tested on the text, so an empty location list never drops it.
|        let _bgSignIns =
|            union isfuzzy=true (datatable(UserId:string, ResultType:string, TimeGenerated:datetime, IPAddress:string, Location:string, NetworkLocationDetails:string)[]), SigninLogs, AADNonInteractiveUserSignInLogs
|            | where TimeGenerated >= ago(30d)
|            | where tostring(ResultType) == "0"
|            | extend UserKey = tolower(tostring(UserId))
|            | where isnotempty(UserKey)
|            | extend IsTrusted = iff(tostring(NetworkLocationDetails) has "trustedNamedLocation", 1, 0)
|            | summarize SigninCount = count(), LastSignin = max(TimeGenerated),
|                        SigninCountries = strcat_array(make_set(Location, 5), ", "), SigninIPs = strcat_array(make_set(IPAddress, 5), ", "),
|                        NonTrustedSignins = countif(IsTrusted == 0)
|              by UserKey;
|        _ciAsset
|        | where si_is_break_glass == true
|        // #690 (23) -- the purpose is a break-glass account that SIGNED IN -- a sign-in in the last 30 days, from the sign-in logs, or
|        // from the account's own last sign-in (si_last_sign_in, Entra and Active Directory) when the logs do not hold it
|        | extend UserKey = tolower(si_link_entra)
|        | join kind=leftouter _bgSignIns on UserKey
|        | extend _lastSignInKnown = iff(coalesce(set_has_element(si_unknown_fields, "si_last_sign_in"), false), datetime(null), si_last_sign_in)
|        | where isnotnull(LastSignin) or (isnotnull(_lastSignInKnown) and _lastSignInKnown >= ago(30d))
|        | extend SignInEvidence = iff(isnotnull(LastSignin),
|            strcat(tostring(SigninCount), " successful sign-in(s) in 30 days, last ", format_datetime(LastSignin, "yyyy-MM-dd HH:mm"), " UTC",
|                   iff(isnotempty(SigninIPs), strcat(" from ", SigninIPs), ""), iff(isnotempty(SigninCountries), strcat(" (", SigninCountries, ")"), ""),
|                   iff(NonTrustedSignins > 0, strcat(", ", tostring(NonTrustedSignins), " from a location that is not trusted"), "")),
|            strcat("Last sign-in ", format_datetime(_lastSignInKnown, "yyyy-MM-dd HH:mm"), " UTC (the account's last sign-in in Entra or Active Directory)"))
|        | extend LastSignin = coalesce(LastSignin, _lastSignInKnown), SigninCount = coalesce(SigninCount, 1), NonTrustedSignins = coalesce(NonTrustedSignins, 0)
|        | extend CriticalityTier      = 0
|        | extend CriticalityTierLevel = "Critical - tier 0"
|        | extend SecuritySeverity = "Very High"
|        | extend RF_P_NonTrusted      = iff(NonTrustedSignins > 0, 1, 0)
|        | extend RF_P_MultipleSignins = iff(SigninCount > 1, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_NonTrusted + RF_P_MultipleSignins
|        | extend RiskFactor_Consequence_Detailed = "LastResortAccessLoss;EmergencyRecoveryCompromise;TenantTakeoverPotential"
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["BreakGlassSignInDetected"]),
|            iff(RF_P_NonTrusted      == 1, dynamic(["SignedInFromNonTrustedLocation"]),dynamic([])),
|            iff(RF_P_MultipleSignins == 1, dynamic(["MultipleSignins"]),               dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("BreakGlassSignInDetected=1;SignedInFromNonTrustedLocation=", tostring(RF_P_NonTrusted),
|                   ";MultipleSignins=", tostring(RF_P_MultipleSignins))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Sign-in Behaviour"
|        | extend Subcategory       = "Break-Glass Usage"
|        | extend ConfigurationName = "Break-glass emergency account sign-in detected - immediate review required"
|        | extend ConfigurationId   = "IDENTITY-SIGNIN-008"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend DisplayName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = sum(SigninCount),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(DisplayName, " [", tostring(LastSignin), "]"))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(DisplayName, " [", tostring(LastSignin), "]", "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            RiskFactor_Consequence_Detailed = any(RiskFactor_Consequence_Detailed),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring("")),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_security_domain <- SecurityDomain
|        // si si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal, si_weighted_risk_score <- RiskScoreTotal_Weighted
|        // si si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category, si_subcategory <- Subcategory
|        // si si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_RoleManagementWrite_Summary
|      ReportPurpose: >
|        Service Principals with the RoleManagement.ReadWrite.Directory Graph permission. This permission allows the SPN to assign ANY Entra ID role to ANY principal, including Global Administrator. A compromised SPN with this permission can immediately elevate any account to full tenant administrator  --  the equivalent of a skeleton key to the entire Entra ID tenant. This is arguably the most dangerous single Graph permission that exists. Severity: Very High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_role_management_write_permissions = dynamic(["RoleManagement.ReadWrite.Directory"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_RoleManagementWrite_Summary
|        // Purpose  Enabled service principals that can assign any Entra role (RoleManagement.ReadWrite.Directory), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | extend _perms = tostring(si_app_permissions)
|        | extend IsMultiTenant = si_is_third_party_multitenant
|        // the permissions this report is about, matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MatchedPermissions = set_intersect(_permsD, SI_List_role_management_write_permissions)
|        | extend MatchedPermissions = iff(array_length(MatchedPermissions) > 0, MatchedPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_role_management_write_permissions)))))
|        | where array_length(MatchedPermissions) > 0
|        // the tier is the CI's (its rules), never a constant -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier      = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "Very High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Consequence_Detailed = "DomainTakeoverPotential;AnyEntraRoleAssignable;GlobalAdminGrantable"
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["RoleManagementWritePermission"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("RoleManagementWritePermission=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privilege Escalation Paths"
|        | extend Subcategory       = "Role Assignment Abuse"
|        | extend ConfigurationName = "SPN with RoleManagement.ReadWrite.Directory - can grant Global Admin to any account"
|        | extend ConfigurationId   = "IDENTITY-ESCALATION-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            RiskFactor_Consequence_Detailed = any(RiskFactor_Consequence_Detailed),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_AppRoleAssignmentWrite_Summary
|      ReportPurpose: >
|        Service Principals with AppRoleAssignment.ReadWrite.All permission. This allows the SPN to grant any Graph application permission to any other SPN, including granting itself Global Admin-equivalent permissions such as RoleManagement.ReadWrite.Directory or Directory.ReadWrite.All. A compromised SPN with this permission can bootstrap full tenant takeover in two API calls: grant itself dangerous permissions, then use them. Severity: Very High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_app_role_assignment_write_permissions = dynamic(["AppRoleAssignment.ReadWrite.All"]);
|        let SI_List_directory_write_permissions = dynamic(["Directory.ReadWrite.All"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_AppRoleAssignmentWrite_Summary
|        // Purpose  Enabled service principals that can grant any Graph permission (AppRoleAssignment.ReadWrite.All), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | extend _perms = tostring(si_app_permissions)
|        | extend IsMultiTenant = si_is_third_party_multitenant
|        // the permissions this report is about (its own list only), matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MatchedPermissions = set_intersect(_permsD, SI_List_app_role_assignment_write_permissions)
|        | extend MatchedPermissions = iff(array_length(MatchedPermissions) > 0, MatchedPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_app_role_assignment_write_permissions)))))
|        | where array_length(MatchedPermissions) > 0
|        // the tier is the CI's (its rules), never a constant -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier      = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "Very High"
|        // asset risk factors -- the CI's evaluation (data-model/risk-factors.locked.json), never this report's own
|        | extend RF_P_AlsoHasDirectoryWrite = iff(_perms has_any (SI_List_directory_write_permissions), 1, 0)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_AlsoHasDirectoryWrite + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["AppRoleAssignmentWritePermission"]),
|            iff(RF_P_AlsoHasDirectoryWrite == 1, dynamic(["AlsoHasDirectoryWrite"]),  dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("AppRoleAssignmentWritePermission=1;AlsoHasDirectoryWrite=", tostring(RF_P_AlsoHasDirectoryWrite))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privilege Escalation Paths"
|        | extend Subcategory       = "Permission Escalation"
|        | extend ConfigurationName = "SPN with AppRoleAssignment.ReadWrite.All - can grant any Graph permission to any app"
|        | extend ConfigurationId   = "IDENTITY-ESCALATION-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_PrivilegedAccessWrite_Summary
|      ReportPurpose: >
|        Service Principals with a permission that writes Privileged Identity Management directly -- RoleEligibilitySchedule / RoleAssignmentSchedule .ReadWrite.Directory, PrivilegedEligibilitySchedule / PrivilegedAssignmentSchedule .ReadWrite.AzureADGroup, RoleManagementPolicy.ReadWrite.*, or the legacy PrivilegedAccess.ReadWrite.AzureAD / AzureADGroup / AzureResources. This allows the SPN to directly create, modify, or remove PIM role eligibility and assignment schedules. A compromised SPN with this permission can make any account permanently eligible for Global Administrator with no approval workflow, or remove existing PIM assignments to cover tracks. Severity: Very High (fixed)  --  direct PIM manipulation capability.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_pim_write_permissions = dynamic(["RoleEligibilitySchedule.ReadWrite.Directory", "RoleAssignmentSchedule.ReadWrite.Directory", "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup", "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup", "RoleManagementPolicy.ReadWrite.Directory", "RoleManagementPolicy.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureAD", "PrivilegedAccess.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureResources"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_PrivilegedAccessWrite_Summary
|        // Purpose  Enabled service principals that can create or change PIM assignments (PrivilegedAccess.ReadWrite), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | extend _perms = tostring(si_app_permissions)
|        | extend IsMultiTenant = si_is_third_party_multitenant
|        // every permission that writes PIM directly (data-model list pim_write_permissions -- the current schedule and policy permissions and the legacy PrivilegedAccess ones), matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MatchedPermissions = set_intersect(_permsD, SI_List_pim_write_permissions)
|        | extend MatchedPermissions = iff(array_length(MatchedPermissions) > 0, MatchedPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_pim_write_permissions)))))
|        | where array_length(MatchedPermissions) > 0
|        // the tier is the CI's (its rules), never a constant -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier      = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "Very High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["PIMManipulationPermission"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("PIMManipulationPermission=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privilege Escalation Paths"
|        | extend Subcategory       = "PIM Abuse"
|        | extend ConfigurationName = "SPN with PrivilegedAccess.ReadWrite - can create/modify PIM assignments directly"
|        | extend ConfigurationId   = "IDENTITY-ESCALATION-005"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_UnverifiedPublisher_HighPermission_Summary
|      ReportPurpose: >
|        Service Principals with Tier 0/1 permissions whose publisher has not been verified by Microsoft. Unverified publishers are anonymous  --  there is no accountability for the code running in your tenant. High-privilege unverified apps represent a supply chain risk: the app developer could push malicious updates, and there is no way to validate the publisher's identity or intent. Severity: High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_directory_write_permissions = dynamic(["Directory.ReadWrite.All"]);
|        let SI_List_microsoft_first_party_tenants = dynamic(["f8cdef31-a31e-4b4a-93e4-5f571e91255a", "72f988bf-86f1-41af-91ab-2d7cd011db47"]);
|        let SI_List_role_assignment_write_permissions = dynamic(["RoleManagement.ReadWrite.Directory", "AppRoleAssignment.ReadWrite.All"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_UnverifiedPublisher_HighPermission_Summary
|        // Purpose  Enabled service principals whose publisher is not verified, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type == "service_principal"
|        | where si_publisher_verified == false
|        // Microsoft's own apps are not a supply-chain risk (and are never "verified" -- Graph leaves them without a verified publisher)
|        | where not(si_app_owner_org_id in (SI_List_microsoft_first_party_tenants))
|        // Tier 0/1 high permission = an application permission or role the privilege tier catalog rates high risk, or a permanent Tier 0/1 role
|        | where si_high_risk_permission_grant == true or si_privilege_tier_permanent in (0, 1)
|        | extend _perms = tostring(si_app_permissions)
|        | extend IsMultiTenant = si_is_third_party_multitenant
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RF_P_HasRoleWrite = iff(_perms has_any (SI_List_role_assignment_write_permissions), 1, 0)
|        | extend RF_P_HasDirWrite = iff(_perms has_any (SI_List_directory_write_permissions), 1, 0)
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors) + RF_P_HasRoleWrite + RF_P_HasDirWrite
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["UnverifiedPublisher"]),
|            RF_P_CiFactorNames,
|            iff(RF_P_HasRoleWrite == 1, dynamic(["HasRoleWrite"]),        dynamic([])),
|            iff(RF_P_HasDirWrite  == 1, dynamic(["HasDirectoryWrite"]),   dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("UnverifiedPublisher=1;HasRoleWrite=", tostring(RF_P_HasRoleWrite), ";HasDirectoryWrite=", tostring(RF_P_HasDirWrite))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privilege Escalation Paths"
|        | extend Subcategory       = "Supply Chain Risk"
|        | extend ConfigurationName = "Unverified-publisher SPN with Tier 0/1 Graph permissions"
|        | extend ConfigurationId   = "IDENTITY-ESCALATION-006"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_NewAccount_ImmediateTier0Role_Summary
|      ReportPurpose: >
|        User accounts created within the last 24 hours that already have a Tier 0 Entra ID role assigned. In a healthy environment, newly created accounts go through a provisioning workflow and role assignments require approval. Immediate Tier 0 role on a brand-new account indicates either a provisioning process bypass, a compromised privileged account creating rogue admin accounts, or a misconfigured automation script with excessive initial permissions. Severity: Very High (fixed)  --  immediate Tier 0 access on new account.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_NewAccount_ImmediateTier0Role_Summary
|        // Purpose  Users created in the last 24 hours that are already tier 0, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        // a Tier 0 ROLE (permanent or eligible -- the identity's role tier), or an account SI rates Tier 0
|        | where si_privilege_tier_permanent == 0 or si_privilege_tier_eligible == 0 or si_tier == 0
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | where CreatedDays == 0
|        | extend CriticalityTier      = 0
|        | extend CriticalityTierLevel = "Critical - tier 0"
|        | extend SecuritySeverity = "Very High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RF_P_AlreadySignedIn = iff(LastSignInDays == 0, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors) + RF_P_AlreadySignedIn
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["ImmediateTier0OnNewAccount"]),
|            RF_P_CiFactorNames,
|            iff(RF_P_AlreadySignedIn == 1, dynamic(["AlreadySignedInToday"]),    dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("ImmediateTier0OnNewAccount=1;AlreadySignedInToday=", tostring(RF_P_AlreadySignedIn))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Identity Lifecycle"
|        | extend Subcategory       = "Provisioning Anomalies"
|        | extend ConfigurationName = "Account created < 24 hours ago already has Tier 0 role - possible rogue admin"
|        | extend ConfigurationId   = "IDENTITY-LIFECYCLE-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(si_display_name, " [Created:", tostring(si_created), "]"))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(strcat(si_display_name, " [Created:", tostring(si_created), "]"), "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_DisabledAccount_ActivePIMAssignment_Summary
|      ReportPurpose: >
|        Disabled user accounts that still have PIM eligible role assignments active. When an account is disabled (e.g. employee leaving), all role assignments should be removed as part of the offboarding process. An eligible assignment on a disabled account means the account could be re-enabled and immediately used to activate privileged access  --  a common post-compromise technique. Severity: High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_DisabledAccount_ActivePIMAssignment_Summary
|        // Purpose  Disabled users that still hold a privileged PIM-eligible role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where si_account_enabled == false
|        | where coalesce(si_privilege_tier_eligible, 99) <= 1
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium-High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RF_P_RecentlyDisabled = iff(LastSignInDays between (0 .. 30), 1, 0)
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors) + RF_P_RecentlyDisabled
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["DisabledAccountWithEligibleRole"]),
|            RF_P_CiFactorNames,
|            iff(RF_P_RecentlyDisabled == 1, dynamic(["RecentlyDisabled30days"]),  dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("DisabledAccountWithEligibleRole=1;RecentlyDisabled30days=", tostring(RF_P_RecentlyDisabled))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Identity Lifecycle"
|        | extend Subcategory       = "Offboarding Gaps"
|        | extend ConfigurationName = "Disabled account with active PIM eligible role assignment - offboarding incomplete"
|        | extend ConfigurationId   = "IDENTITY-LIFECYCLE-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_ServiceAccount_InteractiveSignIn_Summary
|      ReportPurpose: >
|        Accounts classified by MDI as service accounts (MDI_IsServiceAccount = true) that have interactive human sign-ins recorded in SigninLogs. Service accounts should authenticate exclusively via non-interactive flows (daemon credentials, managed identity, service principal). Interactive logins indicate the service account credentials are being used by a human  --  either a shared password problem, a developer using service credentials to bypass controls, or a threat actor who harvested the credentials and is performing hands-on-keyboard activity. Severity: High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_ServiceAccount_InteractiveSignIn_Summary -- the service accounts come from the CI (SI_CI_CL), REQUIREMENTS #505; their sign-ins join on the Entra object id.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        let ServiceAccounts =
|            _ciAsset
|            | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|            | where si_identity_type in ("user", "guest")
|            | where coalesce(si_is_service_account, false) == true
|            | extend CriticalityTier = toint(si_tier)
|            | extend EntraId = tolower(si_link_entra)
|            | project EntraId, DisplayName = coalesce(si_display_name, si_upn, si_asset_name), si_ci_id, si_rf_p,
|                      si_cmdb_id, si_cmdb_name, si_cmdb_criticality, si_cmdb_data_sensitivity, si_asset_type, si_link_entra,
|                      CriticalityTier, IsPrivileged;
|
|        let InteractiveSignins =
|            SigninLogs
|            | where TimeGenerated >= ago(90d)
|            | where ResultType == 0
|            | extend EntraId = tolower(tostring(UserId))
|            | where isnotempty(EntraId)
|            // one row per sign-in, also when its location list is empty (mv-expand drops such a sign-in -- the untrusted case
|            // itself) -- a sign-in is from a trusted location when ANY of its locations is a trusted named location
|            | extend IsTrusted = iff(tostring(NetworkLocationDetails) has "trustedNamedLocation", 1, 0)
|            | summarize
|                InteractiveSigninCount = count(),
|                LastInteractiveSignin  = max(TimeGenerated),
|                NonTrustedCount        = countif(IsTrusted == 0),
|                Countries              = strcat_array(make_set(Location, 5), ";"),
|                UniqueIPs              = dcount(IPAddress)
|              by EntraId;
|
|        ServiceAccounts
|        | join kind=inner InteractiveSignins on EntraId
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity    = "Medium-High"
|        | extend RF_P_NonTrusted     = iff(NonTrustedCount > 0, 1, 0)
|        | extend RF_P_Frequent       = iff(InteractiveSigninCount > 5, 1, 0)
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = 1 + RF_P_NonTrusted + RF_P_Frequent
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["ServiceAccountInteractiveLogin"]),
|            iff(RF_P_NonTrusted  == 1, dynamic(["FromNonTrustedLocation"]),      dynamic([])),
|            iff(RF_P_Frequent    == 1, dynamic(["FrequentInteractive5plus"]),    dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("ServiceAccountInteractiveLogin=1;FromNonTrustedLocation=", tostring(RF_P_NonTrusted),
|                   ";FrequentInteractive5plus=", tostring(RF_P_Frequent))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Identity Lifecycle"
|        | extend Subcategory       = "Service Account Misuse"
|        | extend ConfigurationName = "Service account has interactive sign-ins - credential shared or harvested"
|        | extend ConfigurationId   = "IDENTITY-LIFECYCLE-003"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = DisplayName
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = sum(InteractiveSigninCount),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            AssetId                = min(si_ci_id)
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_HighMDIInvestigationPriority_Summary
|      ReportPurpose: >
|        Active accounts with MDI Investigation Priority Percentile in the top 10% (MDI_InvestigationPriorityPct >= 90). MDI calculates this score based on observed anomalous behaviours, lateral movement signals, unusual access patterns, and UEBA risk scoring. A high investigation priority means MDI has observed behaviour that warrants review. When this is combined with a privileged identity, it represents a potentially active threat that requires immediate attention. Severity: High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_HighMDIInvestigationPriority_Summary -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_mdi_investigation_priority_pct, 0) >= 90
|        | where coalesce(si_mdi_investigation_priority_pct, 0) > 0
|
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|
|        | extend RF_P_Top5Pct           = iff(coalesce(si_mdi_investigation_priority_pct, 0) >= 95, 1, 0)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = 1 + RF_P_Top5Pct + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["HighMDIInvestigationPriority"]),
|            iff(RF_P_Top5Pct         == 1, dynamic(["Top5PercentileMDIScore"]), dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("HighMDIInvestigationPriority=1;Top5PercentileMDIScore=", tostring(RF_P_Top5Pct))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Threat Intelligence"
|        | extend Subcategory       = "MDI Behavioural Signals"
|        | extend ConfigurationName = strcat("High MDI investigation priority (top 10%) - anomalous behaviour observed")
|        | extend ConfigurationId   = "IDENTITY-LIFECYCLE-005"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(
|                strcat(AssetName, " [Score:", tostring(coalesce(si_mdi_investigation_priority_pct, 0)), "]"))), ";"),
|            ImpactedAssetPairs = make_set(strcat(strcat(AssetName, " [Score:", tostring(coalesce(si_mdi_investigation_priority_pct, 0)), "]"), "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_AdminAccount_OnPremSynced_Summary
|      ReportPurpose: >
|        Privileged admin accounts (Tier 0/1) that are synchronised from on-premises AD rather than being cloud-only. Admin accounts should be cloud-native to avoid on-prem compromise pivoting to cloud. A compromised AD environment (e.g. via ransomware) can directly take over cloud admin accounts that are synced from AD. Severity: Very High - on-prem sync of privileged accounts breaks cloud/AD separation.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_AdminAccount_OnPremSynced_Summary
|        // Purpose  Enabled users synchronised from on-premises AD, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where si_onprem_synced == true
|        // the report's question is a privileged ROLE -- the identity's role tier (a Tier 0 / Tier 1 Entra role held
|        // permanently or eligible) decides, and the account's own tier still counts (never fewer rows than before)
|        | extend _roleTier = min_of(coalesce(si_privilege_tier_permanent, 99), coalesce(si_privilege_tier_eligible, 99))
|        | where _roleTier <= 1 or isnull(si_tier) or si_tier in (0, 1)
|        | extend CriticalityTier = toint(case(isnull(si_tier) and _roleTier > 3, int(null), isnull(si_tier), _roleTier, _roleTier > 3, toint(si_tier), min_of(_roleTier, toint(si_tier))))
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["OnPremisesSyncEnabled"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("OnPremisesSyncEnabled=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Admin Account Hygiene"
|        | extend Subcategory       = "Cloud-AD Separation"
|        | extend ConfigurationName = "Privileged account synced from on-prem AD - cloud isolation broken"
|        | extend ConfigurationId   = "IDENTITY-ADMIN-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_AdminAccount_NeverUsed_Summary
|      ReportPurpose: >
|        Privileged accounts (Tier 0/1) created more than 14 days ago that have never signed in. Unused privileged accounts represent dormant attack surface - they hold permissions but have no operational owner actively monitoring them. Common cause: accounts created for a project that never started, or provisioned for a consultant who never onboarded. Severity: High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_AdminAccount_NeverUsed_Summary
|        // Purpose  Enabled users that never signed in after a 14-day grace period, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | where LastSignInDays == -1
|        | where CreatedDays > 14
|        // the report's question is a privileged ROLE -- the identity's role tier (a Tier 0 / Tier 1 Entra role held
|        // permanently or eligible) decides, and the account's own tier still counts (never fewer rows than before)
|        | extend _roleTier = min_of(coalesce(si_privilege_tier_permanent, 99), coalesce(si_privilege_tier_eligible, 99))
|        | where _roleTier <= 1 or isnull(si_tier) or si_tier in (0, 1)
|        | extend CriticalityTier = toint(case(isnull(si_tier) and _roleTier > 3, int(null), isnull(si_tier), _roleTier, _roleTier > 3, toint(si_tier), min_of(_roleTier, toint(si_tier))))
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["NeverSignedIn"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("NeverSignedIn=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Admin Account Hygiene"
|        | extend Subcategory       = "Unused Accounts"
|        | extend ConfigurationName = "Privileged account never signed in after 14-day grace period"
|        | extend ConfigurationId   = "IDENTITY-ADMIN-003"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_TooManyGlobalAdmins_Summary
|      ReportPurpose: >
|        Detects when the organisation has more than 5 active Global Administrator accounts. Microsoft recommends 2-5 Global Admins maximum. Each additional Global Admin increases the attack surface proportionally. Organisations with 10+ Global Admins typically have role assignment hygiene problems and lack a formal review process. Severity: High (fixed) - excessive Global Admin count is always a significant risk.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - UniqueIssues
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - IssueList
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_TooManyGlobalAdmins_Summary
|        // Purpose  More than 5 enabled users with a permanent Global Administrator role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // One tenant-level row; the CI decides which identities count.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        let GlobalAdmins =
|            _ciAsset
|            // #690 (23) -- every identity that holds Global Administrator -- active (permanent or time-bound) or eligible, directly or
|            // through a group (the role read resolves group and PIM-for-groups roles), users, guests and service principals
|            | where tostring(si_entra_roles_permanent) has "Global Administrator" or tostring(si_entra_roles_eligible) has "Global Administrator"
|            | extend DeviceKey = "tenant"
|            //__BUCKET_FILTER_BEGIN__
|            | where 1 == 1
|            //__BUCKET_FILTER_END__
|            | summarize
|                GACount        = dcount(si_ci_id),
|                ImpactedAssets = strcat_array(array_sort_asc(make_set(si_display_name)), ";"),
|                ImpactedAssetPairs = make_set(strcat(si_display_name, "|", si_ci_id));
|        GlobalAdmins
|        | where GACount > 5
|        | extend CriticalityTier      = 0
|        | extend CriticalityTierLevel = "Critical - tier 0"
|        | extend SecuritySeverity     = "Medium"
|        | extend RF_P_ExcessiveCount  = iff(GACount > 10, 2, 1)
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = RF_P_ExcessiveCount
|        | extend RiskFactor_Probability_Detailed =
|            iff(GACount > 10, "ExcessiveGlobalAdminCount_Critical", "ExcessiveGlobalAdminCount")
|        | extend RiskFactor_Probability_DetailedScore = strcat("GlobalAdminCount=", GACount)
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Admin Account Hygiene"
|        | extend Subcategory       = "Role Assignment Governance"
|        | extend ConfigurationName = "Excessive Global Administrator count - more than 5 active accounts"
|        | extend ConfigurationId   = "IDENTITY-ADMIN-004"
|        | extend AssetCount        = GACount
|        | extend TotalIssues       = GACount
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  RiskFactor_Consequence, RiskFactor_Probability,
|                  RiskFactor_Probability_Detailed, RiskFactor_Probability_DetailedScore,
|                  AssetCount, TotalIssues, ImpactedAssets, ImpactedAssetPairs
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, UniqueIssues, ImpactedAssetsList, ImpactedAssetIds, IssueList, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_security_domain <- SecurityDomain
|        // si si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal, si_weighted_risk_score <- RiskScoreTotal_Weighted
|        // si si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category, si_subcategory <- Subcategory
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_BreakGlass_Anomaly_Summary
|      ReportPurpose: >
|        Break-glass emergency access accounts with anomalous sign-in patterns. Detects two opposite problems: (1) Break-glass account used recently (< 30 days) WITHOUT an incident - possible misuse (2) Break-glass account has never been tested OR last test was > 180 days ago Break-glass accounts should only be used in genuine emergencies and tested periodically. Severity: Very High (fixed) - any break-glass anomaly is a critical governance failure.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_BreakGlass_Anomaly_Summary
|        // Purpose  Break-glass accounts used recently, never tested, or not tested for 180+ days, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where si_is_break_glass == true
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        // #690 (27) -- a break-glass account whose last sign-in the CI could not decide is LISTED as anomaly NoSignInDataSource (the cause), never dropped
|        | where LastSignInDays <= 30 or LastSignInDays > 180 or LastSignInDays == -1 or isnull(LastSignInDays)
|        | extend CriticalityTier      = 0
|        | extend CriticalityTierLevel = "Critical - tier 0"
|        | extend SecuritySeverity     = "High"
|        | extend AnomalyType =
|            case(isnull(LastSignInDays),                        "NoSignInDataSource",
|                 LastSignInDays >= 0 and LastSignInDays <= 30, "RecentUnexpectedUsage",
|                 LastSignInDays == -1,                          "NeverTested",
|                 "TestingOverdue")
|        // asset risk factors -- the CI's evaluation (data-model/risk-factors.locked.json), never this report's own
|        | extend RF_P_RecentUse    = iff(LastSignInDays >= 0 and LastSignInDays <= 30, 1, 0)
|        | extend RF_P_NeverTested  = iff(LastSignInDays == -1, 1, 0)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_RecentUse + RF_P_NeverTested + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["BreakGlassAnomaly"]),
|            iff(RF_P_RecentUse   == 1, dynamic(["RecentUnexpectedUsage"]), dynamic([])),
|            iff(RF_P_NeverTested == 1, dynamic(["NeverTested"]),           dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("BreakGlassAnomaly=1;RecentUnexpectedUsage=", tostring(RF_P_RecentUse),
|                   ";NeverTested=", tostring(RF_P_NeverTested))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Admin Account Hygiene"
|        | extend Subcategory       = "Break-Glass Governance"
|        | extend ConfigurationName = iff(AnomalyType == "NoSignInDataSource", "Break-glass account anomaly: no data source for the last sign-in", strcat("Break-glass account anomaly: ", AnomalyType))
|        | extend ConfigurationId   = "IDENTITY-ADMIN-005"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(si_display_name, " [", AnomalyType, "]"))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(strcat(si_display_name, " [", AnomalyType, "]"), "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PIM_EligibleNeverActivated_Summary
|      ReportPurpose: >
|        Users with PIM-eligible Tier 0/1 role assignments that have never been activated (no interactive sign-in with the role active). Eligible roles that are never used suggest the assignment is unnecessary and should be removed to reduce blast radius. This also applies to identities with eligible roles but no sign-in at all. Severity: Medium (fixed) - eligible roles are safer than permanent but unused assignments still represent unnecessary standing access that should be cleaned up.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PIM_EligibleNeverActivated_Summary
|        // Purpose  Enabled users with a privileged PIM eligible role and no sign-in for 180+ days, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where IsPrivilegedEligible == true
|        | where IsPrivileged == false or HasPermanentPrivilegedRole == false
|        | where LastSignInDays > 180 or LastSignInDays == -1
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 1
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "PIM Hygiene"
|        | extend ConfigurationName = "PIM eligible role never activated in 180+ days - unnecessary assignment"
|        | extend ConfigurationId   = "IDENTITY-PIM-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PIM_DuplicateRoleAssignment_Summary
|      ReportPurpose: >
|        Users who have the same Entra ID role assigned both permanently AND as PIM eligible. This is a misconfiguration: the permanent assignment makes the PIM eligible one redundant and indicates the PIM policy was not followed. The permanent assignment should be removed and only the PIM eligible retained. Severity: Medium-High (fixed) - redundant permanent assignment defeats PIM purpose.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PIM_DuplicateRoleAssignment_Summary
|        // Purpose  Enabled users holding the same privileged role permanently and through PIM, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        // the same role held both as an active assignment (permanent or time-bound -- every active assignment that is not a
|        // PIM activation, as Entra lists it) and as a PIM eligibility -- whatever the role's tier
|        | extend _rolesPermanent = iff(gettype(si_entra_roles_permanent) == "array", si_entra_roles_permanent, iff(isempty(tostring(si_entra_roles_permanent)), dynamic([]), pack_array(tostring(si_entra_roles_permanent))))
|        | extend _rolesEligible  = iff(gettype(si_entra_roles_eligible) == "array", si_entra_roles_eligible, iff(isempty(tostring(si_entra_roles_eligible)), dynamic([]), pack_array(tostring(si_entra_roles_eligible))))
|        | where array_length(set_intersect(_rolesPermanent, _rolesEligible)) > 0
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium-High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 1
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["DuplicateRoleAssignment"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("DuplicateRoleAssignment=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "PIM Hygiene"
|        | extend ConfigurationName = "Duplicate role assignment - permanent and eligible overlap for same role"
|        | extend ConfigurationId   = "IDENTITY-PIM-003"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_OverCredentialed_Summary
|      ReportPurpose: >
|        Service Principals that have both a client secret AND a certificate registered. Over-credentialed SPNs increase the credential attack surface - two different authentication paths must both be managed and rotated. Often indicates legacy credentials were not cleaned up when the SPN was migrated to certificate auth. Severity: Medium (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_OverCredentialed_Summary
|        // Purpose  Service principals with credentials expiring within 30 days or expired, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type == "service_principal"
|        // both kinds of credential registered (the purpose) -- every secret and certificate of the principal and of its application registration, in any state
|        | extend _creds = coalesce(todynamic(tostring(si_credentials)), dynamic([]))
|        | mv-apply _cr = _creds to typeof(dynamic) on (summarize SecretCount = countif(tostring(_cr.type) == "secret"), CertificateCount = countif(tostring(_cr.type) == "certificate"))
|        | where SecretCount > 0 and CertificateCount > 0
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 1
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["BothSecretAndCert"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("BothSecretAndCert=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Credential Hygiene"
|        | extend ConfigurationName = "SPN with both client secret and certificate - over-credentialed"
|        | extend ConfigurationId   = "IDENTITY-SPN-006"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_Admin_LogonTo_VulnerableDevice_Summary
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      ReportPurpose: >
|        Privileged users (permanent or PIM-eligible Tier 0/1 roles) who are observed authenticating to devices that have high or critical severity CVEs outstanding. When an admin logs on to a vulnerable device, their privileged token/credential is exposed on that device. An attacker who exploits the CVE could harvest the admin credential via memory dumps, token theft, or keylogging. Severity: Very High (fixed) - privileged credential exposure on vulnerable device.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_Admin_LogonTo_VulnerableDevice_Summary
|        // Purpose  Users that can authenticate to a device with High or Critical CVEs.
|        // The user-to-device "can authenticate to" edge is an Exposure Graph walk (provider, graph-only).
|        // Both ends take tier, CMDB values and asset risk factors from the CI (_ciLink, REQUIREMENTS #505), joined on
|        // the Entra object id (user) and the Defender device id (device) the graph nodes carry, else the node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let _devices =
|            ExposureGraphNodes
|            // a device node or a virtual-machine node (the graph ties "can authenticate to" to either)
|            | where NodeLabel in~ ("device", "microsoft.compute/virtualmachines")
|            | extend rawData          = todynamic(NodeProperties.rawData)
|            | extend HasHighCriticalCVE = tobool(rawData.highRiskVulnerabilityInsights.hasHighOrCritical)
|            | where HasHighCriticalCVE == true
|            | extend MaxCvssScore     = todouble(rawData.highRiskVulnerabilityInsights.maxCvssScore)
|            | extend DeviceRiskScore  = tostring(rawData.riskScore)
|            | extend DeviceName       = iff(isnotempty(tostring(rawData.deviceName)), tostring(rawData.deviceName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|            | project DeviceNodeId = NodeId, MdeDeviceId, DeviceName, MaxCvssScore, DeviceRiskScore;
|
|        let _users =
|            ExposureGraphNodes
|            | where NodeLabel == "user"
|            | extend rawData         = todynamic(NodeProperties.rawData)
|            // the graph's user node holds the sign-in name as accountUpn (SI's own eg mapping of si_upn) and the name as
|            // accountDisplayName -- an account without a sign-in name (a gMSA, a sync account) is kept, its UPN empty
|            | extend UserUPN         = tolower(tostring(rawData.accountUpn))
|            | extend UserDisplayName = iff(isnotempty(tostring(rawData.accountDisplayName)), tostring(rawData.accountDisplayName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend UserEntraId = tolower(coalesce(extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids), tostring(rawData.accountObjectId)))
|            | project UserNodeId = NodeId, UserEntraId, UserUPN, UserDisplayName;
|
|        // who can authenticate to a device -- the account itself, or a group it is a member of (nested groups followed
|        // five levels deep through the graph's own "member of" edges)
|        let _memberOf = ExposureGraphEdges | where EdgeLabel =~ "member of" | project MemberNodeId = SourceNodeId, GroupNodeId = TargetNodeId;
|        let _auth0 = ExposureGraphEdges | where EdgeLabel =~ "can authenticate to" or EdgeLabel =~ "canAuthenticateTo" | project PrincipalNodeId = SourceNodeId, TargetNodeId;
|        let _auth1 = _memberOf | join kind=inner (_auth0) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth2 = _memberOf | join kind=inner (_auth1) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth3 = _memberOf | join kind=inner (_auth2) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth4 = _memberOf | join kind=inner (_auth3) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth5 = _memberOf | join kind=inner (_auth4) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _authTo = union _auth0, _auth1, _auth2, _auth3, _auth4, _auth5 | project SourceNodeId = PrincipalNodeId, TargetNodeId | distinct SourceNodeId, TargetNodeId;
|        _authTo
|        | join kind=inner _users on $left.SourceNodeId == $right.UserNodeId
|        | join kind=inner _devices on $left.TargetNodeId == $right.DeviceNodeId
|        // one row per account and machine -- reached directly and through a group, or a machine with a device node and a
|        // virtual-machine node that carry the same Defender device id
|        | extend _machineKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | summarize arg_max(DeviceNodeId, *) by UserNodeId, _machineKey
|        | extend DeviceKey = iif(isnotempty(UserEntraId), UserEntraId, tolower(UserNodeId))
|        //__STALE_DEVICE_FILTER_BEGIN__
|        | where 1 == 1
|        //__STALE_DEVICE_FILTER_END__
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // #677 the device's CI -- its own lookup (_ciPeer), joined here on the device's own key. The rows are sliced on the
|        // USER, so the device's CI is never cut with them -- it travels whole while it fits, else each slice gets only its own
|        // devices (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | join kind=leftouter (_ciPeer) on $left.DeviceCiKey == $right._peerKey
|        | extend DeviceCiId = peer_ci_id
|        // the device's asset factors -- the device CI's evaluation
|        // the device's asset factors -- the set the engine feeds (the device CI evaluation, the report's factors), its question left out
|        | extend DeviceFactorIds = set_difference(coalesce(peer_rf_p, dynamic([])), dynamic([])), DeviceFactorNames = set_difference(coalesce(peer_rf_names, dynamic([])), dynamic([]))
|        | extend IsInternetFacing = set_has_element(coalesce(peer_rf_p, dynamic([])), "internet_exposed")
|        | project-away DeviceCiKey, _peerKey, peer_*
|        // the user's CI -- tier, CMDB values and asset risk factors
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "Medium-High"
|        // the CVSS of the device's worst CVE is a finding value (Exposure Graph), not an asset factor
|        | extend RF_P_HighCvss        = iff(MaxCvssScore >= 9.0, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + array_length(DeviceFactorIds) + RF_P_HighCvss
|        | extend RiskFactorIds = strcat_array(DeviceFactorIds, ";")
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["AdminOnVulnerableDevice"]),
|            DeviceFactorNames,
|            iff(RF_P_HighCvss == 1, dynamic(["CVSS9plus"]),           dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("AdminOnVulnerableDevice=1;CVSS9plus=", tostring(RF_P_HighCvss))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(DeviceFactorNames) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(DeviceFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "Credential Exposure via Device"
|        | extend ConfigurationName = "Privileged user authenticating to device with High/Critical CVEs"
|        | extend ConfigurationId   = "IDENTITY-DEVICE-001"
|        | extend AssetName = coalesce(si_asset_name, UserDisplayName, UserUPN, DeviceKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(AssetId),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(UserDisplayName, " -> ", DeviceName))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(UserDisplayName, " -> ", DeviceName, "|", AssetId)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(MdeDeviceId)),
|            EntraAccountObjectId   = min(tostring(UserEntraId)),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(AssetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_cvss <- MaxCvssScore
|        // si si_category <- Category, si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics
|        // si si_mitre_techniques <- MITRE_Techniques, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_Admin_LogonTo_VulnerableDevice_Detailed
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      ReportPurpose: >
|        Per-pair detail: privileged admin and the specific vulnerable device they can authenticate to. Includes CVE score, internet exposure and device risk.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_Admin_LogonTo_VulnerableDevice_Detailed
|        // Purpose  Users that can authenticate to a device with High or Critical CVEs.
|        // The user-to-device "can authenticate to" edge is an Exposure Graph walk (provider, graph-only).
|        // Both ends take tier, CMDB values and asset risk factors from the CI (_ciLink, REQUIREMENTS #505), joined on
|        // the Entra object id (user) and the Defender device id (device) the graph nodes carry, else the node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let _devices =
|            ExposureGraphNodes
|            // a device node or a virtual-machine node (the graph ties "can authenticate to" to either)
|            | where NodeLabel in~ ("device", "microsoft.compute/virtualmachines")
|            | extend rawData          = todynamic(NodeProperties.rawData)
|            | extend HasHighCriticalCVE = tobool(rawData.highRiskVulnerabilityInsights.hasHighOrCritical)
|            | where HasHighCriticalCVE == true
|            | extend MaxCvssScore     = todouble(rawData.highRiskVulnerabilityInsights.maxCvssScore)
|            | extend DeviceRiskScore  = tostring(rawData.riskScore)
|            | extend DeviceName       = iff(isnotempty(tostring(rawData.deviceName)), tostring(rawData.deviceName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|            | project DeviceNodeId = NodeId, MdeDeviceId, DeviceName, MaxCvssScore, DeviceRiskScore;
|
|        let _users =
|            ExposureGraphNodes
|            | where NodeLabel == "user"
|            | extend rawData         = todynamic(NodeProperties.rawData)
|            // the graph's user node holds the sign-in name as accountUpn (SI's own eg mapping of si_upn) and the name as
|            // accountDisplayName -- an account without a sign-in name (a gMSA, a sync account) is kept, its UPN empty
|            | extend UserUPN         = tolower(tostring(rawData.accountUpn))
|            | extend UserDisplayName = iff(isnotempty(tostring(rawData.accountDisplayName)), tostring(rawData.accountDisplayName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend UserEntraId = tolower(coalesce(extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids), tostring(rawData.accountObjectId)))
|            | project UserNodeId = NodeId, UserEntraId, UserUPN, UserDisplayName;
|
|        // who can authenticate to a device -- the account itself, or a group it is a member of (nested groups followed
|        // five levels deep through the graph's own "member of" edges)
|        let _memberOf = ExposureGraphEdges | where EdgeLabel =~ "member of" | project MemberNodeId = SourceNodeId, GroupNodeId = TargetNodeId;
|        let _auth0 = ExposureGraphEdges | where EdgeLabel =~ "can authenticate to" or EdgeLabel =~ "canAuthenticateTo" | project PrincipalNodeId = SourceNodeId, TargetNodeId;
|        let _auth1 = _memberOf | join kind=inner (_auth0) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth2 = _memberOf | join kind=inner (_auth1) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth3 = _memberOf | join kind=inner (_auth2) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth4 = _memberOf | join kind=inner (_auth3) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth5 = _memberOf | join kind=inner (_auth4) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _authTo = union _auth0, _auth1, _auth2, _auth3, _auth4, _auth5 | project SourceNodeId = PrincipalNodeId, TargetNodeId | distinct SourceNodeId, TargetNodeId;
|        _authTo
|        | join kind=inner _users on $left.SourceNodeId == $right.UserNodeId
|        | join kind=inner _devices on $left.TargetNodeId == $right.DeviceNodeId
|        // one row per account and machine -- reached directly and through a group, or a machine with a device node and a
|        // virtual-machine node that carry the same Defender device id
|        | extend _machineKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | summarize arg_max(DeviceNodeId, *) by UserNodeId, _machineKey
|        | extend DeviceKey = iif(isnotempty(UserEntraId), UserEntraId, tolower(UserNodeId))
|        //__STALE_DEVICE_FILTER_BEGIN__
|        | where 1 == 1
|        //__STALE_DEVICE_FILTER_END__
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // #677 the device's CI -- its own lookup (_ciPeer), joined here on the device's own key. The rows are sliced on the
|        // USER, so the device's CI is never cut with them -- it travels whole while it fits, else each slice gets only its own
|        // devices (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | join kind=leftouter (_ciPeer) on $left.DeviceCiKey == $right._peerKey
|        | extend DeviceCiId = peer_ci_id
|        // #690 (17b) the machine is the finding's TARGET -- one finding per account x machine survives the engine's de-duplication
|        | extend TargetAssetId = iif(isnotempty(DeviceCiId), DeviceCiId, iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId)))
|        // the device's asset factors -- the device CI's evaluation
|        // the device's asset factors -- the set the engine feeds (the device CI evaluation, the report's factors), its question left out
|        | extend DeviceFactorIds = set_difference(coalesce(peer_rf_p, dynamic([])), dynamic([])), DeviceFactorNames = set_difference(coalesce(peer_rf_names, dynamic([])), dynamic([]))
|        | extend IsInternetFacing = set_has_element(coalesce(peer_rf_p, dynamic([])), "internet_exposed")
|        | project-away DeviceCiKey, _peerKey, peer_*
|        // the user's CI -- tier, CMDB values and asset risk factors
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity      = "Medium-High"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Privileged Access"
|        | extend Subcategory           = "Credential Exposure via Device"
|        | extend ConfigurationName     = "Privileged user authenticating to device with High/Critical CVEs"
|        | extend ConfigurationId       = "IDENTITY-DEVICE-001"
|        // the CVSS of the device's worst CVE is a finding value (Exposure Graph), not an asset factor
|        | extend RF_P_HighCvss        = iff(MaxCvssScore >= 9.0, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + array_length(DeviceFactorIds) + RF_P_HighCvss
|        | extend RiskFactorIds = strcat_array(DeviceFactorIds, ";")
|        | extend AssetName = coalesce(si_asset_name, UserDisplayName, UserUPN, DeviceKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project TargetAssetId, SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  UserDisplayName, UserUPN, UserNodeId,
|                  DeviceName, MaxCvssScore, IsInternetFacing, DeviceRiskScore,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, MaxCvssScore desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_cvss <- MaxCvssScore
|        // si si_category <- Category, si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_Admin_LogonTo_InternetExposedDevice_Summary
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      ReportPurpose: >
|        Privileged users (Tier 0/1) authenticated to internet-facing devices. Privileged sessions should never occur on internet-exposed assets as these devices have a significantly higher chance of being compromised remotely. Even without CVEs, internet-exposed devices face constant attack attempts. An attacker who breaches an internet-exposed device gains access to any privileged credential or token present on that device. Severity: High (fixed).
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_Admin_LogonTo_InternetExposedDevice_Summary
|        // Purpose  Users that can authenticate to an internet-exposed device.
|        // The user-to-device "can authenticate to" edge is an Exposure Graph walk (provider, graph-only).
|        // Both ends take tier, CMDB values and asset risk factors from the CI (_ciLink, REQUIREMENTS #505), joined on
|        // the Entra object id (user) and the Defender device id (device) the graph nodes carry, else the node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let _devices =
|            ExposureGraphNodes
|            // a device node or a virtual-machine node (the graph ties "can authenticate to" to either)
|            | where NodeLabel in~ ("device", "microsoft.compute/virtualmachines")
|            | extend rawData          = todynamic(NodeProperties.rawData)
|            | extend HasCVEs          = tobool(rawData.highRiskVulnerabilityInsights.hasHighOrCritical)
|            | extend DeviceRiskScore  = tostring(rawData.riskScore)
|            | extend DeviceName       = iff(isnotempty(tostring(rawData.deviceName)), tostring(rawData.deviceName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|            | project DeviceNodeId = NodeId, MdeDeviceId, DeviceName, HasCVEs, DeviceRiskScore;
|
|        let _users =
|            ExposureGraphNodes
|            | where NodeLabel == "user"
|            | extend rawData         = todynamic(NodeProperties.rawData)
|            // the graph's user node holds the sign-in name as accountUpn (SI's own eg mapping of si_upn) and the name as
|            // accountDisplayName -- an account without a sign-in name (a gMSA, a sync account) is kept, its UPN empty
|            | extend UserUPN         = tolower(tostring(rawData.accountUpn))
|            | extend UserDisplayName = iff(isnotempty(tostring(rawData.accountDisplayName)), tostring(rawData.accountDisplayName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend UserEntraId = tolower(coalesce(extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids), tostring(rawData.accountObjectId)))
|            | project UserNodeId = NodeId, UserEntraId, UserUPN, UserDisplayName;
|
|        // who can authenticate to a device -- the account itself, or a group it is a member of (nested groups followed
|        // five levels deep through the graph's own "member of" edges)
|        let _memberOf = ExposureGraphEdges | where EdgeLabel =~ "member of" | project MemberNodeId = SourceNodeId, GroupNodeId = TargetNodeId;
|        let _auth0 = ExposureGraphEdges | where EdgeLabel =~ "can authenticate to" or EdgeLabel =~ "canAuthenticateTo" | project PrincipalNodeId = SourceNodeId, TargetNodeId;
|        let _auth1 = _memberOf | join kind=inner (_auth0) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth2 = _memberOf | join kind=inner (_auth1) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth3 = _memberOf | join kind=inner (_auth2) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth4 = _memberOf | join kind=inner (_auth3) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth5 = _memberOf | join kind=inner (_auth4) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _authTo = union _auth0, _auth1, _auth2, _auth3, _auth4, _auth5 | project SourceNodeId = PrincipalNodeId, TargetNodeId | distinct SourceNodeId, TargetNodeId;
|        _authTo
|        | join kind=inner _users on $left.SourceNodeId == $right.UserNodeId
|        | join kind=inner _devices on $left.TargetNodeId == $right.DeviceNodeId
|        // one row per account and machine -- reached directly and through a group, or a machine with a device node and a
|        // virtual-machine node that carry the same Defender device id
|        | extend _machineKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | summarize arg_max(DeviceNodeId, *) by UserNodeId, _machineKey
|        | extend DeviceKey = iif(isnotempty(UserEntraId), UserEntraId, tolower(UserNodeId))
|        //__STALE_DEVICE_FILTER_BEGIN__
|        | where 1 == 1
|        //__STALE_DEVICE_FILTER_END__
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // #677 the device's CI -- its own lookup (_ciPeer), joined here on the device's own key. The rows are sliced on the
|        // USER, so the device's CI is never cut with them -- it travels whole while it fits, else each slice gets only its own
|        // devices (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | join kind=leftouter (_ciPeer) on $left.DeviceCiKey == $right._peerKey
|        | extend DeviceCiId = peer_ci_id
|        // internet exposure and machine risk are the device CI's asset factors
|        | where set_has_element(peer_rf_p, "internet_exposed")
|        // the device's asset factors -- the set the engine feeds (the device CI evaluation, the report's factors), its question left out
|        | extend DeviceFactorIds = set_difference(coalesce(peer_rf_p, dynamic([])), dynamic(["internet_exposed"])), DeviceFactorNames = set_difference(coalesce(peer_rf_names, dynamic([])), pack_array(tostring(SI_FactorNames["internet_exposed"])))
|        | project-away DeviceCiKey, _peerKey, peer_*
|        // the user's CI -- tier, CMDB values and asset risk factors
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "High"
|        | extend RF_P_HasCVEs        = iff(HasCVEs == true, 1, 0)
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = 1 + RF_P_HasCVEs + array_length(DeviceFactorIds)
|        | extend RiskFactorIds = strcat_array(DeviceFactorIds, ";")
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["InternetExposedDevice"]),
|            iff(RF_P_HasCVEs  == 1, dynamic(["DeviceHasHighCVEs"]),  dynamic([])),
|            DeviceFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("InternetExposedDevice=1;DeviceHasHighCVEs=", tostring(RF_P_HasCVEs))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(DeviceFactorNames) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(DeviceFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "Credential Exposure via Device"
|        | extend ConfigurationName = "Privileged user authenticating to internet-exposed device"
|        | extend ConfigurationId   = "IDENTITY-DEVICE-002"
|        | extend AssetName = coalesce(si_asset_name, UserDisplayName, UserUPN, DeviceKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(AssetId),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(UserDisplayName, " -> ", DeviceName))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(UserDisplayName, " -> ", DeviceName, "|", AssetId)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(MdeDeviceId)),
|            EntraAccountObjectId   = min(tostring(UserEntraId)),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(AssetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_Admin_LogonTo_LowTierDevice_Summary
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      - Lookup: _deviceTierOwn
|        Column: _dtKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      ReportPurpose: >
|        Tier 0 privileged users (Global Admin, Domain Admin etc) authenticating to devices that are NOT classified as Tier 0 assets. Tier 0 admins should only use Tier 0 Privileged Access Workstations (PAWs). Logging on to a standard workstation, developer machine, or shared device exposes Tier 0 credentials to a device with a broader attack surface and potentially lower security controls. Severity: Very High (fixed) - Tier 0 admin on non-PAW device is a tiering violation.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_Admin_LogonTo_LowTierDevice_Summary
|        // Purpose  Tier 0 users that can authenticate to a device that is not tier 0 (tiering violation).
|        // The user-to-device "can authenticate to" edge is an Exposure Graph walk (provider, graph-only).
|        // Both ends take tier, CMDB values and asset risk factors from the CI (_ciLink, REQUIREMENTS #505), joined on
|        // the Entra object id (user) and the Defender device id (device) the graph nodes carry, else the node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let _devices =
|            ExposureGraphNodes
|            // a device node or a virtual-machine node (the graph ties "can authenticate to" to either)
|            | where NodeLabel in~ ("device", "microsoft.compute/virtualmachines")
|            | extend rawData          = todynamic(NodeProperties.rawData)
|            | extend DeviceRiskScore = tostring(rawData.riskScore)
|            | extend HasCVEs         = tobool(rawData.highRiskVulnerabilityInsights.hasHighOrCritical)
|            | extend DeviceName       = iff(isnotempty(tostring(rawData.deviceName)), tostring(rawData.deviceName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|            | project DeviceNodeId = NodeId, MdeDeviceId, DeviceName, DeviceRiskScore, HasCVEs;
|
|        let _users =
|            ExposureGraphNodes
|            | where NodeLabel == "user"
|            | extend rawData         = todynamic(NodeProperties.rawData)
|            // the graph's user node holds the sign-in name as accountUpn (SI's own eg mapping of si_upn) and the name as
|            // accountDisplayName -- an account without a sign-in name (a gMSA, a sync account) is kept, its UPN empty
|            | extend UserUPN         = tolower(tostring(rawData.accountUpn))
|            | extend UserDisplayName = iff(isnotempty(tostring(rawData.accountDisplayName)), tostring(rawData.accountDisplayName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            // most graph user nodes carry the Entra id as a tenant id and object id pair (TenantId=... ObjectId=...) -- only
|            // the object id is the key the account's CI is linked on (si_link_entra), so the pair joined no CI
|            | extend _aadId          = tolower(coalesce(extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids), tostring(rawData.accountObjectId)))
|            | extend UserEntraId     = iff(_aadId has "objectid=", extract(@'objectid=([0-9a-f-]+)', 1, _aadId), _aadId)
|            | project UserNodeId = NodeId, UserEntraId, UserUPN, UserDisplayName;
|
|        // #690 (49) the DEVICE's own tier -- decided by every tier claim on its CI EXCEPT the rule that inherits the tier of
|        // its most frequent logon user (AssetProfileByLogonUser/LogonByT0User). That rule makes a workstation Tier 0 BECAUSE a
|        // Tier 0 admin uses it, which would hide exactly the violation this report finds (owner 2026-10-15 -- the rule stays,
|        // this report judges the device without it). The same decision as the CI build -- an observed rule claim first, else
|        // the operator's tier tag, else the default -- and a manual override as it is.
|        let _deviceTierOwn =
|            SI_CI_CL
|            | where TimeGenerated > ago(30d)
|            | where tostring(si_class) == "device" and tostring(column_ifexists("si_row_kind", "")) != "seen"
|            | summarize arg_max(todatetime(si_collection_time), *) by _dtCiId = tostring(si_ci_id)
|            | where isnotempty(_dtCiId)
|            | extend _dtSetBy = tostring(column_ifexists("si_tier_set_by", "")), _dtCiTier = toint(column_ifexists("si_tier", int(null)))
|            | mv-apply _dtClaim = todynamic(tostring(column_ifexists("si_tier_claims", dynamic(null)))) to typeof(dynamic) on (
|                where tobool(_dtClaim.admissible) == true and not(tostring(_dtClaim.rule) endswith "/LogonByT0User") and isnotnull(toint(_dtClaim.tier))
|                | summarize _dtRule = min(iff(tostring(_dtClaim.kind) == "rule", toint(_dtClaim.tier), int(null))),
|                            _dtTag = min(iff(tostring(_dtClaim.kind) == "tag", toint(_dtClaim.tier), int(null))),
|                            _dtDefault = min(iff(tostring(_dtClaim.kind) == "default", toint(_dtClaim.tier), int(null)))
|              )
|            | extend _dtTier = iff(_dtSetBy == "override", _dtCiTier, coalesce(_dtRule, _dtTag, _dtDefault))
|            // #741 (2) one row per LINK KEY of the CI (the keys _ciPeer is matched on), so the lookup can be cut to the devices
|            // of each query slice (LookupNeededKeys) -- whole it is too large for one request at a large tenant
|            | extend _dtKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|            | mv-expand _dtKey = _dtKeys to typeof(string)
|            | where isnotempty(_dtKey)
|            | project _dtKey, _dtCiId, _dtTier;
|
|        // who can authenticate to a device -- the account itself, or a group it is a member of (nested groups followed
|        // five levels deep through the graph's own "member of" edges)
|        let _memberOf = ExposureGraphEdges | where EdgeLabel =~ "member of" | project MemberNodeId = SourceNodeId, GroupNodeId = TargetNodeId;
|        let _auth0 = ExposureGraphEdges | where EdgeLabel =~ "can authenticate to" or EdgeLabel =~ "canAuthenticateTo" | project PrincipalNodeId = SourceNodeId, TargetNodeId;
|        let _auth1 = _memberOf | join kind=inner (_auth0) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth2 = _memberOf | join kind=inner (_auth1) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth3 = _memberOf | join kind=inner (_auth2) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth4 = _memberOf | join kind=inner (_auth3) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth5 = _memberOf | join kind=inner (_auth4) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _authTo = union _auth0, _auth1, _auth2, _auth3, _auth4, _auth5 | project SourceNodeId = PrincipalNodeId, TargetNodeId | distinct SourceNodeId, TargetNodeId;
|        _authTo
|        | join kind=inner _users on $left.SourceNodeId == $right.UserNodeId
|        | join kind=inner _devices on $left.TargetNodeId == $right.DeviceNodeId
|        // one row per account and machine -- reached directly and through a group, or a machine with a device node and a
|        // virtual-machine node that carry the same Defender device id
|        | extend _machineKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | summarize arg_max(DeviceNodeId, *) by UserNodeId, _machineKey
|        | extend DeviceKey = iif(isnotempty(UserEntraId), UserEntraId, tolower(UserNodeId))
|        //__STALE_DEVICE_FILTER_BEGIN__
|        | where 1 == 1
|        //__STALE_DEVICE_FILTER_END__
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // #677 the device's CI -- its own lookup (_ciPeer), joined here on the device's own key. The rows are sliced on the
|        // USER, so the device's CI is never cut with them -- it travels whole while it fits, else each slice gets only its own
|        // devices (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | join kind=leftouter (_ciPeer) on $left.DeviceCiKey == $right._peerKey
|        | extend DeviceCiId = peer_ci_id
|        // the device's tier and machine risk are the device CI's
|        // the device's own tier without the logon-user rule (_deviceTierOwn), else the device CI's tier
|        // (one row per CI again -- the lookup carries one row per link key of a CI, every one with the CI's own tier)
|        | join kind=leftouter (_deviceTierOwn | summarize _dtTier = min(_dtTier) by _dtCiId) on $left.DeviceCiId == $right._dtCiId
|        | extend DeviceCritLvl = toint(coalesce(_dtTier, toint(peer_tier)))
|        | where isnull(DeviceCritLvl) or DeviceCritLvl > 0
|        // the device's asset factors -- the set the engine feeds (the device CI evaluation, the report's factors), its question left out
|        | extend DeviceFactorIds = set_difference(coalesce(peer_rf_p, dynamic([])), dynamic([])), DeviceFactorNames = set_difference(coalesce(peer_rf_names, dynamic([])), dynamic([]))
|        | project-away DeviceCiKey, _peerKey, peer_*
|        // the user's CI -- tier, CMDB values and asset risk factors
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        // a Tier 0 ACCOUNT -- the account CI's tier, decided by the identity privilege tier rules (#690 (48), the tier of the
|        // highest privilege it holds today)
|        | extend CriticalityTier = toint(si_tier)
|        | where CriticalityTier == 0
|        | extend CriticalityTierLevel = "Critical - tier 0"
|        | extend SecuritySeverity     = "Medium"
|        | extend RF_P_DeviceTier2Plus = iff(isnull(DeviceCritLvl) or DeviceCritLvl >= 2, 1, 0)
|        | extend RF_P_HasCVEs         = iff(HasCVEs == true, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_DeviceTier2Plus + RF_P_HasCVEs + array_length(DeviceFactorIds)
|        | extend RiskFactorIds = strcat_array(DeviceFactorIds, ";")
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["Tier0AdminOnNonPAW"]),
|            iff(RF_P_DeviceTier2Plus == 1, dynamic(["DeviceTier2OrUnclassified"]),dynamic([])),
|            iff(RF_P_HasCVEs         == 1, dynamic(["DeviceHasHighCVEs"]),        dynamic([])),
|            DeviceFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("Tier0AdminOnNonPAW=1;DeviceTier2OrUnclassified=", tostring(RF_P_DeviceTier2Plus),
|                   ";DeviceHasHighCVEs=", tostring(RF_P_HasCVEs))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(DeviceFactorNames) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(DeviceFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "Privileged Access Workstation Compliance"
|        | extend ConfigurationName = "Tier 0 admin authenticating to non-PAW (tiering violation)"
|        | extend ConfigurationId   = "IDENTITY-DEVICE-003"
|        | extend AssetName = coalesce(si_asset_name, UserDisplayName, UserUPN, DeviceKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(AssetId),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(UserDisplayName, " -> ", DeviceName))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(UserDisplayName, " -> ", DeviceName, "|", AssetId)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(MdeDeviceId)),
|            EntraAccountObjectId   = min(tostring(UserEntraId)),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(AssetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_EligibleAdmin_LogonTo_ExploitableDevice_Summary
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      ReportPurpose: >
|        Users with PIM-eligible Tier 0/1 roles authenticated to devices that have vulnerabilities with a known exploit (public, verified or in an exploit kit, as Defender vulnerability management and the Exposure Graph report it). Even if the PIM role is not currently activated, the credential harvested from an exploitable device could be used to activate PIM and gain full admin access. Severity: Very High (fixed) - eligible admin credential on actively exploitable device.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_EligibleAdmin_LogonTo_ExploitableDevice_Summary
|        // Purpose  Users that can authenticate to a device with a known exploit.
|        // The user-to-device "can authenticate to" edge is an Exposure Graph walk (provider, graph-only).
|        // Both ends take tier, CMDB values and asset risk factors from the CI (_ciLink, REQUIREMENTS #505), joined on
|        // the Entra object id (user) and the Defender device id (device) the graph nodes carry, else the node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let _devices =
|            ExposureGraphNodes
|            // a device node or a virtual-machine node (the graph ties "can authenticate to" to either)
|            | where NodeLabel in~ ("device", "microsoft.compute/virtualmachines")
|            | extend rawData          = todynamic(NodeProperties.rawData)
|            // the graph's exploit evidence -- the exploitability levels of the device's remote-code-execution and
|            // privilege-escalation CVEs (NoExploit, ExploitIsPublic, ExploitIsVerified, ExploitIsInKit)
|            | extend _xLevels   = strcat(tostring(rawData.highRiskVulnerabilityInsights.vulnerableToRemoteCodeExecution.explotabilityLevels), tostring(rawData.highRiskVulnerabilityInsights.vulnerableToPrivilegeEscalation.explotabilityLevels))
|            | extend IsInKit    = _xLevels has "ExploitIsInKit"
|            | extend IsVerified = _xLevels has "ExploitIsVerified"
|            | extend HasExploit = IsInKit or IsVerified or _xLevels has "ExploitIsPublic"
|            | extend DeviceName       = iff(isnotempty(tostring(rawData.deviceName)), tostring(rawData.deviceName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|            | project DeviceNodeId = NodeId, MdeDeviceId, DeviceName, HasExploit, IsInKit, IsVerified;
|
|        let _users =
|            ExposureGraphNodes
|            | where NodeLabel == "user"
|            | extend rawData         = todynamic(NodeProperties.rawData)
|            // the graph's user node holds the sign-in name as accountUpn (SI's own eg mapping of si_upn) and the name as
|            // accountDisplayName -- an account without a sign-in name (a gMSA, a sync account) is kept, its UPN empty
|            | extend UserUPN         = tolower(tostring(rawData.accountUpn))
|            | extend UserDisplayName = iff(isnotempty(tostring(rawData.accountDisplayName)), tostring(rawData.accountDisplayName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            // most graph user nodes carry the Entra id as a tenant id and object id pair (TenantId=... ObjectId=...) -- only
|            // the object id is the key the account's CI is linked on (si_link_entra), so the pair joined no CI
|            | extend _aadId          = tolower(coalesce(extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids), tostring(rawData.accountObjectId)))
|            | extend UserEntraId     = iff(_aadId has "objectid=", extract(@'objectid=([0-9a-f-]+)', 1, _aadId), _aadId)
|            // the report's question -- an account Entra lists as eligible for a role through PIM (the graph's eligibleRoles)
|            | where array_length(rawData.eligibleRoles) > 0
|            | project UserNodeId = NodeId, UserEntraId, UserUPN, UserDisplayName;
|
|        // who can authenticate to a device -- the account itself, or a group it is a member of (nested groups followed
|        // five levels deep through the graph's own "member of" edges)
|        let _memberOf = ExposureGraphEdges | where EdgeLabel =~ "member of" | project MemberNodeId = SourceNodeId, GroupNodeId = TargetNodeId;
|        let _auth0 = ExposureGraphEdges | where EdgeLabel =~ "can authenticate to" or EdgeLabel =~ "canAuthenticateTo" | project PrincipalNodeId = SourceNodeId, TargetNodeId;
|        let _auth1 = _memberOf | join kind=inner (_auth0) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth2 = _memberOf | join kind=inner (_auth1) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth3 = _memberOf | join kind=inner (_auth2) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth4 = _memberOf | join kind=inner (_auth3) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth5 = _memberOf | join kind=inner (_auth4) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _authTo = union _auth0, _auth1, _auth2, _auth3, _auth4, _auth5 | project SourceNodeId = PrincipalNodeId, TargetNodeId | distinct SourceNodeId, TargetNodeId;
|        // Defender vulnerability management -- a device with a CVE that has a known exploit (the knowledge base's
|        // IsExploitAvailable), read only for the devices an account can authenticate to
|        let _authTargetMde = _authTo | join kind=inner (_devices) on $left.TargetNodeId == $right.DeviceNodeId | where isnotempty(MdeDeviceId) | distinct MdeDeviceId;
|        let _tvmExploitDevices =
|            DeviceTvmSoftwareVulnerabilities
|            | where tolower(DeviceId) in (_authTargetMde)
|            | join kind=inner (DeviceTvmSoftwareVulnerabilitiesKB | where IsExploitAvailable == true | project CveId) on CveId
|            | project TvmExploitDeviceId = tolower(DeviceId)
|            | where isnotempty(TvmExploitDeviceId)
|            | distinct TvmExploitDeviceId;        _authTo
|        | join kind=inner _users on $left.SourceNodeId == $right.UserNodeId
|        | join kind=inner _devices on $left.TargetNodeId == $right.DeviceNodeId
|        | join kind=leftouter (_tvmExploitDevices) on $left.MdeDeviceId == $right.TvmExploitDeviceId
|        | extend HasExploit = HasExploit or isnotempty(TvmExploitDeviceId)
|        | where HasExploit        // one row per account and machine -- reached directly and through a group, or a machine with a device node and a
|        // virtual-machine node that carry the same Defender device id
|        | extend _machineKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | summarize arg_max(DeviceNodeId, *) by UserNodeId, _machineKey
|        | extend DeviceKey = iif(isnotempty(UserEntraId), UserEntraId, tolower(UserNodeId))
|        //__STALE_DEVICE_FILTER_BEGIN__
|        | where 1 == 1
|        //__STALE_DEVICE_FILTER_END__
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // #677 the device's CI -- its own lookup (_ciPeer), joined here on the device's own key. The rows are sliced on the
|        // USER, so the device's CI is never cut with them -- it travels whole while it fits, else each slice gets only its own
|        // devices (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | join kind=leftouter (_ciPeer) on $left.DeviceCiKey == $right._peerKey
|        | extend DeviceCiId = peer_ci_id
|        | project-away DeviceCiKey, _peerKey, peer_*
|        // the user's CI -- tier, CMDB values and asset risk factors
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "High"
|        // exploit signals are finding values (Exposure Graph)
|        | extend RF_P_Verified        = iff(IsVerified == true, 1, 0)
|        | extend RF_P_InKit           = iff(IsInKit == true, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_Verified + RF_P_InKit
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["EligibleAdminOnExploitableDevice"]),
|            iff(RF_P_Verified == 1, dynamic(["VerifiedExploit"]),   dynamic([])),
|            iff(RF_P_InKit    == 1, dynamic(["InExploitKit"]),      dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("EligibleAdminOnExploitableDevice=1;VerifiedExploit=", tostring(RF_P_Verified),
|                   ";InExploitKit=", tostring(RF_P_InKit))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "Credential Exposure via Device"
|        | extend ConfigurationName = "PIM-eligible admin authenticated to device with known exploits"
|        | extend ConfigurationId   = "IDENTITY-DEVICE-004"
|        | extend AssetName = coalesce(si_asset_name, UserDisplayName, UserUPN, DeviceKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(AssetId),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(UserDisplayName, " -> ", DeviceName))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(UserDisplayName, " -> ", DeviceName, "|", AssetId)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(MdeDeviceId)),
|            EntraAccountObjectId   = min(tostring(UserEntraId)),
|            AzureResourceId        = min(tostring("")),
|            AssetId                = min(AssetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_AdminAccount_NeverUsed_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_AdminAccount_NeverUsed_Summary. Privileged accounts (Tier 0/1) created more than 14 days ago that have never signed in. Unused privileged accounts represent dormant attack surface - they hold permissions but have no operational owner actively monitoring them. Common cause: accounts created for a project that never started, or provisioned for a consultant who never onboarded. Severity: High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for AdminAccount NeverUsed Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_AdminAccount_NeverUsed_Detailed
|        // Purpose  Enabled users that never signed in, 14+ days after creation, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where LastSignInDays == -1
|        | where CreatedDays > 14
|        // the report's question is a privileged ROLE -- the identity's role tier (a Tier 0 / Tier 1 Entra role held
|        // permanently or eligible) decides, and the account's own tier still counts (never fewer rows than before)
|        | extend _roleTier = min_of(coalesce(si_privilege_tier_permanent, 99), coalesce(si_privilege_tier_eligible, 99))
|        | where _roleTier <= 1 or isnull(si_tier) or si_tier in (0, 1)
|        | extend CriticalityTier = toint(case(isnull(si_tier) and _roleTier > 3, int(null), isnull(si_tier), _roleTier, _roleTier > 3, toint(si_tier), min_of(_roleTier, toint(si_tier))))
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["NeverSignedIn"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("NeverSignedIn=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Admin Account Hygiene"
|        | extend Subcategory       = "Unused Accounts"
|        | extend ConfigurationName = "Privileged account never signed in after 14-day grace period"
|        | extend ConfigurationId   = "IDENTITY-ADMIN-003"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_AdminAccount_OnPremSynced_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_AdminAccount_OnPremSynced_Summary. Privileged admin accounts (Tier 0/1) that are synchronised from on-premises AD rather than being cloud-only. Admin accounts should be cloud-native to avoid on-prem compromise pivoting to cloud. A compromised AD environment (e.g. via ransomware) can directly take over cloud admin accounts that are synced from AD. Severity: Very High - on-prem sync of privileged accounts breaks cloud/AD separation. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for AdminAccount OnPremisesSyncEnabled Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_AdminAccount_OnPremSynced_Detailed
|        // Purpose  Enabled users synchronised from on-premises AD, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where si_onprem_synced == true
|        // the report's question is a privileged ROLE -- the identity's role tier (a Tier 0 / Tier 1 Entra role held
|        // permanently or eligible) decides, and the account's own tier still counts (never fewer rows than before)
|        | extend _roleTier = min_of(coalesce(si_privilege_tier_permanent, 99), coalesce(si_privilege_tier_eligible, 99))
|        | where _roleTier <= 1 or isnull(si_tier) or si_tier in (0, 1)
|        | extend CriticalityTier = toint(case(isnull(si_tier) and _roleTier > 3, int(null), isnull(si_tier), _roleTier, _roleTier > 3, toint(si_tier), min_of(_roleTier, toint(si_tier))))
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["OnPremisesSyncEnabled"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("OnPremisesSyncEnabled=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Admin Account Hygiene"
|        | extend Subcategory       = "Cloud-AD Separation"
|        | extend ConfigurationName = "Privileged account synced from on-prem AD - cloud isolation broken"
|        | extend ConfigurationId   = "IDENTITY-ADMIN-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_Admin_LogonTo_InternetExposedDevice_Detailed
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      ReportPurpose: >-
|        Per-row detail view for Identity_Admin_LogonTo_InternetExposedDevice_Summary. Privileged users (Tier 0/1) authenticated to internet-facing devices. Privileged sessions should never occur on internet-exposed assets as these devices have a significantly higher chance of being compromised remotely. Even without CVEs, internet-exposed devices face constant attack attempts. An attacker who breaches an internet-exposed device gains access to any privileged credential or token present on that device. Severity: High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for Admin LogonTo InternetExposedDevice Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_Admin_LogonTo_InternetExposedDevice_Detailed
|        // Purpose  Users that can authenticate to an internet-exposed device.
|        // The user-to-device "can authenticate to" edge is an Exposure Graph walk (provider, graph-only).
|        // Both ends take tier, CMDB values and asset risk factors from the CI (_ciLink, REQUIREMENTS #505), joined on
|        // the Entra object id (user) and the Defender device id (device) the graph nodes carry, else the node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let _devices =
|            ExposureGraphNodes
|            // a device node or a virtual-machine node (the graph ties "can authenticate to" to either)
|            | where NodeLabel in~ ("device", "microsoft.compute/virtualmachines")
|            | extend rawData          = todynamic(NodeProperties.rawData)
|            | extend HasCVEs          = tobool(rawData.highRiskVulnerabilityInsights.hasHighOrCritical)
|            | extend DeviceRiskScore  = tostring(rawData.riskScore)
|            | extend DeviceName       = iff(isnotempty(tostring(rawData.deviceName)), tostring(rawData.deviceName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|            | project DeviceNodeId = NodeId, MdeDeviceId, DeviceName, HasCVEs, DeviceRiskScore;
|
|        let _users =
|            ExposureGraphNodes
|            | where NodeLabel == "user"
|            | extend rawData         = todynamic(NodeProperties.rawData)
|            // the graph's user node holds the sign-in name as accountUpn (SI's own eg mapping of si_upn) and the name as
|            // accountDisplayName -- an account without a sign-in name (a gMSA, a sync account) is kept, its UPN empty
|            | extend UserUPN         = tolower(tostring(rawData.accountUpn))
|            | extend UserDisplayName = iff(isnotempty(tostring(rawData.accountDisplayName)), tostring(rawData.accountDisplayName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend UserEntraId = tolower(coalesce(extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids), tostring(rawData.accountObjectId)))
|            | project UserNodeId = NodeId, UserEntraId, UserUPN, UserDisplayName;
|
|        // who can authenticate to a device -- the account itself, or a group it is a member of (nested groups followed
|        // five levels deep through the graph's own "member of" edges)
|        let _memberOf = ExposureGraphEdges | where EdgeLabel =~ "member of" | project MemberNodeId = SourceNodeId, GroupNodeId = TargetNodeId;
|        let _auth0 = ExposureGraphEdges | where EdgeLabel =~ "can authenticate to" or EdgeLabel =~ "canAuthenticateTo" | project PrincipalNodeId = SourceNodeId, TargetNodeId;
|        let _auth1 = _memberOf | join kind=inner (_auth0) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth2 = _memberOf | join kind=inner (_auth1) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth3 = _memberOf | join kind=inner (_auth2) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth4 = _memberOf | join kind=inner (_auth3) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth5 = _memberOf | join kind=inner (_auth4) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _authTo = union _auth0, _auth1, _auth2, _auth3, _auth4, _auth5 | project SourceNodeId = PrincipalNodeId, TargetNodeId | distinct SourceNodeId, TargetNodeId;
|        _authTo
|        | join kind=inner _users on $left.SourceNodeId == $right.UserNodeId
|        | join kind=inner _devices on $left.TargetNodeId == $right.DeviceNodeId
|        // one row per account and machine -- reached directly and through a group, or a machine with a device node and a
|        // virtual-machine node that carry the same Defender device id
|        | extend _machineKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | summarize arg_max(DeviceNodeId, *) by UserNodeId, _machineKey
|        | extend DeviceKey = iif(isnotempty(UserEntraId), UserEntraId, tolower(UserNodeId))
|        //__STALE_DEVICE_FILTER_BEGIN__
|        | where 1 == 1
|        //__STALE_DEVICE_FILTER_END__
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // #677 the device's CI -- its own lookup (_ciPeer), joined here on the device's own key. The rows are sliced on the
|        // USER, so the device's CI is never cut with them -- it travels whole while it fits, else each slice gets only its own
|        // devices (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | join kind=leftouter (_ciPeer) on $left.DeviceCiKey == $right._peerKey
|        | extend DeviceCiId = peer_ci_id
|        // #690 (17b) the machine is the finding's TARGET -- one finding per account x machine survives the engine's de-duplication
|        | extend TargetAssetId = iif(isnotempty(DeviceCiId), DeviceCiId, iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId)))
|        // internet exposure and machine risk are the device CI's asset factors
|        | where set_has_element(peer_rf_p, "internet_exposed")
|        // the device's asset factors -- the set the engine feeds (the device CI evaluation, the report's factors), its question left out
|        | extend DeviceFactorIds = set_difference(coalesce(peer_rf_p, dynamic([])), dynamic(["internet_exposed"])), DeviceFactorNames = set_difference(coalesce(peer_rf_names, dynamic([])), pack_array(tostring(SI_FactorNames["internet_exposed"])))
|        | project-away DeviceCiKey, _peerKey, peer_*
|        // the user's CI -- tier, CMDB values and asset risk factors
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity      = "High"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Privileged Access"
|        | extend Subcategory           = "Credential Exposure via Device"
|        | extend ConfigurationName     = "Privileged user authenticating to internet-exposed device"
|        | extend ConfigurationId       = "IDENTITY-DEVICE-002"
|        | extend RF_P_HasCVEs        = iff(HasCVEs == true, 1, 0)
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = 1 + RF_P_HasCVEs + array_length(DeviceFactorIds)
|        | extend RiskFactorIds = strcat_array(DeviceFactorIds, ";")
|        | extend AssetName = coalesce(si_asset_name, UserDisplayName, UserUPN, DeviceKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project TargetAssetId, SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  UserDisplayName, UserUPN, UserNodeId,
|                  DeviceName, HasCVEs, DeviceRiskScore,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_Admin_LogonTo_LowTierDevice_Detailed
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      - Lookup: _deviceTierOwn
|        Column: _dtKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      ReportPurpose: >-
|        Per-row detail view for Identity_Admin_LogonTo_LowTierDevice_Summary. Tier 0 privileged users (Global Admin, Domain Admin etc) authenticating to devices that are NOT classified as Tier 0 assets. Tier 0 admins should only use Tier 0 Privileged Access Workstations (PAWs). Logging on to a standard workstation, developer machine, or shared device exposes Tier 0 credentials to a device with a broader attack surface and potentially lower security controls. Severity: Very High (fixed) - Tier 0 admin on non-PAW device is a tiering violation. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for Admin LogonTo LowTierDevice Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_Admin_LogonTo_LowTierDevice_Detailed
|        // Purpose  Tier 0 users that can authenticate to a device that is not tier 0 (tiering violation).
|        // The user-to-device "can authenticate to" edge is an Exposure Graph walk (provider, graph-only).
|        // Both ends take tier, CMDB values and asset risk factors from the CI (_ciLink, REQUIREMENTS #505), joined on
|        // the Entra object id (user) and the Defender device id (device) the graph nodes carry, else the node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "permanent_privileged_role", "production_environment", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let _devices =
|            ExposureGraphNodes
|            // a device node or a virtual-machine node (the graph ties "can authenticate to" to either)
|            | where NodeLabel in~ ("device", "microsoft.compute/virtualmachines")
|            | extend rawData          = todynamic(NodeProperties.rawData)
|            | extend DeviceRiskScore = tostring(rawData.riskScore)
|            | extend HasCVEs         = tobool(rawData.highRiskVulnerabilityInsights.hasHighOrCritical)
|            | extend DeviceName       = iff(isnotempty(tostring(rawData.deviceName)), tostring(rawData.deviceName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|            | project DeviceNodeId = NodeId, MdeDeviceId, DeviceName, DeviceRiskScore, HasCVEs;
|
|        let _users =
|            ExposureGraphNodes
|            | where NodeLabel == "user"
|            | extend rawData         = todynamic(NodeProperties.rawData)
|            // the graph's user node holds the sign-in name as accountUpn (SI's own eg mapping of si_upn) and the name as
|            // accountDisplayName -- an account without a sign-in name (a gMSA, a sync account) is kept, its UPN empty
|            | extend UserUPN         = tolower(tostring(rawData.accountUpn))
|            | extend UserDisplayName = iff(isnotempty(tostring(rawData.accountDisplayName)), tostring(rawData.accountDisplayName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            // most graph user nodes carry the Entra id as a tenant id and object id pair (TenantId=... ObjectId=...) -- only
|            // the object id is the key the account's CI is linked on (si_link_entra), so the pair joined no CI
|            | extend _aadId          = tolower(coalesce(extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids), tostring(rawData.accountObjectId)))
|            | extend UserEntraId     = iff(_aadId has "objectid=", extract(@'objectid=([0-9a-f-]+)', 1, _aadId), _aadId)
|            | project UserNodeId = NodeId, UserEntraId, UserUPN, UserDisplayName;
|
|        // #690 (49) the DEVICE's own tier -- decided by every tier claim on its CI EXCEPT the rule that inherits the tier of
|        // its most frequent logon user (AssetProfileByLogonUser/LogonByT0User). That rule makes a workstation Tier 0 BECAUSE a
|        // Tier 0 admin uses it, which would hide exactly the violation this report finds (owner 2026-10-15 -- the rule stays,
|        // this report judges the device without it). The same decision as the CI build -- an observed rule claim first, else
|        // the operator's tier tag, else the default -- and a manual override as it is.
|        let _deviceTierOwn =
|            SI_CI_CL
|            | where TimeGenerated > ago(30d)
|            | where tostring(si_class) == "device" and tostring(column_ifexists("si_row_kind", "")) != "seen"
|            | summarize arg_max(todatetime(si_collection_time), *) by _dtCiId = tostring(si_ci_id)
|            | where isnotempty(_dtCiId)
|            | extend _dtSetBy = tostring(column_ifexists("si_tier_set_by", "")), _dtCiTier = toint(column_ifexists("si_tier", int(null)))
|            | mv-apply _dtClaim = todynamic(tostring(column_ifexists("si_tier_claims", dynamic(null)))) to typeof(dynamic) on (
|                where tobool(_dtClaim.admissible) == true and not(tostring(_dtClaim.rule) endswith "/LogonByT0User") and isnotnull(toint(_dtClaim.tier))
|                | summarize _dtRule = min(iff(tostring(_dtClaim.kind) == "rule", toint(_dtClaim.tier), int(null))),
|                            _dtTag = min(iff(tostring(_dtClaim.kind) == "tag", toint(_dtClaim.tier), int(null))),
|                            _dtDefault = min(iff(tostring(_dtClaim.kind) == "default", toint(_dtClaim.tier), int(null)))
|              )
|            | extend _dtTier = iff(_dtSetBy == "override", _dtCiTier, coalesce(_dtRule, _dtTag, _dtDefault))
|            // #741 (2) one row per LINK KEY of the CI (the keys _ciPeer is matched on), so the lookup can be cut to the devices
|            // of each query slice (LookupNeededKeys) -- whole it is too large for one request at a large tenant
|            | extend _dtKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|            | mv-expand _dtKey = _dtKeys to typeof(string)
|            | where isnotempty(_dtKey)
|            | project _dtKey, _dtCiId, _dtTier;
|
|        // who can authenticate to a device -- the account itself, or a group it is a member of (nested groups followed
|        // five levels deep through the graph's own "member of" edges)
|        let _memberOf = ExposureGraphEdges | where EdgeLabel =~ "member of" | project MemberNodeId = SourceNodeId, GroupNodeId = TargetNodeId;
|        let _auth0 = ExposureGraphEdges | where EdgeLabel =~ "can authenticate to" or EdgeLabel =~ "canAuthenticateTo" | project PrincipalNodeId = SourceNodeId, TargetNodeId;
|        let _auth1 = _memberOf | join kind=inner (_auth0) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth2 = _memberOf | join kind=inner (_auth1) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth3 = _memberOf | join kind=inner (_auth2) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth4 = _memberOf | join kind=inner (_auth3) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth5 = _memberOf | join kind=inner (_auth4) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _authTo = union _auth0, _auth1, _auth2, _auth3, _auth4, _auth5 | project SourceNodeId = PrincipalNodeId, TargetNodeId | distinct SourceNodeId, TargetNodeId;
|        _authTo
|        | join kind=inner _users on $left.SourceNodeId == $right.UserNodeId
|        | join kind=inner _devices on $left.TargetNodeId == $right.DeviceNodeId
|        // one row per account and machine -- reached directly and through a group, or a machine with a device node and a
|        // virtual-machine node that carry the same Defender device id
|        | extend _machineKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | summarize arg_max(DeviceNodeId, *) by UserNodeId, _machineKey
|        | extend DeviceKey = iif(isnotempty(UserEntraId), UserEntraId, tolower(UserNodeId))
|        //__STALE_DEVICE_FILTER_BEGIN__
|        | where 1 == 1
|        //__STALE_DEVICE_FILTER_END__
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // #677 the device's CI -- its own lookup (_ciPeer), joined here on the device's own key. The rows are sliced on the
|        // USER, so the device's CI is never cut with them -- it travels whole while it fits, else each slice gets only its own
|        // devices (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | join kind=leftouter (_ciPeer) on $left.DeviceCiKey == $right._peerKey
|        | extend DeviceCiId = peer_ci_id
|        // #690 (17b) the machine is the finding's TARGET -- one finding per account x machine survives the engine's de-duplication
|        | extend TargetAssetId = iif(isnotempty(DeviceCiId), DeviceCiId, iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId)))
|        // the device's tier and machine risk are the device CI's
|        // the device's own tier without the logon-user rule (_deviceTierOwn), else the device CI's tier
|        // (one row per CI again -- the lookup carries one row per link key of a CI, every one with the CI's own tier)
|        | join kind=leftouter (_deviceTierOwn | summarize _dtTier = min(_dtTier) by _dtCiId) on $left.DeviceCiId == $right._dtCiId
|        | extend DeviceCritLvl = toint(coalesce(_dtTier, toint(peer_tier)))
|        | where isnull(DeviceCritLvl) or DeviceCritLvl > 0
|        // the device's asset factors -- the set the engine feeds (the device CI evaluation, the report's factors), its question left out
|        | extend DeviceFactorIds = set_difference(coalesce(peer_rf_p, dynamic([])), dynamic([])), DeviceFactorNames = set_difference(coalesce(peer_rf_names, dynamic([])), dynamic([]))
|        | project-away DeviceCiKey, _peerKey, peer_*
|        // the user's CI -- tier, CMDB values and asset risk factors
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        // a Tier 0 ACCOUNT -- the account CI's tier, decided by the identity privilege tier rules (#690 (48), the tier of the
|        // highest privilege it holds today)
|        | extend CriticalityTier = toint(si_tier)
|        | where CriticalityTier == 0
|        | extend CriticalityTierLevel = "Critical - tier 0"
|        | extend SecuritySeverity      = "Medium"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Privileged Access"
|        | extend Subcategory           = "Privileged Access Workstation Compliance"
|        | extend ConfigurationName     = "Tier 0 admin authenticating to non-PAW (tiering violation)"
|        | extend ConfigurationId       = "IDENTITY-DEVICE-003"
|        | extend RF_P_DeviceTier2Plus = iff(isnull(DeviceCritLvl) or DeviceCritLvl >= 2, 1, 0)
|        | extend RF_P_HasCVEs         = iff(HasCVEs == true, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_DeviceTier2Plus + RF_P_HasCVEs + array_length(DeviceFactorIds)
|        | extend RiskFactorIds = strcat_array(DeviceFactorIds, ";")
|        | extend AssetName = coalesce(si_asset_name, UserDisplayName, UserUPN, DeviceKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project TargetAssetId, SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  UserDisplayName, UserUPN, UserNodeId,
|                  DeviceName, DeviceCritLvl, DeviceRiskScore, HasCVEs,
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_NoMFA_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_AnyUser_NoMFA_Summary. All enabled users with no MFA registration, across all tiers. Excludes accounts created within the last 7 days. Severity scales with tier. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for AnyUser NoMFA Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_NoMFA_Detailed
|        // Purpose  Enabled users without MFA registration, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        // #690 (27) -- a user whose MFA registration was not read is LISTED and labelled by its cause, not readable from Entra (ConfigurationName), never dropped
|        | extend _mfaUnknown = isnull(si_mfa_registered) or coalesce(set_has_element(si_unknown_fields, "si_mfa_registered"), false)
|        | where si_mfa_registered == false or _mfaUnknown
|        | where isnull(CreatedDays) or CreatedDays > 7
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = case(CriticalityTier == 0, "Very High", CriticalityTier == 1, "High", CriticalityTier == 2, "Medium", "Low")
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Authentication"
|        | extend Subcategory       = "MFA Registration"
|        | extend ConfigurationName = iff(_mfaUnknown, "User MFA registration not readable from Entra", "User missing MFA registration")
|        | extend ConfigurationId   = "IDENTITY-MFA-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_BreakGlass_Anomaly_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_BreakGlass_Anomaly_Summary. Break-glass emergency access accounts with anomalous sign-in patterns. Detects two opposite problems: (1) Break-glass account used recently (< 30 days) WITHOUT an incident - possible misuse (2) Break-glass account has never been tested OR last test was > 180 days ago Break-glass accounts should only be used in genuine emergencies and tested periodically. Severity: Very High (fixed) - any break-glass anomaly is a critical governance failure. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for BreakGlass Anomaly Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_BreakGlass_Anomaly_Detailed
|        // Purpose  Break-glass accounts used recently, never tested or not tested for 180+ days, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where si_is_break_glass == true
|        // #690 (27) -- a break-glass account whose last sign-in the CI could not decide is LISTED as anomaly NoSignInDataSource (the cause), never dropped
|        | where LastSignInDays <= 30 or LastSignInDays > 180 or LastSignInDays == -1 or isnull(LastSignInDays)
|        | extend CriticalityTier      = 0
|        | extend CriticalityTierLevel = "Critical - tier 0"
|        | extend SecuritySeverity     = "High"
|        | extend AnomalyType =
|            case(isnull(LastSignInDays),                        "NoSignInDataSource",
|                 LastSignInDays >= 0 and LastSignInDays <= 30, "RecentUnexpectedUsage",
|                 LastSignInDays == -1,                          "NeverTested",
|                 "TestingOverdue")
|        // report-scoped flags (this report's own finding)
|        | extend RF_P_RecentUse   = iff(LastSignInDays >= 0 and LastSignInDays <= 30, 1, 0)
|        | extend RF_P_NeverTested = iff(LastSignInDays == -1, 1, 0)
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_RecentUse + RF_P_NeverTested + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["BreakGlassAnomaly"]),
|            iff(RF_P_RecentUse   == 1, dynamic(["RecentUnexpectedUsage"]), dynamic([])),
|            iff(RF_P_NeverTested == 1, dynamic(["NeverTested"]),           dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("BreakGlassAnomaly=1;RecentUnexpectedUsage=", tostring(RF_P_RecentUse),
|                   ";NeverTested=", tostring(RF_P_NeverTested))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Admin Account Hygiene"
|        | extend Subcategory       = "Break-Glass Governance"
|        | extend ConfigurationName = iff(AnomalyType == "NoSignInDataSource", "Break-glass account anomaly: no data source for the last sign-in", strcat("Break-glass account anomaly: ", AnomalyType))
|        | extend ConfigurationId   = "IDENTITY-ADMIN-005"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_BreakGlass_SignIn_Detected_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_BreakGlass_SignIn_Detected_Summary. Any successful sign-in by an account flagged as a break-glass emergency account. Break-glass accounts are only valid for use during genuine catastrophic failures where normal admin access is unavailable. Every sign-in by a break-glass account must be investigated to confirm it was authorised and justified. This is an operational alert that should trigger an immediate review process. Severity: Very High (fixed)  --  all break-glass usage is critical regardless of context. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for BreakGlass SignIn Detected Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_BreakGlass_SignIn_Detected_Detailed
|        // Purpose  Break-glass (emergency-access) accounts, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        // #690 (23) -- the sign-ins themselves (interactive and non-interactive, successful, 30 days) where the tenant sends them to
|        // the workspace. A sign-in with no named location is NOT trusted -- tested on the text, so an empty location list never drops it.
|        let _bgSignIns =
|            union isfuzzy=true (datatable(UserId:string, ResultType:string, TimeGenerated:datetime, IPAddress:string, Location:string, NetworkLocationDetails:string)[]), SigninLogs, AADNonInteractiveUserSignInLogs
|            | where TimeGenerated >= ago(30d)
|            | where tostring(ResultType) == "0"
|            | extend UserKey = tolower(tostring(UserId))
|            | where isnotempty(UserKey)
|            | extend IsTrusted = iff(tostring(NetworkLocationDetails) has "trustedNamedLocation", 1, 0)
|            | summarize SigninCount = count(), LastSignin = max(TimeGenerated),
|                        SigninCountries = strcat_array(make_set(Location, 5), ", "), SigninIPs = strcat_array(make_set(IPAddress, 5), ", "),
|                        NonTrustedSignins = countif(IsTrusted == 0)
|              by UserKey;
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where si_is_break_glass == true
|        // #690 (23) -- the purpose is a break-glass account that SIGNED IN -- a sign-in in the last 30 days, from the sign-in logs, or
|        // from the account's own last sign-in (si_last_sign_in, Entra and Active Directory) when the logs do not hold it
|        | extend UserKey = tolower(si_link_entra)
|        | join kind=leftouter _bgSignIns on UserKey
|        | extend _lastSignInKnown = iff(coalesce(set_has_element(si_unknown_fields, "si_last_sign_in"), false), datetime(null), si_last_sign_in)
|        | where isnotnull(LastSignin) or (isnotnull(_lastSignInKnown) and _lastSignInKnown >= ago(30d))
|        | extend SignInEvidence = iff(isnotnull(LastSignin),
|            strcat(tostring(SigninCount), " successful sign-in(s) in 30 days, last ", format_datetime(LastSignin, "yyyy-MM-dd HH:mm"), " UTC",
|                   iff(isnotempty(SigninIPs), strcat(" from ", SigninIPs), ""), iff(isnotempty(SigninCountries), strcat(" (", SigninCountries, ")"), ""),
|                   iff(NonTrustedSignins > 0, strcat(", ", tostring(NonTrustedSignins), " from a location that is not trusted"), "")),
|            strcat("Last sign-in ", format_datetime(_lastSignInKnown, "yyyy-MM-dd HH:mm"), " UTC (the account's last sign-in in Entra or Active Directory)"))
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Very High"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Sign-in Behaviour"
|        | extend Subcategory           = "Break-Glass Usage"
|        | extend ConfigurationName     = "Break-glass emergency account sign-in detected - immediate review required"
|        | extend ConfigurationId       = "IDENTITY-SIGNIN-008"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence  = 3
|        | extend RiskFactor_Probability  = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["BreakGlassAccount"]),
|            RF_P_CiFactorNames), ";")
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, Impact = SignInEvidence, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Tier = si_tier,
|            MfaIsRegistered = si_mfa_registered, HasPermanentPrivilegedRole,
|            LastSignInDays, EntraRoles_Permanent = si_entra_roles_permanent,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_DisabledAccount_ActivePIMAssignment_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_DisabledAccount_ActivePIMAssignment_Summary. Disabled user accounts that still have PIM eligible role assignments active. When an account is disabled (e.g. employee leaving), all role assignments should be removed as part of the offboarding process. An eligible assignment on a disabled account means the account could be re-enabled and immediately used to activate privileged access  --  a common post-compromise technique. Severity: High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for DisabledAccount ActivePIMAssignment Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_DisabledAccount_ActivePIMAssignment_Detailed
|        // Purpose  Disabled users that still hold a privileged PIM eligible role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where si_account_enabled == false
|        | where IsPrivilegedEligible == true
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium-High"
|        // report-scoped flag (this report's own finding)
|        | extend RF_P_RecentlyDisabled = iff(LastSignInDays between (0 .. 30), 1, 0)
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors) + RF_P_RecentlyDisabled
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["DisabledAccountWithEligibleRole"]),
|            RF_P_CiFactorNames,
|            iff(RF_P_RecentlyDisabled == 1, dynamic(["RecentlyDisabled30days"]),  dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("DisabledAccountWithEligibleRole=1;RecentlyDisabled30days=", tostring(RF_P_RecentlyDisabled))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Identity Lifecycle"
|        | extend Subcategory       = "Offboarding Gaps"
|        | extend ConfigurationName = "Disabled account with active PIM eligible role assignment - offboarding incomplete"
|        | extend ConfigurationId   = "IDENTITY-LIFECYCLE-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_EligibleAdmin_LogonTo_ExploitableDevice_Detailed
|      LookupNeededKeys:
|      - Lookup: _ciPeer
|        Column: _peerKey
|        Keys: |-
|          | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|          | project __siNeeded = pack_array(DeviceCiKey)
|      ReportPurpose: >-
|        Per-row detail view for Identity_EligibleAdmin_LogonTo_ExploitableDevice_Summary. Users with PIM-eligible Tier 0/1 roles authenticated to devices that have vulnerabilities with a known exploit (public, verified or in an exploit kit, as Defender vulnerability management and the Exposure Graph report it). Even if the PIM role is not currently activated, the credential harvested from an exploitable device could be used to activate PIM and gain full admin access. Severity: Very High (fixed) - eligible admin credential on actively exploitable device. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for EligibleAdmin LogonTo ExploitableDevice Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_EligibleAdmin_LogonTo_ExploitableDevice_Detailed
|        // Purpose  Users that can authenticate to a device with a known exploit.
|        // The user-to-device "can authenticate to" edge is an Exposure Graph walk (provider, graph-only).
|        // Both ends take tier, CMDB values and asset risk factors from the CI (_ciLink, REQUIREMENTS #505), joined on
|        // the Entra object id (user) and the Defender device id (device) the graph nodes carry, else the node id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        //__SI_CI_PEER_BEGIN__
|            let _ciPeer =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_machine_risk", "identity_at_risk", "identity_high_blast_radius", "internet_exposed", "known_exploited", "leaked_credentials", "ms_criticality_high", "network_no_user_action", "never_signed_in", "no_mfa", "not_onboarded", "old_account", "old_password", "old_vuln", "overdue", "permanent_privileged_role", "production_environment", "remote_code_execution", "report_scoped", "restricted_data", "stale_sign_in", "unmanaged", "unsupported_os", "zero_day"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_machine_risk": "HighMachineRisk", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "internet_exposed": "InternetExposed", "known_exploited": "KnownExploited", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "network_no_user_action": "NetworkNoUserAction", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "not_onboarded": "NotOnboarded", "old_account": "OldAccount", "old_password": "OldPassword", "old_vuln": "OldVuln", "overdue": "Overdue", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _peerKey = _ciKey, peer_ci_id = _ciId, peer_tier = toint(column_ifexists("si_tier", int(null))),
|                          peer_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), peer_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          peer_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), peer_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          peer_rf_p = si_rf_p, peer_rf_names = si_rf_names_, peer_in_scope = si_in_scope_ and not(_ciOff);
|        //__SI_CI_PEER_END__
|
|        let _devices =
|            ExposureGraphNodes
|            // a device node or a virtual-machine node (the graph ties "can authenticate to" to either)
|            | where NodeLabel in~ ("device", "microsoft.compute/virtualmachines")
|            | extend rawData          = todynamic(NodeProperties.rawData)
|            // the graph's exploit evidence -- the exploitability levels of the device's remote-code-execution and
|            // privilege-escalation CVEs (NoExploit, ExploitIsPublic, ExploitIsVerified, ExploitIsInKit)
|            | extend _xLevels   = strcat(tostring(rawData.highRiskVulnerabilityInsights.vulnerableToRemoteCodeExecution.explotabilityLevels), tostring(rawData.highRiskVulnerabilityInsights.vulnerableToPrivilegeEscalation.explotabilityLevels))
|            | extend IsInKit    = _xLevels has "ExploitIsInKit"
|            | extend IsVerified = _xLevels has "ExploitIsVerified"
|            | extend HasExploit = IsInKit or IsVerified or _xLevels has "ExploitIsPublic"
|            | extend DeviceName       = iff(isnotempty(tostring(rawData.deviceName)), tostring(rawData.deviceName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            | extend MdeDeviceId = tolower(coalesce(extract('"type":"SenseDeviceId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"SenseDeviceId"', 1, _ids)))
|            | project DeviceNodeId = NodeId, MdeDeviceId, DeviceName, HasExploit, IsInKit, IsVerified;
|
|        let _users =
|            ExposureGraphNodes
|            | where NodeLabel == "user"
|            | extend rawData         = todynamic(NodeProperties.rawData)
|            // the graph's user node holds the sign-in name as accountUpn (SI's own eg mapping of si_upn) and the name as
|            // accountDisplayName -- an account without a sign-in name (a gMSA, a sync account) is kept, its UPN empty
|            | extend UserUPN         = tolower(tostring(rawData.accountUpn))
|            | extend UserDisplayName = iff(isnotempty(tostring(rawData.accountDisplayName)), tostring(rawData.accountDisplayName), NodeName)
|            | extend _ids = tostring(EntityIds)
|            // most graph user nodes carry the Entra id as a tenant id and object id pair (TenantId=... ObjectId=...) -- only
|            // the object id is the key the account's CI is linked on (si_link_entra), so the pair joined no CI
|            | extend _aadId          = tolower(coalesce(extract('"type":"AadObjectId","id":"([^"]+)"', 1, _ids), extract('"id":"([^"]+)","type":"AadObjectId"', 1, _ids), tostring(rawData.accountObjectId)))
|            | extend UserEntraId     = iff(_aadId has "objectid=", extract(@'objectid=([0-9a-f-]+)', 1, _aadId), _aadId)
|            // the report's question -- an account Entra lists as eligible for a role through PIM (the graph's eligibleRoles)
|            | where array_length(rawData.eligibleRoles) > 0
|            | project UserNodeId = NodeId, UserEntraId, UserUPN, UserDisplayName;
|
|        // who can authenticate to a device -- the account itself, or a group it is a member of (nested groups followed
|        // five levels deep through the graph's own "member of" edges)
|        let _memberOf = ExposureGraphEdges | where EdgeLabel =~ "member of" | project MemberNodeId = SourceNodeId, GroupNodeId = TargetNodeId;
|        let _auth0 = ExposureGraphEdges | where EdgeLabel =~ "can authenticate to" or EdgeLabel =~ "canAuthenticateTo" | project PrincipalNodeId = SourceNodeId, TargetNodeId;
|        let _auth1 = _memberOf | join kind=inner (_auth0) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth2 = _memberOf | join kind=inner (_auth1) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth3 = _memberOf | join kind=inner (_auth2) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth4 = _memberOf | join kind=inner (_auth3) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _auth5 = _memberOf | join kind=inner (_auth4) on $left.GroupNodeId == $right.PrincipalNodeId | project PrincipalNodeId = MemberNodeId, TargetNodeId;
|        let _authTo = union _auth0, _auth1, _auth2, _auth3, _auth4, _auth5 | project SourceNodeId = PrincipalNodeId, TargetNodeId | distinct SourceNodeId, TargetNodeId;
|        // Defender vulnerability management -- a device with a CVE that has a known exploit (the knowledge base's
|        // IsExploitAvailable), read only for the devices an account can authenticate to
|        let _authTargetMde = _authTo | join kind=inner (_devices) on $left.TargetNodeId == $right.DeviceNodeId | where isnotempty(MdeDeviceId) | distinct MdeDeviceId;
|        let _tvmExploitDevices =
|            DeviceTvmSoftwareVulnerabilities
|            | where tolower(DeviceId) in (_authTargetMde)
|            | join kind=inner (DeviceTvmSoftwareVulnerabilitiesKB | where IsExploitAvailable == true | project CveId) on CveId
|            | project TvmExploitDeviceId = tolower(DeviceId)
|            | where isnotempty(TvmExploitDeviceId)
|            | distinct TvmExploitDeviceId;        _authTo
|        | join kind=inner _users on $left.SourceNodeId == $right.UserNodeId
|        | join kind=inner _devices on $left.TargetNodeId == $right.DeviceNodeId
|        | join kind=leftouter (_tvmExploitDevices) on $left.MdeDeviceId == $right.TvmExploitDeviceId
|        | extend HasExploit = HasExploit or isnotempty(TvmExploitDeviceId)
|        | where HasExploit        // one row per account and machine -- reached directly and through a group, or a machine with a device node and a
|        // virtual-machine node that carry the same Defender device id
|        | extend _machineKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | summarize arg_max(DeviceNodeId, *) by UserNodeId, _machineKey
|        | extend DeviceKey = iif(isnotempty(UserEntraId), UserEntraId, tolower(UserNodeId))
|        //__STALE_DEVICE_FILTER_BEGIN__
|        | where 1 == 1
|        //__STALE_DEVICE_FILTER_END__
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // #677 the device's CI -- its own lookup (_ciPeer), joined here on the device's own key. The rows are sliced on the
|        // USER, so the device's CI is never cut with them -- it travels whole while it fits, else each slice gets only its own
|        // devices (the report field LookupNeededKeys).
|        //__SI_LOOKUP_KEYS_HERE__
|        | extend DeviceCiKey = iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId))
|        | join kind=leftouter (_ciPeer) on $left.DeviceCiKey == $right._peerKey
|        | extend DeviceCiId = peer_ci_id
|        // #690 (17b) the machine is the finding's TARGET -- one finding per account x machine survives the engine's de-duplication
|        | extend TargetAssetId = iif(isnotempty(DeviceCiId), DeviceCiId, iif(isnotempty(MdeDeviceId), MdeDeviceId, tolower(DeviceNodeId)))
|        | project-away DeviceCiKey, _peerKey, peer_*
|        // the user's CI -- tier, CMDB values and asset risk factors
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity      = "High"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Privileged Access"
|        | extend Subcategory           = "Credential Exposure via Device"
|        | extend ConfigurationName     = "PIM-eligible admin authenticated to device with known exploits"
|        | extend ConfigurationId       = "IDENTITY-DEVICE-004"
|        // exploit signals are finding values (Exposure Graph)
|        | extend RF_P_Verified        = iff(IsVerified == true, 1, 0)
|        | extend RF_P_InKit           = iff(IsInKit == true, 1, 0)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_Verified + RF_P_InKit
|        | extend AssetName = coalesce(si_asset_name, UserDisplayName, UserUPN, DeviceKey)
|        | extend AssetId   = iif(isnotempty(si_ci_id), si_ci_id, DeviceKey)
|        | extend AssetType = "Identity"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project TargetAssetId, SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  UserDisplayName, UserUPN, UserNodeId,
|                  DeviceName, HasExploit, IsInKit, IsVerified,
|                  RiskFactor_Consequence, RiskFactor_Probability,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_ExternalUser_PrivilegedRole_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_ExternalUser_PrivilegedRole_Summary. External/B2B guest users with Tier 0/1 Entra ID roles. External identities should never hold privileged directory roles. Their accounts are governed by their home tenant's security posture which may be significantly lower than yours. A compromised partner account with Global Admin in your tenant is a catastrophic risk. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for ExternalUser PrivilegedRole Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_ExternalUser_PrivilegedRole_Detailed
|        // Purpose  Enabled external (guest / B2B) users, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where si_is_external == true or si_external_user_state in ("Accepted", "PendingAcceptance")
|        // #690 (23) -- the purpose is an external user WITH a Tier 0/1 Entra role, permanent or eligible (IsPrivileged above)
|        | where IsPrivileged
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "External Identity Risk"
|        | extend ConfigurationName = "External user with privileged Entra ID role"
|        | extend ConfigurationId   = "IDENTITY-EXT-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_HighMDIInvestigationPriority_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_HighMDIInvestigationPriority_Summary. Active accounts with MDI Investigation Priority Percentile in the top 10% (MDI_InvestigationPriorityPct >= 90). MDI calculates this score based on observed anomalous behaviours, lateral movement signals, unusual access patterns, and UEBA risk scoring. A high investigation priority means MDI has observed behaviour that warrants review. When this is combined with a privileged identity, it represents a potentially active threat that requires immediate attention. Severity: High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for HighMDIInvestigationPriority Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_HighMDIInvestigationPriority_Detailed -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_mdi_investigation_priority_pct, 0) >= 90
|        | where coalesce(si_mdi_investigation_priority_pct, 0) > 0
|
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|
|        | extend RF_P_Top5Pct           = iff(coalesce(si_mdi_investigation_priority_pct, 0) >= 95, 1, 0)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = 1 + RF_P_Top5Pct + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["HighMDIInvestigationPriority"]),
|            iff(RF_P_Top5Pct         == 1, dynamic(["Top5PercentileMDIScore"]), dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("HighMDIInvestigationPriority=1;Top5PercentileMDIScore=", tostring(RF_P_Top5Pct))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Threat Intelligence"
|        | extend Subcategory       = "MDI Behavioural Signals"
|        | extend ConfigurationName = strcat("High MDI investigation priority (top 10%) - anomalous behaviour observed")
|        | extend ConfigurationId   = "IDENTITY-LIFECYCLE-005"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|                | project
|                  SecurityDomain,
|                  Category,
|                  Subcategory,
|                  ConfigurationName,
|                  ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity,
|                  CriticalityTier,
|                  CriticalityTierLevel,
|                  DisplayName = si_display_name,
|                  Upn = si_upn,
|                  PrimaryEntityId = si_ci_id,
|                  Department = si_org_department,
|                  Tier = si_tier,
|                  IsPrivileged,
|                  HasPermanentPrivilegedRole,
|                  IsPrivilegedEligible,
|                  MfaIsRegistered = si_mfa_registered,
|                  AccountEnabled = si_account_enabled,
|                  LastSignInDays,
|                  LastSignInDateTime = si_last_sign_in,
|                  CreatedDays,
|                  EntraRoles_Permanent = si_entra_roles_permanent,
|                  NestedGroups = si_group_memberships,
|                  RiskFactor_Consequence,
|                  RiskFactor_Probability,
|                  RiskFactor_Probability_Detailed, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|                | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_HighValueTarget_MDIRisk_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_HighValueTarget_MDIRisk_Summary. Identities flagged by Microsoft Defender for Identity as high or critical risk, cross-referenced with our asset tier classification. MDI risk signals include observed lateral movement, credential exposure, anomalous behaviour, and UEBA scoring. When a Tier 0/1 identity has elevated MDI risk, it indicates an active or recent threat that requires immediate investigation. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for HighValueTarget MDIRisk Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_HighValueTarget_MDIRisk_Detailed
|        // Purpose  Enabled users that Defender for Identity rates at risk or high risk, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where si_mdi_risk_state in ("high", "at_risk")
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Threat Intelligence"
|        | extend Subcategory       = "MDI Risk Signals"
|        | extend ConfigurationName = "Identity with elevated MDI risk score"
|        | extend ConfigurationId   = "IDENTITY-THREAT-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_MultiTenant_HighPermission_SPN_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_MultiTenant_HighPermission_SPN_Summary. Multi-tenant service principals (accessible from external tenants) with Tier 0/1 permissions. Multi-tenant apps expose credentials and permissions to external party control. If a partner tenant is compromised, the SPN can be leveraged to attack your tenant with full privileges. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for MultiTenant HighPermission SPN Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_directory_write_permissions = dynamic(["Directory.ReadWrite.All"]);
|        let SI_List_high_privilege_app_permissions = dynamic(["RoleManagement.ReadWrite.Directory", "AppRoleAssignment.ReadWrite.All", "Directory.ReadWrite.All", "Application.ReadWrite.All", "Application.ReadWrite.OwnedBy", "Group.ReadWrite.All", "GroupMember.ReadWrite.All", "User.ReadWrite.All", "UserAuthenticationMethod.ReadWrite.All", "Policy.ReadWrite.ConditionalAccess", "Policy.ReadWrite.AuthenticationMethod", "Domain.ReadWrite.All", "IdentityRiskyUser.ReadWrite.All", "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementRBAC.ReadWrite.All", "RoleEligibilitySchedule.ReadWrite.Directory", "RoleAssignmentSchedule.ReadWrite.Directory", "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup", "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup", "RoleManagementPolicy.ReadWrite.Directory", "RoleManagementPolicy.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureAD", "PrivilegedAccess.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureResources", "Mail.ReadWrite", "Mail.Send", "full_access_as_app", "EWS.AccessAsApp", "Files.ReadWrite.All", "Sites.FullControl.All", "Sites.ReadWrite.All", "Exchange.ManageAsApp"]);
|        let SI_List_microsoft_first_party_tenants = dynamic(["f8cdef31-a31e-4b4a-93e4-5f571e91255a", "72f988bf-86f1-41af-91ab-2d7cd011db47"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_MultiTenant_HighPermission_SPN_Detailed
|        // Purpose  Multi-tenant service principals owned by another tenant, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type == "service_principal"
|        | where IsMultiTenant == true
|        // high privilege (the purpose) -- a Tier 0 / 1 application permission (data-model list high_privilege_app_permissions), the privilege tier catalog's high-risk permission, or a Tier 0 / 1 Entra role
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend HighPermissions = set_intersect(_permsD, SI_List_high_privilege_app_permissions)
|        | extend HighPermissions = iff(array_length(HighPermissions) > 0, HighPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_high_privilege_app_permissions)))))
|        | extend _privKnown = isnotnull(si_high_risk_permission_grant) or isnotnull(si_privilege_tier_permanent) or array_length(_permsD) > 0
|        | extend _isPrivileged = array_length(HighPermissions) > 0 or si_high_risk_permission_grant == true or si_privilege_tier_permanent in (0, 1)
|        // a service principal whose permissions SI could not read stays in, labelled -- never dropped as not privileged
|        | where _isPrivileged or not(_privKnown)
|        // Microsoft's own applications are owned by another tenant but are not a partner's -- kept, labelled apart (a view filters them)
|        | extend _isMicrosoft = tolower(si_app_owner_org_id) in (SI_List_microsoft_first_party_tenants)
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // report-scoped flag (this report's own finding)
|        | extend RF_P_HasDirectoryWrite = iff(tostring(si_app_permissions) has_any (SI_List_directory_write_permissions), 1, 0)
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors) + RF_P_HasDirectoryWrite
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            RF_P_CiFactorNames,
|            iff(RF_P_HasDirectoryWrite == 1, dynamic(["HasDirectoryWrite"]),    dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("HasDirectoryWrite=", tostring(RF_P_HasDirectoryWrite))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = iff(_isMicrosoft, "Multi-Tenant Exposure - Microsoft first-party application", "Multi-Tenant Exposure")
|        | extend ConfigurationName = "Multi-tenant SPN with high-privilege permissions"
|        | extend ConfigurationId   = "IDENTITY-SPN-004"
|        | extend _why = array_concat(HighPermissions,
|            iff(si_privilege_tier_permanent in (0, 1), pack_array(strcat("Tier ", tostring(si_privilege_tier_permanent), " Entra role")), dynamic([])),
|            iff(si_high_risk_permission_grant == true and array_length(HighPermissions) == 0, dynamic(["a high-risk application permission"]), dynamic([])))
|        | extend Impact = case(
|            not(_privKnown), strcat("Owned by tenant ", si_app_owner_org_id, " -- SI could not read its permissions, so its privilege is not readable - check it in Entra"),
|            _isMicrosoft, strcat("Microsoft first-party application (owner tenant ", si_app_owner_org_id, ") with high privilege - ", strcat_array(_why, ", ")),
|            strcat("Application owned by another organisation (owner tenant ", si_app_owner_org_id, ") with high privilege - ", strcat_array(_why, ", ")))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_ci_id,
|            ObjectType = si_identity_type, ServicePrincipalType = si_sp_type, Tier = si_tier,
|            AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days, IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity, IsMultiTenant, PublisherVerified,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_NewAccount_ImmediateTier0Role_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_NewAccount_ImmediateTier0Role_Summary. User accounts created within the last 24 hours that already have a Tier 0 Entra ID role assigned. In a healthy environment, newly created accounts go through a provisioning workflow and role assignments require approval. Immediate Tier 0 role on a brand-new account indicates either a provisioning process bypass, a compromised privileged account creating rogue admin accounts, or a misconfigured automation script with excessive initial permissions. Severity: Very High (fixed)  --  immediate Tier 0 access on new account. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for NewAccount ImmediateTier0Role Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_NewAccount_ImmediateTier0Role_Detailed
|        // Purpose  Enabled tier 0 users created within the last day, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        // a Tier 0 ROLE (permanent or eligible -- the identity's role tier), or an account SI rates Tier 0
|        | where si_privilege_tier_permanent == 0 or si_privilege_tier_eligible == 0 or si_tier == 0
|        | where CreatedDays == 0
|        | extend CriticalityTier      = 0
|        | extend CriticalityTierLevel = "Critical - tier 0"
|        | extend SecuritySeverity = "Very High"
|        // report-scoped flag (this report's own finding)
|        | extend RF_P_AlreadySignedIn = iff(LastSignInDays == 0, 1, 0)
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors) + RF_P_AlreadySignedIn
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["ImmediateTier0OnNewAccount"]),
|            RF_P_CiFactorNames,
|            iff(RF_P_AlreadySignedIn == 1, dynamic(["AlreadySignedInToday"]),    dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("ImmediateTier0OnNewAccount=1;AlreadySignedInToday=", tostring(RF_P_AlreadySignedIn))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Identity Lifecycle"
|        | extend Subcategory       = "Provisioning Anomalies"
|        | extend ConfigurationName = "Account created < 24 hours ago already has Tier 0 role - possible rogue admin"
|        | extend ConfigurationId   = "IDENTITY-LIFECYCLE-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PIM_DuplicateRoleAssignment_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_PIM_DuplicateRoleAssignment_Summary. Users who have the same Entra ID role assigned both permanently AND as PIM eligible. This is a misconfiguration: the permanent assignment makes the PIM eligible one redundant and indicates the PIM policy was not followed. The permanent assignment should be removed and only the PIM eligible retained. Severity: Medium-High (fixed) - redundant permanent assignment defeats PIM purpose. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for PIM DuplicateRoleAssignment Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PIM_DuplicateRoleAssignment_Detailed
|        // Purpose  Enabled users holding the same privileged role permanently and through PIM, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        // the same role held both as an active assignment (permanent or time-bound -- every active assignment that is not a
|        // PIM activation, as Entra lists it) and as a PIM eligibility -- whatever the role's tier
|        | extend _rolesPermanent = iff(gettype(si_entra_roles_permanent) == "array", si_entra_roles_permanent, iff(isempty(tostring(si_entra_roles_permanent)), dynamic([]), pack_array(tostring(si_entra_roles_permanent))))
|        | extend _rolesEligible  = iff(gettype(si_entra_roles_eligible) == "array", si_entra_roles_eligible, iff(isempty(tostring(si_entra_roles_eligible)), dynamic([]), pack_array(tostring(si_entra_roles_eligible))))
|        | where array_length(set_intersect(_rolesPermanent, _rolesEligible)) > 0
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium-High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 1
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["DuplicateRoleAssignment"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("DuplicateRoleAssignment=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "PIM Hygiene"
|        | extend ConfigurationName = "Duplicate role assignment - permanent and eligible overlap for same role"
|        | extend ConfigurationId   = "IDENTITY-PIM-003"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PIM_EligibleNeverActivated_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_PIM_EligibleNeverActivated_Summary. Users with PIM-eligible Tier 0/1 role assignments that have never been activated (no interactive sign-in with the role active). Eligible roles that are never used suggest the assignment is unnecessary and should be removed to reduce blast radius. This also applies to identities with eligible roles but no sign-in at all. Severity: Medium (fixed) - eligible roles are safer than permanent but unused assignments still represent unnecessary standing access that should be cleaned up. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for PIM EligibleNeverActivated Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PIM_EligibleNeverActivated_Detailed
|        // Purpose  Enabled users with a privileged PIM eligible role and no sign-in for 180+ days, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where IsPrivilegedEligible == true
|        | where IsPrivileged == false or HasPermanentPrivilegedRole == false
|        | where LastSignInDays > 180 or LastSignInDays == -1
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 1
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "PIM Hygiene"
|        | extend ConfigurationName = "PIM eligible role never activated in 180+ days - unnecessary assignment"
|        | extend ConfigurationId   = "IDENTITY-PIM-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PasswordNeverExpires_Privileged_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_PasswordNeverExpires_Privileged_Summary. Privileged accounts with password-never-expires flag set. While passwordless and MFA mitigate this, a non-expiring password on a privileged account means a compromised credential remains valid indefinitely. Combined with no MFA or stale sign-in, this represents a critical unmanaged risk. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for PasswordNeverExpires Privileged Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PasswordNeverExpires_Privileged_Detailed -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        // privileged = a Tier 0/1 Entra role (permanent or eligible) or membership of a critical Active Directory group (#690 (23))
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1 or coalesce(array_length(iff(gettype(si_ad_critical_groups) == "dictionary", si_ad_critical_groups.data, si_ad_critical_groups)), 0) > 0)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        // an UNKNOWN never-expires flag (no source could read it, e.g. a synced account) is listed and labelled
|        // PasswordNeverExpiresNoDataSource (the cause), never dropped
|        | extend _pneUnknown = isnull(si_password_never_expires) or set_has_element(si_unknown_fields, "si_password_never_expires")
|        | where coalesce(si_password_never_expires, false) == true or _pneUnknown
|        | extend si_rf_names_ = iff(_pneUnknown, array_concat(coalesce(si_rf_names_, dynamic([])), dynamic(["PasswordNeverExpiresNoDataSource"])), si_rf_names_)
|        | where coalesce(si_passwordless_only, false) == false
|        // #690 (23) -- the purpose is PRIVILEGED accounts (IsPrivileged above)
|        | where IsPrivileged
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Password Policy"
|        | extend Subcategory       = "Password Never Expires"
|        | extend ConfigurationName = "Privileged account with password-never-expires"
|        | extend ConfigurationId   = "IDENTITY-PWD-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|                | project
|                  SecurityDomain,
|                  Category,
|                  Subcategory,
|                  ConfigurationName,
|                  ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity,
|                  CriticalityTier,
|                  CriticalityTierLevel,
|                  DisplayName = si_display_name,
|                  Upn = si_upn,
|                  PrimaryEntityId = si_ci_id,
|                  Department = si_org_department,
|                  Tier = si_tier,
|                  IsPrivileged,
|                  HasPermanentPrivilegedRole,
|                  IsPrivilegedEligible,
|                  MfaIsRegistered = si_mfa_registered,
|                  AccountEnabled = si_account_enabled,
|                  LastSignInDays,
|                  LastSignInDateTime = si_last_sign_in,
|                  CreatedDays,
|                  EntraRoles_Permanent = si_entra_roles_permanent,
|                  NestedGroups = si_group_memberships,
|                  RiskFactor_Consequence,
|                  RiskFactor_Probability,
|                  RiskFactor_Probability_Detailed, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|                | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PermanentPrivilegedRole_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_PermanentPrivilegedRole_Summary. Privileged users with permanent (non-PIM) role assignments. Best practice requires all Tier 0/1 roles to be assigned via PIM (just-in-time) to reduce the standing attack surface. Permanent assignments mean the role is always active, even when not in use, providing a persistent target for attackers. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for PermanentPrivilegedRole Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PermanentPrivilegedRole_Detailed
|        // Purpose  Enabled users with a permanent privileged role (PIM not used), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays    = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged         = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where HasPermanentPrivilegedRole == true
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "Just-In-Time Access"
|        | extend ConfigurationName = "Permanent privileged role assignment - PIM not used"
|        | extend ConfigurationId   = "IDENTITY-PIM-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled,
|            LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedUser_StalePassword_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_PrivilegedUser_StalePassword_Summary. Privileged accounts whose password has not been changed in over 365 days. Long-lived passwords increase the window of exploitation if credentials were exposed in a breach that was never detected. Applies to accounts where password authentication is still a factor (non-passwordless-only accounts). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for PrivilegedUser StalePassword Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedUser_StalePassword_Detailed -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_passwordless_only, false) == false
|        // an UNKNOWN password age (no date from any source) is listed and labelled PasswordAgeNoDataSource (the cause), never dropped
|        | extend _pwAgeUnknown = isnull(PasswordLastChangedDays) and not(set_has_element(si_rf_p, "old_password"))
|        | where set_has_element(si_rf_p, "old_password") or _pwAgeUnknown
|        // the report's question is a privileged ROLE -- the identity's role tier (a Tier 0 / Tier 1 Entra role held
|        // permanently or eligible) decides, and the account's own tier still counts (never fewer rows than before)
|        | extend _roleTier = min_of(coalesce(si_privilege_tier_permanent, 99), coalesce(si_privilege_tier_eligible, 99))
|        | where _roleTier <= 1 or isnull(si_tier) or si_tier in (0, 1)
|        | extend CriticalityTier = toint(case(isnull(si_tier) and _roleTier > 3, int(null), isnull(si_tier), _roleTier, _roleTier > 3, toint(si_tier), min_of(_roleTier, toint(si_tier))))
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        | extend _pwOver730       = iff(PasswordLastChangedDays > 730, 1, 0)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = _pwOver730 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            iff(_pwOver730      == 1, dynamic(["PasswordOver730Days"]),    dynamic([])),
|            iff(_pwAgeUnknown, dynamic(["PasswordAgeNoDataSource"]), dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("PasswordOver730Days=", tostring(_pwOver730))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Password Policy"
|        | extend Subcategory       = "Stale Passwords"
|        | extend ConfigurationName = "Privileged user with password unchanged for 365+ days"
|        | extend ConfigurationId   = "IDENTITY-PWD-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|                | project
|                  SecurityDomain,
|                  Category,
|                  Subcategory,
|                  ConfigurationName,
|                  ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity,
|                  CriticalityTier,
|                  CriticalityTierLevel,
|                  DisplayName = si_display_name,
|                  Upn = si_upn,
|                  PrimaryEntityId = si_ci_id,
|                  Department = si_org_department,
|                  Tier = si_tier,
|                  IsPrivileged,
|                  HasPermanentPrivilegedRole,
|                  IsPrivilegedEligible,
|                  MfaIsRegistered = si_mfa_registered,
|                  AccountEnabled = si_account_enabled,
|                  LastSignInDays,
|                  LastSignInDateTime = si_last_sign_in,
|                  CreatedDays,
|                  EntraRoles_Permanent = si_entra_roles_permanent,
|                  NestedGroups = si_group_memberships,
|                  RiskFactor_Consequence,
|                  RiskFactor_Probability,
|                  RiskFactor_Probability_Detailed, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|                | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_AppRoleAssignmentWrite_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_SPN_AppRoleAssignmentWrite_Summary. Service Principals with AppRoleAssignment.ReadWrite.All permission. This allows the SPN to grant any Graph application permission to any other SPN, including granting itself Global Admin-equivalent permissions such as RoleManagement.ReadWrite.Directory or Directory.ReadWrite.All. A compromised SPN with this permission can bootstrap full tenant takeover in two API calls: grant itself dangerous permissions, then use them. Severity: Very High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for SPN AppRoleAssignmentWrite Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_app_role_assignment_write_permissions = dynamic(["AppRoleAssignment.ReadWrite.All"]);
|        let SI_List_directory_write_permissions = dynamic(["Directory.ReadWrite.All"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_AppRoleAssignmentWrite_Detailed
|        // Purpose  Enabled service principals / managed identities holding AppRoleAssignment.ReadWrite.All, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type in ("service_principal", "managed_identity")
|        // the permissions this report is about (its own list only), matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MatchedPermissions = set_intersect(_permsD, SI_List_app_role_assignment_write_permissions)
|        | extend MatchedPermissions = iff(array_length(MatchedPermissions) > 0, MatchedPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_app_role_assignment_write_permissions)))))
|        | where array_length(MatchedPermissions) > 0
|        // the tier is the CI's (its rules), never a constant -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier      = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "Very High"
|        | extend Impact = strcat("Holds ", strcat_array(MatchedPermissions, ", "), " -- can grant any application permission to any application, itself included")
|        // report-scoped flag (this report's own finding)
|        | extend RF_P_AlsoHasDirectoryWrite = iff(tostring(si_app_permissions) has_any (SI_List_directory_write_permissions), 1, 0)
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + RF_P_AlsoHasDirectoryWrite + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["AppRoleAssignmentWritePermission"]),
|            iff(RF_P_AlsoHasDirectoryWrite == 1, dynamic(["AlsoHasDirectoryWrite"]), dynamic([])),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("AppRoleAssignmentWritePermission=1;AlsoHasDirectoryWrite=", tostring(RF_P_AlsoHasDirectoryWrite))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privilege Escalation Paths"
|        | extend Subcategory       = "Permission Escalation"
|        | extend ConfigurationName = "SPN with AppRoleAssignment.ReadWrite.All - can grant any Graph permission to any app"
|        | extend ConfigurationId   = "IDENTITY-ESCALATION-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_ci_id,
|            ObjectType = si_identity_type, ServicePrincipalType = si_sp_type, Tier = si_tier,
|            AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days, IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity, IsMultiTenant, PublisherVerified,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_ExpiringCredentials_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_SPN_ExpiringCredentials_Summary. Service Principals with client secrets or certificates that have expired or will expire within 30 days. Expired credentials cause service outages. Credentials expiring on privileged SPNs are especially urgent as emergency secret rotation under pressure increases risk of mistakes or insecure handling. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for SPN ExpiringCredentials Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_ExpiringCredentials_Detailed
|        // Purpose  Service principals / managed identities with expired or expiring credentials, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | where si_credential_expiry_days between (-3650 .. 30)
|        | extend ExpiryDays = si_credential_expiry_days
|        | extend HasExpired = si_credential_expiry_days < 0
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Credential Hygiene"
|        | extend ConfigurationName = "SPN with expired or expiring credentials"
|        | extend ConfigurationId   = "IDENTITY-SPN-002"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | extend si_fix_remediation = iff(isempty(si_credential_fix), "", strcat(si_credential_fix, iff(isempty(si_owner), " No owner is recorded for this application, so assign one before rotating.", strcat(" Owner to contact - ", si_owner, "."))))
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_ci_id,
|            ObjectType = si_identity_type, ServicePrincipalType = si_sp_type, Tier = si_tier,
|            AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days, IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity, IsMultiTenant, PublisherVerified,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor,
|            si_owner, si_owner_upns, si_credentials, si_attached_resource, si_fix_remediation
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_MailboxAccess_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_SPN_MailboxAccess_Summary. Service Principals with mailbox-level Microsoft Graph permissions (Mail.ReadWrite, Mail.Send, MailboxSettings.ReadWrite or equivalent). These permissions allow an app to read all email in the organisation or send as any user - a high-value target for data exfiltration and business email compromise (BEC). SPNs with mailbox access and no active usage are especially concerning. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for SPN MailboxAccess Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_mail_access_permissions = dynamic(["Mail.Read", "Mail.ReadWrite", "Mail.Send", "Mail.ReadBasic", "Mail.ReadBasic.All", "Mail-Advanced.ReadWrite.All", "MailboxSettings.ReadWrite", "MailboxItem.Read.All", "MailboxItem.ImportExport.All", "MailboxFolder.Read.All", "MailboxFolder.ReadWrite.All", "Mailbox.Migration", "full_access_as_app", "EWS.AccessAsApp", "EWS.AccessAsUser.All"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_MailboxAccess_Detailed
|        // Purpose  Enabled service principals / managed identities with organisation-wide mailbox permissions, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type in ("service_principal", "managed_identity")
|        // every mail / mailbox application permission (data-model list mail_access_permissions), matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MatchedPermissions = set_intersect(_permsD, SI_List_mail_access_permissions)
|        | extend MatchedPermissions = iff(array_length(MatchedPermissions) > 0, MatchedPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_mail_access_permissions)))))
|        | where array_length(MatchedPermissions) > 0
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend Impact = strcat("Mail permissions held - ", strcat_array(MatchedPermissions, ", "))
|        | extend SecuritySeverity = "Low"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier <= 1, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Overprivileged Applications"
|        | extend ConfigurationName = "SPN with organisation-wide mailbox access"
|        | extend ConfigurationId   = "IDENTITY-SPN-005"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_ci_id,
|            ObjectType = si_identity_type, ServicePrincipalType = si_sp_type, Tier = si_tier,
|            AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days, IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity, IsMultiTenant, PublisherVerified,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_Orphan_NoOwner_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_SPN_Orphan_NoOwner_Summary. Service Principals with no registered owner. Ownerless SPNs have no accountability for credential rotation, permission review, or decommissioning. Privileged orphaned SPNs are critical: no one is responsible for monitoring or revoking access. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for SPN Orphan NoOwner Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_Orphan_NoOwner_Detailed
|        // Purpose  Service principals without a registered owner, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type == "service_principal"
|        | where si_is_orphan_sp == true
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Low"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, CriticalityTier == 1, 2, 1)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Orphaned Applications"
|        | extend ConfigurationName = "Service principal with no registered owner"
|        | extend ConfigurationId   = "IDENTITY-SPN-003"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | extend si_fix_remediation = strcat("Assign at least two owners to the application ", coalesce(si_display_name, si_asset_name), iff(isempty(si_app_id), "", strcat(" (application id ", si_app_id, ")")), " in Entra ID, on the service principal or on its app registration. If nobody needs it, disable it and then delete it.", iff(isnull(si_last_sign_in), " No sign-in is recorded for it.", strcat(" Its last sign-in was ", format_datetime(si_last_sign_in, "yyyy-MM-dd"), ".")))
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_ci_id,
|            ObjectType = si_identity_type, ServicePrincipalType = si_sp_type, Tier = si_tier,
|            AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days, IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity, IsMultiTenant, PublisherVerified,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor,
|            si_owner, si_owner_upns, si_credentials, si_attached_resource, si_fix_remediation
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_OverCredentialed_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_SPN_OverCredentialed_Summary. Service Principals that have both a client secret AND a certificate registered. Over-credentialed SPNs increase the credential attack surface - two different authentication paths must both be managed and rotated. Often indicates legacy credentials were not cleaned up when the SPN was migrated to certificate auth. Severity: Medium (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for SPN OverCredentialed Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_OverCredentialed_Detailed
|        // Purpose  Service principals with credentials expiring within 30 days or expired, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type == "service_principal"
|        // both kinds of credential registered (the purpose) -- every secret and certificate of the principal and of its application registration, in any state
|        | extend _creds = coalesce(todynamic(tostring(si_credentials)), dynamic([]))
|        | mv-apply _cr = _creds to typeof(dynamic) on (summarize SecretCount = countif(tostring(_cr.type) == "secret"), CertificateCount = countif(tostring(_cr.type) == "certificate"))
|        | where SecretCount > 0 and CertificateCount > 0
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 1
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["BothSecretAndCert"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("BothSecretAndCert=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Workload Identities"
|        | extend Subcategory       = "Credential Hygiene"
|        | extend ConfigurationName = "SPN with both client secret and certificate - over-credentialed"
|        | extend ConfigurationId   = "IDENTITY-SPN-006"
|        | extend Impact = strcat(SecretCount, " client secret(s) and ", CertificateCount, " certificate(s) registered (a SAML signing certificate counts too) -- remove the kind it no longer uses")
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | extend si_fix_remediation = iff(isempty(si_credential_fix), "", strcat(si_credential_fix, iff(isempty(si_owner), " No owner is recorded for this application, so assign one before rotating.", strcat(" Owner to contact - ", si_owner, "."))))
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_ci_id,
|            ObjectType = si_identity_type, ServicePrincipalType = si_sp_type, Tier = si_tier,
|            AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days, IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity, IsMultiTenant, PublisherVerified,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor,
|            si_owner, si_owner_upns, si_credentials, si_attached_resource, si_fix_remediation
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_remediation <- si_fix_remediation, si_fix_remediation <- si_fix_remediation, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_PrivilegedAccessWrite_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_SPN_PrivilegedAccessWrite_Summary. Service Principals with a permission that writes Privileged Identity Management directly -- RoleEligibilitySchedule / RoleAssignmentSchedule .ReadWrite.Directory, PrivilegedEligibilitySchedule / PrivilegedAssignmentSchedule .ReadWrite.AzureADGroup, RoleManagementPolicy.ReadWrite.*, or the legacy PrivilegedAccess.ReadWrite.AzureAD / AzureADGroup / AzureResources. This allows the SPN to directly create, modify, or remove PIM role eligibility and assignment schedules. A compromised SPN with this permission can make any account permanently eligible for Global Administrator with no approval workflow, or remove existing PIM assignments to cover tracks. Severity: Very High (fixed)  --  direct PIM manipulation capability. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for SPN PrivilegedAccessWrite Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_pim_write_permissions = dynamic(["RoleEligibilitySchedule.ReadWrite.Directory", "RoleAssignmentSchedule.ReadWrite.Directory", "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup", "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup", "RoleManagementPolicy.ReadWrite.Directory", "RoleManagementPolicy.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureAD", "PrivilegedAccess.ReadWrite.AzureADGroup", "PrivilegedAccess.ReadWrite.AzureResources"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_PrivilegedAccessWrite_Detailed
|        // Purpose  Enabled service principals / managed identities holding PrivilegedAccess.ReadWrite (PIM manipulation), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type in ("service_principal", "managed_identity")
|        // every permission that writes PIM directly (data-model list pim_write_permissions -- the current schedule and policy permissions and the legacy PrivilegedAccess ones), matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MatchedPermissions = set_intersect(_permsD, SI_List_pim_write_permissions)
|        | extend MatchedPermissions = iff(array_length(MatchedPermissions) > 0, MatchedPermissions, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_pim_write_permissions)))))
|        | where array_length(MatchedPermissions) > 0
|        // the tier is the CI's (its rules), never a constant -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier      = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "Very High"
|        | extend Impact = strcat("Holds ", strcat_array(MatchedPermissions, ", "), " -- can create, change or remove PIM eligibilities, assignments or their policies directly")
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["PIMManipulationPermission"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("PIMManipulationPermission=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privilege Escalation Paths"
|        | extend Subcategory       = "PIM Abuse"
|        | extend ConfigurationName = "SPN with PrivilegedAccess.ReadWrite - can create/modify PIM assignments directly"
|        | extend ConfigurationId   = "IDENTITY-ESCALATION-005"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_ci_id,
|            ObjectType = si_identity_type, ServicePrincipalType = si_sp_type, Tier = si_tier,
|            AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days, IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity, IsMultiTenant, PublisherVerified,
|            RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_RoleManagementWrite_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_SPN_RoleManagementWrite_Summary. Service Principals with the RoleManagement.ReadWrite.Directory Graph permission. This permission allows the SPN to assign ANY Entra ID role to ANY principal, including Global Administrator. A compromised SPN with this permission can immediately elevate any account to full tenant administrator  --  the equivalent of a skeleton key to the entire Entra ID tenant. This is arguably the most dangerous single Graph permission that exists. Severity: Very High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for SPN RoleManagementWrite Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_role_management_write_permissions = dynamic(["RoleManagement.ReadWrite.Directory"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_RoleManagementWrite_Detailed
|        // Purpose  Enabled service principals / managed identities that can write directory role assignments, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend CreatedDays       = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays    = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant     = si_is_third_party_multitenant
|        | extend PublisherVerified = si_publisher_verified
|        | where si_identity_type in ("service_principal", "managed_identity")
|        // the permissions this report is about (its own list only), matched exactly and without regard to case
|        | extend _perms = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MatchedPermissions = set_intersect(_perms, SI_List_role_management_write_permissions)
|        | extend MatchedPermissions = iff(array_length(MatchedPermissions) > 0, MatchedPermissions, set_intersect(todynamic(tolower(tostring(_perms))), todynamic(tolower(tostring(SI_List_role_management_write_permissions)))))
|        | where array_length(MatchedPermissions) > 0
|        // the tier is the CI's (its rules), never a constant -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier      = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = "Very High"
|        | extend Impact = strcat("Holds ", strcat_array(MatchedPermissions, ", "), " -- can assign any Entra role to any account, Global Administrator included")
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)
|        | extend RiskFactor_Consequence = 3
|        | extend RiskFactor_Consequence_Detailed = "DomainTakeoverPotential;AnyEntraRoleAssignable;GlobalAdminGrantable"
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["RoleManagementWritePermission"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("RoleManagementWritePermission=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privilege Escalation Paths"
|        | extend Subcategory       = "Role Assignment Abuse"
|        | extend ConfigurationName = "SPN with RoleManagement.ReadWrite.Directory - can grant Global Admin to any account"
|        | extend ConfigurationId   = "IDENTITY-ESCALATION-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_asset_name, si_display_name, si_upn, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName, AssetId, AssetType, Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, AppId = si_app_id, PrimaryEntityId = si_ci_id,
|            ObjectType = si_identity_type, ServicePrincipalType = si_sp_type, Tier = si_tier,
|            AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions, EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days, IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity, IsMultiTenant, PublisherVerified,
|            RiskFactor_Consequence, RiskFactor_Consequence_Detailed, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_UnverifiedPublisher_HighPermission_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_SPN_UnverifiedPublisher_HighPermission_Summary. Service Principals with Tier 0/1 permissions whose publisher has not been verified by Microsoft. Unverified publishers are anonymous  --  there is no accountability for the code running in your tenant. High-privilege unverified apps represent a supply chain risk: the app developer could push malicious updates, and there is no way to validate the publisher's identity or intent. Severity: High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for SPN UnverifiedPublisher HighPermission Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_directory_write_permissions = dynamic(["Directory.ReadWrite.All"]);
|        let SI_List_microsoft_first_party_tenants = dynamic(["f8cdef31-a31e-4b4a-93e4-5f571e91255a", "72f988bf-86f1-41af-91ab-2d7cd011db47"]);
|        let SI_List_role_assignment_write_permissions = dynamic(["RoleManagement.ReadWrite.Directory", "AppRoleAssignment.ReadWrite.All"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_UnverifiedPublisher_HighPermission_Detailed
|        // Purpose  Enabled service principals whose publisher is not verified, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type == "service_principal"
|        | where si_publisher_verified == false
|        // Microsoft's own apps are not a supply-chain risk (and are never "verified" -- Graph leaves them without a verified publisher)
|        | where not(si_app_owner_org_id in (SI_List_microsoft_first_party_tenants))
|        // Tier 0/1 high permission = an application permission or role the privilege tier catalog rates high risk, or a permanent Tier 0/1 role
|        | where si_high_risk_permission_grant == true or si_privilege_tier_permanent in (0, 1)
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend IsManagedIdentity = (si_identity_type == "managed_identity")
|        | extend IsMultiTenant = si_is_multitenant_app
|        | extend PublisherVerified = si_publisher_verified
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "High"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        // report-scoped flags -- application permissions by name
|        | extend RF_P_HasRoleWrite = iff(tostring(si_app_permissions) has_any (SI_List_role_assignment_write_permissions), 1, 0)
|        | extend RF_P_HasDirWrite = iff(tostring(si_app_permissions) has_any (SI_List_directory_write_permissions), 1, 0)
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors) + RF_P_HasRoleWrite + RF_P_HasDirWrite
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["UnverifiedPublisher"]),
|            RF_P_CiFactorNames,
|            iff(RF_P_HasRoleWrite == 1, dynamic(["HasRoleWrite"]),        dynamic([])),
|            iff(RF_P_HasDirWrite  == 1, dynamic(["HasDirectoryWrite"]),   dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("UnverifiedPublisher=1;HasRoleWrite=", tostring(RF_P_HasRoleWrite), ";HasDirectoryWrite=", tostring(RF_P_HasDirWrite))
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privilege Escalation Paths"
|        | extend Subcategory       = "Supply Chain Risk"
|        | extend ConfigurationName = "Unverified-publisher SPN with Tier 0/1 Graph permissions"
|        | extend ConfigurationId   = "IDENTITY-ESCALATION-006"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_app_id, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, si_identity_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            Subcategory,
|            ConfigurationName,
|            ConfigurationId,
|            AssetName,
|            AssetId,
|            AssetType,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            DisplayName = si_display_name,
|            AppId = si_app_id,
|            PrimaryEntityId = si_link_entra,
|            ObjectType = si_identity_type,
|            ServicePrincipalType = si_sp_type,
|            Tier = si_tier,
|            AccountEnabled = si_account_enabled,
|            LastSignInDays,
|            LastSignInDateTime = si_last_sign_in,
|            CreatedDays,
|            EntraAppPermissions_Application = si_app_permissions,
|            EntraRoles_Permanent = si_entra_roles_permanent,
|            CredentialExpiryDays = si_credential_expiry_days,
|            IsOrphanSPN = si_is_orphan_sp,
|            IsManagedIdentity,
|            IsMultiTenant,
|            PublisherVerified,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_ServiceAccount_InteractiveSignIn_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_ServiceAccount_InteractiveSignIn_Summary. Accounts classified by MDI as service accounts (MDI_IsServiceAccount = true) that have interactive human sign-ins recorded in SigninLogs. Service accounts should authenticate exclusively via non-interactive flows (daemon credentials, managed identity, service principal). Interactive logins indicate the service account credentials are being used by a human  --  either a shared password problem, a developer using service credentials to bypass controls, or a threat actor who harvested the credentials and is performing hands-on-keyboard activity. Severity: High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for ServiceAccount InteractiveSignIn Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_ServiceAccount_InteractiveSignIn_Detailed -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_is_service_account, false) == true
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity      = "Medium-High"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Identity Lifecycle"
|        | extend Subcategory           = "Service Account Misuse"
|        | extend ConfigurationName     = "Service account has interactive sign-ins - credential shared or harvested"
|        | extend ConfigurationId       = "IDENTITY-LIFECYCLE-003"
|        | extend RiskFactor_Consequence  = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability  = 1
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["ServiceAccountInteractiveLogin"])), ";")
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Tier = si_tier, MfaIsRegistered = si_mfa_registered, HasPermanentPrivilegedRole,
|                  LastSignInDays, EntraRoles_Permanent = si_entra_roles_permanent, RiskFactor_Consequence, RiskFactor_Probability,
|                  RiskFactor_Probability_Detailed,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_ServiceAccount_SignIn_NonTrustedLocation_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_ServiceAccount_SignIn_NonTrustedLocation_Summary. Accounts classified as service accounts by MDI (MDI_IsServiceAccount = true) that have successfully authenticated from non-trusted network locations. Service accounts are expected to authenticate exclusively from known, trusted infrastructure (application servers, automation agents). Authentication from an untrusted location strongly suggests the service account credentials have been harvested and are being used by a threat actor. Severity: High (fixed). Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for ServiceAccount SignIn NonTrustedLocation Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_ServiceAccount_SignIn_NonTrustedLocation_Detailed -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        | where coalesce(si_is_service_account, false) == true
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity      = "High"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Sign-in Behaviour"
|        | extend Subcategory           = "Location Anomalies"
|        | extend ConfigurationName     = "Service account authenticated from non-trusted network location"
|        | extend ConfigurationId       = "IDENTITY-SIGNIN-002"
|        | extend RiskFactor_Consequence  = 2
|        | extend RiskFactor_Probability  = 1
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["NonTrustedLocationSignin"])), ";")
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_ci_id, Tier = si_tier, MfaIsRegistered = si_mfa_registered, HasPermanentPrivilegedRole,
|                  LastSignInDays, EntraRoles_Permanent = si_entra_roles_permanent, RiskFactor_Consequence, RiskFactor_Probability,
|                  RiskFactor_Probability_Detailed,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_ShadowAdmin_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_ShadowAdmin_Summary. Users classified as shadow admins: they hold Tier 0/1 AD group membership (e.g. Domain Admins inherited via group nesting) but have no visible Entra ID role assignments. These accounts exercise privileged AD access that may not be tracked by standard Entra ID governance tooling, creating a blind spot in access reviews and PIM coverage. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for ShadowAdmin Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_ShadowAdmin_Detailed -- the identity comes from the CI (SI_CI_CL), REQUIREMENTS #505.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend PasswordLastChangedDays = iff(isnull(si_password_last_changed) or set_has_element(si_unknown_fields, "si_password_last_changed"), long(null), datetime_diff('day', now(), si_password_last_changed))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where si_identity_type in ("user", "guest")
|        // #690 (29) -- a shadow admin is read from the CI fields -- critical AD group membership (si_ad_critical_groups, from the
|        // Exposure Graph and Defender for Identity) and NO Entra role, permanent or eligible. The profile flag si_is_shadow_admin
|        // is still honoured, but it is never set for an AD-only account (no Entra record) -- exactly the shadow admins.
|        // A dictionary-shaped value (type + data) is read through .data, and a missing role list is no role
|        // (array_length of null is null, never 0).
|        | extend _critAdGroups = iff(gettype(si_ad_critical_groups) == "dictionary", si_ad_critical_groups.data, si_ad_critical_groups)
|        | extend _hasCritAdGroup = coalesce(array_length(_critAdGroups), 0) > 0
|        | extend _entraRoleCount = coalesce(array_length(si_entra_roles_permanent), 0) + coalesce(array_length(si_entra_roles_eligible), 0)
|        | where coalesce(si_is_shadow_admin, false) == true or (_hasCritAdGroup and _entraRoleCount == 0)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Medium"
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Consequence = case(CriticalityTier == 0, 3, 2)
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Privileged Access"
|        | extend Subcategory       = "Shadow Admins"
|        | extend ConfigurationName = "Shadow admin - privileged AD access not visible in Entra ID"
|        | extend ConfigurationId   = "IDENTITY-SHADOW-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, "Identity")
|        | extend
|            cmdbId            = si_cmdb_id,
|            cmdbName            = si_cmdb_name,
|            cmdbCriticality     = si_cmdb_criticality,
|            cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|                | project
|                  SecurityDomain,
|                  Category,
|                  Subcategory,
|                  ConfigurationName,
|                  ConfigurationId,
|                  AssetName,
|                  AssetId,
|                  AssetType,
|                  SecuritySeverity,
|                  CriticalityTier,
|                  CriticalityTierLevel,
|                  DisplayName = si_display_name,
|                  Upn = si_upn,
|                  PrimaryEntityId = si_ci_id,
|                  Department = si_org_department,
|                  Tier = si_tier,
|                  IsPrivileged,
|                  HasPermanentPrivilegedRole,
|                  IsPrivilegedEligible,
|                  MfaIsRegistered = si_mfa_registered,
|                  AccountEnabled = si_account_enabled,
|                  LastSignInDays,
|                  LastSignInDateTime = si_last_sign_in,
|                  CreatedDays,
|                  EntraRoles_Permanent = si_entra_roles_permanent,
|                  NestedGroups = si_group_memberships,
|                  RiskFactor_Consequence,
|                  RiskFactor_Probability,
|                  RiskFactor_Probability_Detailed, RiskFactorIds,
|                  cmdbId,
|                  cmdbName,
|                  cmdbCriticality,
|                  cmdbDataSensitivity,
|                  RiskScore_Weight_Detailed,
|                  RiskScore_Weight_Factor
|                | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_StaleGuest_NoLogin90Days_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_StaleGuest_NoLogin90Days_Summary. B2B guest/external collaborator accounts with no sign-in for 90+ days. Guests have a shorter stale threshold than internal users as they represent external access that should be regularly re-validated. Stale guest accounts are a common vector for supply chain and partner-related compromises. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for StaleGuest NoLogin90Days Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_StaleGuest_NoLogin90Days_Detailed
|        // Purpose  Enabled guest / external accounts with no sign-in for 90+ days, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsB2BCollaborator = (si_external_user_state in~ ("Accepted", "PendingAcceptance"))
|        | where si_is_external == true or IsB2BCollaborator == true
|        // #690 (27) -- a guest whose last sign-in the CI could not decide is LISTED and labelled by its cause, no data source (ConfigurationName)
|        | where LastSignInDays > 90 or (LastSignInDays == -1 and CreatedDays > 90) or (isnull(LastSignInDays) and (isnull(CreatedDays) or CreatedDays > 90))
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity = "Low"
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        // report-scoped flag -- a privileged (tier 0/1) Entra role
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = array_length(RF_P_CiFactors)
|        | extend RiskFactor_Probability_Detailed = strcat_array(RF_P_CiFactorNames, ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend SecurityDomain    = "Identity"
|        | extend Category          = "Account Lifecycle"
|        | extend Subcategory       = "Guest / External Access"
|        | extend ConfigurationName = iff(isnull(LastSignInDays), "Guest account inactive for 90+ days - no data source for the last sign-in", "Guest account inactive for 90+ days")
|        | extend ConfigurationId   = "IDENTITY-GUEST-001"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, si_identity_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project
|            SecurityDomain,
|            Category,
|            Subcategory,
|            ConfigurationName,
|            ConfigurationId,
|            AssetName,
|            AssetId,
|            AssetType,
|            SecuritySeverity,
|            CriticalityTier,
|            CriticalityTierLevel,
|            DisplayName = si_display_name,
|            Upn = si_upn,
|            PrimaryEntityId = si_link_entra,
|            Department = si_org_department,
|            Tier = si_tier,
|            IsPrivileged,
|            HasPermanentPrivilegedRole,
|            IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered,
|            AccountEnabled = si_account_enabled,
|            LastSignInDays,
|            LastSignInDateTime = si_last_sign_in,
|            CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent,
|            NestedGroups = si_group_memberships,
|            RiskFactor_Consequence,
|            RiskFactor_Probability,
|            RiskFactor_Probability_Detailed, RiskFactorIds,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_TooManyGlobalAdmins_Detailed
|      ReportPurpose: >-
|        Per-row detail view for Identity_TooManyGlobalAdmins_Summary. Detects when the organisation has more than 5 active Global Administrator accounts. Microsoft recommends 2-5 Global Admins maximum. Each additional Global Admin increases the attack surface proportionally. Organisations with 10+ Global Admins typically have role assignment hygiene problems and lack a formal review process. Severity: High (fixed) - excessive Global Admin count is always a significant risk. Detailed emits one row per affected asset (PrimaryEntityId-keyed), suitable for ticket creation, remediation tracking, and per-asset evidence.
|        Per-identity detail view for TooManyGlobalAdmins Summary.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_TooManyGlobalAdmins_Detailed
|        // Purpose  Enabled users holding a permanent Global Administrator role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier and CMDB values.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        // #690 (23) -- every identity that holds Global Administrator -- active (permanent or time-bound) or eligible, directly or
|        // through a group (the role read resolves group and PIM-for-groups roles), users, guests and service principals -- and the
|        // purpose's threshold, MORE THAN 5, counted over the whole tenant before the slice (the same count as the Summary report)
|        let _gaAll =
|            _ciAsset
|            | where tostring(si_entra_roles_permanent) has "Global Administrator" or tostring(si_entra_roles_eligible) has "Global Administrator";
|        let _gaCount = toscalar(_gaAll | summarize _gaCount = dcount(si_ci_id));
|        _gaAll
|        | where _gaCount > 5
|        | extend GaEvidence = strcat("Global Administrator ", iff(tostring(si_entra_roles_permanent) has "Global Administrator", "active", "eligible"), " - one of ", tostring(_gaCount), " identities holding it (more than 5)")
|        | extend CreatedDays = datetime_diff('day', now(), si_created)
|        | extend LastSignInDays = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), iff(isnull(si_last_sign_in), -1, datetime_diff('day', now(), si_last_sign_in)))
|        | extend HasPermanentPrivilegedRole = (coalesce(si_privilege_tier_permanent, 99) <= 1)
|        | extend IsPrivileged = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend IsPrivilegedEligible = (coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity      = "Medium"
|        | extend SecurityDomain        = "Identity"
|        | extend Category              = "Admin Account Hygiene"
|        | extend Subcategory           = "Role Assignment Governance"
|        | extend ConfigurationName     = "Excessive Global Administrator count - more than 5 active accounts"
|        | extend ConfigurationId       = "IDENTITY-ADMIN-004"
|        | extend RiskFactor_Consequence = 2
|        | extend RiskFactor_Probability = 1
|        | extend RiskFactor_Probability_Detailed = "GlobalAdmin"
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend AssetId   = si_ci_id
|        | extend AssetType = coalesce(si_asset_type, si_identity_type, "Identity")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = iff(isnotempty(cmdbCriticality), strcat("cmdbCriticality=", tostring(cmdbCriticality)), "")
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|            AssetName,
|            AssetId,
|            AssetType,
|            Impact = GaEvidence,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|            DisplayName = si_display_name, Upn = si_upn, PrimaryEntityId = si_link_entra, Department = si_org_department, Tier = si_tier,
|            IsPrivileged, HasPermanentPrivilegedRole, IsPrivilegedEligible,
|            MfaIsRegistered = si_mfa_registered, AccountEnabled = si_account_enabled, LastSignInDays, LastSignInDateTime = si_last_sign_in, CreatedDays,
|            EntraRoles_Permanent = si_entra_roles_permanent, NestedGroups = si_group_memberships, RiskFactor_Consequence, RiskFactor_Probability,
|            RiskFactor_Probability_Detailed,
|            cmdbId,
|            cmdbName,
|            cmdbCriticality,
|            cmdbDataSensitivity,
|            RiskScore_Weight_Detailed,
|            RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: PublicIP_OpenPorts_Summary
|      ReportPurpose: >
|        Public IPs that Shodan reports with one or more open ports, aggregated per asset. Severity follows the criticality tier of the asset the IP belongs to. High-severity ports (SSH 22, RDP 3389, MSSQL 1433, MySQL 3306, PostgreSQL 5432, WinRM 5985/5986) tagged separately. Source: the public IP CI (SI_CI_CL), from the Shodan scanner.
|      SecurityDomain: PublicIP
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["high_risk_port_open", "restricted_data", "confidential_data", "report_scoped"]);
|        let SI_FactorNames = dynamic({"confidential_data": "ConfidentialData", "high_risk_port_open": "PortOpenInternet", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   PublicIP_OpenPorts_Summary
|        // Purpose  Public IPs with open ports seen by Shodan, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["confidential_data", "high_risk_port_open", "report_scoped", "restricted_data"])), si_rf_c = set_intersect(si_rf_c, dynamic(["confidential_data", "high_risk_port_open", "report_scoped", "restricted_data"]))
|                | extend _ciRfNames = dynamic({"confidential_data": "ConfidentialData", "high_risk_port_open": "PortOpenInternet", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        // #690 (35) every CI Shodan scans, whatever its class -- an Azure public IP resource is a cloud_resource CI with a Shodan link, so the block has no class filter
|        _ciAsset
|        | where isnotempty(si_link_shodan) and si_open_port_count > 0
|        | extend IpAddress = si_ip_address
|        | extend AssetName = coalesce(si_asset_name, si_ip_address)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | mv-expand Port = si_open_ports to typeof(int)
|        | extend IsHighRiskPort = iff(Port in (22, 3389, 1433, 3306, 5432, 5985, 5986), 1, 0)
|        // Impact -- 0-10, the same scale the CVE reports take from CVSS. Shodan reports no score for an open port, so
|        // these are the authored values for this domain (Open admin port 9.0, Exposed service 7.0).
|        | extend Impact = iff(IsHighRiskPort == 1, 9.0, 7.0)
|        // CriticalityTier -- the CI's tier (the owning asset's criticality)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0",
|                 CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",
|                 CriticalityTier == 3, "Low - tier 3", "")
|        // severity label = pure tier; port risk and tier 0 raise the score through the probability tokens
|        | extend SecuritySeverity =
|            case(CriticalityTier == 0, "Very High",
|                 CriticalityTier == 1, "High",
|                 CriticalityTier == 2, "Medium",
|                 "Low")
|        | extend SecurityDomain    = "PublicIP"
|        | extend Category          = "External Exposure"
|        | extend Subcategory       = "Open Port"
|        | extend ConfigurationName = strcat("Public IP with open port ", tostring(Port))
|        | extend ConfigurationId   = strcat("PUBLICIP-OPENPORT-", tostring(Port))
|        | extend RiskFactor_Consequence = 3   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)   // engine overrides this from RiskFactor_Probability_Detailed token count (or 0 if empty) -- schema scaffolding only
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["InternetExposed"]),
|            RF_P_CiFactorNames), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("InternetExposed=1")
|        | extend RiskFactor_Probability_DetailedScore = strcat(RiskFactor_Probability_DetailedScore, iff(array_length(RF_P_CiFactors) > 0, strcat(iff(isempty(RiskFactor_Probability_DetailedScore), "", ";"), strcat_array(RF_P_CiFactorNames, "=1;"), "=1"), ""))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(AssetName, " (", IpAddress, ")"))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(strcat(AssetName, " (", IpAddress, ")"), "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactorIds),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|             cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore
|        // out RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality
|        // out cmdbDataSensitivity, ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: PublicIP_OpenPorts_Detailed
|      ReportPurpose: >
|        Per-row Detailed view of public-IP open ports. Severity follows the criticality tier of the asset the IP belongs to. One row per (AssetName, IpAddress, Port). Source: the public IP CI (SI_CI_CL), from the Shodan scanner.
|      SecurityDomain: PublicIP
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactorIds
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["high_risk_port_open", "restricted_data", "confidential_data", "report_scoped"]);
|        let SI_FactorNames = dynamic({"confidential_data": "ConfidentialData", "high_risk_port_open": "PortOpenInternet", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   PublicIP_OpenPorts_Detailed
|        // Purpose  Public IPs with open ports seen by Shodan, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["confidential_data", "high_risk_port_open", "report_scoped", "restricted_data"])), si_rf_c = set_intersect(si_rf_c, dynamic(["confidential_data", "high_risk_port_open", "report_scoped", "restricted_data"]))
|                | extend _ciRfNames = dynamic({"confidential_data": "ConfidentialData", "high_risk_port_open": "PortOpenInternet", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        // #690 (35) every CI Shodan scans, whatever its class -- an Azure public IP resource is a cloud_resource CI with a Shodan link, so the block has no class filter
|        _ciAsset
|        | where isnotempty(si_link_shodan) and si_open_port_count > 0
|        | extend IpAddress = si_ip_address
|        | extend AssetName = coalesce(si_asset_name, si_ip_address)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | mv-expand Port = si_open_ports to typeof(int)
|        | extend IsHighRiskPort = iff(Port in (22, 3389, 1433, 3306, 5432, 5985, 5986), 1, 0)
|        // Impact -- 0-10, the same scale the CVE reports take from CVSS. Shodan reports no score for an open port, so
|        // these are the authored values for this domain (Open admin port 9.0, Exposed service 7.0).
|        | extend Impact = iff(IsHighRiskPort == 1, 9.0, 7.0)
|        // CriticalityTier -- the CI's tier (the owning asset's criticality)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0",
|                 CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",
|                 CriticalityTier == 3, "Low - tier 3", "")
|        // severity label = pure tier; port risk and tier 0 raise the score through the probability tokens
|        | extend SecuritySeverity =
|            case(CriticalityTier == 0, "Very High",
|                 CriticalityTier == 1, "High",
|                 CriticalityTier == 2, "Medium",
|                 "Low")
|        | extend SecurityDomain    = "PublicIP"
|        | extend Category          = "External Exposure"
|        | extend Subcategory       = "Open Port"
|        | extend ConfigurationName = strcat("Public IP with open port ", tostring(Port))
|        | extend ConfigurationId   = strcat("PUBLICIP-OPENPORT-", tostring(Port))
|        | extend RiskFactor_Consequence = 3   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|        // asset risk factors -- the set the engine feeds this report (the CI evaluation, limited to the factors that fit the report)
|        | extend RF_P_CiFactors = coalesce(si_rf_p, dynamic([]))
|        | extend RF_P_CiFactorNames = coalesce(si_rf_names_, dynamic([])), RiskFactorIds = strcat_array(coalesce(si_rf_p, dynamic([])), ";")
|        | extend RiskFactor_Probability = 1 + array_length(RF_P_CiFactors)   // engine overrides this from RiskFactor_Probability_Detailed token count (or 0 if empty) -- schema scaffolding only
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId = si_ci_id,
|                  AssetType = si_asset_type,
|                  Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  AssetEngine = si_class, IpAddress, Port,
|                  cmdbName, cmdbCriticality, Country = si_country,
|                  OrgName        = si_org_name,
|                  Isp            = si_isp,
|                  Hostnames      = si_hostnames,
|                  ShodanLastSeen = tostring(si_last_seen_),
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactorIds,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactorIds
|        // out RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating
|        // out cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: PublicIP_Vulnerabilities_Summary
|      ReportPurpose: >
|        Public IPs that Shodan reports with one or more known CVEs. A vulnerability reachable from the internet is treated as Very High severity whatever the asset tier, because the exposure itself is the risk; the tier of the owning asset then ranks the findings within that severity. Source: the public IP CI (SI_CI_CL), from the Shodan scanner.
|      SecurityDomain: PublicIP
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["high_risk_port_open", "restricted_data", "confidential_data", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"confidential_data": "ConfidentialData", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_risk_port_open": "PortOpenInternet", "known_exploited": "KnownExploited", "network_no_user_action": "NetworkNoUserAction", "old_vuln": "OldVuln", "overdue": "Overdue", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_Factor_high_cvss_public_ip = (si_cvss:string) { (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_cvss))) >= 9) };
|        //__SI_SCOPE_END__
|        // Report   PublicIP_Vulnerabilities_Summary
|        // Purpose  Public IPs with known CVEs reported by Shodan, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["confidential_data", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_risk_port_open", "known_exploited", "network_no_user_action", "old_vuln", "overdue", "remote_code_execution", "report_scoped", "restricted_data", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["confidential_data", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_risk_port_open", "known_exploited", "network_no_user_action", "old_vuln", "overdue", "remote_code_execution", "report_scoped", "restricted_data", "zero_day"]))
|                | extend _ciRfNames = dynamic({"confidential_data": "ConfidentialData", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_risk_port_open": "PortOpenInternet", "known_exploited": "KnownExploited", "network_no_user_action": "NetworkNoUserAction", "old_vuln": "OldVuln", "overdue": "Overdue", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        // #690 (35) every CI Shodan scans, whatever its class -- an Azure public IP resource is a cloud_resource CI with a Shodan link, so the block has no class filter
|        _ciAsset
|        | where isnotempty(si_link_shodan) and array_length(si_vulns) > 0
|        | extend IpAddress = si_ip_address
|        | extend AssetName = coalesce(si_asset_name, si_ip_address)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | extend MaxCvssScore = si_max_cvss
|        | mv-expand Cve = si_vulns to typeof(string)
|        // the CVE exclusions of the Exclusions page (excluded CVEs -- Shodan reports no CVE date, so the minimum age cannot apply)
|        | where SI_InScopeCve(Cve, datetime(null))
|        // CriticalityTier -- the CI's tier (the owning asset's criticality)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0",
|                 CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",
|                 CriticalityTier == 3, "Low - tier 3", "")
|        // Impact -- the CVSS score of the worst CVE Shodan reports on this IP (0-10, as the endpoint CVE report).
|        // Shodan returns the score only on higher plans, so it can be null while CVEs are listed. A null must NOT read
|        // as a low score -- absence is not remediation -- so it falls back to 8.0, the authored impact for an
|        // internet-reachable vulnerability.
|        | extend Impact = toreal(coalesce(MaxCvssScore, 8.0))
|        // Severity bands -- the house CVSS mapping. A CVE's severity is a property of the CVE, not of the asset it
|        // sits on; the asset's tier is carried in CriticalityTier.
|        | extend SecuritySeverity = case(
|            Impact >= 9.0, "Very High",
|            Impact >= 7.0, "High",
|            Impact >= 5.0, "Medium-High",
|            Impact >= 3.0, "Medium",
|            "Low")
|        | extend SecurityDomain    = "PublicIP"
|        | extend Category          = "External Exposure"
|        | extend Subcategory       = "Vulnerability"
|        | extend ConfigurationName = strcat("Public IP with known CVE: ", Cve)
|        | extend ConfigurationId   = Cve
|        | extend RiskFactor_Consequence = 3   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|        // asset risk factor -- the CI's evaluation (data-model/risk-factors.locked.json), never this report's own
|        | extend RiskFactor_Probability = 2   // engine overrides this from RiskFactor_Probability_Detailed token count (or 0 if empty) -- schema scaffolding only
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["InternetExposedCVE"]),
|            iff(SI_Factor_high_cvss_public_ip(tostring(MaxCvssScore)), dynamic(["CVSS9plus"]), dynamic([]))), ";")
|        | extend RiskFactor_Probability_DetailedScore =
|            strcat("InternetExposedCVE=1", iff(SI_Factor_high_cvss_public_ip(tostring(MaxCvssScore)), ";CVSS9plus=1", ""))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(strcat(AssetName, " (", IpAddress, ")"))), ";"),
|            ImpactedAssetPairs     = make_set(strcat(strcat(AssetName, " (", IpAddress, ")"), "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|             cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_cvss <- MaxCvssScore
|        // si si_category <- Category, si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics
|        // si si_mitre_techniques <- MITRE_Techniques, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: PublicIP_Vulnerabilities_Detailed
|      ReportPurpose: >
|        Per-row Detailed view of public-IP CVEs. Every row is Very High severity because the vulnerability is reachable from the internet. One row per (AssetName, IpAddress, CVE). Source: the public IP CI (SI_CI_CL), from the Shodan scanner.
|      SecurityDomain: PublicIP
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["high_risk_port_open", "restricted_data", "confidential_data", "exploit_available", "known_exploited", "exploit_kit", "network_no_user_action", "zero_day", "remote_code_execution", "high_cvss_public_ip", "overdue", "old_vuln", "report_scoped"]);
|        let SI_FactorNames = dynamic({"confidential_data": "ConfidentialData", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_risk_port_open": "PortOpenInternet", "known_exploited": "KnownExploited", "network_no_user_action": "NetworkNoUserAction", "old_vuln": "OldVuln", "overdue": "Overdue", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "zero_day": "ZeroDay"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_Factor_high_cvss_public_ip = (si_cvss:string) { (todouble(extract(@"(-?\d+(\.\d+)?)", 1, tostring(si_cvss))) >= 9) };
|        //__SI_SCOPE_END__
|        // Report   PublicIP_Vulnerabilities_Detailed
|        // Purpose  Public IPs with known CVEs reported by Shodan, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors (si_rf_p / si_rf_c), one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["confidential_data", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_risk_port_open", "known_exploited", "network_no_user_action", "old_vuln", "overdue", "remote_code_execution", "report_scoped", "restricted_data", "zero_day"])), si_rf_c = set_intersect(si_rf_c, dynamic(["confidential_data", "exploit_available", "exploit_kit", "high_cvss_public_ip", "high_risk_port_open", "known_exploited", "network_no_user_action", "old_vuln", "overdue", "remote_code_execution", "report_scoped", "restricted_data", "zero_day"]))
|                | extend _ciRfNames = dynamic({"confidential_data": "ConfidentialData", "exploit_available": "ExploitAvailable", "exploit_kit": "ExploitKit", "high_cvss_public_ip": "CVSS9Plus", "high_risk_port_open": "PortOpenInternet", "known_exploited": "KnownExploited", "network_no_user_action": "NetworkNoUserAction", "old_vuln": "OldVuln", "overdue": "Overdue", "remote_code_execution": "RCE", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "zero_day": "ZeroDay"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        // #690 (35) every CI Shodan scans, whatever its class -- an Azure public IP resource is a cloud_resource CI with a Shodan link, so the block has no class filter
|        _ciAsset
|        | where isnotempty(si_link_shodan) and array_length(si_vulns) > 0
|        | extend IpAddress = si_ip_address
|        | extend AssetName = coalesce(si_asset_name, si_ip_address)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | extend MaxCvssScore = si_max_cvss
|        | mv-expand Cve = si_vulns to typeof(string)
|        // the CVE exclusions of the Exclusions page (excluded CVEs -- Shodan reports no CVE date, so the minimum age cannot apply)
|        | where SI_InScopeCve(Cve, datetime(null))
|        // CriticalityTier -- the CI's tier (the owning asset's criticality)
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0",
|                 CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",
|                 CriticalityTier == 3, "Low - tier 3", "")
|        // Impact -- the CVSS score of the worst CVE Shodan reports on this IP (0-10, as the endpoint CVE report).
|        // Shodan returns the score only on higher plans, so it can be null while CVEs are listed. A null must NOT read
|        // as a low score -- absence is not remediation -- so it falls back to 8.0, the authored impact for an
|        // internet-reachable vulnerability.
|        | extend Impact = toreal(coalesce(MaxCvssScore, 8.0))
|        // Severity bands -- the house CVSS mapping. A CVE's severity is a property of the CVE, not of the asset it
|        // sits on; the asset's tier is carried in CriticalityTier.
|        | extend SecuritySeverity = case(
|            Impact >= 9.0, "Very High",
|            Impact >= 7.0, "High",
|            Impact >= 5.0, "Medium-High",
|            Impact >= 3.0, "Medium",
|            "Low")
|        | extend SecurityDomain    = "PublicIP"
|        | extend Category          = "External Exposure"
|        | extend Subcategory       = "Vulnerability"
|        | extend ConfigurationName = strcat("Public IP with known CVE: ", Cve)
|        | extend ConfigurationId   = Cve
|        | extend RiskFactor_Consequence = 3   // engine overrides this from RiskFactor_Consequence_Detailed token count (or 0 if empty) -- schema scaffolding only
|        // asset risk factor -- the CI's evaluation (data-model/risk-factors.locked.json), never this report's own
|        | extend RiskFactor_Probability = 2   // engine overrides this from RiskFactor_Probability_Detailed token count (or 0 if empty) -- schema scaffolding only
|        // the finding factor high_cvss_public_ip -- the catalog's definition (SI_Factor_high_cvss_public_ip, its threshold the customer may change)
|        | extend RiskFactor_Probability_Detailed = strcat_array(array_concat(
|            dynamic(["InternetExposedCVE"]),
|            iff(SI_Factor_high_cvss_public_ip(tostring(MaxCvssScore)), dynamic(["CVSS9plus"]), dynamic([]))), ";")
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName,
|                  AssetId = si_ci_id,
|                  AssetType = si_asset_type,
|                  Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                  AssetEngine = si_class, IpAddress, Cve, MaxCvssScore,
|                  cmdbName, cmdbCriticality, Country = si_country,
|                  OrgName        = si_org_name,
|                  Isp            = si_isp,
|                  ShodanLastSeen = tostring(si_last_seen_),
|                  RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|                  RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_cvss <- MaxCvssScore
|        // si si_category <- Category, si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Endpoint_ActiveCompromise_Detected_Summary
|      ReportPurpose: >
|        Endpoints of every tier (ranked by tier) where Microsoft Exposure Mgmt has flagged recent compromise indicators (NodeProperties.rawData.isCompromisedRecently). New v2.2 lens enabled by EG-derived IsCompromisedRecently signal (MS-computed). Aggregated per (Tier x Severity x cmdb*) bucket; lists carry impacted-asset detail.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Endpoint_ActiveCompromise_Detected_Summary
|          // Purpose  Tier 0/1 endpoints Microsoft Exposure Management flags as recently compromised, per tier.
|          // #505 -- the asset is the CI (SI_CI_CL), class device. Log Analytics only.
|          //__SI_CI_ASSET_BEGIN__
|              let _ciAsset =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_stale_) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                            si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                            si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                            si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                            si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                            si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                            si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                            si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                            si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                            si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                            si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                            si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                            si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                            si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                            si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                            si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                            si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                            si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                            si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                            si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                            si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                            si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                            si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                            si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                            si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                            si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                            si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                            si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                            si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                            si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                            si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                            si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                            si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                            si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                            si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                            si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                            si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                            si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                            si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                            si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                            si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                            si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                            si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                            si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                            si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                            si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                            si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                            si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                            si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                            si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                            si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                            si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                            si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                            si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                            si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                            si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                            si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                            si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                            si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                            si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                            si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                            si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                            si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                            si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                            si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                            si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                            si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                            si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                            si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                            si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                            si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                            si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                            si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                            si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                            si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|          //__SI_CI_ASSET_END__
|          _ciAsset
|          | where si_is_compromised_recently == true
|          // an asset Defender excludes, or an excluded tag marks, is not reported
|          | where coalesce(si_is_excluded, false) == false
|          // #643 every tier the report declares (CriticalityTierLevelScope 0-3) -- a compromised device is reported whatever its tier,
|          // Defender shows it, so SecurityInsight shows it. A device without a tier yet passes here; the engine gives it the
|          // tier the rules give it before the declared scope applies (never kept now and dropped once it has a tier).
|          | extend CriticalityTier = toint(si_tier)
|          | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|          | extend SecuritySeverity = case(CriticalityTier == 0, "Very High", CriticalityTier == 1, "High", "Medium")
|          | extend SecurityDomain    = "Endpoint"
|          | extend Category          = "Active Threats"
|          | extend Subcategory       = "Compromise Indicators"
|          | extend ConfigurationName = "Asset shows recent compromise indicators (Microsoft Exposure Mgmt)"
|          | extend ConfigurationId   = "ENDPOINT-ACTIVE-COMPROMISE-001"
|          | extend AssetName         = coalesce(si_asset_name, si_hostname, si_ci_id)
|          | extend MsCriticalityLevel = si_ms_criticality
|          | extend MachineRiskState   = si_machine_risk
|          | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|          | extend DeviceKey = si_ci_id
|          //__BUCKET_FILTER_BEGIN__
|          | where 1 == 1
|          //__BUCKET_FILTER_END__
|          // audit #25 -- ImpactedAssetCount is DERIVED from ImpactedAssetsList (a bare make_set), and
|          // ImpactedAssetPairs pairs name and id in one token the engine splits on the LAST '|'.
|          | summarize
|              TotalIssues          = count(),
|              ImpactedAssetsList   = make_set(AssetName),
|              ImpactedAssetPairs   = make_set(strcat(AssetName, "|", si_ci_id)),
|              MdeDeviceId          = min(tostring(si_link_mde)),
|              EntraAccountObjectId = min(tostring(si_link_entra)),
|              AzureResourceId      = min(tostring(si_link_azure)),
|              AssetId              = min(si_ci_id)
|            by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|               CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|               cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, MsCriticalityLevel, MachineRiskState
|          | extend ImpactedAssetsList = array_sort_asc(ImpactedAssetsList)
|          | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|          //__WEIGHTED_FACTORS_BEGIN__
|          | extend RiskScore_Weight_Detailed = ""
|          | extend RiskScore_Weight_Factor   = 100
|          | extend RiskFactor_Weight         = 100
|          //__WEIGHTED_FACTORS_END__
|          | order by RiskScore_Weight_Factor desc, CriticalityTier asc, TotalIssues desc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|          // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|          // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|          // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|    - ReportName: Endpoint_ActiveCompromise_Detected_Detailed
|      ReportPurpose: >
|        Per-asset detail view of endpoints of every tier flagged by Microsoft Exposure Mgmt as recently compromised. One row per asset.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|          //__SI_SCOPE_BEGIN__
|          // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|          let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|          let SI_ScopeIncludeDisabled = false;
|          let SI_ExcludedAssets = dynamic([]);
|          let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|          let SI_ExcludedConfigurationIds = dynamic([]);
|          let SI_ExcludedCves = dynamic([]);
|          let SI_CveMinAgeDays = 0;
|          let SI_ExcludedIpRanges = dynamic([]);
|          let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|          let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|          let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|          let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|          let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|          //__SI_SCOPE_END__
|          // Report   Endpoint_ActiveCompromise_Detected_Detailed
|          // Purpose  Tier 0/1 endpoints Microsoft Exposure Management flags as recently compromised. One row per asset.
|          // #505 -- the asset is the CI (SI_CI_CL), class device. Log Analytics only.
|          //__SI_CI_ASSET_BEGIN__
|              let _ciAsset =
|                  SI_CI_CL
|                  | where TimeGenerated > ago(30d)
|                  | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                  | where isnotempty(_ciId)
|                  | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                  | where _ciKind != "seen"
|                  | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                  | where tostring(si_class) in ("device")
|                  | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                      summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                                si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                    )
|                  | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                  | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                  | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                  | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                  | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_stale_) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                  | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                            si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                            si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                            si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                            si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                            si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                            si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                            si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                            si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                            si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                            si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                            si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                            si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                            si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                            si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                            si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                            si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                            si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                            si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                            si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                            si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                            si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                            si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                            si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                            si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                            si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                            si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                            si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                            si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                            si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                            si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                            si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                            si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                            si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                            si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                            si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                            si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                            si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                            si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                            si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                            si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                            si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                            si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                            si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                            si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                            si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                            si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                            si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                            si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                            si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                            si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                            si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                            si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                            si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                            si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                            si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                            si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                            si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                            si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                            si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                            si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                            si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                            si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                            si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                            si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                            si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                            si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                            si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                            si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                            si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                            si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                            si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                            si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                            si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                            si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                            si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                            si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                            si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                            si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                            si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|          //__SI_CI_ASSET_END__
|          _ciAsset
|          | where si_is_compromised_recently == true
|          // an asset Defender excludes, or an excluded tag marks, is not reported
|          | where coalesce(si_is_excluded, false) == false
|          // #643 every tier the report declares (CriticalityTierLevelScope 0-3) -- a compromised device is reported whatever its tier,
|          // Defender shows it, so SecurityInsight shows it. A device without a tier yet passes here; the engine gives it the
|          // tier the rules give it before the declared scope applies (never kept now and dropped once it has a tier).
|          | extend CriticalityTier = toint(si_tier)
|          | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|          | extend SecuritySeverity = case(CriticalityTier == 0, "Very High", CriticalityTier == 1, "High", "Medium")
|          | extend SecurityDomain    = "Endpoint"
|          | extend Category          = "Active Threats"
|          | extend Subcategory       = "Compromise Indicators"
|          | extend ConfigurationName = "Asset shows recent compromise indicators (Microsoft Exposure Mgmt)"
|          | extend ConfigurationId   = "ENDPOINT-ACTIVE-COMPROMISE-001"
|          | extend AssetName         = coalesce(si_asset_name, si_hostname, si_ci_id)
|          | extend AssetId           = si_ci_id
|          | extend AssetType         = "Endpoint"
|          | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|          | extend MsCriticalityLevel        = si_ms_criticality
|          | extend MachineRiskState          = si_machine_risk
|          | extend HasInternetExposureSignal = si_internet_exposed
|          | extend IsProductionEnvironment   = set_has_element(si_rf_c, "production_environment")
|          | extend LastSeen                  = tostring(si_last_seen_)
|          | extend DeviceKey = si_ci_id
|          //__BUCKET_FILTER_BEGIN__
|          | where 1 == 1
|          //__BUCKET_FILTER_END__
|          //__WEIGHTED_FACTORS_BEGIN__
|          | extend RiskScore_Weight_Detailed = ""
|          | extend RiskScore_Weight_Factor   = 100
|          | extend RiskFactor_Weight         = 100
|          //__WEIGHTED_FACTORS_END__
|          | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                    AssetName, AssetId, AssetType, SecuritySeverity, CriticalityTier, CriticalityTierLevel,
|                    RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                    cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity,
|                    MsCriticalityLevel, MachineRiskState, HasInternetExposureSignal, IsProductionEnvironment, LastSeen,
|                    MdeDeviceId = si_link_mde, EntraAccountObjectId = si_link_entra, AzureResourceId = si_link_azure
|          | order by RiskScore_Weight_Factor desc, CriticalityTier asc
|          //__SI_OUT_BEGIN__
|          // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|          // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|          // si = the SI finding fields the report fills, each with the report column that fills it
|          // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|          // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|          // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|          // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|          // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|          // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|          // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|          // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|          //__SI_OUT_END__
|
|
|    - ReportName: Identity_Departed_AccountStillEnabled_Detailed
|      ReportPurpose: Users whose EmployeeLeaveDateTime is in the past but the account is still enabled. HR off-boarding gap; common attack path.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_Departed_AccountStillEnabled_Detailed
|        // Purpose  Departed users (leave date passed) whose account is still enabled, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where si_account_enabled == true
|        | where isnotnull(si_leave_date) and si_leave_date < now()
|        | extend DaysSinceLeave = datetime_diff('day', now(), si_leave_date)
|        | extend MoreInfoUrl = strcat("https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/overview/userId/", coalesce(si_link_entra, si_upn))
|        | extend Links = dynamic_to_json(pack_array(
|            pack("label", "User profile", "url", MoreInfoUrl),
|            pack("label", "Sign-in logs", "url", strcat("https://entra.microsoft.com/#view/Microsoft_AAD_IAM/SigninLogsMenuBlade/userId/", coalesce(si_link_entra, si_upn)))))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|            AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = si_upn,
|            Impact = strcat("User departed ", DaysSinceLeave, " days ago, account still enabled"),
|            EmployeeLeaveDateTime = si_leave_date, DaysSinceLeave, MoreInfoUrl, Links,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_reference_url <- MoreInfoUrl, si_portal_link <- MoreInfoUrl, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_DisabledPrivilegedUser_Detailed
|      ReportPurpose: Identities flagged DisabledPrivilegedUser by the engine -- account disabled but still carries privileged role assignment.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_DisabledPrivilegedUser_Detailed
|        // Purpose  Disabled accounts that still hold a privileged (tier 0/1) Entra role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_account_enabled == false
|        | extend DisabledPrivilegedUser = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where DisabledPrivilegedUser == true
|        | extend MoreInfoUrl = strcat("https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/overview/userId/", coalesce(si_link_entra, si_upn))
|        | extend Links = dynamic_to_json(pack_array(pack("label", "User profile", "url", MoreInfoUrl)))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|            AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = si_upn,
|            Impact = "Disabled account still has privileged role -- re-enable resurrects access",
|            DisabledPrivilegedUser, MoreInfoUrl, Links,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_reference_url <- MoreInfoUrl, si_portal_link <- MoreInfoUrl, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_DisabledUser_StillInCriticalGroup_Detailed
|      ReportPurpose: |-
|        Disabled users still in critical AD nested groups OR with active Entra
|        roles. Cleanup gap; account re-enable would resurrect privilege.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_DisabledUser_StillInCriticalGroup_Detailed
|        // Purpose  Disabled accounts still in a critical AD group or holding an Entra role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_account_enabled == false
|        | where array_length(si_ad_critical_groups) > 0
|            or array_length(si_entra_roles_permanent) > 0
|            or array_length(si_entra_roles_eligible) > 0
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|            AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = si_upn,
|            Impact = "Disabled account still has privileged group / role -- re-enable resurrects privilege",
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_GuestWithPrivilegedRole_Detailed
|      ReportPurpose: B2B Guest users (UserType=Guest) holding ANY Entra role -- guests should never have privileged roles.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_GuestWithPrivilegedRole_Detailed
|        // Purpose  External (guest) identities holding an Entra role assignment, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_is_external == true
|        | where array_length(si_entra_roles_permanent) > 0 or array_length(si_entra_roles_eligible) > 0
|        | extend MoreInfoUrl = strcat("https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/AssignedRoles/userId/", coalesce(si_link_entra, si_upn))
|        | extend Links = dynamic_to_json(pack_array(
|            pack("label", "Guest user", "url", MoreInfoUrl),
|            pack("label", "External collaboration policy", "url", "https://entra.microsoft.com/#view/Microsoft_AAD_IAM/CompanyRelationshipsMenuBlade/~/Settings")))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|            AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = si_upn,
|            Impact = "External guest holds Entra role assignment",
|            EntraRoles_Permanent = si_entra_roles_permanent, MoreInfoUrl, Links,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_reference_url <- MoreInfoUrl, si_portal_link <- MoreInfoUrl, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedRole_PermanentNotEligible_Detailed
|      ReportPurpose: Users / SPNs holding PERMANENT (always-on) privileged role assignments instead of PIM-eligible. Standing privilege violates JIT/JEA.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_microsoft_first_party_tenants = dynamic(["f8cdef31-a31e-4b4a-93e4-5f571e91255a", "72f988bf-86f1-41af-91ab-2d7cd011db47"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedRole_PermanentNotEligible_Detailed
|        // Purpose  Enabled identities with always-on (permanent) Entra roles instead of PIM-eligible, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        // a list of ONE role can reach the CI as the bare role name (text, not a list) -- counted as one role, never dropped
|        | extend _rolesPermanent = iff(gettype(si_entra_roles_permanent) == "array", si_entra_roles_permanent, iff(isempty(tostring(si_entra_roles_permanent)), dynamic([]), pack_array(tostring(si_entra_roles_permanent))))
|        | extend _rolesEligible  = iff(gettype(si_entra_roles_eligible) == "array", si_entra_roles_eligible, iff(isempty(tostring(si_entra_roles_eligible)), dynamic([]), pack_array(tostring(si_entra_roles_eligible))))
|        | extend PermanentRoleCount = array_length(_rolesPermanent)
|        | extend EligibleRoleCount  = array_length(_rolesEligible)
|        | where PermanentRoleCount > 0
|        // owner 2026-10-15 (#690 (50)) -- Microsoft's own first-party service principals (an application Microsoft owns,
|        // the data-model list microsoft_first_party_tenants) are left out -- a service principal cannot be made eligible in PIM,
|        // and the role is one Microsoft gave its own application
|        | where not(tolower(si_app_owner_org_id) in (SI_List_microsoft_first_party_tenants))
|        | extend MoreInfoUrl = "https://entra.microsoft.com/#view/Microsoft_Azure_PIMCommon/CommonMenuBlade/~/quickStart"
|        | extend Links = dynamic_to_json(pack_array(
|            pack("label", "PIM overview", "url", MoreInfoUrl),
|            pack("label", "Role assignments", "url", "https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RolesManagementMenuBlade/~/AllRoles")))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|            AssetName = coalesce(si_display_name, si_upn, si_app_id, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = coalesce(si_upn, si_app_id),
|            Impact = strcat(PermanentRoleCount, " always-on role(s) instead of PIM-eligible"),
|            PermanentRoleCount, EligibleRoleCount, MoreInfoUrl, Links,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_reference_url <- MoreInfoUrl, si_portal_link <- MoreInfoUrl, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedUser_NoConditionalAccess_Detailed
|      ReportPurpose: |-
|        Privileged users whose recent successful sign-ins did NOT trigger any
|        Conditional Access policy. Effectively bypasses CA enforcement.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedUser_NoConditionalAccess_Detailed
|        // Purpose  Users holding an Entra role whose successful sign-ins (30 days) had no Conditional Access policy applied.
|        // The sign-ins come from Entra's sign-in events in advanced hunting (EntraIdSignInEvents, interactive and
|        // non-interactive) -- SigninLogs is only in a workspace that receives Entra's diagnostic export, and where the
|        // install's workspace has none the report was silently empty (#690 (45)). A role holder is an account Defender for
|        // Identity lists with an Entra role (AssignedRoles, or a PIM role), or a CI with a permanent privileged role or tier
|        // 0 / 1. Tier, CMDB values and factors come from the CI (_ciLink), joined on the Entra object id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        let _roleHolders =
|            IdentityInfo
|            | where Timestamp > ago(14d)
|            | where isnotempty(AccountObjectId)
|            | summarize arg_max(Timestamp, *) by AccountObjectId
|            | where Type == "User"
|            | extend HasEntraRole = coalesce(array_length(AssignedRoles), 0) > 0 or coalesce(array_length(bag_keys(PrivilegedEntraPimRoles)), 0) > 0
|            | extend RoleHolderKey = tolower(AccountObjectId)
|            | where isnotempty(RoleHolderKey)
|            | project RoleHolderKey, HasEntraRole;
|        EntraIdSignInEvents
|        | where Timestamp > ago(30d)
|        | where ErrorCode == 0
|        | where ConditionalAccessStatus == 2
|        | extend UserKey = tolower(AccountObjectId)
|        | where isnotempty(UserKey)
|        | summarize SignInCount = count(), InteractiveSignInCount = countif(LogonType has "interactiveUser"), NonInteractiveSignInCount = countif(LogonType has "nonInteractiveUser"),
|                    SignInUpn = tolower(take_any(AccountUpn)), SignInDisplayName = take_any(AccountDisplayName) by UserKey
|        | join kind=leftouter _roleHolders on $left.UserKey == $right.RoleHolderKey
|        | extend DeviceKey = UserKey
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | where coalesce(si_in_scope_, true)
|        | where coalesce(HasEntraRole, false) or set_has_element(coalesce(si_rf_p, dynamic([])), "permanent_privileged_role") or toint(si_tier) in (0, 1)
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend IsExternalIdentity = (SignInUpn has "#ext#"), IsCmdbOrphan = isempty(si_cmdb_id)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = toint(iff(IsExternalIdentity, 1, 0)) + toint(iff(IsCmdbOrphan, 1, 0))
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(IsExternalIdentity, "IsExternalIdentity", ""), iff(IsCmdbOrphan, "IsCmdbOrphan", "")), ", ")
|        // the labels the report always showed (identity type, user type) -- a guest signs in with an #EXT# name
|        | extend Category = "User"
|        | extend Subcategory = iff(IsExternalIdentity, "Guest", "Member")
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|                  AssetName = coalesce(si_asset_name, SignInDisplayName, SignInUpn, UserKey),
|                  AssetId = iif(isnotempty(si_ci_id), si_ci_id, UserKey),
|                  AssetType = "Identity",
|                  ConfigurationName = SignInDisplayName, ConfigurationId = SignInUpn,
|                  Impact = strcat(SignInCount, " sign-ins (30d) where no Conditional Access policy applied (", InteractiveSignInCount, " interactive, ", NonInteractiveSignInCount, " non-interactive)"), SignInCount, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_MailboxImpersonation_Detailed
|      ReportPurpose: |-
|        SPNs holding Mail.Read / Mail.Send / Mail.ReadWrite as APPLICATION
|        permission (impersonates ANY user mailbox tenant-wide). Common path
|        for phishing-as-a-service compromise.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_mail_access_permissions = dynamic(["Mail.Read", "Mail.ReadWrite", "Mail.Send", "Mail.ReadBasic", "Mail.ReadBasic.All", "Mail-Advanced.ReadWrite.All", "MailboxSettings.ReadWrite", "MailboxItem.Read.All", "MailboxItem.ImportExport.All", "MailboxFolder.Read.All", "MailboxFolder.ReadWrite.All", "Mailbox.Migration", "full_access_as_app", "EWS.AccessAsApp", "EWS.AccessAsUser.All"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_MailboxImpersonation_Detailed
|        // Purpose  Service principals granted application-scope mailbox permissions (impersonate any mailbox), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        // service principals AND managed identities (a managed identity granted mail permissions impersonates the same)
|        | where si_identity_type in ("service_principal", "managed_identity")
|        // every mail / mailbox application permission (data-model list mail_access_permissions), matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MailScopes = set_intersect(_permsD, SI_List_mail_access_permissions)
|        | extend MailScopes = iff(array_length(MailScopes) > 0, MailScopes, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_mail_access_permissions)))))
|        | where array_length(MailScopes) > 0
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|            AssetName = coalesce(si_display_name, si_app_id, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = si_app_id,
|            Impact = strcat("Granted ", array_length(MailScopes), " mailbox-impersonation permission(s) - ", strcat_array(MailScopes, ", ")), MailScopes,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_OwnerMismatch_Detailed
|      ReportPurpose: SPNs whose Owner is different from the Application Owner -- common in apps inherited from a departed employee where ownership got cleaned up only on one side.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_OwnerMismatch_Detailed
|        // Purpose  Enabled service principals whose owner differs from the app registration owner, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type == "service_principal"
|        // only an application registered in THIS tenant has a second owner list here (another organisation's application has none) -- an unknown owning tenant stays in
|        | where coalesce(si_is_third_party_multitenant, false) == false
|        // each owner with where they own (si_owners.of) -- service principal only, application registration only, or both
|        | extend _owners = coalesce(todynamic(tostring(si_owners)), dynamic([]))
|        | mv-apply _ow = _owners to typeof(dynamic) on (summarize
|              SpOnlyOwners  = make_set_if(coalesce(tostring(_ow.upn), tostring(_ow.name), tostring(_ow.id)), tostring(_ow["of"]) == "service principal"),
|              AppOnlyOwners = make_set_if(coalesce(tostring(_ow.upn), tostring(_ow.name), tostring(_ow.id)), tostring(_ow["of"]) == "application"),
|              BothOwners    = make_set_if(coalesce(tostring(_ow.upn), tostring(_ow.name), tostring(_ow.id)), tostring(_ow["of"]) == "both"))
|        // the purpose -- one side has owners the other does not (one side cleaned up, or different people)
|        | where array_length(SpOnlyOwners) > 0 or array_length(AppOnlyOwners) > 0
|        | extend SpnOwner = strcat_array(array_concat(SpOnlyOwners, BothOwners), "; ")
|        | extend AppOwner = strcat_array(array_concat(AppOnlyOwners, BothOwners), "; ")
|        | extend MoreInfoUrl = strcat("https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/~/Owners/appId/", si_app_id)
|        | extend Links = dynamic_to_json(pack_array(
|            pack("label", "App registration owners", "url", MoreInfoUrl),
|            pack("label", "Enterprise app owners", "url", strcat("https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Owners/objectId/", coalesce(si_link_entra, si_app_id)))))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|            AssetName = coalesce(si_display_name, si_app_id, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = si_app_id,
|            Impact = case(
|                array_length(AppOnlyOwners) == 0 and array_length(BothOwners) == 0, strcat("Owners on the enterprise application only (", strcat_array(SpOnlyOwners, "; "), ") -- the application registration lists none of them, or its owners could not be read"),
|                array_length(SpOnlyOwners) == 0 and array_length(BothOwners) == 0, strcat("Owners on the application registration only (", strcat_array(AppOnlyOwners, "; "), ") -- the enterprise application lists none of them"),
|                strcat("Owners differ -- enterprise application only ", iff(array_length(SpOnlyOwners) == 0, "none", strcat_array(SpOnlyOwners, "; ")), " / application registration only ", iff(array_length(AppOnlyOwners) == 0, "none", strcat_array(AppOnlyOwners, "; ")))),
|            SpnOwner, AppOwner, MoreInfoUrl, Links,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_reference_url <- MoreInfoUrl, si_portal_link <- MoreInfoUrl, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_OwnsResourcePublicAccess_Detailed
|      ReportPurpose: |-
|        Service principals and managed identities that hold an Azure role on a
|        publicly exposed resource -- any role assigned on the resource itself,
|        or Owner / Contributor / access administration inherited from its
|        resource group or subscription. One row per identity and resource.
|        Each row says whether the identity is inactive (90+ days) or holds a
|        high-risk permission grant (the "hot" identities with maximum blast
|        radius if compromised); a view filters on it, the report keeps all.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_OwnsResourcePublicAccess_Detailed
|        // Purpose  Service principals and managed identities holding an Azure role (direct, or Owner / Contributor inherited) on a publicly exposed resource.
|        // Both sides come from the CI (SI_CI_CL, REQUIREMENTS #505) -- the service principal (identity) and the resource
|        // (cloud_resource, internet_exposed factor) -- joined on the Azure resource id (role scope == si_link_azure).
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity", "cloud_resource")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "internet_exposed", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "internet_exposed", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        let _publicResources =
|            _ciAsset
|            | where si_class == "cloud_resource"
|            | where set_has_element(si_rf_p, "internet_exposed")
|            | extend LinkedAzureResourceId = tolower(si_link_azure)
|            // an empty id must never be a join key
|            | where isnotempty(LinkedAzureResourceId)
|            | project LinkedAzureResourceId, ResourceType = si_asset_type, ResourceCiId = si_ci_id, ResourceName = si_asset_name;
|        // #690 (3): every scope a role on the resource can be assigned at -- the resource itself, a parent resource, its
|        // resource group, its subscription -- so a role INHERITED from the resource group or subscription counts
|        let _publicResourceScopes =
|            _publicResources
|            | extend _idParts = split(LinkedAzureResourceId, "/")
|            | mv-expand _n = range(2, array_length(_idParts) - 1, 1) to typeof(int)
|            | extend _roleScope = strcat_array(array_slice(_idParts, 0, _n), "/")
|            // an empty scope must never be a join key
|            | where isnotempty(_roleScope)
|            | extend IsDirectRole = (_roleScope == LinkedAzureResourceId)
|            | project _roleScope, IsDirectRole, LinkedAzureResourceId, ResourceType, ResourceCiId, ResourceName;
|        _ciAsset
|        | where si_class == "identity"
|        // service principals AND managed identities (a managed identity is a service principal in Entra)
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | extend DaysInactive = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), datetime_diff('day', now(), si_last_sign_in))
|        | mv-expand _role = si_azure_role_assignments
|        // the role's scope property is `Scope` (case-sensitive)
|        | extend _scope = tolower(tostring(_role.Scope))
|        | extend RoleName = coalesce(tostring(_role.RoleDefinitionName), tostring(_role.roleDefinitionName), tostring(_role.roleName), tostring(_role.role), tostring(_role.name))
|        // an empty scope must never join an empty resource id
|        | where isnotempty(_scope)
|        | join kind=inner _publicResourceScopes on $left._scope == $right._roleScope
|        // a role directly on the resource counts whatever it is (as before); one inherited from a parent scope counts when
|        // it can change the resource (Owner / Contributor / access administration) or its name is not known
|        | where IsDirectRole or isempty(RoleName) or RoleName in~ ("Owner", "Contributor", "User Access Administrator", "Role Based Access Control Administrator") or RoleName endswith "Contributor"
|        | extend _roleRank = case(RoleName =~ "Owner", 4, RoleName in~ ("User Access Administrator", "Role Based Access Control Administrator"), 3, RoleName endswith "Contributor", 2, 1)
|        | extend _roleText = strcat(iff(isempty(RoleName), "an Azure role (name not collected)", RoleName), iff(IsDirectRole, " on the resource", strcat(" inherited from ", _scope)))
|        // one finding per service principal x resource (several roles on one resource are one finding, every role named)
|        | summarize RoleAssignments = strcat_array(array_sort_asc(make_set(_roleText)), "; "), arg_max(_roleRank, *) by si_ci_id, LinkedAzureResourceId
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend IsStaleAsset = (si_stale_ == true), IsCmdbOrphan = isempty(si_cmdb_id)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = toint(iff(IsStaleAsset, 1, 0)) + toint(iff(IsCmdbOrphan, 1, 0))
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(IsStaleAsset, "IsStaleAsset", ""), iff(IsCmdbOrphan, "IsCmdbOrphan", "")), ", ")
|        | extend Category = ""
|        | extend Subcategory = ""
|        | extend IsHighRiskPermissionGrant = si_high_risk_permission_grant
|        // #690 (3) owner 2026-10-15 ("narrowing belongs in views"): the "inactive or privileged" condition no longer drops a
|        // row -- every row says which of it holds, so a view can filter on it
|        | extend _condition = case(
|            DaysInactive >= 90 and si_high_risk_permission_grant == true, strcat("inactive ", tostring(DaysInactive), " days and holds a high-risk permission grant"),
|            DaysInactive >= 90, strcat("inactive ", tostring(DaysInactive), " days"),
|            si_high_risk_permission_grant == true, "holds a high-risk permission grant",
|            isnull(DaysInactive), "sign-in activity not collected; no high-risk permission grant known",
|            strcat("active (last sign-in ", tostring(DaysInactive), " days ago), no high-risk permission grant"))
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|                  AssetId = si_ci_id,
|                  AssetType = coalesce(si_asset_type, "Identity"),
|                  AssetName = coalesce(si_asset_name, si_display_name, si_ci_id),
|                  ConfigurationName = si_display_name, ConfigurationId = si_app_id,
|                  Impact = strcat(iff(si_identity_type == "managed_identity", "Managed identity", "Service principal"), " holds ", RoleAssignments, " -- publicly exposed resource ", coalesce(ResourceName, LinkedAzureResourceId), " (", ResourceType, "); ", _condition),
|                  DaysInactive, IsHighRiskPermissionGrant, LinkedAzureResourceId, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed, RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_AdNestedCriticalGroup_NoEntraRole_Detailed
|      ReportPurpose: |-
|        Users in an AD nested critical group (Domain Admins / Schema Admins /
|        Enterprise Admins via nesting) but holding NO Entra role. Indicates
|        AD-side privilege that isn't visible in Entra-only audits.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_AdNestedCriticalGroup_NoEntraRole_Detailed
|        // Purpose  Enabled users in a critical on-premises AD group but with no Entra role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where array_length(si_ad_critical_groups) > 0
|        | where coalesce(array_length(si_entra_roles_permanent), 0) == 0
|        | where coalesce(array_length(si_entra_roles_eligible), 0) == 0
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory,
|            AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = si_upn,
|            Impact = "User has on-prem AD critical-group membership but no Entra role -- privilege is invisible to Entra-only audits",
|            AdNestedCriticalGroups = si_ad_critical_groups,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_HighRiskFactorComposite4Plus_Detailed
|      ReportPurpose: Identities with 4+ risk factors flagged. Above the I16 threshold (3+) -- these are the worst offenders.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy: RiskScoreTotal
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_HighRiskFactorComposite4Plus_Detailed
|        // Purpose  Identities carrying 4 or more of the CI's asset risk factors at once (tier factors not counted), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        // the CI's production asset risk factors, without the tier ones (the tier is already the probability base)
|        | extend RiskFactorCount = array_length(array_concat(si_rf_p, si_rf_c))
|        | where RiskFactorCount >= 4
|        | extend MoreInfoUrl = iff(si_identity_type == "service_principal",
|            strcat("https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/~/Overview/appId/", si_app_id),
|            strcat("https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/overview/userId/", coalesce(si_link_entra, si_upn)))
|        | extend Links = dynamic_to_json(pack_array(pack("label", "Identity portal", "url", MoreInfoUrl)))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain = "Identity", Category, Subcategory = strcat(RiskFactorCount, " concurrent risk factors"),
|            AssetName = coalesce(si_display_name, si_upn, si_app_id, si_asset_name, si_ci_id),
|            AssetId = si_ci_id,
|            AssetType = coalesce(si_asset_type, si_identity_type, "Identity"),
|            ConfigurationName = si_display_name, ConfigurationId = coalesce(si_upn, si_app_id),
|            Impact = strcat("Identity hits ", RiskFactorCount, " risk-factor flags simultaneously"), RiskFactorCount, MoreInfoUrl, Links,
|            SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence, RiskFactor_Probability, RiskFactor_Probability_Detailed,
|            RiskFactor_Weight, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        | sort by RiskFactor_Weight desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability
|        // out RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId
|        // out cmdbName, cmdbCriticality, cmdbDataSensitivity, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_reference_url <- MoreInfoUrl, si_portal_link <- MoreInfoUrl, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|
|    - ReportName: Identity_Departed_AccountStillEnabled_Summary
|      ReportPurpose: >-
|        Users whose EmployeeLeaveDateTime is in the past but the account is still enabled. HR off-boarding gap; common attack path. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_Departed_AccountStillEnabled_Summary
|        // Purpose  Departed users (leave date passed) whose account is still enabled, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where si_account_enabled == true
|        | where isnotnull(si_leave_date) and si_leave_date < now()
|        | extend DaysSinceLeave = datetime_diff('day', now(), si_leave_date)
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "Departed user account still enabled"
|        | extend ConfigurationId   = "IDENTITY-OFFBOARD-001"
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_DisabledPrivilegedUser_Summary
|      ReportPurpose: >-
|        Identities flagged DisabledPrivilegedUser by the engine -- account disabled but still carries privileged role assignment. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_DisabledPrivilegedUser_Summary
|        // Purpose  Disabled accounts that still hold a privileged (tier 0/1) Entra role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_account_enabled == false
|        | extend DisabledPrivilegedUser = (coalesce(si_privilege_tier_permanent, 99) <= 1 or coalesce(si_privilege_tier_eligible, 99) <= 1)
|        | where DisabledPrivilegedUser == true
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "Disabled privileged user retains role"
|        | extend ConfigurationId   = "IDENTITY-PRIVRETAIN-001"
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_DisabledUser_StillInCriticalGroup_Summary
|      ReportPurpose: >-
|        Disabled users still in critical AD nested groups OR with active Entra roles. Cleanup gap; account re-enable would resurrect privilege. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_DisabledUser_StillInCriticalGroup_Summary
|        // Purpose  Disabled accounts still in a critical AD group or holding an Entra role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_account_enabled == false
|        | where array_length(si_ad_critical_groups) > 0
|            or array_length(si_entra_roles_permanent) > 0
|            or array_length(si_entra_roles_eligible) > 0
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "Disabled user still in critical group / role"
|        | extend ConfigurationId   = "IDENTITY-DISABLED-CRITGROUP-001"
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_GuestWithPrivilegedRole_Summary
|      ReportPurpose: >-
|        B2B Guest users (UserType=Guest) holding ANY Entra role -- guests should never have privileged roles. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_GuestWithPrivilegedRole_Summary
|        // Purpose  External (guest) identities holding an Entra role assignment, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_is_external == true
|        | where array_length(si_entra_roles_permanent) > 0 or array_length(si_entra_roles_eligible) > 0
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "Guest user holds Entra role"
|        | extend ConfigurationId   = "IDENTITY-GUEST-PRIVROLE-001"
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedRole_PermanentNotEligible_Summary
|      ReportPurpose: >-
|        Users / SPNs holding PERMANENT (always-on) privileged role assignments instead of PIM-eligible. Standing privilege violates JIT/JEA. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_microsoft_first_party_tenants = dynamic(["f8cdef31-a31e-4b4a-93e4-5f571e91255a", "72f988bf-86f1-41af-91ab-2d7cd011db47"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedRole_PermanentNotEligible_Summary
|        // Purpose  Enabled identities with always-on (permanent) Entra roles instead of PIM-eligible, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        // a list of ONE role can reach the CI as the bare role name (text, not a list) -- counted as one role, never dropped
|        | extend _rolesPermanent = iff(gettype(si_entra_roles_permanent) == "array", si_entra_roles_permanent, iff(isempty(tostring(si_entra_roles_permanent)), dynamic([]), pack_array(tostring(si_entra_roles_permanent))))
|        | extend _rolesEligible  = iff(gettype(si_entra_roles_eligible) == "array", si_entra_roles_eligible, iff(isempty(tostring(si_entra_roles_eligible)), dynamic([]), pack_array(tostring(si_entra_roles_eligible))))
|        | extend PermanentRoleCount = array_length(_rolesPermanent)
|        | extend EligibleRoleCount  = array_length(_rolesEligible)
|        | where PermanentRoleCount > 0
|        // owner 2026-10-15 (#690 (50)) -- Microsoft's own first-party service principals (an application Microsoft owns,
|        // the data-model list microsoft_first_party_tenants) are left out -- a service principal cannot be made eligible in PIM,
|        // and the role is one Microsoft gave its own application
|        | where not(tolower(si_app_owner_org_id) in (SI_List_microsoft_first_party_tenants))
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "Permanent privileged role instead of PIM-eligible"
|        | extend ConfigurationId   = "IDENTITY-PIM-PERMANENT-001"
|        | extend AssetName = coalesce(si_display_name, si_upn, si_app_id, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_PrivilegedUser_NoConditionalAccess_Summary
|      ReportPurpose: >-
|        Privileged users whose recent successful sign-ins did NOT trigger any Conditional Access policy. Effectively bypasses CA enforcement. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_PrivilegedUser_NoConditionalAccess_Summary
|        // Purpose  Users holding an Entra role whose successful sign-ins (30 days) had no Conditional Access policy applied.
|        // The sign-ins come from Entra's sign-in events in advanced hunting (EntraIdSignInEvents, interactive and
|        // non-interactive) -- SigninLogs is only in a workspace that receives Entra's diagnostic export, and where the
|        // install's workspace has none the report was silently empty (#690 (45)). A role holder is an account Defender for
|        // Identity lists with an Entra role (AssignedRoles, or a PIM role), or a CI with a permanent privileged role or tier
|        // 0 / 1. Tier, CMDB values and factors come from the CI (_ciLink), joined on the Entra object id.
|        //__SI_CI_LINK_BEGIN__
|            let _ciLink =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | extend si_in_scope_ = coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | mv-apply _ciLo = todynamic(column_ifexists("si_linked_objects", dynamic([]))) to typeof(dynamic) on (
|                    summarize _ciLive = make_set_if(tostring(_ciLo.provider), tostring(_ciLo.state) in ("active", "frozen")),
|                              _ciOld = make_bag_if(bag_pack(tolower(tostring(_ciLo.id)), tostring(_ciLo.provider)), tostring(_ciLo.state) in ("not_seen", "gone"))
|                  )
|                | extend _ciKeys = set_union(extract_all(@'"id"\s*:\s*"([^"]+)"', tolower(tostring(column_ifexists("si_linked_objects", dynamic([]))))), pack_array(tolower(tostring(column_ifexists("si_link_mde", ""))), tolower(tostring(column_ifexists("si_link_entra", ""))), tolower(tostring(column_ifexists("si_link_azure", ""))), tolower(tostring(column_ifexists("si_link_eg", ""))), tolower(tostring(column_ifexists("si_link_ad", ""))), tolower(tostring(column_ifexists("si_link_intune", "")))))
|                | mv-expand _ciKey = _ciKeys to typeof(string)
|                | where isnotempty(_ciKey)
|                | extend _ciOff = set_has_element(_ciLive, tostring(_ciOld[_ciKey]))
|                | summarize arg_max(_ciBuild, *) by _ciKey
|                | project _ciKey, si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")), si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")), si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))), si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_tags_, si_in_scope_ = si_in_scope_ and not(_ciOff);
|        //__SI_CI_LINK_END__
|        let _roleHolders =
|            IdentityInfo
|            | where Timestamp > ago(14d)
|            | where isnotempty(AccountObjectId)
|            | summarize arg_max(Timestamp, *) by AccountObjectId
|            | where Type == "User"
|            | extend HasEntraRole = coalesce(array_length(AssignedRoles), 0) > 0 or coalesce(array_length(bag_keys(PrivilegedEntraPimRoles)), 0) > 0
|            | extend RoleHolderKey = tolower(AccountObjectId)
|            | where isnotempty(RoleHolderKey)
|            | project RoleHolderKey, HasEntraRole;
|        EntraIdSignInEvents
|        | where Timestamp > ago(30d)
|        | where ErrorCode == 0
|        | where ConditionalAccessStatus == 2
|        | extend UserKey = tolower(AccountObjectId)
|        | where isnotempty(UserKey)
|        | summarize SignInCount = count(), InteractiveSignInCount = countif(LogonType has "interactiveUser"), NonInteractiveSignInCount = countif(LogonType has "nonInteractiveUser"),
|                    SignInUpn = tolower(take_any(AccountUpn)), SignInDisplayName = take_any(AccountDisplayName) by UserKey
|        | join kind=leftouter _roleHolders on $left.UserKey == $right.RoleHolderKey
|        | extend DeviceKey = UserKey
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | join kind=leftouter (_ciLink | where si_class == "identity") on $left.DeviceKey == $right._ciKey
|        | where coalesce(si_in_scope_, true)
|        | where coalesce(HasEntraRole, false) or set_has_element(coalesce(si_rf_p, dynamic([])), "permanent_privileged_role") or toint(si_tier) in (0, 1)
|        | extend Impact = real(null)
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend IsExternalIdentity = (SignInUpn has "#ext#"), IsCmdbOrphan = isempty(si_cmdb_id)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = toint(iff(IsExternalIdentity, 1, 0)) + toint(iff(IsCmdbOrphan, 1, 0))
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(IsExternalIdentity, "IsExternalIdentity", ""), iff(IsCmdbOrphan, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(toint(iff(IsExternalIdentity, 1, 0))), ";IsCmdbOrphan=", tostring(toint(iff(IsCmdbOrphan, 1, 0))))
|        // the labels the report always showed (identity type, user type) -- a guest signs in with an #EXT# name
|        | extend Category = "User"
|        | extend Subcategory = iff(IsExternalIdentity, "Guest", "Member")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "Privileged user sign-ins bypassing Conditional Access"
|        | extend ConfigurationId   = "IDENTITY-CA-BYPASS-001"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | extend AssetId = iif(isnotempty(si_ci_id), si_ci_id, UserKey)
|        | extend AssetName = coalesce(si_asset_name, SignInDisplayName, SignInUpn, AssetId)
|        | summarize
|            AssetCount             = dcount(AssetId),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", AssetId)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(column_ifexists("MdeDeviceId",""))),
|            EntraAccountObjectId   = min(UserKey),
|            AzureResourceId        = min(tostring(column_ifexists("AzureResourceId",""))),
|            AssetId                = min(AssetId),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_MailboxImpersonation_Summary
|      ReportPurpose: >-
|        SPNs holding Mail.Read / Mail.Send / Mail.ReadWrite as APPLICATION permission (impersonates ANY user mailbox tenant-wide). Common path for phishing-as-a-service compromise. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        let SI_List_mail_access_permissions = dynamic(["Mail.Read", "Mail.ReadWrite", "Mail.Send", "Mail.ReadBasic", "Mail.ReadBasic.All", "Mail-Advanced.ReadWrite.All", "MailboxSettings.ReadWrite", "MailboxItem.Read.All", "MailboxItem.ImportExport.All", "MailboxFolder.Read.All", "MailboxFolder.ReadWrite.All", "Mailbox.Migration", "full_access_as_app", "EWS.AccessAsApp", "EWS.AccessAsUser.All"]);
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_MailboxImpersonation_Summary
|        // Purpose  Service principals granted application-scope mailbox permissions (impersonate any mailbox), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        // service principals AND managed identities (a managed identity granted mail permissions impersonates the same)
|        | where si_identity_type in ("service_principal", "managed_identity")
|        // every mail / mailbox application permission (data-model list mail_access_permissions), matched exactly and without regard to case
|        | extend _permsD = coalesce(todynamic(tostring(si_app_permissions)), dynamic([]))
|        | extend MailScopes = set_intersect(_permsD, SI_List_mail_access_permissions)
|        | extend MailScopes = iff(array_length(MailScopes) > 0, MailScopes, set_intersect(todynamic(tolower(tostring(_permsD))), todynamic(tolower(tostring(SI_List_mail_access_permissions)))))
|        | where array_length(MailScopes) > 0
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "SPN granted application-scope mailbox impersonation"
|        | extend ConfigurationId   = "IDENTITY-SPN-MAILBOX-IMPERSONATION-001"
|        | extend AssetName = coalesce(si_display_name, si_app_id, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_OwnerMismatch_Summary
|      ReportPurpose: >-
|        SPNs whose Owner is different from the Application Owner -- common in apps inherited from a departed employee where ownership got cleaned up only on one side. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_OwnerMismatch_Summary
|        // Purpose  Enabled service principals whose owner differs from the app registration owner, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_mfa", "no_owner", "old_account", "old_password", "permanent_privileged_role", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "no_owner": "NoOwner", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type == "service_principal"
|        // only an application registered in THIS tenant has a second owner list here (another organisation's application has none) -- an unknown owning tenant stays in
|        | where coalesce(si_is_third_party_multitenant, false) == false
|        // each owner with where they own (si_owners.of) -- service principal only, application registration only, or both
|        | extend _owners = coalesce(todynamic(tostring(si_owners)), dynamic([]))
|        | mv-apply _ow = _owners to typeof(dynamic) on (summarize
|              SpOnlyOwners  = make_set_if(coalesce(tostring(_ow.upn), tostring(_ow.name), tostring(_ow.id)), tostring(_ow["of"]) == "service principal"),
|              AppOnlyOwners = make_set_if(coalesce(tostring(_ow.upn), tostring(_ow.name), tostring(_ow.id)), tostring(_ow["of"]) == "application"),
|              BothOwners    = make_set_if(coalesce(tostring(_ow.upn), tostring(_ow.name), tostring(_ow.id)), tostring(_ow["of"]) == "both"))
|        // the purpose -- one side has owners the other does not (one side cleaned up, or different people)
|        | where array_length(SpOnlyOwners) > 0 or array_length(AppOnlyOwners) > 0
|        | extend SpnOwner = strcat_array(array_concat(SpOnlyOwners, BothOwners), "; ")
|        | extend AppOwner = strcat_array(array_concat(AppOnlyOwners, BothOwners), "; ")
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        // the tier is the CI's (its rules), never a default -- a CI without a tier keeps CriticalityTier empty (the engine resolves it from the tier rules before the scope filter)
|        | extend CriticalityTier = si_tier
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "SPN owner mismatched with App owner"
|        | extend ConfigurationId   = "IDENTITY-SPN-OWNER-MISMATCH-001"
|        | extend AssetName = coalesce(si_display_name, si_app_id, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_SPN_OwnsResourcePublicAccess_Summary
|      ReportPurpose: >-
|        Service principals and managed identities that hold an Azure role on a publicly exposed resource -- any role on the resource itself, or Owner / Contributor / access administration inherited from its resource group or subscription (one finding per identity and resource; whether the identity is inactive or holds a high-risk permission grant is shown on the Detailed rows, never filtered). Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = true;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "has_secret", "no_owner", "expired_credentials", "expiring_credentials", "publisher_not_verified", "multitenant_app", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_SPN_OwnsResourcePublicAccess_Summary
|        // Purpose  Service principals and managed identities holding an Azure role (direct, or Owner / Contributor inherited) on a publicly exposed resource.
|        // Both sides come from the CI (SI_CI_CL, REQUIREMENTS #505) -- the service principal (identity) and the resource
|        // (cloud_resource, internet_exposed factor) -- joined on the Azure resource id (role scope == si_link_azure).
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity", "cloud_resource")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "internet_exposed", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "expired_credentials", "expiring_credentials", "has_secret", "internet_exposed", "ms_criticality_high", "multitenant_app", "never_signed_in", "no_owner", "old_account", "permanent_privileged_role", "production_environment", "publisher_not_verified", "report_scoped", "restricted_data", "stale_sign_in", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "expired_credentials": "CredsExpired", "expiring_credentials": "CredsExpiring", "has_secret": "ClientSecret", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "multitenant_app": "MultiTenantApp", "never_signed_in": "NeverSignedIn", "no_owner": "NoOwner", "old_account": "OldAccount", "permanent_privileged_role": "PermanentAdmin", "production_environment": "Production", "publisher_not_verified": "PublisherUnverified", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        let _publicResources =
|            _ciAsset
|            | where si_class == "cloud_resource"
|            | where set_has_element(si_rf_p, "internet_exposed")
|            | extend LinkedAzureResourceId = tolower(si_link_azure)
|            // an empty id must never be a join key
|            | where isnotempty(LinkedAzureResourceId)
|            | project LinkedAzureResourceId, ResourceType = si_asset_type, ResourceCiId = si_ci_id;
|        // #690 (3): every scope a role on the resource can be assigned at (resource, parent, resource group, subscription)
|        let _publicResourceScopes =
|            _publicResources
|            | extend _idParts = split(LinkedAzureResourceId, "/")
|            | mv-expand _n = range(2, array_length(_idParts) - 1, 1) to typeof(int)
|            | extend _roleScope = strcat_array(array_slice(_idParts, 0, _n), "/")
|            // an empty scope must never be a join key
|            | where isnotempty(_roleScope)
|            | extend IsDirectRole = (_roleScope == LinkedAzureResourceId)
|            | project _roleScope, IsDirectRole, LinkedAzureResourceId, ResourceType, ResourceCiId;
|        _ciAsset
|        | where si_class == "identity"
|        // service principals AND managed identities (a managed identity is a service principal in Entra)
|        | where si_identity_type in ("service_principal", "managed_identity")
|        | extend DaysInactive = iff(set_has_element(si_unknown_fields, "si_last_sign_in"), long(null), datetime_diff('day', now(), si_last_sign_in))
|        | mv-expand _role = si_azure_role_assignments
|        // the role's scope property is `Scope` (case-sensitive)
|        | extend _scope = tolower(tostring(_role.Scope))
|        | extend RoleName = coalesce(tostring(_role.RoleDefinitionName), tostring(_role.roleDefinitionName), tostring(_role.roleName), tostring(_role.role), tostring(_role.name))
|        // an empty scope must never join an empty resource id
|        | where isnotempty(_scope)
|        | join kind=inner _publicResourceScopes on $left._scope == $right._roleScope
|        // as the Detailed report: a direct role counts whatever it is; an inherited one when it can change the resource
|        | where IsDirectRole or isempty(RoleName) or RoleName in~ ("Owner", "Contributor", "User Access Administrator", "Role Based Access Control Administrator") or RoleName endswith "Contributor"
|        // one finding per service principal x resource (as the Detailed report)
|        | extend _direct = toint(IsDirectRole)
|        | summarize arg_max(_direct, *) by si_ci_id, LinkedAzureResourceId
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend IsStaleAsset = (si_stale_ == true), IsCmdbOrphan = isempty(si_cmdb_id)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = toint(iff(IsStaleAsset, 1, 0)) + toint(iff(IsCmdbOrphan, 1, 0))
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(IsStaleAsset, "IsStaleAsset", ""), iff(IsCmdbOrphan, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsStaleAsset=", tostring(toint(iff(IsStaleAsset, 1, 0))), ";IsCmdbOrphan=", tostring(toint(iff(IsCmdbOrphan, 1, 0))))
|        | extend Category = ""
|        | extend Subcategory = ""
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "Service principal or managed identity holds an Azure role on a publicly exposed resource"
|        | extend ConfigurationId   = "IDENTITY-SPN-PUBLICRES-001"
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | extend AssetName = coalesce(si_display_name, si_app_id, si_asset_name, si_ci_id)
|        | summarize
|            AssetCount             = dcount(DeviceKey),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring("")),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(LinkedAzureResourceId)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_AdNestedCriticalGroup_NoEntraRole_Summary
|      ReportPurpose: >-
|        Users in an AD nested critical group (Domain Admins / Schema Admins / Enterprise Admins via nesting) but holding NO Entra role. Indicates AD-side privilege that isn't visible in Entra-only audits. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_AdNestedCriticalGroup_NoEntraRole_Summary
|        // Purpose  Enabled users in a critical on-premises AD group but with no Entra role, from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where si_identity_type in ("user", "guest")
|        | where array_length(si_ad_critical_groups) > 0
|        | where coalesce(array_length(si_entra_roles_permanent), 0) == 0
|        | where coalesce(array_length(si_entra_roles_eligible), 0) == 0
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "AD nested critical group membership without Entra role"
|        | extend ConfigurationId   = "IDENTITY-AD-NESTED-NOENTRA-001"
|        | extend AssetName = coalesce(si_display_name, si_upn, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Identity_HighRiskFactorComposite4Plus_Summary
|      ReportPurpose: >-
|        Identities with 4+ risk factors flagged. Above the I16 threshold (3+) -- these are the worst offenders. Summary emits one row per finding type (Category x Subcategory x ConfigurationName), with AssetCount/TotalIssues/ImpactedAssets aggregated -- suitable for dashboards and exec reporting.
|      SecurityDomain: Identity
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      SecuritySeverityInputName: SecuritySeverity
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      RiskScoreOutputName: RiskScoreTotal
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - MoreDetails
|      - AssetDetectedInReportName
|      SortBy:
|      - RiskScoreTotal_Weighted
|      ReportQuery:
|      - |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["compromised_recently", "no_mfa", "old_password", "leaked_credentials", "identity_at_risk", "identity_high_blast_radius", "stale_sign_in", "never_signed_in", "old_account", "permanent_privileged_role", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Identity_HighRiskFactorComposite4Plus_Summary
|        // Purpose  Identities carrying 4 or more of the CI's asset risk factors at once (tier factors not counted), from the CI (SI_CI_CL) -- REQUIREMENTS #505.
|        // The CI decides tier, CMDB values and the asset risk factors, one definition each.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("identity")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"])), si_rf_c = set_intersect(si_rf_c, dynamic(["compromised_recently", "confidential_data", "identity_at_risk", "identity_high_blast_radius", "leaked_credentials", "ms_criticality_high", "never_signed_in", "no_mfa", "old_account", "old_password", "permanent_privileged_role", "report_scoped", "restricted_data", "stale_sign_in"]))
|                | extend _ciRfNames = dynamic({"compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "identity_at_risk": "IdentityAtRisk", "identity_high_blast_radius": "HighBlastRadius", "leaked_credentials": "LeakedCreds", "ms_criticality_high": "HighMsCriticality", "never_signed_in": "NeverSignedIn", "no_mfa": "NoMFA", "old_account": "OldAccount", "old_password": "OldPassword", "permanent_privileged_role": "PermanentAdmin", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "stale_sign_in": "EnabledNoSignInStale"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        // the CI's production asset risk factors, without the tier ones (the tier is already the probability base)
|        | extend RiskFactorCount = array_length(array_concat(si_rf_p, si_rf_c))
|        | where RiskFactorCount >= 4
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        | extend SecuritySeverity = "Low"
|        | extend CriticalityTier = toint(si_tier)
|        | extend CriticalityTierLevel =
|            case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1",
|                 CriticalityTier == 2, "Medium - tier 2",   CriticalityTier == 3, "Low - tier 3", "")
|        // report-scoped flags (external identity, no CMDB record) -- not catalog asset factors
|        | extend _rfExternal = iff(si_is_external == true, 1, 0)
|        | extend _rfCmdbOrphan = iff(isempty(si_cmdb_id), 1, 0)
|        | extend RiskFactor_Consequence = 0
|        | extend RiskFactor_Probability = _rfExternal + _rfCmdbOrphan
|        | extend RiskFactor_Probability_Detailed = strcat_array(pack_array(iff(_rfExternal == 1, "IsExternalIdentity", ""), iff(_rfCmdbOrphan == 1, "IsCmdbOrphan", "")), ", ")
|        | extend RiskFactor_Probability_DetailedScore = strcat("IsExternalIdentity=", tostring(_rfExternal), ";IsCmdbOrphan=", tostring(_rfCmdbOrphan))
|        | extend Category = si_identity_type
|        | extend Subcategory = case(isnotempty(si_sp_type), si_sp_type, si_identity_type in ("user", "guest"), si_identity_type, isnotempty(si_employee_type), si_employee_type, "")
|        | extend SecurityDomain    = "Identity"
|        | extend ConfigurationName = "Identity with 4+ concurrent risk factors"
|        | extend ConfigurationId   = "IDENTITY-COMPOSITE-RISK-4PLUS-001"
|        | extend AssetName = coalesce(si_display_name, si_upn, si_app_id, si_asset_name, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | summarize
|            AssetCount             = dcount(si_ci_id),
|            TotalIssues            = count(),
|            ImpactedAssets         = strcat_array(array_sort_asc(make_set(AssetName)), ";"),
|            ImpactedAssetPairs     = make_set(strcat(AssetName, "|", si_ci_id)),
|            RiskFactor_Consequence = max(RiskFactor_Consequence),
|            arg_max(RiskFactor_Probability, RiskFactor_Probability_Detailed),
|            RiskFactor_Probability_DetailedScore = any(RiskFactor_Probability_DetailedScore),
|            cmdbId = min(tostring(cmdbId)),
|            cmdbName = min(tostring(cmdbName)),
|            MdeDeviceId            = min(tostring(si_link_mde)),
|            EntraAccountObjectId   = min(tostring(si_link_entra)),
|            AzureResourceId        = min(tostring(si_link_azure)),
|            AssetId                = min(si_ci_id),
|            MITRE_Tactics          = min(tostring(column_ifexists("MITRE_Tactics",""))),
|            MITRE_Techniques       = min(tostring(column_ifexists("MITRE_Techniques",""))),
|            ComplianceTags         = min(tostring(column_ifexists("ComplianceTags","")))
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity, cmdbCriticality, cmdbDataSensitivity
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by RiskScore_Weight_Factor desc, CriticalityTier asc, RiskFactor_Probability desc, TotalIssues desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_compliance_tags <- ComplianceTags, si_mitre_tactics <- MITRE_Tactics, si_mitre_techniques <- MITRE_Techniques
|        // si si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Endpoint_ExcludedAssets_Detailed
|      ReportPurpose: Every endpoint currently suppressed from Risk Analysis by an operator exclusion tag, and the exact tag that
|        did it. This is the INVERSE of every other report -- it deliberately does not filter excluded assets out, because they are
|        the subject. Exclusion was previously invisible - a tagged asset simply vanished from every report with nothing recording
|        that it had been dropped or why, which an operator cannot tell apart from collection having broken. Severity follows the
|        asset's own criticality tier, so a suppressed Tier 0 asset surfaces at the top - suppressing a critical asset is the
|        governance risk worth reviewing, and a stale exclusion tag never expires on its own.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      SecuritySeverityInputName: SecuritySeverity
|      RiskScoreOutputName: RiskScoreTotal
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      SortBy:
|      - RiskScoreTotal_Weighted
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - ExcludedReason
|      - AssetTags
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - LastSeen
|      - MoreDetails
|      - AssetDetectedInReportName
|      ReportQuery: |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Endpoint_ExcludedAssets_Detailed
|        // Purpose  What is being suppressed, and by which tag. One row per excluded asset.
|        //
|        // THIS REPORT DELIBERATELY KEEPS THE ASSETS every other endpoint report drops. Excluded assets
|        // are the subject here -- an asset is excluded when one of the CI's tags matches SI_ExcludedAssetTags,
|        // and ExcludedReason is the matching tag text.
|        //
|        // #505 -- the asset is the CI (SI_CI_CL), class device. Log Analytics only.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_stale_)
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where array_length(SI_ExcludedAssetTags) > 0
|        | where coalesce(si_tags_, "") has_any (SI_ExcludedAssetTags)
|        | mv-apply _xt = si_tags to typeof(string) on (
|            where tolower(_xt) has_any (SI_ExcludedAssetTags)
|            | summarize _xTags = make_set(_xt)
|          )
|        | extend ExcludedReason = strcat_array(array_sort_asc(_xTags), "; ")
|        | extend CriticalityTier      = toint(si_tier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        // Severity tracks the asset's own tier. Suppressing a Tier 0 asset is the finding.
|        | extend SecuritySeverity     = case(CriticalityTier == 0, "Very High", CriticalityTier == 1, "High", CriticalityTier == 2, "Medium", "Low")
|        | extend SecurityDomain    = "Endpoint"
|        | extend Category          = "Governance"
|        | extend Subcategory       = "Suppressed Assets"
|        | extend ConfigurationName = "Asset is excluded from Risk Analysis by an operator tag"
|        | extend ConfigurationId   = "ENDPOINT-EXCLUDED-BY-TAG-001"
|        | extend AssetName         = coalesce(si_asset_name, si_hostname, si_ci_id)
|        | extend AssetId           = si_ci_id
|        | extend AssetType         = "Endpoint"
|        | extend AssetTags         = strcat_array(si_tags, ";")
|        | extend LastSeen          = tostring(si_last_seen_)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | extend Impact            = strcat("Suppressed from every Risk Analysis report. Tier ", tostring(CriticalityTier), ".")
|        | extend MoreDetails       = strcat("Excluded by -> ", ExcludedReason, " | All tags ", AssetTags)
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName, AssetId, AssetType, ExcludedReason, AssetTags, Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, LastSeen, MoreDetails,
|                  MdeDeviceId = si_link_mde, EntraAccountObjectId = si_link_entra, AzureResourceId = si_link_azure
|        | order by CriticalityTier asc, AssetName asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out ExcludedReason, AssetTags, Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence
|        // out RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted
|        // out RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, LastSeen, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Endpoint_ExcludedAssets_Summary
|      ReportPurpose: How many endpoints are currently suppressed from Risk Analysis by an operator exclusion tag, grouped by
|        criticality tier, with the assets and the exact tags listed. The Summary answers "how much of the estate am I not
|        looking at, and is any of it critical"; the Detailed pair lists it asset by asset. Exclusion was previously invisible -
|        a tagged asset simply vanished from every report with nothing recording that it had been dropped or why. Severity
|        follows the asset's own tier, so suppressed Tier 0 assets sort to the top - exclusion tags never expire, and a critical
|        asset suppressed by a tag added months ago is a governance gap rather than a preference.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      SecuritySeverityInputName: SecuritySeverity
|      RiskScoreOutputName: RiskScoreTotal
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      SortBy:
|      - RiskScoreTotal_Weighted
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - ExcludedReasons
|      - MoreDetails
|      - AssetDetectedInReportName
|      ReportQuery: |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Endpoint_ExcludedAssets_Summary
|        // Purpose  How much of the estate is suppressed, per tier -- and by which tags.
|        //
|        // THIS REPORT DELIBERATELY KEEPS THE ASSETS every other endpoint report drops. Excluded assets
|        // are the subject here -- an asset is excluded when one of the CI's tags matches SI_ExcludedAssetTags,
|        // and ExcludedReason is the matching tag text.
|        //
|        // #505 -- the asset is the CI (SI_CI_CL), class device. Log Analytics only.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_stale_)
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where array_length(SI_ExcludedAssetTags) > 0
|        | where coalesce(si_tags_, "") has_any (SI_ExcludedAssetTags)
|        | mv-apply _xt = si_tags to typeof(string) on (
|            where tolower(_xt) has_any (SI_ExcludedAssetTags)
|            | summarize _xTags = make_set(_xt)
|          )
|        | extend ExcludedReason = strcat_array(array_sort_asc(_xTags), "; ")
|        | extend CriticalityTier      = toint(si_tier)
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = case(CriticalityTier == 0, "Very High", CriticalityTier == 1, "High", CriticalityTier == 2, "Medium", "Low")
|        | extend SecurityDomain    = "Endpoint"
|        | extend Category          = "Governance"
|        | extend Subcategory       = "Suppressed Assets"
|        | extend ConfigurationName = "Assets excluded from Risk Analysis by an operator tag"
|        | extend ConfigurationId   = "ENDPOINT-EXCLUDED-BY-TAG-001"
|        | extend AssetName         = coalesce(si_asset_name, si_hostname, si_ci_id)
|        | extend cmdbId = si_cmdb_id, cmdbName = si_cmdb_name, cmdbCriticality = si_cmdb_criticality, cmdbDataSensitivity = si_cmdb_data_sensitivity
|        | extend DeviceKey = si_ci_id
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // audit #25 -- ImpactedAssetCount is DERIVED from ImpactedAssetsList (a bare make_set), and
|        // ImpactedAssetPairs pairs name and id in one token the engine splits on the LAST '|'.
|        | summarize
|            ImpactedAssetsList   = make_set(AssetName),
|            ImpactedAssetPairs   = make_set(strcat(AssetName, "|", si_ci_id)),
|            ExcludedReasons      = strcat_array(array_sort_asc(make_set(ExcludedReason)), " | "),
|            MdeDeviceId          = min(tostring(si_link_mde)),
|            EntraAccountObjectId = min(tostring(si_link_entra)),
|            AzureResourceId      = min(tostring(si_link_azure)),
|            AssetId              = min(si_ci_id)
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|             cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | extend ImpactedAssetsList = array_sort_asc(ImpactedAssetsList)
|        | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|        | extend Impact      = strcat(tostring(ImpactedAssetCount), " asset(s) at tier ", tostring(CriticalityTier), " are suppressed from every Risk Analysis report.")
|        | extend MoreDetails = strcat("Excluded by -> ", ExcludedReasons)
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by CriticalityTier asc, ImpactedAssetCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, ExcludedReasons, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- si_ci_id, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Endpoint_ConflictingTierTags_Detailed
|      ReportPurpose: Every endpoint whose operator tags assert TWO OR MORE different criticality tiers at once, with the exact
|        conflicting tags. Tier is computed as a MIN across all signals, so the most critical tag silently wins and nothing
|        breaks - which is precisely why this has never been visible. The estate can assert that one machine is both Tier 0 and
|        Tier 3 and no report says so. Measured on a live estate, 16 of 19 tagged endpoints carried contradictory tier tags,
|        including a privileged-access workstation tagged both PAWDevices tier 0 and EmployeeWorkstations tier 3, and a domain
|        controller whose certificate-services tag claimed tier 0 and tier 1 simultaneously. Severity follows the MOST critical
|        tier claimed, because a conflict involving a Tier 0 claim is the one where being wrong costs the most.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      SecuritySeverityInputName: SecuritySeverity
|      RiskScoreOutputName: RiskScoreTotal
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      SortBy:
|      - RiskScoreTotal_Weighted
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - AssetName
|      - AssetId
|      - AssetType
|      - ConflictingTags
|      - ClaimedTiers
|      - AssetTags
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - LastSeen
|      - MoreDetails
|      - AssetDetectedInReportName
|      ReportQuery: |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Endpoint_ConflictingTierTags_Detailed
|        // Purpose  Which machines are tagged with two different tiers at once, and with which tags.
|        //
|        // WHY THIS IS INVISIBLE WITHOUT A REPORT. Tier is a MIN across signals, so a machine tagged
|        // both tier0 and tier3 simply becomes tier0. Nothing errors, nothing is dropped, every number
|        // downstream looks right -- and the estate is quietly asserting two answers about one asset.
|        //
|        // #505 -- the asset is the CI (SI_CI_CL), class device; the tags are the CI's tags (si_tags_,
|        // lower-case, every source that tags the device). Log Analytics only.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_stale_) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where isnotempty(si_tags_)
|        | extend AssetName = coalesce(si_asset_name, si_hostname, si_ci_id)
|        | extend AssetId   = si_ci_id
|        // One row per tag of the si_tags ARRAY (each tag a {source, name, value} object, or a plain text), read as a
|        // dynamic array -- never the array's JSON text split on commas. The tier a tag claims is read from its name and
|        // value: tier0, Tier 0, tier-0, tier_0, Tier=0 (any case); only tiers 0-3 are tiers.
|        | mv-expand _t = si_tags to typeof(dynamic)
|        | extend _tagText = iff(gettype(_t) == "string", tostring(_t), strcat(tostring(_t.name), iff(isnotempty(tostring(_t.value)), strcat("=", tostring(_t.value)), "")))
|        | extend _tagSource = iff(gettype(_t) == "string", "", tostring(_t.source))
|        | extend _tag  = iff(isnotempty(_tagSource), strcat(_tagText, " (", _tagSource, ")"), _tagText)
|        | extend _tier = extract(@"(?i)tier[\s_\-:=]*([0-3])(?:[^0-9]|$)", 1, _tagText)
|        | summarize
|            _tiers   = make_set_if(_tier, isnotempty(_tier)),
|            _tags    = make_set_if(_tag, isnotempty(_tier)),
|            _allTags = make_set_if(_tag, isnotempty(_tagText)),
|            _tierCol = take_any(toint(si_tier)),
|            _lastSeen = any(tostring(si_last_seen_)),
|            cmdbId = min(tostring(si_cmdb_id)), cmdbName = min(tostring(si_cmdb_name)),
|            cmdbCriticality = any(si_cmdb_criticality), cmdbDataSensitivity = any(si_cmdb_data_sensitivity),
|            MdeDeviceId = min(tostring(si_link_mde)), EntraAccountObjectId = min(tostring(si_link_entra)), AzureResourceId = min(tostring(si_link_azure))
|          by AssetName, AssetId
|        | extend AssetTags = strcat_array(array_sort_asc(_allTags), "; ")
|        // the engine's tier when the CI has one -- a CI without a tier says not tiered (no tier rule matches), never 3
|        | extend _engineTier = iff(isnull(_tierCol), "not tiered (no tier rule matches)", tostring(_tierCol))
|        // THE WHOLE REPORT IS THIS LINE. One distinct tier is agreement; two or more is the finding.
|        | where array_length(_tiers) > 1
|        | extend ClaimedTiers    = strcat_array(array_sort_asc(_tiers), ", ")
|        | extend ConflictingTags = strcat_array(array_sort_asc(_tags), " | ")
|        | extend AssetType       = "Endpoint"
|        | extend LastSeen        = _lastSeen
|        // Severity follows the MOST critical tier CLAIMED, not the tier the engine settled on.
|        | extend CriticalityTier      = toint(array_sort_asc(_tiers)[0])
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = case(CriticalityTier == 0, "Very High", CriticalityTier == 1, "High", CriticalityTier == 2, "Medium", "Low")
|        | extend SecurityDomain    = "Endpoint"
|        | extend Category          = "Governance"
|        | extend Subcategory       = "Conflicting Tier Tags"
|        | extend ConfigurationName = "Asset carries operator tags asserting more than one criticality tier"
|        | extend ConfigurationId   = "ENDPOINT-CONFLICTING-TIER-TAGS-001"
|        | extend Impact            = iff(isnull(_tierCol), strcat("Tags claim tiers ", ClaimedTiers, ". The engine has no tier for this asset yet - no tier rule matches it."), strcat("Tags claim tiers ", ClaimedTiers, ". The engine resolved tier ", _engineTier, " by MIN, so the most critical claim wins silently."))
|        | extend MoreDetails       = strcat("Conflicting tags -> ", ConflictingTags, " | engine tier ", _engineTier, " | all tags ", AssetTags)
|        | extend DeviceKey = AssetId
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | project SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|                  AssetName, AssetId, AssetType, ConflictingTags, ClaimedTiers, AssetTags, Impact, SecuritySeverity,
|                  CriticalityTier, CriticalityTierLevel, RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskFactor_Weight,
|                  cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, LastSeen, MoreDetails,
|                  MdeDeviceId, EntraAccountObjectId, AzureResourceId
|        | order by CriticalityTier asc, AssetName asc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, AssetName, AssetId, AssetType
|        // out ConflictingTags, ClaimedTiers, AssetTags, Impact, SecuritySeverity, CriticalityTier, CriticalityTierLevel, RiskFactor_Consequence_Detailed
|        // out RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal, RiskScore_Weight_Detailed, RiskScore_Weight_Factor
|        // out RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity, LastSeen, MoreDetails
|        // out AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|    - ReportName: Endpoint_ConflictingTierTags_Summary
|      ReportPurpose: How many endpoints carry operator tags that assert more than one criticality tier, grouped by the most
|        critical tier claimed, with the assets listed. The Summary answers "how much of my tagging disagrees with itself";
|        the Detailed pair names the tags per asset. Because tier is a MIN, a conflict never fails - the most critical tag
|        wins and the estate looks healthy, so the only way to see this is to ask. A cluster of assets sharing one conflicting
|        pair usually means a tagging rule was changed and the old tag was never removed, which is a single fix rather than
|        one per machine.
|      SecurityDomain: Endpoint
|      CategoryInputName: Category
|      SubcategoryInputName: Subcategory
|      ConfigurationIdInputName: ConfigurationId
|      CriticalityTierLevelInputName: CriticalityTierLevel
|      SecuritySeverityInputName: SecuritySeverity
|      RiskScoreOutputName: RiskScoreTotal
|      RiskConsequenceScoreOutputName: RiskConsequenceScore
|      RiskProbabilityScoreOutputName: RiskProbabilityScore
|      CriticalityTierLevelScope:
|      - Critical - tier 0
|      - High - tier 1
|      - Medium - tier 2
|      - Low - tier 3
|      SecuritySeverityScope:
|      - Very High
|      - High
|      - Medium-High
|      - Medium
|      - Low
|      SortBy:
|      - RiskScoreTotal_Weighted
|      OutputPropertyOrder:
|      - SecurityDomain
|      - Category
|      - Subcategory
|      - ConfigurationName
|      - ConfigurationId
|      - Impact
|      - SecuritySeverity
|      - CriticalityTier
|      - CriticalityTierLevel
|      - RiskFactor_Consequence_Detailed
|      - RiskFactor_Consequence
|      - RiskFactor_Probability_Detailed
|      - RiskFactor_Probability
|      - RiskConsequenceScore
|      - RiskProbabilityScore
|      - RiskScoreTotal
|      - RiskScore_Weight_Detailed
|      - RiskScore_Weight_Factor
|      - RiskScoreTotal_Weighted
|      - RiskRating
|      - cmdbId
|      - cmdbName
|      - cmdbCriticality
|      - cmdbDataSensitivity
|      - ImpactedAssetCount
|      - ImpactedAssetsList
|      - ImpactedAssetIds
|      - ConflictingTagPairs
|      - MoreDetails
|      - AssetDetectedInReportName
|      ReportQuery: |-
|        //__SI_SCOPE_BEGIN__
|        // the report scope, generated by the engine from the data model and the customer settings (Exclusions, disabled assets, stale days, tier scope)
|        let SI_ScopeTiers = dynamic([0, 1, 2, 3]);
|        let SI_ScopeIncludeDisabled = false;
|        let SI_ExcludedAssets = dynamic([]);
|        let SI_ExcludedAssetTags = dynamic(["--excluded--si"]);
|        let SI_ExcludedConfigurationIds = dynamic([]);
|        let SI_ExcludedCves = dynamic([]);
|        let SI_CveMinAgeDays = 0;
|        let SI_ExcludedIpRanges = dynamic([]);
|        let SI_ReportFactors = dynamic(["internet_exposed", "compromised_recently", "unsupported_os", "not_onboarded", "antivirus_disabled", "antivirus_out_of_date", "excluded_from_defender", "high_machine_risk", "unmanaged", "production_environment", "restricted_data", "confidential_data", "ms_criticality_high", "report_scoped"]);
|        let SI_FactorNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"});
|        let SI_InScopeIp = (ip:string) { array_length(SI_ExcludedIpRanges) == 0 or not(ipv4_is_in_any_range(ip, SI_ExcludedIpRanges)) };
|        let SI_InScopeCve = (cve:string, lastModified:datetime) { not(toupper(cve) in (SI_ExcludedCves)) and (SI_CveMinAgeDays == 0 or isnull(lastModified) or lastModified < ago(SI_CveMinAgeDays * 1d)) };
|        let SI_InScopeConfiguration = (configurationId:string) { not(configurationId in (SI_ExcludedConfigurationIds)) };
|        //__SI_SCOPE_END__
|        // Report   Endpoint_ConflictingTierTags_Summary
|        // Purpose  How much of the tagging disagrees with itself, per most-critical-tier-claimed.
|        //
|        // Tier is a MIN, so a conflict never fails and the estate looks healthy. The only way to see
|        // it is to ask, which is what this report is.
|        //
|        // #505 -- the asset is the CI (SI_CI_CL), class device; the tags are the CI's tags (si_tags_,
|        // lower-case, every source that tags the device). Log Analytics only.
|        //__SI_CI_ASSET_BEGIN__
|            let _ciAsset =
|                SI_CI_CL
|                | where TimeGenerated > ago(30d)
|                | extend _ciId = tostring(si_ci_id), _ciT = todatetime(si_collection_time), _ciKind = tostring(column_ifexists("si_row_kind", ""))
|                | where isnotempty(_ciId)
|                | summarize _ciBuild = max(_ciT), _ciSeen = max(todatetime(column_ifexists("si_last_seen", datetime(null)))), arg_max(iff(_ciKind == "seen", datetime(1900-01-01), _ciT), *) by _ciId
|                | where _ciKind != "seen"
|                | where _ciBuild == toscalar(SI_CI_CL | where TimeGenerated > ago(30d) | summarize max(todatetime(si_collection_time)))
|                | where tostring(si_class) in ("device")
|                | mv-apply _ciRf = todynamic(column_ifexists("si_risk_factors", dynamic([]))) to typeof(dynamic) on (
|                    summarize si_rf_p = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "probability" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0),
|                              si_rf_c = make_set_if(tostring(_ciRf.id), tostring(_ciRf.axis) == "consequence" and tostring(_ciRf.stage) in ("production", "") and todouble(_ciRf.impact) > 0)
|                  )
|                | extend si_rf_p = set_intersect(si_rf_p, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"])), si_rf_c = set_intersect(si_rf_c, dynamic(["antivirus_disabled", "antivirus_out_of_date", "compromised_recently", "confidential_data", "excluded_from_defender", "high_machine_risk", "internet_exposed", "ms_criticality_high", "not_onboarded", "production_environment", "report_scoped", "restricted_data", "unmanaged", "unsupported_os"]))
|                | extend _ciRfNames = dynamic({"antivirus_disabled": "AVDisabled", "antivirus_out_of_date": "AVOutOfDate", "compromised_recently": "RecentIncident", "confidential_data": "ConfidentialData", "excluded_from_defender": "DefenderExcluded", "high_machine_risk": "HighMachineRisk", "internet_exposed": "InternetExposed", "ms_criticality_high": "HighMsCriticality", "not_onboarded": "NotOnboarded", "production_environment": "Production", "report_scoped": "ReportFactor", "restricted_data": "RestrictedData", "unmanaged": "Unmanaged", "unsupported_os": "UnsupportedOS"})
|                | mv-apply _ciRfN = si_rf_p to typeof(string) on (summarize si_rf_names_ = make_list(iff(isempty(tostring(_ciRfNames[_ciRfN])), _ciRfN, tostring(_ciRfNames[_ciRfN]))))
|                | extend si_stale_ = isnotnull(_ciSeen) and _ciSeen < ago(30d), si_last_seen_ = _ciSeen, si_tags_ = tolower(tostring(column_ifexists("si_tags", dynamic(null))))
|                | where coalesce(tobool(column_ifexists("si_account_enabled", bool(null))), true) and not(si_stale_) and not(si_tags_ has_any (dynamic(["--excluded--si"])))
|                | project si_ci_id = _ciId, si_class = tostring(si_class), si_asset_name = tostring(si_asset_name),
|                          si_asset_type = tostring(column_ifexists("si_asset_type", "")), si_display_name = tostring(column_ifexists("si_display_name", "")),
|                          si_tier = toint(column_ifexists("si_tier", int(null))), si_tier_set_by = tostring(column_ifexists("si_tier_set_by", "")),
|                          si_tier_reason = tostring(column_ifexists("si_tier_reason", "")), si_cmdb_id = tostring(column_ifexists("si_cmdb_id", "")),
|                          si_cmdb_name = tostring(column_ifexists("si_cmdb_name", "")),
|                          si_cmdb_criticality = tostring(column_ifexists("si_cmdb_criticality", "")),
|                          si_cmdb_data_sensitivity = tostring(column_ifexists("si_cmdb_data_sensitivity", "")),
|                          si_criticality_factor = todouble(column_ifexists("si_criticality_factor", real(null))),
|                          si_link_mde = tostring(column_ifexists("si_link_mde", "")), si_link_entra = tostring(column_ifexists("si_link_entra", "")),
|                          si_link_azure = tostring(column_ifexists("si_link_azure", "")), si_link_eg = tostring(column_ifexists("si_link_eg", "")),
|                          si_link_ad = tostring(column_ifexists("si_link_ad", "")), si_link_intune = tostring(column_ifexists("si_link_intune", "")),
|                          si_link_shodan = tostring(column_ifexists("si_link_shodan", "")), si_tags = todynamic(column_ifexists("si_tags", dynamic(null))),
|                          si_hostname = tostring(column_ifexists("si_hostname", "")), si_hostnames = todynamic(column_ifexists("si_hostnames", dynamic(null))),
|                          si_ip_address = tostring(column_ifexists("si_ip_address", "")), si_identity_type = tostring(column_ifexists("si_identity_type", "")),
|                          si_upn = tostring(column_ifexists("si_upn", "")), si_account_enabled = tobool(column_ifexists("si_account_enabled", bool(null))),
|                          si_is_external = tobool(column_ifexists("si_is_external", bool(null))),
|                          si_external_user_state = tostring(column_ifexists("si_external_user_state", "")),
|                          si_mfa_registered = tobool(column_ifexists("si_mfa_registered", bool(null))),
|                          si_created = todatetime(column_ifexists("si_created", datetime(null))),
|                          si_last_sign_in = todatetime(column_ifexists("si_last_sign_in", datetime(null))),
|                          si_password_last_changed = todatetime(column_ifexists("si_password_last_changed", datetime(null))),
|                          si_leave_date = todatetime(column_ifexists("si_leave_date", datetime(null))),
|                          si_onprem_synced = tobool(column_ifexists("si_onprem_synced", bool(null))),
|                          si_identity_origin = tostring(column_ifexists("si_identity_origin", "")),
|                          si_unknown_fields = todynamic(column_ifexists("si_unknown_fields", dynamic(null))),
|                          si_org_department = tostring(column_ifexists("si_org_department", "")), si_country = tostring(column_ifexists("si_country", "")),
|                          si_employee_type = tostring(column_ifexists("si_employee_type", "")),
|                          si_entra_roles_permanent = todynamic(column_ifexists("si_entra_roles_permanent", dynamic(null))),
|                          si_entra_roles_eligible = todynamic(column_ifexists("si_entra_roles_eligible", dynamic(null))),
|                          si_privilege_tier_permanent = toint(column_ifexists("si_privilege_tier_permanent", int(null))),
|                          si_privilege_tier_eligible = toint(column_ifexists("si_privilege_tier_eligible", int(null))),
|                          si_azure_role_assignments = todynamic(column_ifexists("si_azure_role_assignments", dynamic(null))),
|                          si_app_permissions = todynamic(column_ifexists("si_app_permissions", dynamic(null))),
|                          si_group_memberships = todynamic(column_ifexists("si_group_memberships", dynamic(null))),
|                          si_ad_critical_groups = todynamic(column_ifexists("si_ad_critical_groups", dynamic(null))),
|                          si_custom_security_attributes = todynamic(column_ifexists("si_custom_security_attributes", dynamic(null))),
|                          si_is_break_glass = tobool(column_ifexists("si_is_break_glass", bool(null))),
|                          si_sp_type = tostring(column_ifexists("si_sp_type", "")), si_app_id = tostring(column_ifexists("si_app_id", "")),
|                          si_publisher_name = tostring(column_ifexists("si_publisher_name", "")),
|                          si_publisher_verified = tobool(column_ifexists("si_publisher_verified", bool(null))),
|                          si_app_owner_org_id = tostring(column_ifexists("si_app_owner_org_id", "")),
|                          si_is_multitenant_app = tobool(column_ifexists("si_is_multitenant_app", bool(null))),
|                          si_is_third_party_multitenant = tobool(column_ifexists("si_is_third_party_multitenant", bool(null))),
|                          si_is_orphan_sp = tobool(column_ifexists("si_is_orphan_sp", bool(null))),
|                          si_credential_expiry_days = toint(column_ifexists("si_credential_expiry_days", int(null))),
|                          si_high_risk_permission_grant = tobool(column_ifexists("si_high_risk_permission_grant", bool(null))),
|                          si_owner = tostring(column_ifexists("si_owner", "")), si_mdi_risk_state = tostring(column_ifexists("si_mdi_risk_state", "")),
|                          si_mdi_blast_radius = tostring(column_ifexists("si_mdi_blast_radius", "")),
|                          si_is_sensitive_account = tobool(column_ifexists("si_is_sensitive_account", bool(null))),
|                          si_has_leaked_credentials = tobool(column_ifexists("si_has_leaked_credentials", bool(null))),
|                          si_is_compromised_recently = tobool(column_ifexists("si_is_compromised_recently", bool(null))),
|                          si_machine_risk = tostring(column_ifexists("si_machine_risk", "")),
|                          si_ms_criticality = tostring(column_ifexists("si_ms_criticality", "")),
|                          si_internet_exposed = tobool(column_ifexists("si_internet_exposed", bool(null))),
|                          si_open_ports = todynamic(column_ifexists("si_open_ports", dynamic(null))),
|                          si_open_port_count = toint(column_ifexists("si_open_port_count", int(null))),
|                          si_vulns = todynamic(column_ifexists("si_vulns", dynamic(null))), si_max_cvss = todouble(column_ifexists("si_max_cvss", real(null))),
|                          si_isp = tostring(column_ifexists("si_isp", "")), si_org_name = tostring(column_ifexists("si_org_name", "")),
|                          si_os_platform = tostring(column_ifexists("si_os_platform", "")), si_os_version = tostring(column_ifexists("si_os_version", "")),
|                          si_exposure_level = tostring(column_ifexists("si_exposure_level", "")),
|                          si_is_excluded = tobool(column_ifexists("si_is_excluded", bool(null))),
|                          si_excluded_reason = tostring(column_ifexists("si_excluded_reason", "")),
|                          si_is_shadow_admin = tobool(column_ifexists("si_is_shadow_admin", bool(null))),
|                          si_is_service_account = tobool(column_ifexists("si_is_service_account", bool(null))),
|                          si_password_never_expires = tobool(column_ifexists("si_password_never_expires", bool(null))),
|                          si_passwordless_only = tobool(column_ifexists("si_passwordless_only", bool(null))),
|                          si_mdi_investigation_priority_pct = toint(column_ifexists("si_mdi_investigation_priority_pct", int(null))),
|                          si_owner_upns = todynamic(column_ifexists("si_owner_upns", dynamic(null))),
|                          si_owners = todynamic(column_ifexists("si_owners", dynamic(null))),
|                          si_credentials = todynamic(column_ifexists("si_credentials", dynamic(null))),
|                          si_credential_fix = tostring(column_ifexists("si_credential_fix", "")),
|                          si_attached_resource = tostring(column_ifexists("si_attached_resource", "")),
|                          si_role_paths = todynamic(column_ifexists("si_role_paths", dynamic(null))),
|                          si_mfa_strength = tostring(column_ifexists("si_mfa_strength", "")),
|                          si_ca_mfa_enforced = tobool(column_ifexists("si_ca_mfa_enforced", bool(null))),
|                          si_entra_risk_level = tostring(column_ifexists("si_entra_risk_level", "")),
|                          si_privilege_tier_level = toint(column_ifexists("si_privilege_tier_level", int(null))),
|                          si_privilege_tier_level_text = tostring(column_ifexists("si_privilege_tier_level_text", "")),
|                          si_break_glass_reason = tostring(column_ifexists("si_break_glass_reason", "")),
|                          si_rf_p, si_rf_c, si_rf_names_, si_stale_, si_last_seen_, si_tags_;
|        //__SI_CI_ASSET_END__
|        _ciAsset
|        | where isnotempty(si_tags_)
|        | extend AssetName = coalesce(si_asset_name, si_hostname, si_ci_id)
|        | extend AssetId   = si_ci_id
|        // one row per tag of the si_tags ARRAY (as the Detailed report): tier0 / Tier 0 / tier-0 / tier_0 / Tier=0, tiers 0-3
|        | mv-expand _t = si_tags to typeof(dynamic)
|        | extend _tagText = iff(gettype(_t) == "string", tostring(_t), strcat(tostring(_t.name), iff(isnotempty(tostring(_t.value)), strcat("=", tostring(_t.value)), "")))
|        | extend _tagSource = iff(gettype(_t) == "string", "", tostring(_t.source))
|        | extend _tag  = iff(isnotempty(_tagSource), strcat(_tagText, " (", _tagSource, ")"), _tagText)
|        | extend _tier = extract(@"(?i)tier[\s_\-:=]*([0-3])(?:[^0-9]|$)", 1, _tagText)
|        | where isnotempty(_tier)
|        | summarize _tiers = make_set(_tier), _tags = make_set(_tag),
|                    cmdbId = min(tostring(si_cmdb_id)), cmdbName = min(tostring(si_cmdb_name)),
|                    cmdbCriticality = any(si_cmdb_criticality), cmdbDataSensitivity = any(si_cmdb_data_sensitivity),
|                    MdeDeviceId = min(tostring(si_link_mde)), EntraAccountObjectId = min(tostring(si_link_entra)), AzureResourceId = min(tostring(si_link_azure))
|          by AssetName, AssetId
|        | where array_length(_tiers) > 1
|        | extend _pair                = strcat_array(array_sort_asc(_tags), " + ")
|        | extend CriticalityTier      = toint(array_sort_asc(_tiers)[0])
|        | extend CriticalityTierLevel = case(CriticalityTier == 0, "Critical - tier 0", CriticalityTier == 1, "High - tier 1", CriticalityTier == 2, "Medium - tier 2", CriticalityTier == 3, "Low - tier 3", "")
|        | extend SecuritySeverity     = case(CriticalityTier == 0, "Very High", CriticalityTier == 1, "High", CriticalityTier == 2, "Medium", "Low")
|        | extend SecurityDomain    = "Endpoint"
|        | extend Category          = "Governance"
|        | extend Subcategory       = "Conflicting Tier Tags"
|        | extend ConfigurationName = "Assets carrying operator tags that assert more than one criticality tier"
|        | extend ConfigurationId   = "ENDPOINT-CONFLICTING-TIER-TAGS-001"
|        | extend DeviceKey = AssetId
|        //__BUCKET_FILTER_BEGIN__
|        | where 1 == 1
|        //__BUCKET_FILTER_END__
|        // audit #25 -- ImpactedAssetCount is DERIVED from ImpactedAssetsList (a bare make_set), and
|        // ImpactedAssetPairs pairs name and id in one token the engine splits on the LAST '|'.
|        | summarize
|            ImpactedAssetsList   = make_set(AssetName),
|            ImpactedAssetPairs   = make_set(strcat(AssetName, "|", AssetId)),
|            ConflictingTagPairs  = strcat_array(array_sort_asc(make_set(_pair)), "  ||  "),
|            MdeDeviceId          = min(tostring(MdeDeviceId)),
|            EntraAccountObjectId = min(tostring(EntraAccountObjectId)),
|            AzureResourceId      = min(tostring(AzureResourceId)),
|            AssetId              = min(AssetId)
|          by SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId,
|             CriticalityTier, CriticalityTierLevel, SecuritySeverity,
|             cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        | extend ImpactedAssetsList = array_sort_asc(ImpactedAssetsList)
|        | extend ImpactedAssetCount = array_length(ImpactedAssetsList)
|        | extend Impact      = strcat(tostring(ImpactedAssetCount), " asset(s) carry tags claiming more than one tier, the most critical being tier ", tostring(CriticalityTier), ".")
|        | extend MoreDetails = strcat("Conflicting tag pairs -> ", ConflictingTagPairs)
|        //__WEIGHTED_FACTORS_BEGIN__
|        | extend RiskScore_Weight_Detailed = ""
|        | extend RiskScore_Weight_Factor   = 100
|        | extend RiskFactor_Weight         = 100
|        //__WEIGHTED_FACTORS_END__
|        | order by CriticalityTier asc, ImpactedAssetCount desc
|        //__SI_OUT_BEGIN__
|        // DATA OUT, generated from the output contract and the field catalog (tools/ra-ci/Set-RaOutBlock.ps1), never edited by hand
|        // out = the output columns, in order (the engine shapes every row to them, a name never changes, additions only)
|        // si = the SI finding fields the report fills, each with the report column that fills it
|        // out SecurityDomain, Category, Subcategory, ConfigurationName, ConfigurationId, Impact, SecuritySeverity, CriticalityTier
|        // out CriticalityTierLevel, RiskFactor_Consequence_Detailed, RiskFactor_Consequence, RiskFactor_Probability_Detailed, RiskFactor_Probability, RiskConsequenceScore, RiskProbabilityScore, RiskScoreTotal
|        // out RiskScore_Weight_Detailed, RiskScore_Weight_Factor, RiskScoreTotal_Weighted, RiskRating, cmdbId, cmdbName, cmdbCriticality, cmdbDataSensitivity
|        // out ImpactedAssetCount, ImpactedAssetsList, ImpactedAssetIds, ConflictingTagPairs, MoreDetails, AssetDetectedInReportName
|        // si si_ci_id <- AssetId, si_finding_key <- ConfigurationId, si_title <- ConfigurationName, si_asset_name <- AssetName
|        // si si_security_domain <- SecurityDomain, si_report_name <- AssetDetectedInReportName, si_severity <- SecuritySeverity, si_risk_score <- RiskScoreTotal
|        // si si_weighted_risk_score <- RiskScoreTotal_Weighted, si_finding_risk_factors <- RiskFactor_Probability_Detailed, si_tier <- CriticalityTier, si_category <- Category
|        // si si_subcategory <- Subcategory, si_asset_criticality <- cmdbCriticality
|        //__SI_OUT_END__
|
|ReportTemplates:
|
|    - ReportName: RiskAnalysis_Detailed
|      ReportPurpose: Detailed
|      ReportsIncluded:
|      - Name: Device_Missing_CVEs_Detailed
|      - Name: Endpoint_ExcludedAssets_Detailed
|      - Name: Endpoint_ConflictingTierTags_Detailed
|      - Name: Device_Recommendations_Detailed
|      - Name: Device_EndOfSupport_Software_Detailed
|      - Name: Device_Certificates_Detailed
|      - Name: Device_BrowserExtensions_Detailed
|      - Name: Endpoint_ActiveCompromise_Detected_Detailed
|      - Name: Azure_Recommendations_Detailed
|      - Name: Azure_DefenderRecommendations_Detailed
|      - Name: Attack_Paths_Detailed_Github_to_Azure_Resources
|      - Name: Attack_Paths_Detailed_Public_IP_to_VM_with_CVE_Exploitation
|      - Name: Attack_Paths_Detailed_Identity_Group_Membership_to_Privileged_Resources
|      - Name: Attack_Paths_Detailed_Data_Sensitivity_to_Exposed_Credentials
|      - Name: Attack_Paths_Detailed_Device_with_high_severity_vulnerabilities_allows_lateral_movement_Azure
|      - Name: Attack_Paths_Detailed_Credential_Based_Lateral_Movement
|      - Name: Attack_Paths_Detailed_ServicePrincipal_Impersonates_Users
|      - Name: Attack_Paths_Detailed_Workload_ManagedIdentity_to_Azure_Resources
|      - Name: Attack_Paths_Detailed_SignIn_Entitlement_to_Tier0_Servers
|      - Name: Attack_Paths_Detailed_Owner_to_Privileged_Service_Principal
|      - Name: Identity_PrivilegedSPN_NoLogin180Days_Detailed
|      - Name: Identity_PrivilegedUser_SignIn_NonTrustedLocation_Detailed
|      - Name: Identity_Admin_LogonTo_VulnerableDevice_Detailed
|      - Name: Identity_AdminAccount_NeverUsed_Detailed
|      - Name: Identity_AdminAccount_OnPremSynced_Detailed
|      - Name: Identity_Admin_LogonTo_InternetExposedDevice_Detailed
|      - Name: Identity_Admin_LogonTo_LowTierDevice_Detailed
|      - Name: Identity_NoMFA_Detailed
|      - Name: Identity_BreakGlass_Anomaly_Detailed
|      - Name: Identity_BreakGlass_SignIn_Detected_Detailed
|      - Name: Identity_DisabledAccount_ActivePIMAssignment_Detailed
|      - Name: Identity_EligibleAdmin_LogonTo_ExploitableDevice_Detailed
|      - Name: Identity_ExternalUser_PrivilegedRole_Detailed
|      - Name: Identity_HighMDIInvestigationPriority_Detailed
|      - Name: Identity_HighValueTarget_MDIRisk_Detailed
|      - Name: Identity_MultiTenant_HighPermission_SPN_Detailed
|      - Name: Identity_NewAccount_ImmediateTier0Role_Detailed
|      - Name: Identity_PIM_DuplicateRoleAssignment_Detailed
|      - Name: Identity_PIM_EligibleNeverActivated_Detailed
|      - Name: Identity_PasswordNeverExpires_Privileged_Detailed
|      - Name: Identity_PermanentPrivilegedRole_Detailed
|      - Name: Identity_PrivilegedUser_StalePassword_Detailed
|      - Name: Identity_SPN_AppRoleAssignmentWrite_Detailed
|      - Name: Identity_SPN_ExpiringCredentials_Detailed
|      - Name: Identity_SPN_MailboxAccess_Detailed
|      - Name: Identity_SPN_Orphan_NoOwner_Detailed
|      - Name: Identity_SPN_OverCredentialed_Detailed
|      - Name: Identity_SPN_PrivilegedAccessWrite_Detailed
|      - Name: Identity_SPN_RoleManagementWrite_Detailed
|      - Name: Identity_SPN_UnverifiedPublisher_HighPermission_Detailed
|      - Name: Identity_ServiceAccount_InteractiveSignIn_Detailed
|      - Name: Identity_ServiceAccount_SignIn_NonTrustedLocation_Detailed
|      - Name: Identity_ShadowAdmin_Detailed
|      - Name: Identity_StaleGuest_NoLogin90Days_Detailed
|      - Name: Identity_TooManyGlobalAdmins_Detailed
|      - Name: Identity_StaleUser_NoLogin180Days_Detailed
|      - Name: Identity_Departed_AccountStillEnabled_Detailed
|      - Name: Identity_DisabledPrivilegedUser_Detailed
|      - Name: Identity_DisabledUser_StillInCriticalGroup_Detailed
|      - Name: Identity_GuestWithPrivilegedRole_Detailed
|      - Name: Identity_PrivilegedRole_PermanentNotEligible_Detailed
|      - Name: Identity_PrivilegedUser_NoConditionalAccess_Detailed
|      - Name: Identity_SPN_MailboxImpersonation_Detailed
|      - Name: Identity_SPN_OwnerMismatch_Detailed
|      - Name: Identity_SPN_OwnsResourcePublicAccess_Detailed
|      - Name: Identity_AdNestedCriticalGroup_NoEntraRole_Detailed
|      - Name: Identity_HighRiskFactorComposite4Plus_Detailed
|      - Name: PublicIP_OpenPorts_Detailed
|      - Name: PublicIP_Vulnerabilities_Detailed
|
|    - ReportName: RiskAnalysis_Summary
|      ReportPurpose: Overview
|      ReportsIncluded:
|      - Name: Device_Missing_CVEs_Summary
|      - Name: Endpoint_ExcludedAssets_Summary
|      - Name: Endpoint_ConflictingTierTags_Summary
|      - Name: Device_Recommendations_Summary
|      - Name: Device_EndOfSupport_Software_Summary
|      - Name: Device_Certificates_Summary
|      - Name: Device_BrowserExtensions_Summary
|      - Name: Endpoint_ActiveCompromise_Detected_Summary
|      - Name: Azure_Recommendations_Summary
|      - Name: Azure_DefenderRecommendations_Summary
|      - Name: Attack_Paths_Summary_Github_to_Azure_Resources
|      - Name: Attack_Paths_Summary_Public_IP_to_VM_with_CVE_Exploitation
|      - Name: Attack_Paths_Summary_Identity_Group_Membership_to_Privileged_Resources
|      - Name: Attack_Paths_Summary_Data_Sensitivity_to_Exposed_Credentials
|      - Name: Attack_Paths_Summary_Device_with_high_severity_vulnerabilities_allows_lateral_movement_Azure
|      - Name: Attack_Paths_Summary_Credential_Based_Lateral_Movement
|      - Name: Attack_Paths_Summary_ServicePrincipal_Impersonates_Users
|      - Name: Attack_Paths_Summary_Workload_ManagedIdentity_to_Azure_Resources
|      - Name: Attack_Paths_Summary_SignIn_Entitlement_to_Tier0_Servers
|      - Name: Attack_Paths_Summary_Owner_to_Privileged_Service_Principal
|      - Name: Identity_NoMFA_Summary
|      - Name: Identity_StaleUser_NoLogin180Days_Summary
|      - Name: Identity_StaleGuest_NoLogin90Days_Summary
|      - Name: Identity_PrivilegedSPN_NoLogin180Days_Summary
|      - Name: Identity_SPN_ExpiringCredentials_Summary
|      - Name: Identity_SPN_Orphan_NoOwner_Summary
|      - Name: Identity_PermanentPrivilegedRole_Summary
|      - Name: Identity_ShadowAdmin_Summary
|      - Name: Identity_PasswordNeverExpires_Privileged_Summary
|      - Name: Identity_MultiTenant_HighPermission_SPN_Summary
|      - Name: Identity_ExternalUser_PrivilegedRole_Summary
|      - Name: Identity_PrivilegedUser_StalePassword_Summary
|      - Name: Identity_SPN_MailboxAccess_Summary
|      - Name: Identity_HighValueTarget_MDIRisk_Summary
|      - Name: Identity_PrivilegedUser_SignIn_NonTrustedLocation_Summary
|      - Name: Identity_ServiceAccount_SignIn_NonTrustedLocation_Summary
|      - Name: Identity_BreakGlass_SignIn_Detected_Summary
|      - Name: Identity_SPN_RoleManagementWrite_Summary
|      - Name: Identity_SPN_AppRoleAssignmentWrite_Summary
|      - Name: Identity_SPN_PrivilegedAccessWrite_Summary
|      - Name: Identity_SPN_UnverifiedPublisher_HighPermission_Summary
|      - Name: Identity_NewAccount_ImmediateTier0Role_Summary
|      - Name: Identity_DisabledAccount_ActivePIMAssignment_Summary
|      - Name: Identity_ServiceAccount_InteractiveSignIn_Summary
|      - Name: Identity_HighMDIInvestigationPriority_Summary
|      - Name: Identity_AdminAccount_OnPremSynced_Summary
|      - Name: Identity_AdminAccount_NeverUsed_Summary
|      - Name: Identity_TooManyGlobalAdmins_Summary
|      - Name: Identity_BreakGlass_Anomaly_Summary
|      - Name: Identity_PIM_EligibleNeverActivated_Summary
|      - Name: Identity_PIM_DuplicateRoleAssignment_Summary
|      - Name: Identity_SPN_OverCredentialed_Summary
|      - Name: Identity_Admin_LogonTo_VulnerableDevice_Summary
|      - Name: Identity_Admin_LogonTo_InternetExposedDevice_Summary
|      - Name: Identity_Admin_LogonTo_LowTierDevice_Summary
|      - Name: Identity_EligibleAdmin_LogonTo_ExploitableDevice_Summary
|      - Name: Identity_Departed_AccountStillEnabled_Summary
|      - Name: Identity_DisabledPrivilegedUser_Summary
|      - Name: Identity_DisabledUser_StillInCriticalGroup_Summary
|      - Name: Identity_GuestWithPrivilegedRole_Summary
|      - Name: Identity_PrivilegedRole_PermanentNotEligible_Summary
|      - Name: Identity_PrivilegedUser_NoConditionalAccess_Summary
|      - Name: Identity_SPN_MailboxImpersonation_Summary
|      - Name: Identity_SPN_OwnerMismatch_Summary
|      - Name: Identity_SPN_OwnsResourcePublicAccess_Summary
|      - Name: Identity_AdNestedCriticalGroup_NoEntraRole_Summary
|      - Name: Identity_HighRiskFactorComposite4Plus_Summary
|      - Name: PublicIP_OpenPorts_Summary
|      - Name: PublicIP_Vulnerabilities_Summary
|
|    - ReportName: AssetSimulationComplexSummary
|      ReportPurpose: |
|        A load test over 10 Summary reports covering EVERY cross-domain
|        Attack_Paths_Summary_* (all 6 use `summarize` + `_TargetCmdb` and were the
|        primary cascade-blowup offenders in earlier releases). Single-let Endpoint
|        (Device_Missing_CVEs, Device_Recommendations), single-let Azure
|        (Azure_Recommendations), 6 cross-domain Attack_Paths Summary (covers
|        Github->Azure, PublicIP->VM, Identity Group Membership, Data Sensitivity,
|        Device-high-sev-vuln lateral, and Credential-based lateral), plus 1
|        cross-domain Identity_Admin_LogonTo_VulnerableDevice. Pair with the
|        launcher's `-RunAssetSimulation ComplexSummary -AssetSimulationAmount N`
|        knob to validate the futile-prune, the error-body surfacing
|        + bucketing under load in ~10-15 min.
|      ReportsIncluded:
|      - Name: Device_Missing_CVEs_Summary
|      - Name: Device_Recommendations_Summary
|      - Name: Azure_Recommendations_Summary
|      - Name: Azure_DefenderRecommendations_Summary
|      - Name: Attack_Paths_Summary_Github_to_Azure_Resources
|      - Name: Attack_Paths_Summary_Public_IP_to_VM_with_CVE_Exploitation
|      - Name: Attack_Paths_Summary_Identity_Group_Membership_to_Privileged_Resources
|      - Name: Attack_Paths_Summary_Data_Sensitivity_to_Exposed_Credentials
|      - Name: Attack_Paths_Summary_Device_with_high_severity_vulnerabilities_allows_lateral_movement_Azure
|      - Name: Attack_Paths_Summary_Credential_Based_Lateral_Movement
|      - Name: Identity_Admin_LogonTo_VulnerableDevice_Summary
|
|    - ReportName: AssetSimulationComplexDetailed
|      ReportPurpose: |
|        Detailed counterparts to AssetSimulationComplexSummary (same reports,
|        per-(asset, finding) rows). Use with
|        `-RunAssetSimulation ComplexDetailed -AssetSimulationAmount N`.
|      ReportsIncluded:
|      - Name: Device_Missing_CVEs_Detailed
|      - Name: Device_Recommendations_Detailed
|      - Name: Attack_Paths_Detailed_Identity_Group_Membership_to_Privileged_Resources
|      - Name: Attack_Paths_Detailed_Device_with_high_severity_vulnerabilities_allows_lateral_movement_Azure
|      - Name: Attack_Paths_Detailed_Credential_Based_Lateral_Movement
|      - Name: Identity_Admin_LogonTo_VulnerableDevice_Detailed
|      - Name: Azure_Recommendations_Detailed
|      - Name: Azure_DefenderRecommendations_Detailed
'@ }
$__siSupportFiles['engine/asset-profiling/shared/RuleEval.ps1'] = @{ Sha256 = '10c2df6a6ee608dad2f0c55987abe15490083389f96ca2fab852293ef3e8bb5d'; Text = @'
|#Requires -Version 5.1
|<#
|    RuleEval.ps1
|
|    `detect.kind` registry + per-asset evaluator for the AssetProfileBy*
|    rule shape (ARCHITECTURE.md §§ 7, 9). Companion to Get-SIRuleSet.ps1.
|
|    Two-layer design:
|
|      LAYER 1 -- Per-kind handler functions
|        Each handler implements one `detect.kind`. Signature:
|          handler -Asset <pscustomobject> -Args <hashtable> -> [bool]
|        Asset is the row from Stage Collect (engine-specific shape, but
|        common fields like PrimaryEntityId, Name, Hostname, MDE_*,
|        ENTRA_*, AZ_* available). Args is the kind's parameter hashtable
|        from the YAML (e.g. for nameMatches: @{ namePatterns = [...] }).
|
|      LAYER 2 -- Detection / rule evaluator
|        Invoke-SIDetect -Asset $a -Detect $d -> [bool]
|          Walks $d.any[] (true if ANY kind handler returns true) or
|          $d.all[] (true only if ALL handlers return true). Per ARCHITECTURE
|          .md § 7 each detection has an `any:` or `all:` array.
|
|        Invoke-SIRuleEval -Asset $a -Rule $r -> [pscustomobject] | $null
|          Walks $r.Detections in array order. Returns the FIRST detection
|          whose Detect block matches, with its Set values bundled. Returns
|          $null when no detection matches (asset doesn't fit this rule).
|
|    Performance contract (ARCHITECTURE.md § 9):
|
|      Per-asset handlers MUST NOT make external network calls. They read
|      either from the asset row itself or from a pre-built bulk index.
|      Index builders for kinds that need external data (hasSoftwareInstalled,
|      groupMembership, hasAzureTagDirectOrParent, egKustoQuery, entraKustoQuery)
|      live in companion files added in .
|
|    4 kinds implemented (asset-row-only, no bulk fetch):
|      * nameMatches
|      * hasMdeMachineGroupTag
|      * egDetectedRoles
|      * hasEntraExtensionAttributeTag
|
|    4 kinds STUBBED (throw 'not yet implemented'):
|      * hasSoftwareInstalled       <- needs DeviceTvmSoftwareInventory bulk index
|      * groupMembership            <- needs Entra group-member bulk index
|      * hasAzureTagDirectOrParent  <- needs sub/MG hierarchy bulk index
|      * egKustoQuery               <- needs per-rule pre-fetch
|
|    Stage integration is NOT done in . Use Test-SIRuleEval to
|    exercise this against a sample asset object; engine integration ships
|    later. No stage calls it today and no setting turns it on.
|#>
|
|# ----------------------------------------------------------------------------
|# Helpers (asset-row reader + safe regex match)
|# ----------------------------------------------------------------------------
|
|function Get-SIAssetField {
|    <#
|        Reads a field from an asset, tolerating both [hashtable] and
|        [pscustomobject] shapes (assets can arrive as either depending on
|        the stage -- post-staging-blob round-trip they're PSCustomObject).
|        Returns $null when the field doesn't exist.
|
|        also walks $Asset.Metadata.<Name> as a fallback. Azure
|        records (and endpoint records cross-source merge)
|        carry AZ_*/MDE_*/ENTRA_*/EG_* fields under .Metadata, not at top
|        level. Without this fallback, Test-SIKind_hasAzureTagDirectOrParent
|        and other rule kinds saw $null for AZ_ResourceId on every asset and
|        no rules ever matched.
|    #>
|    param(
|        [Parameter(Mandatory)]$Asset,
|        [Parameter(Mandatory)][string]$Name
|    )
|    if ($null -eq $Asset) { return $null }
|
|    # Top-level lookup
|    $val = $null
|    if ($Asset -is [System.Collections.IDictionary]) {
|        if ($Asset.Contains($Name)) { $val = $Asset[$Name] }
|    } else {
|        $prop = $Asset.PSObject.Properties[$Name]
|        if ($prop) { $val = $prop.Value }
|    }
|    if ($null -ne $val -and "$val" -ne '') { return $val }
|
|    # Metadata-bag fallback
|    $meta = $null
|    if ($Asset -is [System.Collections.IDictionary]) {
|        if ($Asset.Contains('Metadata')) { $meta = $Asset['Metadata'] }
|    } else {
|        $mp = $Asset.PSObject.Properties['Metadata']
|        if ($mp) { $meta = $mp.Value }
|    }
|    if ($null -ne $meta) {
|        if ($meta -is [System.Collections.IDictionary]) {
|            if ($meta.Contains($Name)) { return $meta[$Name] }
|        } else {
|            $mp2 = $meta.PSObject.Properties[$Name]
|            if ($mp2) { return $mp2.Value }
|        }
|    }
|    return $null
|}
|
|function Test-SIPatternMatch {
|    <#
|        Tests $Value against an array of regex patterns. Returns $true on
|        first hit. Empty/null Value or empty pattern array -> $false.
|        Regex compile failures are logged and swallowed (one bad pattern
|        in a 500-rule set must not stop evaluation).
|    #>
|    param(
|        [string]$Value,
|        [string[]]$Patterns
|    )
|    if ([string]::IsNullOrEmpty($Value) -or -not $Patterns -or $Patterns.Count -eq 0) {
|        return $false
|    }
|    foreach ($p in $Patterns) {
|        if ([string]::IsNullOrWhiteSpace($p)) { continue }
|        try {
|            if ([System.Text.RegularExpressions.Regex]::IsMatch($Value, $p)) { return $true }
|        } catch {
|            Write-Verbose ('Test-SIPatternMatch: invalid regex {0} -- {1}' -f $p, $_.Exception.Message)
|        }
|    }
|    return $false
|}
|
|# ----------------------------------------------------------------------------
|# Implemented handlers (asset-row-only, no bulk fetch needed)
|# ----------------------------------------------------------------------------
|
|function Test-SIKind_osPlatform {
|    <#
|        kind: osPlatform
|          osPatterns:                      # any-match (regex; case-insensitive)
|            - '(?i)^Windows10$'
|            - '(?i)^Windows11$'
|            - '(?i)^macOS'
|        Reads MDE_OSPlatform / ENTRA_OS / EG.osPlatform / EG.osPlatformFriendlyName.
|    #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $patterns = @($Args.osPatterns)
|    if (-not $patterns) { $patterns = @($Args.patterns) }
|    if (-not $patterns -or $patterns.Count -eq 0) { return $false }
|    foreach ($field in @('MDE_OSPlatform','ENTRA_OS','EG_OS')) {
|        $val = [string](Get-SIAssetField -Asset $Asset -Name $field)
|        if ($val -and (Test-SIPatternMatch -Value $val -Patterns $patterns)) { return $true }
|    }
|    return $false
|}
|
|function Get-SIAssetOsClass {
|    <#
|    .SYNOPSIS
|        Coarse OS classification for fast per-rule scope filtering in Stage Profile.
|
|    .DESCRIPTION
|        Returns one of: WindowsServer, WindowsClient, Linux, macOS, iOS, Android,
|        IoT, Other. Reads the same MDE_OSPlatform / ENTRA_OS / EG_OS fields the
|        existing osPlatform rule kind uses. First non-empty wins.
|
|        Used by Invoke-Profile.ps1 to short-circuit rule evaluation when a rule
|        declares `osPlatformScope: [WindowsServer,...]` and the asset's class
|        isn't in the list. Avoids running ~589 server-app rules against
|        workstations / IoT / mobile and similar wasted permutations.
|
|        Match table (case-insensitive prefix on the raw OS string):
|          WindowsServer  : Windows Server, WindowsServer
|          WindowsClient  : Windows10, Windows11, Windows7, Windows8
|          Linux          : Linux, Ubuntu, Debian, RHEL, CentOS, Fedora, SUSE,
|                           Oracle, AmazonLinux, AlmaLinux, Rocky
|          macOS          : macOS, Mac OS, OSX
|          iOS            : iOS, iPadOS
|          Android        : Android
|          IoT            : TvOS, WatchOS, IoT, Embedded, ChromeOS
|          Other          : nothing matched (empty / unknown OS)
|    #>
|    param([Parameter(Mandatory)]$Asset)
|    $os = $null
|    foreach ($field in @('MDE_OSPlatform','ENTRA_OS','EG_OS')) {
|        $v = [string](Get-SIAssetField -Asset $Asset -Name $field)
|        if (-not [string]::IsNullOrWhiteSpace($v)) { $os = $v; break }
|    }
|    if ([string]::IsNullOrWhiteSpace($os)) { return 'Other' }
|    switch -Regex ($os) {
|        '(?i)windows[\s_-]*server'                                                 { return 'WindowsServer' }
|        '(?i)^windowsserver'                                                       { return 'WindowsServer' }
|        '(?i)^windows(7|8|8\.1|10|11)$'                                            { return 'WindowsClient' }
|        '(?i)^windows[\s_-]?(10|11)'                                               { return 'WindowsClient' }
|        '(?i)^(linux|ubuntu|debian|rhel|redhat|centos|fedora|suse|oracle|amazonlinux|almalinux|rocky)' { return 'Linux' }
|        '(?i)^(macos|mac os|osx)'                                                  { return 'macOS' }
|        '(?i)^(ios|ipados)'                                                        { return 'iOS' }
|        '(?i)^android'                                                             { return 'Android' }
|        '(?i)^(tvos|watchos|iot|embedded|chromeos)'                                { return 'IoT' }
|        default                                                                    { return 'Other' }
|    }
|}
|
|function Test-SIKind_nameMatches {
|    <#
|        kind: nameMatches
|          namePatterns:
|            - '(?i)^dc\d'
|            - '(?i)domain.controller'
|        Reads asset Name / Hostname / DisplayName fields and tests each
|        regex pattern. Hits any -> true.
|    #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $patterns = @($Args.namePatterns)
|    if (-not $patterns) { $patterns = @($Args.patterns) }   # accept either spelling
|    if (-not $patterns -or $patterns.Count -eq 0) { return $false }
|
|    foreach ($field in @('Name','Hostname','DisplayName','Fqdn','MDE_DeviceName','ENTRA_DisplayName','AZ_Name')) {
|        $val = [string](Get-SIAssetField -Asset $Asset -Name $field)
|        if ($val -and (Test-SIPatternMatch -Value $val -Patterns $patterns)) { return $true }
|    }
|    return $false
|}
|
|function Test-SIKind_hasMdeMachineGroupTag {
|    <#
|        kind: hasMdeMachineGroupTag
|          machineTagPatterns: [ '(?i)domain.controller', '(?i)tier.?0' ]
|        Reads asset MDE_MachineGroup (a string, comma- or semicolon-
|        separated when multiple groups) and tests each regex against it.
|    #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $patterns = @($Args.machineTagPatterns)
|    if (-not $patterns) { $patterns = @($Args.patterns) }
|    # a bare tier pattern ('(?i)tier.?0') matches every operator tier tag, so it is no evidence of the rule's role (a PAW
|    # tagged PAWDevices--tier0--SI became a Domain Controller); the tier tag is its own contributor (tenant_si_manual_tag)
|    $patterns = @($patterns | Where-Object { $_ -and ([string]$_ -notmatch '^(\(\?i\))?\^?tier(\.|\[[^\]]*\]|[_-])?[?*]?\d\$?$') })
|    if (-not $patterns -or $patterns.Count -eq 0) { return $false }
|
|    $val = [string](Get-SIAssetField -Asset $Asset -Name 'MDE_MachineGroup')
|    if (-not $val) { return $false }
|    return (Test-SIPatternMatch -Value $val -Patterns $patterns)
|}
|
|function Test-SIKind_egDetectedRoles {
|    <#
|        kind: egDetectedRoles
|          egSignals: [ 'isDomainController' ]
|        Reads asset EG_DetectedRoles (semicolon-joined string from
|        ExposureGraphNodes confidenceHigh/confidenceLow arrays) AND
|        EG_RawData (full JSON blob) for properties like isDomainController.
|    #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $signals = @()
|    if ($Args.egSignals) { $signals = @($Args.egSignals) }
|    elseif ($Args.roles) { $signals = @($Args.roles) }
|    if ($signals.Count -eq 0) { return $false }
|
|    $detectedRoles = [string](Get-SIAssetField -Asset $Asset -Name 'EG_DetectedRoles')
|    foreach ($s in $signals) {
|        if ([string]::IsNullOrWhiteSpace($s)) { continue }
|        # Two match modes:
|        #   1) substring match against EG_DetectedRoles string
|        #   2) boolean property match against EG_RawData (e.g. isDomainController=true)
|        if ($detectedRoles -and $detectedRoles -match [regex]::Escape($s)) { return $true }
|
|        $rawData = Get-SIAssetField -Asset $Asset -Name 'EG_RawData'
|        if ($rawData) {
|            $propVal = if ($rawData -is [System.Collections.IDictionary]) {
|                if ($rawData.ContainsKey($s)) { $rawData[$s] } else { $null }
|            } else {
|                $p = $rawData.PSObject.Properties[$s]
|                if ($p) { $p.Value } else { $null }
|            }
|            if ($propVal -eq $true -or $propVal -eq 'true') { return $true }
|        }
|    }
|    return $false
|}
|
|function Test-SIKind_hasEntraExtensionAttributeTag {
|    <#
|        kind: hasEntraExtensionAttributeTag
|          attribute: extensionAttribute6
|          value:     'Internal_User'
|          match:     exact
|        Reads ENTRA_ExtensionAttributes (a JSON blob or hashtable with
|        extensionAttribute1..15 keys). 'exact' requires full string match;
|        anything else allows substring (case-insensitive).
|    #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $attrName = [string]$Args.attribute
|    $value    = [string]$Args.value
|    $matchKind = if ($Args.match) { [string]$Args.match } else { 'exact' }
|    if ([string]::IsNullOrWhiteSpace($attrName) -or [string]::IsNullOrWhiteSpace($value)) { return $false }
|
|    # First try direct flat field (some collectors flatten extensionAttributeN to top-level)
|    $direct = [string](Get-SIAssetField -Asset $Asset -Name ('ENTRA_' + $attrName))
|    if ($direct) {
|        # PS 5.1 has no ternary -- explicit if/else (ternary lands in PS 7+).
|        if ($matchKind -eq 'exact') { return ($direct -ceq $value) }
|        return ($direct -like ('*' + $value + '*'))
|    }
|
|    # Fallback to nested ENTRA_ExtensionAttributes / ExtensionAttributes object
|    foreach ($container in @('ENTRA_ExtensionAttributes','ExtensionAttributes','extensionAttributes')) {
|        $obj = Get-SIAssetField -Asset $Asset -Name $container
|        if ($null -eq $obj) { continue }
|        $val = if ($obj -is [System.Collections.IDictionary]) {
|            if ($obj.ContainsKey($attrName)) { $obj[$attrName] } else { $null }
|        } else {
|            $p = $obj.PSObject.Properties[$attrName]
|            if ($p) { $p.Value } else { $null }
|        }
|        if ($null -ne $val) {
|            $sval = [string]$val
|            if ($matchKind -eq 'exact') { if ($sval -ceq $value) { return $true } }
|            else                        { if ($sval -like ('*' + $value + '*')) { return $true } }
|        }
|    }
|    return $false
|}
|
|# ----------------------------------------------------------------------------
|# Bulk-index handlers
|# ----------------------------------------------------------------------------
|
|function Test-SIKind_hasSoftwareInstalled {
|    <# Looks up MDE_DeviceId in tvmSoftware index. Pattern '<vendor>/<name>'
|       allows wildcards via -like. Returns true on first match. #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $patterns = @($Args.tvmSoftwareNames)
|    if (-not $patterns -or $patterns.Count -eq 0) { return $false }
|
|    $devId = [string](Get-SIAssetField -Asset $Asset -Name 'MDE_DeviceId')
|    if (-not $devId) { $devId = [string](Get-SIAssetField -Asset $Asset -Name 'PrimaryEntityId') }
|    if (-not $devId) { return $false }
|
|    $idx = if (Get-Variable -Name SIRuleIndexes -Scope Script -ErrorAction SilentlyContinue) { $script:SIRuleIndexes.tvmSoftware } else { $null }
|    if (-not $idx) { Write-Verbose 'hasSoftwareInstalled: tvmSoftware index not built (call Build-SIRuleIndexes first)'; return $false }
|    $pairs = $idx[$devId.ToLower()]
|    if (-not $pairs) { return $false }
|
|    foreach ($pair in $pairs) {
|        foreach ($p in $patterns) {
|            $glob = ([string]$p).ToLower()
|            if ($pair -like $glob -or $pair -like ('*/' + $glob)) { return $true }
|        }
|    }
|    return $false
|}
|
|function Test-SIKind_groupMembership {
|    <# renamed from adGroupMember. Looks up identity object id
|       in GroupMembership index (sourced from ENTRA_Groups field on the asset row).
|       Exact (case-insensitive) group-name match.
|       index renamed adGroups -> GroupMembership; align key
|       candidates with Build-SIGroupMembershipIndex --
|       discovery emits ENTRA_UserId (not AccountObjectId; that's IdentityInfo's
|       field name). PrimaryEntityId is only set by the row-builder at Output
|       stage, NOT during Profile when this matcher runs. Without ENTRA_UserId
|       in the candidate list, the lookup misses every identity even when the
|       index correctly contains them -> SIRules ends up empty. Last-resort
|       fallback also added: extract from AssetId 'entra-user:<guid>'. #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $target = [string]$Args.group
|    if ([string]::IsNullOrWhiteSpace($target)) { return $false }
|
|    # short-circuit for non-user assets. SPs/MIs are not members
|    # of org-finance / org-hr / etc. for tier-classification purposes -- the
|    # builder doesn't index them (would always miss anyway). This skips the
|    # AssetId regex + Get-SIAssetField calls per non-user iteration.
|    $aid = [string](Get-SIAssetField -Asset $Asset -Name 'AssetId')
|    if ($aid -and $aid -notmatch '^entra-user:') { return $false }
|
|    $key = $null
|    foreach ($f in @('PrimaryEntityId','AccountObjectId','ENTRA_UserId','ENTRA_ObjectId')) {
|        $v = [string](Get-SIAssetField -Asset $Asset -Name $f)
|        if ($v) { $key = $v.ToLower(); break }
|    }
|    if (-not $key) {
|        $aid = [string](Get-SIAssetField -Asset $Asset -Name 'AssetId')
|        if ($aid -match '^entra-user:(?<id>.+)$') { $key = $matches.id.ToLower() }
|    }
|    if (-not $key) { return $false }
|
|    $idx = if (Get-Variable -Name SIRuleIndexes -Scope Script -ErrorAction SilentlyContinue) { $script:SIRuleIndexes.GroupMembership } else { $null }
|    if (-not $idx) { Write-Verbose 'groupMembership: GroupMembership index not built'; return $false }
|    $groups = $idx[$key]
|    if (-not $groups) { return $false }
|    # case-insensitive end-to-end. Both sides .ToLowerInvariant()
|    # (locale-safe -- ToLower() in tr-TR locale would map "I" -> "i_" not "i").
|    # -icontains is explicit case-insensitive (-contains is also CI but the
|    # explicit form documents intent).
|    return ($groups -icontains $target.ToLowerInvariant())
|}
|
|function Test-SIMatchOperator {
|    <# shared match-operator helper. Used by tag-related detect kinds
|       so YAML rules can express richer comparisons than raw equality.
|       Operators (case-insensitive on operator name AND value):
|         equal   (default) -- exact string match
|         like              -- PowerShell -like wildcard ('*foo*', 'bar?')
|         has               -- contains substring (case-insensitive)
|         regex / matches   -- .NET regex match (caller can write '(?i)' inline for case)
|         in                -- value appears in a list/array
|         startswith        -- prefix match
|         endswith          -- suffix match
|       Returns $false on $null Actual or unknown operator. #>
|    param([string]$Actual, $Expected, [string]$Op = 'equal')
|    if ($null -eq $Actual) { return $false }
|    $opLc = if ($Op) { $Op.ToLowerInvariant() } else { 'equal' }
|    switch ($opLc) {
|        'equal'      { return ([string]$Actual -ieq [string]$Expected) }
|        'like'       { return ([string]$Actual -ilike [string]$Expected) }
|        'has'        { return ([string]$Actual -imatch [regex]::Escape([string]$Expected)) }
|        'startswith' { return ([string]$Actual).ToLowerInvariant().StartsWith(([string]$Expected).ToLowerInvariant()) }
|        'endswith'   { return ([string]$Actual).ToLowerInvariant().EndsWith(([string]$Expected).ToLowerInvariant()) }
|        'regex'      { try { return ([string]$Actual -imatch [string]$Expected) } catch { return $false } }
|        'matches'    { try { return ([string]$Actual -imatch [string]$Expected) } catch { return $false } }
|        'in' {
|            $list = if ($Expected -is [System.Collections.IEnumerable] -and $Expected -isnot [string]) { @($Expected) } else { @($Expected) }
|            foreach ($v in $list) { if ([string]$Actual -ieq [string]$v) { return $true } }
|            return $false
|        }
|        default {
|            Write-Verbose ("Test-SIMatchOperator: unknown operator '{0}', defaulting to 'equal'" -f $Op)
|            return ([string]$Actual -ieq [string]$Expected)
|        }
|    }
|}
|
|function Test-SIKind_hasAzureTagDirectOrParent {
|    <# Checks an Azure tag directly on the resource, OR inherited from any parent
|       container (RG -> subscription -> management group). Consults the parentChain
|       index built once per run by Build-SIParentResourceChainIndex.
|       optional `match` arg supports equal|like|has|regex|matches|in|
|       startswith|endswith. Default 'equal'. Tag KEY is always exact (case-insensitive). #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $tagKey = [string]$Args.tag
|    $tagVal = $Args.value
|    $op     = if ($Args.match) { [string]$Args.match } else { 'equal' }
|    if ([string]::IsNullOrWhiteSpace($tagKey)) { return $false }
|
|    $resourceId = [string](Get-SIAssetField -Asset $Asset -Name 'AZ_ResourceId')
|    if (-not $resourceId) { $resourceId = [string](Get-SIAssetField -Asset $Asset -Name 'PrimaryEntityId') }
|    if (-not $resourceId) { return $false }
|
|    $idx = if (Get-Variable -Name SIRuleIndexes -Scope Script -ErrorAction SilentlyContinue) { $script:SIRuleIndexes.parentChain } else { $null }
|    if (-not $idx) { Write-Verbose 'hasAzureTagDirectOrParent: parentChain index not built'; return $false }
|
|    $chain = @()
|    $rid = $resourceId.ToLower()
|    if ($idx.ContainsKey($rid)) { $chain += $idx[$rid] }
|    if ($rid -match '^(/subscriptions/[^/]+/resourcegroups/[^/]+)') {
|        $rgKey = $matches[1].ToLower()
|        if ($idx.ContainsKey($rgKey)) { $chain += $idx[$rgKey] }
|    }
|    if ($rid -match '^(/subscriptions/[^/]+)') {
|        $subKey = $matches[1].ToLower()
|        if ($idx.ContainsKey($subKey)) { $chain += $idx[$subKey] }
|    }
|
|    foreach ($t in $chain) {
|        if ([string]$t.tag -ieq $tagKey) {
|            # No value supplied -> presence-only check (any non-empty value matches)
|            if ($null -eq $tagVal -or ($tagVal -is [string] -and [string]::IsNullOrEmpty([string]$tagVal))) { return $true }
|            if (Test-SIMatchOperator -Actual ([string]$t.value) -Expected $tagVal -Op $op) { return $true }
|        }
|    }
|    return $false
|}
|
|function Test-SIIpInCidr {
|    <# Returns $true if $Ip is inside the IPv4 / IPv6 $Cidr ('a.b.c.d/N').
|       Pure byte-mask compare so it works in PS 5.1. Bad input -> $false. #>
|    param([string]$Ip, [string]$Cidr)
|    if ([string]::IsNullOrWhiteSpace($Ip) -or [string]::IsNullOrWhiteSpace($Cidr)) { return $false }
|    $parts = $Cidr -split '/'
|    if ($parts.Count -ne 2) { return $false }
|    try {
|        $ipObj  = [System.Net.IPAddress]::Parse($Ip.Trim())
|        $netObj = [System.Net.IPAddress]::Parse($parts[0].Trim())
|        if ($ipObj.AddressFamily -ne $netObj.AddressFamily) { return $false }
|        $ipBytes  = $ipObj.GetAddressBytes()
|        $netBytes = $netObj.GetAddressBytes()
|        $bits = [int]$parts[1]
|        for ($i = 0; $i -lt $ipBytes.Length; $i++) {
|            $byteBits = [Math]::Min(8, [Math]::Max(0, $bits - ($i * 8)))
|            if ($byteBits -eq 0) { return $true }
|            $mask = [byte](256 - [Math]::Pow(2, 8 - $byteBits))
|            if (($ipBytes[$i] -band $mask) -ne ($netBytes[$i] -band $mask)) { return $false }
|        }
|        return $true
|    } catch { return $false }
|}
|
|function Test-SIKind_ipInRange {
|    <# detect kind: matches when ANY of the asset's IP-bearing
|       fields falls within ANY of the supplied CIDR ranges. Cross-engine:
|       walks well-known endpoint AND azure IP carriers.
|
|         - kind: ipInRange
|           cidrs: ['10.100.1.0/24', '10.100.2.0/24']
|           # Optional: restrict which fields to read
|           # fields: ['MDE_EffectiveIpAddresses','MDE_PublicIp']
|
|       Default fields scanned (in order):
|         endpoint:  MDE_EffectiveIpAddresses, MDE_PublicIp,
|                    MDE_LastIpAddress, EG_PublicIp, EG_PrivateIp
|         azure:     AZ_PropertiesJson.ipAddress (publicIPAddress),
|                    AZ_PropertiesJson.ipConfigurations[*].properties.privateIPAddress
|                    (network interface; walked at runtime via JSON parse)
|
|       Field values may be a single IP string, a comma-separated string,
|       a JSON string array, or a [string[]] array -- all flattened. #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|
|    $cidrs = @(if ($Args.cidrs) { @($Args.cidrs) } elseif ($Args.cidr) { @($Args.cidr) } else { @() })
|    $cidrs = $cidrs | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }
|    if ($cidrs.Count -eq 0) { return $false }
|
|    # scan ALL SOURCES OF TRUTH, not just MDE. Order = priority but
|    # ANY hit suffices. MDE_EffectiveIpAddresses is already a UNION of MDE
|    # DeviceInfo + EG internalIpAddresses + EG lastIpAddress + Entra + ARG NIC +
|    # AD + CMDB (Collect stage merges them per record, see contract).
|    # The per-source backstops below catch records where the union didn't run --
|    # e.g. EG-only assets or azure-engine resources.
|    $defaultFields = @(
|        # MDE (Microsoft Defender for Endpoint -- machine + DeviceInfo)
|        'MDE_EffectiveIpAddresses','MDE_PublicIp','MDE_LastIpAddress',
|        # Exposure Graph (Microsoft Security Exposure Management -- security view)
|        'EG_PublicIp','EG_PrivateIp','EG_LastIpAddress','EG_InternalIpAddresses',
|        # Entra (Entra ID joined device record)
|        'ENTRA_PrivateIp','ENTRA_PublicIp','ENTRA_IpAddress',
|        # Azure (ARG: VM NIC private IPs / PIP ipAddress)
|        'AZ_PrivateIp','AZ_PrivateIpAddresses','AZ_PublicIp',
|        # AD (on-prem Active Directory computer object -- enrichment coming)
|        'AD_IpAddress','AD_IpAddresses',
|        # CMDB (matched CI's IP fields -- folded by Reconcile from CMDB.csv columns)
|        'CMDB_PrivateIp','CMDB_IpAddresses','CMDB_ip','CMDB_private_ip'
|    )
|    $fields = if ($Args.fields) { @($Args.fields) } else { $defaultFields }
|
|    # Collect candidate IP strings
|    $ips = New-Object System.Collections.Generic.List[string]
|    foreach ($f in $fields) {
|        $v = Get-SIAssetField -Asset $Asset -Name $f
|        if ($null -eq $v) { continue }
|        # Flatten: single IP, comma-list, JSON array, or [string[]] array
|        if ($v -is [System.Collections.IEnumerable] -and -not ($v -is [string])) {
|            foreach ($x in $v) { if ($x) { $ips.Add([string]$x) } }
|            continue
|        }
|        $s = [string]$v
|        if ([string]::IsNullOrWhiteSpace($s)) { continue }
|        # JSON array string?
|        if ($s.StartsWith('[')) {
|            try { foreach ($x in ($s | ConvertFrom-Json)) { if ($x) { $ips.Add([string]$x) } } } catch { $ips.Add($s) }
|            continue
|        }
|        # Comma / semicolon list
|        foreach ($p in ($s -split '[,;]\s*')) { if ($p) { $ips.Add($p.Trim()) } }
|    }
|
|    # Azure VM/NIC fallback -- pull privateIP / ipAddress from AZ_PropertiesJson
|    $azPropsJson = [string](Get-SIAssetField -Asset $Asset -Name 'AZ_PropertiesJson')
|    if ($azPropsJson) {
|        try {
|            $p = $azPropsJson | ConvertFrom-Json
|            if ($p.PSObject.Properties['ipAddress']) { $ips.Add([string]$p.ipAddress) }
|            if ($p.PSObject.Properties['ipConfigurations']) {
|                foreach ($cfg in $p.ipConfigurations) {
|                    if ($cfg.properties -and $cfg.properties.PSObject.Properties['privateIPAddress']) {
|                        $ips.Add([string]$cfg.properties.privateIPAddress)
|                    }
|                }
|            }
|        } catch {}
|    }
|
|    if ($ips.Count -eq 0) { return $false }
|    foreach ($ip in $ips) {
|        if ([string]::IsNullOrWhiteSpace($ip)) { continue }
|        foreach ($cidr in $cidrs) {
|            if (Test-SIIpInCidr -Ip $ip -Cidr $cidr) { return $true }
|        }
|    }
|    return $false
|}
|
|function Get-SIAssetTagPairs {
|    <# cross-source-of-truth tag carrier walker. Returns a flat
|       list of @{ Key=<string|null>; Value=<string>; Source=<string> } pairs
|       for an asset by walking every supported tag carrier on its Metadata.
|
|       Carriers walked (works for endpoint, identity, AND azure assets --
|       absent fields just don't contribute):
|
|         MDE   value-only:  MDE_MachineTags
|         EG    value-only:  EG_RawData.deviceDynamicTags / deviceManualTags
|         EG    key:value:   EG_RawData.tags (some node types)
|         Entra key:value:   ENTRA_ExtensionAttribute1..15
|         Entra key:value:   ENTRA_OnPremisesExtensionAttributes (dict)
|         ARM   key:value:   AZ_TagsJson (parsed) -- direct on the resource
|         ARM   key:value:   parentChain index lookup (sub/RG inheritance)
|         CMDB  key:value:   Metadata.CMDB_<col> (Reconcile-folded CSV columns)
|         AD    value-only:  AD_GroupMemberships (placeholder, when present)
|
|       Pairs with $null Key are "value-only" (presence in a list); pairs with
|       a non-null Key are "key:value". The matcher in Test-SIKind_hasTag
|       handles both shapes, including the convention where a value-only list
|       carries a literal "key:value" or "key=value" string. #>
|    param([Parameter(Mandatory)]$Asset)
|    $pairs = New-Object System.Collections.Generic.List[object]
|
|    $meta = $null
|    if ($Asset -is [System.Collections.IDictionary]) { if ($Asset.Contains('Metadata')) { $meta = $Asset['Metadata'] } }
|    elseif ($Asset.PSObject.Properties['Metadata'])  { $meta = $Asset.PSObject.Properties['Metadata'].Value }
|
|    function _flattenList($v) {
|        if ($null -eq $v) { return @() }
|        if ($v -is [string]) {
|            $s = [string]$v
|            # PS 5.1 note -- `@(pipeline | ConvertFrom-Json)` collapses to a SINGLE element on 5.1
|            # (7 unrolls). This line is CORRECT anyway, but only because `return` unrolls a second
|            # time. Verified on 5.1.20348: this form yields the real element count. Do NOT copy the
|            # shape into a plain ASSIGNMENT (`$x = @(... | ConvertFrom-Json)`) -- that keeps the
|            # collapse and hands you one opaque array. See Invoke-Enrich.ps1's signals_json parse.
|            if ($s.StartsWith('[')) { try { return @($s | ConvertFrom-Json -ErrorAction Stop) } catch { return @($s -split '[,;]\s*') } }
|            return @($s -split '[,;]\s*')
|        }
|        if ($v -is [System.Collections.IEnumerable]) { return @($v) }
|        return @($v)
|    }
|    function _flattenDict($obj) {
|        # Returns @( @{k=..; v=..}, ... ) for a hashtable / pscustomobject / JSON-string dict.
|        if ($null -eq $obj) { return @() }
|        if ($obj -is [string]) { try { $obj = $obj | ConvertFrom-Json -ErrorAction Stop } catch { return @() } }
|        $out = @()
|        if ($obj -is [System.Collections.IDictionary]) {
|            foreach ($k in $obj.Keys) { $out += @{ k=[string]$k; v=[string]$obj[$k] } }
|        } elseif ($obj.PSObject -and $obj.PSObject.Properties) {
|            foreach ($p in $obj.PSObject.Properties) { $out += @{ k=[string]$p.Name; v=[string]$p.Value } }
|        }
|        return $out
|    }
|
|    # MDE machine tags (value-only)
|    foreach ($t in (_flattenList (Get-SIAssetField -Asset $Asset -Name 'MDE_MachineTags'))) {
|        if ($t) { [void]$pairs.Add(@{ Key=$null; Value=[string]$t; Source='mde' }) }
|    }
|
|    # EG rawData.deviceDynamicTags / deviceManualTags / tags (mix shapes)
|    $egRaw = Get-SIAssetField -Asset $Asset -Name 'EG_RawData'
|    if (-not $egRaw) {
|        $egRawJson = Get-SIAssetField -Asset $Asset -Name 'AZ_PropertiesRawJson'
|        if ($egRawJson -is [string]) {
|            try {
|                $parsed = $egRawJson | ConvertFrom-Json -ErrorAction Stop
|                $egRaw = if ($parsed.PSObject.Properties['rawData']) { $parsed.rawData } else { $parsed }
|            } catch {}
|        }
|    }
|    if ($egRaw) {
|        foreach ($f in @('deviceDynamicTags','deviceManualTags')) {
|            if ($egRaw.PSObject.Properties[$f]) {
|                foreach ($t in @($egRaw.$f)) { if ($t) { [void]$pairs.Add(@{ Key=$null; Value=[string]$t; Source='eg' }) } }
|            }
|        }
|        if ($egRaw.PSObject.Properties['tags']) {
|            foreach ($p in (_flattenDict $egRaw.tags)) { [void]$pairs.Add(@{ Key=$p.k; Value=$p.v; Source='eg' }) }
|        }
|    }
|
|    # Entra extensionAttribute1..15
|    for ($i = 1; $i -le 15; $i++) {
|        $v = Get-SIAssetField -Asset $Asset -Name ("ENTRA_ExtensionAttribute$i")
|        if ($v) { [void]$pairs.Add(@{ Key=("extensionAttribute$i"); Value=[string]$v; Source='entra' }) }
|    }
|    # Entra onPremisesExtensionAttributes (key:value dict)
|    foreach ($p in (_flattenDict (Get-SIAssetField -Asset $Asset -Name 'ENTRA_OnPremisesExtensionAttributes'))) {
|        [void]$pairs.Add(@{ Key=$p.k; Value=$p.v; Source='entra' })
|    }
|
|    # ARM tags directly on the resource (azure engine)
|    foreach ($p in (_flattenDict (Get-SIAssetField -Asset $Asset -Name 'AZ_TagsJson'))) {
|        [void]$pairs.Add(@{ Key=$p.k; Value=$p.v; Source='arm' })
|    }
|
|    # ARM tags via parent chain (cross-engine: endpoint linked to Azure VM, etc.)
|    $resId = Get-SIAssetField -Asset $Asset -Name 'AZ_ResourceId'
|    if (-not $resId) { $resId = Get-SIAssetField -Asset $Asset -Name 'MDE_AzureResourceId' }
|    if (-not $resId) { $resId = Get-SIAssetField -Asset $Asset -Name 'AzureResourceId' }
|    if ($resId) {
|        $idx = if (Get-Variable -Name SIRuleIndexes -Scope Script -ErrorAction SilentlyContinue) { $script:SIRuleIndexes.parentChain } else { $null }
|        if ($idx) {
|            $rid = ([string]$resId).ToLower()
|            $chain = @()
|            if ($idx.ContainsKey($rid)) { $chain += $idx[$rid] }
|            if ($rid -match '^(/subscriptions/[^/]+/resourcegroups/[^/]+)') {
|                $rgKey = $matches[1].ToLower()
|                if ($idx.ContainsKey($rgKey)) { $chain += $idx[$rgKey] }
|            }
|            if ($rid -match '^(/subscriptions/[^/]+)') {
|                $subKey = $matches[1].ToLower()
|                if ($idx.ContainsKey($subKey)) { $chain += $idx[$subKey] }
|            }
|            foreach ($t in $chain) { [void]$pairs.Add(@{ Key=[string]$t.tag; Value=[string]$t.value; Source=('arm:' + $t.level) }) }
|        }
|    }
|
|    # CMDB-folded fields (Reconcile stamps Metadata.CMDB_<col> = value)
|    if ($meta) {
|        $cmdbKeys = if ($meta -is [System.Collections.IDictionary]) { @($meta.Keys) } else { @($meta.PSObject.Properties.Name) }
|        foreach ($k in $cmdbKeys) {
|            if ($k -like 'CMDB_*') {
|                $val = if ($meta -is [System.Collections.IDictionary]) { $meta[$k] } else { $meta.$k }
|                if ($val) { [void]$pairs.Add(@{ Key=$k.Substring(5); Value=[string]$val; Source='cmdb' }) }
|            }
|        }
|    }
|
|    # AD security-group memberships (placeholder for the AD enricher -- value-only)
|    foreach ($t in (_flattenList (Get-SIAssetField -Asset $Asset -Name 'AD_GroupMemberships'))) {
|        if ($t) { [void]$pairs.Add(@{ Key=$null; Value=[string]$t; Source='ad' }) }
|    }
|
|    return $pairs
|}
|
|function Test-SIKind_hasTag {
|    <# unified cross-source tag matcher. Three modes (per
|       user-direction "tags are defined in 2 ways - value (only) and
|       key:value"):
|
|         tag only           -> key presence (any source has that key with non-empty value)
|         value only         -> value presence (any list contains it OR any dict has it as a value)
|         tag + value        -> exact pair (key:value carrier) OR literal "key:value" /
|                                "key=value" string in a value-only carrier
|
|       Refusal: plain `value: '<single-string>'` with no `match:` operator
|       is too broad (would match any 'cmdb:1' / 'Tier:1' / etc. lookalike
|       in any source). Author must use match: in/regex/like, OR pair with
|       `tag:`. Value alone with match: in [list] is allowed.
|
|       Operator support: equal | like | has | regex | matches |
|       in | startswith | endswith. Default 'equal'. All comparisons are
|       case-insensitive on both key and value.
|
|       Optional: `sources: ['mde','eg','entra','arm','cmdb','ad']` -- restrict
|       which carriers contribute. Default: all. #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|
|    $tagKey = if ($Args.tag)   { [string]$Args.tag }   else { $null }
|    $hasVal = $false
|    $tagVal = $null
|    if ($Args -is [System.Collections.IDictionary]) {
|        if ($Args.Contains('value')) { $hasVal = $true; $tagVal = $Args['value'] }
|    } elseif ($Args.PSObject.Properties['value']) {
|        $hasVal = $true; $tagVal = $Args.value
|    }
|    $op = if ($Args.match) { [string]$Args.match } else { 'equal' }
|
|    if ([string]::IsNullOrWhiteSpace($tagKey) -and -not $hasVal) {
|        Write-Verbose 'hasTag: refusing rule with neither tag nor value'
|        return $false
|    }
|    # Refuse value-only with op=equal AND value is a single scalar -- too broad
|    if ([string]::IsNullOrWhiteSpace($tagKey) -and $op -eq 'equal' -and $hasVal -and -not ($tagVal -is [System.Collections.IEnumerable] -and -not ($tagVal -is [string]))) {
|        Write-Verbose 'hasTag: refusing value-only equal rule (use match: in/regex/like or pair with tag:)'
|        return $false
|    }
|
|    $pairs = Get-SIAssetTagPairs -Asset $Asset
|    if ($pairs.Count -eq 0) { return $false }
|
|    # Optional source restriction
|    if ($Args.sources) {
|        $allow = @($Args.sources | ForEach-Object { ([string]$_).ToLowerInvariant() })
|        $pairs = @($pairs | Where-Object {
|            $src = ([string]$_.Source).ToLowerInvariant()
|            $base = $src.Split(':')[0]
|            ($src -in $allow) -or ($base -in $allow)
|        })
|    }
|
|    foreach ($p in $pairs) {
|        $pKey = [string]$p.Key
|        $pVal = [string]$p.Value
|        $isValueOnly = [string]::IsNullOrWhiteSpace($pKey)
|
|        if ($tagKey -and $hasVal) {
|            # MODE 3: exact key:value pair
|            if (-not $isValueOnly -and ($pKey -ieq $tagKey) -and (Test-SIMatchOperator -Actual $pVal -Expected $tagVal -Op $op)) { return $true }
|            # MODE 3 fallback: literal "key:value" or "key=value" inside a value-only list
|            if ($isValueOnly -and ($tagVal -isnot [System.Collections.IEnumerable] -or $tagVal -is [string])) {
|                $literal1 = ('{0}:{1}' -f $tagKey, $tagVal)
|                $literal2 = ('{0}={1}' -f $tagKey, $tagVal)
|                if (($pVal -ieq $literal1) -or ($pVal -ieq $literal2)) { return $true }
|            }
|        } elseif ($tagKey) {
|            # MODE 1: key presence
|            if (-not $isValueOnly -and ($pKey -ieq $tagKey) -and -not [string]::IsNullOrWhiteSpace($pVal)) { return $true }
|            # value-only carrier: literal "key:" / "key=" prefix
|            if ($isValueOnly) {
|                $prefixColon = ($tagKey + ':')
|                $prefixEqual = ($tagKey + '=')
|                if ($pVal.StartsWith($prefixColon, [StringComparison]::OrdinalIgnoreCase) -or
|                    $pVal.StartsWith($prefixEqual, [StringComparison]::OrdinalIgnoreCase)) { return $true }
|            }
|        } else {
|            # MODE 2: value presence anywhere (with operator -- usually 'in' or 'regex')
|            if (Test-SIMatchOperator -Actual $pVal -Expected $tagVal -Op $op) { return $true }
|        }
|    }
|    return $false
|}
|
|function Test-SIKind_mostFrequentUserTier {
|    <# Reads MostFrequentUserTier from asset Metadata (stamped by Enrich/
|       Get-SIBulkDeviceUserCorrelation from logon-graph + SI_Identity_Profile_CL).
|       Returns $true when the value is in the rule's tierValues list.
|       Used by AssetProfileByLogonUser to inherit endpoint tier from frequent
|       logon user (admin's PC -> T1, T2 user -> T2, T3 user -> T3). #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $v = Get-SIAssetField -Asset $Asset -Name 'MostFrequentUserTier'
|    if ($null -eq $v -or "$v" -eq '') { return $false }
|    try { $userTier = [int]$v } catch { return $false }
|    $vals = @($Args.tierValues)
|    if ($vals.Count -eq 0) { return $false }
|    foreach ($t in $vals) { if ([int]$t -eq $userTier) { return $true } }
|    return $false
|}
|
|function Test-SIKind_assetKind {
|    <# kind: assetKind
|         kinds: [endpoint, identity, azure, publicip]
|       Matches when the asset's kind (SI_AssetKind, stamped by whoever evaluates the rule -- the default tier
|       resolver, Resolve-SIDefaultTier.ps1) is in the list. Used by the default tier rule
|       (asset-profiling-enrichment/shared/AssetProfileByDefaultTier.locked.yaml) to give each asset kind its own
|       default. An asset without a kind never matches. #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $k = [string](Get-SIAssetField -Asset $Asset -Name 'SI_AssetKind')
|    if ([string]::IsNullOrWhiteSpace($k)) { return $false }
|    $vals = @($Args.kinds)
|    if ($vals.Count -eq 0) { $vals = @($Args.values) }
|    foreach ($v in $vals) {
|        foreach ($one in @(([string]$v) -split '[,;]\s*')) { if ($one.Trim() -and $one.Trim() -ieq $k.Trim()) { return $true } }
|    }
|    return $false
|}
|
|function Test-SIKind_egKustoQuery {
|    <# Consults per-rule kustoSets (built by Build-SIEgKustoQuerySets at IN).
|       Caller (Invoke-SIDetect) injects __ruleId into Args so we know which set. #>
|    param([Parameter(Mandatory)]$Asset, [Parameter(Mandatory)]$Args)
|    $ruleId = [string]$Args.__ruleId
|    if ([string]::IsNullOrWhiteSpace($ruleId)) { return $false }
|
|    $sets = if (Get-Variable -Name SIRuleIndexes -Scope Script -ErrorAction SilentlyContinue) { $script:SIRuleIndexes.kustoSets } else { $null }
|    if (-not $sets -or -not $sets.ContainsKey($ruleId)) { return $false }
|    $set = $sets[$ruleId]
|
|    foreach ($f in @('PrimaryEntityId','EG_NodeId','MDE_DeviceId','AccountObjectId')) {
|        $v = [string](Get-SIAssetField -Asset $Asset -Name $f)
|        if ($v -and $set.Contains($v.ToLower())) { return $true }
|    }
|    return $false
|}
|
|# ----------------------------------------------------------------------------
|# Registry (kind name -> handler function name)
|# ----------------------------------------------------------------------------
|
|# AUDIT #35 -- the 'nameMatches' entry below was CODE that a bulk comment-rewrite
|# turned into a COMMENT, and it shipped that way for the whole v2.2 lifetime.
|# 0412976e added it under a header comment naming the preview it landed in. The
|# v2.2.0 flatten (536e1405, 2026-05-04) stripped the version framing out of that
|# header and JOINED THE TWO LINES, so the registration became the tail of a
|# comment. The handler (Test-SIKind_nameMatches, above) was never touched -- only
|# its registration vanished, so Invoke-SIDetect treated the kind as unknown and
|# skipped it: 95 detections across 93 rule files silently lost their name-pattern
|# arm, on every customer, for every v2.2 release. Same family as #29 (a bulk
|# rewrite corrupting a file nobody re-read) and the same fail-open shape -- the
|# only trace was a Write-Verbose that prints for nobody.
|#
|# Kept OUTSIDE the hashtable on purpose: SI-RuleKindRegistry.Tests.ps1 scans the
|# registry BODY for a commented-out entry, which is the corruption's signature.
|# Prose inside the body would be indistinguishable from the thing being detected.
|$script:SIKindRegistry = @{
|    'nameMatches'                   = 'Test-SIKind_nameMatches'
|    'osPlatform'                    = 'Test-SIKind_osPlatform'
|    'hasMdeMachineGroupTag'         = 'Test-SIKind_hasMdeMachineGroupTag'
|    'egDetectedRoles'               = 'Test-SIKind_egDetectedRoles'
|    'hasEntraExtensionAttributeTag' = 'Test-SIKind_hasEntraExtensionAttributeTag'
|
|    # Stubbed -- implemented in alongside their bulk-source builders:
|    'hasSoftwareInstalled'          = 'Test-SIKind_hasSoftwareInstalled'
|    'groupMembership'               = 'Test-SIKind_groupMembership'
|    'hasAzureTagDirectOrParent'     = 'Test-SIKind_hasAzureTagDirectOrParent'
|    'egKustoQuery'                  = 'Test-SIKind_egKustoQuery'
|    'mostFrequentUserTier'          = 'Test-SIKind_mostFrequentUserTier'
|
|    # IP-subnet match for CMDB / role mapping
|    'ipInRange'                     = 'Test-SIKind_ipInRange'
|
|    # cross-source-of-truth tag matcher (works on endpoint, identity,
|    # azure -- walks MDE / EG / Entra / ARM / CMDB / AD carriers in one shot)
|    'hasTag'                        = 'Test-SIKind_hasTag'
|
|    # the asset's kind (endpoint / identity / azure / publicip) -- the default tier rule's per-kind detections
|    'assetKind'                     = 'Test-SIKind_assetKind'
|}
|
|function Get-SIKindRegistry { $script:SIKindRegistry }
|
|# ----------------------------------------------------------------------------
|# Detection + rule evaluators
|# ----------------------------------------------------------------------------
|
|function Invoke-SIDetect {
|    <#
|        Walks the `any` (OR-semantics) or `all` (AND-semantics) list of
|        kind specifications inside one detection. Returns $true on first
|        match (any) or first non-match (all).
|
|        $RuleId is optional context -- injected into each handler's Args
|        as `__ruleId` so per-rule index handlers (egKustoQuery) can look
|        up their pre-fetched set.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)]$Asset,
|        [Parameter(Mandatory)]$Detect,
|        [Parameter()][string]$RuleId
|    )
|
|    # Detect comes from YAML as @{ any = [...] } or @{ all = [...] }
|    $any = $false
|    $all = $false
|    $list = $null
|    if ($Detect.any) { $list = @($Detect.any); $any = $true }
|    elseif ($Detect.all) { $list = @($Detect.all); $all = $true }
|    if (-not $list) { return $false }
|
|    foreach ($spec in $list) {
|        $kind = [string]$spec.kind
|        if ([string]::IsNullOrWhiteSpace($kind)) { continue }
|        if (-not $script:SIKindRegistry.ContainsKey($kind)) {
|            Write-Verbose ('Invoke-SIDetect: unknown kind {0} -- skipping' -f $kind)
|            if ($all) { return $false }   # all-mode: unknown kind = AND-failure
|            continue
|        }
|        $handler = $script:SIKindRegistry[$kind]
|        $argsHash = @{}
|        # Strip 'kind' from the spec; everything else flows to the handler as Args
|        if ($spec -is [System.Collections.IDictionary]) {
|            foreach ($k in $spec.Keys) { if ($k -ne 'kind') { $argsHash[$k] = $spec[$k] } }
|        } else {
|            foreach ($p in $spec.PSObject.Properties) { if ($p.Name -ne 'kind') { $argsHash[$p.Name] = $p.Value } }
|        }
|        if ($RuleId) { $argsHash['__ruleId'] = $RuleId }
|        try {
|            $hit = & $handler -Asset $Asset -Args $argsHash
|        } catch {
|            Write-Verbose ('Invoke-SIDetect: handler {0} threw: {1}' -f $handler, $_.Exception.Message)
|            $hit = $false
|        }
|        if ($any -and $hit) { return $true }
|        if ($all -and -not $hit) { return $false }
|    }
|    return ($all)   # all-mode: reaching the end means every spec matched
|}
|
|function Invoke-SIRuleEval {
|    <#
|        Evaluates a single rule (one [pscustomobject] from Get-SIRuleSet)
|        against one asset. Walks $Rule.Detections in array order (first
|        match wins per ARCHITECTURE.md § 7). Returns either:
|          $null                        when no detection matched
|          [pscustomobject] @{          when a detection matched
|              RuleId        = $Rule.Id
|              DetectionId   = $matchedDet.Id
|              Set           = $matchedDet.Set      # tier / purpose / category / cmdb*
|              MatchedKinds  = @( ... )             # which kinds inside the match fired
|          }
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)]$Asset,
|        [Parameter(Mandatory)]$Rule
|    )
|
|    if ($Rule.Mode -eq 'disable') { return $null }
|    if (-not $Rule.Detections -or @($Rule.Detections).Count -eq 0) { return $null }
|
|    # Asset name used for per-detection ExcludeAssets matching. Pulled
|    # once outside the detection loop because the asset is constant for
|    # this call. Fallbacks (DeviceName -> FQDN -> ComputerName) cover
|    # the schema differences across MDE / EG / Entra / ARM inputs.
|    $assetName = $null
|    foreach ($f in 'Name','DeviceName','FQDN','ComputerName','HostName') {
|        $v = Get-SIAssetField -Asset $Asset -Name $f
|        if (-not [string]::IsNullOrWhiteSpace([string]$v)) { $assetName = [string]$v; break }
|    }
|
|    foreach ($det in $Rule.Detections) {
|        # Per-detection ExcludeAssets: device names / wildcards that
|        # should be skipped by THIS detection even if the detect block
|        # would match. Use when you can't remove the signal (legacy
|        # software installed for compatibility reasons, etc.) but want
|        # the asset out-of-scope for THIS specific detection. CI -like
|        # match supports * and ? wildcards. Exact strings work too.
|        if ($det.ExcludeAssets -and @($det.ExcludeAssets).Count -gt 0 -and $assetName) {
|            $skip = $false
|            foreach ($pat in $det.ExcludeAssets) {
|                if ($assetName -like $pat) { $skip = $true; break }
|            }
|            if ($skip) { continue }
|        }
|
|        $hit = Invoke-SIDetect -Asset $Asset -Detect $det.Detect -RuleId $Rule.Id
|        if ($hit) {
|            return [pscustomobject]@{
|                RuleId      = $Rule.Id
|                DetectionId = $det.Id
|                Set         = $det.Set
|            }
|        }
|    }
|    return $null
|}
|
|# ----------------------------------------------------------------------------
|# Test harness (no engine integration -- run interactively)
|# ----------------------------------------------------------------------------
|
|function Test-SIRuleEval {
|    <#
|        Quick validator: loads all rules for an engine via Get-SIRuleSet,
|        evaluates each against the supplied $Asset, returns matching rules
|        as a list. Useful for "would this asset get tagged?" pre-flight.
|
|        Usage:
|          $sample = @{ Name='dc01'; MDE_MachineGroup='DomainControllers' }
|          Test-SIRuleEval -Engine endpoint -Asset $sample
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)]
|        [ValidateSet('endpoint','identity','azure','publicip')]
|        [string]$Engine,
|
|        [Parameter(Mandatory)]
|        $Asset
|    )
|    . (Join-Path $PSScriptRoot 'Get-SIRuleSet.ps1')
|    $rules = Get-SIRuleSet -Engine $Engine
|    $hits = New-Object System.Collections.ArrayList
|    foreach ($r in $rules) {
|        $hit = Invoke-SIRuleEval -Asset $Asset -Rule $r
|        if ($hit) { [void]$hits.Add($hit) }
|    }
|    Write-Verbose ('Test-SIRuleEval: {0} rules evaluated, {1} matched' -f $rules.Count, $hits.Count)
|    return $hits.ToArray()
|}
'@ }
$__siSupportFiles['engine/asset-profiling/shared/Get-SIRuleSet.ps1'] = @{ Sha256 = '5c76912d582b83f1f0ea8ea924fdae87c5298f358e28bca31f99b691c1060ac3'; Text = @'
|#Requires -Version 5.1
|<#
|    Get-SIRuleSet.ps1
|
|    New rule loader for the AssetProfileBy* rules introduced in (ARCHITECTURE.md § 7). Reads YAMLs from:
|
|      v2.2/asset-profiling-enrichment/<engine>/AssetProfileBy*/*.yaml          (locked, ships in repo)
|      v2.2/asset-profiling-enrichment/<engine>/AssetProfileBy*.yaml            (locked, single-file flavour)
|      v2.2/asset-profiling-enrichment/shared/AssetProfileBy*.yaml
|      v2.2/asset-profiling-enrichment/<engine>/AssetProfileBy*/*.yaml   (customer overrides)
|      v2.2/asset-profiling-enrichment/<engine>/AssetProfileBy*.yaml     (customer overrides)
|      v2.2/asset-profiling-enrichment/shared/AssetProfileBy*.yaml
|
|    appliesTo accepts:
|      'endpoint' | 'identity' | 'azure' | 'publicip' (single)
|      'any'                                          (loads in every engine)
|      ['endpoint','identity']                        (YAML list)
|      'endpoint,identity'                            (comma-separated)
|
|    Returns array of [pscustomobject] in the schema:
|
|        Id          : <filename-basename, must equal $y.id>     -- string
|        AppliesTo   : 'endpoint' | 'identity' | 'azure'         -- string
|        Mode        : 'locked' | 'append' | 'merge' | 'overwrite' | 'disable'
|        Purpose     : free text                                 -- string
|        Category    : group label (e.g. 'Server Roles')         -- string
|        Description : multi-line                                -- string
|        Detections  : array of [pscustomobject] per detection block:
|            Id      : <inner detection id, mirrors file id when single-detection>
|            Detect  : @{ any=[detect-kinds] } OR @{ all=[detect-kinds] }
|            Set     : @{ Tier=N; Purpose='...'; Category='...'; cmdbId='...'; ... }
|        File        : repo-relative path, for diagnostics
|        Folder      : 'rules' | 'rules-custom'
|        SchemaShape : 'AssetProfileBy'                          -- discriminator
|                      so callers can tell new-loader rules apart
|                      from legacy Get-SIPostureRules output.
|
|    Backward compat note:
|
|      This loader does NOT replace Get-SIPostureRules. Both run side-by-side.
|      Callers opt in to the new loader explicitly. Old engine code that
|      reads from posture-rules-locked/ continues to work unchanged.
|
|      Future introduces RuleEval.ps1 (the kind: registry +
|      bulk-source builder). Until then, Get-SIRuleSet output is for
|      inspection / lint / new-stage prototyping only.
|
|    Locked + custom merge:
|
|      one rule per id: the highest-ranked custom file is combined with the
|      shipped (*.locked.yaml) rule of the same id by its mode -- overwrite /
|      append / merge / disable (#470, Merge-SIRuleOverride below).
|#>
|
|function Get-SIRuleSet {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)]
|        [ValidateSet('endpoint','identity','azure','publicip')]
|        [string]$Engine,
|
|        # Pass to restrict to a single AssetProfileBy* method (folder or file
|        # basename, e.g. 'AssetProfileByApplicationServiceDetection',
|        # 'AssetProfileByExtensionAttributes'). Empty = all methods.
|        [Parameter()]
|        [string]$Method,
|
|        # Pass $false to skip rules-custom/. Default loads both locked + custom.
|        [Parameter()]
|        [bool]$IncludeCustom = $true,
|
|        # AUDIT #29 -- test seam. Overrides the solution root this function would otherwise
|        # derive from $PSScriptRoot, so the rule-loading behaviour (notably the parse-failure
|        # reporting below) can be exercised against a scratch folder instead of the real
|        # enrichment tree. Production callers never pass it.
|        [Parameter()]
|        [string]$SolutionRootOverride,
|
|        # AUDIT #34 phase 1 -- OPERATOR DATA OVERLAY.
|        # An external directory holding the operator's own *.custom.yaml rules, laid out with
|        # the same <engine>/ + shared/ subfolders as asset-profiling-enrichment/. When set, its
|        # rules load ALONGSIDE the shipped tree and WIN on a colliding id.
|        #
|        # Why: today a customer's rules live INSIDE the directory the sync overwrites, and they
|        # survive only because they happen to be absent from the update zip -- not because
|        # anything protects them. One tracked file with a colliding name would overwrite a
|        # customer's rule, and a .gitignore slip publishes their data to the public mirror.
|        # An overlay puts operator data outside the code tree, so the shipped tree is pure code
|        # and a fresh clone behaves identically to a real install.
|        #
|        # Defaults to $global:SI_EnrichmentDataRoot so config sets it once. UNSET = every
|        # existing installation behaves exactly as before; this is opt-in by construction.
|        [Parameter()]
|        [string]$EnrichmentDataRoot,
|
|        # The DEFAULT tier rule(s) -- a rule file with `fallback: true` (asset-profiling-enrichment/shared/
|        # AssetProfileByDefaultTier.locked.yaml). A fallback rule is not one more vote in the MIN across matched
|        # rules: it applies only when nothing else gave the asset a tier (Resolve-SIDefaultTier.ps1). So the normal
|        # call leaves fallback rules OUT, and -Fallback returns ONLY them (plus every turned-off rule, so the caller
|        # can tell "the default rule is turned off" from "there is no default rule here").
|        [Parameter()]
|        [switch]$Fallback
|    )
|
|    # SecurityInsight's own YAML reader (no powershell-yaml module).
|    if (-not (Get-Command -Name ConvertFrom-SIYaml -ErrorAction SilentlyContinue)) {
|        . (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) '_shared/SI-Yaml.ps1')
|    }
|
|    # Resolve v2.2 root from this script's location.
|    # $PSScriptRoot = v2.2/engine/asset-profiling/shared -> three parents up = v2.2 root.
|    $siRoot = if (-not [string]::IsNullOrWhiteSpace($SolutionRootOverride)) { $SolutionRootOverride }
|              else { Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) }
|
|    # rules now live under asset-profiling-enrichment/<engine>/
|    # (locked + custom coexist in the same dir, distinguished by file suffix
|    # *.locked.yaml vs *.custom.yaml -- handled by the .custom/.locked-strip
|    # logic in the file-loop below). Old layout with separate rules/ +
|    # rules-custom/ folders is deprecated -- the doc comment at the top of
|    # this file already says asset-profiling-enrichment/, the code just never
|    # got updated. -IncludeCustom remains honored at the file-suffix level.
|    $folders = @('asset-profiling-enrichment')
|
|    $results = New-Object System.Collections.ArrayList
|    $loaded  = 0
|    $skipped = 0
|    # AUDIT #29 -- parse failures tracked apart from the benign skips; see the catch below.
|    $parseFailed = 0
|    $parseFailedNames = New-Object System.Collections.Generic.List[string]
|
|    # also walk rules/shared/ + rules-custom/shared/ for cross-engine rules.
|    # Each rules root contributes two scan folders: <Engine>/ and shared/.
|    $scanRoots = @()
|    # SecurityInsight Pro (Phase C): when the settings layer materialised the rules from the database's TEMPLATES into the
|    # overlay (shipped rules as *.locked.yaml, overrides as *.custom.yaml, turned-off rules left out), the overlay IS the
|    # rule set and the shipped tree is not read. Only together with an overlay that exists -- otherwise exactly as before.
|    $proRulesOnly = ([bool]$global:SI_ProRulesFromSql) -and [string]::IsNullOrWhiteSpace($SolutionRootOverride) -and
|                    -not [string]::IsNullOrWhiteSpace([string]$global:SI_EnrichmentDataRoot) -and (Test-Path -LiteralPath ([string]$global:SI_EnrichmentDataRoot)) -and
|                    ([string]::IsNullOrWhiteSpace($EnrichmentDataRoot) -or $EnrichmentDataRoot -eq [string]$global:SI_EnrichmentDataRoot)
|    if ($proRulesOnly) { $folders = @() }
|    foreach ($folder in $folders) {
|        foreach ($sub in @($Engine, 'shared')) {
|            $p = Join-Path $siRoot (Join-Path $folder $sub)
|            if (Test-Path $p) { $scanRoots += [pscustomobject]@{ Folder = $folder; Path = $p; Sub = $sub; Base = $siRoot; Source = 'tree' } }
|        }
|    }
|
|    # AUDIT #34 phase 1 -- the operator data overlay, appended AFTER the shipped tree so a
|    # colliding id resolves overlay-wins in the dedup below. Same <engine>/ + shared/ layout,
|    # so an operator moves files across without renaming anything.
|    $overlayRoot = if (-not [string]::IsNullOrWhiteSpace($EnrichmentDataRoot)) { $EnrichmentDataRoot }
|                   elseif (-not [string]::IsNullOrWhiteSpace([string]$global:SI_EnrichmentDataRoot)) { [string]$global:SI_EnrichmentDataRoot }
|                   else { $null }
|    $overlayActive = $false
|    if (-not [string]::IsNullOrWhiteSpace($overlayRoot)) {
|        if (-not (Test-Path -LiteralPath $overlayRoot)) {
|            # Configured but absent is NOT a silent fall-back to the in-tree rules. That would be
|            # #29's shape a third time: the run would look clean while every operator rule the
|            # overlay was supposed to supply is missing.
|            Write-Warning ("Get-SIRuleSet: SI_EnrichmentDataRoot is set to '{0}' but that path does not exist. NO overlay rules were loaded for engine '{1}' -- only the shipped tree is in force. Fix the path or clear the setting." -f $overlayRoot, $Engine)
|        } else {
|            $overlayActive = $true
|            foreach ($sub in @($Engine, 'shared')) {
|                $p = Join-Path $overlayRoot $sub
|                if (Test-Path $p) { $scanRoots += [pscustomobject]@{ Folder = 'overlay'; Path = $p; Sub = $sub; Base = $overlayRoot; Source = 'overlay' } }
|            }
|        }
|    }
|
|    foreach ($root in $scanRoots) {
|        $folder      = $root.Folder
|        $engineRoot  = $root.Path
|        $isShared    = ($root.Sub -eq 'shared')
|        $ruleBase    = $root.Base       # #34 -- File is relative to the root the file came from
|        $ruleSource  = $root.Source     # 'tree' | 'overlay'
|
|        # Both shapes are legal:
|        #   1) <engineRoot>/<MethodName>.yaml                     (single file)
|        #   2) <engineRoot>/<MethodName>/<roleName>.yaml          (folder per method)
|        # Walk both with one Get-ChildItem -Recurse.
|        $yamls = @(Get-ChildItem -Path $engineRoot -Filter '*.yaml' -Recurse -File -ErrorAction SilentlyContinue)
|
|        foreach ($f in $yamls) {
|            # ALLOW-LIST -- a rule is *.locked.yaml (shipped) or *.custom.yaml
|            # (customer override). NOTHING else in this tree is a rule: samples,
|            # editor backups, "- Copy" duplicates, .gitkeep and _scratch files
|            # must never load.
|            #
|            # This used to be a blacklist ('_*', '.*', '*.sample.*'). It let
|            # 'ADDomainController.custom.sample - Copy.yaml' through, because
|            # -like '*.sample.*' needs the literal '.sample.' and that name reads
|            # '.sample - Copy.yaml'. The file loaded as a live rule and -- on any
|            # host without its own ADDomainController.custom.yaml -- WON over the
|            # shipped ADDomainController.locked.yaml, making sample content the
|            # effective detection rule. Verified, and it shipped in v2.2.405.
|            # A blacklist has to predict every wrong name; an allow-list does not.
|            if ($f.Name -notlike '*.locked.yaml' -and $f.Name -notlike '*.custom.yaml') { $skipped++; continue }
|            # honor -IncludeCustom at the file-suffix level since
|            # locked + custom now share one folder.
|            if (-not $IncludeCustom -and $f.Name -like '*.custom.yaml') { continue }
|
|            # Optional method filter
|            if ($Method) {
|                # Match either: file basename = $Method, or parent folder name = $Method
|                $parentName = (Split-Path -Parent $f.FullName | Split-Path -Leaf)
|                if ($f.BaseName -ne $Method -and $parentName -ne $Method) { continue }
|            }
|
|            try {
|                $ruleText = Get-Content -Raw $f.FullName
|                # #908: a custom rule that still carries the shipped sample's header is the EXAMPLE copied as it was (on one
|                # install the IP-subnet sample made a network device a Tier 0 "Domain Controller"). It is loaded as before --
|                # the run never drops a rule on suspicion -- but it is said every run. Same marker as Test-SIRuleSampleMarker.
|                if ($f.Name -like '*.custom.yaml' -and $ruleText -match '(?m)^[ \t]*#[ \t]*SAMPLE[ \t]*/[ \t]*TEMPLATE\b') {
|                    Write-Warning ("Get-SIRuleSet: {0} is the shipped EXAMPLE (it still starts with the '# SAMPLE / TEMPLATE' header) and is loaded as a live rule -- review it: check its detections (example names, subnets, tiers) and remove the header, or remove the file" -f $f.Name)
|                }
|                $obj = ConvertFrom-SIYaml -Yaml $ruleText -SourceName $f.FullName
|            } catch {
|                Write-Warning ('Get-SIRuleSet: skipping {0} (parse error: {1})' -f $f.Name, $_.Exception.Message)
|                $skipped++
|                # AUDIT #29 -- counted SEPARATELY from $skipped on purpose. Most skips above are
|                # deliberate and benign (sample files, foreign schemas, engine filters), so a
|                # blanket "skipped=N" says nothing. A file that fails to PARSE is different: it is
|                # a rule the operator wrote and believes is in force, and it is not.
|                $parseFailed++
|                [void]$parseFailedNames.Add($f.Name)
|                continue
|            }
|
|            # Required: id (must match filename basename per ARCHITECTURE.md § 7).
|            # customer files in rules-custom/ may use the .custom.yaml
|            # naming convention (AssetProfileByTags.custom.yaml). Strip the .custom
|            # infix from basename before id-comparison so the override file pairs
|            # cleanly with the locked file's id.
|            #
|            # Silently skip foreign schemas that live in the same engine folder
|            # but belong to other engines (e.g. AssetTagging.custom.yaml uses
|            # the asset-tagging-engine shape `AssetTagging: [...]` -- not a
|            # rule shape). These should not produce a noisy WARN every run.
|            # ConvertFrom-Yaml returns a Hashtable, so .PSObject.Properties lists the
|            # HASHTABLE's own members (IsReadOnly, Keys, Values, Count, ...) and never
|            # the YAML keys -- this test was ALWAYS false. The AssetTagging files fell
|            # through to the 'no id field' branch instead and emitted a misleading
|            # WARNING every run, which is exactly the noise this guard exists to
|            # prevent. Ask the dictionary itself.
|            if ($obj -is [System.Collections.IDictionary] -and $obj.Contains('AssetTagging')) {
|                $skipped++; continue
|            }
|            $id = [string]$obj.id
|            if ([string]::IsNullOrWhiteSpace($id)) {
|                Write-Warning ('Get-SIRuleSet: skipping {0} (no id field)' -f $f.Name)
|                $skipped++; continue
|            }
|            $effectiveBaseName = $f.BaseName
|            if ($effectiveBaseName -like '*.custom') { $effectiveBaseName = $effectiveBaseName.Substring(0, $effectiveBaseName.Length - 7) }
|            elseif ($effectiveBaseName -like '*.locked') { $effectiveBaseName = $effectiveBaseName.Substring(0, $effectiveBaseName.Length - 7) }
|            if ($id -ne $effectiveBaseName) {
|                Write-Warning ("Get-SIRuleSet: id/filename mismatch in {0} (id='{1}', basename='{2}'). Per ARCHITECTURE.md § 7 the id MUST equal the file basename (or '<id>.custom'/'<id>.locked' in asset-profiling-enrichment/). Loading anyway." -f $f.Name, $id, $f.BaseName)
|            }
|
|            # appliesTo can be a string ('endpoint'), 'any', a comma-
|            # separated string ('endpoint,identity'), or a YAML list ([endpoint,
|            # identity]). Normalise to a [string[]] of lowercased engine names.
|            $appliesToList = @()
|            if ($null -eq $obj.appliesTo) {
|                # Per-engine folders default to that engine; shared/ defaults to 'any'.
|                $appliesToList = if ($isShared) { @('any') } else { @($Engine) }
|            } elseif ($obj.appliesTo -is [System.Collections.IEnumerable] -and -not ($obj.appliesTo -is [string])) {
|                $appliesToList = @($obj.appliesTo | ForEach-Object { ([string]$_).Trim().ToLowerInvariant() })
|            } else {
|                $appliesToList = @(([string]$obj.appliesTo) -split '[,;]\s*' | ForEach-Object { $_.Trim().ToLowerInvariant() } | Where-Object { $_ })
|            }
|            $appliesTo = ($appliesToList -join ',')   # preserved for diagnostic output
|
|            # Engine-match: rule loads if appliesTo contains 'any' or the current Engine
|            $matchesEngine = ($appliesToList -contains 'any') -or ($appliesToList -contains $Engine.ToLowerInvariant())
|            if (-not $matchesEngine) {
|                if (-not $isShared) {
|                    # Engine-folder rule that explicitly targets a different engine -- legacy warning.
|                    Write-Warning ("Get-SIRuleSet: appliesTo='{0}' in {1} doesn't match folder engine='{2}', skipping" -f $appliesTo, $f.Name, $Engine)
|                }
|                # Shared-folder rules silently skip when the current engine isn't in their appliesTo list.
|                $skipped++; continue
|            }
|
|            $mode = if ($obj.mode) { [string]$obj.mode } else { 'locked' }
|
|            # Disable mode: customer wants this rule's locked counterpart suppressed.
|            # Surface in result so the merge step in can act on it.
|            if ($mode -eq 'disable') {
|                # #470: `detections:` listing ids turns off ONLY those shipped detections (the ids are all that is read)
|                $offIds = @(@($obj.detections) | Where-Object { $null -ne $_ -and $_.id } | ForEach-Object { [string]$_.id })
|                [void]$results.Add([pscustomobject]@{
|                    Id          = $id
|                    AppliesTo   = $appliesTo
|                    Mode        = 'disable'
|                    DisableDetections = $offIds
|                    Purpose     = $null
|                    Category    = $null
|                    Description = $null
|                    Detections  = @()
|                    File        = $f.FullName.Substring($ruleBase.Length).TrimStart('\','/')
|                    Folder      = $folder
|                    Source      = $ruleSource
|                    SchemaShape = 'AssetProfileBy'
|                    Fallback    = $false
|                })
|                $loaded++
|                continue
|            }
|
|            # Detections array — required for non-disable modes
|            $detections = New-Object System.Collections.ArrayList
|            if ($obj.detections) {
|                foreach ($d in $obj.detections) {
|                    $detId = if ($d.id) { [string]$d.id } else { $id }
|
|                    # Per-detection asset exclusion list. Read from
|                    # `excludeAssets:` on the detection (alias
|                    # `excludeNames:`). Accepted shapes:
|                    #   excludeAssets: ['my-old-box', '*-legacy-*']
|                    #   excludeAssets:
|                    #     - my-old-box
|                    #     - '*-legacy-*'
|                    # Comparison happens against the asset's Name field
|                    # (case-insensitive) in Invoke-SIRuleEval. Wildcards
|                    # supported via PowerShell -like (*, ?). Use this
|                    # when you can't remove the matching software /
|                    # signal from the asset itself but want the asset
|                    # out-of-scope FOR THIS DETECTION only -- the rule
|                    # continues to fire for every other asset.
|                    $exclude = @()
|                    $rawEx = if ($d.excludeAssets) { $d.excludeAssets } elseif ($d.excludeNames) { $d.excludeNames } else { $null }
|                    if ($rawEx) {
|                        if ($rawEx -is [System.Collections.IEnumerable] -and -not ($rawEx -is [string])) {
|                            $exclude = @($rawEx | ForEach-Object { [string]$_ } | Where-Object { $_ })
|                        } else {
|                            $exclude = @(([string]$rawEx) -split '[,;]\s*' | ForEach-Object { $_.Trim() } | Where-Object { $_ })
|                        }
|                    }
|
|                    [void]$detections.Add([pscustomobject]@{
|                        Id            = $detId
|                        Detect        = $d.detect      # leave nested @{ any|all = [...]} as-is for RuleEval to consume
|                        Set           = $d.set
|                        ExcludeAssets = $exclude        # @() when not configured -- empty means "exclusion disabled"
|                    })
|                }
|            }
|
|            # osPlatformScope: optional per-rule list of OS classes the rule applies to.
|            # When non-empty, Invoke-Profile.ps1 Pass 2.5 buckets the rule into ONLY
|            # those OS-class buckets. When empty/missing, rule lands in EVERY bucket
|            # (unscoped) and runs against every asset. Without this field on the
|            # rule object, the bucketing optimization is silently disabled.
|            $osScope = @()
|            if ($obj.osPlatformScope) {
|                if ($obj.osPlatformScope -is [System.Collections.IEnumerable] -and -not ($obj.osPlatformScope -is [string])) {
|                    $osScope = @($obj.osPlatformScope | ForEach-Object { [string]$_ } | Where-Object { $_ })
|                } else {
|                    $osScope = @(([string]$obj.osPlatformScope) -split '[,;]\s*' | ForEach-Object { $_.Trim() } | Where-Object { $_ })
|                }
|            }
|
|            [void]$results.Add([pscustomobject]@{
|                Id              = $id
|                AppliesTo       = $appliesTo
|                Mode            = $mode
|                osPlatformScope = $osScope
|                Purpose         = if ($obj.purpose)     { [string]$obj.purpose }     else { $null }
|                Category        = if ($obj.category)    { [string]$obj.category }    else { $null }
|                Description     = if ($obj.description) { [string]$obj.description } else { $null }
|                Detections      = $detections.ToArray()
|                File            = $f.FullName.Substring($ruleBase.Length).TrimStart('\','/')
|                Folder          = $folder
|                Source          = $ruleSource
|                SchemaShape     = 'AssetProfileBy'
|                Fallback        = ([string]$obj.fallback) -match '^(?i:true|1|yes)$'
|                # #462 the truth stage (production decides; testing is evaluated and shown, never deciding; not_used is
|                # not evaluated) and the priority (higher wins a single-value field) -- read by the CI enrichment
|                Stage           = $(if ([string]$obj.stage -match '^(?i)(production|testing|not_used)$') { ([string]$obj.stage).ToLowerInvariant() } else { 'production' })
|                Priority        = $(if ($null -ne $obj.priority -and [string]$obj.priority -match '^-?\d+$') { [int]$obj.priority } else { 100 })
|            })
|            $loaded++
|        }
|    }
|
|    # dedup by id -- locked + custom both load (same folder, just
|    # *.locked.yaml vs *.custom.yaml suffix). Preference: custom wins over
|    # locked (the customer-edited file is the override). Without this dedup
|    # the same rule fires twice per asset (you'd see e.g. OrgFinanceMember
|    # appearing 2x in SIRules with identical Tier/Purpose/Category, doubling
|    # match counts and inflating risk-factor probabilities).
|    # AUDIT #34 -- precedence is now RANKED rather than "custom replaces whatever came before",
|    # because a third source exists. Highest rank wins; equal rank keeps the first seen:
|    #   2 = overlay *.custom.yaml   (operator data root -- the most specific statement)
|    #   1 = in-tree *.custom.yaml   (today's customer override, same as before)
|    #   0 = *.locked.yaml           (shipped)
|    # With no overlay configured this collapses to exactly the previous behaviour: every rule is
|    # rank 0 or 1 and custom still beats locked.
|    # #470 -- the winning custom rule is then COMBINED with the shipped rule of the same id by its
|    # mode (V3-DATA-MODEL §2.4.5: the override grain is the item -- one detection -- not the file):
|    #   overwrite (and a custom file with no mode / 'locked')  the custom rule replaces the shipped one
|    #   append    the shipped detections stay; the custom detections are added (a colliding detection
|    #             id is NOT replaced -- append never changes a shipped detection; use merge for that)
|    #   merge     per detection id: a custom detection EXTENDS the shipped one of the same id (any:/all:
|    #             entries added, set: keys win), the others are added; the custom rule's purpose /
|    #             category / description win where set
|    #   disable   the shipped rule is turned off (or, with detection ids listed, only those detections)
|    # With no shipped counterpart every mode is the custom rule as written. See Merge-SIRuleOverride.
|    if ($results.Count -gt 1) {
|        $deduped = New-Object System.Collections.ArrayList
|        $byId    = @{}
|        $lockedById = @{}
|        $order   = New-Object System.Collections.Generic.List[string]
|        $rankOf  = {
|            param($r)
|            if ($r.File -notlike '*.custom.yaml') { return 0 }
|            if ($r.Source -eq 'overlay') { return 2 }
|            return 1
|        }
|        foreach ($r in $results) {
|            if ((& $rankOf $r) -eq 0 -and -not $lockedById.ContainsKey($r.Id)) { $lockedById[$r.Id] = $r }
|            if (-not $byId.ContainsKey($r.Id)) {
|                $byId[$r.Id] = $r
|                $order.Add($r.Id)
|            } elseif ((& $rankOf $r) -gt (& $rankOf $byId[$r.Id])) {
|                $byId[$r.Id] = $r
|            }
|            # else: same or lower rank than what we already hold -- ignore.
|        }
|        foreach ($rid in $order) {
|            $win = $byId[$rid]
|            if ((& $rankOf $win) -gt 0 -and $lockedById.ContainsKey($rid)) { $win = Merge-SIRuleOverride -Locked $lockedById[$rid] -Custom $win }
|            [void]$deduped.Add($win)
|        }
|        $dropped = $results.Count - $deduped.Count
|        if ($dropped -gt 0) {
|            Write-SIInfo ("Get-SIRuleSet: deduped {0} rule(s) (locked/custom pair) -- {1} unique rules remain" -f $dropped, $deduped.Count)
|        }
|        $results = $deduped
|    }
|
|    # The default tier rule(s) are kept apart from the rules that vote (see -Fallback). After the dedup, so a custom copy
|    # (or a turn-off) of the default rule has already replaced the shipped one.
|    $kept = New-Object System.Collections.ArrayList
|    foreach ($r in $results) {
|        $isFallback = [bool]$r.Fallback
|        if ($Fallback) { if ($isFallback -or $r.Mode -eq 'disable') { [void]$kept.Add($r) } }
|        elseif (-not $isFallback) { [void]$kept.Add($r) }
|    }
|    $results = $kept
|
|    Write-Verbose ("Get-SIRuleSet: engine={0} loaded={1} skipped={2} folders={3}" -f $Engine, $loaded, $skipped, ($folders -join ','))
|
|    # AUDIT #34 -- CUTOVER VISIBILITY. When an overlay is configured, operator rules still sitting in
|    # the shipped tree are read (never ignored -- silently dropping them would be #29 a third time)
|    # but they are the OLD location, and on a colliding id the overlay now outranks them. Say so once
|    # per run, naming the files, so a half-finished migration cannot look like a finished one.
|    if ($overlayActive) {
|        $overlayRules = @($results | Where-Object { $_.Source -eq 'overlay' })
|        $strayCustom  = @($results | Where-Object { $_.Source -eq 'tree' -and $_.File -like '*.custom.yaml' })
|        Write-SIInfo ("Get-SIRuleSet: operator data overlay ACTIVE at '{0}' -- {1} of {2} rule(s) for engine '{3}' come from the overlay." -f `
|            $overlayRoot, $overlayRules.Count, @($results).Count, $Engine)
|        if ($strayCustom.Count -gt 0) {
|            Write-Warning ("Get-SIRuleSet: {0} operator rule(s) for engine '{1}' are still in the SHIPPED TREE while an overlay is configured -- {2}. They ARE loaded, but they live in the directory the updater writes to and the overlay outranks them on a colliding id. Move them under '{3}\<engine>\' to complete the migration." -f `
|                $strayCustom.Count, $Engine, (($strayCustom | ForEach-Object { $_.File }) -join ', '), $overlayRoot)
|        }
|    }
|
|    # AUDIT #29 -- a rule file that will not PARSE must be visible on a normal run.
|    #
|    # Found by running the endpoint profiler live: all 8 *.custom.yaml files in this environment
|    # had been unparseable since 2026-06-11 (the space after each `key:` was stripped), so every
|    # customer tagging/profiling rule was inert -- while the run still reported
|    # "Engine completed successfully". The per-file warnings above scroll past in a long log, and
|    # the only aggregate was the Write-Verbose line above, which prints for nobody by default.
|    # Same defect shape as #27: the engine knew, and never said so where anyone would look.
|    #
|    # Deliberately a WARNING, not a throw: a broken custom rule must not stop a security run that
|    # still produces useful output -- consistent with the standing "a source failing must never
|    # block the run" decision. But it must not be silent either.
|    if ($parseFailed -gt 0) {
|        Write-Warning ("Get-SIRuleSet: {0} of {1} rule file(s) for engine '{2}' FAILED TO PARSE and were not applied -- {3}. These rules are NOT in force for this run; classification and tagging ran without them. Fix the YAML (a common cause is a missing space after 'key:') and re-run." -f `
|            $parseFailed, ($loaded + $parseFailed), $Engine, ($parseFailedNames -join ', '))
|    }
|
|    # AUDIT #36 -- a rule that LOADS with zero detections does nothing, and said so
|    # to nobody. Parsing is not the only way a rule can be inert: the #29 repair left
|    # asset-profiling-enrichment/azure/AssetProfileByTags.custom.yaml ending at a bare
|    # `detections:` with nothing under it. It parses, it loads, it dedups -- and it
|    # matches no asset, ever. There is no *.locked.yaml sibling for it, so the whole
|    # Azure CMDB tag mapping was running on a rule with no rules in it.
|    # `mode: disable` is the ONE legitimate zero-detection case (the customer is
|    # suppressing a locked rule on purpose) and is excluded.
|    $emptyRules = @($results | Where-Object { $_.Mode -ne 'disable' -and @($_.Detections).Count -eq 0 })
|    if ($emptyRules.Count -gt 0) {
|        Write-Warning ("Get-SIRuleSet: {0} rule(s) for engine '{1}' loaded with ZERO detections and can never match -- {2}. A rule with no detections is inert; check the file's 'detections:' block is not empty (use 'mode: disable' if suppression was intended)." -f `
|            $emptyRules.Count, $Engine, (($emptyRules | ForEach-Object { $_.File }) -join ', '))
|    }
|
|    # AUDIT #35 -- a detect kind the evaluator does not know is DROPPED, silently.
|    # Invoke-SIDetect logs an unknown kind with Write-Verbose (prints for nobody) and
|    # then continues in any-mode / returns $false in all-mode. That is how the
|    # unregistered 'nameMatches' cost 95 detections their name-pattern arm for the
|    # whole v2.2 lifetime without a single visible symptom. Checked here, at load, so
|    # it costs one pass over the final rule set instead of a test in the per-asset
|    # hot loop -- and so a customer's typo'd kind is reported on the run that uses it,
|    # not just by the lint they may never run.
|    # Soft dependency: RuleEval.ps1 is dot-sourced alongside this file by the profile
|    # stage, but not by every caller, so absence of the registry is not an error.
|    if (Get-Command -Name 'Get-SIKindRegistry' -ErrorAction SilentlyContinue) {
|        $kindRegistry = Get-SIKindRegistry
|        $unknownKinds = @{}
|        foreach ($r in $results) {
|            foreach ($det in @($r.Detections)) {
|                $dmode = if ($det.Detect.any) { 'any' } elseif ($det.Detect.all) { 'all' } else { $null }
|                if (-not $dmode) { continue }
|                foreach ($spec in @($det.Detect.$dmode)) {
|                    $k = [string]$spec.kind
|                    if ([string]::IsNullOrWhiteSpace($k)) { continue }
|                    if (-not $kindRegistry.ContainsKey($k)) {
|                        if (-not $unknownKinds.ContainsKey($k)) { $unknownKinds[$k] = 0 }
|                        $unknownKinds[$k]++
|                    }
|                }
|            }
|        }
|        if ($unknownKinds.Count -gt 0) {
|            $kindDetail = (($unknownKinds.Keys | Sort-Object | ForEach-Object { '{0} ({1} detection(s))' -f $_, $unknownKinds[$_] }) -join ', ')
|            Write-Warning ("Get-SIRuleSet: {0} detect kind(s) used by engine '{1}' rules are NOT in the RuleEval registry and are SKIPPED at evaluation -- {2}. Those detection arms never match, and a detection whose only arm is unknown can never fire. Check the spelling, or that the kind is registered in RuleEval.ps1." -f `
|                $unknownKinds.Count, $Engine, $kindDetail)
|        }
|    }
|
|    ,$results.ToArray()
|}
|
|function Merge-SIRuleOverride {
|    <#
|        PURE (#470). A customer rule (*.custom.yaml) combined with the shipped rule of the same id, by the customer
|        rule's mode. Returns the rule the engine evaluates; the shipped rule's file is kept as BaseFile.
|          overwrite | locked | (none)   the custom rule as written (the shipped rule is replaced)
|          append                        shipped detections + the custom detections whose id is new; a colliding id is
|                                        skipped with a warning (append never changes a shipped detection)
|          merge                         deep merge per detection id (DESIGN "Custom override"): a custom detection with
|                                        a shipped id EXTENDS it -- its any: (or all:) entries are added to the shipped
|                                        ones, its set: keys win over the shipped set: keys, excludeAssets are united;
|                                        new ids are added; purpose / category / description / osPlatformScope from the
|                                        custom rule where it sets them
|          disable                       no detections listed: the rule is off (Mode disable). Detection ids listed:
|                                        ONLY those shipped detections are dropped, the rest of the rule stays
|        An unknown mode warns and is treated as overwrite (today's behaviour for every custom file).
|        osPlatformScope for append: the union of both (empty on either side = every OS, so empty).
|    #>
|    param([Parameter(Mandatory)]$Locked, [Parameter(Mandatory)]$Custom)
|    $mode = ([string]$Custom.Mode).Trim().ToLowerInvariant()
|    if ($mode -eq 'disable') {
|        $off = @($Custom.DisableDetections | Where-Object { $_ })
|        if ($off.Count -eq 0) { return $Custom }
|        $keep = @(@($Locked.Detections) | Where-Object { $null -ne $_ -and $off -notcontains [string]$_.Id })
|        $missing = @($off | Where-Object { @($Locked.Detections | ForEach-Object { [string]$_.Id }) -notcontains $_ })
|        if ($missing.Count) { Write-Warning ("Get-SIRuleSet: rule '{0}' ({1}, mode disable) names detection id(s) {2} that the shipped rule does not have -- nothing to turn off for them." -f $Custom.Id, $Custom.File, ($missing -join ', ')) }
|        $r = $Locked.PSObject.Copy()
|        $r.Detections = $keep
|        $r.File = $Custom.File
|        $r.Source = $Custom.Source
|        $r | Add-Member -NotePropertyName BaseFile -NotePropertyValue $Locked.File -Force
|        $r | Add-Member -NotePropertyName DisabledDetections -NotePropertyValue $off -Force
|        return $r
|    }
|    if ($mode -in '', 'locked', 'overwrite') { return $Custom }
|    if ($mode -notin 'append', 'merge') {
|        Write-Warning ("Get-SIRuleSet: rule '{0}' ({1}) has mode '{2}', which is not one of overwrite / append / merge / disable -- it REPLACES the shipped rule (overwrite)." -f $Custom.Id, $Custom.File, $Custom.Mode)
|        return $Custom
|    }
|    $dets = New-Object System.Collections.Generic.List[object]
|    $pos = @{}
|    foreach ($d in @($Locked.Detections)) { if ($null -eq $d) { continue }; $pos[[string]$d.Id] = $dets.Count; $dets.Add($d) }
|    $skippedIds = New-Object System.Collections.Generic.List[string]
|    foreach ($d in @($Custom.Detections)) {
|        if ($null -eq $d) { continue }
|        $did = [string]$d.Id
|        if ($pos.ContainsKey($did)) {
|            if ($mode -eq 'merge') { $dets[$pos[$did]] = Merge-SIRuleDetection -Locked $dets[$pos[$did]] -Custom $d -RuleId $Custom.Id }
|            else { $skippedIds.Add($did) }
|            continue
|        }
|        $pos[$did] = $dets.Count
|        $dets.Add($d)
|    }
|    if ($skippedIds.Count -gt 0) {
|        Write-Warning ("Get-SIRuleSet: rule '{0}' ({1}, mode append) repeats shipped detection id(s) {2} -- append never changes a shipped detection, so they were NOT applied. Use mode: merge to replace a shipped detection, or give the detection a new id." -f $Custom.Id, $Custom.File, ($skippedIds -join ', '))
|    }
|    $pick = { param($c, $l) if ($null -ne $c -and -not [string]::IsNullOrWhiteSpace([string]$c)) { $c } else { $l } }
|    $scope = @()
|    $ls = @($Locked.osPlatformScope | Where-Object { $_ }); $cs = @($Custom.osPlatformScope | Where-Object { $_ })
|    if ($mode -eq 'merge') { $scope = if ($cs.Count) { $cs } else { $ls } }
|    elseif ($ls.Count -and $cs.Count) { $scope = @(@($ls) + @($cs) | Select-Object -Unique) }
|    [pscustomobject]@{
|        Id              = $Custom.Id
|        AppliesTo       = $Custom.AppliesTo
|        Mode            = $mode
|        osPlatformScope = $scope
|        Purpose         = $(if ($mode -eq 'merge') { & $pick $Custom.Purpose $Locked.Purpose } else { & $pick $Locked.Purpose $Custom.Purpose })
|        Category        = $(if ($mode -eq 'merge') { & $pick $Custom.Category $Locked.Category } else { & $pick $Locked.Category $Custom.Category })
|        Description     = $(if ($mode -eq 'merge') { & $pick $Custom.Description $Locked.Description } else { & $pick $Locked.Description $Custom.Description })
|        Detections      = $dets.ToArray()
|        File            = $Custom.File
|        BaseFile        = $Locked.File
|        Folder          = $Custom.Folder
|        Source          = $Custom.Source
|        SchemaShape     = 'AssetProfileBy'
|        Fallback        = [bool]$Locked.Fallback
|        Stage           = $(if ($Custom.PSObject.Properties['Stage'] -and $Custom.Stage) { $Custom.Stage } else { $Locked.Stage })
|        Priority        = $(if ($Custom.PSObject.Properties['Priority'] -and $null -ne $Custom.Priority) { $Custom.Priority } else { $Locked.Priority })
|    }
|}
|
|function Merge-SIRuleDetection {
|    <#
|        PURE (#470, mode merge). One shipped detection extended by the customer detection of the same id: the custom
|        any: (or all:) entries are ADDED to the shipped ones; set: keys of the custom detection win; excludeAssets are
|        united. A custom detection whose block is the other kind (all: against a shipped any:) cannot be added to it --
|        it replaces the shipped detect block, with a warning.
|    #>
|    param([Parameter(Mandatory)]$Locked, [Parameter(Mandatory)]$Custom, [string]$RuleId = '')
|    $cmp = [System.StringComparer]::OrdinalIgnoreCase
|    $detect = $Locked.Detect
|    if ($Custom.Detect) {
|        $lk = if ($Locked.Detect -and $Locked.Detect.any) { 'any' } elseif ($Locked.Detect -and $Locked.Detect.all) { 'all' } else { '' }
|        $ck = if ($Custom.Detect.any) { 'any' } elseif ($Custom.Detect.all) { 'all' } else { '' }
|        if ($ck -and $lk -eq $ck) {
|            $detect = [hashtable]::new($cmp)
|            $detect[$lk] = @(@($Locked.Detect.$lk) + @($Custom.Detect.$ck))
|        } elseif ($ck) {
|            if ($lk) { Write-Warning ("Get-SIRuleSet: rule '{0}' detection '{1}' (mode merge) uses {2}: where the shipped detection uses {3}: -- the two cannot be combined, so the custom detect block REPLACES the shipped one." -f $RuleId, $Custom.Id, $ck, $lk) }
|            $detect = $Custom.Detect
|        }
|    }
|    $set = [hashtable]::new($cmp)
|    foreach ($src in @($Locked.Set, $Custom.Set)) {
|        if ($src -is [System.Collections.IDictionary]) { foreach ($k in @($src.Keys)) { $set[[string]$k] = $src[$k] } }
|        elseif ($null -ne $src) { foreach ($p in $src.PSObject.Properties) { $set[$p.Name] = $p.Value } }
|    }
|    [pscustomobject]@{
|        Id            = $Locked.Id
|        Detect        = $detect
|        Set           = $set
|        ExcludeAssets = @(@($Locked.ExcludeAssets) + @($Custom.ExcludeAssets) | Where-Object { $_ } | Select-Object -Unique)
|    }
|}
|
|function Get-SIRuleSetSummary {
|    <#
|        Diagnostic helper. Returns a one-row-per-rule summary table:
|        Id, AppliesTo, Mode, DetectionCount, KindsUsed, TierRange, Folder.
|
|        Useful for lint runs ('how many rules per engine?') and pre-flight
|        checks before the new RuleEval ships.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)]
|        [ValidateSet('endpoint','identity','azure','publicip')]
|        [string]$Engine
|    )
|
|    Get-SIRuleSet -Engine $Engine | ForEach-Object {
|        $kindsUsed = New-Object System.Collections.Generic.HashSet[string]
|        $tiers     = New-Object System.Collections.Generic.HashSet[int]
|        foreach ($d in $_.Detections) {
|            if ($d.Detect) {
|                $kindList = if ($d.Detect.any)  { $d.Detect.any }
|                            elseif ($d.Detect.all) { $d.Detect.all }
|                            else { @() }
|                foreach ($k in $kindList) { if ($k.kind) { [void]$kindsUsed.Add([string]$k.kind) } }
|            }
|            if ($d.Set -and $null -ne $d.Set.Tier) { [void]$tiers.Add([int]$d.Set.Tier) }
|        }
|        [pscustomobject]@{
|            Id             = $_.Id
|            AppliesTo      = $_.AppliesTo
|            Mode           = $_.Mode
|            DetectionCount = $_.Detections.Count
|            KindsUsed      = (($kindsUsed | Sort-Object) -join ',')
|            TierRange      = if ($tiers.Count -gt 0) { "T$($tiers | Sort-Object | Select-Object -First 1)..T$($tiers | Sort-Object | Select-Object -Last 1)" } else { '' }
|            Folder         = $_.Folder
|        }
|    }
|}
'@ }
$__siSupportFiles['engine/pro-settings/SI-ProConfig.ps1'] = @{ Sha256 = '4b73c86473036151ca131fec04b4a6b99a75b3ca792b97522f19035726b3623b'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- ALL CONFIGURATION IN SQL, WITH VENDOR TEMPLATES (REQUIREMENTS §9.3.3 phase C).
|
|    Operator, 2026-10-03: "pro version must have all configurations stored in the sql database, so no configuration
|    files .custom + .default + .locked" ... "templates, to replace the locked files today, where i provide central
|    configurations, customers can choose to import in their environment - but with option to customize".
|
|    THE MODEL (sql\si-pro-settings.sql):
|      cfg.Template      the vendor baseline, ONE ROW PER ITEM (a report, a risk index row, a tier rule, a tagging rule,
|                        an ownership entry, the service model, a naming default). Published from the shipped *.locked
|                        files of a release by setup\Publish-SITemplates.ps1.
|      cfg.ItemOverride  the customer's state per item: inherit (or no row) | override (their body) | disable.
|      cfg.Document      unchanged (Pro-1b): the customer's own exclusions, weights and tier rules.
|      cfg.Exemption     "exempt this finding" from the GUI; expired / revoked rows are not applied.
|
|    RUN START: the template and the customer state are MERGED per item and MATERIALISED into a run-local folder, in
|    exactly the files the engines' own loaders already read -- so the engines stay as they are. A Pro run then needs no
|    configuration file of the installation: only SI_ProSqlServer / SI_ProSqlDatabase.
|
|    PER FAMILY, NEVER HALF: a family (rules, the Risk Analysis catalog, the risk index, ...) is served from SQL as soon
|    as it has template rows; until its templates are published it is read from the installation exactly as before. A
|    database without the Phase C tables behaves exactly as Pro-1b.
|
|    🔒 FAIL CLOSED, as the rest of the layer: a row that does not validate, an unknown kind, a template whose body does
|    not match its hash, an exemption that is not well-formed, the same item set in two places -- the run stops with
|    the reason.
|
|    Everything here except the file writers is pure (rows in, objects out) and tested directly.
|#>
|
|$script:SIProConfigSIRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|if (-not (Get-Command Test-SISettingValue -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-Settings.ps1'))
|}
|# SecurityInsight's own YAML reader (no powershell-yaml module).
|if (-not (Get-Command -Name ConvertFrom-SIYaml -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-Yaml.ps1'))
|}
|# Template versioning: the normalised content hash, the fingerprint gate, conformance (adopted from PIM4EntraPS).
|. ([System.IO.Path]::Combine($PSScriptRoot, 'SI-TemplateVersioning.ps1'))
|# Mandatory controls on top of templates: what SecurityInsight's own code requires, never switched off by an override.
|. ([System.IO.Path]::Combine($PSScriptRoot, 'SI-TemplateMandatory.ps1'))
|# #275 R3: where the asset-tagging engine finds its rules -- the launchers' and the engine's own resolution, shared.
|if (-not (Get-Command -Name Resolve-SIAssetTaggingFiles -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'asset-tagging', 'AssetTagging.Resolve.ps1'))
|}
|# The risk index rule: first match wins in Precedence order, and the conversion of a v2.2 index (same scores).
|if (-not (Get-Command -Name ConvertTo-SIRiskIndexFirstMatch -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'risk-analysis', '_shared', 'RA-RiskIndexOrder.ps1'))
|}
|# #559: the index keyed by the SI generic fields, and the 2.2 -> SI translation of rows stored with the old columns.
|if (-not (Get-Command -Name ConvertTo-SIRiskIndexSiRows -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'risk-analysis', '_shared', 'RA-RiskIndexSi.ps1'))
|}
|# the customer's overrides keyed the pre-v2 way are translated on the next template publish (CONVERGE-DEFAULTS)
|. ([System.IO.Path]::Combine($PSScriptRoot, 'SI-ProOverrideMigration.ps1'))
|# #398: the shipped index is riskscore.index.locked.csv; riskscore.index.custom.csv is the customer's own rows, unless it
|# is an unchanged copy of an earlier version's shipped index.
|if (-not (Get-Command -Name Test-SIRiskIndexShippedCopy -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'risk-analysis', '_shared', 'RA-RiskIndexFiles.ps1'))
|}
|# #456: the data model (field catalog, provider mappings, ...) as 'datamodel' template items -- rows, validation, the run's folder.
|. ([System.IO.Path]::Combine($PSScriptRoot, 'SI-DataModelTemplateRows.ps1'))
|# #274: the output scope per destination (validation and the file the engines read).
|if (-not (Get-Command -Name Test-SIOutputScopeBody -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-OutputScope.ps1'))
|}
|
|# ---------------------------------------------------------------------------------------------------------------------
|#  THE KINDS. Templated = the vendor publishes a baseline for it; Format = how BodyJson is read; Key = the item key.
|#  A kind not listed here is REFUSED at run start (there is deliberately no CHECK constraint on Kind in SQL -- see the
|#  schema file -- so this list is the guard).
|# ---------------------------------------------------------------------------------------------------------------------
|#  #251 (operator decision 2026-10-04): templates hold only VENDOR-DEVELOPED content (rules, Risk Analysis reports, the risk
|#  index, tagging rules, the service model). naming and cmdbownership are CONFIGURATION now:
|#    naming         a name is a setting (cfg.Setting) -- the catalog default is the only default. Existing naming overrides
|#                   are carried over 1:1 as setting rows by setup; a legacy override row is still read (never refused) until
|#                   then, and nothing new is written as a naming item.
|#    cmdbownership  ONE configuration document, key 'map' (the cmdbSourceOwnership object), seeded from the shipped file at
|#                   setup and owned by the customer. The per-entry keys (defaults, assettype/<type>) are the legacy rows: read
|#                   only, to carry them over (ConvertTo-SIProOwnershipMap).
|$script:SIProItemKinds = [ordered]@{
|    rareport      = @{ Templated = $true;  Format = 'json'; Key = '^(report|template)/[A-Za-z0-9_]{1,100}$' }
|    riskindex     = @{ Templated = $true;  Format = 'json'; Key = '^row/[^\r\n]{1,124}$' }
|    rule          = @{ Templated = $true;  Format = 'yaml'; Key = '^(endpoint|identity|azure|shared)/[A-Za-z0-9][A-Za-z0-9_\-]{0,99}$' }
|    assettagging  = @{ Templated = $true;  Format = 'json'; Key = '^(config|tag/[^\r\n/\\]{1,120})$' }
|    cmdbownership = @{ Templated = $false; Format = 'json'; Key = '^(map|defaults|assettype/[a-z0-9][a-z0-9_\-\.]{0,99})$' }
|    servicemodel  = @{ Templated = $true;  Format = 'json'; Key = '^model$' }
|    # #456: the data model, one item per field / mapping / factor / output column (SI-DataModelTemplateRows.ps1): '<template>' (its
|    # header) or '<template>:<item key>', e.g. 'mappings/mde:si_os_version|device|'
|    datamodel     = @{ Templated = $true;  Format = 'json'; Key = (Get-SIDataModelProKeyPattern) }
|    schemaoverlay = @{ Templated = $false; Format = 'json'; Key = '^(endpoint|identity|azure|publicip)$' }
|    decision      = @{ Templated = $false; Format = 'yaml'; Key = '^(asset|correlation)$' }
|    naming        = @{ Templated = $false; Format = 'json'; Key = '^[A-Za-z_][A-Za-z0-9_]{0,127}$' }
|    weights       = @{ Templated = $false; Format = 'json'; Key = '^(model|report/[A-Za-z0-9_]{1,100})$' }
|    # the tier board's 'move this whole rule to tier N': { "ruleKey": "<engine>/<id>", "tier": 0-3 } -- applied to the rule in force
|    ruletier      = @{ Templated = $false; Format = 'json'; Key = '^(endpoint|identity|azure|shared)/[A-Za-z0-9][A-Za-z0-9_\-]{0,99}$' }
|    # #275 R6: the customer's override of the server-application catalog (asset-profiling-enrichment\endpoint\
|    # server-applications.json: { "applications": [ { software_vendor, software_name, tier, ... } ] }), merged over the
|    # shipped catalog by its own loader (EndpointCatalogTierComputer.ps1) -- materialised to SI_ProConfigRoot.
|    serverapps    = @{ Templated = $false; Format = 'json'; Key = '^catalog$' }
|    # #274: what each output destination receives (Excel + mail, the vulnerability and CMDB connectors) -- one item per
|    # destination, materialised into config\output-scope.json (engine\_shared\SI-OutputScope.ps1 reads it)
|    outputscope   = @{ Templated = $false; Format = 'json'; Key = '^(excel|vuln-sql|vuln-servicenow|cmdb-sql|cmdb-servicenow)$' }
|}
|# The risk index columns the engine reads (#559: keyed by the SI generic fields -- RA-RiskIndexSi.ps1) plus the notes
|# column and Precedence (the row's place: first match wins, 1 = checked first).
|$script:SIRiskIndexColumns = @('si_finding_type', 'si_category', 'si_subcategory', 'si_component', 'si_finding_key', 'asset_class',
|    'si_severity', 'VulnerabilityBase', 'si_tier', 'AssetBase', 'Comments', 'Precedence')
|$script:SIRiskIndexKeyColumns = @('si_finding_type', 'si_category', 'si_subcategory', 'si_component', 'si_finding_key', 'asset_class', 'si_severity', 'si_tier')
|# #559: a row stored before the re-key carries the 2.2 columns -- still accepted, translated where it is written
|# (riskscore.index.translation.locked.json); its item key is the 2.2 one until it is saved again.
|$script:SIRiskIndexV22Columns = @('SecurityDomain', 'Category', 'SubCategory', 'ConfigurationId', 'SecuritySeverity',
|    'RiskConsequenceScore_SecuritySeverity', 'CriticalityTierLevel', 'RiskProbablityScore_CriticialityTierLevel', 'Comments', 'Precedence')
|$script:SIRiskIndexV22KeyColumns = @('SecurityDomain', 'Category', 'SubCategory', 'ConfigurationId', 'SecuritySeverity', 'CriticalityTierLevel')
|# Naming conventions: catalog text settings that name a table, a DCR, a DCE or a workspace.
|$script:SIProNamingPattern = '(?i)(dcr|dce|table|workspacename)'
|# The run-local file names the engines read.
|$script:SIProRaCatalogFile  = 'RiskAnalysis_Queries_Locked.yaml'
|$script:SIProRiskIndexFile  = 'riskscore.index.custom.csv'
|$script:SIProExemptionsFile = 'RiskAnalysisExemptions.json'
|
|function Get-SIProItemKinds { $script:SIProItemKinds }
|
|# =====================================================================================================================
|#  JSON: one reader and one canonical writer, so a body means the same thing -- and hashes the same -- on PowerShell
|#  5.1 and 7 (pwsh 7 turns date-like strings into DateTime and decimals into double; 5.1 does neither).
|# =====================================================================================================================
|function ConvertFrom-SIProJson {
|    <# ConvertFrom-Json that keeps date-like strings as strings where the runtime allows it (pwsh 7.5+ -DateKind). #>
|    param([AllowEmptyString()][AllowNull()][string]$Text)
|    if ($null -eq $script:SIProJsonDateKind) { $script:SIProJsonDateKind = (Get-Command ConvertFrom-Json).Parameters.ContainsKey('DateKind') }
|    if ($script:SIProJsonDateKind) { return ($Text | ConvertFrom-Json -DateKind String -ErrorAction Stop) }
|    $Text | ConvertFrom-Json -ErrorAction Stop
|}
|
|function ConvertTo-SIProJsonString {
|    <# PURE. A string as a JSON literal. Escapes every control character and the characters YAML refuses unescaped
|       (C1 controls, line / paragraph separators) -- the materialised JSON is read by a YAML parser too. #>
|    param([AllowEmptyString()][string]$Value)
|    $sb = New-Object System.Text.StringBuilder ($Value.Length + 2)
|    [void]$sb.Append('"')
|    foreach ($ch in $Value.ToCharArray()) {
|        $c = [int]$ch
|        if ($ch -eq '"') { [void]$sb.Append('\"') }
|        elseif ($ch -eq '\') { [void]$sb.Append('\\') }
|        elseif ($c -eq 10) { [void]$sb.Append('\n') }
|        elseif ($c -eq 13) { [void]$sb.Append('\r') }
|        elseif ($c -eq 9) { [void]$sb.Append('\t') }
|        elseif ($c -lt 32 -or ($c -ge 0x7F -and $c -le 0x9F) -or $c -eq 0x2028 -or $c -eq 0x2029 -or $c -eq 0xFEFF) { [void]$sb.Append(('\u{0:x4}' -f $c)) }
|        else { [void]$sb.Append($ch) }
|    }
|    [void]$sb.Append('"')
|    $sb.ToString()
|}
|
|function ConvertTo-SIProJson {
|    <#
|        PURE. A value as JSON. -Canonical sorts object keys ordinally and writes compactly (for hashing and comparing);
|        without it keys keep their order and the text is indented (for storing and materialising). A list is always an
|        array; a number is invariant (a non-integer as its shortest round-trip form, whatever type the runtime parsed
|        it into); a DateTime is ISO 8601.
|    #>
|    param([AllowNull()]$Value, [switch]$Canonical, [int]$Level = 0)
|    if ($null -eq $Value) { return 'null' }
|    if ($Value -is [bool]) { if ($Value) { return 'true' } else { return 'false' } }
|    if ($Value -is [int] -or $Value -is [long] -or $Value -is [int16] -or $Value -is [byte] -or $Value -is [uint32] -or $Value -is [uint64] -or $Value -is [System.Numerics.BigInteger]) {
|        return ([string]::Format([System.Globalization.CultureInfo]::InvariantCulture, '{0}', $Value))
|    }
|    if ($Value -is [double] -or $Value -is [single] -or $Value -is [decimal]) {
|        $d = [double]$Value
|        if ($d -eq [Math]::Floor($d) -and [Math]::Abs($d) -lt 1e15) { return ([long]$d).ToString([System.Globalization.CultureInfo]::InvariantCulture) }
|        return $d.ToString('R', [System.Globalization.CultureInfo]::InvariantCulture)
|    }
|    if ($Value -is [datetime]) { return (ConvertTo-SIProJsonString $Value.ToString('o', [System.Globalization.CultureInfo]::InvariantCulture)) }
|    if ($Value -is [string] -or $Value -is [char] -or $Value -is [guid]) { return (ConvertTo-SIProJsonString ([string]$Value)) }
|    $nl = if ($Canonical) { '' } else { "`n" }
|    $pad = if ($Canonical) { '' } else { '  ' * $Level }
|    $pad1 = if ($Canonical) { '' } else { '  ' * ($Level + 1) }
|    $sep = if ($Canonical) { ':' } else { ': ' }
|    $pairs = $null
|    if ($Value -is [System.Collections.IDictionary]) { $pairs = @(foreach ($k in $Value.get_Keys()) { , @([string]$k, $Value[$k]) }) }
|    elseif ($Value -is [System.Management.Automation.PSCustomObject]) { $pairs = @(foreach ($p in $Value.PSObject.Properties) { , @($p.Name, $p.Value) }) }
|    if ($null -ne $pairs) {
|        if ($pairs.Count -eq 0) { return '{}' }
|        if ($Canonical) {
|            $names = [string[]]@($pairs | ForEach-Object { $_[0] })
|            $idx = [int[]](0..($pairs.Count - 1))
|            [Array]::Sort($names, $idx, [System.StringComparer]::Ordinal)
|            $pairs = @(foreach ($i in $idx) { , $pairs[$i] })
|        }
|        $items = foreach ($p in $pairs) { $pad1 + (ConvertTo-SIProJsonString $p[0]) + $sep + (ConvertTo-SIProJson -Value $p[1] -Canonical:$Canonical -Level ($Level + 1)) }
|        return ('{' + $nl + ($items -join (',' + $nl)) + $nl + $pad + '}')
|    }
|    if ($Value -is [System.Collections.IEnumerable]) {
|        $arr = @($Value)
|        if ($arr.Count -eq 0) { return '[]' }
|        $items = foreach ($v in $arr) { $pad1 + (ConvertTo-SIProJson -Value $v -Canonical:$Canonical -Level ($Level + 1)) }
|        return ('[' + $nl + ($items -join (',' + $nl)) + $nl + $pad + ']')
|    }
|    ConvertTo-SIProJsonString ([string]$Value)
|}
|
|function Get-SIProTextHash {
|    <# PURE. SHA-256 (hex) of a text as UTF-8. #>
|    param([AllowEmptyString()][AllowNull()][string]$Text)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { -join ($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes([string]$Text)) | ForEach-Object { $_.ToString('x2') }) } finally { $sha.Dispose() }
|}
|
|function Get-SIProItemFingerprint {
|    <#
|        PURE. What an item SAYS, independent of how it was written: JSON -> the canonical form (key order, spacing and
|        number formatting do not count); YAML -> the text with line endings, a BOM and trailing spaces normalised (its
|        comments DO count -- they are part of what the operator wrote). Used to store only real differences.
|    #>
|    param([AllowEmptyString()][string]$Body, [string]$Format = 'json')
|    if ($Format -eq 'yaml') {
|        $t = $Body.TrimStart([char]0xFEFF) -replace "`r`n", "`n" -replace "`r", "`n"
|        return ((($t -split "`n") | ForEach-Object { $_.TrimEnd() }) -join "`n").Trim()
|    }
|    try { ConvertTo-SIProJson -Value (ConvertFrom-SIProJson $Body) -Canonical } catch { $Body.Trim() }
|}
|
|function Test-SIProSameItem {
|    <# PURE. Do two bodies say the same thing? #>
|    param([AllowEmptyString()][string]$A, [AllowEmptyString()][string]$B, [string]$Format = 'json')
|    (Get-SIProItemFingerprint -Body $A -Format $Format) -ceq (Get-SIProItemFingerprint -Body $B -Format $Format)
|}
|
|# =====================================================================================================================
|#  KEYS that are derived from a body
|# =====================================================================================================================
|function Get-SIRiskIndexKey {
|    <# PURE. A risk index row's item key: its dimension columns, '|'-joined (#559: the eight SI dimensions; a row still
|       written with the 2.2 columns keeps its six 2.2 dimensions -- -V22). #>
|    param([Parameter(Mandatory)]$Row, [switch]$V22)
|    $get = { param($n) if ($Row -is [System.Collections.IDictionary]) { [string]$Row[$n] } elseif ($Row.PSObject.Properties[$n]) { [string]$Row.$n } else { '' } }
|    $cols = $script:SIRiskIndexKeyColumns; if ($V22) { $cols = $script:SIRiskIndexV22KeyColumns }
|    'row/' + ((@($cols | ForEach-Object { (& $get $_).Trim() })) -join '|')
|}
|
|function Get-SIProAssetTagStemKey {
|    <#
|        PURE. The asset-tagging merge key of a tag name -- the SAME rule as the engine's Get-AssetTagStemKey
|        (engine\asset-tagging\AssetTagging.ps1; a test runs both on the same names): '<stem>--tier<N>--SI' and
|        '<stem>--excluded--SI' share the key '<STEM>--SI'. $null when the name does not follow the convention.
|    #>
|    param([AllowEmptyString()][string]$Name)
|    if ([string]::IsNullOrWhiteSpace($Name)) { return $null }
|    $m = [regex]::Match($Name.Trim(), '^(?<stem>.+?)--(?:tier(?<tier>\d+)|excluded)--SI$', [System.Text.RegularExpressions.RegexOptions]::IgnoreCase)
|    if (-not $m.Success) { return $null }
|    ($m.Groups['stem'].Value + '--SI').ToUpperInvariant()
|}
|
|# =====================================================================================================================
|#  VALIDATION -- the same rules for a template (at publish), an override (writer and run start) and an import.
|# =====================================================================================================================
|function Get-SIProConfigContext {
|    <# What validating items needs from the installation (read once per run): the Pro-1b document context plus the
|       settings catalog (for naming). #>
|    param([string]$SIRoot, [object[]]$Catalog)
|    if (-not $SIRoot) { $SIRoot = $script:SIProConfigSIRoot }
|    if (-not $Catalog) { $Catalog = @(Get-SISettingsCatalog -SIRoot $SIRoot) }
|    [pscustomobject]@{ SIRoot = $SIRoot; Reports = @(Get-SIRaReportNames -SIRoot $SIRoot); Kinds = @(Get-SIRuleKinds -SIRoot $SIRoot); Catalog = @($Catalog) }
|}
|
|function Test-SIProOwnershipMap {
|    <#
|        PURE. The reasons a CMDB ownership map (the configuration document cmdbownership/map, #251) is not accepted -- empty =
|        accepted. The map is the cmdbSourceOwnership object of config\cmdb-source-ownership.locked.json. The web app's
|        OwnershipMapValidator applies the same rules (both test suites read pro-management\tests\fixtures\ownership-map-cases.json).
|        -Value: the JSON text, or (-Parsed) the value ConvertFrom-SIProJson made of it.
|    #>
|    param([AllowNull()]$Value, [switch]$Parsed)
|    $why = New-Object System.Collections.Generic.List[string]
|    $o = $Value
|    if (-not $Parsed) {
|        try { $o = ConvertFrom-SIProJson ([string]$Value) } catch { $why.Add('the ownership map is not valid JSON: ' + $_.Exception.Message); return $why.ToArray() }
|    }
|    if ($o -isnot [System.Management.Automation.PSCustomObject]) { $why.Add('the ownership map must be a JSON object'); return $why.ToArray() }
|    $isNote = { param([string]$n) $n.StartsWith('_') -or $n -eq 'Comment' }
|    $isList = { param($v) ($null -ne $v) -and ($v -is [System.Collections.IEnumerable]) -and ($v -isnot [string]) -and ($v -isnot [System.Management.Automation.PSCustomObject]) }
|    $whole = { param($v) if ($null -eq $v -or $v -is [bool] -or (& $isList $v) -or $v -is [System.Management.Automation.PSCustomObject]) { return $false }
|               $d = 0.0; if (-not [double]::TryParse([string]$v, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $false }
|               ($d -eq [Math]::Floor($d)) -and $d -ge 0 -and $d -le 3650 }
|    $text = { param($v) ($v -is [string]) -and -not [string]::IsNullOrWhiteSpace($v) }
|    foreach ($p in $o.PSObject.Properties) {
|        if (& $isNote $p.Name) { continue }
|        $v = $p.Value
|        switch -CaseSensitive ($p.Name) {
|            'notACiResourceTypes' { if (-not (& $isList $v) -or @(@($v) | Where-Object { -not (& $text $_) }).Count) { $why.Add('notACiResourceTypes must be a list of resource types') } }
|            'defaultSiMayCreate' { if ($v -isnot [bool]) { $why.Add('defaultSiMayCreate must be true or false') } }
|            'defaultExpectedWithinDays' { if (-not (& $whole $v)) { $why.Add('defaultExpectedWithinDays must be a whole number from 0 to 3650') } }
|            'defaultCiClass' { if (-not (& $text $v)) { $why.Add('defaultCiClass must be a CI class name') } }
|            'assetTypes' {
|                if (-not (& $isList $v)) { $why.Add('assetTypes must be a list'); break }
|                $seen = @{}; $n = 0
|                foreach ($e in @($v)) {
|                    $n++
|                    if ($e -isnot [System.Management.Automation.PSCustomObject]) { $why.Add(('assetTypes[{0}] must be an object' -f $n)); continue }
|                    if (-not $e.PSObject.Properties['siAssetType']) { $why.Add(('assetTypes[{0}] has no siAssetType' -f $n)); continue }
|                    $raw = $e.siAssetType
|                    $t = if ($raw -is [string]) { $raw.Trim().ToLowerInvariant() } else { '' }
|                    if ($t -cnotmatch '^[a-z0-9][a-z0-9_\-\.]{0,99}$') { $why.Add(("assetTypes[{0}]: '{1}' is not an asset type (lower-case letters, digits, _ - .)" -f $n, $raw)); continue }
|                    if ($seen.ContainsKey($t)) { $why.Add(("assetTypes: '{0}' is listed twice" -f $t)); continue }
|                    $seen[$t] = $true
|                    foreach ($q in $e.PSObject.Properties) {
|                        if ((& $isNote $q.Name) -or $q.Name -ceq 'siAssetType') { continue }
|                        switch -CaseSensitive ($q.Name) {
|                            'siMayCreate' { if ($q.Value -isnot [bool]) { $why.Add(('assetTypes[{0}] ({1}): siMayCreate must be true or false' -f $n, $t)) } }
|                            'expectedWithinDays' { if (-not (& $whole $q.Value)) { $why.Add(('assetTypes[{0}] ({1}): expectedWithinDays must be a whole number from 0 to 3650' -f $n, $t)) } }
|                            'ciClass' { if (-not (& $text $q.Value)) { $why.Add(('assetTypes[{0}] ({1}): ciClass must be a CI class name' -f $n, $t)) } }
|                            'ownedBy' { if ($null -ne $q.Value -and $q.Value -isnot [string]) { $why.Add(('assetTypes[{0}] ({1}): ownedBy must be text or null' -f $n, $t)) } }
|                            default { $why.Add(("assetTypes[{0}] ({1}): '{2}' is not an asset type setting" -f $n, $t, $q.Name)) }
|                        }
|                    }
|                }
|            }
|            default { $why.Add(("'{0}' is not an ownership setting" -f $p.Name)) }
|        }
|    }
|    $why.ToArray()
|}
|
|function Test-SIProItem {
|    <#
|        The reasons an item body is not accepted (empty = accepted). -Context: Get-SIProConfigContext (Reports may be
|        widened by the caller with the customer's own reports).
|    #>
|    param([AllowEmptyString()][string]$Kind, [AllowEmptyString()][string]$Key, [AllowEmptyString()][AllowNull()][string]$Body,
|          [string]$Format, [Parameter(Mandatory)]$Context)
|    $why = New-Object System.Collections.Generic.List[string]
|    $spec = $script:SIProItemKinds[$Kind]
|    if (-not $spec) { $why.Add(("'{0}' is not a configuration kind ({1})" -f $Kind, ($script:SIProItemKinds.Keys -join ', '))); return $why.ToArray() }
|    if ([string]::IsNullOrEmpty($Key) -or $Key -notmatch $spec.Key) { $why.Add(("'{0}' is not a valid {1} key" -f $Key, $Kind)); return $why.ToArray() }
|    if (-not $Format) { $Format = $spec.Format }
|    if ($Format -ne $spec.Format) { $why.Add(("a {0} item is {1}, not {2}" -f $Kind, $spec.Format, $Format)); return $why.ToArray() }
|    if ([string]::IsNullOrWhiteSpace($Body)) { $why.Add('the body is empty'); return $why.ToArray() }
|    $o = $null
|    if ($Format -eq 'json') {
|        try { $o = ConvertFrom-SIProJson $Body } catch { $why.Add('the body is not valid JSON: ' + $_.Exception.Message); return $why.ToArray() }
|    }
|    $isObj = $o -is [System.Management.Automation.PSCustomObject]
|    $prop = { param($n) if ($isObj -and $o.PSObject.Properties[$n]) { , $o.$n } else { $null } }   # ',' keeps a one-item list a list
|    switch ($Kind) {
|        'rareport' {
|            if (-not $isObj) { $why.Add('a report must be a JSON object'); break }
|            $name = $Key.Substring($Key.IndexOf('/') + 1)
|            if ([string](& $prop 'ReportName') -cne $name) { $why.Add(("ReportName must be '{0}' -- the key names the report" -f $name)) }
|            if ($Key -like 'report/*') {
|                $q = & $prop 'ReportQuery'
|                # the shipped catalog writes ReportQuery as a one-item YAML list; text works as well
|                $qt = @(@($q) | Where-Object { $_ -is [string] -and -not [string]::IsNullOrWhiteSpace($_) })
|                if ($qt.Count -eq 0 -or @(@($q) | Where-Object { $_ -isnot [string] }).Count) { $why.Add('a report needs a ReportQuery (text, or a list of text)') }
|            } else {
|                $incRaw = & $prop 'ReportsIncluded'
|                $inc = @($incRaw | Where-Object { $null -ne $_ })
|                if ($inc.Count -eq 0) { $why.Add('a report template needs ReportsIncluded') }
|                foreach ($i in $inc) {
|                    $n = if ($i -is [string]) { $i } elseif ($i.PSObject.Properties['Name']) { [string]$i.Name } elseif ($i.PSObject.Properties['ReportName']) { [string]$i.ReportName } else { '' }
|                    if ($n -notmatch '^[A-Za-z0-9_]{1,100}$') { $why.Add(("ReportsIncluded: '{0}' is not a report name" -f $n)) }
|                }
|            }
|        }
|        'riskindex' {
|            if (-not $isObj) { $why.Add('a risk index row must be a JSON object'); break }
|            # #559: SI-keyed (the columns of today) or a row stored with the 2.2 columns (translated where it is written)
|            $isV22 = (@($o.PSObject.Properties.Name) | Where-Object { $_ -in 'RiskConsequenceScore_SecuritySeverity', 'RiskProbablityScore_CriticialityTierLevel', 'SecurityDomain', 'CriticalityTierLevel' }).Count -gt 0
|            $allowed = $script:SIRiskIndexColumns; if ($isV22) { $allowed = $script:SIRiskIndexV22Columns }
|            foreach ($p in $o.PSObject.Properties) {
|                if ($allowed -notcontains $p.Name) { $why.Add(("'{0}' is not a risk index column" -f $p.Name)); continue }
|                if ($null -ne $p.Value -and ($p.Value -is [System.Collections.IEnumerable] -and $p.Value -isnot [string])) { $why.Add(("{0} must be a single value" -f $p.Name)); continue }
|                if ([string]$p.Value -match '[\r\n"]') { $why.Add(("{0} may not hold quotes or line breaks" -f $p.Name)) }
|            }
|            $nums = @('AssetBase', 'VulnerabilityBase', 'si_tier', 'Precedence'); if ($isV22) { $nums = @('RiskConsequenceScore_SecuritySeverity', 'RiskProbablityScore_CriticialityTierLevel', 'Precedence') }
|            foreach ($n in $nums) {
|                $v = [string](& $prop $n); $d = 0.0
|                if ($v -and -not [double]::TryParse($v, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { $why.Add(("{0} must be a number" -f $n)) }
|            }
|            if (-not $isV22) {
|                $ac = [string](& $prop 'asset_class')
|                if ($ac -and @('device_server', 'device_client', 'device', 'identity', 'cloud_resource', 'public_ip') -notcontains $ac) { $why.Add(("asset_class '{0}' (device_server, device_client, device, identity, cloud_resource, public_ip or blank)" -f $ac)) }
|            }
|            # an empty dimension is a wildcard row (the shipped index has rows matched by configuration id at any severity)
|            # a repeated row keeps its place as '<dimensions>#<n>' (the engine's index keeps every row, so a repeat is kept too)
|            if ($why.Count -eq 0 -and ($Key -replace '#\d+$', '') -cne (Get-SIRiskIndexKey -Row $o -V22:$isV22)) { $why.Add(("the key must be '{0}' (or '{0}#<n>' for a repeated row) -- it is made of the row's dimension columns" -f (Get-SIRiskIndexKey -Row $o -V22:$isV22))) }
|        }
|        'rule' {
|            $id = $Key.Substring($Key.IndexOf('/') + 1)
|            foreach ($w in @(Test-SIRuleText -Text $Body.TrimStart([char]0xFEFF) -Id $id -Kinds @($Context.Kinds))) { $why.Add($w) }
|        }
|        'assettagging' {
|            if (-not $isObj) { $why.Add('an asset-tagging item must be a JSON object'); break }
|            if ($Key -eq 'config') { break }   # asset-tagging.config.json: the gates the rules name, free-form
|            $stem = Get-SIProAssetTagStemKey ([string](& $prop 'AssetTagName'))
|            if (-not $stem) { $why.Add("AssetTagName must be '<stem>--tier<N>--SI' or '<stem>--excluded--SI'"); break }
|            if (('tag/' + $stem) -cne $Key) { $why.Add(("the key must be 'tag/{0}' -- it is the tag's merge key" -f $stem)) }
|        }
|        'cmdbownership' {
|            if ($Key -eq 'map') { foreach ($w in @(Test-SIProOwnershipMap -Value $o -Parsed)) { $why.Add($w) }; break }
|            if (-not $isObj) { $why.Add('an ownership item must be a JSON object'); break }
|            if ($Key -eq 'defaults') {
|                if ($o.PSObject.Properties['assetTypes']) { $why.Add("the defaults item holds no assetTypes -- each asset type is its own item (assettype/<type>)") }
|                $sc = & $prop 'defaultSiMayCreate'; if ($null -ne $sc -and $sc -isnot [bool]) { $why.Add('defaultSiMayCreate must be true or false') }
|                $d = & $prop 'defaultExpectedWithinDays'; $n = 0; if ($null -ne $d -and (-not [int]::TryParse([string]$d, [ref]$n) -or $n -lt 0 -or $n -gt 3650)) { $why.Add('defaultExpectedWithinDays must be a whole number from 0 to 3650') }
|                $na = & $prop 'notACiResourceTypes'; if ($null -ne $na) { foreach ($t in @($na)) { if ($t -isnot [string]) { $why.Add('notACiResourceTypes must be a list of resource types') ; break } } }
|            } else {
|                $t = ([string](& $prop 'siAssetType')).Trim().ToLowerInvariant()
|                if (('assettype/' + $t) -cne $Key) { $why.Add(("siAssetType must be '{0}' -- the key names the asset type" -f $Key.Substring(10))) }
|                $sc = & $prop 'siMayCreate'; if ($null -ne $sc -and $sc -isnot [bool]) { $why.Add('siMayCreate must be true or false') }
|                $d = & $prop 'expectedWithinDays'; $n = 0; if ($null -ne $d -and (-not [int]::TryParse([string]$d, [ref]$n) -or $n -lt 0 -or $n -gt 3650)) { $why.Add('expectedWithinDays must be a whole number from 0 to 3650') }
|            }
|        }
|        'servicemodel' {
|            if (-not $isObj) { $why.Add('the service model must be a JSON object'); break }
|            foreach ($n in 'services', 'bindings') { $v = & $prop $n; if ($null -ne $v -and -not ($v -is [System.Collections.IEnumerable] -and $v -isnot [string])) { $why.Add(("{0} must be a list" -f $n)) } }
|        }
|        'schemaoverlay' {
|            if (-not $isObj) { $why.Add('a schema overlay must be a JSON object'); break }
|            $f = & $prop 'fields'; if ($null -ne $f -and -not ($f -is [System.Collections.IEnumerable] -and $f -isnot [string])) { $why.Add('fields must be a list') }
|        }
|        'decision' {
|            $y = $null
|            try { $y = ConvertFrom-SIYaml -Yaml $Body.TrimStart([char]0xFEFF) -SourceName ('decisions/' + $Key) } catch { $why.Add('the decisions file is not valid YAML: ' + $_.Exception.Message); break }
|            if ($null -ne $y -and $y -isnot [System.Collections.IDictionary]) { $why.Add('a decisions file must be a YAML mapping') }
|        }
|        'naming' {
|            $s = @($Context.Catalog | Where-Object { $_.name -eq $Key }) | Select-Object -First 1
|            if (-not $s -or $s.type -ne 'text' -or $s.secret -or $Key -notmatch $script:SIProNamingPattern) { $why.Add(("'{0}' is not a naming setting (a text setting that names a table, DCR, DCE or workspace)" -f $Key)); break }
|            if ($o -isnot [string]) { $why.Add('a naming item is one text value'); break }
|            $w = Test-SISettingValue -Setting $s -Value $o
|            if ($w) { $why.Add($w) }
|            elseif ($o -notmatch '^[A-Za-z0-9][A-Za-z0-9_\-\.\{\}]{0,127}$') { $why.Add(("'{0}' is not a valid resource name (letters, digits, _ - . and {{placeholders}})" -f $o)) }
|        }
|        'ruletier' {
|            if (-not $isObj) { $why.Add('a rule tier decision must be a JSON object'); break }
|            if ([string](& $prop 'ruleKey') -cne $Key) { $why.Add(("ruleKey must be '{0}' -- the key names the rule" -f $Key)) }
|            $tv = & $prop 'tier'; $n = 0
|            if ($null -eq $tv -or -not [int]::TryParse([string]$tv, [ref]$n) -or [string]$n -ne ([string]$tv).Trim() -or $n -lt 0 -or $n -gt 3) { $why.Add('tier must be 0, 1, 2 or 3') }
|        }
|        'serverapps' {
|            # the loader's own rule: an entry without a vendor or a name is skipped; a tier it cannot read as 0-3 is refused
|            # here, because the loader casts it ([int]) and would stop the run
|            if (-not $isObj) { $why.Add('the server-application catalog must be a JSON object'); break }
|            $apps = & $prop 'applications'
|            if ($null -eq $apps -or -not ($apps -is [System.Collections.IEnumerable] -and $apps -isnot [string])) { $why.Add('applications must be a list'); break }
|            foreach ($a in @($apps)) {
|                if ($a -isnot [System.Management.Automation.PSCustomObject]) { $why.Add('every application must be a JSON object'); break }
|                if (-not $a.PSObject.Properties['tier']) { continue }
|                $n = 0
|                if (-not [int]::TryParse([string]$a.tier, [ref]$n) -or $n -lt 0 -or $n -gt 3) { $why.Add(("{0} / {1}: tier must be 0, 1, 2 or 3" -f [string]$a.software_vendor, [string]$a.software_name)) }
|            }
|        }
|        'outputscope' {
|            foreach ($w in @(Test-SIOutputScopeBody -Key $Key -Body $o)) { $why.Add($w) }
|        }
|        'datamodel' {
|            foreach ($w in @(Test-SIDataModelProItem -Key $Key -Value $o)) { $why.Add($w) }
|        }
|        'weights' {
|            if (-not $isObj) { $why.Add('a weights item must be a JSON object'); break }
|            if ($Key -eq 'model') {
|                if ($o.PSObject.Properties['weightedRiskFactors']) { $why.Add("weightedRiskFactors belongs in the weights document (cfg.Document weights/solution), not in the model sections") }
|            } else {
|                $rep = $Key.Substring(7)
|                if (@($Context.Reports) -notcontains $rep) { $why.Add(("'{0}' is not a Risk Analysis report" -f $rep)); break }
|                foreach ($w in @(Test-SIProDocument -Kind weights -Key solution -Body $Body -Context $Context)) { $why.Add($w) }
|            }
|        }
|    }
|    $why.ToArray()
|}
|
|# =====================================================================================================================
|#  READING THE ROWS (guarded: a database without the Phase C tables has none of them)
|# =====================================================================================================================
|function Read-SIProTemplates {
|    <# ContentHash (template versioning) is read where the column exists -- through EXEC, because a batch naming a
|       column the table does not have fails to compile even inside an IF. #>
|    param([Parameter(Mandatory)]$Store)
|    $cols = "Kind, ItemKey, [Version] AS TemplateVersion, BodyJson, Format, SortOrder, BodyHash, Source, RetiredAt, CONVERT(varchar(30), CONVERT(bigint, RowVersion)) AS Version"
|    $sql = "IF COL_LENGTH('cfg.Template', 'ContentHash') IS NOT NULL EXEC (N'SELECT $cols, ContentHash FROM cfg.Template') ELSE IF OBJECT_ID('cfg.Template') IS NOT NULL SELECT $cols, CAST(NULL AS char(64)) AS ContentHash FROM cfg.Template"
|    & $Store.Invoke $sql @{} 'reader' | ForEach-Object { $_ }
|}
|function Read-SIProItemOverrides {
|    param([Parameter(Mandatory)]$Store)
|    & $Store.Invoke "IF OBJECT_ID('cfg.ItemOverride') IS NOT NULL SELECT Kind, ItemKey, State, BodyJson, Format, BaseVersion, BaseHash, CONVERT(varchar(30), CONVERT(bigint, RowVersion)) AS Version FROM cfg.ItemOverride" @{} 'reader' | ForEach-Object { $_ }
|}
|function Read-SIProExemptions {
|    param([Parameter(Mandatory)]$Store)
|    # RequestId (#252) only where the column exists -- a database set up before the governed flow has none
|    $cols = 'ExemptionId, Scope, ReportName, ConfigurationId, Cve, AssetKey, Reason, ExpiresAt, CreatedBy, CreatedAt, RevokedAt'
|    & $Store.Invoke "IF COL_LENGTH('cfg.Exemption', 'RequestId') IS NOT NULL EXEC (N'SELECT $cols, RequestId FROM cfg.Exemption') ELSE IF OBJECT_ID('cfg.Exemption') IS NOT NULL SELECT $cols, CAST(NULL AS bigint) AS RequestId FROM cfg.Exemption" @{} 'reader' | ForEach-Object { $_ }
|}
|
|function Get-SIProOrdinalOrder {
|    <# PURE. The positions of -Keys in ordinal order (culture never decides an order here -- it differs between PS 5.1
|       and 7). Sorts an int[] alongside the keys: [Array]::Sort with an object[] of items leaves the items unmoved in
|       PowerShell, an int[] is moved. #>
|    param([AllowEmptyCollection()][string[]]$Keys = @())
|    if ($Keys.Count -eq 0) { return }
|    $k = [string[]]$Keys.Clone(); $idx = [int[]](0..($k.Count - 1))
|    [Array]::Sort($k, $idx, [System.StringComparer]::Ordinal)
|    $idx
|}
|
|function Get-SIProRowValue {
|    param($Row, [string]$Name)
|    if ($null -eq $Row) { return $null }
|    if ($Row -is [System.Collections.IDictionary]) { if ($Row.Contains($Name)) { return $Row[$Name] } else { return $null } }
|    if ($Row.PSObject.Properties[$Name]) { return $Row.$Name }
|    $null
|}
|
|# =====================================================================================================================
|#  MERGE: template + customer state per item -> the effective items of a run.
|# =====================================================================================================================
|function Merge-SIProItems {
|    <#
|        PURE. -Templates (cfg.Template rows), -Overrides (cfg.ItemOverride rows), -Documents (accepted cfg.Document
|        documents, Pro-1b). Per (kind, key):
|          template only                 -> the template body           (Origin 'template')
|          override State 'inherit'      -> the template body           (an explicit "follow the vendor")
|          override State 'override'     -> the customer's body          (Origin 'override'; 'own' when no template)
|          override State 'disable'      -> left out                     (listed in Disabled)
|          retired template, no override -> left out                     (the release no longer ships it)
|        Templates are checked against their BodyHash; overrides are validated by Test-SIProItem. A cfg.Document rule and
|        an override of the same rule, or an override of a kind cfg.Document owns (exclusions), are refused -- one item,
|        one home. Returns @{ Items; Disabled; Refused; Notes; TemplateVersion; Families }.
|        Items are ordered: per kind, templates by SortOrder then key, then the customer's own items by key (ordinal), so
|        the same rows always materialise the same files.
|        ADDITIVE UPGRADE (adopted from PIM4EntraPS): -Revisions (cfg.TemplateRevision rows -- Read-SIProOverrideBaseRevisions
|        reads just the ones needed). An override behind the shipped content whose new shipped version only ADDS (keys,
|        list entries) gets those additions in its effective body; the customer's own values are never touched
|        (Get-SIProAdditiveMerge). The merged body is validated like any override; one that does not validate, or a change
|        that alters / removes something, stays the customer's body as stored (upgrade available, as before). Nothing is
|        written: the stored override keeps its base, so the conformance view shows "new shipped additions applied".
|        MANDATORY CONTROLS: -Mandatory (default: config\template-mandatory.locked.json of $Context.SIRoot). An item with a
|        control that the customer switched off is applied from its template anyway; a required value the effective body
|        breaks is put back on top (Set-SIProMandatoryValues). Each correction is a note. Pass -Mandatory @() for none.
|    #>
|    param([AllowEmptyCollection()][object[]]$Templates = @(), [AllowEmptyCollection()][object[]]$Overrides = @(),
|          [AllowEmptyCollection()][object[]]$Documents = @(), [Parameter(Mandatory)]$Context,
|          [AllowEmptyCollection()][object[]]$Revisions = @(), [AllowEmptyCollection()][object[]]$Mandatory)
|    if ($null -eq $Mandatory) {
|        $Mandatory = @()
|        $mr = if ($Context -and $Context.PSObject.Properties['SIRoot'] -and $Context.SIRoot) { [string]$Context.SIRoot } else { $script:SIProConfigSIRoot }
|        $Mandatory = @(Get-SIProMandatoryControls -SIRoot $mr)
|    }
|    $revIdx = Get-SIProRevisionIndex -Revisions @($Revisions)
|    $refused = New-Object System.Collections.Generic.List[object]; $notes = New-Object System.Collections.Generic.List[string]
|    $disabled = New-Object System.Collections.Generic.List[string]
|    $tpl = @{}; $versions = @{}
|    # #251: the CMDB ownership map's legacy rows (templates + per-entry overrides), kept for the carry-over below
|    $legacyOwnTpl = New-Object System.Collections.Generic.List[object]; $legacyOwnOvr = New-Object System.Collections.Generic.List[object]
|    foreach ($t in @($Templates | Where-Object { $_ })) {
|        $kind = [string](Get-SIProRowValue $t 'Kind'); $key = [string](Get-SIProRowValue $t 'ItemKey')
|        $body = [string](Get-SIProRowValue $t 'BodyJson'); $fmt = [string](Get-SIProRowValue $t 'Format'); if (-not $fmt) { $fmt = 'json' }
|        $name = '{0}/{1}' -f $kind, $key
|        # #251: a template row of a kind that is configuration now (naming, cmdbownership) is history -- never applied as a
|        # template, never refused. A live ownership row still feeds the map until setup has carried it over.
|        if (Test-SIProFormerTemplateKind $kind) {
|            if ($kind -eq 'cmdbownership' -and $null -eq (Get-SIProRowValue $t 'RetiredAt')) { $legacyOwnTpl.Add($t) }
|            continue
|        }
|        $spec = $script:SIProItemKinds[$kind]
|        if (-not $spec -or -not $spec.Templated) { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'template'; Reason = ("'{0}' is not a templated configuration kind" -f $kind) }); continue }
|        if ($key -notmatch $spec.Key) { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'template'; Reason = 'not a valid key' }); continue }
|        if ($fmt -ne $spec.Format) { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'template'; Reason = ("a {0} item is {1}" -f $kind, $spec.Format) }); continue }
|        $h = [string](Get-SIProRowValue $t 'BodyHash')
|        if ((Get-SIProTextHash $body) -ne $h.Trim()) { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'template'; Reason = 'the body does not match its BodyHash -- republish the templates' }); continue }
|        if ($fmt -eq 'json') { try { $null = ConvertFrom-SIProJson $body } catch { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'template'; Reason = 'the body is not valid JSON' }); continue } }
|        $so = 0; [void][int]::TryParse([string](Get-SIProRowValue $t 'SortOrder'), [ref]$so)
|        $v = [string](Get-SIProRowValue $t 'TemplateVersion'); if ($v) { $versions[$v] = $true }
|        $tpl[$name] = [pscustomobject]@{ Kind = $kind; Key = $key; Body = $body; Format = $fmt; SortOrder = $so; Hash = $h.Trim()
|            ContentHash = ([string](Get-SIProRowValue $t 'ContentHash')).Trim()
|            Source = [string](Get-SIProRowValue $t 'Source'); Version = $v; Retired = ($null -ne (Get-SIProRowValue $t 'RetiredAt')) }
|    }
|    $docKeys = @{}; foreach ($d in @($Documents | Where-Object { $_ })) { $docKeys[('{0}/{1}' -f $d.Kind, $d.Key)] = $true }
|    $ovr = @{}
|    foreach ($o in @($Overrides | Where-Object { $_ })) {
|        $kind = [string](Get-SIProRowValue $o 'Kind'); $key = [string](Get-SIProRowValue $o 'ItemKey'); $state = [string](Get-SIProRowValue $o 'State')
|        $body = Get-SIProRowValue $o 'BodyJson'; $fmt = [string](Get-SIProRowValue $o 'Format'); if (-not $fmt) { $fmt = 'json' }
|        $name = '{0}/{1}' -f $kind, $key
|        if ($kind -eq 'exclusions') { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'override'; Reason = 'exclusions are documents (cfg.Document), not item overrides' }); continue }
|        if ($state -notin 'inherit', 'override', 'disable') { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'override'; Reason = ("'{0}' is not a state (inherit, override, disable)" -f $state) }); continue }
|        $spec = $script:SIProItemKinds[$kind]
|        if (-not $spec) { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'override'; Reason = ("'{0}' is not a configuration kind" -f $kind) }); continue }
|        if ($key -notmatch $spec.Key) { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'override'; Reason = 'not a valid key' }); continue }
|        if ($docKeys.ContainsKey($name) -and $state -ne 'inherit') { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'override'; Reason = 'the same item is also a cfg.Document -- one item, one home' }); continue }
|        # #251: a legacy per-entry ownership row (defaults, assettype/<type>) is carried into the map, not applied by itself
|        if ($kind -eq 'cmdbownership' -and $key -ne 'map') { $legacyOwnOvr.Add($o); continue }
|        if ($state -eq 'override') {
|            # the required values go on top BEFORE the override is validated: a stored override that weakens one (a
|            # built-in factor switched off) keeps the customer's other values with the required value applied, instead of
|            # being refused whole by the item rules
|            if ($fmt -eq 'json' -and @($Mandatory).Count) {
|                $mv0 = Set-SIProMandatoryValues -Controls $Mandatory -Kind $kind -Key $key -Body ([string]$body)
|                if ($mv0.Changed) { $body = [string]$mv0.Body; foreach ($a in @($mv0.Applied)) { $notes.Add($a) } }
|            }
|            $why = @(Test-SIProItem -Kind $kind -Key $key -Body ([string]$body) -Format $fmt -Context $Context)
|            if ($why.Count) { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'override'; Reason = ($why -join '; ') }); continue }
|        }
|        $ovr[$name] = [pscustomobject]@{ Kind = $kind; Key = $key; State = $state; Body = [string]$body; Format = $fmt; BaseHash = [string](Get-SIProRowValue $o 'BaseHash') }
|    }
|    $items = New-Object System.Collections.Generic.List[object]
|    foreach ($name in @($tpl.Keys)) {
|        $t = $tpl[$name]; $o = $ovr[$name]
|        if ($o -and $o.State -eq 'disable') {
|            # a mandatory item is never switched off: the template applies, and the run says so
|            if (-not $t.Retired -and @(Get-SIProMandatoryFor -Controls $Mandatory -Kind $t.Kind -Key $t.Key).Count) {
|                $notes.Add(("{0}: switched off, but SecurityInsight requires it -- the shipped item is applied" -f $name))
|                $items.Add([pscustomobject]@{ Kind = $t.Kind; Key = $t.Key; Body = $t.Body; Format = $t.Format; Origin = 'template'; SortOrder = $t.SortOrder; Source = $t.Source; Stale = $false; Mandatory = $true })
|                continue
|            }
|            $disabled.Add($name); continue
|        }
|        if ($o -and $o.State -eq 'override') {
|            # BaseHash is the template's normalised ContentHash (template versioning), or its raw BodyHash for an override
|            # made before content hashes -- either one matching means the template's CONTENT did not move underneath it.
|            $b = ([string]$o.BaseHash).Trim()
|            $stale = $false
|            if ($b -and $b -ne $t.Hash) {
|                $ch = $t.ContentHash
|                if (-not $ch) { try { $ch = Get-SIProContentHash -Body $t.Body -Format $t.Format } catch { $ch = '' } }
|                $stale = ($b -ne $ch)
|            }
|            $effBody = $o.Body; $added = @()
|            if ($stale -and $b) {
|                # additive upgrade: the shipped version the override was made on, by its content hash or raw body hash
|                $base = $revIdx[('{0}#{1}' -f $name, $b)]
|                if ($base) {
|                    $am = Get-SIProAdditiveMerge -Base ([string](Get-SIProRowValue $base 'BodyJson')) -Current $t.Body -Override $o.Body -Format $o.Format
|                    if ($am.Additive) {
|                        $why = @()
|                        if ($am.Changed) { $why = @(Test-SIProItem -Kind $t.Kind -Key $t.Key -Body ([string]$am.Body) -Format $o.Format -Context $Context) }
|                        if ($why.Count -eq 0) {
|                            $effBody = [string]$am.Body; $added = @($am.Added); $stale = $false
|                            if ($added.Count) { $notes.Add(("{0}: overridden -- new shipped additions applied ({1}); your own values are unchanged" -f $name, ($added -join ', '))) }
|                        } else {
|                            $notes.Add(("{0}: the new shipped additions do not fit your version ({1}) -- review the upgrade" -f $name, ($why -join '; ')))
|                        }
|                    }
|                }
|            }
|            if ($stale) { $notes.Add(("{0}: the template changed since it was overridden -- an upgrade is available (see the template conformance view)" -f $name)) }
|            $items.Add([pscustomobject]@{ Kind = $t.Kind; Key = $t.Key; Body = $effBody; Format = $o.Format; Origin = 'override'; SortOrder = $t.SortOrder; Source = $t.Source; Stale = $stale
|                AdditionsApplied = ($added.Count -gt 0); Additions = $added })
|            continue
|        }
|        if ($t.Retired) { continue }
|        $items.Add([pscustomobject]@{ Kind = $t.Kind; Key = $t.Key; Body = $t.Body; Format = $t.Format; Origin = 'template'; SortOrder = $t.SortOrder; Source = $t.Source; Stale = $false })
|    }
|    foreach ($name in @($ovr.Keys)) {
|        if ($tpl.ContainsKey($name)) { continue }
|        $o = $ovr[$name]
|        if ($o.State -ne 'override') {
|            # a naming 'disable' / 'inherit' made against a template that is a setting now: the catalog default applies -- quiet
|            if (-not (Test-SIProFormerTemplateKind $o.Kind)) { $notes.Add(("{0}: '{1}' has no template to apply to -- nothing to do" -f $name, $o.State)) }
|            continue
|        }
|        $items.Add([pscustomobject]@{ Kind = $o.Kind; Key = $o.Key; Body = $o.Body; Format = $o.Format; Origin = 'own'; SortOrder = [int]::MaxValue; Source = ''; Stale = $false })
|    }
|    # #251: the CMDB ownership map. The configuration document cmdbownership/map is the map; until setup has written it, the
|    # map is built from the legacy rows exactly as it was materialised before (templates with the customer's per-entry
|    # overrides over them), so nothing the customer set is lost in between.
|    if (-not $ovr.ContainsKey('cmdbownership/map') -and ($legacyOwnTpl.Count -or @($legacyOwnOvr | Where-Object { [string](Get-SIProRowValue $_ 'State') -eq 'override' }).Count)) {
|        $mapBody = ConvertTo-SIProOwnershipMap -Templates $legacyOwnTpl.ToArray() -Overrides $legacyOwnOvr.ToArray()
|        if ($mapBody) { $items.Add([pscustomobject]@{ Kind = 'cmdbownership'; Key = 'map'; Body = $mapBody; Format = 'json'; Origin = 'own'; SortOrder = [int]::MaxValue; Source = 'carried over from the ownership templates'; Stale = $false }) }
|    }
|    # mandatory controls: the required values ON TOP of every effective JSON body (an override cannot weaken them)
|    if (@($Mandatory).Count) {
|        foreach ($it in $items) {
|            if ($it.Format -ne 'json') { continue }
|            $mv = Set-SIProMandatoryValues -Controls $Mandatory -Kind $it.Kind -Key $it.Key -Body $it.Body
|            if (-not $mv.Changed) { continue }
|            $it.Body = [string]$mv.Body
|            foreach ($a in @($mv.Applied)) { $notes.Add($a) }
|        }
|    }
|    $kindOrder = @{}; $i = 0; foreach ($k in $script:SIProItemKinds.Keys) { $kindOrder[$k] = $i++ }
|    $unsorted = $items.ToArray()
|    $arr = @(foreach ($i in (Get-SIProOrdinalOrder -Keys @($unsorted | ForEach-Object { '{0:D3}|{1:D10}|{2}' -f $kindOrder[$_.Kind], [long]$_.SortOrder, $_.Key }))) { $unsorted[$i] })
|    $families = @{}; foreach ($t in $tpl.Values) { $families[$t.Kind] = $true }
|    # A family whose files are generated whole (catalog, index, ownership map, model, tagging rules) is served from SQL
|    # only once its templates are published -- until then the customer's items for it cannot be applied. Say so.
|    foreach ($k in 'rareport', 'riskindex', 'assettagging', 'servicemodel') {
|        if ($families[$k]) { continue }
|        $n = @($arr | Where-Object { $_.Kind -eq $k -and -not ($k -eq 'assettagging' -and $_.Key -eq 'config') }).Count
|        if ($n) { $notes.Add(("{0} {1} item(s) are NOT applied: no {1} templates are published yet, so this family is still read from the installation -- run setup\Publish-SITemplates.ps1 -Apply" -f $n, $k)) }
|    }
|    $vlist = [string[]]@($versions.Keys); [Array]::Sort($vlist, [System.StringComparer]::Ordinal)
|    $dl = $disabled.ToArray(); [Array]::Sort($dl, [System.StringComparer]::Ordinal)
|    [pscustomobject]@{ Items = $arr; Disabled = $dl; Refused = $refused.ToArray(); Notes = $notes.ToArray()
|        TemplateVersion = ($vlist -join ', '); Families = $families }
|}
|
|# =====================================================================================================================
|#  EXEMPTIONS ("exempt this finding")
|# =====================================================================================================================
|function ConvertTo-SIProUtc {
|    <# PURE. A SQL datetime2 (stored as UTC, read back with Kind Unspecified), a DateTime or an ISO text -> UTC; $null stays $null. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or ($Value -is [string] -and [string]::IsNullOrWhiteSpace($Value)) -or $Value -is [System.DBNull]) { return $null }
|    if ($Value -is [datetime]) {
|        if ($Value.Kind -eq [DateTimeKind]::Local) { return $Value.ToUniversalTime() }
|        return [datetime]::SpecifyKind($Value, [DateTimeKind]::Utc)
|    }
|    [datetime]::Parse([string]$Value, [System.Globalization.CultureInfo]::InvariantCulture, [System.Globalization.DateTimeStyles]'AdjustToUniversal, AssumeUniversal')
|}
|
|function ConvertFrom-SIProExemptionRows {
|    <#
|        PURE. cfg.Exemption rows -> Active (applied), Inactive (expired or revoked -- with why), Refused (malformed; the
|        run stops). -Now is a seam (UTC).
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [Parameter(Mandatory)]$Context, [datetime]$Now = ([datetime]::UtcNow))
|    $active = New-Object System.Collections.Generic.List[object]; $inactive = New-Object System.Collections.Generic.List[object]; $refused = New-Object System.Collections.Generic.List[object]
|    foreach ($r in @($Rows | Where-Object { $_ })) {
|        $id = [string](Get-SIProRowValue $r 'ExemptionId'); $name = 'exemption/' + $id
|        $scope = [string](Get-SIProRowValue $r 'Scope'); $rep = [string](Get-SIProRowValue $r 'ReportName')
|        $cve = [string](Get-SIProRowValue $r 'Cve'); $cfg = [string](Get-SIProRowValue $r 'ConfigurationId'); $asset = [string](Get-SIProRowValue $r 'AssetKey')
|        $why = New-Object System.Collections.Generic.List[string]
|        # The scopes are the management GUI's: finding = one issue on one asset; issue = one issue on every asset;
|        # asset = every issue of one asset. ReportName narrows any of them to one report (empty = every report).
|        if ($scope -notin 'finding', 'issue', 'asset') { $why.Add("Scope must be 'finding', 'issue' or 'asset'") }
|        if ($rep -and @($Context.Reports) -notcontains $rep) { $why.Add(("'{0}' is not a Risk Analysis report" -f $rep)) }
|        if ($scope -eq 'finding' -and (-not $asset -or (-not $cve -and -not $cfg))) { $why.Add('a finding exemption names an asset AND a CVE or configuration id') }
|        if ($scope -eq 'issue' -and ($asset -or (-not $cve -and -not $cfg))) { $why.Add('an issue exemption names a CVE or configuration id and no asset') }
|        if ($scope -eq 'asset' -and (-not $asset -or $cve -or $cfg)) { $why.Add('an asset exemption names an asset and no CVE or configuration id') }
|        if ($cve -and $cve -notmatch '^CVE-\d{4}-\d{4,7}$') { $why.Add(("'{0}' is not a valid CVE id" -f $cve)) }
|        if ($cfg -and $cfg -notmatch '^[A-Za-z0-9._:\-]{1,128}$') { $why.Add(("'{0}' is not a valid configuration id" -f $cfg)) }
|        if ($asset -and $asset -notmatch '^[^"\\\r\n]{1,256}$') { $why.Add('the asset key may not hold quotes, backslashes or line breaks') }
|        if ([string]::IsNullOrWhiteSpace([string](Get-SIProRowValue $r 'Reason'))) { $why.Add('an exemption needs a reason') }
|        if ($why.Count) { $refused.Add([pscustomobject]@{ Name = $name; Scope = 'exemption'; Reason = ($why -join '; ') }); continue }
|        $rev = Get-SIProRowValue $r 'RevokedAt'; $exp = ConvertTo-SIProUtc (Get-SIProRowValue $r 'ExpiresAt')
|        $e = [pscustomobject]@{ Id = $id; Scope = $scope; ReportName = $(if ($rep) { $rep } else { $null }); Cve = $(if ($cve) { $cve.ToUpperInvariant() } else { $null })
|            ConfigurationId = $(if ($cfg) { $cfg } else { $null }); AssetKey = $(if ($asset) { $asset } else { $null }); Reason = [string](Get-SIProRowValue $r 'Reason')
|            ExpiresAt = $(if ($exp) { $exp.ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture) } else { $null })
|            RequestId = $(if ([string](Get-SIProRowValue $r 'RequestId')) { [string](Get-SIProRowValue $r 'RequestId') } else { $null }) }
|        if ($null -ne $rev -and [string]$rev -ne '') { $inactive.Add([pscustomobject]@{ Exemption = $e; Why = 'revoked' }); continue }
|        if ($exp -and $exp -le $Now) { $inactive.Add([pscustomobject]@{ Exemption = $e; Why = 'expired' }); continue }
|        $active.Add($e)
|    }
|    $u = $active.ToArray()
|    $a = @(foreach ($i in (Get-SIProOrdinalOrder -Keys @($u | ForEach-Object { '{0:D20}' -f [long]$_.Id }))) { $u[$i] })
|    [pscustomobject]@{ Active = $a; Inactive = $inactive.ToArray(); Refused = $refused.ToArray() }
|}
|
|function Get-SIProExemptionPlan {
|    <#
|        PURE. How active exemptions reach Risk Analysis without changing its queries (#264): EVERY active exemption --
|        finding, issue or asset scope -- goes to RiskAnalysisExemptions.json, and Risk Analysis MARKS the rows it covers
|        (RA-Exemptions.ps1). Nothing becomes a KQL exclusion any more: an exclusion removes the finding from the raw data,
|        and an exempted finding must stay in it (marked) so the views decide what to show and count.
|        (Before #264 an exemption without an asset was merged into the report's exclusion file. The #211 exclusion lists
|        themselves are unchanged: they are the customer's own "never report this" rules, not exemptions.)
|        -QueryOf is accepted for compatibility and no longer used.
|        Returns @{ Exclusions = (always empty); Marked = [...]; AssetScoped = the same list (the earlier name) }.
|    #>
|    param([AllowEmptyCollection()][object[]]$Active = @(), [hashtable]$QueryOf = @{})
|    $marked = @($Active | Where-Object { $null -ne $_ })
|    [pscustomobject]@{ Exclusions = [ordered]@{}; Marked = $marked; AssetScoped = $marked }
|}
|# =====================================================================================================================
|#  MATERIALISE -- the effective configuration into the run-local folder, in the files the engines already read.
|# =====================================================================================================================
|function Join-SIProPath {
|    <# [IO.Path]::Combine over segments that may carry either separator -- the same code runs on Windows and in the Linux container. #>
|    param([Parameter(Mandatory)][string]$Base, [Parameter(ValueFromRemainingArguments)][string[]]$Parts)
|    $p = $Base
|    foreach ($x in $Parts) { foreach ($seg in ($x -split '[\\/]')) { if ($seg) { $p = [System.IO.Path]::Combine($p, $seg) } } }
|    $p
|}
|
|function Write-SIProFile {
|    param([Parameter(Mandatory)][string]$Path, [AllowEmptyString()][string]$Text)
|    $d = [System.IO.Path]::GetDirectoryName($Path)
|    if (-not (Test-Path -LiteralPath $d)) { New-Item -ItemType Directory -Path $d -Force | Out-Null }
|    # WITH a BOM: PowerShell 5.1's Get-Content (the rule loader, the report catalog loader) reads a BOM-less file as ANSI,
|    # and the shipped catalog and rules carry non-ASCII text. Every reader here strips the BOM.
|    [System.IO.File]::WriteAllText($Path, $Text, (New-Object System.Text.UTF8Encoding($true)))
|}
|
|function ConvertTo-SIProCsvField {
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    '"' + ([string]$Value).Replace('"', '""') + '"'
|}
|
|function Get-SIProTemplateIncluded {
|    <# PURE. The report names a report template includes (ReportsIncluded: names, or objects with Name / ReportName). #>
|    param($Template)
|    $inc = $null
|    if ($Template -is [System.Collections.IDictionary]) { if ($Template.Contains('ReportsIncluded')) { $inc = $Template['ReportsIncluded'] } }
|    elseif ($Template.PSObject.Properties['ReportsIncluded']) { $inc = $Template.ReportsIncluded }
|    @(foreach ($i in @($inc | Where-Object { $null -ne $_ })) {
|        if ($i -is [string]) { $i }
|        elseif ($i -is [System.Collections.IDictionary]) { if ($i.Contains('Name')) { [string]$i['Name'] } else { [string]$i['ReportName'] } }
|        elseif ($i.PSObject.Properties['Name']) { [string]$i.Name } else { [string]$i.ReportName }
|    })
|}
|
|function Get-SIProTemplateMembership {
|    <#
|        Report template name -> the report names it includes, for THIS run: -FromItems = the rareport items of the run (the
|        catalog is served from SQL); otherwise the installation's catalog (risk-analysis-detection\RiskAnalysis_Queries_
|        Locked.yaml, then RiskAnalysis_Queries_Custom.yaml -- a custom template of the same name replaces the locked one).
|    #>
|    param([AllowEmptyCollection()][object[]]$Items = @(), [bool]$FromItems, [string]$SIRoot)
|    $map = [ordered]@{}
|    if ($FromItems) {
|        foreach ($it in @($Items | Where-Object { $_.Key -like 'template/*' })) { $map[$it.Key.Substring(9)] = @(Get-SIProTemplateIncluded (ConvertFrom-SIProJson $it.Body)) }
|        return $map
|    }
|    foreach ($f in 'RiskAnalysis_Queries_Locked.yaml', 'RiskAnalysis_Queries_Custom.yaml') {
|        $p = Join-SIProPath $SIRoot 'risk-analysis-detection' $f
|        if (-not (Test-Path -LiteralPath $p)) { continue }
|        $y = ConvertFrom-SIYaml -Path $p -Ordered
|        foreach ($t in @($y['ReportTemplates'] | Where-Object { $null -ne $_ })) { $map[[string]$t['ReportName']] = @(Get-SIProTemplateIncluded $t) }
|    }
|    $map
|}
|
|function Export-SIProConfig {
|    <#
|        Materialise everything a run needs into -RunFolder (never the installation -- a folder inside it is refused):
|          rules\                      the rules overlay (set as SI_EnrichmentDataRoot): the run's existing overlay copied
|                                      first; when rule TEMPLATES exist every effective template rule at its shipped place as
|                                      <id>.locked.yaml, an override beside it as <id>.custom.yaml (it outranks the locked
|                                      one in Get-SIRuleSet), and RulesFromSql = the tree is not read; cfg.Document rules as
|                                      Pro-1b; decision files at the overlay ROOT (where their loaders look).
|          risk-analysis\              (SI_ProRaSettingsPath) exclusion documents merged with exemption-derived lists,
|                                      the weights document (+ the model sections), per-report weights, the report catalog
|                                      (RiskAnalysis_Queries_Locked.yaml -- JSON, which is YAML), the risk index CSV,
|                                      RiskAnalysisExemptions.json.
|          config\                     (SI_ProConfigRoot) cmdb-source-ownership.locked.json, service-model.locked.json,
|                                      asset-tagging.config.json, asset-profiling-schema\<engine>.schema.custom.json,
|                                      server-applications.json (the catalog override, #275 R6);
|                                      output-scope.json (#274: the output scope per destination, templates resolved);
|                                      config\asset-tagging\ (SI_ProAssetTaggingPath) AssetTagging.locked.yaml.
|          data-model\                 (SI_DataModelRoot, #456) every data-model template, put back together from its items
|                                      (templates + overrides + own items), validated -- a file with no rows is copied
|                                      from the installation.
|        Returns what was written and the folders to point the engines at.
|    #>
|    param([AllowEmptyCollection()][object[]]$Items = @(), [AllowEmptyCollection()][object[]]$Documents = @(),
|          [AllowEmptyCollection()][object[]]$Exemptions = @(), [hashtable]$Families = @{},
|          [Parameter(Mandatory)][string]$RunFolder, [Parameter(Mandatory)]$Context, [string]$ExistingOverlay)
|    $sep = [System.IO.Path]::DirectorySeparatorChar
|    $siFull = [System.IO.Path]::GetFullPath([string]$Context.SIRoot).TrimEnd('\', '/') + $sep
|    $runFull = [System.IO.Path]::GetFullPath($RunFolder).TrimEnd('\', '/') + $sep
|    if ($runFull.StartsWith($siFull, [StringComparison]::OrdinalIgnoreCase)) { throw ('the run-local folder {0} is inside the SecurityInsight folder -- documents are never written into the installation' -f $RunFolder) }
|    $out = [ordered]@{ RulesRoot = $null; RaSettingsPath = $null; ConfigRoot = $null; AssetTaggingPath = $null; RulesFromSql = $false
|        Rules = 0; Exclusions = 0; Weights = 0; Reports = 0; RiskIndexRows = 0; Exemptions = 0; ConfigFiles = 0; Decisions = 0; RuleTiers = 0; Naming = @{}
|        DataModelRoot = $null; DataModelItems = 0
|        Notes = (New-Object System.Collections.Generic.List[string]) }
|    $byKind = @{}; foreach ($it in @($Items)) { if (-not $byKind.ContainsKey($it.Kind)) { $byKind[$it.Kind] = New-Object System.Collections.Generic.List[object] }; $byKind[$it.Kind].Add($it) }
|    $kindItems = { param($k) if ($byKind.ContainsKey($k)) { $byKind[$k].ToArray() } else { @() } }
|
|    # ---- rules overlay ------------------------------------------------------------------------------------------------
|    $ruleDocs = @($Documents | Where-Object { $_.Kind -eq 'rule' })
|    $ruleItems = @(& $kindItems 'rule')
|    $decisions = @(& $kindItems 'decision')
|    $tiers = @(& $kindItems 'ruletier')
|    if ($ruleDocs.Count -or $ruleItems.Count -or $decisions.Count -or $tiers.Count -or $Families['rule']) {
|        $ov = Join-SIProPath $RunFolder 'rules'
|        New-Item -ItemType Directory -Path $ov -Force | Out-Null
|        if (-not [string]::IsNullOrWhiteSpace($ExistingOverlay) -and (Test-Path -LiteralPath $ExistingOverlay)) {
|            $src = [System.IO.Path]::GetFullPath($ExistingOverlay).TrimEnd('\', '/')
|            foreach ($f in @(Get-ChildItem -LiteralPath $src -Recurse -File -ErrorAction Stop)) {
|                $to = Join-SIProPath $ov $f.FullName.Substring($src.Length)
|                $d = [System.IO.Path]::GetDirectoryName($to)
|                if (-not (Test-Path -LiteralPath $d)) { New-Item -ItemType Directory -Path $d -Force | Out-Null }
|                [System.IO.File]::Copy($f.FullName, $to, $true)
|            }
|        }
|        # the folder a template rule ships in (relative to its engine folder), so a method filter still finds it
|        $relDirOf = @{}
|        foreach ($it in $ruleItems) {
|            $rel = ''
|            if ($it.Source) {
|                $parts = @($it.Source -split '[\\/]' | Where-Object { $_ })
|                $ei = [Array]::IndexOf([string[]]@($parts | ForEach-Object { $_.ToLowerInvariant() }), $it.Key.Split('/')[0])
|                if ($ei -ge 0 -and $parts.Count - $ei -gt 2) { $rel = ($parts[($ei + 1)..($parts.Count - 2)] -join '/') }
|            }
|            $relDirOf[$it.Key] = $rel
|        }
|        $removeCopied = {
|            param([string]$engineDir, [string]$id)
|            foreach ($f in @(Get-ChildItem -LiteralPath $engineDir -Recurse -File -Filter '*.custom.yaml' -ErrorAction SilentlyContinue)) {
|                $h = Get-SIRuleHeader -Text ([System.IO.File]::ReadAllText($f.FullName))
|                $fid = if ($h.Id) { $h.Id } else { $f.Name -replace '\.custom\.yaml$', '' }
|                if ($fid -eq $id) { Remove-Item -LiteralPath $f.FullName -Force }   # the run's own copy -- the database wins
|            }
|        }
|        foreach ($it in $ruleItems) {
|            $engine, $id = $it.Key -split '/', 2
|            $edir = Join-SIProPath $ov $engine
|            $name = if ($it.Origin -eq 'template') { '{0}.locked.yaml' -f $id } else { '{0}.custom.yaml' -f $id }
|            if ($it.Origin -ne 'template') { & $removeCopied $edir $id }
|            Write-SIProFile -Path (Join-SIProPath $edir $relDirOf[$it.Key] $name) -Text $it.Body.TrimStart([char]0xFEFF)
|            $out.Rules++
|        }
|        foreach ($doc in $ruleDocs) {
|            $engine, $id = $doc.Key -split '/', 2
|            $edir = Join-SIProPath $ov $engine
|            & $removeCopied $edir $id
|            $rel = if ($relDirOf.ContainsKey($doc.Key)) { $relDirOf[$doc.Key] } else { '' }
|            Write-SIProFile -Path (Join-SIProPath $edir $rel ('{0}.custom.yaml' -f $id)) -Text $doc.Body
|            $out.Rules++
|        }
|        # The tier board's whole-rule moves: the rule IN FORCE (a document, else an override / template, else the shipped
|        # file) with every Tier it sets changed, written as the rule's custom copy so it outranks every other source.
|        foreach ($it in $tiers) {
|            $tier = [int](ConvertFrom-SIProJson $it.Body).tier
|            $engine, $id = $it.Key -split '/', 2
|            $src = $null
|            $doc = @($ruleDocs | Where-Object { $_.Key -eq $it.Key }) | Select-Object -First 1
|            if ($doc) { $src = $doc.Body }
|            if (-not $src) { $ri = @($ruleItems | Where-Object { $_.Key -eq $it.Key }) | Select-Object -First 1; if ($ri) { $src = $ri.Body } }
|            if (-not $src -and -not $Families['rule']) {
|                $tree = Join-SIProPath ([string]$Context.SIRoot) 'asset-profiling-enrichment' $engine
|                $hit = @(Get-ChildItem -LiteralPath $tree -Recurse -File -Filter ('{0}.locked.yaml' -f $id) -ErrorAction SilentlyContinue) | Select-Object -First 1
|                if ($hit) {
|                    $src = [System.IO.File]::ReadAllText($hit.FullName)
|                    if (-not $relDirOf.ContainsKey($it.Key)) { $relDirOf[$it.Key] = ($hit.DirectoryName.Substring($tree.Length).TrimStart('\', '/') -replace '\\', '/') }
|                }
|            }
|            if (-not $src) { $out.Notes.Add(("ruletier/{0}: the rule is not in force (removed, or turned off) -- the tier decision is not applied" -f $it.Key)); continue }
|            if ($src -match '(?m)^mode\s*:\s*disable\b') { $out.Notes.Add(("ruletier/{0}: the rule is turned off -- the tier decision is not applied" -f $it.Key)); continue }
|            $rx = '(?m)^(\s+Tier\s*:\s*)[''"]?\d+[''"]?'
|            if (-not [regex]::IsMatch($src, $rx)) { throw ("ruletier/{0}: the rule sets no Tier, so it cannot be moved to tier {1}" -f $it.Key, $tier) }
|            $text = [regex]::Replace($src.TrimStart([char]0xFEFF), $rx, ('${1}' + $tier))
|            $why = @(Test-SIRuleText -Text $text -Id $id -Kinds @($Context.Kinds))
|            if ($why.Count) { throw ("ruletier/{0}: the moved rule does not validate: {1}" -f $it.Key, ($why -join '; ')) }
|            $edir = Join-SIProPath $ov $engine
|            & $removeCopied $edir $id
|            $rel = if ($relDirOf.ContainsKey($it.Key)) { $relDirOf[$it.Key] } else { '' }
|            Write-SIProFile -Path (Join-SIProPath $edir $rel ('{0}.custom.yaml' -f $id)) -Text $text
|            $out.RuleTiers++
|        }        foreach ($it in $decisions) {
|            $file = if ($it.Key -eq 'asset') { 'asset-decisions.custom.yaml' } else { 'correlation-decisions.custom.yaml' }
|            Write-SIProFile -Path (Join-SIProPath $ov $file) -Text $it.Body.TrimStart([char]0xFEFF)
|            $out.Decisions++
|        }
|        $out.RulesRoot = $ov
|        $out.RulesFromSql = [bool]$Families['rule']
|    }
|
|    # ---- Risk Analysis ------------------------------------------------------------------------------------------------
|    $rp = Join-SIProPath $RunFolder 'risk-analysis'
|    $raWritten = $false
|    $ensureRa = { if (-not (Test-Path -LiteralPath $rp)) { New-Item -ItemType Directory -Path $rp -Force | Out-Null } }
|    # the report catalog (only when the family is served from SQL)
|    $rareports = @(& $kindItems 'rareport')
|    $queryOf = @{}
|    if ($Families['rareport'] -or $rareports.Count) {
|        $reports = New-Object System.Collections.Generic.List[string]; $templates = New-Object System.Collections.Generic.List[object]
|        $present = @{}
|        foreach ($it in $rareports) {
|            if ($it.Key -like 'report/*') {
|                $reports.Add($it.Body.Trim()); $present[$it.Key.Substring(7)] = $true
|                try { $queryOf[$it.Key.Substring(7)] = (@((ConvertFrom-SIProJson $it.Body).ReportQuery) -join "`n") } catch { }
|            } else { $templates.Add($it) }
|        }
|        if ($Families['rareport']) {
|            $tplTexts = foreach ($t in $templates) {
|                # a report that is disabled (or retired) leaves every template that includes it
|                $o = ConvertFrom-SIProJson $t.Body
|                $inc = @($o.ReportsIncluded | Where-Object { $null -ne $_ } | Where-Object {
|                    $n = if ($_ -is [string]) { $_ } elseif ($_.PSObject.Properties['Name']) { [string]$_.Name } else { [string]$_.ReportName }
|                    $present.ContainsKey($n) })
|                $o.ReportsIncluded = $inc
|                ConvertTo-SIProJson -Value $o -Level 2
|            }
|            & $ensureRa
|            $catalogText = "{`n  `"Reports`": [`n" + (($reports | ForEach-Object { $_ }) -join ",`n") + "`n  ],`n  `"ReportTemplates`": [`n" + (@($tplTexts) -join ",`n") + "`n  ]`n}`n"
|            $fileName = if ($global:ReportSettingsFileLocked) { [string]$global:ReportSettingsFileLocked } else { $script:SIProRaCatalogFile }
|            Write-SIProFile -Path (Join-SIProPath $rp $fileName) -Text $catalogText
|            $out.Reports = $reports.Count; $raWritten = $true
|        }
|    }
|    if (-not $queryOf.Count) {
|        # the shipped catalog tells which reports carry which exclusion block (global exemptions fan out by it)
|        $lp = Join-SIProPath ([string]$Context.SIRoot) 'risk-analysis-detection' $script:SIProRaCatalogFile
|        if (Test-Path -LiteralPath $lp) {
|            $txt = [System.IO.File]::ReadAllText($lp)
|            foreach ($m in [regex]::Matches($txt, '(?ms)^\s*-\s*ReportName:\s*([A-Za-z0-9_]+)\s*$(.*?)(?=^\s*-\s*ReportName:|\z)')) { $queryOf[$m.Groups[1].Value] = $m.Groups[2].Value }
|        }
|    }
|    # the risk index
|    if ($Families['riskindex']) {
|        $rows = @(& $kindItems 'riskindex')
|        # #559: the run file is keyed by the SI generic fields. A row stored with the 2.2 columns is translated
|        # (riskscore.index.translation.locked.json, RA-RiskIndexSi.ps1) -- its base values unchanged.
|        $raw = @(foreach ($it in $rows) { ConvertFrom-SIProJson $it.Body })
|        $positioned = @($raw | Where-Object { $_ -and $_.PSObject.Properties['Precedence'] -and -not [string]::IsNullOrWhiteSpace([string]$_.Precedence) }).Count
|        $allV22 = ($raw.Count -gt 0) -and (@($raw | Where-Object { -not (Test-SIRiskIndexV22Form @($_)) }).Count -eq 0)
|        $text = $null
|        if ($positioned -eq 0 -and $allV22) {
|            # an index from before the order (v2.2 rows): the v2.2 ladder puts it in first-match order with the same scores
|            # (RA-RiskIndexOrder.ps1), then every row is translated
|            # (a stored item carries a blank Precedence: drop it, or the ladder is skipped and the rows are only sorted)
|            $noPos = @(foreach ($o in $raw) { $c = [ordered]@{}; foreach ($pp in $o.PSObject.Properties) { if ($pp.Name -ne 'Precedence') { $c[$pp.Name] = $pp.Value } }; [pscustomobject]$c })
|            $text = ConvertTo-SIRiskIndexSiCsvText -OrderedRows @(ConvertTo-SIRiskIndexSiRows -Rows $noPos)
|        } else {
|            # First match wins: the rows in Precedence order, renumbered 1..n. A row with no place (an item made before the
|            # index had an order) is checked after every placed row -- said, so it is reviewed in the Risk index editor.
|            if ($positioned -lt $raw.Count) { $out.Notes.Add(("riskindex: {0} row(s) have no place in the order (made before the risk index had one) -- they are checked after the other rows; give them a place on the Risk index page" -f ($raw.Count - $positioned))) }
|            $bodies = @(foreach ($o in $raw) { [pscustomobject](ConvertTo-SIRiskIndexSiRow -Row $o) })
|            $text = ConvertTo-SIRiskIndexSiCsvText -OrderedRows @(ConvertTo-SIRiskIndexSiRows -Rows $bodies)
|        }
|        & $ensureRa
|        Write-SIProFile -Path (Join-SIProPath $rp $script:SIProRiskIndexFile) -Text $text
|        $out.RiskIndexRows = $rows.Count; $raWritten = $true
|    }
|    # exclusions: the documents, merged with what exemptions add
|    $plan = Get-SIProExemptionPlan -Active @($Exemptions) -QueryOf $queryOf
|    # A document no exemption touches is written byte for byte (Pro-1b); one an exemption adds to is re-serialised.
|    $exclDocs = [ordered]@{}
|    foreach ($doc in @($Documents | Where-Object { $_.Kind -eq 'exclusions' })) { $exclDocs[$doc.Key] = $doc.Body }
|    foreach ($rep in @($plan.Exclusions.Keys)) {
|        $o = if ($exclDocs.Contains($rep)) { ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $exclDocs[$rep]) } else { [ordered]@{ '_source' = 'cfg.Exemption (SecurityInsight Pro)' } }
|        foreach ($prop in 'ExcludedCves', 'ExcludedConfigurationIds') {
|            $add = @($plan.Exclusions[$rep][$prop])
|            if (-not $add.Count) { continue }
|            $have = @(); if ($o.Contains($prop)) { $have = @($o[$prop] | Where-Object { $null -ne $_ } | ForEach-Object { [string]$_ }) }
|            $o[$prop] = @($have + @($add | Where-Object { $have -notcontains $_ }))
|        }
|        $exclDocs[$rep] = ConvertTo-SIProJson -Value $o
|        $out.Exemptions += @($plan.Exclusions[$rep]['ExcludedCves']).Count + @($plan.Exclusions[$rep]['ExcludedConfigurationIds']).Count
|    }
|    foreach ($key in @($exclDocs.Keys)) {
|        $pageKey = if ($key -eq 'global') { 'exclusions:global' } else { 'exclusions:' + $key }
|        $target = Resolve-SIJsonTarget -SIRoot ([string]$Context.SIRoot) -Key $pageKey -Reports @($Context.Reports)
|        if (-not $target) { throw ("no settings file for the exclusions of {0}" -f $key) }
|        & $ensureRa
|        Write-SIProFile -Path (Join-SIProPath $rp ([System.IO.Path]::GetFileName($target))) -Text $exclDocs[$key]
|        $out.Exclusions++; $raWritten = $true
|    }
|    if ($plan.Marked.Count) {
|        $file = [ordered]@{
|            '_purpose' = 'SecurityInsight Pro: the approved exemptions (cfg.Exemption). Written by the settings layer for this run; engine\risk-analysis\_shared\RA-Exemptions.ps1 MARKS the rows each one covers (never drops them).'
|            matchAssetColumns   = @('SI_AssetId', 'SI_CorrelationId', 'AssetId', 'AssetName', 'DeviceName', 'DeviceId')
|            matchFindingColumns = @('CveId', 'Cve', 'CVE', 'ConfigurationId')
|            exemptions = @($plan.Marked | ForEach-Object { [ordered]@{ id = $_.Id; scope = $_.Scope; report = $_.ReportName; assetKey = $_.AssetKey; cve = $_.Cve; configurationId = $_.ConfigurationId; expiresAt = $_.ExpiresAt; requestId = $(if ($_.PSObject.Properties['RequestId']) { $_.RequestId } else { $null }); reason = $_.Reason } })
|        }
|        & $ensureRa
|        Write-SIProFile -Path (Join-SIProPath $rp $script:SIProExemptionsFile) -Text (ConvertTo-SIProJson -Value $file)
|        $out.Exemptions += $plan.Marked.Count; $raWritten = $true
|    }
|    # weights: the document (+ the model sections beside it), and per-report files
|    $wdoc = @($Documents | Where-Object { $_.Kind -eq 'weights' }) | Select-Object -First 1
|    $model = @(& $kindItems 'weights' | Where-Object { $_.Key -eq 'model' }) | Select-Object -First 1
|    if ($wdoc -or $model) {
|        $text = $null
|        if ($wdoc -and -not $model) { $text = $wdoc.Body }   # Pro-1b: byte for byte
|        else {
|            $w = [ordered]@{}
|            if ($model) { $m = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $model.Body); foreach ($k in @($m.Keys)) { $w[$k] = $m[$k] } }
|            if ($wdoc) { $d = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $wdoc.Body); foreach ($k in @($d.Keys)) { $w[$k] = $d[$k] } }
|            $text = ConvertTo-SIProJson -Value $w
|        }
|        & $ensureRa
|        Write-SIProFile -Path (Join-SIProPath $rp 'riskscore_weighted.schema.custom.json') -Text $text
|        $out.Weights++; $raWritten = $true
|    }
|    foreach ($it in @(& $kindItems 'weights' | Where-Object { $_.Key -like 'report/*' })) {
|        & $ensureRa
|        Write-SIProFile -Path (Join-SIProPath $rp ('{0}.weighted.custom.json' -f $it.Key.Substring(7))) -Text $it.Body
|        $out.Weights++; $raWritten = $true
|    }
|    if ($raWritten) { $out.RaSettingsPath = $rp }
|
|    # ---- config\ -----------------------------------------------------------------------------------------------------
|    $cr = Join-SIProPath $RunFolder 'config'
|    # #251: the CMDB ownership map is the customer's configuration document (cmdbownership/map) -- the whole map, written
|    # where engine\asset-cmdb\_shared\SI-CmdbOwnership.ps1 looks first (SI_ProConfigRoot). No document = the installation's
|    # shipped map, as on a Community install.
|    $ownMap = @(& $kindItems 'cmdbownership' | Where-Object { $_.Key -eq 'map' }) | Select-Object -First 1
|    if ($ownMap) {
|        $root = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $ownMap.Body)
|        Write-SIProFile -Path (Join-SIProPath $cr 'cmdb-source-ownership.locked.json') -Text (ConvertTo-SIProJson -Value ([ordered]@{ '_source' = 'SecurityInsight Pro settings database (the CMDB ownership configuration), materialised for this run'; cmdbSourceOwnership = $root }))
|        $out.ConfigFiles++; $out.ConfigRoot = $cr
|    }
|    if ($Families['servicemodel']) {
|        $sm = @(& $kindItems 'servicemodel' | Where-Object { $_.Key -eq 'model' }) | Select-Object -First 1
|        $body = if ($sm) { ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $sm.Body) } else { [ordered]@{ services = @(); bindings = @() } }
|        Write-SIProFile -Path (Join-SIProPath $cr 'service-model.locked.json') -Text (ConvertTo-SIProJson -Value ([ordered]@{ '_source' = 'SecurityInsight Pro settings database, materialised for this run'; serviceModel = $body }))
|        $out.ConfigFiles++; $out.ConfigRoot = $cr
|    }
|    $tagCfg = @(& $kindItems 'assettagging' | Where-Object { $_.Key -eq 'config' }) | Select-Object -First 1
|    if ($tagCfg) { Write-SIProFile -Path (Join-SIProPath $cr 'asset-tagging.config.json') -Text $tagCfg.Body; $out.ConfigFiles++; $out.ConfigRoot = $cr }
|    if ($Families['assettagging']) {
|        $tags = @(& $kindItems 'assettagging' | Where-Object { $_.Key -like 'tag/*' })
|        $text = ConvertTo-SIProJson -Value ([ordered]@{ AssetTagging = @($tags | ForEach-Object { ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $_.Body) }) })
|        $tp = Join-SIProPath $cr 'asset-tagging'
|        Write-SIProFile -Path (Join-SIProPath $tp 'AssetTagging.locked.yaml') -Text $text
|        $out.ConfigFiles++; $out.ConfigRoot = $cr; $out.AssetTaggingPath = $tp
|    }
|    foreach ($it in @(& $kindItems 'schemaoverlay')) {
|        $base = if ($it.Key -eq 'publicip') { 'public-ip' } else { $it.Key }
|        Write-SIProFile -Path (Join-SIProPath $cr 'asset-profiling-schema' ('{0}.schema.custom.json' -f $base)) -Text $it.Body
|        $out.ConfigFiles++; $out.ConfigRoot = $cr
|    }
|    # #275 R6: the server-application catalog override, where its loader looks first (SI_ProConfigRoot)
|    $apps = @(& $kindItems 'serverapps' | Where-Object { $_.Key -eq 'catalog' }) | Select-Object -First 1
|    if ($apps) { Write-SIProFile -Path (Join-SIProPath $cr 'server-applications.json') -Text $apps.Body; $out.ConfigFiles++; $out.ConfigRoot = $cr }
|    # #274: the output scope per destination -- ONE file, every named report template resolved to its reports here (the
|    # templates of THIS run: the database's when the catalog is served from SQL, else the installation's catalog), so the
|    # engines and connectors never read the catalog themselves. No item = no file = everything passes, as before.
|    $scopes = @(& $kindItems 'outputscope')
|    if ($scopes.Count) {
|        $membership = Get-SIProTemplateMembership -Items @(& $kindItems 'rareport') -FromItems ([bool]($Families['rareport'] -or @(& $kindItems 'rareport').Count)) -SIRoot ([string]$Context.SIRoot)
|        $dests = [ordered]@{}
|        foreach ($it in $scopes) {
|            $o = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $it.Body)
|            $tpl = @(Get-SIOutputScopeList $o 'templates'); $rep = @(Get-SIOutputScopeList $o 'reports')
|            if (($tpl.Count + $rep.Count) -gt 0) {
|                $set = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::Ordinal)
|                foreach ($r in $rep) { [void]$set.Add([string]$r) }
|                foreach ($t in $tpl) {
|                    if (-not $membership.Contains([string]$t)) { $out.Notes.Add(("outputscope/{0}: the report template '{1}' does not exist in this run -- it lets no report through" -f $it.Key, $t)); continue }
|                    foreach ($r in @($membership[[string]$t])) { [void]$set.Add([string]$r) }
|                }
|                $arr = [string[]]@($set); [Array]::Sort($arr, [System.StringComparer]::Ordinal)
|                $o['resolvedReports'] = @($arr)
|            }
|            $dests[$it.Key] = $o
|        }
|        Write-SIProFile -Path (Join-SIProPath $cr 'output-scope.json') -Text (ConvertTo-SIProJson -Value ([ordered]@{ '_source' = 'SecurityInsight Pro settings database (the output scope per destination), materialised for this run'; destinations = $dests }))
|        $out.ConfigFiles++; $out.ConfigRoot = $cr
|    }
|    # ---- #456: the data model -> <run>\data-model (SI_DataModelRoot): served from the database once its templates exist --
|    $dmItems = @(& $kindItems 'datamodel')
|    if ($Families['datamodel'] -or $dmItems.Count) {
|        $dm = Export-SIDataModelProRoot -Items $dmItems -RunFolder $RunFolder -ShippedRoot (Join-SIProPath ([string]$Context.SIRoot) 'data-model') `
|            -FromJson { param($s) ConvertFrom-SIProJson $s } -ToJson { param($v) ConvertTo-SIProJson -Value $v }
|        $out.DataModelRoot = [string]$dm.Root
|        $out.DataModelItems = $dmItems.Count
|        foreach ($n in @($dm.Notes)) { if ($n) { $out.Notes.Add([string]$n) } }
|        if (@($dm.Copied).Count -and $dmItems.Count) { $out.Notes.Add(('data model: {0} template file(s) are not in the settings database yet and come from the installation: {1}' -f @($dm.Copied).Count, (@($dm.Copied) -join ', '))) }
|    }
|    # ---- naming: values, not files (applied by the layer) ------------------------------------------------------------
|    foreach ($it in @(& $kindItems 'naming')) { $out.Naming[$it.Key] = [pscustomobject]@{ Value = [string](ConvertFrom-SIProJson $it.Body); Origin = $it.Origin } }
|    [pscustomobject]$out
|}
|
|# =====================================================================================================================
|#  WRITERS (transactional, each with its cfg.ChangeLog entry) -- the importer, the GUI and tools use these.
|# =====================================================================================================================
|function Set-SIProItem {
|    <#
|        Write one item's customer state: State override (with -Body), disable, or inherit (= go back to the template:
|        the row is removed). Validated BEFORE any SQL by the same rules the run applies. -BaseVersion / -BaseHash: the
|        template the override was made against. ChangeLog: Name = key, Scope = 'item', Kind.
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Kind, [Parameter(Mandatory)][string]$Key,
|          [Parameter(Mandatory)][ValidateSet('override', 'disable', 'inherit')][string]$State, [AllowEmptyString()][string]$Body,
|          [string]$Format, [string]$BaseVersion, [string]$BaseHash, [Parameter(Mandatory)][string]$ChangedBy, [string]$Reason = '', $Context)
|    $spec = $script:SIProItemKinds[$Kind]
|    if (-not $spec) { throw ("'{0}' is not a configuration kind" -f $Kind) }
|    if ($Key -notmatch $spec.Key) { throw ("'{0}' is not a valid {1} key" -f $Key, $Kind) }
|    # #251: a name is a setting now (Set-SIProSetting), and the ownership map is ONE document (cmdbownership/map)
|    if ($Kind -eq 'naming' -and $State -ne 'inherit') { throw ("{0}: the names of tables, DCRs, DCE and workspace are settings -- set it with Set-SIProSetting (the catalog default applies otherwise)" -f $Key) }
|    if ($Kind -eq 'cmdbownership' -and $Key -ne 'map' -and $State -ne 'inherit') { throw ("cmdbownership/{0}: the CMDB ownership map is one configuration document, cmdbownership/map" -f $Key) }
|    if (-not $Format) { $Format = $spec.Format }
|    $text = $null
|    if ($State -eq 'override') {
|        if (-not $Context) { $Context = Get-SIProConfigContext }
|        $text = ([string]$Body).TrimStart([char]0xFEFF)
|    }
|    # mandatory controls FIRST: an override never switches off or weakens what SecurityInsight requires, and that plain
|    # reason is the one given (the item rules may refuse the same change in their own words, e.g. a built-in factor)
|    $mroot = if ($Context -and $Context.PSObject.Properties['SIRoot'] -and $Context.SIRoot) { [string]$Context.SIRoot } else { $script:SIProConfigSIRoot }
|    $mwhy = @(Test-SIProMandatoryOverride -Controls @(Get-SIProMandatoryControls -SIRoot $mroot) -Kind $Kind -Key $Key -State $State -Body $text)
|    if ($mwhy.Count) { throw ("nothing written: {0}" -f ($mwhy -join '; ')) }
|    if ($State -eq 'override') {
|        $why = @(Test-SIProItem -Kind $Kind -Key $Key -Body $text -Format $Format -Context $Context)
|        if ($why.Count) { throw ("{0}/{1} is not valid: {2}" -f $Kind, $Key, ($why -join '; ')) }
|    }
|    $sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @old nvarchar(max) = (SELECT State + COALESCE(':' + BodyJson, '') FROM cfg.ItemOverride WITH (UPDLOCK, HOLDLOCK) WHERE Kind = @Kind AND ItemKey = @Key);
|IF @State = 'inherit'
|    DELETE FROM cfg.ItemOverride WHERE Kind = @Kind AND ItemKey = @Key;
|ELSE IF @old IS NOT NULL
|    UPDATE cfg.ItemOverride SET State = @State, BodyJson = @Body, Format = @Format, BaseVersion = @BaseVersion, BaseHash = @BaseHash, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Kind = @Kind AND ItemKey = @Key;
|ELSE
|    INSERT cfg.ItemOverride (Kind, ItemKey, State, BodyJson, Format, BaseVersion, BaseHash, UpdatedBy) VALUES (@Kind, @Key, @State, @Body, @Format, @BaseVersion, @BaseHash, @By);
|INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|VALUES (@Key, 'item', @Kind, CASE WHEN @State = 'inherit' THEN 'Reset' ELSE 'Set' END, @old, @State + COALESCE(':' + @Body, ''), @By, @Reason);
|COMMIT;
|'@
|    & $Store.Invoke $sql ([ordered]@{ Kind = $Kind; Key = $Key; State = $State; Body = $text; Format = $Format
|        BaseVersion = $(if ($BaseVersion) { $BaseVersion } else { $null }); BaseHash = $(if ($BaseHash) { $BaseHash } else { $null }); By = $ChangedBy; Reason = $Reason }) 'nonquery'
|}
|
|function New-SIProExemption {
|    <# Record one exemption (validated first by the rules the run applies), with its ChangeLog entry, in one transaction. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][ValidateSet('finding', 'issue', 'asset')][string]$Scope, [string]$ReportName,
|          [string]$ConfigurationId, [string]$Cve, [string]$AssetKey, [Parameter(Mandatory)][string]$Reason, [Nullable[datetime]]$ExpiresAt,
|          [Parameter(Mandatory)][string]$CreatedBy, $Context)
|    if (-not $Context) { $Context = Get-SIProConfigContext }
|    $row = @{ ExemptionId = '0'; Scope = $Scope; ReportName = $ReportName; ConfigurationId = $ConfigurationId; Cve = $Cve; AssetKey = $AssetKey; Reason = $Reason; ExpiresAt = $ExpiresAt; RevokedAt = $null }
|    $c = ConvertFrom-SIProExemptionRows -Rows @($row) -Context $Context -Now ([datetime]::MinValue)
|    if (@($c.Refused).Count) { throw ('the exemption is not valid: ' + $c.Refused[0].Reason) }
|    $sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|INSERT cfg.Exemption (Scope, ReportName, ConfigurationId, Cve, AssetKey, Reason, ExpiresAt, CreatedBy) VALUES (@Scope, @Report, @Cfg, @Cve, @Asset, @Reason, @Expires, @By);
|DECLARE @id bigint = SCOPE_IDENTITY();
|INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|VALUES (CONCAT('exemption/', CONVERT(nvarchar(30), @id)), 'exemption', 'exemption', 'Set', NULL, CONCAT(@Scope, '|', @Report, '|', @Cve, '|', @Cfg, '|', @Asset, '|', CONVERT(varchar(30), @Expires, 126)), @By, @Reason);
|COMMIT;
|'@
|    & $Store.Invoke $sql ([ordered]@{ Scope = $Scope; Report = $(if ($ReportName) { $ReportName } else { $null }); Cfg = $(if ($ConfigurationId) { $ConfigurationId } else { $null })
|        Cve = $(if ($Cve) { $Cve.ToUpperInvariant() } else { $null }); Asset = $(if ($AssetKey) { $AssetKey } else { $null }); Reason = $Reason
|        Expires = (ConvertTo-SIProUtc $ExpiresAt); By = $CreatedBy }) 'nonquery'
|}
|
|function Revoke-SIProExemption {
|    <# Revoke one exemption (it stays, with RevokedAt / RevokedBy), with its ChangeLog entry, in one transaction. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][long]$ExemptionId, [Parameter(Mandatory)][string]$RevokedBy, [string]$Reason = '')
|    $sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|UPDATE cfg.Exemption SET RevokedAt = SYSUTCDATETIME(), RevokedBy = @By WHERE ExemptionId = @Id AND RevokedAt IS NULL;
|IF @@ROWCOUNT = 1
|    INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|    VALUES (CONCAT('exemption/', CONVERT(nvarchar(30), @Id)), 'exemption', 'exemption', 'Reset', 'active', 'revoked', @By, @Reason);
|COMMIT;
|'@
|    & $Store.Invoke $sql ([ordered]@{ Id = $ExemptionId; By = $RevokedBy; Reason = $Reason }) 'nonquery'
|}
|
|# =====================================================================================================================
|#  TEMPLATES FROM THE SHIPPED FILES (Publish-SITemplates; the importer diffs against the same rows)
|# =====================================================================================================================
|function Get-SIProShippedVersion {
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $p = Join-SIProPath $SIRoot 'VERSION'
|    if (Test-Path -LiteralPath $p) { return ([System.IO.File]::ReadAllText($p)).Trim() }
|    '0.0.0'
|}
|
|function Get-SITemplateRows {
|    <#
|        The template rows a release ships -- VENDOR-DEVELOPED content only (#251) -- built from its *.locked files:
|          rareport      risk-analysis-detection\RiskAnalysis_Queries_Locked.yaml        report/<name>, template/<name>
|          riskindex     risk-analysis-detection\riskscore.index.locked.csv (shipped)    row/<dimensions>
|          rule          asset-profiling-enrichment\<engine>\**\*.locked.yaml             <engine>/<id> (YAML text)
|          assettagging  asset-profiling-enrichment\endpoint\AssetTagging.locked.yaml     tag/<STEM--SI>
|          servicemodel  config\service-model.locked.json                                 model
|          datamodel     data-model\**\*.locked.json (#456)                                <template>, <template>:<item key>
|        NOT templates: the names of tables / DCRs / DCE / workspace (settings -- the catalog default is the default) and the
|        CMDB ownership map (the customer's configuration, seeded from config\cmdb-source-ownership.locked.json); nor the
|        profile schemas (asset-profiling-schema\*.locked.json) -- they are the engines' data contract (hashes, entity ids),
|        not configuration; a customer's schema OVERLAY is an item (schemaoverlay).
|        -Version (stamped on every row): default the shipped template pack's version (engine\pro-settings\
|        shipped-template-pack.json, 1.0) -- template versions are their own series, not the code version.
|        Every row is validated as the run will validate it; one that does not is returned in Refused, never published.
|        -Families limits what is built (tests).
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [string]$Version, $Context, [string[]]$Families)
|    if (-not $Version) { $Version = (Get-SIProShippedPackInfo -SIRoot $SIRoot).PackVersion }
|    # #416: building the rows takes ~30 s (780 templates, each validated, serialised and hashed) and ONE update ran it three
|    # times (the template gate, the split check, the install) -- the same files give the same rows, so a process keeps the
|    # result for files it has already read (Get-SITemplateRowsCacheKey: every input file's path, size and write time).
|    # Never with a caller's own -Context. Every caller gets its OWN copies of the rows.
|    $cacheKey = $null
|    if (-not $PSBoundParameters.ContainsKey('Context')) {
|        $cacheKey = Get-SITemplateRowsCacheKey -SIRoot $SIRoot -Version $Version -Families $Families
|        $hit = Get-SITemplateRowsCached -Key $cacheKey
|        if ($hit) { return $hit }
|    }
|    if (-not $Context) { $Context = Get-SIProConfigContext -SIRoot $SIRoot }
|    $want = { param($k) (-not $Families) -or ($Families -contains $k) }
|    $rows = New-Object System.Collections.Generic.List[object]; $refused = New-Object System.Collections.Generic.List[object]
|    $add = {
|        param([string]$kind, [string]$key, [string]$body, [string]$fmt, [int]$order, [string]$source)
|        $why = @(Test-SIProItem -Kind $kind -Key $key -Body $body -Format $fmt -Context $Context)
|        if ($why.Count) { $refused.Add([pscustomobject]@{ Name = ('{0}/{1}' -f $kind, $key); Scope = 'template'; Reason = ('{0}: {1}' -f $source, ($why -join '; ')) }); return }
|        $rows.Add([pscustomobject]@{ Kind = $kind; ItemKey = $key; TemplateVersion = $Version; BodyJson = $body; Format = $fmt; SortOrder = $order; BodyHash = (Get-SIProTextHash $body)
|            ContentHash = (Get-SIProContentHash -Body $body -Format $fmt); Source = $source })
|    }
|    if (& $want 'rareport') {
|        $p = Join-SIProPath $SIRoot 'risk-analysis-detection' 'RiskAnalysis_Queries_Locked.yaml'
|        if (Test-Path -LiteralPath $p) {
|            $y = ConvertFrom-SIYaml -Path $p -Ordered
|            $i = 0; foreach ($r in @($y['Reports'])) { & $add 'rareport' ('report/' + [string]$r['ReportName']) (ConvertTo-SIProJson -Value $r -Level 2) 'json' ($i++) 'risk-analysis-detection/RiskAnalysis_Queries_Locked.yaml' }
|            $i = 100000; foreach ($r in @($y['ReportTemplates'])) { & $add 'rareport' ('template/' + [string]$r['ReportName']) (ConvertTo-SIProJson -Value $r -Level 2) 'json' ($i++) 'risk-analysis-detection/RiskAnalysis_Queries_Locked.yaml' }
|        }
|    }
|    if (& $want 'riskindex') {
|        $p = Join-SIProPath $SIRoot 'risk-analysis-detection' 'riskscore.index.locked.csv'
|        if (Test-Path -LiteralPath $p) {
|            $seen = @{}; $i = 0
|            foreach ($r in @(Import-Csv -LiteralPath $p)) {
|                $o = [ordered]@{}; foreach ($c in $script:SIRiskIndexColumns) { $o[$c] = $(if ($r.PSObject.Properties[$c]) { [string]$r.$c } else { '' }) }
|                $key = Get-SIRiskIndexKey -Row $o
|                # the engine's index keeps EVERY row (a repeated row adds to its lists), so a repeat is published as
|                # '<dimensions>#<n>' -- the materialised file is then the shipped file, row for row
|                if ($seen.ContainsKey($key)) { $seen[$key]++; $key = '{0}#{1}' -f $key, $seen[$key] } else { $seen[$key] = 1 }
|                & $add 'riskindex' $key (ConvertTo-SIProJson -Value $o) 'json' ($i++) 'risk-analysis-detection/riskscore.index.locked.csv'
|            }
|        }
|    }
|    if (& $want 'rule') {
|        $tree = Join-SIProPath $SIRoot 'asset-profiling-enrichment'
|        $files = @(Get-ChildItem -LiteralPath $tree -Recurse -File -Filter '*.locked.yaml' -ErrorAction SilentlyContinue)
|        $relU = [string[]]@($files | ForEach-Object { $_.FullName.Substring($tree.Length).TrimStart('\', '/').Replace('\', '/') })
|        $order = Get-SIProOrdinalOrder -Keys $relU
|        $rel = [string[]]@(foreach ($i in $order) { $relU[$i] }); $fa = @(foreach ($i in $order) { $files[$i] })
|        $i = 0
|        for ($n = 0; $n -lt $fa.Count; $n++) {
|            $text = ([System.IO.File]::ReadAllText($fa[$n].FullName)).TrimStart([char]0xFEFF)
|            if ($text -match '(?m)^AssetTagging\s*:') { continue }   # the asset-tagging file shares the folder; it is its own kind
|            $engine = $rel[$n].Split('/')[0].ToLowerInvariant()
|            $h = Get-SIRuleHeader -Text $text
|            $id = if ($h.Id) { $h.Id } else { $fa[$n].Name -replace '\.locked\.yaml$', '' }
|            & $add 'rule' ('{0}/{1}' -f $engine, $id) $text 'yaml' ($i++) ('asset-profiling-enrichment/' + $rel[$n])
|        }
|    }
|    if (& $want 'assettagging') {
|        $p = Join-SIProPath $SIRoot 'asset-profiling-enrichment' 'endpoint' 'AssetTagging.locked.yaml'
|        if (Test-Path -LiteralPath $p) {
|            $y = ConvertFrom-SIYaml -Path $p -Ordered
|            $i = 0
|            foreach ($t in @($y['AssetTagging'] | Where-Object { $null -ne $_ })) {
|                $stem = Get-SIProAssetTagStemKey ([string]$t['AssetTagName'])
|                & $add 'assettagging' ('tag/' + $stem) (ConvertTo-SIProJson -Value $t) 'json' ($i++) 'asset-profiling-enrichment/endpoint/AssetTagging.locked.yaml'
|            }
|        }
|    }
|    # #251: no cmdbownership and no naming rows -- the ownership map and the names are configuration (see the kinds above).
|    if (& $want 'servicemodel') {
|        $p = Join-SIProPath $SIRoot 'config' 'service-model.locked.json'
|        if (Test-Path -LiteralPath $p) {
|            $sm = (ConvertTo-SIOrderedJson (ConvertFrom-SIProJson ([System.IO.File]::ReadAllText($p))))['serviceModel']
|            & $add 'servicemodel' 'model' (ConvertTo-SIProJson -Value $sm) 'json' 0 'config/service-model.locked.json'
|        }
|    }
|    # #456: the data model -- one row per field / mapping / factor / output column, plus each template's header
|    if (& $want 'datamodel') {
|        foreach ($r in (Get-SIDataModelTemplateRows -SIRoot $SIRoot -ToJson { param($v) ConvertTo-SIProJson -Value $v })) {
|            & $add 'datamodel' $r.Key $r.Body 'json' ([int]$r.SortOrder) $r.Source
|        }
|    }
|    $result = [pscustomobject]@{ Version = $Version; Rows = $rows.ToArray(); Refused = $refused.ToArray() }
|    if ($cacheKey) { Set-SITemplateRowsCached -Key $cacheKey -Result $result; return (Get-SITemplateRowsCached -Key $cacheKey) }
|    $result
|}
|
|function Get-SITemplateRowsCacheKey {
|    <#
|        #416: what the shipped template rows are built from, as one string: the root, the version, the families and every
|        input file's relative path + size + last write time (the template sources, the shipped config the validation reads,
|        the code that builds and validates them). A changed, added or removed file = another key.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [string]$Version, [string[]]$Families)
|    $root = [IO.Path]::GetFullPath($SIRoot).TrimEnd('\', '/')
|    $sb = New-Object System.Text.StringBuilder
|    [void]$sb.Append($root).Append('|').Append($Version).Append('|').Append((@($Families) -join ',')).Append("`n")
|    foreach ($d in @(@('risk-analysis-detection', $false), @('asset-profiling-enrichment', $true), @('config', $false), @(([IO.Path]::Combine('engine', 'pro-settings')), $false), @('data-model', $true))) {
|        $dir = [IO.Path]::Combine($root, $d[0])
|        if (-not [IO.Directory]::Exists($dir)) { continue }
|        $opt = if ($d[1]) { [IO.SearchOption]::AllDirectories } else { [IO.SearchOption]::TopDirectoryOnly }
|        $fs = [IO.Directory]::GetFiles($dir, '*', $opt); [Array]::Sort($fs, [StringComparer]::Ordinal)
|        foreach ($f in $fs) { $i = New-Object IO.FileInfo($f); [void]$sb.Append($f.Substring($root.Length)).Append('|').Append($i.Length).Append('|').Append($i.LastWriteTimeUtc.Ticks).Append("`n") }
|    }
|    foreach ($f in @([IO.Path]::Combine($root, 'engine', '_shared', 'SI-Yaml.ps1'), [IO.Path]::Combine($root, 'engine', 'asset-profiling', 'shared', 'RuleEval.ps1'))) {
|        if ([IO.File]::Exists($f)) { $i = New-Object IO.FileInfo($f); [void]$sb.Append($f.Substring($root.Length)).Append('|').Append($i.Length).Append('|').Append($i.LastWriteTimeUtc.Ticks).Append("`n") }
|    }
|    $sb.ToString()
|}
|
|function Get-SITemplateRowsCached {
|    <# #416: the cached rows for -Key, as NEW copies (a caller may change its rows), or $null. The cache lives in the process. #>
|    param([Parameter(Mandatory)][string]$Key)
|    $c = [AppDomain]::CurrentDomain.GetData('SecurityInsight.TemplateRows')
|    if ($null -eq $c -or -not $c.ContainsKey($Key)) { return $null }
|    $r = $c[$Key]
|    [pscustomobject]@{ Version = $r.Version; Rows = @(foreach ($x in $r.Rows) { $x.PSObject.Copy() }); Refused = @(foreach ($x in $r.Refused) { $x.PSObject.Copy() }) }
|}
|
|function Set-SITemplateRowsCached {
|    <# #416: keeps the rows for -Key (the newest few keys only). #>
|    param([Parameter(Mandatory)][string]$Key, [Parameter(Mandatory)]$Result)
|    $c = [AppDomain]::CurrentDomain.GetData('SecurityInsight.TemplateRows')
|    if ($null -eq $c) { $c = [hashtable]::Synchronized(@{}); [AppDomain]::CurrentDomain.SetData('SecurityInsight.TemplateRows', $c) }
|    if ($c.Count -ge 8) { $c.Clear() }
|    $c[$Key] = $Result
|}
|
|# =====================================================================================================================
|#  #250 -- THE SHIPPED TEMPLATES ARE TEMPLATE PACK 1.0 ("Default templates 1.0"), like the old .locked files
|# =====================================================================================================================
|function Get-SIProShippedPackInfo {
|    <#
|        The template pack the templates shipped with this code ARE: engine\pro-settings\shipped-template-pack.json
|        (PackVersion, Name). Template pack versions are their own series starting at 1.0 -- never the code version. A
|        missing or unreadable file reads as 1.0.
|    #>
|    param([string]$SIRoot)
|    if (-not $SIRoot) { $SIRoot = $script:SIProConfigSIRoot }
|    $v = '1.0'; $n = ''; $reviewed = $false
|    $p = Join-SIProPath $SIRoot 'engine' 'pro-settings' 'shipped-template-pack.json'
|    if (Test-Path -LiteralPath $p) {
|        try {
|            $o = ConvertFrom-SIProJson ([System.IO.File]::ReadAllText($p).TrimStart([char]0xFEFF))
|            $pv = ([string]$o.PackVersion).Trim()
|            if ($pv -match '^\d{1,6}(\.\d{1,12}){1,5}$' -and $pv.Length -le 32) { $v = $pv }
|            $n = ([string]$o.Name).Trim()
|            # #405: the split install (fix + default with the code, Microsoft content packs automatic) runs only when the
|            # vendor marked the shipped templates' classification as reviewed; absent or anything but true = false
|            if ($o.PSObject.Properties['ClassificationReviewed'] -and $o.ClassificationReviewed -is [bool]) { $reviewed = [bool]$o.ClassificationReviewed }
|        } catch { }
|    }
|    if (-not $n) { $n = 'Default templates {0}' -f $v }
|    [pscustomobject]@{ PackVersion = $v; Name = $n; ClassificationReviewed = $reviewed }
|}
|
|function Get-SIProDefaultTemplateDecision {
|    <#
|        PURE. What a setup / update run does with the templates SHIPPED with its code (pack -ShippedVersion), on an install
|        that recorded -InstalledPack (cfg.InstallState 'TemplatePack', '' = none) and has -LiveCount templated rows whose
|        fingerprint is -InstalledFingerprint; -ShippedFingerprint = the shipped templates'.
|          install          no templates yet                          -> publish the shipped templates, record the pack
|          adopt            templates, no pack recorded, the SAME content as the shipped ones -> record the pack (as released)
|          adopt-customised templates, no pack recorded, OTHER content   -> record "customised, based on <shipped>"; the
|                           shipped pack is offered (staged) but nothing in force changes without an acceptance
|          current          the shipped pack is installed and in force  -> refresh (version stamps / content hashes only)
|          newer-installed  a newer pack (from the update ring) is installed -> nothing: a pack never goes backwards
|          shipped-differs  the shipped pack's version is installed, but this code ships OTHER content under that version --
|                           never applied: a pack version names exactly one content (the vendor ships changes as a new pack)
|          release          an older pack is installed                 -> publish the shipped pack through the gate
|        Returns @{ Action; Publish (run the publish); Record (adoption: write the pack / status); Status; Reason }.
|    #>
|    param([AllowEmptyString()][string]$InstalledPack, [AllowEmptyString()][string]$InstalledStatus, [int]$LiveCount,
|          [AllowEmptyString()][string]$InstalledFingerprint, [Parameter(Mandatory)][string]$ShippedVersion,
|          [AllowEmptyString()][string]$ShippedFingerprint, [string]$ShippedName)
|    if (-not $ShippedName) { $ShippedName = 'Default templates {0}' -f $ShippedVersion }
|    $mk = { param($a, [bool]$pub, [bool]$rec, $st, $why) [pscustomobject]@{ Action = $a; Publish = $pub; Record = $rec; Status = $st; Reason = $why } }
|    $same = ([string]$InstalledFingerprint -ne '') -and ($InstalledFingerprint -eq $ShippedFingerprint)
|    # A pack recorded BEFORE template packs had their own version series (1.0, 1.1, ...) carries the CODE version
|    # (e.g. '3.0.0') and no pack status -- the new code always records one. It is not a pack: decide by content, like an
|    # install with no pack recorded (live 2026-10-04: '3.0.0' read as newer than 1.0 and blocked the adoption).
|    if ($InstalledPack -and -not $InstalledStatus) {
|        $major = 0
|        if ([int]::TryParse((([string]$InstalledPack).Trim().Split('.')[0]), [ref]$major) -and $major -ge 2) { $InstalledPack = '' }
|    }
|    if (-not $InstalledPack) {
|        if ($LiveCount -le 0) { return (& $mk 'install' $true $false 'as-released' ('no templates yet -- installing {0}' -f $ShippedName)) }
|        if ($same) { return (& $mk 'adopt' $true $true 'as-released' ('the templates in force are {0} -- recorded as installed' -f $ShippedName)) }
|        return (& $mk 'adopt-customised' $false $true 'customised' ('the templates in force differ from {0} -- recorded as customised, based on {1}; your templates are kept, and {0} is offered on the Template releases page' -f $ShippedName, $ShippedVersion))
|    }
|    $cmp = Compare-SIProVersionParts $InstalledPack $ShippedVersion
|    if ($cmp -gt 0) { return (& $mk 'newer-installed' $false $false $InstalledStatus ('template pack {0} is installed, newer than {1} -- nothing to do' -f $InstalledPack, $ShippedName)) }
|    if ($cmp -eq 0) {
|        if ($same -or $LiveCount -le 0) { return (& $mk 'current' $true $false $InstalledStatus ('{0} is installed' -f $ShippedName)) }
|        if ($InstalledStatus -eq 'customised') { return (& $mk 'current' $false $false 'customised' ('{0} is installed, customised -- your templates are kept' -f $ShippedName)) }
|        return (& $mk 'shipped-differs' $false $false $InstalledStatus ('{0} is installed; this release ships other template content under the same version -- it is not applied (template changes arrive as a new pack)' -f $ShippedName))
|    }
|    & $mk 'release' $true $false 'as-released' ('template pack {0} is installed -- {1} is released through the template gate' -f $InstalledPack, $ShippedName)
|}
|
|function Compare-SIProVersionParts {
|    <# PURE. -1 / 0 / 1, numeric per part (64-bit), a missing part counts as 0 -- the same rule as Compare-SIProPackVersion. #>
|    param([AllowEmptyString()][string]$A, [AllowEmptyString()][string]$B)
|    $pa = @(([string]$A).Trim().Split('.') | Where-Object { $_ -ne '' }); $pb = @(([string]$B).Trim().Split('.') | Where-Object { $_ -ne '' })
|    for ($i = 0; $i -lt [Math]::Max($pa.Count, $pb.Count); $i++) {
|        $x = [long]0; $y = [long]0
|        if ($i -lt $pa.Count) { [void][long]::TryParse($pa[$i], [ref]$x) }
|        if ($i -lt $pb.Count) { [void][long]::TryParse($pb[$i], [ref]$y) }
|        if ($x -lt $y) { return -1 }
|        if ($x -gt $y) { return 1 }
|    }
|    0
|}
|
|# =====================================================================================================================
|#  #251 -- NAMING AND CMDB OWNERSHIP BECOME CONFIGURATION (carried over 1:1, nothing lost)
|# =====================================================================================================================
|function Get-SIProShippedOwnershipMap {
|    <# The shipped CMDB ownership map (config\cmdb-source-ownership.locked.json -> its cmdbSourceOwnership object) as JSON
|       text, keys in file order; $null when the file is missing. What setup seeds the configuration document with. #>
|    param([string]$SIRoot)
|    if (-not $SIRoot) { $SIRoot = $script:SIProConfigSIRoot }
|    $p = Join-SIProPath $SIRoot 'config' 'cmdb-source-ownership.locked.json'
|    if (-not (Test-Path -LiteralPath $p)) { return $null }
|    $root = (ConvertTo-SIOrderedJson (ConvertFrom-SIProJson ([System.IO.File]::ReadAllText($p).TrimStart([char]0xFEFF))))['cmdbSourceOwnership']
|    if ($null -eq $root) { return $null }
|    ConvertTo-SIProJson -Value $root
|}
|
|function ConvertTo-SIProOwnershipMap {
|    <#
|        PURE. The CMDB ownership map built from its LEGACY rows -- exactly what the run materialised from them before #251:
|        the live cmdbownership templates ('defaults' + one 'assettype/<type>' each, in SortOrder), every customer override
|        replacing its entry (an override of an entry with no template adds it, after the template entries, by key), a
|        'disable' removing it. -Shipped (the shipped map text) is the base when there are no template rows.
|        Returns the map as JSON text, or $null when there is nothing to build from.
|    #>
|    param([AllowEmptyCollection()][object[]]$Templates = @(), [AllowEmptyCollection()][object[]]$Overrides = @(), [string]$Shipped)
|    $entries = [ordered]@{}; $order = @{}
|    $live = @($Templates | Where-Object { $_ -and [string](Get-SIProRowValue $_ 'Kind') -eq 'cmdbownership' -and $null -eq (Get-SIProRowValue $_ 'RetiredAt') })
|    if ($live.Count) {
|        foreach ($t in $live) {
|            $k = [string](Get-SIProRowValue $t 'ItemKey'); $so = 0; [void][int]::TryParse([string](Get-SIProRowValue $t 'SortOrder'), [ref]$so)
|            $entries[$k] = [string](Get-SIProRowValue $t 'BodyJson'); $order[$k] = '{0:D10}|{1}' -f $so, $k
|        }
|    } elseif ($Shipped) {
|        $root = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $Shipped)
|        $def = [ordered]@{}; foreach ($k in @($root.Keys)) { if ($k -ne 'assetTypes') { $def[$k] = $root[$k] } }
|        $entries['defaults'] = ConvertTo-SIProJson -Value $def; $order['defaults'] = '{0:D10}|defaults' -f 0
|        $i = 1
|        foreach ($e in @($root['assetTypes'] | Where-Object { $null -ne $_ })) {
|            $k = 'assettype/' + ([string]$e['siAssetType']).Trim().ToLowerInvariant()
|            $entries[$k] = ConvertTo-SIProJson -Value $e; $order[$k] = '{0:D10}|{1}' -f ($i++), $k
|        }
|    }
|    foreach ($o in @($Overrides | Where-Object { $_ -and [string](Get-SIProRowValue $_ 'Kind') -eq 'cmdbownership' })) {
|        $k = [string](Get-SIProRowValue $o 'ItemKey'); if ($k -eq 'map') { continue }
|        switch ([string](Get-SIProRowValue $o 'State')) {
|            'override' { $entries[$k] = [string](Get-SIProRowValue $o 'BodyJson'); if (-not $order.ContainsKey($k)) { $order[$k] = '{0:D10}|{1}' -f [int]::MaxValue, $k } }
|            'disable'  { if ($entries.Contains($k)) { $entries.Remove($k) } }
|        }
|    }
|    if ($entries.Count -eq 0) { return $null }
|    $map = [ordered]@{}
|    if ($entries.Contains('defaults')) { $d = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $entries['defaults']); foreach ($k in @($d.Keys)) { if ($k -ne 'assetTypes') { $map[$k] = $d[$k] } } }
|    $keys = [string[]]@($entries.Keys | Where-Object { $_ -like 'assettype/*' })
|    $sorted = @(foreach ($i in (Get-SIProOrdinalOrder -Keys @($keys | ForEach-Object { $order[$_] }))) { $keys[$i] })
|    $map['assetTypes'] = @($sorted | ForEach-Object { ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $entries[$_]) })
|    ConvertTo-SIProJson -Value $map
|}
|
|function Get-SIProConfigurationMigrationPlan {
|    <#
|        PURE. What #251 carries over on an install (setup, the update hook and Import-SIProSettings -CreateSchema run it;
|        it is idempotent -- a second run plans nothing):
|          Settings  every naming OVERRIDE (State 'override') of a catalog naming setting becomes a cfg.Setting row
|                    (Name, Scope 'solution', the same value) -- unless that setting already has a 'solution' row, which
|                    already wins at run start (Kept). A 'disable' / 'inherit' carries nothing: the catalog default applies,
|                    as it did. A name the catalog does not know is NotCarried (its row stays and is still applied).
|          Map       the CMDB ownership configuration document cmdbownership/map when there is none yet: built from the
|                    legacy rows when there are any (every customer override carried over), else the shipped map.
|                    $null when the document exists.
|          Retire    every live cfg.Template row of kind naming / cmdbownership: retired (RetiredAt), never removed.
|        -Templates: cfg.Template rows; -Overrides: cfg.ItemOverride rows; -Settings: cfg.Setting rows; -Catalog: the
|        settings catalog; -ShippedOwnershipMap: Get-SIProShippedOwnershipMap.
|    #>
|    param([AllowEmptyCollection()][object[]]$Templates = @(), [AllowEmptyCollection()][object[]]$Overrides = @(),
|          [AllowEmptyCollection()][object[]]$Settings = @(), [AllowEmptyCollection()][object[]]$Catalog = @(), [string]$ShippedOwnershipMap)
|    $byName = @{}; foreach ($s in @($Catalog | Where-Object { $_ })) { $byName[[string]$s.name] = $s }
|    $have = @{}; foreach ($s in @($Settings | Where-Object { $_ })) { $have[('{0}|{1}' -f (Get-SIProRowValue $s 'Name'), (Get-SIProRowValue $s 'Scope'))] = $s }
|    $set = New-Object System.Collections.Generic.List[object]; $kept = New-Object System.Collections.Generic.List[object]; $not = New-Object System.Collections.Generic.List[object]
|    $ovr = @($Overrides | Where-Object { $_ })
|    $nm = @($ovr | Where-Object { [string](Get-SIProRowValue $_ 'Kind') -eq 'naming' -and [string](Get-SIProRowValue $_ 'State') -eq 'override' })
|    foreach ($i in (Get-SIProOrdinalOrder -Keys @($nm | ForEach-Object { [string](Get-SIProRowValue $_ 'ItemKey') }))) {
|        $o = $nm[$i]; $name = [string](Get-SIProRowValue $o 'ItemKey')
|        $val = $null; try { $val = ConvertFrom-SIProJson ([string](Get-SIProRowValue $o 'BodyJson')) } catch { }
|        $s = $byName[$name]
|        if (-not $s -or $s.secret -or $val -isnot [string] -or (Test-SISettingValue -Setting $s -Value $val)) {
|            $not.Add([pscustomobject]@{ Name = $name; Value = $val; Reason = $(if (-not $s) { 'not in the settings catalog -- the row stays and is still applied' } else { 'the value is not a valid setting value -- the row stays and is still applied' }) }); continue
|        }
|        $cur = $have[('{0}|solution' -f $name)]
|        if ($cur) { $kept.Add([pscustomobject]@{ Name = $name; Value = $val; Setting = [string](Get-SIProRowValue $cur 'ValueJson') }); continue }
|        $set.Add([pscustomobject]@{ Name = $name; Scope = 'solution'; Value = $val; From = ('naming/{0}' -f $name) })
|    }
|    $map = $null
|    if (-not @($ovr | Where-Object { [string](Get-SIProRowValue $_ 'Kind') -eq 'cmdbownership' -and [string](Get-SIProRowValue $_ 'ItemKey') -eq 'map' }).Count) {
|        $legacyT = @($Templates | Where-Object { $_ -and [string](Get-SIProRowValue $_ 'Kind') -eq 'cmdbownership' -and $null -eq (Get-SIProRowValue $_ 'RetiredAt') })
|        $legacyO = @($ovr | Where-Object { [string](Get-SIProRowValue $_ 'Kind') -eq 'cmdbownership' })
|        if ($legacyT.Count -or @($legacyO | Where-Object { [string](Get-SIProRowValue $_ 'State') -ne 'inherit' }).Count) {
|            $body = ConvertTo-SIProOwnershipMap -Templates $legacyT -Overrides $legacyO -Shipped $ShippedOwnershipMap
|            if ($body) { $map = [pscustomobject]@{ Body = $body; From = ('carried over: {0} template entr(ies), {1} of your change(s)' -f $legacyT.Count, @($legacyO | Where-Object { [string](Get-SIProRowValue $_ 'State') -ne 'inherit' }).Count) } }
|        } elseif ($ShippedOwnershipMap) {
|            $map = [pscustomobject]@{ Body = $ShippedOwnershipMap; From = 'the shipped default (config\cmdb-source-ownership.locked.json)' }
|        }
|    }
|    $retire = @($Templates | Where-Object { $_ -and (Test-SIProFormerTemplateKind ([string](Get-SIProRowValue $_ 'Kind'))) -and $null -eq (Get-SIProRowValue $_ 'RetiredAt') } |
|        ForEach-Object { [pscustomobject]@{ Kind = [string](Get-SIProRowValue $_ 'Kind'); ItemKey = [string](Get-SIProRowValue $_ 'ItemKey') } })
|    [pscustomobject]@{ Settings = $set.ToArray(); Kept = $kept.ToArray(); NotCarried = $not.ToArray(); Map = $map; Retire = @($retire)
|        Empty = ($set.Count -eq 0 -and $null -eq $map -and @($retire).Count -eq 0) }
|}
|
|function Invoke-SIProConfigurationMigration {
|    <#
|        Apply Get-SIProConfigurationMigrationPlan to the database: the setting rows (Set-SIProSetting, each with its
|        cfg.ChangeLog row), the ownership document (Set-SIProItem cmdbownership/map), and the retirement of the former
|        template rows (RetiredAt + a cfg.ChangeLog row each; one transaction). The actor is the session. A carried-over map
|        the run would refuse is NOT written (reported) -- the run keeps building it from the legacy rows, so nothing changes.
|        Returns the plan plus Written = @{ Settings; Map; Retired } and Refused.
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$SIRoot, [object[]]$Catalog, $Context)
|    if (-not $Catalog) { $Catalog = @(Get-SISettingsCatalog -SIRoot $SIRoot) }
|    $tpl = @(Read-SIProTemplates -Store $Store); $ovr = @(Read-SIProItemOverrides -Store $Store); $set = @(Read-SIProSettings -Store $Store)
|    $plan = Get-SIProConfigurationMigrationPlan -Templates $tpl -Overrides $ovr -Settings $set -Catalog $Catalog -ShippedOwnershipMap (Get-SIProShippedOwnershipMap -SIRoot $SIRoot)
|    $by = '{0} (carried over: templates hold only vendor content)' -f (Get-SIProSessionActor)
|    $written = [ordered]@{ Settings = 0; Map = $false; Retired = 0 }; $refused = New-Object System.Collections.Generic.List[string]
|    foreach ($s in @($plan.Settings)) {
|        Set-SIProSetting -Store $Store -Catalog $Catalog -Name $s.Name -Scope $s.Scope -Action Set -Value $s.Value -ChangedBy $by -Reason ('carried over 1:1 from {0} (a name is a setting now)' -f $s.From)
|        $written.Settings++
|    }
|    if ($plan.Map) {
|        $why = @(Test-SIProOwnershipMap -Value $plan.Map.Body)
|        if ($why.Count) { $refused.Add(('the CMDB ownership map was not written ({0}) -- it is still built from your earlier entries at run start' -f ($why -join '; '))) }
|        else {
|            if (-not $Context) { $Context = Get-SIProConfigContext -SIRoot $SIRoot -Catalog $Catalog }
|            Set-SIProItem -Store $Store -Kind cmdbownership -Key map -State override -Body $plan.Map.Body -ChangedBy $by -Reason ('the CMDB ownership map is your configuration now -- {0}' -f $plan.Map.From) -Context $Context
|            $written.Map = $true
|        }
|    }
|    # the ownership rows are retired only once the map document holds what they said
|    $retire = @($plan.Retire | Where-Object { $_.Kind -ne 'cmdbownership' -or -not $refused.Count })
|    if ($retire.Count) {
|        $sb = New-Object System.Text.StringBuilder; $p = [ordered]@{ By = $by }
|        [void]$sb.AppendLine('SET XACT_ABORT ON;'); [void]$sb.AppendLine('BEGIN TRAN;')
|        $i = 0
|        foreach ($r in $retire) {
|            $p["k$i"] = $r.Kind; $p["i$i"] = $r.ItemKey
|            [void]$sb.AppendLine(("UPDATE cfg.Template SET RetiredAt = SYSUTCDATETIME() WHERE Kind = @k{0} AND ItemKey = @i{0} AND RetiredAt IS NULL;" -f $i))
|            [void]$sb.AppendLine(("INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason) VALUES (@i{0}, 'template', @k{0}, 'Reset', 'published', 'retired', @By, 'not a template any more -- it is configuration (kept as history)');" -f $i))
|            $i++
|        }
|        [void]$sb.AppendLine('COMMIT;')
|        & $Store.Invoke $sb.ToString() $p 'nonquery'
|        $written.Retired = $i
|    }
|    $plan | Add-Member -NotePropertyName Written -NotePropertyValue ([pscustomobject]$written) -PassThru | Add-Member -NotePropertyName Refused -NotePropertyValue $refused.ToArray() -PassThru
|}
|
|function Get-SITemplatePublishPlan {
|    <#
|        PURE. What publishing -Rows over the database's current templates (-Existing) would do, per item:
|          insert   new item;   update   body (hash) or version changed;   same   nothing to do;
|          retire   in the database, not shipped any more (RetiredAt is set -- the row is never removed);
|          revive   retired before, shipped again.
|        Customer overrides are not read or touched: a version bump keeps every override.
|        -RefreshMissingContentHash: an existing row without a ContentHash (published before template versioning) is
|        updated even when nothing else changed, so every row carries one.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [AllowEmptyCollection()][object[]]$Existing = @(), [string[]]$Families,
|          [switch]$RefreshMissingContentHash)
|    $have = @{}; foreach ($e in @($Existing | Where-Object { $_ })) { $have[('{0}/{1}' -f (Get-SIProRowValue $e 'Kind'), (Get-SIProRowValue $e 'ItemKey'))] = $e }
|    $ship = @{}
|    $plan = New-Object System.Collections.Generic.List[object]
|    foreach ($r in @($Rows)) {
|        $name = '{0}/{1}' -f $r.Kind, $r.ItemKey; $ship[$name] = $true
|        $e = $have[$name]
|        $action = if (-not $e) { 'insert' }
|                  elseif ($null -ne (Get-SIProRowValue $e 'RetiredAt')) { 'revive' }
|                  elseif ([string](Get-SIProRowValue $e 'BodyHash') -ne $r.BodyHash -or [string](Get-SIProRowValue $e 'TemplateVersion') -ne $r.TemplateVersion -or [string](Get-SIProRowValue $e 'Source') -ne $r.Source -or [string](Get-SIProRowValue $e 'SortOrder') -ne [string]$r.SortOrder) { 'update' }
|                  elseif ($RefreshMissingContentHash -and -not ([string](Get-SIProRowValue $e 'ContentHash')).Trim()) { 'update' }
|                  else { 'same' }
|        $plan.Add([pscustomobject]@{ Action = $action; Kind = $r.Kind; ItemKey = $r.ItemKey; Row = $r })
|    }
|    $kinds = if ($Families) { $Families } else { @($Rows | ForEach-Object { $_.Kind } | Select-Object -Unique) }
|    foreach ($name in @($have.Keys)) {
|        $e = $have[$name]
|        if ($ship.ContainsKey($name) -or $null -ne (Get-SIProRowValue $e 'RetiredAt')) { continue }
|        if ($kinds -notcontains [string](Get-SIProRowValue $e 'Kind')) { continue }
|        $plan.Add([pscustomobject]@{ Action = 'retire'; Kind = [string](Get-SIProRowValue $e 'Kind'); ItemKey = [string](Get-SIProRowValue $e 'ItemKey'); Row = $null })
|    }
|    $u = $plan.ToArray()
|    @(foreach ($i in (Get-SIProOrdinalOrder -Keys @($u | ForEach-Object { '{0}|{1}' -f $_.Kind, $_.ItemKey }))) { $u[$i] })
|}
|
|function Get-SIProStoreTransaction {
|    <#
|        The store's ONE-CONNECTION TRANSACTION: { param([scriptblock]$Body) } -- the body gets an invoke (sql, params, mode)
|        bound to one open connection and one transaction, committed when it returns, rolled back on any error. The settings
|        store has it (New-SIProSettingsStore: Transaction); a store that names its Server / Database / GetToken (the container
|        updater's) gets one built here, and so does one with an OpenConnection { } (returns an OPEN SqlConnection -- the
|        real-SQL tests). $null for a store with none of these (a test's fake): the caller then writes as before.
|    #>
|    param([Parameter(Mandatory)]$Store)
|    if ($Store.PSObject.Properties['Transaction'] -and $Store.Transaction -is [scriptblock]) { return $Store.Transaction }
|    $open = $null
|    if ($Store.PSObject.Properties['OpenConnection'] -and $Store.OpenConnection -is [scriptblock]) { $open = $Store.OpenConnection }
|    elseif ($Store.PSObject.Properties['GetToken'] -and $Store.GetToken -is [scriptblock] -and $Store.PSObject.Properties['Server'] -and "$($Store.Server)".Trim() -and $Store.PSObject.Properties['Database'] -and "$($Store.Database)".Trim()) {
|        $cs = 'Server=tcp:{0},1433;Database={1};Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;' -f $Store.Server, $Store.Database
|        $gt = $Store.GetToken
|        $open = { $c = New-Object System.Data.SqlClient.SqlConnection($cs); $c.AccessToken = [string](& $gt); $c.Open(); $c }.GetNewClosure()
|    }
|    if ($open) {
|        return {
|            param([scriptblock]$Body)
|            $cn = & $open
|            $tx = $null
|            try {
|                $tx = $cn.BeginTransaction()
|                $txInvoke = {
|                    param([string]$tsql, $tp, [string]$tmode)
|                    $tc = $cn.CreateCommand(); $tc.Transaction = $tx; $tc.CommandText = $tsql; $tc.CommandTimeout = 0
|                    if ($tp) { foreach ($k in $tp.Keys) { [void]$tc.Parameters.AddWithValue('@' + $k, $(if ($null -eq $tp[$k]) { [System.DBNull]::Value } else { $tp[$k] })) } }
|                    if ($tmode -eq 'reader') { $rd = $tc.ExecuteReader(); $out = New-Object System.Collections.Generic.List[object]; while ($rd.Read()) { $h = @{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $h[$rd.GetName($i)] = $(if ($rd.IsDBNull($i)) { $null } else { $rd.GetValue($i) }) }; $out.Add($h) }; $rd.Close(); return , $out.ToArray() }
|                    if ($tmode -eq 'scalar') { return $tc.ExecuteScalar() }
|                    [void]$tc.ExecuteNonQuery()
|                }.GetNewClosure()
|                $r = & $Body $txInvoke
|                $tx.Commit(); $tx = $null
|                $r
|            } catch {
|                if ($tx) { try { $tx.Rollback() } catch { } }
|                throw
|            } finally { $cn.Dispose() }
|        }.GetNewClosure()
|    }
|    $null
|}
|
|function Invoke-SITemplatePublish {
|    <#
|        Apply a publish plan: insert / update / revive / retire, each with a cfg.ChangeLog entry (Scope 'template', the
|        version and content hash -- not the body, which can be large), in transactions of up to -BatchSize items. Every
|        written row carries its normalised ContentHash, and each content is kept once in cfg.TemplateRevision. Never
|        writes cfg.ItemOverride (it reads it only to leave an overridden or switched-off item out of the "upgraded"
|        change-log entry). Needs the template-versioning schema (Publish-SITemplates checks it first).
|        ATOMIC (ring 1 2026-10-10: a run that read the store while the first data-model publish was half-way saw part of the
|        field catalog and stopped): every batch goes through the store's ONE-CONNECTION TRANSACTION (Get-SIProStoreTransaction)
|        -- a reader sees the whole old set or the whole new one, never a mix (with READ COMMITTED SNAPSHOT, Azure SQL's default,
|        the old set until the commit; without it the read waits for the commit). The batches stay (a command's parameters are
|        limited), inside the one transaction. A store without one (a test's fake) gets the batches as before.
|        -AfterBatch { param($BatchNo, $Invoke) }: test seam, called after each batch inside the transaction.
|    #>
|    param([Parameter(Mandatory)]$Store, [AllowEmptyCollection()][object[]]$Plan = @(), [Parameter(Mandatory)][string]$ChangedBy, [int]$BatchSize = 100, [scriptblock]$AfterBatch)
|    $work = @($Plan | Where-Object { $_.Action -ne 'same' })
|    if (-not $work.Count) { return 0 }
|    $txn = Get-SIProStoreTransaction -Store $Store
|    $write = {
|    param($Send)
|    $batchNo = 0
|    for ($s = 0; $s -lt $work.Count; $s += $BatchSize) {
|        $chunk = @($work[$s..([Math]::Min($s + $BatchSize, $work.Count) - 1)])
|        $sb = New-Object System.Text.StringBuilder
|        [void]$sb.AppendLine('SET XACT_ABORT ON;'); [void]$sb.AppendLine('BEGIN TRAN;')
|        $p = [ordered]@{ By = $ChangedBy }
|        for ($i = 0; $i -lt $chunk.Count; $i++) {
|            $c = $chunk[$i]; $p["k$i"] = $c.Kind; $p["i$i"] = $c.ItemKey
|            if ($c.Action -eq 'retire') {
|                [void]$sb.AppendLine(("UPDATE cfg.Template SET RetiredAt = SYSUTCDATETIME() WHERE Kind = @k{0} AND ItemKey = @i{0} AND RetiredAt IS NULL;" -f $i))
|                [void]$sb.AppendLine(("INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason) VALUES (@i{0}, 'template', @k{0}, 'Reset', 'published', 'retired', @By, 'no longer shipped');" -f $i))
|                continue
|            }
|            $r = $c.Row
|            $ch = [string](Get-SIProRowValue $r 'ContentHash'); if (-not $ch.Trim()) { $ch = Get-SIProContentHash -Body $r.BodyJson -Format $r.Format }
|            $p["v$i"] = $r.TemplateVersion; $p["b$i"] = $r.BodyJson; $p["f$i"] = $r.Format; $p["o$i"] = [int]$r.SortOrder; $p["h$i"] = $r.BodyHash; $p["s$i"] = $r.Source; $p["c$i"] = $ch.Trim()
|            # #529 (3): the content in force before this write -- an item that FOLLOWS the template (no override, or inherit)
|            # and changes content gets an "upgraded" entry below, naming the version it went from and to
|            [void]$sb.AppendLine(("DECLARE @pv{0} nvarchar(32) = NULL, @pc{0} char(64) = NULL, @pr{0} bit = 0; SELECT @pv{0} = [Version], @pc{0} = ContentHash, @pr{0} = CASE WHEN RetiredAt IS NULL THEN 0 ELSE 1 END FROM cfg.Template WHERE Kind = @k{0} AND ItemKey = @i{0};" -f $i))
|            [void]$sb.AppendLine(("IF EXISTS (SELECT 1 FROM cfg.Template WHERE Kind = @k{0} AND ItemKey = @i{0})" -f $i))
|            [void]$sb.AppendLine(("    UPDATE cfg.Template SET [Version] = @v{0}, BodyJson = @b{0}, Format = @f{0}, SortOrder = @o{0}, BodyHash = @h{0}, ContentHash = @c{0}, Source = @s{0}, PublishedAt = SYSUTCDATETIME(), RetiredAt = NULL WHERE Kind = @k{0} AND ItemKey = @i{0};" -f $i))
|            [void]$sb.AppendLine('ELSE')
|            [void]$sb.AppendLine(("    INSERT cfg.Template (Kind, ItemKey, [Version], BodyJson, Format, SortOrder, BodyHash, ContentHash, Source) VALUES (@k{0}, @i{0}, @v{0}, @b{0}, @f{0}, @o{0}, @h{0}, @c{0}, @s{0});" -f $i))
|            # every content a template ever had is kept once (by ContentHash), so "what changed since you overrode it"
|            # can be shown against the body the override was made on
|            [void]$sb.AppendLine(("IF NOT EXISTS (SELECT 1 FROM cfg.TemplateRevision WHERE Kind = @k{0} AND ItemKey = @i{0} AND ContentHash = @c{0}) INSERT cfg.TemplateRevision (Kind, ItemKey, ContentHash, [Version], BodyJson, Format) VALUES (@k{0}, @i{0}, @c{0}, @v{0}, @b{0}, @f{0});" -f $i))
|            [void]$sb.AppendLine(("INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason) VALUES (@i{0}, 'template', @k{0}, 'Set', NULL, CONCAT(@v{0}, ':', @c{0}), @By, '{1}');" -f $i, $c.Action))
|            [void]$sb.AppendLine(("IF @pc{0} IS NOT NULL AND @pr{0} = 0 AND @pc{0} <> @c{0} AND NOT EXISTS (SELECT 1 FROM cfg.ItemOverride WHERE Kind = @k{0} AND ItemKey = @i{0} AND State IN ('override', 'disable')) INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason) VALUES (@i{0}, 'item', @k{0}, 'Set', CONCAT('template ', COALESCE(@pv{0}, '(none)'), ':', @pc{0}), CONCAT('template ', @v{0}, ':', @c{0}), @By, CONCAT('upgraded: follows the new shipped version (', COALESCE(@pv{0}, '(none)'), ' -> ', @v{0}, ')'));" -f $i))
|        }
|        [void]$sb.AppendLine('COMMIT;')
|        & $Send $sb.ToString() $p 'nonquery'
|        $batchNo++
|        if ($AfterBatch) { & $AfterBatch $batchNo $Send }
|    }
|    }
|    if ($txn) { $null = & $txn $write } else { $null = & $write $Store.Invoke }
|    $work.Count
|}
|
|# =====================================================================================================================
|#  IMPORT: an installation's files -> only what DIFFERS from the templates (Community -> Pro)
|# =====================================================================================================================
|function Get-SIProAssetTaggingSources {
|    <#
|        #275 R3. The asset-tagging files a 2.2 run of THIS installation reads, found exactly as the launcher and the engine
|        find them (AssetTagging.Resolve.ps1): SettingsPath, CustomYamlFile, LockedYamlFile and LegacyYamlFile as the
|        configuration layers leave them -- config\SecurityInsight.custom.ps1, then launcher\asset-tagging\
|        LauncherConfig.custom.ps1, then (internal launcher) launcher\asset-tagging\launcher.override.ps1, the last plain
|        top-level assignment winning -- else the launcher's default folder (internal: asset-tagging-rules\ first).
|        -SettingsPath (the importer's -AssetTaggingPath) wins, as the launcher's -SettingsPath switch does.
|        Returns @{ SettingsPath; From; Flavour; Files (Resolve-SIAssetTaggingFiles, or $null when the folder cannot be
|        known or read); Review (not imported, with the reason -- never silent); Info (said, nothing lost) }.
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [string]$SettingsPath, [string]$Flavour)
|    $review = New-Object System.Collections.Generic.List[object]; $info = New-Object System.Collections.Generic.List[object]
|    $rel = { param([string]$p) if ($p.StartsWith($SIRoot, [StringComparison]::OrdinalIgnoreCase)) { $p.Substring($SIRoot.Length).TrimStart('\', '/') } else { $p } }
|    if (-not $Flavour) { $Flavour = if ((Split-Path -Leaf (Split-Path -Parent $SIRoot)) -eq 'SOLUTIONS') { 'internal' } else { 'community' } }
|    $layers = @((Join-SIProPath $SIRoot 'config' 'SecurityInsight.custom.ps1'), (Join-SIProPath $SIRoot 'launcher' 'asset-tagging' 'LauncherConfig.custom.ps1'))
|    if ($Flavour -eq 'internal') { $layers += (Join-SIProPath $SIRoot 'launcher' 'asset-tagging' 'launcher.override.ps1') }   # only the internal launcher dot-sources it
|    $names = 'SettingsPath', 'CustomYamlFile', 'LockedYamlFile', 'LegacyYamlFile'
|    $val = @{}; $from = @{}; $byCode = @{}
|    foreach ($l in $layers) {
|        if (-not (Test-Path -LiteralPath $l)) { continue }
|        foreach ($a in @(Get-SIPs1Assignments -Text (Read-SISettingsText -Path $l).Text | Where-Object { $names -contains $_.Name })) {
|            if ($a.TopLevel -and $a.Literal) { $val[$a.Name] = [string]$a.Value; $from[$a.Name] = ('{0} line {1}' -f (& $rel $l), $a.Line); [void]$byCode.Remove($a.Name) }
|            else { $byCode[$a.Name] = [pscustomobject]@{ Path = (& $rel $l); Line = $a.Line } }
|        }
|    }
|    $out = [pscustomobject]@{ SettingsPath = $null; From = ''; Flavour = $Flavour; Files = $null; Review = $review; Info = $info }
|    $tell = { param([string]$name, [string]$path, $line, [string]$reason) $review.Add([pscustomobject]@{ Name = $name; Scope = 'item'; Path = $path; Line = $line; Reason = $reason }) }
|    foreach ($n in @($names | Where-Object { $byCode.ContainsKey($_) -and $_ -ne 'SettingsPath' })) {
|        $c = $byCode[$n]
|        & $tell ('assettagging ' + $n) $c.Path $c.Line ('{0} is set by code at line {1}, so the importer cannot tell which asset-tagging file the run reads -- the default name is used; check that nothing is missing' -f $n, $c.Line)
|    }
|    if (-not $SettingsPath -and $byCode.ContainsKey('SettingsPath')) {
|        $c = $byCode['SettingsPath']
|        & $tell 'assettagging' $c.Path $c.Line ('SettingsPath is set by code at line {0}, so the importer cannot tell which folder the asset-tagging run reads -- no asset-tagging rules are imported; run the importer again with -AssetTaggingPath <that folder>' -f $c.Line)
|        return $out
|    }
|    $configured = if ($val.ContainsKey('SettingsPath')) { $val['SettingsPath'] } else { '' }
|    $sp = Resolve-SIAssetTaggingSettingsPath -Cli $SettingsPath -Configured $configured -SIRoot $SIRoot -Flavour $Flavour
|    $out.SettingsPath = $sp
|    $out.From = if ($SettingsPath) { '-AssetTaggingPath' } elseif ($configured) { $from['SettingsPath'] } else { ('the {0} launcher''s default' -f $Flavour) }
|    if (-not [System.IO.Path]::IsPathRooted($sp)) {
|        & $tell 'assettagging' $sp $null ('the asset-tagging rules folder (SettingsPath, {0}) is a relative path -- it depends on the folder the run starts in; run the importer again with -AssetTaggingPath <the full path>' -f $out.From)
|        return $out
|    }
|    if (-not (Test-Path -LiteralPath $sp -PathType Container)) {
|        # the launcher's own default folder missing = an installation without asset tagging (the 2.2 run stopped): nothing to lose
|        if (-not $SettingsPath -and -not $configured) { $out.Files = $null; return $out }
|        & $tell 'assettagging' $sp $null ('the asset-tagging rules folder (SettingsPath, {0}) does not exist on this machine -- copy it here or run the importer again with -AssetTaggingPath <folder>' -f $out.From)
|        return $out
|    }
|    $launcherDefault = { param([string]$n, [string]$d) if ($val.ContainsKey($n) -and -not [string]::IsNullOrWhiteSpace($val[$n])) { $val[$n] } else { $d } }
|    # the launchers set the locked / custom names when nothing else has (AssetTagging.locked.yaml / .custom.yaml); the
|    # legacy name only ever comes from the configuration or the engine's own default
|    $out.Files = Resolve-SIAssetTaggingFiles -SettingsPath $sp -SIRoot $SIRoot `
|        -LockedYamlFile (& $launcherDefault 'LockedYamlFile' 'AssetTagging.locked.yaml') -CustomYamlFile (& $launcherDefault 'CustomYamlFile' 'AssetTagging.custom.yaml') `
|        -LegacyYamlFile (& $launcherDefault 'LegacyYamlFile' '')
|    $f = $out.Files
|    $shippedDir = Join-SIProPath $SIRoot 'asset-profiling-enrichment' 'endpoint'
|    $isShipped = ([System.IO.Path]::GetFullPath($sp).TrimEnd('\', '/') -ieq [System.IO.Path]::GetFullPath($shippedDir).TrimEnd('\', '/'))
|    if ($f.Mode -eq 'legacy') {
|        $info.Add([pscustomobject]@{ Name = 'assettagging'; Path = (& $rel $f.LegacyPath); Reason = 'the run read ONLY this legacy file (no locked / custom file beside it); its tags are imported -- in Pro the shipped tags it does not restate also run: turn off the ones you do not want' })
|    } elseif ($f.Mode -eq 'locked+custom' -and -not $f.LockedExists -and -not $isShipped) {
|        $info.Add([pscustomobject]@{ Name = 'assettagging'; Path = (& $rel $f.CustomPath); Reason = ('the run read ONLY this file ({0} holds no {1}); its tags are imported -- in Pro the shipped tags also run: turn off the ones you do not want' -f (& $rel $sp), $f.LockedYamlFile) })
|    } elseif ($f.Mode -eq 'none' -and -not $isShipped) {
|        & $tell 'assettagging' (& $rel $sp) $null ('no asset-tagging rules file ({0}, {1} or {2}) is in the folder the run reads (SettingsPath, {3}) -- the 2.2 run stopped here; nothing to import' -f $f.LockedYamlFile, $f.CustomYamlFile, $f.LegacyYamlFile, $out.From)
|    }
|    $cands = @($f.ConfigCandidates)
|    if ($f.ConfigPath) {
|        foreach ($c in @($cands | Where-Object { $_ -ne $f.ConfigPath -and (Test-Path -LiteralPath $_) })) {
|            $info.Add([pscustomobject]@{ Name = 'assettagging/config'; Path = (& $rel $c); Reason = ('not read by the run -- {0} comes first; not imported' -f (& $rel $f.ConfigPath)) })
|        }
|    }
|    $out
|}
|
|function Get-SIProConfigImportPlan {
|    <#
|        Every configuration family an installation keeps in files, as cfg.ItemOverride rows -- ONLY what differs from the
|        templates (-Templates: the rows Get-SITemplateRows builds, or the database's). Per family:
|          rareport      RiskAnalysis_Queries_Custom.yaml (or custom\): a report / template that differs -> override; a
|                        new one -> own
|          riskindex     riskscore.index.custom.csv (the customer's own rows, #398): a row that differs from its template
|                        -> override, a new row -> own, both placed before every shipped row (as the engine reads them);
|                        nothing is disabled; an unchanged copy of an earlier shipped index -> nothing (Info)
|          rule          a custom rule with 'mode: disable' for a shipped rule -> disable (other custom rules stay
|                        cfg.Document, Get-SIProDocumentImportPlan)
|          assettagging  the files the asset-tagging run reads, found as the launcher + engine find them (Get-SIProAssetTaggingSources;
|                        -AssetTaggingPath wins): per tag override / own; the asset-tagging.config.json it reads -> config
|          serverapps    asset-profiling-enrichment\endpoint\server-applications.json -> catalog
|          cmdbownership config\cmdb-source-ownership.custom.json, merged per field over the template (the loader's rule)
|          servicemodel  config\service-model.custom.json (replaces the model wholesale)
|          schemaoverlay asset-profiling-schema\<engine>.schema.custom.json
|          decision      config\ and overlay-root asset-decisions / correlation-decisions .custom.yaml
|          weights       <Report>.weighted.custom.json -> report/<Report>; the riskscore_weighted file's sections other than
|                        weightedRiskFactors -> model (weightedRiskFactors itself is the cfg.Document weights/solution)
|        Not imported, with the reason: a file that does not parse or validate. Returns @{ Rows; Skipped; Same; Files }
|        where Files = the source files and whether everything in them was imported (for -RetireFiles).
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [AllowEmptyCollection()][object[]]$Templates = @(), [string]$OverlayRoot,
|          [string]$AssetTaggingPath, [string]$AssetTaggingFlavour, $Context,
|          # The templates were built from THIS installation's files, not read from the database. Kept for callers: since
|          # #398 the shipped risk index (locked) and the customer's rows (custom) are separate files, so a local baseline
|          # compares like any other.
|          [switch]$LocalTemplates)
|    if (-not $Context) { $Context = Get-SIProConfigContext -SIRoot $SIRoot }
|    $tpl = @{}; foreach ($t in @($Templates)) { $tpl[('{0}/{1}' -f $t.Kind, $t.ItemKey)] = $t }
|    $rows = New-Object System.Collections.Generic.List[object]; $skipped = New-Object System.Collections.Generic.List[object]
|    $same = New-Object System.Collections.Generic.List[string]; $files = [ordered]@{}; $info = New-Object System.Collections.Generic.List[object]
|    $rel = { param([string]$p) if ($p.StartsWith($SIRoot, [StringComparison]::OrdinalIgnoreCase)) { $p.Substring($SIRoot.Length).TrimStart('\', '/') } else { $p } }
|    $file = { param([string]$p, [string]$kind) $k = & $rel $p; if (-not $files.Contains($k)) { $files[$k] = [pscustomobject]@{ Path = $p; Rel = $k; Kind = $kind; Complete = $true; Imported = 0 } }; $files[$k] }
|    # the customer's own reports count as reports for validation
|    $ctx = [pscustomobject]@{ SIRoot = $Context.SIRoot; Reports = @($Context.Reports); Kinds = @($Context.Kinds); Catalog = @($Context.Catalog) }
|    $consider = {
|        param([string]$kind, [string]$key, [string]$body, [string]$fmt, [string]$src)
|        $f = & $file $src $kind
|        $name = '{0}/{1}' -f $kind, $key
|        $t = $tpl[$name]
|        if ($t -and (Test-SIProSameItem -A $body -B ([string]$t.BodyJson) -Format $fmt)) { $same.Add($name); return }
|        $why = @(Test-SIProItem -Kind $kind -Key $key -Body $body -Format $fmt -Context $ctx)
|        if ($why.Count) { $skipped.Add([pscustomobject]@{ Name = $name; Scope = 'item'; Reason = ('{0}: {1}' -f (& $rel $src), ($why -join '; ')) }); $f.Complete = $false; return }
|        $rows.Add([pscustomobject]@{ Kind = $kind; Key = $key; State = 'override'; Body = $body; Format = $fmt
|            BaseVersion = $(if ($t) { [string]$t.TemplateVersion } else { $null }); BaseHash = $(if ($t) { Get-SIProRowContentHash $t } else { $null })
|            Origin = $(if ($t) { 'override' } else { 'own' }); Source = (& $rel $src) })
|        $f.Imported++
|    }
|    $rad = Join-SIProPath $SIRoot 'risk-analysis-detection'
|
|    # ---- Risk Analysis report catalog: the custom YAML ----
|    foreach ($cand in @((Join-SIProPath $rad 'custom' 'RiskAnalysis_Queries_Custom.yaml'), (Join-SIProPath $rad 'RiskAnalysis_Queries_Custom.yaml'))) {
|        if (-not (Test-Path -LiteralPath $cand)) { continue }
|        $y = $null
|        try { $y = ConvertFrom-SIYaml -Path $cand -Ordered } catch { $skipped.Add([pscustomobject]@{ Name = (& $rel $cand); Scope = 'item'; Reason = 'not valid YAML: ' + $_.Exception.Message }); (& $file $cand 'rareport').Complete = $false; continue }
|        if ($null -eq $y) { continue }
|        foreach ($r in @($y['Reports'] | Where-Object { $null -ne $_ })) { $ctx.Reports = @($ctx.Reports + [string]$r['ReportName']) }
|        foreach ($r in @($y['Reports'] | Where-Object { $null -ne $_ })) { & $consider 'rareport' ('report/' + [string]$r['ReportName']) (ConvertTo-SIProJson -Value $r -Level 2) 'json' $cand }
|        foreach ($r in @($y['ReportTemplates'] | Where-Object { $null -ne $_ })) { & $consider 'rareport' ('template/' + [string]$r['ReportName']) (ConvertTo-SIProJson -Value $r -Level 2) 'json' $cand }
|        foreach ($k in @($y.Keys | Where-Object { $_ -notin 'Reports', 'ReportTemplates' })) { $skipped.Add([pscustomobject]@{ Name = ('{0}:{1}' -f (& $rel $cand), $k); Scope = 'item'; Reason = 'only Reports and ReportTemplates are read from the custom catalog' }) }
|        break   # the engine reads the custom\ copy when it exists, else the flat one
|    }
|
|    # ---- the risk index: the customer's OWN rows (#398) ----
|    # riskscore.index.custom.csv is never shipped (the shipped index is riskscore.index.locked.csv, the templates); it
|    # holds only the customer's rows, which the engine reads BEFORE the shipped rows and which never remove one. So the
|    # import mirrors that: a row equal to its template (its place aside) changes nothing; any other row is placed before
|    # every shipped row, in the file's order (a negative Precedence -- the run file renumbers 1..n); nothing is disabled.
|    # A never-edited copy of an earlier version's shipped index is not the customer's and is not imported.
|    $ri = Join-SIProPath $rad 'riskscore.index.custom.csv'
|    $riShipped = $false
|    if ((Test-Path -LiteralPath $ri) -and (Get-Command -Name Test-SIRiskIndexShippedCopy -ErrorAction SilentlyContinue)) { $riShipped = Test-SIRiskIndexShippedCopy -Path $ri }
|    if ($riShipped) {
|        $info.Add([pscustomobject]@{ Name = 'riskindex'; Reason = ('{0} is the unchanged risk index of an earlier version -- nothing of it is imported' -f (& $rel $ri)) })
|    } elseif (Test-Path -LiteralPath $ri) {
|        $count = @{}
|        # A v2.2 index (no Precedence column) is put in precedence order first -- the same scores, first match wins
|        # (RA-RiskIndexOrder.ps1) -- so it is compared with the templates in the form they are published in.
|        # #559: and a file written with the 2.2 columns is translated to the SI keys (the form the templates are published in)
|        $riRows = @(Import-Csv -LiteralPath $ri)
|        $riRows = @(ConvertTo-SIRiskIndexSiRows -Rows $riRows | ForEach-Object { [pscustomobject]$_ })
|        $n = $riRows.Count; $pos = 0
|        foreach ($r in $riRows) {
|            $pos++
|            $o = [ordered]@{}; foreach ($c in $script:SIRiskIndexColumns) { $o[$c] = $(if ((Get-SIRiskIndexCell $r $c) -ne '') { Get-SIRiskIndexCell $r $c } else { '' }) }
|            $key = Get-SIRiskIndexKey -Row $o
|            if ($count.ContainsKey($key)) { $count[$key]++; $key = '{0}#{1}' -f $key, $count[$key] } else { $count[$key] = 1 }   # a repeat, as the templates key it
|            $t = $tpl[('riskindex/{0}' -f $key)]
|            if ($t) {
|                $tb = ConvertFrom-SIProJson ([string]$t.BodyJson)
|                $diff = @($script:SIRiskIndexColumns | Where-Object { $_ -ne 'Precedence' -and [string]$o[$_] -cne [string]$(if ($tb.PSObject.Properties[$_]) { $tb.$_ } else { '' }) })
|                if (-not $diff.Count) { $same.Add(('riskindex/{0}' -f $key)); continue }
|            }
|            $o['Precedence'] = [string]($pos - $n - 1)
|            & $consider 'riskindex' $key (ConvertTo-SIProJson -Value $o) 'json' $ri
|        }
|    }
|
|    # ---- rules: a custom 'mode: disable' of a shipped rule ----
|    foreach ($r in @(Get-SIRuleView -SIRoot $SIRoot -OverlayRoot $OverlayRoot)) {
|        $own = if ($r.overlay) { $r.overlay } elseif ($r.custom) { $r.custom } else { $null }
|        if (-not $own -or -not $r.locked -or $own.mode -ne 'disable') { continue }
|        $path = if ($own.path -like 'overlay:*') { Join-SIProPath $OverlayRoot $own.path.Substring(8) } else { Join-SIProPath $SIRoot $own.path }
|        $key = '{0}/{1}' -f $r.engine, $r.id
|        $t = $tpl['rule/' + $key]
|        $rows.Add([pscustomobject]@{ Kind = 'rule'; Key = $key; State = 'disable'; Body = $null; Format = 'yaml'; BaseVersion = $(if ($t) { [string]$t.TemplateVersion } else { $null }); BaseHash = $(if ($t) { Get-SIProRowContentHash $t } else { $null }); Origin = 'disable'; Source = (& $rel $path) })
|        (& $file $path 'rule').Imported++
|    }
|
|    # ---- asset tagging: EXACTLY the files a run of this installation reads (#275 R3) -- the launchers' and the engine's
|    #      own resolution (AssetTagging.Resolve.ps1); what cannot be known or read is listed, never skipped silently ----
|    $tagSrc = Get-SIProAssetTaggingSources -SIRoot $SIRoot -SettingsPath $AssetTaggingPath -Flavour $AssetTaggingFlavour
|    foreach ($s in $tagSrc.Review) { $skipped.Add($s) }
|    foreach ($s in $tagSrc.Info) { $info.Add($s) }
|    $tf = $tagSrc.Files
|    if ($tf) {
|        $tagFiles = @()
|        if ($tf.Mode -eq 'locked+custom') {
|            # a locked file OUTSIDE the shipped place is the customer's copy -- the run read it, so its tags count (a tag
|            # identical to the template is not stored)
|            $shippedLocked = Join-SIProPath $SIRoot 'asset-profiling-enrichment' 'endpoint' 'AssetTagging.locked.yaml'
|            if ($tf.LockedExists -and ([System.IO.Path]::GetFullPath($tf.LockedPath) -ine [System.IO.Path]::GetFullPath($shippedLocked))) { $tagFiles += $tf.LockedPath }
|            if ($tf.CustomExists) { $tagFiles += $tf.CustomPath }
|        } elseif ($tf.Mode -eq 'legacy') { $tagFiles += $tf.LegacyPath }
|        # merged as the engine merges: per tag stem, the custom file wins over the locked one
|        $merged = [ordered]@{}
|        foreach ($tc in $tagFiles) {
|            $null = & $file $tc 'assettagging'
|            $y = $null
|            try { $y = ConvertFrom-SIYaml -Path $tc -Ordered } catch { $skipped.Add([pscustomobject]@{ Name = (& $rel $tc); Scope = 'item'; Path = (& $rel $tc); Reason = 'not valid YAML: ' + $_.Exception.Message }); (& $file $tc 'assettagging').Complete = $false; continue }
|            if (-not $y) { continue }
|            foreach ($t in @($y['AssetTagging'] | Where-Object { $null -ne $_ })) {
|                $stem = Get-SIProAssetTagStemKey ([string]$t['AssetTagName'])
|                if (-not $stem) { $skipped.Add([pscustomobject]@{ Name = 'assettagging/' + [string]$t['AssetTagName']; Scope = 'item'; Path = (& $rel $tc); Reason = 'the tag name does not follow <stem>--tier<N>--SI / <stem>--excluded--SI' }); (& $file $tc 'assettagging').Complete = $false; continue }
|                $merged[$stem] = [pscustomobject]@{ Tag = $t; Source = $tc }
|            }
|        }
|        foreach ($k in @($merged.Keys)) { & $consider 'assettagging' ('tag/' + $k) (ConvertTo-SIProJson -Value $merged[$k].Tag) 'json' $merged[$k].Source }
|    }
|    # the AutoExclude gates: the config file the run reads (config\ under the solution first, then SettingsPath)
|    $tcfg = if ($tf) { $tf.ConfigPath } else { $p = Join-SIProPath $SIRoot 'config' 'asset-tagging.config.json'; if (Test-Path -LiteralPath $p) { $p } else { $null } }
|    if ($tcfg) { & $consider 'assettagging' 'config' ([System.IO.File]::ReadAllText($tcfg).TrimStart([char]0xFEFF)) 'json' $tcfg }
|
|    # ---- the server-application catalog override (#275 R6): asset-profiling-enrichment\endpoint\server-applications.json,
|    #      which the endpoint profiler merges over the shipped catalog -> serverapps/catalog ----
|    $sa = Join-SIProPath $SIRoot 'asset-profiling-enrichment' 'endpoint' 'server-applications.json'
|    if (Test-Path -LiteralPath $sa) { & $consider 'serverapps' 'catalog' ([System.IO.File]::ReadAllText($sa).TrimStart([char]0xFEFF)) 'json' $sa }
|
|    # ---- CMDB ownership (#251: configuration, ONE document cmdbownership/map): the shipped map with the custom file merged
|    #      over it exactly as the loader merges it (top-level settings replace; an asset type replaces by siAssetType and
|    #      inherits every field it does not restate) -- the whole map, which is the customer's from then on ----
|    $oc = Join-SIProPath $SIRoot 'config' 'cmdb-source-ownership.custom.json'
|    if (Test-Path -LiteralPath $oc) {
|        $c = $null
|        try { $c = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson ([System.IO.File]::ReadAllText($oc))) } catch { $skipped.Add([pscustomobject]@{ Name = (& $rel $oc); Scope = 'item'; Reason = 'not valid JSON' }); (& $file $oc 'cmdbownership').Complete = $false }
|        if ($c -and $c.Contains('cmdbSourceOwnership')) {
|            $croot = $c['cmdbSourceOwnership']
|            $shipped = Get-SIProShippedOwnershipMap -SIRoot $SIRoot
|            $map = if ($shipped) { ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $shipped) } else { [ordered]@{} }
|            foreach ($k in @($croot.Keys | Where-Object { $_ -ne 'assetTypes' -and -not ([string]$_).StartsWith('_') -and $_ -ne 'Comment' })) { if ($null -ne $croot[$k]) { $map[$k] = $croot[$k] } }
|            $types = New-Object System.Collections.Generic.List[object]
|            foreach ($e in @($map['assetTypes'] | Where-Object { $null -ne $_ })) { $types.Add($e) }
|            foreach ($e in @($croot['assetTypes'] | Where-Object { $null -ne $_ })) {
|                $k = ([string]$e['siAssetType']).Trim().ToLowerInvariant()
|                $base = @($types | Where-Object { ([string]$_['siAssetType']).Trim().ToLowerInvariant() -eq $k }) | Select-Object -First 1
|                $m = if ($base) { $base } else { $n = [ordered]@{}; $types.Add($n); $n }
|                foreach ($f in @($e.Keys)) {
|                    # a null siMayCreate / expectedWithinDays says nothing (the loader inherits); a null ownedBy is meaningful
|                    if ($null -eq $e[$f] -and $f -in 'siMayCreate', 'expectedWithinDays', 'ciClass') { continue }
|                    $m[$f] = $e[$f]
|                }
|                $m['siAssetType'] = $k
|            }
|            $map['assetTypes'] = @($types.ToArray())
|            & $consider 'cmdbownership' 'map' (ConvertTo-SIProJson -Value $map) 'json' $oc
|        }
|    }
|    # ---- service model (wholesale) ----
|    $smc = Join-SIProPath $SIRoot 'config' 'service-model.custom.json'
|    if (Test-Path -LiteralPath $smc) {
|        $c = $null
|        try { $c = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson ([System.IO.File]::ReadAllText($smc))) } catch { $skipped.Add([pscustomobject]@{ Name = (& $rel $smc); Scope = 'item'; Reason = 'not valid JSON' }); (& $file $smc 'servicemodel').Complete = $false }
|        if ($c -and $c.Contains('serviceModel')) { & $consider 'servicemodel' 'model' (ConvertTo-SIProJson -Value $c['serviceModel']) 'json' $smc }
|    }
|    # ---- schema overlays ----
|    foreach ($e in 'endpoint', 'identity', 'azure', 'publicip') {
|        $base = if ($e -eq 'publicip') { 'public-ip' } else { $e }
|        $p = Join-SIProPath $SIRoot 'asset-profiling-schema' ('{0}.schema.custom.json' -f $base)
|        if (Test-Path -LiteralPath $p) { & $consider 'schemaoverlay' $e ([System.IO.File]::ReadAllText($p).TrimStart([char]0xFEFF)) 'json' $p }
|    }
|    # ---- decisions: one item per kind; the loaders ADD the tree and the overlay copy, so two files are not merged here ----
|    foreach ($d in @(@{ Key = 'asset'; File = 'asset-decisions.custom.yaml' }, @{ Key = 'correlation'; File = 'correlation-decisions.custom.yaml' })) {
|        $found = @(@((Join-SIProPath $SIRoot 'config' $d.File)) + @($(if ($OverlayRoot) { Join-SIProPath $OverlayRoot $d.File })) | Where-Object { $_ -and (Test-Path -LiteralPath $_) })
|        if ($found.Count -gt 1) {
|            foreach ($f in $found) { $skipped.Add([pscustomobject]@{ Name = 'decision/' + $d.Key; Scope = 'item'; Reason = ('{0}: the installation reads two {1} files and adds them up -- combine them into one and import again' -f (& $rel $f), $d.File) }); (& $file $f 'decision').Complete = $false }
|            continue
|        }
|        if ($found.Count -eq 1) { & $consider 'decision' $d.Key ([System.IO.File]::ReadAllText($found[0]).TrimStart([char]0xFEFF)) 'yaml' $found[0] }
|    }
|    # ---- weights: per-report files, and the model sections of the solution file ----
|    foreach ($f in @(Get-ChildItem -LiteralPath $rad -Filter '*.weighted.custom.json' -File -ErrorAction SilentlyContinue | Sort-Object Name)) {
|        $rep = $f.Name -replace '\.weighted\.custom\.json$', ''
|        $text = [System.IO.File]::ReadAllText($f.FullName).TrimStart([char]0xFEFF)
|        $o = $null; try { $o = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson $text) } catch { }
|        if ($o) {
|            $keep = [ordered]@{}; foreach ($k in @($o.Keys)) { if ($k -eq 'weightedRiskFactors' -or $k -eq '$schema' -or ([string]$k).StartsWith('_') -or $k -eq 'Comment') { $keep[$k] = $o[$k] } }
|            $other = @($o.Keys | Where-Object { -not $keep.Contains($_) })
|            if ($other.Count) { $skipped.Add([pscustomobject]@{ Name = 'weights/report/' + $rep + ' (other sections)'; Scope = 'item'; Info = $true; Reason = ('{0}: {1} -- a per-report file is read for weightedRiskFactors only; the other sections are not imported' -f $f.Name, ($other -join ', ')) }) }
|            $text = ConvertTo-SIProJson -Value $keep
|        }
|        & $consider 'weights' ('report/' + $rep) $text 'json' $f.FullName
|    }
|    $wf = Join-SIProPath $rad 'riskscore_weighted.schema.custom.json'
|    if (Test-Path -LiteralPath $wf) {
|        $o = $null; try { $o = ConvertTo-SIOrderedJson (ConvertFrom-SIProJson ([System.IO.File]::ReadAllText($wf))) } catch { }
|        if ($o) {
|            $model = [ordered]@{}; foreach ($k in @($o.Keys)) { if ($k -ne 'weightedRiskFactors' -and $k -ne '$schema' -and -not ([string]$k).StartsWith('_') -and $k -ne 'Comment') { $model[$k] = $o[$k] } }
|            if ($model.Count) { & $consider 'weights' 'model' (ConvertTo-SIProJson -Value $model) 'json' $wf }
|        }
|    }
|    [pscustomobject]@{ Rows = $rows.ToArray(); Skipped = $skipped.ToArray(); Same = $same.ToArray(); Files = @($files.Values); Info = $info.ToArray() }
|}
'@ }
$__siSupportFiles['engine/pro-settings/SI-TemplateVersioning.ps1'] = @{ Sha256 = 'cdc375e3908aab97993a91115673927df57854f2e151ec94a9df6af7f0b4d4dc'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- TEMPLATE VERSIONING (REQUIREMENTS §9.3.3 phase C, "align with PIM4EntraPS").
|
|    What a template SAYS, independent of how it is written, and the gate in front of every path that changes it.
|    Adopted from PIM4EntraPS's policy templates, with the lessons PIM paid for:
|
|      (a) ITEM IDENTITY = A NORMALISED CONTENT HASH (ContentHash). Comments, key order, `_*` keys and description-only
|          fields (description, comment, comments, notes, $schema) do not count, so a documentation edit is not a change.
|          BodyHash (the raw body's SHA-256) stays what it was: the integrity check at run start.
|      (b) An override whose BaseHash is not the current template's ContentHash is "UPGRADE AVAILABLE", shown with WHAT
|          changed (a structured diff of the normalised bodies). Never merged automatically.
|      (c) A FINGERPRINT GATE (the same gate PIM4EntraPS uses, on every update path, so a release never changes the
|          templates in force unseen). Publishing templates compares the template-set fingerprint with the one recorded on the
|          install (cfg.InstallState 'TemplateFingerprint'); a moved fingerprint needs -AcceptTemplateChange, otherwise
|          the run is a plan. The fingerprint is recorded only AFTER a publish is read back and verified.
|      (d) The approver is the identity of the session (Get-SIProSessionActor), never a parameter or a request field.
|      (e) A conformance view per item and per install: UpToDate / Overridden / Disabled / UpgradeAvailable / Own / Retired.
|
|    Everything here except the store readers / writers is pure (rows in, objects out) and tested directly.
|    PS 5.1 safe.
|#>
|
|# Keys that describe an item and never change what it does (compared case-insensitively). `_*` keys are dropped too.
|$script:SIProDocOnlyKeys = @('description', 'comment', 'comments', 'notes', '$schema')
|# The conformance states (the web app's Conformance.States is the same list in the same order).
|$script:SIProConformanceStates = @('UpToDate', 'Overridden', 'Disabled', 'UpgradeAvailable', 'Own', 'Retired')
|# cfg.InstallState names.
|$script:SIProFingerprintName = 'TemplateFingerprint'
|# #251 (operator decision 2026-10-04): kinds that WERE templates and are configuration now. Their cfg.Template rows are
|# retired by setup (never removed -- history) and count nowhere: not in the fingerprint, not in conformance, not in a pack.
|#   naming         the names of tables, DCRs, DCE and workspace are settings (cfg.Setting); the catalog default is the default
|#   cmdbownership  the CMDB ownership map is the customer's configuration (cfg.ItemOverride cmdbownership/map)
|$script:SIProFormerTemplateKinds = @('naming', 'cmdbownership')
|
|function Get-SIProConformanceStates { $script:SIProConformanceStates }
|function Get-SIProFormerTemplateKinds { $script:SIProFormerTemplateKinds }
|function Test-SIProFormerTemplateKind {
|    <# PURE. Is this kind one that was a template and is configuration now (#251)? #>
|    param([AllowEmptyString()][AllowNull()][string]$Kind)
|    $script:SIProFormerTemplateKinds -contains [string]$Kind
|}
|
|# =====================================================================================================================
|#  (a) NORMALISED CONTENT
|# =====================================================================================================================
|function Test-SIProDocOnlyKey {
|    <# PURE. Is this key documentation only? #>
|    param([AllowEmptyString()][string]$Key)
|    if ($Key.StartsWith('_')) { return $true }
|    $script:SIProDocOnlyKeys -contains $Key.ToLowerInvariant()
|}
|
|function ConvertTo-SIProContentValue {
|    <# PURE. A parsed value with every documentation-only key removed, at any depth (objects -> ordered dictionaries). #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [string] -or $Value -is [ValueType]) { return $Value }
|    $pairs = $null
|    if ($Value -is [System.Collections.IDictionary]) { $pairs = @(foreach ($k in $Value.get_Keys()) { , @([string]$k, $Value[$k]) }) }
|    elseif ($Value -is [System.Management.Automation.PSCustomObject]) { $pairs = @(foreach ($p in $Value.PSObject.Properties) { , @($p.Name, $p.Value) }) }
|    if ($null -ne $pairs) {
|        $o = [ordered]@{}
|        foreach ($p in $pairs) { if (-not (Test-SIProDocOnlyKey $p[0])) { $o[$p[0]] = ConvertTo-SIProContentValue $p[1] } }
|        return $o
|    }
|    if ($Value -is [System.Collections.IEnumerable]) {
|        $list = New-Object System.Collections.Generic.List[object]
|        foreach ($v in $Value) { $list.Add((ConvertTo-SIProContentValue $v)) }
|        return , $list.ToArray()
|    }
|    $Value
|}
|
|function ConvertFrom-SIProBody {
|    <# The parsed body (JSON or YAML) -- throws when it does not parse. #>
|    param([AllowEmptyString()][string]$Body, [string]$Format = 'json')
|    $t = ([string]$Body).TrimStart([char]0xFEFF)
|    if ($Format -eq 'yaml') {
|        # SecurityInsight's own YAML reader (no powershell-yaml module); -Ordered keeps key order like before.
|        if (-not (Get-Command -Name ConvertFrom-SIYaml -ErrorAction SilentlyContinue)) {
|            . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-Yaml.ps1'))
|        }
|        return (ConvertFrom-SIYaml -Yaml $t -Ordered)
|    }
|    ConvertFrom-SIProJson $t
|}
|
|function Get-SIProContentText {
|    <#
|        PURE. What an item DOES, as one canonical JSON text: parsed (JSON or YAML -- YAML comments are gone with the
|        parse), documentation-only keys dropped at every depth, object keys in ordinal order, compact. A body that does
|        not parse falls back to its text with line endings and trailing spaces normalised and comment lines removed --
|        so even then a comment edit is not a change.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Body, [string]$Format = 'json')
|    if ($null -eq $Body) { $Body = '' }
|    try { return (ConvertTo-SIProJson -Value (ConvertTo-SIProContentValue (ConvertFrom-SIProBody -Body $Body -Format $Format)) -Canonical) }
|    catch {
|        $t = $Body.TrimStart([char]0xFEFF) -replace "`r`n", "`n" -replace "`r", "`n"
|        return ((($t -split "`n") | ForEach-Object { $_.TrimEnd() } | Where-Object { $_ -notmatch '^\s*(#|//)' -and $_ -ne '' }) -join "`n").Trim()
|    }
|}
|
|function Get-SIProContentHash {
|    <# PURE. SHA-256 (hex) of the normalised content (Get-SIProContentText). #>
|    param([AllowEmptyString()][AllowNull()][string]$Body, [string]$Format = 'json')
|    Get-SIProTextHash (Get-SIProContentText -Body $Body -Format $Format)
|}
|
|function Get-SIProRowContentHash {
|    <# A template row's ContentHash: the stored one, else computed from its body (a row published before the column). #>
|    param($Row)
|    $h = [string](Get-SIProRowValue $Row 'ContentHash')
|    if ($h.Trim()) { return $h.Trim() }
|    $fmt = [string](Get-SIProRowValue $Row 'Format'); if (-not $fmt) { $fmt = 'json' }
|    Get-SIProContentHash -Body ([string](Get-SIProRowValue $Row 'BodyJson')) -Format $fmt
|}
|
|# =====================================================================================================================
|#  (b) WHAT CHANGED -- a structured diff of two normalised bodies
|# =====================================================================================================================
|function Get-SIProContentDiff {
|    <#
|        PURE. The differences between two bodies of one item, after normalisation, as a list of
|        @{ Path; Change = added | removed | changed; Old; New } -- Path like 'detections[0].set.Tier', Old / New as compact
|        JSON. Objects compare by key (ordinal), lists by position. Identical content = an empty list, however the two are
|        written. A body that does not parse is compared as a whole ('(body)').
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Old, [AllowEmptyString()][AllowNull()][string]$New, [string]$Format = 'json')
|    $out = New-Object System.Collections.Generic.List[object]
|    $parse = {
|        param([string]$b)
|        if ([string]::IsNullOrEmpty($b)) { return @{ Ok = $true; Value = $null } }
|        try { @{ Ok = $true; Value = (ConvertTo-SIProContentValue (ConvertFrom-SIProBody -Body $b -Format $Format)) } } catch { @{ Ok = $false; Value = $null } }
|    }
|    $a = & $parse $Old; $b = & $parse $New
|    if (-not $a.Ok -or -not $b.Ok) {
|        $x = Get-SIProContentText -Body $Old -Format $Format; $y = Get-SIProContentText -Body $New -Format $Format
|        if ($x -cne $y) { $out.Add([pscustomobject]@{ Path = '(body)'; Change = 'changed'; Old = $x; New = $y }) }
|        return $out.ToArray()
|    }
|    $json = { param($v) ConvertTo-SIProJson -Value $v -Canonical }
|    $isObj = { param($v) $v -is [System.Collections.IDictionary] }
|    $isList = { param($v) ($null -ne $v) -and ($v -is [System.Collections.IEnumerable]) -and ($v -isnot [string]) -and -not ($v -is [System.Collections.IDictionary]) }
|    $walk = $null
|    $walk = {
|        param([string]$path, $x, $y)
|        if ((& $isObj $x) -and (& $isObj $y)) {
|            $keys = New-Object System.Collections.Generic.List[string]
|            foreach ($k in $x.get_Keys()) { $keys.Add([string]$k) }
|            foreach ($k in $y.get_Keys()) { if (-not $keys.Contains([string]$k)) { $keys.Add([string]$k) } }
|            $ka = $keys.ToArray(); [Array]::Sort($ka, [System.StringComparer]::Ordinal)
|            foreach ($k in $ka) {
|                $p = if ($path) { '{0}.{1}' -f $path, $k } else { $k }
|                if (-not $x.Contains($k)) { $out.Add([pscustomobject]@{ Path = $p; Change = 'added'; Old = $null; New = (& $json $y[$k]) }); continue }
|                if (-not $y.Contains($k)) { $out.Add([pscustomobject]@{ Path = $p; Change = 'removed'; Old = (& $json $x[$k]); New = $null }); continue }
|                & $walk $p $x[$k] $y[$k]
|            }
|            return
|        }
|        if ((& $isList $x) -and (& $isList $y)) {
|            $xa = @($x); $ya = @($y)
|            $n = [Math]::Max($xa.Count, $ya.Count)
|            for ($i = 0; $i -lt $n; $i++) {
|                $p = '{0}[{1}]' -f $path, $i
|                if ($i -ge $xa.Count) { $out.Add([pscustomobject]@{ Path = $p; Change = 'added'; Old = $null; New = (& $json $ya[$i]) }); continue }
|                if ($i -ge $ya.Count) { $out.Add([pscustomobject]@{ Path = $p; Change = 'removed'; Old = (& $json $xa[$i]); New = $null }); continue }
|                & $walk $p $xa[$i] $ya[$i]
|            }
|            return
|        }
|        $jx = & $json $x; $jy = & $json $y
|        if ($jx -cne $jy) { $out.Add([pscustomobject]@{ Path = $(if ($path) { $path } else { '(value)' }); Change = 'changed'; Old = $jx; New = $jy }) }
|    }
|    & $walk '' $a.Value $b.Value
|    $out.ToArray()
|}
|
|# =====================================================================================================================
|#  (b2) ADDITIVE UPGRADE OF AN OVERRIDDEN ITEM (#529, adopted from PIM4EntraPS: "missing blocks / notification rules are
|#       added, existing values never touched")
|# =====================================================================================================================
|function ConvertTo-SIProMutableValue {
|    <# PURE. A parsed value as ordered dictionaries and ArrayLists (every key kept, documentation keys too), so additions can
|       be put into it. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [string] -or $Value -is [ValueType]) { return $Value }
|    $pairs = $null
|    if ($Value -is [System.Collections.IDictionary]) { $pairs = @(foreach ($k in $Value.get_Keys()) { , @([string]$k, $Value[$k]) }) }
|    elseif ($Value -is [System.Management.Automation.PSCustomObject]) { $pairs = @(foreach ($p in $Value.PSObject.Properties) { , @($p.Name, $p.Value) }) }
|    if ($null -ne $pairs) {
|        $o = [ordered]@{}
|        foreach ($p in $pairs) { $o[$p[0]] = ConvertTo-SIProMutableValue $p[1] }
|        return $o
|    }
|    if ($Value -is [System.Collections.IEnumerable]) {
|        $list = New-Object System.Collections.ArrayList
|        foreach ($v in $Value) { [void]$list.Add((ConvertTo-SIProMutableValue $v)) }
|        return , $list
|    }
|    $Value
|}
|
|function Get-SIProAdditiveMerge {
|    <#
|        PURE. Can the new shipped body of an item reach the customer's override WITHOUT touching anything the customer has?
|        -Base     the shipped body the override was made against (cfg.TemplateRevision at the override's BaseHash)
|        -Current  the shipped body now (cfg.Template)
|        -Override the customer's body (cfg.ItemOverride)
|        The vendor's change Base -> Current is compared after normalisation (documentation-only keys do not count). It is
|        ADDITIVE when it only adds: a new key in an object, new entries in a list (Base's entries all still there, in the
|        same order -- new ones may sit anywhere between them). Then every addition is put into the customer's body:
|          * a new key the customer's object does not have        -> added (Added)
|          * a new key the customer already has (their own value) -> theirs is kept, untouched (Kept)
|          * a new list entry the customer's list does not hold   -> appended to their list (Added)
|          * a new list entry the customer's list already holds   -> nothing to do (Kept)
|          * an addition whose place the customer removed (the parent object / list is gone or is another type) -> the
|            upgrade is NOT additive for this override: the customer reviews it (UpgradeAvailable), as before.
|        Anything the vendor CHANGED or REMOVED makes the upgrade not additive -- nothing is merged, the item stays
|        UpgradeAvailable. Only JSON items are merged (a YAML tier rule keeps its own text, comments and all).
|        Returns @{ Additive; Changed (the body differs from the override); Body (the merged JSON, or the override as it
|        was); Added; Kept (paths); Reason (why not additive, '' when it is) }.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Base, [AllowEmptyString()][AllowNull()][string]$Current,
|          [AllowEmptyString()][AllowNull()][string]$Override, [string]$Format = 'json')
|    $no = { param([string]$why) [pscustomobject]@{ Additive = $false; Changed = $false; Body = $Override; Added = @(); Kept = @(); Reason = $why } }
|    if ($Format -ne 'json') { return (& $no 'a YAML item is never merged automatically -- review the new version') }
|    if ([string]::IsNullOrWhiteSpace($Base)) { return (& $no 'the shipped version your change was made on is not known') }
|    try {
|        $bRaw = ConvertFrom-SIProJson $Base; $cRaw = ConvertFrom-SIProJson $Current; $oRaw = ConvertFrom-SIProJson $Override
|    } catch { return (& $no ('a body is not valid JSON: ' + $_.Exception.Message)) }
|    $st = @{ Fail = ''; Added = (New-Object System.Collections.Generic.List[string]); Kept = (New-Object System.Collections.Generic.List[string]) }
|    $canon = { param($v) ConvertTo-SIProJson -Value (ConvertTo-SIProContentValue $v) -Canonical }
|    $isObj = { param($v) $v -is [System.Collections.IDictionary] }
|    $isList = { param($v) ($null -ne $v) -and ($v -is [System.Collections.IEnumerable]) -and ($v -isnot [string]) -and -not ($v -is [System.Collections.IDictionary]) }
|    $b = ConvertTo-SIProContentValue $bRaw
|    $c = ConvertTo-SIProContentValue $cRaw
|    $cm = ConvertTo-SIProMutableValue $cRaw      # what is added: the shipped entry as shipped (its description too)
|    $o = ConvertTo-SIProMutableValue $oRaw
|    $walk = $null
|    $walk = {
|        # x = base (normalised), y = current (normalised), ym = current (mutable, every key), t = the customer's value here
|        # ($null when the customer has nothing here: then nothing below may be ADDED, only compared)
|        param([string]$path, $x, $y, $ym, $t, [bool]$hasT)
|        if ($st.Fail) { return }
|        $show = if ($path) { $path } else { '(item)' }
|        if ((& $isObj $x) -and (& $isObj $y)) {
|            foreach ($k in @($x.get_Keys())) {
|                if (-not $y.Contains($k)) { $st.Fail = ("'{0}' was removed from the shipped version" -f $(if ($path) { "$path.$k" } else { $k })); return }
|            }
|            $tObj = $hasT -and (& $isObj $t)
|            foreach ($k in @($y.get_Keys())) {
|                $p = if ($path) { '{0}.{1}' -f $path, $k } else { [string]$k }
|                $ymk = $ym[$k]
|                if ($x.Contains($k)) {
|                    $tk = $null; $has = $false
|                    if ($tObj -and $t.Contains($k)) { $tk = $t[$k]; $has = $true }
|                    & $walk $p $x[$k] $y[$k] $ymk $tk $has
|                    if ($st.Fail) { return }
|                    continue
|                }
|                # a key the vendor added
|                if (-not $tObj) { $st.Fail = ("the shipped version adds '{0}', but your version has no '{1}' to add it to" -f $p, $show); return }
|                if ($t.Contains($k)) { $st.Kept.Add($p) } else { $t[$k] = $ymk; $st.Added.Add($p) }
|            }
|            return
|        }
|        if ((& $isList $x) -and (& $isList $y)) {
|            $xa = @($x); $ya = @($y); $yma = @($ym)
|            $xc = @($xa | ForEach-Object { & $canon $_ }); $yc = @($ya | ForEach-Object { & $canon $_ })
|            # Base's entries, in order, inside Current: the rest of Current are the vendor's new entries
|            $j = 0; $new = New-Object System.Collections.Generic.List[int]
|            for ($i = 0; $i -lt $ya.Count; $i++) { if ($j -lt $xa.Count -and $yc[$i] -ceq $xc[$j]) { $j++ } else { $new.Add($i) } }
|            if ($j -eq $xa.Count) {
|                if ($new.Count -eq 0) { return }
|                if (-not ($hasT -and (& $isList $t))) { $st.Fail = ("the shipped version adds entries to '{0}', but your version has no list there" -f $show); return }
|                $tc = New-Object System.Collections.Generic.List[string]; foreach ($e in $t) { $tc.Add((& $canon $e)) }
|                foreach ($i in $new) {
|                    $p = '{0}[{1}]' -f $path, $i
|                    if ($tc.Contains($yc[$i])) { $st.Kept.Add($p) } else { [void]$t.Add($yma[$i]); $tc.Add($yc[$i]); $st.Added.Add($p) }
|                }
|                return
|            }
|            # the same entries, changed inside: only additions inside each entry are allowed, and only when the customer's
|            # list still lines up with the shipped one (same length) -- else the entry cannot be found safely
|            if ($xa.Count -ne $ya.Count) { $st.Fail = ("entries of '{0}' were changed or removed in the shipped version" -f $show); return }
|            $tList = $hasT -and (& $isList $t) -and (@($t).Count -eq $xa.Count)
|            for ($i = 0; $i -lt $xa.Count; $i++) {
|                if ($xc[$i] -ceq $yc[$i]) { continue }
|                if (-not $tList) { $st.Fail = ("an entry of '{0}' changed in the shipped version and your list does not line up with it" -f $show); return }
|                & $walk ('{0}[{1}]' -f $path, $i) $xa[$i] $ya[$i] $yma[$i] $t[$i] $true
|                if ($st.Fail) { return }
|            }
|            return
|        }
|        if ((& $canon $x) -cne (& $canon $y)) { $st.Fail = ("'{0}' changed in the shipped version" -f $show) }
|    }
|    & $walk '' $b $c $cm $o $true
|    if ($st.Fail) { return (& $no $st.Fail) }
|    $added = $st.Added.ToArray(); $kept = $st.Kept.ToArray()
|    $body = if ($added.Count) { ConvertTo-SIProJson -Value $o } else { $Override }
|    [pscustomobject]@{ Additive = $true; Changed = ($added.Count -gt 0); Body = $body; Added = $added; Kept = $kept; Reason = '' }
|}
|
|function Get-SIProRevisionIndex {
|    <# PURE. cfg.TemplateRevision rows indexed by '<kind>/<key>#<hash>' -- by their ContentHash AND by the SHA-256 of their
|       body (an override made before content hashes recorded the raw BodyHash as its base). #>
|    param([AllowEmptyCollection()][object[]]$Revisions = @())
|    $rev = @{}
|    foreach ($r in @($Revisions | Where-Object { $_ })) {
|        $n = '{0}/{1}' -f (Get-SIProRowValue $r 'Kind'), (Get-SIProRowValue $r 'ItemKey')
|        $ch = ([string](Get-SIProRowValue $r 'ContentHash')).Trim()
|        if ($ch) { $rev[('{0}#{1}' -f $n, $ch)] = $r }
|        $bh = Get-SIProTextHash ([string](Get-SIProRowValue $r 'BodyJson'))
|        if (-not $rev.ContainsKey(('{0}#{1}' -f $n, $bh))) { $rev[('{0}#{1}' -f $n, $bh)] = $r }
|    }
|    $rev
|}
|
|function Read-SIProOverrideBaseRevisions {
|    <# The cfg.TemplateRevision rows of the items whose override is behind the shipped content -- the bodies an additive
|       upgrade compares (only those, never every revision). Empty without the versioning schema. #>
|    param([Parameter(Mandatory)]$Store)
|    $inner = "SELECT r.Kind, r.ItemKey, r.ContentHash, r.[Version] AS TemplateVersion, r.BodyJson, r.Format FROM cfg.TemplateRevision r JOIN cfg.ItemOverride o ON o.Kind = r.Kind AND o.ItemKey = r.ItemKey JOIN cfg.Template t ON t.Kind = o.Kind AND t.ItemKey = o.ItemKey WHERE o.State = N''override'' AND o.BaseHash IS NOT NULL AND o.BaseHash <> COALESCE(t.ContentHash, N'''') AND o.BaseHash <> t.BodyHash"
|    $sql = "IF OBJECT_ID('cfg.TemplateRevision') IS NOT NULL AND OBJECT_ID('cfg.ItemOverride') IS NOT NULL AND COL_LENGTH('cfg.Template', 'ContentHash') IS NOT NULL EXEC (N'$inner')"
|    & $Store.Invoke $sql @{} 'reader' | ForEach-Object { $_ }
|}
|
|# =====================================================================================================================
|#  (c) THE TEMPLATE-SET FINGERPRINT AND THE GATE
|# =====================================================================================================================
|function Get-SIProTemplateSetFingerprint {
|    <#
|        PURE. ONE hash for the whole set of templates in force: SHA-256 over '<kind>/<key>=<ContentHash>' of every live
|        (not retired) row, ordinal order, newline-joined. '' for an empty set. Only CONTENT counts: a comment, a version
|        stamp, a sort order or a source path does not move it.
|        #251: rows of a former template kind (naming, cmdbownership) do not count -- they are configuration now. -AllKinds
|        counts them as the fingerprint did before (to recognise a fingerprint recorded under the old definition).
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [switch]$AllKinds)
|    $lines = New-Object System.Collections.Generic.List[string]
|    foreach ($r in @($Rows | Where-Object { $_ })) {
|        if ($null -ne (Get-SIProRowValue $r 'RetiredAt')) { continue }
|        if (-not $AllKinds -and (Test-SIProFormerTemplateKind ([string](Get-SIProRowValue $r 'Kind')))) { continue }
|        $lines.Add(('{0}/{1}={2}' -f (Get-SIProRowValue $r 'Kind'), (Get-SIProRowValue $r 'ItemKey'), (Get-SIProRowContentHash $r)))
|    }
|    if ($lines.Count -eq 0) { return '' }
|    $a = $lines.ToArray(); [Array]::Sort($a, [System.StringComparer]::Ordinal)
|    Get-SIProTextHash ($a -join "`n")
|}
|
|function Get-SIProPlannedTemplateSet {
|    <#
|        PURE. The live template set AFTER a publish plan is applied to -Existing: existing rows the plan does not touch,
|        plus every inserted / updated / revived / unchanged row, minus the retired ones. What the fingerprint gate
|        compares with the recorded fingerprint, and what the verification after the write must read back.
|    #>
|    param([AllowEmptyCollection()][object[]]$Existing = @(), [AllowEmptyCollection()][object[]]$Plan = @())
|    $set = [ordered]@{}
|    foreach ($e in @($Existing | Where-Object { $_ })) {
|        if ($null -ne (Get-SIProRowValue $e 'RetiredAt')) { continue }
|        $set[('{0}/{1}' -f (Get-SIProRowValue $e 'Kind'), (Get-SIProRowValue $e 'ItemKey'))] = $e
|    }
|    foreach ($p in @($Plan | Where-Object { $_ })) {
|        $name = '{0}/{1}' -f $p.Kind, $p.ItemKey
|        if ($p.Action -eq 'retire') { if ($set.Contains($name)) { $set.Remove($name) }; continue }
|        if ($p.Row) { $set[$name] = $p.Row }
|    }
|    @($set.Values)
|}
|
|function Get-SIProTemplateChanges {
|    <#
|        PURE. The items whose CONTENT a publish plan changes (what the operator accepts with -AcceptTemplateChange):
|        new, retired, revived, and updated with a different ContentHash. A body edit that only touched comments or
|        descriptions is not listed.
|    #>
|    param([AllowEmptyCollection()][object[]]$Existing = @(), [AllowEmptyCollection()][object[]]$Plan = @())
|    $have = @{}; foreach ($e in @($Existing | Where-Object { $_ })) { $have[('{0}/{1}' -f (Get-SIProRowValue $e 'Kind'), (Get-SIProRowValue $e 'ItemKey'))] = $e }
|    foreach ($p in @($Plan | Where-Object { $_ })) {
|        $name = '{0}/{1}' -f $p.Kind, $p.ItemKey
|        switch ($p.Action) {
|            'insert' { [pscustomobject]@{ Name = $name; Change = 'new'; Kind = $p.Kind; ItemKey = $p.ItemKey } }
|            'retire' { [pscustomobject]@{ Name = $name; Change = 'retired'; Kind = $p.Kind; ItemKey = $p.ItemKey } }
|            'revive' { [pscustomobject]@{ Name = $name; Change = 'revived'; Kind = $p.Kind; ItemKey = $p.ItemKey } }
|            'update' {
|                $e = $have[$name]
|                if (-not $e -or (Get-SIProRowContentHash $e) -ne (Get-SIProRowContentHash $p.Row)) { [pscustomobject]@{ Name = $name; Change = 'changed'; Kind = $p.Kind; ItemKey = $p.ItemKey } }
|            }
|        }
|    }
|}
|
|function Get-SIProTemplateUpgrades {
|    <#
|        PURE. #529 (3) -- the items a publish plan UPGRADES in place: a live template whose content changes, and which the
|        customer follows (no override row, or 'inherit'). One @{ Name; Kind; ItemKey; FromVersion; ToVersion; FromHash;
|        ToHash } each. Invoke-SITemplatePublish writes the same rule as SQL (an "upgraded" cfg.ChangeLog row per item, Scope
|        'item', in the publish transaction); this is what a plan prints and what the tests hold the writer to.
|        An overridden or switched-off item is not listed: it does not follow the template (conformance says what it does).
|    #>
|    param([AllowEmptyCollection()][object[]]$Existing = @(), [AllowEmptyCollection()][object[]]$Plan = @(), [AllowEmptyCollection()][object[]]$Overrides = @())
|    $have = @{}; foreach ($e in @($Existing | Where-Object { $_ })) { $have[('{0}/{1}' -f (Get-SIProRowValue $e 'Kind'), (Get-SIProRowValue $e 'ItemKey'))] = $e }
|    $own = @{}; foreach ($o in @($Overrides | Where-Object { $_ })) { if ([string](Get-SIProRowValue $o 'State') -in 'override', 'disable') { $own[('{0}/{1}' -f (Get-SIProRowValue $o 'Kind'), (Get-SIProRowValue $o 'ItemKey'))] = $true } }
|    foreach ($p in @($Plan | Where-Object { $_ -and $_.Action -eq 'update' -and $_.Row })) {
|        $name = '{0}/{1}' -f $p.Kind, $p.ItemKey
|        $e = $have[$name]
|        if (-not $e -or $null -ne (Get-SIProRowValue $e 'RetiredAt') -or $own.ContainsKey($name)) { continue }
|        $from = ([string](Get-SIProRowValue $e 'ContentHash')).Trim()
|        if (-not $from) { continue }   # published before content hashes: nothing to compare (the writer skips it too)
|        $to = Get-SIProRowContentHash $p.Row
|        if ($from -eq $to) { continue }
|        [pscustomobject]@{ Name = $name; Kind = $p.Kind; ItemKey = $p.ItemKey
|            FromVersion = [string](Get-SIProRowValue $e 'TemplateVersion'); ToVersion = [string](Get-SIProRowValue $p.Row 'TemplateVersion'); FromHash = $from; ToHash = $to }
|    }
|}
|
|function Get-SIProTemplateGateDecision {
|    <#
|        PURE. May a publish whose result is -Expected go ahead on an install that recorded -Recorded?
|          Initial   nothing recorded and no templates yet -- the first publish of an install; allowed.
|          Same      the content in force does not change; allowed (a comment-only refresh writes without acceptance).
|          Moved     the content changes: allowed only with -Accept, and when -AcceptFingerprint is given only for
|                    exactly that fingerprint (an acceptance names WHAT it accepts -- never a standing blank cheque).
|        -Current: the fingerprint of the templates in the database now; it stands in for -Recorded on an install that
|        published before the fingerprint was recorded.
|    #>
|    param([AllowEmptyString()][string]$Recorded, [AllowEmptyString()][string]$Current, [AllowEmptyString()][string]$Expected,
|          [switch]$Accept, [AllowEmptyString()][string]$AcceptFingerprint)
|    $base = if ($Recorded) { $Recorded } else { $Current }
|    $short = { param($f) if ($f) { $f.Substring(0, [Math]::Min(12, $f.Length)) } else { '(none)' } }
|    if (-not $base) {
|        return [pscustomobject]@{ Allowed = $true; Moved = $false; Initial = $true; Baseline = ''; Expected = $Expected
|            Reason = ('first publish on this install -- the template fingerprint {0} becomes the baseline' -f (& $short $Expected)) }
|    }
|    if ($base -eq $Expected) {
|        return [pscustomobject]@{ Allowed = $true; Moved = $false; Initial = $false; Baseline = $base; Expected = $Expected
|            Reason = ('the templates in force do not change (fingerprint {0})' -f (& $short $Expected)) }
|    }
|    $note = if ($Recorded) { 'recorded' } else { 'in the database (nothing recorded yet)' }
|    if (-not $Accept) {
|        return [pscustomobject]@{ Allowed = $false; Moved = $true; Initial = $false; Baseline = $base; Expected = $Expected
|            Reason = ('the templates in force would change: fingerprint {0} {1} -> {2}. Nothing is written without -AcceptTemplateChange.' -f (& $short $base), $note, (& $short $Expected)) }
|    }
|    if ($AcceptFingerprint -and $AcceptFingerprint.Length -ge 12 -and $Expected.StartsWith($AcceptFingerprint, [StringComparison]::OrdinalIgnoreCase)) {
|        return [pscustomobject]@{ Allowed = $true; Moved = $true; Initial = $false; Baseline = $base; Expected = $Expected
|            Reason = ('template change accepted for fingerprint {0}' -f (& $short $Expected)) }
|    }
|    if ($AcceptFingerprint) {
|        return [pscustomobject]@{ Allowed = $false; Moved = $true; Initial = $false; Baseline = $base; Expected = $Expected
|            Reason = ('the acceptance names fingerprint {0}, but this publish would put {1} in force -- review the new plan and accept that one' -f (& $short $AcceptFingerprint), (& $short $Expected)) }
|    }
|    [pscustomobject]@{ Allowed = $true; Moved = $true; Initial = $false; Baseline = $base; Expected = $Expected
|        Reason = ('template change accepted: fingerprint {0} -> {1}' -f (& $short $base), (& $short $Expected)) }
|}
|
|# =====================================================================================================================
|#  (d) THE ACTOR IS THE SESSION
|# =====================================================================================================================
|function Get-SIProSessionActor {
|    <#
|        The identity this process runs as -- what cfg.ChangeLog records for a publish, an acceptance or an
|        acknowledgement. Never taken from a parameter, a file or a request: the record names who really acted. In a container: the managed identity (its client id when the platform says) or the
|        engine application; on Windows: the signed-in Windows account; elsewhere: the operating-system user.
|    #>
|    if ($global:SI_UseManagedIdentity) {
|        $cid = [Environment]::GetEnvironmentVariable('AZURE_CLIENT_ID')
|        if ($cid) { return ('managed identity {0}' -f $cid) }
|        return 'managed identity'
|    }
|    try {
|        if ([System.Environment]::OSVersion.Platform -eq [System.PlatformID]::Win32NT) {
|            $w = [System.Security.Principal.WindowsIdentity]::GetCurrent()
|            if ($w -and $w.Name) { return $w.Name }
|        }
|    } catch { }
|    [System.Environment]::UserName
|}
|
|# =====================================================================================================================
|#  (e) CONFORMANCE -- per item and per install
|# =====================================================================================================================
|function Get-SIProConformanceState {
|    <#
|        PURE. One item's state:
|          Own               the customer's item -- no template (or a retired template the customer still overrides)
|          Retired           the template is retired and the customer does not override it (the item is not applied)
|          Disabled          the customer switched the template item off
|          UpToDate          no override (or 'inherit') -- the template as published
|          Overridden        the customer's own body, made against the CURRENT template content
|          UpgradeAvailable  the customer's own body, made against an OLDER template content (or before the vendor
|                            shipped one) -- review what changed, then take the template or keep yours
|        BaseHash may be the ContentHash (from now on) or the raw BodyHash (overrides made before content hashes).
|    #>
|    param([bool]$HasTemplate, [bool]$Retired, [AllowEmptyString()][string]$State, [AllowEmptyString()][string]$BaseHash,
|          [AllowEmptyString()][string]$ContentHash, [AllowEmptyString()][string]$BodyHash)
|    if (-not $HasTemplate) { return 'Own' }
|    if ($Retired) { if ($State -eq 'override') { return 'Own' } else { return 'Retired' } }
|    if ($State -eq 'disable') { return 'Disabled' }
|    if ($State -ne 'override') { return 'UpToDate' }
|    $b = ([string]$BaseHash).Trim()
|    if ($b -and ($b -eq ([string]$ContentHash).Trim() -or $b -eq ([string]$BodyHash).Trim())) { return 'Overridden' }
|    'UpgradeAvailable'
|}
|
|function Get-SIProConformance {
|    <#
|        PURE. The conformance view. -Templates (cfg.Template rows), -Overrides (cfg.ItemOverride rows), -Revisions
|        (cfg.TemplateRevision rows: the template body each BaseHash was made against), -Recorded (the install's recorded
|        fingerprint). Returns @{ Items; Summary }:
|          Items    one per item: Kind, ItemKey, State, TemplateVersion, BaseVersion, ContentHash, BaseHash, and for
|                   UpgradeAvailable: TemplateChanges (base template -> current template) and YourChanges (current
|                   template -> your body), each a Get-SIProContentDiff list; BaseKnown says whether the base body was
|                   found (an override made before revisions were kept has none -- then only YourChanges is shown).
|          Summary  the per-install view: Counts per state (every state present, 0 when none), Total, UpgradeAvailable,
|                   Conformant (no upgrade waiting), Fingerprint (of the templates in force) and Recorded.
|    #>
|    param([AllowEmptyCollection()][object[]]$Templates = @(), [AllowEmptyCollection()][object[]]$Overrides = @(),
|          [AllowEmptyCollection()][object[]]$Revisions = @(), [AllowEmptyString()][string]$Recorded, [switch]$NoDiff)
|    # #251: naming and CMDB ownership are configuration, not templates -- they are not part of the conformance view.
|    $Templates = @($Templates | Where-Object { $_ -and -not (Test-SIProFormerTemplateKind ([string](Get-SIProRowValue $_ 'Kind'))) })
|    $Overrides = @($Overrides | Where-Object { $_ -and -not (Test-SIProFormerTemplateKind ([string](Get-SIProRowValue $_ 'Kind'))) })
|    $tpl = @{}; foreach ($t in @($Templates | Where-Object { $_ })) { $tpl[('{0}/{1}' -f (Get-SIProRowValue $t 'Kind'), (Get-SIProRowValue $t 'ItemKey'))] = $t }
|    $ovr = @{}; foreach ($o in @($Overrides | Where-Object { $_ })) { $ovr[('{0}/{1}' -f (Get-SIProRowValue $o 'Kind'), (Get-SIProRowValue $o 'ItemKey'))] = $o }
|    # #529: by ContentHash and by the raw body hash (an override made before content hashes recorded the BodyHash)
|    $rev = Get-SIProRevisionIndex -Revisions @($Revisions)
|    $names = New-Object System.Collections.Generic.List[string]
|    foreach ($k in $tpl.Keys) { $names.Add($k) }
|    foreach ($k in $ovr.Keys) { if (-not $tpl.ContainsKey($k)) { $names.Add($k) } }
|    $na = $names.ToArray(); [Array]::Sort($na, [System.StringComparer]::Ordinal)
|    $counts = [ordered]@{}; foreach ($s in $script:SIProConformanceStates) { $counts[$s] = 0 }
|    $items = foreach ($name in $na) {
|        $t = $tpl[$name]; $o = $ovr[$name]
|        $row = if ($t) { $t } else { $o }
|        $kind = [string](Get-SIProRowValue $row 'Kind'); $key = [string](Get-SIProRowValue $row 'ItemKey')
|        $fmt = [string](Get-SIProRowValue $row 'Format'); if (-not $fmt) { $fmt = 'json' }
|        $ch = if ($t) { Get-SIProRowContentHash $t } else { '' }
|        $bh = if ($t) { ([string](Get-SIProRowValue $t 'BodyHash')).Trim() } else { '' }
|        $st = if ($o) { [string](Get-SIProRowValue $o 'State') } else { '' }
|        $base = if ($o) { ([string](Get-SIProRowValue $o 'BaseHash')).Trim() } else { '' }
|        $state = Get-SIProConformanceState -HasTemplate ([bool]$t) -Retired ([bool]($t -and $null -ne (Get-SIProRowValue $t 'RetiredAt'))) -State $st -BaseHash $base -ContentHash $ch -BodyHash $bh
|        # #529 (1): an override behind a shipped version that only ADDS is merged at run start (Merge-SIProItems) -- it reads
|        # "Overridden -- new shipped additions applied", not "upgrade available". Anything changed or removed stays as before.
|        $addApplied = $false; $additions = @(); $notAdditive = ''
|        $b = if ($state -eq 'UpgradeAvailable' -and $base) { $rev[('{0}#{1}' -f $name, $base)] } else { $null }
|        if ($state -eq 'UpgradeAvailable') {
|            if ($b) {
|                $am = Get-SIProAdditiveMerge -Base ([string](Get-SIProRowValue $b 'BodyJson')) -Current ([string](Get-SIProRowValue $t 'BodyJson')) -Override ([string](Get-SIProRowValue $o 'BodyJson')) -Format $fmt
|                if ($am.Additive) { $state = 'Overridden'; $addApplied = $true; $additions = @($am.Added) } else { $notAdditive = $am.Reason }
|            } else { $notAdditive = 'the shipped version your change was made on is not known' }
|        }
|        $counts[$state]++
|        $tc = @(); $yc = @(); $known = $false
|        if ($state -eq 'UpgradeAvailable' -and -not $NoDiff) {
|            $cur = [string](Get-SIProRowValue $t 'BodyJson')
|            if ($b) { $known = $true; $tc = @(Get-SIProContentDiff -Old ([string](Get-SIProRowValue $b 'BodyJson')) -New $cur -Format $fmt) }
|            $yc = @(Get-SIProContentDiff -Old $cur -New ([string](Get-SIProRowValue $o 'BodyJson')) -Format $fmt)
|        }
|        [pscustomobject]@{ Kind = $kind; ItemKey = $key; Name = $name; State = $state; Format = $fmt
|            TemplateVersion = $(if ($t) { [string](Get-SIProRowValue $t 'TemplateVersion') } else { '' })
|            BaseVersion = $(if ($o) { [string](Get-SIProRowValue $o 'BaseVersion') } else { '' })
|            ContentHash = $ch; BaseHash = $base; BaseKnown = $known; TemplateChanges = $tc; YourChanges = $yc
|            AdditionsApplied = $addApplied; Additions = $additions; NotAdditiveReason = $notAdditive
|            StateText = $(if ($addApplied) { 'Overridden -- new shipped additions applied' } else { $state }) }
|    }
|    $items = @($items)
|    $fp = Get-SIProTemplateSetFingerprint -Rows @($Templates)
|    [pscustomobject]@{ Items = $items
|        Summary = [pscustomobject]@{ Counts = [pscustomobject]$counts; Total = $items.Count; UpgradeAvailable = $counts['UpgradeAvailable']
|            Conformant = ($counts['UpgradeAvailable'] -eq 0); Fingerprint = $fp; Recorded = [string]$Recorded
|            FingerprintMatches = (-not $Recorded -or $Recorded -eq $fp) } }
|}
|
|# =====================================================================================================================
|#  STORE: readers and writers (guarded -- a database without the versioning schema answers "not ready")
|# =====================================================================================================================
|function Test-SIProVersioningSchema {
|    <# What the template-versioning schema still lacks (empty = ready): the ContentHash column, cfg.TemplateRevision,
|       cfg.InstallState. #>
|    param([Parameter(Mandatory)]$Store)
|    $sql = "SELECT CASE WHEN COL_LENGTH('cfg.Template', 'ContentHash') IS NULL THEN 0 ELSE 1 END AS HasContentHash, CASE WHEN OBJECT_ID('cfg.TemplateRevision') IS NULL THEN 0 ELSE 1 END AS HasRevision, CASE WHEN OBJECT_ID('cfg.InstallState') IS NULL THEN 0 ELSE 1 END AS HasInstallState"
|    $r = @(& $Store.Invoke $sql @{} 'reader' | ForEach-Object { $_ }) | Select-Object -First 1
|    $missing = New-Object System.Collections.Generic.List[string]
|    if (-not $r -or [int](Get-SIProRowValue $r 'HasContentHash') -ne 1) { $missing.Add('cfg.Template.ContentHash') }
|    if (-not $r -or [int](Get-SIProRowValue $r 'HasRevision') -ne 1) { $missing.Add('cfg.TemplateRevision') }
|    if (-not $r -or [int](Get-SIProRowValue $r 'HasInstallState') -ne 1) { $missing.Add('cfg.InstallState') }
|    $missing.ToArray()
|}
|
|function Read-SIProInstallState {
|    <# One cfg.InstallState row (@{ Value; Version; UpdatedAt; UpdatedBy }), or $null (no row, or no table). #>
|    param([Parameter(Mandatory)]$Store, [string]$Name = $script:SIProFingerprintName)
|    $rows = @(& $Store.Invoke "IF OBJECT_ID('cfg.InstallState') IS NOT NULL SELECT Name, Value, [Version], UpdatedAt, UpdatedBy FROM cfg.InstallState WHERE Name = @Name" @{ Name = $Name } 'reader' | ForEach-Object { $_ })
|    if ($rows.Count) { return $rows[0] }
|    $null
|}
|
|function Read-SIProTemplateRevisions {
|    <# cfg.TemplateRevision rows (empty without the table). #>
|    param([Parameter(Mandatory)]$Store)
|    & $Store.Invoke "IF OBJECT_ID('cfg.TemplateRevision') IS NOT NULL SELECT Kind, ItemKey, ContentHash, [Version] AS TemplateVersion, BodyJson, Format FROM cfg.TemplateRevision" @{} 'reader' | ForEach-Object { $_ }
|}
|
|function Set-SIProTemplateFingerprint {
|    <#
|        Record the template-set fingerprint on the install, with its cfg.ChangeLog row, in one transaction. Called ONLY
|        after a publish was read back and verified (Publish-SITemplates). The actor is the session (Get-SIProSessionActor).
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][AllowEmptyString()][string]$Fingerprint, [string]$Version, [string]$Reason = '')
|    $sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @old nvarchar(400) = (SELECT Value FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @Name);
|IF @old IS NULL AND NOT EXISTS (SELECT 1 FROM cfg.InstallState WHERE Name = @Name)
|    INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@Name, @Value, @Version, @By);
|ELSE
|    UPDATE cfg.InstallState SET Value = @Value, [Version] = @Version, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @Name;
|INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|VALUES (@Name, 'install', 'install', 'Set', @old, CONCAT(@Version, ':', @Value), @By, @Reason);
|COMMIT;
|'@
|    & $Store.Invoke $sql ([ordered]@{ Name = $script:SIProFingerprintName; Value = $Fingerprint; Version = $(if ($Version) { $Version } else { $null }); By = (Get-SIProSessionActor); Reason = $Reason }) 'nonquery'
|}
|
|function Get-SIProStoreConformance {
|    <# The conformance view read from the database (templates, overrides, revisions, the recorded fingerprint). #>
|    param([Parameter(Mandatory)]$Store, [switch]$NoDiff)
|    $rec = Read-SIProInstallState -Store $Store
|    Get-SIProConformance -Templates @(Read-SIProTemplates -Store $Store) -Overrides @(Read-SIProItemOverrides -Store $Store) `
|        -Revisions @(Read-SIProTemplateRevisions -Store $Store) -Recorded $(if ($rec) { [string](Get-SIProRowValue $rec 'Value') } else { '' }) -NoDiff:$NoDiff
|}
|
|function Approve-SIProTemplateUpgrade {
|    <#
|        Resolve "upgrade available" for one item -- the PowerShell twin of the web page's two buttons:
|          -Action Take   take the new template: the override goes back to inherit (the row is removed), as Set-SIProItem
|          -Action Keep   keep mine and acknowledge: the override's BaseHash / BaseVersion move to the CURRENT template,
|                         so it reads Overridden again; the body is not touched
|        Each with its cfg.ChangeLog row in one transaction. The actor is the SESSION (Get-SIProSessionActor) -- there is
|        deliberately no -ChangedBy. -ExpectedContentHash: the template content the decision was made on; when the
|        template moved since, nothing is written.
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Kind, [Parameter(Mandatory)][string]$Key,
|          [Parameter(Mandatory)][ValidateSet('Take', 'Keep')][string]$Action, [string]$Reason = '', [string]$ExpectedContentHash)
|    $spec = $script:SIProItemKinds[$Kind]
|    if (-not $spec -or -not $spec.Templated) { throw ("'{0}' is not a templated configuration kind" -f $Kind) }
|    if ($Key -notmatch $spec.Key) { throw ("'{0}' is not a valid {1} key" -f $Key, $Kind) }
|    $by = Get-SIProSessionActor
|    if ($Action -eq 'Take') {
|        Set-SIProItem -Store $Store -Kind $Kind -Key $Key -State inherit -ChangedBy $by -Reason $(if ($Reason) { $Reason } else { 'took the new template' })
|        return [pscustomobject]@{ Kind = $Kind; Key = $Key; Action = 'Take'; Outcome = 'Saved'; By = $by }
|    }
|    $missing = @(Test-SIProVersioningSchema -Store $Store)
|    if ($missing.Count) { throw ('nothing written: the Pro database lacks {0} -- run setup\Publish-SITemplates.ps1 -Apply -CreateSchema first' -f ($missing -join ', ')) }
|    $sql = @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @state nvarchar(16), @oldHash char(64), @newHash char(64), @newVersion nvarchar(32);
|SELECT @state = State, @oldHash = BaseHash FROM cfg.ItemOverride WITH (UPDLOCK, HOLDLOCK) WHERE Kind = @Kind AND ItemKey = @Key;
|SELECT @newHash = ContentHash, @newVersion = [Version] FROM cfg.Template WHERE Kind = @Kind AND ItemKey = @Key AND RetiredAt IS NULL;
|IF @state IS NULL OR @state <> 'override' BEGIN ROLLBACK; SELECT 'NotOverridden' AS Outcome; RETURN; END;
|IF @newHash IS NULL BEGIN ROLLBACK; SELECT 'NoTemplate' AS Outcome; RETURN; END;
|IF @Expected IS NOT NULL AND @newHash <> @Expected BEGIN ROLLBACK; SELECT 'Stale' AS Outcome; RETURN; END;
|UPDATE cfg.ItemOverride SET BaseHash = @newHash, BaseVersion = @newVersion, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Kind = @Kind AND ItemKey = @Key;
|INSERT cfg.ChangeLog (Name, Scope, Kind, Action, OldValue, NewValue, ChangedBy, Reason)
|VALUES (@Key, 'item', @Kind, 'Set', CONCAT('base:', COALESCE(@oldHash, '(none)')), CONCAT('base:', @newHash, ' (', @newVersion, ')'), @By, @Reason);
|COMMIT;
|SELECT 'Saved' AS Outcome;
|'@
|    $rows = @(& $Store.Invoke $sql ([ordered]@{ Kind = $Kind; Key = $Key; Expected = $(if ($ExpectedContentHash) { $ExpectedContentHash } else { $null }); By = $by
|        Reason = $(if ($Reason) { $Reason } else { 'kept my version; acknowledged the new template' }) }) 'reader' | ForEach-Object { $_ })
|    $outcome = if ($rows.Count) { [string](Get-SIProRowValue $rows[0] 'Outcome') } else { '' }
|    [pscustomobject]@{ Kind = $Kind; Key = $Key; Action = 'Keep'; Outcome = $outcome; By = $by }
|}
'@ }
$__siSupportFiles['engine/pro-settings/SI-TemplateMandatory.ps1'] = @{ Sha256 = '3ca199d35b830963959c2b1a5c92d4da682508f0099933eb233b9a371907a069'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- MANDATORY CONTROLS ON TOP OF TEMPLATES (adopted from PIM4EntraPS: engine-enforced defaults applied
|    on top of every policy template, whatever the customer's copy says).
|
|    Some parts of a shipped template item are REQUIRED by SecurityInsight's own code -- a risk factor the scoring needs, a
|    collection scope without which an engine has nothing to read. A customer may override the item, but never switch such a
|    part off or weaken it:
|      * the web app's validators (MandatoryControls.cs) and Set-SIProItem refuse such an override with a plain reason;
|      * the run (Merge-SIProItems) applies the mandatory value ON TOP of whatever is stored -- an override written before the
|        control existed, or by a path that skipped the validator, cannot switch it off either. Each correction is a note.
|
|    The set is data, config\template-mandatory.locked.json (linked next to the web app as catalog\template-mandatory.locked.json),
|    and it is a CODE contract: an entry exists only because code in this release depends on it (the entry names that code).
|    One control:
|      Kind, ItemKey   the template item ('<kind>/<key>' as in cfg.Template)
|      Rule            present  -- the item may not be switched off (State 'disable'); the shipped item applies
|                      equals   -- the value at Path must be Value
|                      atLeast  -- the number at Path must be >= Value
|                      above    -- the number at Path must be > Value; the run applies Default when it is not
|                      contains -- the list at Path must hold every entry of Value (a list)
|      Path            dot-separated object keys inside the JSON body ('' for 'present')
|      Value           the required value (the bound, for atLeast / above)
|      Default         (above only) the value the run applies when the customer's is not above the bound
|      Reason          one plain sentence a person reads when an override is refused
|    A switched-off item counts as every part of it switched off: an item with ANY control can not be disabled.
|
|    PURE except Get-SIProMandatoryControls (reads one shipped file). PowerShell 5.1 safe.
|#>
|
|$script:SIProMandatoryRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|$script:SIProMandatoryRules = @('present', 'equals', 'atLeast', 'above', 'contains')
|$script:SIProMandatoryCache = @{}
|
|function Get-SIProMandatoryRules { $script:SIProMandatoryRules }
|
|function ConvertFrom-SIProMandatoryCatalog {
|    <# PURE. The catalog text -> its controls. Throws on a malformed catalog (it ships with the code: a test reads it). #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Text)
|    if ([string]::IsNullOrWhiteSpace($Text)) { return @() }
|    $doc = ConvertFrom-Json -InputObject $Text
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($c in @($doc.Controls)) {
|        if ($null -eq $c) { continue }
|        $rule = [string]$c.Rule
|        if ($script:SIProMandatoryRules -cnotcontains $rule) { throw ("template-mandatory: '{0}' is not a rule ({1})" -f $rule, ($script:SIProMandatoryRules -join ', ')) }
|        $kind = [string]$c.Kind; $key = [string]$c.ItemKey
|        if (-not $kind -or -not $key) { throw 'template-mandatory: every control names its Kind and ItemKey' }
|        $path = if ($c.PSObject.Properties['Path']) { [string]$c.Path } else { '' }
|        if ($rule -ne 'present' -and -not $path) { throw ("template-mandatory: {0}/{1} -- rule '{2}' needs a Path" -f $kind, $key, $rule) }
|        $val = if ($c.PSObject.Properties['Value']) { $c.Value } else { $null }
|        $num = { param($x) $d = 0.0; ($null -ne $x) -and ($x -isnot [bool]) -and [double]::TryParse([string]::Format([System.Globalization.CultureInfo]::InvariantCulture, '{0}', $x), [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d) }
|        if ($rule -in 'atLeast', 'above' -and -not (& $num $val)) { throw ("template-mandatory: {0}/{1} -- {2} needs a number" -f $kind, $key, $rule) }
|        $def = if ($c.PSObject.Properties['Default']) { $c.Default } else { $null }
|        if ($rule -eq 'above' -and -not ((& $num $def) -and [double]$def -gt [double]$val)) { throw ("template-mandatory: {0}/{1} -- above needs a Default greater than its Value" -f $kind, $key) }
|        if ($rule -eq 'contains' -and -not ($val -is [System.Collections.IEnumerable] -and $val -isnot [string])) { throw ("template-mandatory: {0}/{1} -- contains needs a list" -f $kind, $key) }
|        $out.Add([pscustomobject]@{ Id = [string]$c.Id; Kind = $kind; ItemKey = $key; Rule = $rule; Path = $path; Value = $val; Default = $def; Reason = [string]$c.Reason; Code = [string]$c.Code })
|    }
|    # one by one: callers collect with @(...), and a `, $array` return read through @() nests (one element: the array)
|    foreach ($o in $out) { $o }
|}
|
|function Get-SIProMandatoryControls {
|    <# The shipped controls (config\template-mandatory.locked.json), read once per path. No file = no controls. #>
|    param([string]$SIRoot = $script:SIProMandatoryRoot)
|    $p = [System.IO.Path]::Combine($SIRoot, 'config', 'template-mandatory.locked.json')
|    if (-not $script:SIProMandatoryCache.ContainsKey($p)) {
|        $c = @()
|        if (Test-Path -LiteralPath $p) { $c = @(ConvertFrom-SIProMandatoryCatalog -Text ([System.IO.File]::ReadAllText($p))) }
|        $script:SIProMandatoryCache[$p] = $c
|    }
|    # one by one (callers collect with @(...)); no file = nothing
|    foreach ($o in $script:SIProMandatoryCache[$p]) { $o }
|}
|
|function Get-SIProMandatoryFor {
|    <# PURE. The controls of one item. #>
|    param([AllowEmptyCollection()][object[]]$Controls = @(), [AllowEmptyString()][string]$Kind, [AllowEmptyString()][string]$Key)
|    @($Controls | Where-Object { $_ -and $_.Kind -ceq $Kind -and $_.ItemKey -ceq $Key })
|}
|
|function Get-SIProMandatoryPathValue {
|    <# PURE. @{ Found; Value } at a dot path of a parsed body (PSCustomObject or dictionary). #>
|    param($Value, [string]$Path)
|    $cur = $Value
|    foreach ($seg in ($Path -split '\.')) {
|        if ($cur -is [System.Collections.IDictionary]) { if (-not $cur.Contains($seg)) { return @{ Found = $false; Value = $null } }; $cur = $cur[$seg]; continue }
|        if ($cur -is [System.Management.Automation.PSCustomObject] -and $cur.PSObject.Properties[$seg]) { $cur = $cur.$seg; continue }
|        return @{ Found = $false; Value = $null }
|    }
|    @{ Found = $true; Value = $cur }
|}
|
|function Test-SIProMandatoryValue {
|    <# PURE. Does a value satisfy one control? (present is about the item's State, not a value: always $true here) #>
|    param([Parameter(Mandatory)]$Control, [bool]$Found, $Value)
|    switch ($Control.Rule) {
|        'present' { return $true }
|        'equals' {
|            if (-not $Found) { return $false }
|            return ((ConvertTo-SIProJson -Value $Value -Canonical) -ceq (ConvertTo-SIProJson -Value $Control.Value -Canonical))
|        }
|        'atLeast' {
|            if (-not $Found -or $null -eq $Value -or $Value -is [bool] -or $Value -is [string]) { return $false }
|            $d = 0.0
|            if (-not [double]::TryParse([string]::Format([System.Globalization.CultureInfo]::InvariantCulture, '{0}', $Value), [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $false }
|            return ($d -ge [double]$Control.Value)
|        }
|        'above' {
|            if (-not $Found -or $null -eq $Value -or $Value -is [bool] -or $Value -is [string]) { return $false }
|            $d = 0.0
|            if (-not [double]::TryParse([string]::Format([System.Globalization.CultureInfo]::InvariantCulture, '{0}', $Value), [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $false }
|            return ($d -gt [double]$Control.Value)
|        }
|        'contains' {
|            if (-not $Found -or $null -eq $Value -or $Value -is [string] -or -not ($Value -is [System.Collections.IEnumerable])) { return $false }
|            $have = @(foreach ($v in $Value) { ConvertTo-SIProJson -Value $v -Canonical })
|            foreach ($need in @($Control.Value)) { if ($have -cnotcontains (ConvertTo-SIProJson -Value $need -Canonical)) { return $false } }
|            return $true
|        }
|    }
|    $false
|}
|
|function Get-SIProMandatoryText {
|    <# PURE. The plain sentence for one control a customer's change breaks. #>
|    param([Parameter(Mandatory)]$Control, [switch]$WhatOnly)
|    $v = ConvertTo-SIProJson -Value $Control.Value -Canonical
|    $what = switch ($Control.Rule) {
|        'present' { 'it cannot be switched off' }
|        'equals' { "'{0}' must stay {1}" -f $Control.Path, $v }
|        'atLeast' { "'{0}' must be at least {1}" -f $Control.Path, $v }
|        'above' { "'{0}' must be more than {1}" -f $Control.Path, $v }
|        'contains' { "'{0}' must keep {1}" -f $Control.Path, $v }
|    }
|    if ($WhatOnly) { return $what }
|    $r = if ($Control.Reason) { ' -- ' + $Control.Reason } else { '' }
|    ('{0}/{1} is required by SecurityInsight: {2}{3}' -f $Control.Kind, $Control.ItemKey, $what, $r)
|}
|
|function Test-SIProMandatoryOverride {
|    <#
|        PURE. The reasons a customer's state of an item is refused because it switches a mandatory part off or weakens it
|        (empty = accepted). -State 'disable' on an item with any control is refused; 'override' is checked per control
|        against the body; 'inherit' is always accepted (the shipped item meets every control).
|    #>
|    param([AllowEmptyCollection()][object[]]$Controls = @(), [AllowEmptyString()][string]$Kind, [AllowEmptyString()][string]$Key,
|          [AllowEmptyString()][string]$State, [AllowEmptyString()][AllowNull()][string]$Body)
|    $mine = @(Get-SIProMandatoryFor -Controls $Controls -Kind $Kind -Key $Key)
|    if ($mine.Count -eq 0 -or $State -eq 'inherit') { return @() }
|    if ($State -eq 'disable') {
|        $why = New-Object System.Collections.Generic.List[string]
|        foreach ($c in $mine) { $why.Add(('{0}/{1} is required by SecurityInsight and cannot be switched off{2}' -f $Kind, $Key, $(if ($c.Reason) { ' -- ' + $c.Reason } else { '' }))) }
|        return @($why | Select-Object -Unique)
|    }
|    $o = $null
|    try { $o = ConvertFrom-SIProJson ([string]$Body).TrimStart([char]0xFEFF) } catch { return @() }   # an unreadable body is the item validator's to refuse
|    @(foreach ($c in $mine) {
|        if ($c.Rule -eq 'present') { continue }
|        $pv = Get-SIProMandatoryPathValue -Value $o -Path $c.Path
|        if (-not (Test-SIProMandatoryValue -Control $c -Found $pv.Found -Value $pv.Value)) { Get-SIProMandatoryText -Control $c }
|    })
|}
|
|function Set-SIProMandatoryValues {
|    <#
|        PURE. The run's side: the mandatory values put ON TOP of an effective JSON body. Returns @{ Body; Changed; Applied
|        (one plain line per correction) }. A body that is not JSON (or not an object) is returned as it is.
|    #>
|    param([AllowEmptyCollection()][object[]]$Controls = @(), [AllowEmptyString()][string]$Kind, [AllowEmptyString()][string]$Key,
|          [AllowEmptyString()][AllowNull()][string]$Body)
|    $mine = @(Get-SIProMandatoryFor -Controls $Controls -Kind $Kind -Key $Key | Where-Object { $_.Rule -ne 'present' })
|    $same = [pscustomobject]@{ Body = $Body; Changed = $false; Applied = @() }
|    if ($mine.Count -eq 0) { return $same }
|    $o = $null
|    try { $o = ConvertTo-SIProMutableValue (ConvertFrom-SIProJson ([string]$Body).TrimStart([char]0xFEFF)) } catch { return $same }
|    if ($o -isnot [System.Collections.IDictionary]) { return $same }
|    $applied = New-Object System.Collections.Generic.List[string]
|    foreach ($c in $mine) {
|        $pv = Get-SIProMandatoryPathValue -Value $o -Path $c.Path
|        if (Test-SIProMandatoryValue -Control $c -Found $pv.Found -Value $pv.Value) { continue }
|        # walk / create the path; the last key receives the value
|        $segs = @($c.Path -split '\.'); $cur = $o; $ok = $true
|        for ($i = 0; $i -lt $segs.Count - 1; $i++) {
|            $s = $segs[$i]
|            if (-not $cur.Contains($s) -or $cur[$s] -isnot [System.Collections.IDictionary]) {
|                if ($cur.Contains($s) -and $null -ne $cur[$s]) { $ok = $false; break }   # another type sits there: never guessed over
|                $cur[$s] = [ordered]@{}
|            }
|            $cur = $cur[$s]
|        }
|        if (-not $ok) { continue }
|        $last = $segs[$segs.Count - 1]
|        if ($c.Rule -eq 'contains') {
|            $list = if ($cur.Contains($last) -and $cur[$last] -is [System.Collections.IList]) { $cur[$last] } else { New-Object System.Collections.ArrayList }
|            $have = @(foreach ($v in $list) { ConvertTo-SIProJson -Value $v -Canonical })
|            foreach ($need in @($c.Value)) { if ($have -cnotcontains (ConvertTo-SIProJson -Value $need -Canonical)) { [void]$list.Add((ConvertTo-SIProMutableValue $need)) } }
|            $cur[$last] = $list
|        } elseif ($c.Rule -eq 'above') {
|            $cur[$last] = $c.Default
|        } else {
|            $cur[$last] = ConvertTo-SIProMutableValue $c.Value
|        }
|        $applied.Add(('{0}/{1}: {2} -- the required value is applied' -f $Kind, $Key, (Get-SIProMandatoryText -Control $c -WhatOnly)))
|    }
|    if ($applied.Count -eq 0) { return $same }
|    [pscustomobject]@{ Body = (ConvertTo-SIProJson -Value $o); Changed = $true; Applied = $applied.ToArray() }
|}
'@ }
$__siSupportFiles['config/template-mandatory.locked.json'] = @{ Sha256 = '4cb824456f53731553392f7c383a9d5d02909a752567db51b12cf4b3eb76af73'; Text = @'
|{
|  "_doc": "SecurityInsight Pro -- MANDATORY CONTROLS on top of templates. The parts of shipped template items that SecurityInsight's own code requires: a customer override can never switch them off or weaken them. The web app refuses such an override (MandatoryControls, pro-management) and Set-SIProItem refuses it; the run applies the required value on top of whatever is stored (Merge-SIProItems, engine\\pro-settings\\SI-TemplateMandatory.ps1). Rules: present (the item cannot be switched off), equals, atLeast, above (with Default -- what the run applies), contains. A control exists ONLY because code in this release depends on it -- 'Code' names that code. This is a code contract, not policy: add an entry together with the code that needs it, remove it together with that code.",
|  "Schema": 1,
|  "Controls": [
|    { "Id": "rf-internet-exposed-present", "Kind": "datamodel", "ItemKey": "risk-factors:internet_exposed", "Rule": "present",
|      "Reason": "the shipped Risk Analysis reports read this factor to score internet-exposed assets",
|      "Code": "risk-analysis-detection\\RiskAnalysis_Queries_Locked.yaml: set_has_element(si_rf_p, \"internet_exposed\") (4 reports)" },
|    { "Id": "rf-internet-exposed-state", "Kind": "datamodel", "ItemKey": "risk-factors:internet_exposed", "Rule": "equals", "Path": "state", "Value": "enabled",
|      "Reason": "only an enabled factor (#559 state) reaches the reports that score on it -- the shipped factor is built-in, so it is never disabled",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: si_rf_p = make_set_if(... stage in (\"production\", \"\") and impact > 0) -- the CI build evaluates enabled factors only and stamps them production (SI-CiEnrich.ps1)" },
|    { "Id": "rf-internet-exposed-axis", "Kind": "datamodel", "ItemKey": "risk-factors:internet_exposed", "Rule": "equals", "Path": "axis", "Value": "probability",
|      "Reason": "the reports read it on the probability side of the score",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: si_rf_p takes axis == \"probability\"" },
|    { "Id": "rf-internet-exposed-impact", "Kind": "datamodel", "ItemKey": "risk-factors:internet_exposed", "Rule": "above", "Path": "impact", "Value": 0, "Default": 4,
|      "Reason": "a factor with no impact is left out of the scoring the reports read",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: todouble(impact) > 0" },
|
|    { "Id": "rf-old-password-present", "Kind": "datamodel", "ItemKey": "risk-factors:old_password", "Rule": "present",
|      "Reason": "the shipped Risk Analysis reports read this factor to score accounts with an old password",
|      "Code": "risk-analysis-detection\\RiskAnalysis_Queries_Locked.yaml: set_has_element(si_rf_p, \"old_password\") (2 reports)" },
|    { "Id": "rf-old-password-state", "Kind": "datamodel", "ItemKey": "risk-factors:old_password", "Rule": "equals", "Path": "state", "Value": "enabled",
|      "Reason": "only an enabled factor (#559 state) reaches the reports that score on it -- the shipped factor is built-in, so it is never disabled",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: si_rf_p = make_set_if(... stage in (\"production\", \"\") and impact > 0) -- the CI build evaluates enabled factors only and stamps them production (SI-CiEnrich.ps1)" },
|    { "Id": "rf-old-password-axis", "Kind": "datamodel", "ItemKey": "risk-factors:old_password", "Rule": "equals", "Path": "axis", "Value": "probability",
|      "Reason": "the reports read it on the probability side of the score",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: si_rf_p takes axis == \"probability\"" },
|    { "Id": "rf-old-password-impact", "Kind": "datamodel", "ItemKey": "risk-factors:old_password", "Rule": "above", "Path": "impact", "Value": 0, "Default": 3,
|      "Reason": "a factor with no impact is left out of the scoring the reports read",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: todouble(impact) > 0" },
|
|    { "Id": "rf-production-environment-present", "Kind": "datamodel", "ItemKey": "risk-factors:production_environment", "Rule": "present",
|      "Reason": "the shipped Risk Analysis reports read this factor to weigh production assets",
|      "Code": "risk-analysis-detection\\RiskAnalysis_Queries_Locked.yaml: set_has_element(si_rf_c, \"production_environment\")" },
|    { "Id": "rf-production-environment-state", "Kind": "datamodel", "ItemKey": "risk-factors:production_environment", "Rule": "equals", "Path": "state", "Value": "enabled",
|      "Reason": "only an enabled factor (#559 state) reaches the reports that score on it -- the shipped factor is built-in, so it is never disabled",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: si_rf_c = make_set_if(... stage in (\"production\", \"\") and impact > 0) -- the CI build evaluates enabled factors only and stamps them production (SI-CiEnrich.ps1)" },
|    { "Id": "rf-production-environment-axis", "Kind": "datamodel", "ItemKey": "risk-factors:production_environment", "Rule": "equals", "Path": "axis", "Value": "consequence",
|      "Reason": "the reports read it on the consequence side of the score",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: si_rf_c takes axis == \"consequence\"" },
|    { "Id": "rf-production-environment-impact", "Kind": "datamodel", "ItemKey": "risk-factors:production_environment", "Rule": "above", "Path": "impact", "Value": 0, "Default": 3,
|      "Reason": "a factor with no impact is left out of the scoring the reports read",
|      "Code": "engine\\risk-analysis\\_shared\\RA-CiKql.ps1: todouble(impact) > 0" }
|  ]
|}
'@ }
$__siSupportFiles['engine/asset-tagging/AssetTagging.Resolve.ps1'] = @{ Sha256 = 'a62f0efa93220a2c964803bb46c9f7b9dd788ebbc9f8626b1e9a145ff4270f80'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT -- WHERE THE ASSET-TAGGING ENGINE FINDS ITS RULES AND ITS CONFIG (one resolution, three readers).
|
|    The launchers (launcher\asset-tagging\launcher.*.ps1), the engine (engine\asset-tagging\AssetTagging.ps1) and the Pro
|    importer (setup\Import-SIProSettings.ps1, #275 R3) all call THESE functions, so the importer looks exactly where a run
|    looks -- a customisation kept anywhere the engine reads is found, and nothing the engine would not read is imported.
|    The rules are the ones 2.2 shipped, moved here unchanged (2.2.460: launcher.internal-vm.ps1 "SettingsPath resolution",
|    AssetTagging.ps1 "LockedYamlFile / CustomYamlFile / LegacyYamlFile" and "asset-tagging.config.json").
|
|    PURE apart from Test-Path. PowerShell 5.1: no ?. / ??.
|#>
|
|function Resolve-SIAssetTaggingSettingsPath {
|    <#
|        The rules folder (SettingsPath): the -SettingsPath switch (-Cli), else the configured $global:SettingsPath, else the
|        launcher's default --
|          internal launcher:  <SI>\asset-tagging-rules\ when it exists, then <SI>\asset-profiling-enrichment\endpoint\, else
|                              asset-tagging-rules\ (the engine then stops with the clear "No YAML found" error);
|          community launcher: <SI>\asset-profiling-enrichment\endpoint\.
|    #>
|    param([string]$Cli, [string]$Configured, [Parameter(Mandatory)][string]$SIRoot, [ValidateSet('internal', 'community')][string]$Flavour = 'internal')
|    if ($Cli) { return $Cli }
|    if (-not [string]::IsNullOrWhiteSpace($Configured)) { return $Configured }
|    $defaultRules = Join-Path $SIRoot 'asset-tagging-rules'
|    $defaultEnrich = Join-Path $SIRoot 'asset-profiling-enrichment\endpoint'
|    if ($Flavour -eq 'community') { return $defaultEnrich }
|    if (Test-Path -LiteralPath $defaultRules) { return $defaultRules }
|    if (Test-Path -LiteralPath $defaultEnrich) { return $defaultEnrich }
|    $defaultRules
|}
|
|function Resolve-SIAssetTaggingFiles {
|    <#
|        The files a run reads from -SettingsPath. The YAML names: the configured ones, else the engine's own defaults
|        (a launcher always sets AssetTagging.locked.yaml / AssetTagging.custom.yaml). Pro: when the settings layer
|        materialised the rules (-ProAssetTaggingPath holds AssetTagging.locked.yaml) they are the WHOLE rule set.
|        Returns: RulesDir, LockedYamlFile, CustomYamlFile, LegacyYamlFile, LockedPath / CustomPath / LegacyPath and
|        whether each exists, FromPro, PreRenamed (the pre-2.2.392 locked name was used), Mode ('locked+custom' |
|        'legacy' | 'none'), ConfigCandidates (in the order they are tried) and ConfigPath (the one read, or $null).
|    #>
|    param([Parameter(Mandatory)][string]$SettingsPath, [Parameter(Mandatory)][string]$SIRoot,
|          [string]$LockedYamlFile, [string]$CustomYamlFile, [string]$LegacyYamlFile,
|          [string]$ProAssetTaggingPath, [string]$ProConfigRoot)
|    if ([string]::IsNullOrWhiteSpace($LockedYamlFile)) { $LockedYamlFile = 'SecurityInsight_CriticalAssetTagging_Locked.yaml' }
|    if ([string]::IsNullOrWhiteSpace($CustomYamlFile)) { $CustomYamlFile = 'SecurityInsight_CriticalAssetTagging_Custom.yaml' }
|    if ([string]::IsNullOrWhiteSpace($LegacyYamlFile)) { $LegacyYamlFile = 'CriticalAssetTagging.yaml' }
|    $configuredLocked = $LockedYamlFile
|    $fromPro = $false
|    $taggingRulesDir = $SettingsPath
|    if (-not [string]::IsNullOrWhiteSpace($ProAssetTaggingPath) -and (Test-Path -LiteralPath (Join-Path $ProAssetTaggingPath 'AssetTagging.locked.yaml'))) {
|        $taggingRulesDir = $ProAssetTaggingPath
|        $LockedYamlFile  = 'AssetTagging.locked.yaml'
|        $CustomYamlFile  = 'AssetTagging.custom.yaml'
|        $fromPro = $true
|    }
|    $lockedPath = Join-Path $taggingRulesDir $LockedYamlFile
|    $customPath = Join-Path $taggingRulesDir $CustomYamlFile
|    $legacyPath = Join-Path $taggingRulesDir $LegacyYamlFile
|    $lockedExists = Test-Path -LiteralPath $lockedPath
|    $customExists = Test-Path -LiteralPath $customPath
|    $legacyExists = Test-Path -LiteralPath $legacyPath
|    # v2.2.393 back-compat: 'AssetTagging.AutoExclude.locked.yaml' (the name before the v2.2.392 rename), in SettingsPath.
|    $preRenamed = $false
|    if (-not $lockedExists) {
|        $preRenamedLocked = Join-Path $SettingsPath 'AssetTagging.AutoExclude.locked.yaml'
|        if (Test-Path -LiteralPath $preRenamedLocked) {
|            $lockedPath = $preRenamedLocked
|            $LockedYamlFile = 'AssetTagging.AutoExclude.locked.yaml'
|            $lockedExists = $true
|            $preRenamed = $true
|        }
|    }
|    $mode = if ($lockedExists -or $customExists) { 'locked+custom' } elseif ($legacyExists) { 'legacy' } else { 'none' }
|    # asset-tagging.config.json: Pro's materialised copy first, then config\ under the solution root, then SettingsPath.
|    $candidateConfigPaths = @(
|        $(if (-not [string]::IsNullOrWhiteSpace($ProConfigRoot)) { Join-Path $ProConfigRoot 'asset-tagging.config.json' }),
|        (Join-Path $SIRoot 'config\asset-tagging.config.json'),
|        (Join-Path $SettingsPath 'asset-tagging.config.json')
|    ) | Where-Object { $_ }
|    $taggingConfigPath = $null
|    foreach ($cand in @($candidateConfigPaths)) {
|        if (Test-Path -LiteralPath $cand) { $taggingConfigPath = $cand; break }
|    }
|    [pscustomobject]@{
|        RulesDir = $taggingRulesDir; FromPro = $fromPro; PreRenamed = $preRenamed; ConfiguredLockedYamlFile = $configuredLocked
|        LockedYamlFile = $LockedYamlFile; CustomYamlFile = $CustomYamlFile; LegacyYamlFile = $LegacyYamlFile
|        LockedPath = $lockedPath; CustomPath = $customPath; LegacyPath = $legacyPath
|        LockedExists = $lockedExists; CustomExists = $customExists; LegacyExists = $legacyExists
|        Mode = $mode; ConfigCandidates = @($candidateConfigPaths); ConfigPath = $taggingConfigPath
|    }
|}
|
|# =====================================================================================================================
|#  THE RUN MODE of the Community server launcher (launcher\asset-tagging\launcher.community-vm.ps1)
|#  Operator decision 2026-10-07: asset tagging is REPORT ONLY by default -- as the Pro container job already is. Writing
|#  is asked for explicitly: -Apply on the run, or $global:SI_AssetTagging_Apply = $true in the configuration.
|# =====================================================================================================================
|function ConvertTo-SIAssetTaggingBool {
|    <# PURE. $true / 'true' / '1' / 'yes' / 'on' / '$true' -> $true; anything else (null, empty, false, 0 ...) -> $false. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $false }
|    if ($Value -is [bool]) { return $Value }
|    if ($Value -is [System.Management.Automation.SwitchParameter]) { return $Value.IsPresent }
|    return ("$Value".Trim().Trim('$').ToLowerInvariant() -in @('true', '1', 'yes', 'on'))
|}
|
|function Resolve-SIAssetTaggingRunMode {
|    <#
|        PURE. Does this Community asset-tagging run WRITE tags? First match wins:
|          1. -WhatIfMode given on this run             -> report only   (Source 'switch-whatif'; it also wins over -Apply)
|          2. -Apply given on this run                  -> write         (Source 'switch-apply')
|          3. WhatIfMode true in the configuration      -> report only   (Source 'config-whatif'; what it always meant here)
|          4. SI_AssetTagging_Apply true in the config  -> write         (Source 'setting')
|          5. nothing asked for                         -> report only   (Source 'default')
|        A WhatIfMode = $false in the configuration is NOT a request to write (it was the old default, copied into many
|        configurations); only -Apply or SI_AssetTagging_Apply writes.
|        ABOVE ALL (#643, owner 2026-10-13: "tagging must be disabled by default. customer must enable it in settings"): a run
|        WRITES only when the customer setting "Asset tagging" (SI_AssetTagging_Enabled, -EnabledSetting) is on. Off (the
|        shipped default) = report only whatever -Apply / SI_AssetTagging_Apply say (Source 'tagging-off').
|        Returns @{ Apply; WhatIfMode; Source }.
|    #>
|    param([bool]$ApplySwitch = $false, [bool]$WhatIfSwitch = $false, [AllowNull()]$ApplySetting, [AllowNull()]$ConfigWhatIf, [AllowNull()]$EnabledSetting)
|    $r = { param($apply, $src) [pscustomobject]@{ Apply = [bool]$apply; WhatIfMode = -not [bool]$apply; Source = $src } }
|    if ($WhatIfSwitch) { return (& $r $false 'switch-whatif') }
|    $on = ConvertTo-SIAssetTaggingBool $EnabledSetting
|    if ($ApplySwitch)  { if (-not $on) { return (& $r $false 'tagging-off') }; return (& $r $true 'switch-apply') }
|    if (ConvertTo-SIAssetTaggingBool $ConfigWhatIf) { return (& $r $false 'config-whatif') }
|    if (ConvertTo-SIAssetTaggingBool $ApplySetting) { if (-not $on) { return (& $r $false 'tagging-off') }; return (& $r $true 'setting') }
|    & $r $false 'default'
|}
|
|function Get-SIAssetTaggingRunModeLine {
|    <# PURE. The one line every run prints about its mode. #>
|    param([Parameter(Mandatory)]$Mode)
|    if ($Mode.Apply) {
|        $why = if ($Mode.Source -eq 'switch-apply') { 'the -Apply switch' } else { '$global:SI_AssetTagging_Apply = $true' }
|        return ('WRITES ON -- this run sets tags in Defender, Azure and Entra ({0}).' -f $why)
|    }
|    switch ($Mode.Source) {
|        'switch-whatif' { return 'REPORT ONLY -- nothing is changed (-WhatIfMode). Every tag the rules would set is logged.' }
|        'config-whatif' { return 'REPORT ONLY -- nothing is changed (WhatIfMode = $true in your configuration). Every tag the rules would set is logged.' }
|        'tagging-off'   { return 'REPORT ONLY -- asset tagging is OFF (the setting "Asset tagging", SI_AssetTagging_Enabled, is not on): nothing is changed. To use it: set $global:SI_AssetTagging_Enabled = $true, then -Apply or $global:SI_AssetTagging_Apply = $true to write.' }
|        default         { return 'REPORT ONLY -- nothing is changed; every tag the rules would set is logged. To write the tags: run with -Apply, or set $global:SI_AssetTagging_Apply = $true in config\SecurityInsight.custom.ps1.' }
|    }
|}
|
|function Get-SIAssetTaggingReportOnlyNoticeLines {
|    <# PURE. The one-time notice when the DEFAULT made a run report only. -RanBefore: this install ran asset tagging
|       before (it wrote tags then, unless it was started with -WhatIfMode). #>
|    param([bool]$RanBefore = $false)
|    if ($RanBefore) {
|        return @(
|            'Asset tagging is now REPORT ONLY by default. Earlier versions wrote tags whenever the script ran without -WhatIfMode; from this version a run writes only when you ask for it.',
|            ' - This run changed nothing. It logged every tag the rules would set (console, run log and SI_AssetTagActivity_CL).',
|            ' - To write tags again on every run: set $global:SI_AssetTagging_Apply = $true in config\SecurityInsight.custom.ps1. For one run: add -Apply.',
|            ' - This notice is shown once.'
|        )
|    }
|    @(
|        'Asset tagging is REPORT ONLY by default: it logs every tag the rules would set and changes nothing.',
|        ' - To write tags: set $global:SI_AssetTagging_Apply = $true in config\SecurityInsight.custom.ps1, or add -Apply to one run. Its identity also needs the write grants (setup\Grant-SIIdentity.ps1 -Tagging).',
|        ' - This notice is shown once.'
|    )
|}
|
|function Test-SIAssetTaggingRanBefore {
|    <# Did this install run asset tagging before this run? Its run logs (asset-tagging_*.log in -LogDir) older than
|       -Before, other than -ExcludePath (this run's own log). Never throws. #>
|    param([string]$LogDir, [datetime]$Before = [datetime]::Now, [string]$ExcludePath)
|    try {
|        if (-not $LogDir -or -not (Test-Path -LiteralPath $LogDir)) { return $false }
|        $old = @(Get-ChildItem -LiteralPath $LogDir -Filter 'asset-tagging_*.log' -File -ErrorAction SilentlyContinue |
|                 Where-Object { $_.LastWriteTime -lt $Before -and (-not $ExcludePath -or $_.FullName -ne $ExcludePath) })
|        return ($old.Count -gt 0)
|    } catch { return $false }
|}
|
|function Invoke-SIAssetTaggingReportOnlyNotice {
|    <#
|        Shows the report-only notice ONCE per install (notice id 'asset-tagging-report-only' in the install state the
|        first-run layer keeps, engine\_shared\SI-FirstRun.ps1: logs\state\install-state.json). Only when the DEFAULT made
|        this run report only -- a run that asked for report only, or for writing, is not told. -Store: as
|        Read-SIInstallState (file | memory). -RanBefore: { } -> bool, evaluated only when the notice is due.
|        Returns @{ Shown; RanBefore; Lines }. Never throws; an unreadable state shows nothing (never on every run).
|    #>
|    param([Parameter(Mandatory)]$Mode, [Parameter(Mandatory)][hashtable]$Store, [scriptblock]$RanBefore)
|    $res = [pscustomobject]@{ Shown = $false; RanBefore = $false; Lines = @() }
|    try {
|        if ($Mode.Apply -or $Mode.Source -ne 'default') { return $res }
|        if (-not (Get-Command -Name Read-SIInstallState -ErrorAction SilentlyContinue)) { return $res }
|        $id = 'asset-tagging-report-only'
|        $read = Read-SIInstallState -Store $Store
|        if (-not $read.Ok) { return $res }
|        $state = $read.State
|        if ($state -and -not (Test-SINoticeDue -State $state -Id $id)) { return $res }
|        $before = $false
|        if ($RanBefore) { try { $before = [bool](& $RanBefore) } catch { $before = $false } }
|        if (-not $state) {
|            $ev = if ($before) { @('earlier-asset-tagging-runs') } else { @() }
|            $state = New-SIInstallState -Origin $(if ($before) { 'upgraded' } else { 'fresh' }) -Evidence $ev -Version ''
|        }
|        $lines = @(Get-SIAssetTaggingReportOnlyNoticeLines -RanBefore $before)
|        Write-SINoticeLines -Lines $lines
|        Add-SINoticeShown -State $state -Id $id
|        $null = Save-SIInstallState -Store $Store -State $state
|        $res.Shown = $true; $res.RanBefore = $before; $res.Lines = $lines
|    } catch { Write-Verbose ('asset-tagging notice skipped: {0}' -f $_.Exception.Message) }
|    $res
|}
'@ }
$__siSupportFiles['engine/risk-analysis/_shared/RA-RiskIndexOrder.ps1'] = @{ Sha256 = 'c4fb7558d9a4d6d815d3dbaa084b0e59a36c843a67e33da8e4cb1cfa7221d22e'; Text = @'
|#######################################################################################################
|#  SecurityInsight - Risk Analysis engine
|#  The risk index: FIRST MATCH WINS, in row order (operator decision 2026-10-04).
|#
|#  WHAT A ROW MEANS
|#    Matchers  SecurityDomain, Category, SubCategory, ConfigurationId   -- blank = any
|#              SecuritySeverity      (consulted for the CONSEQUENCE score only)
|#              CriticalityTierLevel  (consulted for the PROBABILITY score only)
|#    Scores    RiskConsequenceScore_SecuritySeverity, RiskProbablityScore_CriticialityTierLevel
|#              -- a blank score means "this row does not set that score": the search goes on.
|#    Order     Precedence (1 = checked first). A file without the Precedence column is a v2.2 index.
|#
|#  HOW A FINDING IS SCORED
|#    Consequence base = the score of the FIRST row, top-down, that has a consequence score and whose
|#    filled matchers among Domain/Category/SubCategory/ConfigurationId/SecuritySeverity all equal the
|#    finding's values (case-insensitive). The probability base is found the same way with
|#    CriticalityTierLevel in place of SecuritySeverity. No row -> 0. The two lookups are independent,
|#    exactly as they were in v2.2. The scoring contract is unchanged:
|#      RiskScoreTotal = (consBase + rfCons) x (probBase + rfProb)
|#
|#  WHY THE TWO LOOKUPS STAY INDEPENDENT
|#    v2.2 never took both scores from one row: the consequence came from the best row for the
|#    finding's SEVERITY and the probability from the best row for its TIER. Making one row supply both
|#    would need a row for every severity x tier x matcher combination to give the same scores
|#    (measured on the shipped index: thousands of rows), so it is not done.
|#
|#  v2.2 -> v3 (ConvertTo-SIRiskIndexFirstMatch)
|#    v2.2 did NOT use the order of the file. It walked a FIXED ladder of column patterns, most specific
|#    first (domain-qualified before not; severity/tier-qualified before configuration-only), and per
|#    pattern took the first row in the file that had every pattern column filled -- IGNORING that row's
|#    other columns. Converting a v2.2 file writes one row per (pattern, value) the ladder could ever
|#    pick, in ladder order, so first-match over the converted rows returns exactly the v2.2 score for
|#    every finding (proved in tests/pester/SIv3-RiskIndexOrder.Tests.ps1 over every matcher
|#    combination). The C# preview (SI.Management.Core RiskIndexScoring) mirrors this file 1:1.
|#
|#  PowerShell 5.1 compatible. Pure functions; no I/O.
|#######################################################################################################
|
|$script:SIRiskIndexMatchColumns = @('SecurityDomain', 'Category', 'SubCategory', 'ConfigurationId')
|$script:SIRiskIndexOutColumns   = @('SecurityDomain', 'Category', 'SubCategory', 'ConfigurationId', 'SecuritySeverity',
|    'RiskConsequenceScore_SecuritySeverity', 'CriticalityTierLevel', 'RiskProbablityScore_CriticialityTierLevel', 'Comments', 'Precedence')
|
|function Get-SIRiskIndexLadder {
|    <# PURE. The v2.2 pattern ladder (RA-ExcelReport.ps1 New-RiskIndex before v3), most specific first.
|       D C S I = SecurityDomain Category SubCategory ConfigurationId; V = SecuritySeverity (consequence) or
|       CriticalityTierLevel (probability). #>
|    @(
|        @('D','C','S','I','V'), @('D','C','S','V'), @('D','C','V'), @('D','V'),
|        @('D','C','S','I'),     @('D','C','S'),     @('D','C'),     @('D'),
|        @('C','S','I','V'),     @('C','S','V'),     @('C','V'),     @('V'),
|        @('C','S','I'),         @('C','S'),         @('C')
|    )
|}
|
|function Get-SIRiskIndexCell {
|    param($Row, [string]$Name)
|    if ($null -eq $Row) { return '' }
|    if ($Row -is [System.Collections.IDictionary]) { if ($Row.Contains($Name)) { return [string]$Row[$Name] } else { return '' } }
|    $p = $Row.PSObject.Properties[$Name]
|    if ($null -eq $p -or $null -eq $p.Value) { return '' }
|    [string]$p.Value
|}
|
|function ConvertTo-SIRiskIndexNumber {
|    <# PURE. A score the way the engine always parsed it: invariant, anything else -> 0. #>
|    param([string]$Text)
|    $n = 0.0
|    [void][double]::TryParse([string]$Text, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$n)
|    $n
|}
|
|function Get-SIRiskIndexLogicalColumn {
|    param([string]$Letter, [string]$Kind)
|    switch ($Letter) {
|        'D' { 'SecurityDomain' } 'C' { 'Category' } 'S' { 'SubCategory' } 'I' { 'ConfigurationId' }
|        'V' { if ($Kind -eq 'Consequence') { 'SecuritySeverity' } else { 'CriticalityTierLevel' } }
|    }
|}
|
|function Get-SIRiskIndexScoreColumn {
|    param([string]$Kind)
|    if ($Kind -eq 'Consequence') { 'RiskConsequenceScore_SecuritySeverity' } else { 'RiskProbablityScore_CriticialityTierLevel' }
|}
|
|function Get-SIRiskIndexLadderScore {
|    <#
|        PURE. The v2.2 rule, kept as the REFERENCE the conversion is proved against (and for the impact
|        measurement). -Rows in file order; -Finding a hashtable with SecurityDomain, Category, SubCategory,
|        ConfigurationId, SecuritySeverity, CriticalityTierLevel. Returns the base score (0 when nothing matches).
|    #>
|    param([object[]]$Rows, [hashtable]$Finding, [ValidateSet('Consequence','Probability')][string]$Kind, [hashtable]$Index)
|    if (-not $Index) { $Index = New-SIRiskIndexLadderIndex -Rows $Rows }
|    $maps = $Index[$Kind]
|    $hasDomain = -not [string]::IsNullOrWhiteSpace([string]$Finding['SecurityDomain'])
|    $ladder = Get-SIRiskIndexLadder
|    for ($g = 0; $g -lt $ladder.Count; $g++) {
|        $pat = $ladder[$g]
|        if ($g -lt 8 -and -not $hasDomain) { continue }
|        $fk = New-Object System.Collections.Generic.List[string]; $ok = $true
|        foreach ($l in $pat) { $v = [string]$Finding[(Get-SIRiskIndexLogicalColumn $l $Kind)]; if ([string]::IsNullOrWhiteSpace($v)) { $ok = $false; break }; $fk.Add($v) }
|        if (-not $ok) { continue }
|        $fkey = ($fk.ToArray() -join '|').ToLowerInvariant()
|        if ($maps[$g].ContainsKey($fkey)) { return $maps[$g][$fkey] }
|    }
|    0.0
|}
|
|function New-SIRiskIndexLadderIndex {
|    <# PURE. The v2.2 lookup maps (per kind, per ladder pattern: key -> score of the FIRST row in the file with that key). #>
|    param([object[]]$Rows)
|    $ladder = Get-SIRiskIndexLadder
|    $res = @{}
|    foreach ($kind in 'Consequence', 'Probability') {
|        $scoreCol = Get-SIRiskIndexScoreColumn $kind
|        $maps = @()
|        foreach ($pat in $ladder) {
|            $map = @{}
|            foreach ($r in @($Rows)) {
|                $rk = New-Object System.Collections.Generic.List[string]; $rok = $true
|                foreach ($l in $pat) { $v = Get-SIRiskIndexCell $r (Get-SIRiskIndexLogicalColumn $l $kind); if ([string]::IsNullOrWhiteSpace($v)) { $rok = $false; break }; $rk.Add($v) }
|                if (-not $rok) { continue }
|                $k = ($rk.ToArray() -join '|').ToLowerInvariant()
|                if (-not $map.ContainsKey($k)) { $map[$k] = (ConvertTo-SIRiskIndexNumber (Get-SIRiskIndexCell $r $scoreCol)) }
|            }
|            $maps += , $map
|        }
|        $res[$kind] = $maps
|    }
|    $res
|}
|
|function ConvertTo-SIRiskIndexFirstMatch {
|    <#
|        PURE. A v2.2 index (rows in file order) -> the same index as first-match rows, in precedence order, with
|        Precedence 1..n. First-match over the result scores every finding exactly as the v2.2 ladder scored the
|        input. Rows are [ordered] dictionaries with the ten columns of $script:SIRiskIndexOutColumns.
|        One row per (ladder pattern, value) the v2.2 ladder could pick. A severity row carries only the
|        consequence score and a tier row only the probability score; a pattern without severity / tier writes its
|        consequence and probability entry (same domain/category/subcategory/configuration) as one row.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows)
|    $rows = @($Rows | Where-Object { $null -ne $_ })
|    $ladder = Get-SIRiskIndexLadder
|    $groups = New-Object System.Collections.Generic.List[object]   # per pattern: ordered groups of (cons list, prob list)
|    for ($g = 0; $g -lt $ladder.Count; $g++) {
|        $pat = $ladder[$g]
|        $byKey = @{}; $order = New-Object System.Collections.Generic.List[string]
|        foreach ($kind in 'Consequence', 'Probability') {
|            $seen = @{}
|            $scoreCol = Get-SIRiskIndexScoreColumn $kind
|            foreach ($r in $rows) {
|                $vals = New-Object System.Collections.Generic.List[string]; $ok = $true
|                foreach ($l in $pat) { $v = Get-SIRiskIndexCell $r (Get-SIRiskIndexLogicalColumn $l $kind); if ([string]::IsNullOrWhiteSpace($v)) { $ok = $false; break }; $vals.Add($v) }
|                if (-not $ok) { continue }
|                $key = ($vals.ToArray() -join '|').ToLowerInvariant()
|                if ($seen.ContainsKey($key)) { continue }
|                $seen[$key] = $true
|                # the group: the pattern's columns without V
|                $gk = New-Object System.Collections.Generic.List[string]
|                for ($i = 0; $i -lt $pat.Count; $i++) { if ($pat[$i] -ne 'V') { $gk.Add($vals[$i]) } }
|                $gkey = ($gk.ToArray() -join '|').ToLowerInvariant()
|                if (-not $byKey.ContainsKey($gkey)) { $byKey[$gkey] = @{ Cons = (New-Object System.Collections.Generic.List[object]); Prob = (New-Object System.Collections.Generic.List[object]) }; $order.Add($gkey) }
|                $raw = (Get-SIRiskIndexCell $r $scoreCol).Trim()
|                $d = 0.0
|                $score = if ($raw -ne '' -and [double]::TryParse($raw, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { $raw } else { '0' }
|                # the row's note travels only to a row that matches what the row itself matched (not to the wider
|                # patterns v2.2 also filed it under)
|                $wider = $false
|                foreach ($l in 'D', 'C', 'S', 'I', 'V') { if ($pat -notcontains $l -and -not [string]::IsNullOrWhiteSpace((Get-SIRiskIndexCell $r (Get-SIRiskIndexLogicalColumn $l $kind)))) { $wider = $true } }
|                $entry = @{ Vals = $vals.ToArray(); Score = $score; Comment = $(if ($wider) { '' } else { Get-SIRiskIndexCell $r 'Comments' }) }
|                if ($kind -eq 'Consequence') { $byKey[$gkey].Cons.Add($entry) } else { $byKey[$gkey].Prob.Add($entry) }
|            }
|        }
|        $groups.Add(@{ Pattern = $pat; ByKey = $byKey; Order = $order })
|    }
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($grp in $groups) {
|        $pat = $grp.Pattern
|        foreach ($gkey in $grp.Order) {
|            $c = $grp.ByKey[$gkey].Cons; $p = $grp.ByKey[$gkey].Prob
|            # A pattern WITH a severity / tier column: one row per score (a severity row sets the consequence, a tier
|            # row the probability -- so no row reads as "severity AND tier"). Without one: at most one entry of each
|            # kind, written as one row with both scores.
|            $pairs = New-Object System.Collections.Generic.List[object]
|            if ($pat -contains 'V') {
|                foreach ($e in $c) { $pairs.Add(@($e, $null)) }
|                foreach ($e in $p) { $pairs.Add(@($null, $e)) }
|            } else {
|                $pairs.Add(@($(if ($c.Count) { $c[0] } else { $null }), $(if ($p.Count) { $p[0] } else { $null })))
|            }
|            foreach ($pair in $pairs) {
|                $o = [ordered]@{}; foreach ($col in $script:SIRiskIndexOutColumns) { $o[$col] = '' }
|                $ce = $pair[0]
|                $pe = $pair[1]
|                $src = if ($ce) { $ce } else { $pe }
|                for ($j = 0; $j -lt $pat.Count; $j++) {
|                    $l = $pat[$j]
|                    if ($l -eq 'V') {
|                        if ($ce) { $o['SecuritySeverity'] = $ce.Vals[$j] }
|                        if ($pe) { $o['CriticalityTierLevel'] = $pe.Vals[$j] }
|                    } else { $o[(Get-SIRiskIndexLogicalColumn $l 'Consequence')] = $src.Vals[$j] }
|                }
|                if ($ce) { $o['RiskConsequenceScore_SecuritySeverity'] = $ce.Score }
|                if ($pe) { $o['RiskProbablityScore_CriticialityTierLevel'] = $pe.Score }
|                $o['Comments'] = $(if ($ce -and $ce.Comment) { $ce.Comment } elseif ($pe) { $pe.Comment } else { '' })
|                $out.Add($o)
|            }
|        }
|    }
|    $k = 0; foreach ($o in $out) { $k++; $o['Precedence'] = [string]$k }
|    # the rows, one by one, to the pipeline (callers collect them with @())
|    $out.ToArray()
|}
|
|function Test-SIRiskIndexFirstMatchForm {
|    <# PURE. $true when the rows carry the Precedence column (a v3 first-match index), $false for a v2.2 index. #>
|    param([AllowEmptyCollection()][object[]]$Rows)
|    $first = @($Rows | Where-Object { $null -ne $_ } | Select-Object -First 1)
|    if (-not $first.Count) { return $false }
|    $r = $first[0]
|    if ($r -is [System.Collections.IDictionary]) { return [bool]$r.Contains('Precedence') }
|    [bool]$r.PSObject.Properties['Precedence']
|}
|
|function Get-SIRiskIndexOrderedRows {
|    <#
|        PURE. The rows of an index in the order first-match walks them. A v3 index: stable sort by Precedence
|        (a number; a row without one goes after the numbered rows, in file order). A v2.2 index: converted.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows)
|    $rows = @($Rows | Where-Object { $null -ne $_ })
|    if (-not (Test-SIRiskIndexFirstMatchForm $rows)) { return @(ConvertTo-SIRiskIndexFirstMatch -Rows $rows) }
|    if ($rows.Count -eq 0) { return }
|    $keys = New-Object 'System.Collections.Generic.List[double]'
|    for ($i = 0; $i -lt $rows.Count; $i++) {
|        $t = (Get-SIRiskIndexCell $rows[$i] 'Precedence').Trim(); $d = 0.0
|        if ($t -ne '' -and [double]::TryParse($t, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { $keys.Add($d) } else { $keys.Add([double]::MaxValue) }
|    }
|    $idx = [int[]](0..($rows.Count - 1))
|    # stable: sort by (precedence, original position); the rows go to the pipeline one by one (callers use @())
|    $sorted = @($idx | Sort-Object -Property @{ Expression = { $keys[$_] } }, @{ Expression = { $_ } })
|    foreach ($i in $sorted) { $rows[$i] }
|}
|
|function New-SIRiskIndexRules {
|    <#
|        PURE. Ordered rows -> the two rule lists first-match walks: @{ Consequence = rules; Probability = rules }.
|        A rule: @{ M = string[5] (D, C, S, I, V lowercased; $null = any); Score = double; Position = 1-based row }.
|        A row without a score for a kind is not a rule of that kind.
|    #>
|    param([AllowEmptyCollection()][object[]]$OrderedRows)
|    $res = @{}
|    foreach ($kind in 'Consequence', 'Probability') {
|        $scoreCol = Get-SIRiskIndexScoreColumn $kind
|        $list = New-Object System.Collections.Generic.List[object]
|        $pos = 0
|        foreach ($r in @($OrderedRows)) {
|            $pos++
|            $s = Get-SIRiskIndexCell $r $scoreCol
|            if ([string]::IsNullOrWhiteSpace($s)) { continue }
|            $m = New-Object 'object[]' 5
|            $i = 0
|            foreach ($l in 'D', 'C', 'S', 'I', 'V') {
|                $v = Get-SIRiskIndexCell $r (Get-SIRiskIndexLogicalColumn $l $kind)
|                $m[$i] = $(if ([string]::IsNullOrWhiteSpace($v)) { $null } else { $v.ToLowerInvariant() })
|                $i++
|            }
|            $list.Add(@{ M = $m; Score = (ConvertTo-SIRiskIndexNumber $s); Position = $pos })
|        }
|        $res[$kind] = $list.ToArray()
|    }
|    $res
|}
|
|function Find-SIRiskIndexRule {
|    <#
|        PURE. The first rule whose filled matchers all equal the finding's values. -Values: string[5] in D C S I V
|        order (the finding's; blank = the finding has no value, which a filled matcher never matches).
|        Returns the rule, or $null.
|    #>
|    param([object[]]$Rules, [string[]]$Values)
|    $lv = New-Object 'object[]' 5
|    for ($i = 0; $i -lt 5; $i++) { $lv[$i] = $(if ([string]::IsNullOrWhiteSpace($Values[$i])) { $null } else { $Values[$i].ToLowerInvariant() }) }
|    foreach ($rule in $Rules) {
|        $m = $rule.M; $fit = $true
|        for ($i = 0; $i -lt 5; $i++) {
|            if ($null -ne $m[$i] -and $m[$i] -cne $lv[$i]) { $fit = $false; break }
|        }
|        if ($fit) { return $rule }
|    }
|    $null
|}
|
|function Get-SIRiskIndexFirstMatchScore {
|    <# PURE. The base score of one finding under first-match (0 when no rule matches). For tests and tools. #>
|    param([hashtable]$Rules, [hashtable]$Finding, [ValidateSet('Consequence','Probability')][string]$Kind)
|    $vals = @(foreach ($l in 'D', 'C', 'S', 'I', 'V') { [string]$Finding[(Get-SIRiskIndexLogicalColumn $l $Kind)] })
|    $r = Find-SIRiskIndexRule -Rules $Rules[$Kind] -Values $vals
|    if ($null -eq $r) { 0.0 } else { [double]$r.Score }
|}
|
|function ConvertTo-SIRiskIndexCsvText {
|    <# PURE. Ordered rows -> the CSV text the engine reads (v3: with Precedence, renumbered 1..n in this order). #>
|    param([AllowEmptyCollection()][object[]]$OrderedRows)
|    $q = { param([string]$s) if ($s -match '[",\r\n]' -or $s -ne $s.Trim()) { '"' + $s.Replace('"', '""') + '"' } else { $s } }
|    $lines = New-Object System.Collections.Generic.List[string]
|    $lines.Add(($script:SIRiskIndexOutColumns -join ','))
|    $k = 0
|    foreach ($r in @($OrderedRows)) {
|        $k++
|        $lines.Add((@(foreach ($c in $script:SIRiskIndexOutColumns) { if ($c -eq 'Precedence') { [string]$k } else { & $q (Get-SIRiskIndexCell $r $c) } }) -join ','))
|    }
|    ($lines.ToArray() -join "`r`n") + "`r`n"
|}
'@ }
$__siSupportFiles['engine/risk-analysis/_shared/RA-RiskIndexSi.ps1'] = @{ Sha256 = 'e9f3b48744992ac92d2c1506ac468adc716b8a74ebeb5bd8c67c056580c28b8c'; Text = @'
|#######################################################################################################
|#  SecurityInsight - Risk Analysis engine
|#  THE RISK INDEX, RE-KEYED TO THE SI GENERIC FIELDS (REQUIREMENTS #559, owner 2026-10-10: "base values come from the
|#  risk index. that is the magic ... risk index base values must be adjusted to the si names ... if mde has not
|#  responded in 7 days on a server, it is critical - but on a client for a user being on vacation it is not same
|#  criticality").
|#
|#  WHAT A ROW MEANS (riskscore.index.locked.csv, and the customer's riskscore.index.custom.csv)
|#    Matchers  si_finding_type, si_category, si_subcategory, si_component, si_finding_key, asset_class  -- blank = any
|#              si_severity  (consulted for the VULNERABILITY base only)
|#              si_tier      (consulted for the ASSET base only)
|#    Scores    AssetBase (the asset side's base: by finding x asset class x tier)
|#              VulnerabilityBase (the vulnerability side's base: by finding type / category / subcategory / severity)
|#              -- a blank score means "this row does not set that score": the search goes on.
|#    Order     Precedence (1 = checked first); rows without one after the numbered rows, in file order.
|#
|#  HOW A FINDING IS SCORED -- unchanged from 3.0 (RA-RiskIndexOrder.ps1): FIRST MATCH WINS, per base, top down. A filled
|#  matcher must equal the finding's value (case-insensitive); a blank finding value never fits a filled matcher. ONE
|#  extension: asset_class 'device' is the FAMILY of device_server / device_client, so a 'device' row fits both (the v2.2
|#  'Endpoint' rows translate to it), while a device_server row fits only servers. No row -> 0.
|#      asset side         = AssetBase + SUM(enabled asset factors' impacts)          no cap
|#      vulnerability side = VulnerabilityBase + SUM(enabled finding factors' impacts)  no cap
|#      risk score         = asset side x vulnerability side                         (RA-RiskScore.ps1)
|#
|#  v2.2 KEYS ARE TRANSLATED, NEVER LOST (riskscore.index.translation.locked.json, shipped as data). A file with the v2.2
|#  columns (SecurityDomain, Category, SubCategory, ConfigurationId, SecuritySeverity, CriticalityTierLevel and the two
|#  score columns) is first put in first-match form when it has no Precedence column (ConvertTo-SIRiskIndexFirstMatch --
|#  the v2.2 ladder, proved in SIv3-RiskIndexOrder.Tests.ps1), then translated row for row, in order, so every v2.2 base
|#  value is carried over and first-match over the translated rows scores a translated finding exactly as v2.2 did
|#  (tests/pester/SIv3-RiskIndexSi.Tests.ps1). The shipped index IS that translation of the 3.0 index (99 rows), plus the
|#  owner's server / client rows in front.
|#
|#  PowerShell 7 (v3); written 5.1-safe. Pure functions except Get-SIRiskIndexTranslation (reads the shipped table once).
|#######################################################################################################
|
|$script:SIRiskIndexSiColumns = @('si_finding_type', 'si_category', 'si_subcategory', 'si_component', 'si_finding_key', 'asset_class',
|    'si_severity', 'VulnerabilityBase', 'si_tier', 'AssetBase', 'Comments', 'Precedence')
|$script:SIRiskIndexSiMatchers = @('si_finding_type', 'si_category', 'si_subcategory', 'si_component', 'si_finding_key', 'asset_class')
|$script:SIRiskIndexV22Columns = @('SecurityDomain', 'Category', 'SubCategory', 'ConfigurationId', 'SecuritySeverity',
|    'RiskConsequenceScore_SecuritySeverity', 'CriticalityTierLevel', 'RiskProbablityScore_CriticialityTierLevel')
|$script:SIRiskIndexTranslationPath = [System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))), 'risk-analysis-detection', 'riskscore.index.translation.locked.json')
|
|# the shipped table, used when the file cannot be read (a stripped package): the same values, so a v2.2 file still scores
|$script:SIRiskIndexTranslationDefault = @{
|    columns = [ordered]@{ SecurityDomain = 'asset_class'; Category = 'si_category'; SubCategory = 'si_subcategory'; ConfigurationId = 'si_finding_key'
|        SecuritySeverity = 'si_severity'; RiskConsequenceScore_SecuritySeverity = 'VulnerabilityBase'; CriticalityTierLevel = 'si_tier'
|        RiskProbablityScore_CriticialityTierLevel = 'AssetBase'; Comments = 'Comments'; Precedence = 'Precedence' }
|    values = @{
|        asset_class = @{ 'endpoint' = 'device'; 'identity' = 'identity'; 'azure' = 'cloud_resource'; 'publicip' = 'public_ip' }
|        si_severity = @{ 'very high' = 'critical'; 'critical' = 'critical'; 'high' = 'high'; 'medium-high' = 'medium_high'; 'medium' = 'medium'; 'moderate' = 'medium'; 'low' = 'low'; 'informational' = 'info'; 'info' = 'info' }
|        si_tier = @{ 'critical - tier 0' = '0'; 'high - tier 1' = '1'; 'medium - tier 2' = '2'; 'low - tier 3' = '3' }
|    }
|}
|
|function Get-SIRiskIndexTranslation {
|    <# The v2.2 -> SI translation table: @{ columns = ordered v2.2 -> SI; values = SI column -> @{ lower-case v2.2 value -> SI value } }.
|       Read once per process from riskscore.index.translation.locked.json; the built-in copy when it cannot be read. #>
|    param([string]$Path = $script:SIRiskIndexTranslationPath)
|    if ($script:SIRiskIndexTranslationCache -and -not $PSBoundParameters.ContainsKey('Path')) { return $script:SIRiskIndexTranslationCache }
|    $t = $script:SIRiskIndexTranslationDefault
|    try {
|        if ($Path -and (Test-Path -LiteralPath $Path)) {
|            $j = [System.IO.File]::ReadAllText($Path) | ConvertFrom-Json
|            $cols = [ordered]@{}; foreach ($p in $j.columns.PSObject.Properties) { $cols[$p.Name] = [string]$p.Value }
|            $vals = @{}
|            foreach ($p in $j.values.PSObject.Properties) { $m = @{}; foreach ($q in $p.Value.PSObject.Properties) { $m[$q.Name.ToLowerInvariant()] = [string]$q.Value }; $vals[$p.Name] = $m }
|            $t = @{ columns = $cols; values = $vals }
|        }
|    } catch { $t = $script:SIRiskIndexTranslationDefault }
|    if (-not $PSBoundParameters.ContainsKey('Path')) { $script:SIRiskIndexTranslationCache = $t }
|    return $t
|}
|
|function Get-SIRiskIndexCellSi {
|    param($Row, [string]$Name)
|    if ($null -eq $Row) { return '' }
|    if ($Row -is [System.Collections.IDictionary]) { if ($Row.Contains($Name) -and $null -ne $Row[$Name]) { return [string]$Row[$Name] } else { return '' } }
|    $p = $Row.PSObject.Properties[$Name]
|    if ($null -eq $p -or $null -eq $p.Value) { return '' }
|    [string]$p.Value
|}
|
|function Get-SIRiskIndexRowColumns {
|    param($Row)
|    if ($null -eq $Row) { return @() }
|    if ($Row -is [System.Collections.IDictionary]) { return @($Row.Keys | ForEach-Object { [string]$_ }) }
|    return @($Row.PSObject.Properties.Name)
|}
|
|function Test-SIRiskIndexV22Form {
|    <# PURE. $true when the rows are written with the v2.2 columns (they carry a v2.2 score column and no SI score column). #>
|    param([AllowEmptyCollection()][object[]]$Rows)
|    $first = @($Rows | Where-Object { $null -ne $_ } | Select-Object -First 1)
|    if (-not $first.Count) { return $false }
|    $cols = Get-SIRiskIndexRowColumns $first[0]
|    if ($cols -contains 'AssetBase' -or $cols -contains 'VulnerabilityBase') { return $false }
|    return ($cols -contains 'RiskConsequenceScore_SecuritySeverity' -or $cols -contains 'RiskProbablityScore_CriticialityTierLevel' -or $cols -contains 'CriticalityTierLevel')
|}
|
|function ConvertTo-SIRiskIndexSiValue {
|    <# PURE. One v2.2 value -> its SI value for an SI column (the table's value map; an unlisted value is kept as written). #>
|    param([string]$Column, [AllowNull()][AllowEmptyString()][string]$Value, [hashtable]$Translation)
|    if (-not $Translation) { $Translation = Get-SIRiskIndexTranslation }
|    $v = ([string]$Value).Trim()
|    if ($v -eq '') { return '' }
|    if ($Translation.values -and $Translation.values.ContainsKey($Column)) {
|        $m = $Translation.values[$Column]
|        $k = $v.ToLowerInvariant()
|        if ($m.ContainsKey($k)) { return [string]$m[$k] }
|    }
|    return $v
|}
|
|function ConvertTo-SIRiskIndexSiRow {
|    <# PURE. ONE row -> an SI-keyed [ordered] row: a 2.2-keyed row translated column by column (its Precedence kept), an
|       SI row copied. For one row at a time (a Pro item); a whole 2.2 file without Precedence goes through
|       ConvertTo-SIRiskIndexSiRows (the ladder needs every row). #>
|    param([Parameter(Mandatory)]$Row, [hashtable]$Translation)
|    if (-not $Translation) { $Translation = Get-SIRiskIndexTranslation }
|    $o = [ordered]@{}; foreach ($c in $script:SIRiskIndexSiColumns) { $o[$c] = '' }
|    if (Test-SIRiskIndexV22Form @($Row)) {
|        foreach ($src in $Translation.columns.Keys) {
|            $dst = [string]$Translation.columns[$src]
|            if ($o.Contains($dst)) { $o[$dst] = ConvertTo-SIRiskIndexSiValue -Column $dst -Value (Get-SIRiskIndexCellSi $Row $src) -Translation $Translation }
|        }
|    } else {
|        foreach ($c in $script:SIRiskIndexSiColumns) { $o[$c] = Get-SIRiskIndexCellSi $Row $c }
|    }
|    return $o
|}
|
|function ConvertTo-SIRiskIndexSiRows {
|    <#
|        PURE. Index rows -> SI-keyed rows ([ordered] dictionaries with $script:SIRiskIndexSiColumns), in first-match order.
|          * SI rows (AssetBase / VulnerabilityBase columns): kept, ordered by Precedence (stable)
|          * v2.2 rows: a file without Precedence is converted by the v2.2 ladder first (ConvertTo-SIRiskIndexFirstMatch),
|            then every row is translated column by column (riskscore.index.translation.locked.json), keeping its order
|        Precedence is renumbered 1..n in the returned order.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows, [hashtable]$Translation)
|    $rows = @($Rows | Where-Object { $null -ne $_ })
|    if ($rows.Count -eq 0) { return }
|    if (-not $Translation) { $Translation = Get-SIRiskIndexTranslation }
|    $out = [System.Collections.Generic.List[object]]::new()
|    if (Test-SIRiskIndexV22Form $rows) {
|        $ordered = @()
|        if (Get-Command -Name Get-SIRiskIndexOrderedRows -ErrorAction SilentlyContinue) { $ordered = @(Get-SIRiskIndexOrderedRows -Rows $rows) } else { $ordered = $rows }
|        foreach ($r in $ordered) {
|            $o = [ordered]@{}; foreach ($c in $script:SIRiskIndexSiColumns) { $o[$c] = '' }
|            foreach ($src in $Translation.columns.Keys) {
|                $dst = [string]$Translation.columns[$src]
|                if (-not $o.Contains($dst)) { continue }
|                $o[$dst] = ConvertTo-SIRiskIndexSiValue -Column $dst -Value (Get-SIRiskIndexCellSi $r $src) -Translation $Translation
|            }
|            $out.Add($o)
|        }
|    } else {
|        $keys = New-Object 'System.Collections.Generic.List[double]'
|        for ($i = 0; $i -lt $rows.Count; $i++) {
|            $t = (Get-SIRiskIndexCellSi $rows[$i] 'Precedence').Trim(); $d = 0.0
|            if ($t -ne '' -and [double]::TryParse($t, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { $keys.Add($d) } else { $keys.Add([double]::MaxValue) }
|        }
|        $idx = [int[]](0..($rows.Count - 1))
|        foreach ($i in @($idx | Sort-Object -Property @{ Expression = { $keys[$_] } }, @{ Expression = { $_ } })) {
|            $o = [ordered]@{}; foreach ($c in $script:SIRiskIndexSiColumns) { $o[$c] = (Get-SIRiskIndexCellSi $rows[$i] $c) }
|            $out.Add($o)
|        }
|    }
|    $k = 0; foreach ($o in $out) { $k++; $o['Precedence'] = [string]$k }
|    $out.ToArray()
|}
|
|function New-SIRiskIndexSiRules {
|    <#
|        PURE. SI rows in first-match order -> @{ Asset = rules; Vulnerability = rules }. A rule: @{ M = string[7] (the six
|        matchers + tier / severity, lower-case; $null = any); Score = double; Position = 1-based row }. A row without a
|        score for a kind is not a rule of that kind.
|    #>
|    param([AllowEmptyCollection()][object[]]$OrderedRows)
|    $res = @{}
|    foreach ($kind in 'Asset', 'Vulnerability') {
|        $scoreCol = 'AssetBase'; $vCol = 'si_tier'
|        if ($kind -eq 'Vulnerability') { $scoreCol = 'VulnerabilityBase'; $vCol = 'si_severity' }
|        $list = [System.Collections.Generic.List[object]]::new()
|        $pos = 0
|        foreach ($r in @($OrderedRows)) {
|            $pos++
|            $s = Get-SIRiskIndexCellSi $r $scoreCol
|            if ([string]::IsNullOrWhiteSpace($s)) { continue }
|            $m = New-Object 'object[]' 7
|            for ($i = 0; $i -lt 6; $i++) { $v = (Get-SIRiskIndexCellSi $r $script:SIRiskIndexSiMatchers[$i]).Trim(); $m[$i] = $(if ($v -eq '') { $null } else { $v.ToLowerInvariant() }) }
|            $vv = (Get-SIRiskIndexCellSi $r $vCol).Trim(); $m[6] = $(if ($vv -eq '') { $null } else { $vv.ToLowerInvariant() })
|            $n = 0.0
|            [void][double]::TryParse($s.Trim(), [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$n)
|            $list.Add(@{ M = $m; Score = $n; Position = $pos })
|        }
|        $res[$kind] = $list.ToArray()
|    }
|    $res
|}
|
|function Find-SIRiskIndexSiRule {
|    <#
|        PURE. The first rule whose filled matchers all fit the finding's values. -Values: string[7] in the order
|        si_finding_type, si_category, si_subcategory, si_component, si_finding_key, asset_class, tier-or-severity.
|        asset_class: a matcher fits the same class or the class's family ('device' fits device_server / device_client).
|    #>
|    param([object[]]$Rules, [string[]]$Values)
|    $lv = New-Object 'object[]' 7
|    for ($i = 0; $i -lt 7; $i++) { $lv[$i] = $(if ([string]::IsNullOrWhiteSpace($Values[$i])) { $null } else { ([string]$Values[$i]).Trim().ToLowerInvariant() }) }
|    $fam = $null; if ($lv[5]) { $u = ([string]$lv[5]).IndexOf('_'); if ($u -gt 0 -and ([string]$lv[5]).StartsWith('device_')) { $fam = ([string]$lv[5]).Substring(0, $u) } }
|    foreach ($rule in $Rules) {
|        $m = $rule.M; $fit = $true
|        for ($i = 0; $i -lt 7; $i++) {
|            if ($null -eq $m[$i]) { continue }
|            if ($m[$i] -ceq $lv[$i]) { continue }
|            if ($i -eq 5 -and $null -ne $fam -and $m[$i] -ceq $fam) { continue }
|            $fit = $false; break
|        }
|        if ($fit) { return $rule }
|    }
|    $null
|}
|
|function New-SIRiskIndexSi {
|    <#
|        PURE. The SI-keyed risk index Calculate-RiskScore looks its two bases up in. -Rows the shipped index, -OverlayRows the
|        customer's own rows (walked FIRST, #398). Either may be SI-keyed or v2.2-keyed (translated). Returns the index object.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [AllowEmptyCollection()][object[]]$OverlayRows = @(), [hashtable]$Translation)
|    $Rows = @($Rows | Where-Object { $null -ne $_ }); $OverlayRows = @($OverlayRows | Where-Object { $null -ne $_ })
|    $srcForm = $(if (Test-SIRiskIndexV22Form $Rows) { $(if (@(Get-SIRiskIndexRowColumns $Rows[0]) -contains 'Precedence') { 'v3-v2.2keys' } else { 'v2.2' }) } else { 'si' })
|    $ovForm = ''
|    if ($OverlayRows.Count) { $ovForm = $(if (Test-SIRiskIndexV22Form $OverlayRows) { $(if (@(Get-SIRiskIndexRowColumns $OverlayRows[0]) -contains 'Precedence') { 'v3-v2.2keys' } else { 'v2.2' }) } else { 'si' }) }
|    $ov = @(); if ($OverlayRows.Count) { $ov = @(ConvertTo-SIRiskIndexSiRows -Rows $OverlayRows -Translation $Translation) }
|    $sh = @(); if ($Rows.Count) { $sh = @(ConvertTo-SIRiskIndexSiRows -Rows $Rows -Translation $Translation) }
|    $ordered = @($ov) + @($sh)
|    $rules = New-SIRiskIndexSiRules -OrderedRows $ordered
|    [pscustomobject]@{
|        Form                 = 'si'
|        Mode                 = 'first-match'
|        OrderedRows          = $ordered
|        OrderedRowCount      = $ordered.Count
|        OverlayRowCount      = $ov.Count
|        SourceForm           = $srcForm
|        OverlayForm          = $ovForm
|        Asset_Rules          = $rules['Asset']
|        Vulnerability_Rules  = $rules['Vulnerability']
|        # the column a row's security domain is read from when it has no asset class (kept for the callers' defaults)
|        SecurityDomainColumn = 'SecurityDomain'
|        Memo                 = ([System.Collections.Generic.Dictionary[string,object]]::new([System.StringComparer]::Ordinal))
|    }
|}
|
|function Get-SIRiskIndexAssetClass {
|    <#
|        PURE. The asset class the index keys on: device_server / device_client (a device with a known category or OS),
|        device (a device neither says), identity, cloud_resource, public_ip; '' when the class is unknown.
|    #>
|    param([string]$Class, [string]$DeviceCategory, [string]$OsPlatform, [string]$OsName)
|    $c = ([string]$Class).Trim().ToLowerInvariant()
|    switch ($c) {
|        'device' {
|            $cat = ([string]$DeviceCategory).Trim().ToLowerInvariant()
|            $os = (([string]$OsPlatform) + ' ' + ([string]$OsName)).Trim().ToLowerInvariant()
|            if ($cat -eq 'server' -or $os -match 'server') { return 'device_server' }
|            if ($cat -in 'endpoint', 'workstation', 'desktop', 'laptop', 'mobile', 'client') { return 'device_client' }
|            if ($os -match '^(windows ?(7|8|10|11|xp|vista))|macos|mac os|ios|ipados|android') { return 'device_client' }
|            return 'device'
|        }
|        { $_ -in 'identity', 'cloud_resource', 'public_ip' } { return $c }
|        default { return '' }
|    }
|}
|
|function Get-SIRiskIndexFindingValues {
|    <#
|        PURE. One finding row -> @{ Asset = string[7]; Vulnerability = string[7] } (the values the two lookups compare).
|          si_finding_type  the row's si_finding_type, else 'cve' for a CVE key, else blank
|          si_category      si_category, else the report's Category column (-CategoryInputName)
|          si_subcategory   si_subcategory, else Subcategory / SubCategory (-SubCategoryInputName)
|          si_component     si_component (#561), else blank
|          si_finding_key   si_finding_key, else ConfigurationId (-ConfigurationIdInputName)
|          asset_class      si_asset_class (the CI context), else the row's si_class split by its OS columns, else the
|                           report's security domain translated (Endpoint -> device ...)
|          tier             CriticalityTier (0..3), else the tier label translated, else si_tier
|          severity         the severity label translated (keeps v2.2's Medium-High band), else si_severity
|    #>
|    param([Parameter(Mandatory)]$Row, [string]$CategoryInputName = 'Category', [string]$SubCategoryInputName = 'Subcategory',
|          [string]$ConfigurationIdInputName = 'ConfigurationId', [string]$SecuritySeverityInputName = 'SecuritySeverity',
|          [string]$CriticalityTierLevelInputName = 'CriticalityTierLevel', [string]$DomainValue = '', [hashtable]$Translation)
|    if (-not $Translation) { $Translation = Get-SIRiskIndexTranslation }
|    $g = { param($n) if (-not $n) { return '' }; $p = $Row.PSObject.Properties[$n]; if ($Row -is [System.Collections.IDictionary]) { if ($Row.Contains($n) -and $null -ne $Row[$n]) { return ([string]$Row[$n]).Trim() } else { return '' } }; if ($p -and $null -ne $p.Value) { return ([string]$p.Value).Trim() }; return '' }
|    $first = { param([string[]]$names) foreach ($n in $names) { $v = & $g $n; if ($v -ne '') { return $v } }; return '' }
|    $key = & $first @('si_finding_key', $ConfigurationIdInputName, 'ConfigurationId')
|    $ftype = & $g 'si_finding_type'
|    if ($ftype -eq '' -and $key -match '^(?i)CVE-\d{4}-\d+$') { $ftype = 'cve' }
|    $cat = & $first @('si_category', $CategoryInputName, 'Category')
|    $sub = & $first @('si_subcategory', $SubCategoryInputName, 'Subcategory', 'SubCategory')
|    $comp = & $g 'si_component'
|    $ac = & $g 'si_asset_class'
|    if ($ac -eq '') {
|        $cls = & $g 'si_class'
|        if ($cls -ne '') { $ac = Get-SIRiskIndexAssetClass -Class $cls -DeviceCategory (& $first @('si_device_category', 'DeviceCategory')) -OsPlatform (& $first @('si_os_platform', 'OSPlatform', 'OsPlatform', 'MDE_OSPlatform')) -OsName (& $first @('si_os_name')) }
|    }
|    if ($ac -eq '') {
|        $dom = $DomainValue; if (-not $dom) { $dom = & $first @('SecurityDomain', 'si_security_domain') }
|        $ac = ConvertTo-SIRiskIndexSiValue -Column 'asset_class' -Value $dom -Translation $Translation
|        if ($ac -eq 'device') {
|            $os = & $first @('si_os_platform', 'OSPlatform', 'OsPlatform', 'MDE_OSPlatform')
|            if ($os -ne '') { $ac = Get-SIRiskIndexAssetClass -Class 'device' -OsPlatform $os -DeviceCategory (& $first @('si_device_category', 'DeviceCategory')) }
|        }
|    }
|    $tier = ''
|    $tn = & $g 'CriticalityTier'
|    $d = 0.0
|    if ($tn -ne '' -and [double]::TryParse($tn, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { $tier = [string][int][Math]::Floor($d) }
|    if ($tier -eq '') { $tl = & $first @($CriticalityTierLevelInputName, 'CriticalityTierLevel'); if ($tl -ne '') { $tier = ConvertTo-SIRiskIndexSiValue -Column 'si_tier' -Value $tl -Translation $Translation } }
|    if ($tier -eq '') { $tier = & $g 'si_tier' }
|    $sev = ''
|    $sl = & $first @($SecuritySeverityInputName, 'SecuritySeverity')
|    if ($sl -ne '') { $sev = ConvertTo-SIRiskIndexSiValue -Column 'si_severity' -Value $sl -Translation $Translation }
|    if ($sev -eq '') { $sev = (& $g 'si_severity').ToLowerInvariant() }
|    $base = @($ftype, $cat, $sub, $comp, $key, $ac)
|    return @{ Asset = [string[]](@($base) + @($tier)); Vulnerability = [string[]](@($base) + @($sev)) }
|}
|
|function Get-SIRiskIndexSiScore {
|    <# PURE (memoised on the index). The base of one kind ('Asset' | 'Vulnerability') for the finding values: @{ Score; Position }
|       (Position 0 = no row fits -> 0). #>
|    param([Parameter(Mandatory)]$Index, [Parameter(Mandatory)][ValidateSet('Asset', 'Vulnerability')][string]$Kind, [Parameter(Mandatory)][AllowEmptyString()][AllowEmptyCollection()][string[]]$Values)
|    # the memo key: a loop, not a pipeline (this runs twice per finding row)
|    $mkParts = [System.Collections.Generic.List[string]]::new([int]($Values.Count))
|    foreach ($v in $Values) { $mkParts.Add(([string]$v).Trim().ToLowerInvariant()) }
|    $mk = $Kind + [char]31 + ($mkParts -join [char]31)
|    $hit = $null
|    if ($Index.Memo -and $Index.Memo.TryGetValue($mk, [ref]$hit)) { return $hit }
|    $rules = $Index.Asset_Rules; if ($Kind -eq 'Vulnerability') { $rules = $Index.Vulnerability_Rules }
|    $rule = Find-SIRiskIndexSiRule -Rules @($rules) -Values $Values
|    $res = $(if ($null -eq $rule) { @{ Score = 0.0; Position = 0 } } else { @{ Score = [double]$rule.Score; Position = [int]$rule.Position } })
|    if ($Index.Memo) { $Index.Memo[$mk] = $res }
|    $res
|}
|
|function ConvertTo-SIRiskIndexSiCsvText {
|    <# PURE. SI rows in first-match order -> the CSV text the engine reads (SI columns, Precedence renumbered 1..n). #>
|    param([AllowEmptyCollection()][object[]]$OrderedRows)
|    $q = { param([string]$s) if ($s -match '[",\r\n]' -or $s -ne $s.Trim()) { '"' + $s.Replace('"', '""') + '"' } else { $s } }
|    $lines = [System.Collections.Generic.List[string]]::new()
|    $lines.Add(($script:SIRiskIndexSiColumns -join ','))
|    $k = 0
|    foreach ($r in @($OrderedRows)) {
|        $k++
|        $lines.Add((@(foreach ($c in $script:SIRiskIndexSiColumns) { if ($c -eq 'Precedence') { [string]$k } else { & $q (Get-SIRiskIndexCellSi $r $c) } }) -join ','))
|    }
|    ($lines.ToArray() -join "`r`n") + "`r`n"
|}
'@ }
$__siSupportFiles['risk-analysis-detection/riskscore.index.translation.locked.json'] = @{ Sha256 = 'e8b96eae2683b4da448a4cfe3f4e138e0c7fa718ce65309e738493eef7ab53a3'; Text = @'
|{
|  "$comment": "SecurityInsight risk index: the v2.2 key -> SI key translation (REQUIREMENTS #559, owner 2026-10-10: \"risk index base values must be adjusted to the si names\"). The shipped index (riskscore.index.locked.csv) is keyed by the SI generic fields; an index or a customer's own rows still written with the v2.2 columns (riskscore.index.custom.csv of 2.2 / 3.0, the Pro run file of an older web app) are translated with this table on load, row for row, in their order -- every v2.2 base value is carried over (engine/risk-analysis/_shared/RA-RiskIndexSi.ps1, ConvertTo-SIRiskIndexSiRows; proved by tests/pester/SIv3-RiskIndexSi.Tests.ps1). columns: v2.2 column -> SI column. values: per SI column, v2.2 value -> SI value (case-insensitive); a value not listed is kept as written. si_finding_type and si_component did not exist in v2.2: a translated row leaves them blank (= any). asset_class 'device' is the family of device_server and device_client: a 'device' matcher fits both. Severity keeps v2.2's Medium-High band as medium_high so its own base value survives (SI's finding severity folds it into medium). AssetBase = the asset side's base (v2.2 RiskProbablityScore_CriticialityTierLevel, keyed by tier); VulnerabilityBase = the vulnerability side's base (v2.2 RiskConsequenceScore_SecuritySeverity, keyed by severity).",
|  "kind": "risk-index-translation",
|  "version": "1.0.0",
|  "siColumns": ["si_finding_type", "si_category", "si_subcategory", "si_component", "si_finding_key", "asset_class", "si_severity", "VulnerabilityBase", "si_tier", "AssetBase", "Comments", "Precedence"],
|  "columns": {
|    "SecurityDomain": "asset_class",
|    "Category": "si_category",
|    "SubCategory": "si_subcategory",
|    "ConfigurationId": "si_finding_key",
|    "SecuritySeverity": "si_severity",
|    "RiskConsequenceScore_SecuritySeverity": "VulnerabilityBase",
|    "CriticalityTierLevel": "si_tier",
|    "RiskProbablityScore_CriticialityTierLevel": "AssetBase",
|    "Comments": "Comments",
|    "Precedence": "Precedence"
|  },
|  "values": {
|    "asset_class": {
|      "Endpoint": "device",
|      "Identity": "identity",
|      "Azure": "cloud_resource",
|      "PublicIP": "public_ip"
|    },
|    "si_severity": {
|      "Very High": "critical",
|      "Critical": "critical",
|      "High": "high",
|      "Medium-High": "medium_high",
|      "Medium": "medium",
|      "Moderate": "medium",
|      "Low": "low",
|      "Informational": "info",
|      "Info": "info"
|    },
|    "si_tier": {
|      "Critical - tier 0": "0",
|      "High - tier 1": "1",
|      "Medium - tier 2": "2",
|      "Low - tier 3": "3"
|    }
|  },
|  "assetClasses": ["device_server", "device_client", "device", "identity", "cloud_resource", "public_ip"],
|  "riskFactorsV1": {
|    "$comment": "The risk-factor catalog BEFORE model v2 (1.0.0): per factor id its shipped name, impact, stage and axis. A Pro override (cfg.ItemOverride risk-factors:<id>) made against it is converged to model v2 on the next template publish / update (SI-ProOverrideMigration.ps1): a value equal to this 1.0.0 default takes the new shipped value, a value the customer changed is kept; stage becomes state; retired factors (removed) are listed with what replaced them.",
|    "factors": {"internet_exposed":{"name":"Internet exposed","impact":1,"stage":"production","axis":"probability"},"unsupported_os":{"name":"Unsupported operating system","impact":1,"stage":"production","axis":"probability"},"compromised_recently":{"name":"Involved in a recent incident","impact":1,"stage":"production","axis":"probability"},"high_machine_risk":{"name":"High machine risk","impact":1,"stage":"production","axis":"probability"},"antivirus_disabled":{"name":"Antivirus disabled","impact":1,"stage":"production","axis":"probability"},"antivirus_out_of_date":{"name":"Antivirus out of date","impact":1,"stage":"production","axis":"probability"},"not_onboarded":{"name":"Not onboarded to Defender for Endpoint","impact":1,"stage":"production","axis":"probability"},"unmanaged":{"name":"Unmanaged device","impact":1,"stage":"production","axis":"probability"},"excluded_from_defender":{"name":"Excluded from Defender","impact":1,"stage":"production","axis":"probability"},"no_mfa":{"name":"No MFA registered","impact":1,"stage":"production","axis":"probability"},"no_owner":{"name":"Service principal without owner","impact":1,"stage":"production","axis":"probability"},"stale_sign_in":{"name":"No sign-in for 90 days","impact":1,"stage":"production","axis":"probability"},"very_stale_sign_in":{"name":"No sign-in for a year","impact":1,"stage":"production","axis":"probability"},"never_signed_in":{"name":"Never signed in","impact":1,"stage":"production","axis":"probability"},"old_account":{"name":"Account older than 90 days","impact":1,"stage":"production","axis":"probability"},"old_password":{"name":"Password not changed for a year","impact":1,"stage":"production","axis":"probability"},"publisher_not_verified":{"name":"Publisher not verified","impact":1,"stage":"production","axis":"probability"},"multitenant_app":{"name":"Multi-tenant application","impact":1,"stage":"production","axis":"probability"},"permanent_privileged_role":{"name":"Permanent privileged role","impact":1,"stage":"production","axis":"probability"},"expiring_credentials":{"name":"Credentials expire within 30 days","impact":1,"stage":"production","axis":"probability"},"has_secret":{"name":"Client secret in use","impact":1,"stage":"production","axis":"probability"},"expired_credentials":{"name":"Expired credentials","impact":1,"stage":"production","axis":"probability"},"identity_high_blast_radius":{"name":"High blast radius (Defender for Identity)","impact":1,"stage":"production","axis":"probability"},"identity_at_risk":{"name":"Identity at risk (Defender for Identity)","impact":1,"stage":"production","axis":"probability"},"break_glass":{"name":"Emergency-access account","impact":1,"stage":"production","axis":"probability"},"leaked_credentials":{"name":"Leaked credentials","impact":1,"stage":"testing","axis":"probability"},"high_risk_port_open":{"name":"Administrative port open to the internet","impact":1,"stage":"production","axis":"probability"},"high_cvss_public_ip":{"name":"CVSS 9 or higher","impact":1,"stage":"production","axis":"probability"},"ms_criticality_high":{"name":"High Microsoft criticality","impact":1,"stage":"production","axis":"consequence"},"production_environment":{"name":"Production environment","impact":1,"stage":"production","axis":"consequence"},"restricted_data":{"name":"Restricted data","impact":1,"stage":"production","axis":"consequence"},"confidential_data":{"name":"Confidential data","impact":1,"stage":"production","axis":"consequence"},"exploit_available":{"name":"Exploit available","impact":1,"stage":"production","axis":"probability"},"remote_code_execution":{"name":"Remote code execution","impact":1,"stage":"production","axis":"consequence"},"report_scoped":{"name":"Factors computed inside one report","impact":1,"stage":"production","axis":"probability"}},
|    "removed": { "very_stale_sign_in": "stale_sign_in", "break_glass": "classification:break_glass_patterns" }
|  }
|}
'@ }
$__siSupportFiles['engine/pro-settings/SI-ProOverrideMigration.ps1'] = @{ Sha256 = 'ad657db2a03088c59f46d51f3ac497d931d3d7adf7ac13f54f5f350312b01794'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- THE CUSTOMER'S OVERRIDES FOLLOW THE RISK FACTOR MODEL V2 (CONVERGE-DEFAULTS).
|
|    The risk index was re-keyed from the 2.2 columns to the SI generic fields, and the risk-factor catalog moved to model
|    v2 (shortName / group / class / impact 1-5 / state instead of stage). A Pro install keeps the customer's changes as
|    cfg.ItemOverride rows keyed by the OLD shape. Left alone they would become orphans: a risk index override under a
|    2.2 key matches no template any more (and would come back as an "own" row in the wrong column set), a factor override
|    still says `stage` and lacks the v2 fields, and an override of a removed factor (break_glass) would come back as a
|    factor of its own. On the next template publish / update (setup\Publish-SITemplates.ps1 with the shipped templates,
|    what setup and the updater run) every such row is translated through the SHIPPED translation table
|    (risk-analysis-detection\riskscore.index.translation.locked.json) -- the customer's values are kept:
|
|      riskindex  'row/<6 x 2.2 dims>[#n]' -> 'row/<8 x SI dims>[#n]' (si_finding_type | si_category | si_subcategory |
|                 si_component | si_finding_key | asset_class | si_severity | si_tier); its body translated column by column
|                 (its base values and its place unchanged); a 'disable' moves with its key. When the new key already has
|                 an override (the customer redid it), the new one is kept and the old row removed -- said.
|      datamodel  'risk-factors:<id>' with a pre-v2 body: stage -> state (not_used / testing = disabled; a built-in factor
|                 is never disabled -- it stays enabled and that is said); the v2 fields it lacks come from the shipped
|                 factor; a value EQUAL to the 1.0.0 default (riskFactorsV1 in the table: impact 1, the old name) takes the
|                 new shipped value, a value the customer changed is kept (impact held to 1..5). A 'disable' of a built-in
|                 factor is removed (it cannot be switched off). An override of a REMOVED factor (very_stale_sign_in,
|                 break_glass) is removed and said what replaced it.
|    Every write goes through Set-SIProItem (validated, ChangeLog), the old key's removal too ('inherit'); an item that does
|    not validate after translation is left as it was and reported -- nothing is half-migrated. Running it again changes
|    nothing (an already-migrated row is not touched).
|
|    PURE except Invoke-SIProOverrideMigration. PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|function Get-SIProOverrideTranslation {
|    <# The shipped translation table (the whole JSON document), from -SIRoot. #>
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $p = [System.IO.Path]::Combine($SIRoot, 'risk-analysis-detection', 'riskscore.index.translation.locked.json')
|    return ([System.IO.File]::ReadAllText($p) | ConvertFrom-Json)
|}
|
|function ConvertTo-SIProRiskIndexSiKey {
|    <# PURE. An old 2.2 risk index item key ('row/<SecurityDomain>|<Category>|<SubCategory>|<ConfigurationId>|<Severity>|<Tier>'
|       with an optional '#n') -> the SI key; $null when the key is not a 2.2 key (8 dimensions already, or not a row key). #>
|    param([Parameter(Mandatory)][string]$Key, [Parameter(Mandatory)][hashtable]$Translation)
|    if ($Key -notmatch '^row/') { return $null }
|    $suffix = ''; $body = $Key.Substring(4)
|    $m = [regex]::Match($body, '#\d+$'); if ($m.Success) { $suffix = $m.Value; $body = $body.Substring(0, $m.Index) }
|    $d = $body.Split('|')
|    if ($d.Count -ne 6) { return $null }
|    $v = { param($c, $x) ConvertTo-SIRiskIndexSiValue -Column $c -Value $x -Translation $Translation }
|    $si = @('', (& $v 'si_category' $d[1]), (& $v 'si_subcategory' $d[2]), '', (& $v 'si_finding_key' $d[3]), (& $v 'asset_class' $d[0]), (& $v 'si_severity' $d[4]), (& $v 'si_tier' $d[5]))
|    return ('row/' + (($si | ForEach-Object { ([string]$_).Trim() }) -join '|') + $suffix)
|}
|
|function ConvertTo-SIProPascalName {
|    <# PURE. An id -> a PascalCase short name (old_thing_2 -> OldThing2), for a customer's own factor that has none. #>
|    param([string]$Id)
|    $s = (@(([string]$Id) -split '[^A-Za-z0-9]+' | Where-Object { $_ } | ForEach-Object { $_.Substring(0, 1).ToUpperInvariant() + $_.Substring(1) }) -join '')
|    if ($s -notmatch '^[A-Z]') { $s = 'F' + $s }
|    if ($s.Length -gt 24) { $s = $s.Substring(0, 24) }
|    if ($s.Length -lt 2) { $s = $s + 'X' }
|    return $s
|}
|
|function ConvertTo-SIProFactorV2Body {
|    <#
|        PURE. One pre-v2 factor override body -> its model v2 body (CONVERGE-DEFAULTS, see the header). -Shipped: the shipped
|        v2 factor of that id ($null for the customer's own factor); -V1: the 1.0.0 default of that id ($null when it was not
|        shipped). Returns @{ Body (ordered); Notes }.
|    #>
|    param([Parameter(Mandatory)]$Override, $Shipped, $V1)
|    $notes = New-Object System.Collections.Generic.List[string]
|    $o = [ordered]@{}
|    foreach ($p in $Override.PSObject.Properties) { $o[$p.Name] = $p.Value }
|    $id = [string]$o['id']
|    $builtin = ($null -ne $Shipped -and [string]$Shipped.class -ne 'optional')
|    # stage -> state
|    if (-not $o.Contains('state')) {
|        $st = 'enabled'
|        if ($o.Contains('stage') -and [string]$o['stage'] -in 'not_used', 'testing') { $st = 'disabled' }
|        if ($st -eq 'disabled' -and $builtin) { $st = 'enabled'; $notes.Add(("{0} was switched off ({1}); it is built-in now and stays enabled -- lower its impact instead" -f $id, [string]$o['stage'])) }
|        $o['state'] = $st
|    }
|    if ($o.Contains('stage')) { $o.Remove('stage') }
|    # the v2 fields it lacks: the shipped factor's (a customer's own factor: derived, optional)
|    $fill = @('shortName', 'group', 'class', 'appliesTo', 'axis', 'evaluatedBy', 'providers', 'combine', 'legacyTokens', 'description', 'findingKinds', 'criteria', 'ciColumn')
|    foreach ($k in $fill) {
|        if ($o.Contains($k)) { continue }
|        if ($Shipped -and $Shipped.PSObject.Properties[$k]) { $o[$k] = $Shipped.$k }
|    }
|    if (-not $o.Contains('shortName')) { $o['shortName'] = ConvertTo-SIProPascalName $id }
|    if (-not $o.Contains('class')) { $o['class'] = 'optional' }
|    if (-not $o.Contains('group')) { $o['group'] = $(if ([string]$o['appliesTo'] -eq 'finding') { 'Severity' } else { 'Exposure' }) }
|    # a value equal to the 1.0.0 default takes the new shipped value; the customer's own value is kept
|    $imp = $null; if ($o.Contains('impact')) { $imp = ConvertTo-SINumberOrNull $o['impact'] }
|    $v1Imp = $null; if ($V1) { $v1Imp = ConvertTo-SINumberOrNull $V1.impact }
|    if ($Shipped -and ($null -eq $imp -or ($null -ne $v1Imp -and $imp -eq $v1Imp))) { $o['impact'] = [int]$Shipped.impact }
|    elseif ($null -eq $imp) { $o['impact'] = 1 }
|    else {
|        $n = [int][Math]::Round($imp); if ($n -lt 1) { $n = 1 }; if ($n -gt 5) { $n = 5 }
|        if ($n -ne $imp) { $notes.Add(("{0}: impact {1} held to {2} (1..5)" -f $id, $imp, $n)) }
|        $o['impact'] = $n
|    }
|    if ($Shipped -and $V1 -and [string]$o['name'] -ceq [string]$V1.name) { $o['name'] = [string]$Shipped.name }
|    if (-not ([string]$o['name']).Trim()) { if ($Shipped) { $o['name'] = [string]$Shipped.name } else { $o['name'] = $id } }
|    return @{ Body = $o; Notes = $notes.ToArray() }
|}
|
|function Test-SIProFactorBodyIsV2 {
|    <# PURE. $true when a factor body already carries the v2 shape (state, shortName, group, class; no stage). #>
|    param($Body)
|    if ($null -eq $Body) { return $true }
|    foreach ($k in 'state', 'shortName', 'group', 'class') { if (-not $Body.PSObject.Properties[$k]) { return $false } }
|    return (-not $Body.PSObject.Properties['stage'])
|}
|
|function Get-SIProOverrideMigrationPlan {
|    <#
|    .SYNOPSIS  PURE. The overrides that need the v2 shape -> the actions: @{ Kind; OldKey; NewKey; State; Body (text or $null);
|               Format; BaseHash; BaseVersion; Action = move | rewrite | remove; Reason }. Rows already in the v2 shape give none.
|    .PARAMETER Overrides       cfg.ItemOverride rows (Kind, ItemKey, State, BodyJson, Format, BaseVersion, BaseHash)
|    .PARAMETER Translation     the shipped translation table (Get-SIProOverrideTranslation)
|    .PARAMETER ShippedFactors  the shipped v2 factors (data-model\risk-factors.locked.json .factors)
|    .PARAMETER TemplateHashes  '<kind>/<key>' -> the shipped template's content hash (the new BaseHash of a moved row)
|    #>
|    param([AllowEmptyCollection()][object[]]$Overrides = @(), [Parameter(Mandatory)]$Translation, [AllowEmptyCollection()][object[]]$ShippedFactors = @(),
|          [hashtable]$TemplateHashes = @{})
|    $tr = @{ columns = [ordered]@{}; values = @{} }
|    foreach ($p in $Translation.columns.PSObject.Properties) { $tr.columns[$p.Name] = [string]$p.Value }
|    foreach ($p in $Translation.values.PSObject.Properties) { $m = @{}; foreach ($q in $p.Value.PSObject.Properties) { $m[$q.Name.ToLowerInvariant()] = [string]$q.Value }; $tr.values[$p.Name] = $m }
|    $v1 = @{}; $removed = @{}
|    if ($Translation.PSObject.Properties['riskFactorsV1']) {
|        foreach ($p in $Translation.riskFactorsV1.factors.PSObject.Properties) { $v1[$p.Name] = $p.Value }
|        foreach ($p in $Translation.riskFactorsV1.removed.PSObject.Properties) { $removed[$p.Name] = [string]$p.Value }
|    }
|    $shipped = @{}; foreach ($f in $ShippedFactors) { if ($f -and $f.id) { $shipped[[string]$f.id] = $f } }
|    $have = @{}; foreach ($o in $Overrides) { $have[('{0}/{1}' -f (Get-SIProRowValue $o 'Kind'), (Get-SIProRowValue $o 'ItemKey'))] = $true }
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($o in $Overrides) {
|        $kind = [string](Get-SIProRowValue $o 'Kind'); $key = [string](Get-SIProRowValue $o 'ItemKey'); $state = [string](Get-SIProRowValue $o 'State')
|        $bodyText = [string](Get-SIProRowValue $o 'BodyJson'); $fmt = [string](Get-SIProRowValue $o 'Format'); if (-not $fmt) { $fmt = 'json' }
|        $bv = [string](Get-SIProRowValue $o 'BaseVersion'); $bh = [string](Get-SIProRowValue $o 'BaseHash')
|        if ($kind -eq 'riskindex') {
|            $nk = ConvertTo-SIProRiskIndexSiKey -Key $key -Translation $tr
|            $body = $null; $isOld = $false
|            if ($bodyText) { try { $body = $bodyText | ConvertFrom-Json } catch { $body = $null }; if ($body) { $isOld = Test-SIRiskIndexV22Form @($body) } }
|            if (-not $nk -and -not $isOld) { continue }
|            if (-not $nk) { $nk = $key }
|            $newBody = $null
|            if ($state -eq 'override' -and $body) {
|                $si = ConvertTo-SIRiskIndexSiRow -Row $body -Translation $tr
|                # an item keeps its place: Precedence travels as it was stored
|                if ($body.PSObject.Properties['Precedence']) { $si['Precedence'] = [string]$body.Precedence }
|                $newBody = ConvertTo-Json -InputObject ([pscustomobject]$si) -Compress
|                # the key is made of the translated body's dimensions (a repeat keeps its '#n')
|                $sfx = ''; $mm = [regex]::Match($key, '#\d+$'); if ($mm.Success) { $sfx = $mm.Value }
|                $nk = 'row/' + ((@('si_finding_type', 'si_category', 'si_subcategory', 'si_component', 'si_finding_key', 'asset_class', 'si_severity', 'si_tier') | ForEach-Object { ([string]$si[$_]).Trim() }) -join '|') + $sfx
|            }
|            if ($nk -ne $key -and $have.ContainsKey('riskindex/' + $nk)) {
|                $out.Add([pscustomobject]@{ Kind = $kind; OldKey = $key; NewKey = $nk; State = 'inherit'; Body = $null; Format = $fmt; BaseHash = $null; BaseVersion = $null; Action = 'remove'
|                        Reason = ("the risk index row {0} is already overridden under its new key {1} -- that one is kept, the old row removed" -f $key, $nk) })
|                continue
|            }
|            $nh = $bh; if ($TemplateHashes.ContainsKey('riskindex/' + $nk)) { $nh = [string]$TemplateHashes['riskindex/' + $nk] }
|            $out.Add([pscustomobject]@{ Kind = $kind; OldKey = $key; NewKey = $nk; State = $state; Body = $newBody; Format = $fmt; BaseHash = $nh; BaseVersion = $bv
|                    Action = $(if ($nk -eq $key) { 'rewrite' } else { 'move' }); Reason = ("risk index row keyed by the SI fields (was {0})" -f $key) })
|            continue
|        }
|        if ($kind -ne 'datamodel' -or $key -notmatch '^risk-factors:(.+)$') { continue }
|        $id = $Matches[1]
|        if ($removed.ContainsKey($id)) {
|            $out.Add([pscustomobject]@{ Kind = $kind; OldKey = $key; NewKey = $key; State = 'inherit'; Body = $null; Format = $fmt; BaseHash = $null; BaseVersion = $null; Action = 'remove'
|                    Reason = ("risk factor {0} no longer exists (replaced by {1}) -- your override of it is removed" -f $id, $removed[$id]) })
|            continue
|        }
|        $sf = $null; if ($shipped.ContainsKey($id)) { $sf = $shipped[$id] }
|        if ($state -eq 'disable') {
|            if ($sf -and [string]$sf.class -ne 'optional') {
|                $out.Add([pscustomobject]@{ Kind = $kind; OldKey = $key; NewKey = $key; State = 'inherit'; Body = $null; Format = $fmt; BaseHash = $null; BaseVersion = $null; Action = 'remove'
|                        Reason = ("risk factor {0} is built-in and cannot be switched off -- your 'disable' is removed (lower its impact instead)" -f $id) })
|            }
|            continue
|        }
|        if ($state -ne 'override' -or -not $bodyText) { continue }
|        $body = $null; try { $body = $bodyText | ConvertFrom-Json } catch { continue }
|        if (Test-SIProFactorBodyIsV2 $body) { continue }
|        $vv = $null; if ($v1.ContainsKey($id)) { $vv = $v1[$id] }
|        $c = ConvertTo-SIProFactorV2Body -Override $body -Shipped $sf -V1 $vv
|        $nh = $bh; if ($TemplateHashes.ContainsKey('datamodel/' + $key)) { $nh = [string]$TemplateHashes['datamodel/' + $key] }
|        $why = 'risk factor override in the model v2 shape (your values kept)'
|        if (@($c.Notes).Count) { $why = $why + ' -- ' + (@($c.Notes) -join '; ') }
|        $out.Add([pscustomobject]@{ Kind = $kind; OldKey = $key; NewKey = $key; State = 'override'; Body = (ConvertTo-Json -InputObject ([pscustomobject]$c.Body) -Compress -Depth 30); Format = $fmt
|                BaseHash = $nh; BaseVersion = $bv; Action = 'rewrite'; Reason = $why })
|    }
|    return $out.ToArray()
|}
|
|function Resolve-SIProRunOverrides {
|    <#
|    .SYNOPSIS  RUN START: the stored cfg.ItemOverride rows with every row from the PREVIOUS model translated IN MEMORY for this
|               run (the same plan the update applies -- Get-SIProOverrideMigrationPlan). Nothing is written: the update's
|               Invoke-SIProOverrideMigration stores it. A row the plan removes (a removed factor, a 'disable' of a built-in
|               factor, an old risk index row the customer already redid) is left out; a moved / rewritten row takes its new
|               key / body. Returns @{ Overrides; Notes (one per item) }. NEVER THROWS: without the translation table the rows
|               come back as stored (each then validated as usual -- one that does not validate is left out by the caller).
|    #>
|    param([AllowEmptyCollection()][object[]]$Overrides = @(), [Parameter(Mandatory)][string]$SIRoot, $Translation, [AllowEmptyCollection()][object[]]$ShippedFactors)
|    $rows = @($Overrides | Where-Object { $_ })
|    $notes = New-Object System.Collections.Generic.List[string]
|    if (-not $rows.Count) { return [pscustomobject]@{ Overrides = @(); Notes = @() } }
|    try {
|        if (-not $Translation) { $Translation = Get-SIProOverrideTranslation -SIRoot $SIRoot }
|        if ($null -eq $ShippedFactors) { $ShippedFactors = @(([System.IO.File]::ReadAllText([System.IO.Path]::Combine($SIRoot, 'data-model', 'risk-factors.locked.json')) | ConvertFrom-Json).factors) }
|        $plan = @(Get-SIProOverrideMigrationPlan -Overrides $rows -Translation $Translation -ShippedFactors @($ShippedFactors))
|    } catch {
|        return [pscustomobject]@{ Overrides = $rows; Notes = @(("your overrides from the previous model could not be translated for this run ({0}) -- they are read as stored" -f $_.Exception.Message)) }
|    }
|    if (-not $plan.Count) { return [pscustomobject]@{ Overrides = $rows; Notes = @() } }
|    $byOld = @{}; foreach ($a in $plan) { $byOld[('{0}/{1}' -f $a.Kind, $a.OldKey)] = $a }
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($o in $rows) {
|        $k = '{0}/{1}' -f (Get-SIProRowValue $o 'Kind'), (Get-SIProRowValue $o 'ItemKey')
|        if (-not $byOld.ContainsKey($k)) { $out.Add($o); continue }
|        $a = $byOld[$k]
|        if ($a.Action -eq 'remove') { $notes.Add(("{0}: {1} (for this run; the next update stores it)" -f $k, $a.Reason)); continue }
|        $out.Add([pscustomobject]@{ Kind = $a.Kind; ItemKey = $a.NewKey; State = $a.State
|                BodyJson = $(if ($null -ne $a.Body) { [string]$a.Body } else { Get-SIProRowValue $o 'BodyJson' }); Format = $a.Format
|                BaseVersion = $a.BaseVersion; BaseHash = $a.BaseHash })
|        $notes.Add(("{0}: {1} -- translated for this run (the next update stores it)" -f $k, $a.Reason))
|    }
|    return [pscustomobject]@{ Overrides = $out.ToArray(); Notes = $notes.ToArray() }
|}
|
|function Invoke-SIProOverrideMigration {
|    <#
|    .SYNOPSIS  Applies Get-SIProOverrideMigrationPlan to the install's cfg.ItemOverride rows (see the header). Returns
|               @{ Applied = actions written; Refused = @{ Action; Reason } (left as they were); Plan }. -WhatIf: plan only.
|    #>
|    [CmdletBinding(SupportsShouldProcess)]
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$SIRoot, [AllowEmptyCollection()][object[]]$Templates = @(), [string]$ChangedBy = 'SecurityInsight update')
|    $ov = @(Read-SIProItemOverrides -Store $Store)
|    $tr = Get-SIProOverrideTranslation -SIRoot $SIRoot
|    $sf = @(([System.IO.File]::ReadAllText([System.IO.Path]::Combine($SIRoot, 'data-model', 'risk-factors.locked.json')) | ConvertFrom-Json).factors)
|    $hashes = @{}
|    foreach ($t in $Templates) { $k = '{0}/{1}' -f (Get-SIProRowValue $t 'Kind'), (Get-SIProRowValue $t 'ItemKey'); if (-not $hashes.ContainsKey($k)) { try { $hashes[$k] = Get-SIProRowContentHash $t } catch { } } }
|    $plan = @(Get-SIProOverrideMigrationPlan -Overrides $ov -Translation $tr -ShippedFactors $sf -TemplateHashes $hashes)
|    $applied = New-Object System.Collections.Generic.List[object]; $refused = New-Object System.Collections.Generic.List[object]
|    if ($plan.Count -eq 0 -or $WhatIfPreference) { return [pscustomobject]@{ Applied = @(); Refused = @(); Plan = $plan } }
|    $ctx = Get-SIProConfigContext -SIRoot $SIRoot
|    foreach ($a in $plan) {
|        try {
|            if ($a.Action -eq 'remove') {
|                Set-SIProItem -Store $Store -Kind $a.Kind -Key $a.OldKey -State inherit -ChangedBy $ChangedBy -Reason $a.Reason -Context $ctx
|            } else {
|                # the new row first (validated -- a refusal leaves the old row as it was), then the old key goes
|                Set-SIProItem -Store $Store -Kind $a.Kind -Key $a.NewKey -State $a.State -Body $a.Body -Format $a.Format -BaseVersion $a.BaseVersion -BaseHash $a.BaseHash -ChangedBy $ChangedBy -Reason $a.Reason -Context $ctx
|                if ($a.NewKey -ne $a.OldKey) { Set-SIProItem -Store $Store -Kind $a.Kind -Key $a.OldKey -State inherit -ChangedBy $ChangedBy -Reason ('moved to ' + $a.NewKey) -Context $ctx }
|            }
|            $applied.Add($a)
|        } catch { $refused.Add([pscustomobject]@{ Action = $a; Reason = $_.Exception.Message }) }
|    }
|    return [pscustomobject]@{ Applied = $applied.ToArray(); Refused = $refused.ToArray(); Plan = $plan }
|}
'@ }
$__siSupportFiles['data-model/risk-factors.locked.json'] = @{ Sha256 = '86f989c3f2b9377d0ed88d464fac90feb90637e73f4c4d7a63c2f69ef7886554'; Text = @'
|{
|  "$comment": "SecurityInsight risk-factor catalog -- risk factor model v2 (REQUIREMENTS #559, owner 2026-10-10: \"everything is a risk factor\", \"each of the risk factors will be linked to an risk score impact value (1-5)\", \"Sum, no cap\"). Template kind: risk-factor. Each factor is defined ONCE over SI fields (never provider fields) and carries: shortName = the name reports, Excel, PDF and mails show (PascalCase, precise wording, no editable number in it); name = its description in the GUI; appliesTo = asset (evaluated on the CI; adds to the ASSET side of the score) or finding (evaluated on the de-duplicated finding; adds to the VULNERABILITY side), never both; group = Exposure, Device health, Identity, Privilege, Apps, Importance, Exploitability, Impact, Severity or Lifecycle; class = builtin (always on: the engine refuses to switch it off, the web app too) or optional (the customer may switch it off); impact = 1..5 (very low .. very high), what the factor ADDS to its side of the score; state = enabled | disabled (a builtin factor is never disabled). THE SCORE: asset side = the risk index base (by finding x asset class x tier) + the SUM of the enabled asset factors' impacts; vulnerability side = the risk index base (by finding type / category / subcategory / severity) + the SUM of the enabled finding factors' impacts; no cap; risk score = asset side x vulnerability side (engine/risk-analysis/_shared/RA-RiskScore.ps1). axis = the report column the factor's short name is listed in (probability = RiskFactor_Probability_Detailed, consequence = RiskFactor_Consequence_Detailed) -- kept for the reports' CI blocks (si_rf_p / si_rf_c); the score side is appliesTo, never axis. Tier is never a factor (the risk index carries it); break glass is a classification (data-model list break_glass_patterns), not a factor. legacyTokens = the RF_* names / engine tokens this factor replaces, so the reports' tokens map to it and one factor counts once. evaluatedBy: catalog (this file decides) or report (computed inside one report's query). description = what the factor means to a person; combine = how its conditions join (any / all); providers = the provider fields that PROVE it, per provider, read from the field mappings (data-model/mappings) -- generated by Update-SIRiskFactorProviders (engine/data-model/SI-RiskFactorCatalog.ps1) and proven equal to the mappings by a test, never hand-edited; ciColumn = the factor gets its own SI_CI_CL column si_rf_<id>. A factor whose SI field is not mapped yet stays UNKNOWN (never a finding, #546). Customer overrides: risk-factors.custom.json (Pro: cfg.ItemOverride), per factor id -- impact, state (optional factors only) and the criteria (wizards).",
|  "kind": "risk-factor",
|  "version": "2.0.0",
|  "groups": ["Exposure", "Device health", "Identity", "Privilege", "Apps", "Importance", "Exploitability", "Impact", "Severity", "Lifecycle"],
|  "conditionOps": ["eq", "ne", "in", "not_in", "is_true", "is_false", "is_empty", "not_empty", "gt", "gte", "lt", "lte", "like", "contains", "contains_any", "matches", "older_than_days", "newer_than_days", "in_ranges", "in_list"],
|  "factors": [
|    { "id": "internet_exposed", "shortName": "InternetExposed", "name": "The asset can be reached from the internet", "appliesTo": "asset", "group": "Exposure", "class": "builtin", "impact": 4, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"azure":[{"siField":"si_internet_exposed","sources":["derived.isPubliclyExposed"],"recordTypes":["azure_resource"]}],"eg":[{"siField":"si_internet_exposed","sources":["node.NodeProperties.rawData.exposedToInternet.type","node.NodeProperties.rawData.hasInternetExposureSignal"],"recordTypes":["device","azure_resource","public_ip"]}],"mdc":[{"siField":"si_internet_exposed","sources":["exposure.internetExposed"],"recordTypes":["azure_resource"]}],"mde":[{"siField":"si_ip_addresses","sources":["machine.ipAddresses[*].ipAddress","machine.lastIpAddress"],"recordTypes":["device"]},{"siField":"si_internet_exposed","sources":["deviceInfo.IsInternetFacing"],"recordTypes":["device"]}],"servicenow":[{"siField":"si_ip_addresses","sources":["ci.ip_address"],"recordTypes":["cmdb_ci"]}],"shodan":[{"siField":"si_internet_exposed","sources":["host.ports"],"recordTypes":["public_ip"]}],"network":[{"siField":"si_ip_addresses","list":"internet_exposed_ranges","setting":"SI_InternetExposedRanges"}]},
|      "description": "The asset can be reached from the internet: any provider says so (Defender for Endpoint internet-facing, Exposure Graph exposure, the Azure public-exposure derivation, Shodan open ports), or one of its addresses is in the customer's exposed network ranges (DMZ, online landing zones).", "combine": "any", "ciColumn": true,
|      "legacyTokens": ["RF_P_InternetExposed", "RF_P_Internet", "InternetExposureSignal", "InternetFacingDevice"],
|      "when": {"any":[{"field":"si_internet_exposed","op":"is_true"},{"field":"si_ip_addresses","op":"in_ranges","value":"internet_exposed_ranges"}]} },
|    { "id": "high_risk_port_open", "shortName": "PortOpenInternet", "name": "An administrative or database port is open to the internet", "appliesTo": "asset", "group": "Exposure", "class": "builtin", "impact": 5, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"shodan":[{"siField":"si_open_ports","sources":["host.ports[*]"],"recordTypes":["public_ip"]}]},
|      "description": "An administrative or database port is open to the internet (Shodan).", "combine": "all",
|      "legacyTokens": ["RF_P_HighRiskPort", "AdminPort"],
|      "when": {"all":[{"field":"si_open_ports","op":"contains_any","value":"high_risk_ports"}]} },
|    { "id": "compromised_recently", "shortName": "RecentIncident", "name": "The asset was involved in a recent incident", "appliesTo": "asset", "group": "Exposure", "class": "builtin", "impact": 4, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_is_compromised_recently","sources":["node.NodeProperties.rawData.isCompromisedRecently"],"recordTypes":["device","user","service_principal","azure_resource"]}]},
|      "description": "The asset was involved in a recent incident (Exposure Graph).", "combine": "all",
|      "legacyTokens": ["IsCompromisedRecently"],
|      "when": {"all":[{"field":"si_is_compromised_recently","op":"is_true"}]} },
|    { "id": "unsupported_os", "shortName": "UnsupportedOS", "name": "The operating system is out of vendor security support", "appliesTo": "asset", "group": "Device health", "class": "builtin", "impact": 4, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"ad":[{"siField":"si_os_name","sources":["computer.operatingSystem"],"recordTypes":["device"]},{"siField":"si_os_platform","sources":["computer.operatingSystem"],"recordTypes":["device"]},{"siField":"si_os_version","sources":["computer.operatingSystemVersion"],"recordTypes":["device"]}],"azure":[{"siField":"si_os_platform","sources":["resource.properties.storageProfile.osDisk.osType"],"recordTypes":["azure_resource"]}],"eg":[{"siField":"si_os_name","sources":["node.NodeProperties.rawData.osPlatform","node.NodeProperties.rawData.osDistribution"],"recordTypes":["device"]},{"siField":"si_os_platform","sources":["node.NodeProperties.rawData.osPlatform"],"recordTypes":["device"]},{"siField":"si_os_version","sources":["node.NodeProperties.rawData.osVersion"],"recordTypes":["device"]}],"entra":[{"siField":"si_os_name","sources":["device.operatingSystem"],"recordTypes":["device"]},{"siField":"si_os_platform","sources":["device.operatingSystem"],"recordTypes":["device"]},{"siField":"si_os_version","sources":["device.operatingSystemVersion"],"recordTypes":["device"]}],"intune":[{"siField":"si_os_name","sources":["device.operatingSystem"],"recordTypes":["device"]},{"siField":"si_os_platform","sources":["device.operatingSystem"],"recordTypes":["device"]},{"siField":"si_os_version","sources":["device.osVersion"],"recordTypes":["device"]}],"mde":[{"siField":"si_os_name","sources":["machine.osPlatform","deviceInfo.OSPlatform"],"recordTypes":["device"]},{"siField":"si_os_platform","sources":["machine.osPlatform","deviceInfo.OSPlatform"],"recordTypes":["device"]},{"siField":"si_os_version","sources":["machine.osVersion","machine.version","deviceInfo.OSVersion"],"recordTypes":["device"]}]},
|      "criteria": {"kind": "list", "list": "unsupported_os", "field": "si_os_name", "detailField": "si_os_version", "source": "collected"},
|      "description": "The operating system is out of vendor security support (the unsupported_os list, matched on the OS name every device provider reports).", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_LegacyEoS", "LegacyEndOfSupport"],
|      "when": {"all":[{"field":"si_os_version","op":"in_list","value":"unsupported_os"}]} },
|    { "id": "not_onboarded", "shortName": "NotOnboarded", "name": "The device is seen but not onboarded to Defender for Endpoint", "appliesTo": "asset", "group": "Device health", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_onboarding_status","sources":["node.NodeProperties.rawData.onboardingStatus"],"recordTypes":["device"]}],"mde":[{"siField":"si_onboarding_status","sources":["machine.onboardingStatus","deviceInfo.OnboardingStatus"],"recordTypes":["device"]}]},
|      "description": "The device is seen but not onboarded to Defender for Endpoint.", "combine": "all",
|      "legacyTokens": ["Unonboarded"],
|      "when": {"all":[{"field":"si_onboarding_status","op":"not_empty"},{"field":"si_onboarding_status","op":"ne","value":"onboarded"}]} },
|    { "id": "antivirus_disabled", "shortName": "AVDisabled", "name": "Microsoft Defender Antivirus is disabled", "appliesTo": "asset", "group": "Device health", "class": "builtin", "impact": 4, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"mde":[{"siField":"si_av_status","sources":["deviceInfo.DefenderAvStatus","machine.defenderAvStatus"],"recordTypes":["device"]}]},
|      "description": "Microsoft Defender Antivirus is disabled.", "combine": "all",
|      "legacyTokens": ["DefenderAvDisabled"],
|      "when": {"all":[{"field":"si_av_status","op":"eq","value":"disabled"}]} },
|    { "id": "antivirus_out_of_date", "shortName": "AVOutOfDate", "name": "Microsoft Defender Antivirus signatures are out of date", "appliesTo": "asset", "group": "Device health", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"mde":[{"siField":"si_av_status","sources":["deviceInfo.DefenderAvStatus","machine.defenderAvStatus"],"recordTypes":["device"]}]},
|      "description": "Microsoft Defender Antivirus signatures are out of date.", "combine": "all",
|      "legacyTokens": ["DefenderAvOutOfDate"],
|      "when": {"all":[{"field":"si_av_status","op":"eq","value":"out_of_date"}]} },
|    { "id": "excluded_from_defender", "shortName": "DefenderExcluded", "name": "The device is excluded in Defender", "appliesTo": "asset", "group": "Device health", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"mde":[{"siField":"si_is_excluded","sources":["machine.isExcluded","deviceInfo.IsExcluded"],"recordTypes":["device"]}]},
|      "description": "The device is excluded in Defender.", "combine": "all",
|      "legacyTokens": ["Excluded"],
|      "when": {"all":[{"field":"si_is_excluded","op":"is_true"}]} },
|    { "id": "high_machine_risk", "shortName": "HighMachineRisk", "name": "Defender for Endpoint rates the machine's risk high", "appliesTo": "asset", "group": "Device health", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_machine_risk","sources":["node.NodeProperties.rawData.machineRiskState"],"recordTypes":["device"]}],"mde":[{"siField":"si_machine_risk","sources":["machine.riskScore"],"recordTypes":["device"]}]},
|      "description": "Defender for Endpoint rates the machine's risk high.", "combine": "all",
|      "legacyTokens": ["HighMachineRisk", "RF_P_HighRiskDevice", "DeviceHighRiskScore"],
|      "when": {"all":[{"field":"si_machine_risk","op":"eq","value":"high"}]} },
|    { "id": "unmanaged", "shortName": "Unmanaged", "name": "No management agent manages the device", "appliesTo": "asset", "group": "Device health", "class": "optional", "impact": 2, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"intune":[{"siField":"si_managed_by","sources":["device.managementAgent"],"recordTypes":["device"]}],"mde":[{"siField":"si_managed_by","sources":["machine.managedBy","deviceInfo.DeviceManagementType"],"recordTypes":["device"]}]},
|      "description": "No management agent manages the device.", "combine": "all",
|      "legacyTokens": ["Unmanaged"],
|      "when": {"all":[{"field":"si_managed_by","op":"eq","value":"unmanaged"}]} },
|    { "id": "no_mfa", "shortName": "NoMFA", "name": "A user or guest with no MFA method registered", "appliesTo": "asset", "group": "Identity", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_mfa_registered","sources":["node.NodeProperties.rawData.isMfaRegistered"],"recordTypes":["user"]}],"entra":[{"siField":"si_mfa_registered","sources":["registration.isMfaRegistered"],"recordTypes":["user"]}]},
|      "description": "A user or guest with no MFA method registered (Entra registration details, else the Exposure Graph identity node). A registration that could not be read is unknown, never \"no MFA\".", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_NoMFA", "NoMfaIsRegistered"],
|      "when": {"all":[{"field":"si_identity_type","op":"in","value":["user","guest"]},{"field":"si_mfa_registered","op":"is_false"}]} },
|    { "id": "old_password", "shortName": "OldPassword", "name": "The password of a user or guest has not been changed for a long time", "appliesTo": "asset", "group": "Identity", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"ad":[{"siField":"si_password_last_changed","sources":["user.pwdLastSet"],"recordTypes":["user"]}],"eg":[{"siField":"si_password_last_changed","sources":["node.NodeProperties.rawData"],"recordTypes":["user"]}],"entra":[{"siField":"si_password_last_changed","sources":["user.lastPasswordChangeDateTime"],"recordTypes":["user"]},{"siField":"si_password_last_changed","sources":["profile.LastPasswordChangeDateTime"],"recordTypes":["user"]}]},
|      "criteria": {"kind": "threshold", "field": "si_password_last_changed", "op": "older_than_days", "min": 30, "max": 3650, "unit": "days", "source": "enum"},
|      "description": "The password of a user or guest has not been changed for a year: si_password_last_changed by the field authority of the identity's origin (a synchronised account: Active Directory pwdLastSet, never Entra; a cloud-only one: Entra). A password age that was never read, or that the authoritative provider did not report, is unknown -- never old.", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_OldPassword", "PasswordOver365Days", "PasswordOver730Days"],
|      "when": {"all":[{"field":"si_identity_type","op":"in","value":["user","guest"]},{"field":"si_password_last_changed","op":"older_than_days","value":365}]} },
|    { "id": "leaked_credentials", "shortName": "LeakedCreds", "name": "Credentials of the identity were found leaked", "appliesTo": "asset", "group": "Identity", "class": "builtin", "impact": 5, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_has_leaked_credentials","sources":["node.NodeProperties.rawData.hasLeakedCredentials","node.NodeProperties.rawData.hasAdLeakedCredentials"],"recordTypes":["user"]}]},
|      "$note": "new in 3.1 -- enters as testing (counts 0) until promoted",
|      "description": "Credentials of the identity were found leaked (Exposure Graph).", "combine": "all",
|      "legacyTokens": [],
|      "when": {"all":[{"field":"si_has_leaked_credentials","op":"is_true"}]} },
|    { "id": "identity_at_risk", "shortName": "IdentityAtRisk", "name": "Defender for Identity rates the identity at risk", "appliesTo": "asset", "group": "Identity", "class": "builtin", "impact": 4, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"mdi":[{"siField":"si_mdi_risk_state","sources":["identity.riskState","identity.RiskStatus","identity.RiskLevel"],"recordTypes":["user"]}]},
|      "description": "Defender for Identity rates the identity at risk.", "combine": "all",
|      "legacyTokens": ["RF_P_AtRisk", "RF_P_HighRisk", "MDI_AtRisk"],
|      "when": {"all":[{"field":"si_mdi_risk_state","op":"in","value":["at_risk","high"]}]} },
|    { "id": "identity_high_blast_radius", "shortName": "HighBlastRadius", "name": "Defender for Identity rates the identity's blast radius high", "appliesTo": "asset", "group": "Importance", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"mdi":[{"siField":"si_mdi_blast_radius","sources":["identity.BlastRadius","identity.blastRadius"],"recordTypes":["user"]}]},
|      "description": "Defender for Identity rates the identity's blast radius high.", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_HighBlastRadius"],
|      "when": {"all":[{"field":"si_mdi_blast_radius","op":"eq","value":"high"}]} },
|    { "id": "stale_sign_in", "shortName": "EnabledNoSignInStale", "name": "An enabled identity with no sign-in for a long time (days editable)", "appliesTo": "asset", "group": "Lifecycle", "class": "optional", "impact": 2, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"ad":[{"siField":"si_account_enabled","sources":["computer.userAccountControl","user.userAccountControl"],"recordTypes":["device","user"]},{"siField":"si_last_sign_in","sources":["user.lastLogonTimestamp"],"recordTypes":["user"]}],"eg":[{"siField":"si_account_enabled","sources":["node.NodeProperties.rawData.accountEnabled","node.NodeProperties.rawData.isEnabled"],"recordTypes":["user","service_principal"]}],"entra":[{"siField":"si_account_enabled","sources":["user.accountEnabled"],"recordTypes":["user"]},{"siField":"si_last_sign_in","sources":["user.signInActivity.lastSuccessfulSignInDateTime","user.signInActivity.lastSignInDateTime","user.signInActivity.lastNonInteractiveSignInDateTime"],"recordTypes":["user"]},{"siField":"si_account_enabled","sources":["sp.accountEnabled"],"recordTypes":["service_principal"]},{"siField":"si_last_sign_in","sources":["signIn.lastSignInActivity.lastSignInDateTime"],"recordTypes":["service_principal"]},{"siField":"si_account_enabled","sources":["device.accountEnabled"],"recordTypes":["device"]},{"siField":"si_last_sign_in","sources":["profile.LastSignInDateTime"],"recordTypes":["user","service_principal"]}],"mdi":[{"siField":"si_account_enabled","sources":["identity.IsAccountEnabled"],"recordTypes":["user"]},{"siField":"si_last_sign_in","sources":["identity.lastSeenActivity"],"recordTypes":["user"]}]},
|      "criteria": {"kind": "threshold", "field": "si_last_sign_in", "op": "older_than_days", "min": 7, "max": 3650, "unit": "days", "source": "enum"},
|      "$note": "today the reports use 90 or 180 days; one definition now (90)",
|      "description": "An ENABLED identity with no sign-in for 90 days (editable) -- identities only: a device or resource has no sign-in. The newest sign-in the providers authoritative for the identity's origin report (a synchronised account: Active Directory / Defender for Identity, with Entra; a cloud-only one: Entra). One stale factor: the days are the criteria (the former \"no sign-in for a year\" is this factor with more days). No sign-in recorded is NeverSignedIn; a sign-in or an enabled state the CI cannot decide is unknown, never stale.", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_Stale", "RF_P_StaleLogin", "StaleLastLogin", "StaleLastSignIn", "RF_P_VeryStale", "StaleOver365Days", "NoSignInStale", "NoSignInVeryStale"],
|      "when": {"all":[{"field":"si_identity_type","op":"in","value":["user","guest","service_principal"]},{"field":"si_account_enabled","op":"is_true"},{"field":"si_last_sign_in","op":"older_than_days","value":90}]} },
|    { "id": "never_signed_in", "shortName": "NeverSignedIn", "name": "An identity that has never signed in", "appliesTo": "asset", "group": "Lifecycle", "class": "optional", "impact": 2, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"ad":[{"siField":"si_last_sign_in","sources":["user.lastLogonTimestamp"],"recordTypes":["user"]}],"entra":[{"siField":"si_last_sign_in","sources":["user.signInActivity.lastSuccessfulSignInDateTime","user.signInActivity.lastSignInDateTime","user.signInActivity.lastNonInteractiveSignInDateTime"],"recordTypes":["user"]},{"siField":"si_last_sign_in","sources":["signIn.lastSignInActivity.lastSignInDateTime"],"recordTypes":["service_principal"]},{"siField":"si_last_sign_in","sources":["profile.LastSignInDateTime"],"recordTypes":["user","service_principal"]}],"mdi":[{"siField":"si_last_sign_in","sources":["identity.lastSeenActivity"],"recordTypes":["user"]}]},
|      "description": "An identity that has never signed in: the provider that decides the sign-in for the identity's origin is linked and reports none (a synchronised account: Active Directory; a cloud-only one: Entra). Without that provider the sign-in is unknown, never 'never signed in'.", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_NeverLoggedIn", "NeverAuthenticated"],
|      "when": {"all":[{"field":"si_identity_type","op":"in","value":["user","guest","service_principal"]},{"field":"si_last_sign_in","op":"is_empty"}]} },
|    { "id": "old_account", "shortName": "OldAccount", "name": "An identity created long ago (days editable)", "appliesTo": "asset", "group": "Lifecycle", "class": "optional", "impact": 1, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"ad":[{"siField":"si_created","sources":["computer.whenCreated","user.whenCreated"],"recordTypes":["device","user"]}],"azure":[{"siField":"si_created","sources":["resource.properties.timeCreated","resource.properties.creationTime","resource.systemData.createdAt"],"recordTypes":["azure_resource"]}],"entra":[{"siField":"si_created","sources":["user.createdDateTime"],"recordTypes":["user"]},{"siField":"si_created","sources":["device.registrationDateTime","device.createdDateTime"],"recordTypes":["device"]},{"siField":"si_created","sources":["profile.CreatedDateTime","sp.createdDateTime"],"recordTypes":["service_principal"]}]},
|      "criteria": {"kind": "threshold", "field": "si_created", "op": "older_than_days", "min": 1, "max": 3650, "unit": "days", "source": "enum"},
|      "description": "An identity (user, guest or service principal) created more than 90 days ago -- identities only: a device or resource is not an account.", "combine": "all",
|      "legacyTokens": ["RF_P_VeryOld", "AccountOver90DaysOld"],
|      "when": {"all":[{"field":"si_identity_type","op":"in","value":["user","guest","service_principal"]},{"field":"si_created","op":"older_than_days","value":90}]} },
|    { "id": "permanent_privileged_role", "shortName": "PermanentAdmin", "name": "A Tier 0 / Tier 1 role held permanently, not just-in-time", "appliesTo": "asset", "group": "Privilege", "class": "optional", "impact": 2, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"entra":[{"siField":"si_privilege_tier_permanent","sources":["profile.EntraRolesPermanentVerdict_Tier"],"recordTypes":["user","service_principal"]}]},
|      "description": "A Tier 0 / Tier 1 role held permanently (not just-in-time).", "combine": "all",
|      "legacyTokens": ["RF_P_Permanent", "RF_P_AlsoPermanent", "AlsoPermanentAssignment", "PermanentAssignment", "PermanentRole", "PermanentRoleAssignment"],
|      "when": {"all":[{"field":"si_privilege_tier_permanent","op":"lte","value":1}]} },
|    { "id": "has_secret", "shortName": "ClientSecret", "name": "The service principal authenticates with a client secret", "appliesTo": "asset", "group": "Apps", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"entra":[{"siField":"si_has_client_secret","sources":["sp.passwordCredentials[*].keyId","app.passwordCredentials[*].keyId"],"recordTypes":["service_principal"]}]},
|      "description": "The service principal authenticates with a client secret (a password), not only a certificate or a managed identity: a secret leaks more easily.", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_HasSecret", "HasClientSecret"],
|      "when": {"all":[{"field":"si_has_client_secret","op":"is_true"}]} },
|    { "id": "no_owner", "shortName": "NoOwner", "name": "A service principal or application without an owner", "appliesTo": "asset", "group": "Apps", "class": "optional", "impact": 2, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"entra":[{"siField":"si_is_orphan_sp","sources":["derived.ownerCount"],"recordTypes":["service_principal"]},{"siField":"si_is_orphan_sp","sources":["profile.IsOrphanSPN"],"recordTypes":["service_principal"]}]},
|      "description": "A service principal / application with no owner: nobody answers for its credentials and permissions.", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_NoOwner"],
|      "when": {"all":[{"field":"si_is_orphan_sp","op":"is_true"}]} },
|    { "id": "expired_credentials", "shortName": "CredsExpired", "name": "The service principal holds an expired secret or certificate", "appliesTo": "asset", "group": "Apps", "class": "optional", "impact": 2, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"entra":[{"siField":"si_credential_expiry_days","sources":["derived.credentialExpiryDays"],"recordTypes":["service_principal"]},{"siField":"si_credential_expiry_days","sources":["profile.CredentialExpiryDays"],"recordTypes":["service_principal"]}]},
|      "description": "The service principal holds an expired secret or certificate.", "combine": "all",
|      "legacyTokens": ["RF_P_HasExpired", "RF_P_AlreadyExpired", "ExpiredCredential"],
|      "when": {"all":[{"field":"si_credential_expiry_days","op":"lt","value":0}]} },
|    { "id": "expiring_credentials", "shortName": "CredsExpiring", "name": "The service principal has a secret or certificate that expires soon", "appliesTo": "asset", "group": "Apps", "class": "optional", "impact": 1, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"entra":[{"siField":"si_credential_expiry_days","sources":["derived.credentialExpiryDays"],"recordTypes":["service_principal"]},{"siField":"si_credential_expiry_days","sources":["profile.CredentialExpiryDays"],"recordTypes":["service_principal"]}]},
|      "description": "The service principal has a secret or certificate that expires within 30 days (the reports' \"HasSecret\").", "combine": "all", "ciColumn": true,
|      "legacyTokens": ["RF_P_ExpiresVerySoon", "ExpiresWithin7Days"],
|      "when": {"all":[{"field":"si_credential_expiry_days","op":"gte","value":0},{"field":"si_credential_expiry_days","op":"lte","value":30}]} },
|    { "id": "publisher_not_verified", "shortName": "PublisherUnverified", "name": "The application's publisher is not verified", "appliesTo": "asset", "group": "Apps", "class": "optional", "impact": 1, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"entra":[{"siField":"si_publisher_verified","sources":["sp.verifiedPublisher.verifiedPublisherId"],"recordTypes":["service_principal"]}]},
|      "description": "The application's publisher is not verified.", "combine": "all",
|      "legacyTokens": ["RF_P_NotVerified"],
|      "when": {"all":[{"field":"si_publisher_verified","op":"is_false"}]} },
|    { "id": "multitenant_app", "shortName": "MultiTenantApp", "name": "The application accepts sign-ins from other tenants", "appliesTo": "asset", "group": "Apps", "class": "optional", "impact": 1, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"entra":[{"siField":"si_is_multitenant_app","sources":["app.signInAudience","sp.signInAudience"],"recordTypes":["service_principal"]}]},
|      "description": "The application accepts sign-ins from other tenants.", "combine": "all",
|      "legacyTokens": ["RF_P_MultiTenant"],
|      "when": {"all":[{"field":"si_is_multitenant_app","op":"is_true"}]} },
|    { "id": "production_environment", "shortName": "Production", "name": "The asset is in a production environment", "appliesTo": "asset", "group": "Importance", "class": "builtin", "impact": 3, "state": "enabled", "axis": "consequence", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_is_production","sources":["node.NodeProperties.rawData.isProductionEnvironment"],"recordTypes":["device","azure_resource"]}]},
|      "description": "The asset is in a production environment.", "combine": "all",
|      "legacyTokens": ["IsProductionEnvironment"],
|      "when": {"all":[{"field":"si_is_production","op":"is_true"}]} },
|    { "id": "restricted_data", "shortName": "RestrictedData", "name": "The owning CMDB service holds restricted data", "appliesTo": "asset", "group": "Importance", "class": "builtin", "impact": 4, "state": "enabled", "axis": "consequence", "evaluatedBy": "catalog",
|      "providers": {"cmdb":[{"siField":"si_cmdb_data_sensitivity","sources":["ci.DataSensitivity"],"recordTypes":["cmdb_ci"]}],"servicenow":[{"siField":"si_cmdb_data_sensitivity","sources":["ci.u_data_sensitivity","ci.data_classification"],"recordTypes":["cmdb_ci"]}]},
|      "description": "The owning CMDB service holds restricted data.", "combine": "all",
|      "legacyTokens": ["RestrictedDataAccess"],
|      "when": {"all":[{"field":"si_cmdb_data_sensitivity","op":"in","value":["restricted"]}]} },
|    { "id": "confidential_data", "shortName": "ConfidentialData", "name": "The owning CMDB service holds confidential data", "appliesTo": "asset", "group": "Importance", "class": "builtin", "impact": 3, "state": "enabled", "axis": "consequence", "evaluatedBy": "catalog",
|      "providers": {"cmdb":[{"siField":"si_cmdb_data_sensitivity","sources":["ci.DataSensitivity"],"recordTypes":["cmdb_ci"]}],"servicenow":[{"siField":"si_cmdb_data_sensitivity","sources":["ci.u_data_sensitivity","ci.data_classification"],"recordTypes":["cmdb_ci"]}]},
|      "description": "The owning CMDB service holds confidential data.", "combine": "all",
|      "legacyTokens": ["ConfidentialDataAccess"],
|      "when": {"all":[{"field":"si_cmdb_data_sensitivity","op":"in","value":["confidential"]}]} },
|    { "id": "ms_criticality_high", "shortName": "HighMsCriticality", "name": "Microsoft rates the asset's criticality high or very high", "appliesTo": "asset", "group": "Importance", "class": "builtin", "impact": 3, "state": "enabled", "axis": "consequence", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_ms_criticality","sources":["node.NodeProperties.rawData.criticalityLevel.criticalityLevel","node.NodeProperties.rawData.criticalityLevel"],"recordTypes":["device","user","service_principal","azure_resource"]}]},
|      "description": "Microsoft (Exposure Management) rates the asset's criticality high or very high.", "combine": "all",
|      "legacyTokens": ["MsCriticalityHigh"],
|      "when": {"all":[{"field":"si_ms_criticality","op":"in","value":["high","very_high"]}]} },
|    { "id": "exploit_available", "shortName": "ExploitAvailable", "name": "A public exploit exists for the vulnerability", "appliesTo": "finding", "findingKinds": ["vulnerability"], "group": "Exploitability", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_has_exploit","sources":["node.NodeProperties.rawData.hasExploit"],"recordTypes":["finding"]}],"mde":[{"siField":"si_has_exploit","sources":["kb.IsExploitAvailable"],"recordTypes":["vulnerability"]}],"computed":[{"siField":"si_has_exploit","sources":["A public exploit exists."]}]},
|      "description": "A public exploit exists for the vulnerability (si_has_exploit). A verified exploit, an exploit kit and a zero-day are their own factors (KnownExploited, ExploitKit, ZeroDay) and add their own impact.", "combine": "all",
|      "legacyTokens": ["RF_P_ExploitSignals"],
|      "when": {"all":[{"field":"si_has_exploit","op":"is_true"}]} },
|    { "id": "known_exploited", "shortName": "KnownExploited", "name": "The vulnerability is actively exploited (the exploit is verified)", "appliesTo": "finding", "findingKinds": ["vulnerability"], "group": "Exploitability", "class": "builtin", "impact": 4, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_exploit_verified","sources":["node.NodeProperties.rawData.isExploitVerified"],"recordTypes":["finding"]}],"shodan":[{"siField":"si_exploit_verified","sources":["vuln.verified"],"recordTypes":["vulnerability"]}],"computed":[{"siField":"si_exploit_verified","sources":["The exploit is verified."]}]},
|      "description": "The vulnerability is actively exploited: the provider verified the exploit (si_exploit_verified). Unknown when the source does not carry it.", "combine": "all",
|      "legacyTokens": ["IsExploitVerified", "ExploitVerified"],
|      "when": {"all":[{"field":"si_exploit_verified","op":"is_true"}]} },
|    { "id": "exploit_kit", "shortName": "ExploitKit", "name": "The exploit is in an exploit kit", "appliesTo": "finding", "findingKinds": ["vulnerability"], "group": "Exploitability", "class": "builtin", "impact": 4, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_in_exploit_kit","sources":["node.NodeProperties.rawData.isInExploitKit"],"recordTypes":["finding"]}],"computed":[{"siField":"si_in_exploit_kit","sources":["The exploit is in an exploit kit."]}]},
|      "description": "The exploit is part of an exploit kit (si_in_exploit_kit): attackers without skills can use it.", "combine": "all",
|      "legacyTokens": ["RF_P_InKit", "InExploitKit"],
|      "when": {"all":[{"field":"si_in_exploit_kit","op":"is_true"}]} },
|    { "id": "network_no_user_action", "shortName": "NetworkNoUserAction", "name": "Exploitable over the network with no user action (CVSS AV:N and UI:N)", "appliesTo": "finding", "findingKinds": ["vulnerability"], "group": "Exploitability", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_cvss_vector","sources":["node.NodeProperties.rawData.cvssVector","node.NodeProperties.rawData.cvssV3Vector"],"recordTypes":["finding"]}],"mde":[{"siField":"si_cvss_vector","sources":["kb.CvssVector"],"recordTypes":["vulnerability"]}],"computed":[{"siField":"si_cvss_vector","sources":["The CVSS vector string, when a source gives one."]}]},
|      "description": "The CVSS vector says the vulnerability is exploitable over the network (AV:N) with no user interaction (UI:N) -- si_cvss_vector. Unknown when no vector is known.", "combine": "all",
|      "legacyTokens": [],
|      "when": {"all":[{"field":"si_cvss_vector","op":"matches","value":"(?i)(^|/)AV:N(/|$)"},{"field":"si_cvss_vector","op":"matches","value":"(?i)(^|/)UI:N(/|$)"}]} },
|    { "id": "zero_day", "shortName": "ZeroDay", "name": "A zero-day: no fix is available yet", "appliesTo": "finding", "findingKinds": ["vulnerability"], "group": "Exploitability", "class": "builtin", "impact": 4, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_zero_day","sources":["node.NodeProperties.rawData.isZeroDay"],"recordTypes":["finding"]}],"mdc":[{"siField":"si_fix_available","sources":["assessment.properties.metadata.remediationDescription"],"recordTypes":["assessment"]}],"mde":[{"siField":"si_fix_available","sources":["vuln.RecommendedSecurityUpdate","vuln.RecommendedSecurityUpdateId"],"recordTypes":["vulnerability"]},{"siField":"si_fix_available","sources":["kb.RemediationOptions"],"recordTypes":["configuration"]}],"computed":[{"siField":"si_zero_day","sources":["Zero-day."]},{"siField":"si_fix_available","sources":["A fix exists (the source names a security update or a remediation)."]}]},
|      "description": "A zero-day: the provider marks it as one (si_zero_day), or no fix is available yet (si_fix_available false). Unknown when neither is known.", "combine": "any",
|      "legacyTokens": ["IsZeroDay"],
|      "when": {"any":[{"field":"si_zero_day","op":"is_true"},{"field":"si_fix_available","op":"is_false"}]} },
|    { "id": "remote_code_execution", "shortName": "RCE", "name": "The finding allows remote code execution", "appliesTo": "finding", "findingKinds": ["vulnerability"], "group": "Impact", "class": "builtin", "impact": 4, "state": "enabled", "axis": "consequence", "evaluatedBy": "catalog",
|      "providers": {"computed":[{"siField":"si_remote_code_execution","sources":["The finding allows remote code execution."]}]},
|      "description": "The finding allows remote code execution.", "combine": "all",
|      "legacyTokens": ["RF_C_RemoteCodeExec", "RemoteCodeExecutionRisk"],
|      "when": {"all":[{"field":"si_remote_code_execution","op":"is_true"}]} },
|    { "id": "high_cvss_public_ip", "shortName": "CVSS9Plus", "name": "The vulnerability scores CVSS 9 or higher", "appliesTo": "finding", "findingKinds": ["vulnerability"], "group": "Severity", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_cvss","sources":["node.NodeProperties.rawData.cvssScore"],"recordTypes":["finding"]}],"mde":[{"siField":"si_cvss","sources":["kb.CvssScore"],"recordTypes":["vulnerability"]}],"shodan":[{"siField":"si_cvss","sources":["vuln.cvss"],"recordTypes":["vulnerability"]}],"computed":[{"siField":"si_cvss","sources":["CVSS score."]}]},
|      "description": "The vulnerability scores CVSS 9 or higher, on any asset -- a fact about the finding, not the asset. (The id keeps its historic name: the factor once applied to public IPs only.)", "combine": "all",
|      "legacyTokens": ["RF_P_HighCvss", "CVSS9plus"],
|      "when": {"all":[{"field":"si_cvss","op":"gte","value":9.0}]} },
|    { "id": "overdue", "shortName": "Overdue", "name": "The finding is past its SLA due date", "appliesTo": "finding", "findingKinds": ["vulnerability", "recommendation"], "group": "Lifecycle", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"servicenow":[{"siField":"si_due_date","sources":["item.due_date.value","item.due_date"],"recordTypes":["vulnerable_item"]}],"computed":[{"siField":"si_due_date","sources":["When the finding is due: the ticket's due date (ServiceNow) or the SLA SI derives; unknown otherwise."]}]},
|      "description": "The finding is past its SLA due date (si_due_date). Unknown when no due date is known.", "combine": "all",
|      "legacyTokens": [],
|      "when": {"all":[{"field":"si_due_date","op":"older_than_days","value":0}]} },
|    { "id": "old_vuln", "shortName": "OldVuln", "name": "Published long ago and still open (days editable)", "appliesTo": "finding", "findingKinds": ["vulnerability"], "group": "Lifecycle", "class": "builtin", "impact": 3, "state": "enabled", "axis": "probability", "evaluatedBy": "catalog",
|      "providers": {"eg":[{"siField":"si_published","sources":["node.NodeProperties.rawData.publishedDate"],"recordTypes":["finding"]}],"mde":[{"siField":"si_published","sources":["kb.PublishedDate"],"recordTypes":["vulnerability"]}],"computed":[{"siField":"si_published","sources":["When the vulnerability was published (Defender vulnerability management PublishedDate)."]}]},
|      "criteria": {"kind": "threshold", "field": "si_published", "op": "older_than_days", "min": 30, "max": 3650, "unit": "days", "source": "enum"},
|      "description": "The vulnerability was published long ago (180 days by default, editable) and is still open (si_published). Unknown when the publish date is not known.", "combine": "all",
|      "legacyTokens": [],
|      "when": {"all":[{"field":"si_published","op":"older_than_days","value":180}]} },
|    { "id": "report_scoped", "shortName": "ReportFactor", "name": "A factor computed inside one report (its own question)", "appliesTo": "finding", "group": "Impact", "class": "optional", "impact": 1, "state": "enabled", "axis": "probability", "evaluatedBy": "report",
|      "$note": "still defined in the report's own query: they describe the finding's context (sign-in patterns, role writes, rank in the estate), not the asset. Listed so every factor is known; each moves into the catalog when a report needs it on another report too.",
|      "description": "Factors still computed inside one report's own query (sign-in patterns, role writes, rank in the estate): the report's own question, listed so every factor is known. Each is its own factor with this impact; a token keeps the side of the score its report column puts it on (RiskFactor_Probability_Detailed = asset side, RiskFactor_Consequence_Detailed = vulnerability side). Each moves into the catalog when a report needs it on another report too.", "combine": "all",
|      "legacyTokens": ["RF_P_RiskFactorsCount", "RF_P_Frequent", "RF_P_Top5Pct", "RF_P_RecentUse", "RF_P_RecentlyDisabled", "RF_P_NonTrusted", "RF_P_NeverTested", "RF_P_NeverChanged", "RF_P_HasRoleWrite", "RF_P_HasRoles", "RF_P_HasDirWrite", "RF_P_HasDirectoryWrite", "RF_P_AlsoHasDirectoryWrite", "RF_P_AlreadySignedIn", "RF_P_Verified", "RF_P_MultipleSignins", "RF_P_MultipleIPs", "RF_P_MultiCountry", "RF_P_DeviceTier2Plus", "RF_P_ExcessiveCount", "RF_P_HasCVEs", "IsExchangeOnlineMailbox"],
|      "when": { "all": [] } }
|  ]
|}
'@ }
$__siSupportFiles['engine/risk-analysis/_shared/RA-RiskIndexFiles.ps1'] = @{ Sha256 = '8af4e737c44102681ac1f31e6183549def441334d2199dd2dd69352e44990b9d'; Text = @'
|#######################################################################################################
|#  SecurityInsight - Risk Analysis engine
|#  WHICH RISK INDEX FILES A RUN READS -- the locked + custom model (#398).
|#
|#    risk-analysis-detection\riskscore.index.locked.csv         SHIPPED. Replaced by every update.
|#    risk-analysis-detection\riskscore.index.custom.csv         YOURS. Never shipped, never replaced. Optional.
|#    risk-analysis-detection\riskscore.index.custom.sample.csv  SHIPPED. A starting point for your own rows.
|#
|#  Your rows (custom) are checked FIRST, then the shipped rows -- first match wins (RA-RiskIndexOrder.ps1). A row of
|#  yours therefore wins over a shipped row it fits the same findings as; a finding none of your rows fits is scored
|#  by the shipped index. Your file may be a few rows or a whole index; with a Precedence column the rows are walked
|#  in that order, without one (a 2.2 index) they are converted exactly as 2.2 scored them.
|#
|#  🔴 WHY (v3 upgrade test, 2026-10-05). Until 3.0 the shipped index itself was called riskscore.index.custom.csv,
|#  so which index an upgraded install scored with depended on HOW it was upgraded: the signed update never touches
|#  *.custom.* (it kept 2.2's 59 rows), a git pull brought 3.0's 99 rows, the internal sync overwrote the file --
|#  customer edits included. Now the shipped index has a locked name, and the custom name is only ever yours.
|#
|#  🔑 THE MIGRATION (every run, so every upgrade path gets it -- signed update, git pull, sync, container image).
|#  A riskscore.index.custom.csv that is BYTE-FOR-BYTE a file SecurityInsight shipped (line endings and a UTF-8 BOM
|#  aside) was never edited: it is removed and the locked file takes over. Anything else is your edit: it is kept, read
|#  as your rows over the shipped ones, and the run log says so once. The shipped versions are listed below by SHA-256
|#  (tests/pester/SIv3-RiskIndexFiles.Tests.ps1 proves the list against the files in git history).
|#
|#  PowerShell 5.1 compatible. No Set-StrictMode here (it leaks into the caller's scope).
|#######################################################################################################
|
|$script:SIRiskIndexLockedName = 'riskscore.index.locked.csv'
|$script:SIRiskIndexCustomName = 'riskscore.index.custom.csv'
|
|# SHA-256 of every riskscore.index.custom.csv SecurityInsight ever shipped, after Get-SIRiskIndexFileHash's
|# normalisation: 2.2.0 - 2.2.461 (59 rows) and the 3.0 pre-release index (99 rows, Precedence) that internal ring-1
|# installs received before it moved to the locked name.
|$script:SIRiskIndexShippedCustomHashes = @(
|    'a840970d76adff3343a04087ac289358c68e093c9b5d406cd324edbb4e6c636e',   # 2.2.0 - 2.2.461 (git blob e2fb10baf)
|    '45eb7ab5518f5ce9ebc4a1128b1c85a1e8ee7c2828349f819b20a6e092a931cb',   # 3.0 pre-release   (git blob ef1e50146)
|    # #559: the 3.0 locked index with the 2.2 columns (99 rows, Precedence) -- a copy of it under the custom name is not an
|    # edit either (the shipped index is now keyed by the SI fields; this copy would only re-add the translated rows)
|    'eadac5f370c27fc7066a1e0576729308c13fd64447da098ad6ea644b5b9fb483'    # 3.0 locked, 2.2 keys (git blob 702f53316)
|)
|
|function Get-SIRiskIndexFileHash {
|    <# PURE (reads one file). SHA-256 (lower-case hex) of the file's text with a UTF-8 BOM removed and CRLF -> LF, so a
|       git checkout with autocrlf and a zip download of the same release hash the same. $null when it cannot be read. #>
|    param([Parameter(Mandatory)][string]$Path)
|    try {
|        $b = [System.IO.File]::ReadAllBytes($Path)
|        $start = 0
|        if ($b.Length -ge 3 -and $b[0] -eq 0xEF -and $b[1] -eq 0xBB -and $b[2] -eq 0xBF) { $start = 3 }
|        $text = [System.Text.Encoding]::UTF8.GetString($b, $start, $b.Length - $start).Replace("`r`n", "`n")
|        $sha = [System.Security.Cryptography.SHA256]::Create()
|        try { $h = $sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($text)) } finally { $sha.Dispose() }
|        return (-join ($h | ForEach-Object { $_.ToString('x2') }))
|    } catch { return $null }
|}
|
|function Test-SIRiskIndexShippedCopy {
|    <# PURE (reads one file). $true when -Path is byte-for-byte (see Get-SIRiskIndexFileHash) a shipped risk index. #>
|    param([Parameter(Mandatory)][string]$Path, [string[]]$KnownHashes = $script:SIRiskIndexShippedCustomHashes)
|    $h = Get-SIRiskIndexFileHash -Path $Path
|    if (-not $h) { return $false }
|    return (@($KnownHashes) -contains $h)
|}
|
|function Resolve-SIRiskIndexFiles {
|    <#
|        Decides which risk index files this run reads, and migrates a never-edited copy of a shipped index away.
|          -Folder         the folder holding the index files (risk-analysis-detection)
|          -NoticeMarker   a file whose presence means "the run log already said the custom file is used as your rows"
|                          (VM: under logs\state). Empty = say it on every run (a container has no local state).
|          -NoRemove       never delete (tests, a read-only tree): an unedited shipped copy is then only ignored
|        Returns @{ LockedPath; CustomPath ($null = none read); Action = none | removed-unedited | ignored-unedited |
|        overlay; Lines (what to tell the run log) }. Never throws for the custom file; a missing locked file is the
|        caller's error.
|    #>
|    param([Parameter(Mandatory)][string]$Folder, [string]$NoticeMarker, [switch]$NoRemove,
|          [string[]]$KnownHashes = $script:SIRiskIndexShippedCustomHashes)
|    $locked = Join-Path $Folder $script:SIRiskIndexLockedName
|    $custom = Join-Path $Folder $script:SIRiskIndexCustomName
|    $res = [pscustomobject]@{ LockedPath = $locked; CustomPath = $null; Action = 'none'; Lines = @() }
|    if (-not (Test-Path -LiteralPath $custom -PathType Leaf)) { return $res }
|
|    if (Test-SIRiskIndexShippedCopy -Path $custom -KnownHashes $KnownHashes) {
|        $removed = $false
|        if (-not $NoRemove) { try { Remove-Item -LiteralPath $custom -Force -ErrorAction Stop; $removed = $true } catch { $removed = $false } }
|        if ($removed) {
|            $res.Action = 'removed-unedited'
|            $res.Lines = @(('Risk index: {0} was the unchanged risk index of an earlier version, so it was removed. The shipped index ({1}) is used, and updates keep it current.' -f $script:SIRiskIndexCustomName, $script:SIRiskIndexLockedName))
|        } else {
|            $res.Action = 'ignored-unedited'
|            $res.Lines = @(('Risk index: {0} is the unchanged risk index of an earlier version, so it is not used. The shipped index ({1}) is used; delete {0} to stop this line.' -f $script:SIRiskIndexCustomName, $script:SIRiskIndexLockedName))
|        }
|        return $res
|    }
|
|    $res.CustomPath = $custom
|    $res.Action = 'overlay'
|    $say = $true
|    if ($NoticeMarker) { try { $say = -not (Test-Path -LiteralPath $NoticeMarker) } catch { $say = $true } }
|    if ($say) {
|        $res.Lines = @(
|            ('Risk index: your own {0} is kept and read FIRST, before the shipped index ({1}): where one of your rows fits a finding it sets the score, and every other finding is scored by the shipped index, which updates keep current.' -f $script:SIRiskIndexCustomName, $script:SIRiskIndexLockedName),
|            ('If you edited it only to change a few rows, keep just those rows in it; if you did not mean to change scoring, delete it. This is said once.')
|        )
|        if ($NoticeMarker) {
|            try {
|                $null = [System.IO.Directory]::CreateDirectory((Split-Path -Parent $NoticeMarker))
|                [System.IO.File]::WriteAllText($NoticeMarker, ('{0:o}' -f [datetime]::UtcNow))
|            } catch { }
|        }
|    }
|    $res
|}
'@ }
$__siSupportFiles['engine/pro-settings/SI-DataModelTemplateRows.ps1'] = @{ Sha256 = '5fa24f0f578d3c5e5a87e75a8d6fc7888578807abb8fd86fc1e11923fc5ef3be'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- THE DATA-MODEL TEMPLATES IN SQL (REQUIREMENTS #456, V3-DATA-MODEL 2.4.5).
|
|    The data model (data-model/*.locked.json: the field catalog, the provider MAPPINGS, value maps, lists, trust, risk
|    factors, criticality mapping, collection scope, coverage checks, output maps) travels through the same template channel
|    as every other vendor template: one cfg.Template row per ITEM, kind 'datamodel', so a customer overrides, disables or
|    adds ONE mapping / field / factor (cfg.ItemOverride) and an update keeps it -- the conformance view flags
|    UpgradeAvailable when the shipped item changed underneath an override, never merges it (SI-TemplateVersioning.ps1).
|
|    ITEM KEYS ('datamodel' kind, max 128 characters):
|      <template>               the template's HEADER: the document without its item array (kind, version, objects ...);
|                               for a template without items (value-maps, criticality-mapping) the whole document
|      <template>:<item key>    one item -- the key the file-based merge uses (Get-SIDataModelItemKey: a mapping's
|                               'field|recordTypes|resourceTypes', a repeat '#<n>', a field's name, a factor's id ...).
|                               A key that would pass 128 characters keeps its first part and ends '~<12 hex of SHA-256>'.
|      <template> = field-catalog | value-maps | risk-factors | lists | trust | criticality-mapping | collection-scope |
|                   coverage-checks | relations | dimensions | classification | finding-texts | mappings/<provider> | outputs/<id>
|
|    RUN START (Export-SIDataModelProRoot): the effective items (template, override or own; disabled ones are left out)
|    are put back together per template, in the shipped order (SortOrder) with the customer's own items after, and written
|    as <run>\data-model\<template>.locked.json -- the folder the record writer, the CI build and the outputs read
|    ($global:SI_DataModelRoot). The whole model is validated (Test-SIDataModel) before a run may use it.
|
|    Classification (#405): 'fix' -- installed with the code on every install and every update (CONVERGE-DEFAULTS:
|    existing installs receive the rows on their next update), never held; a customer's override is never changed.
|
|    PURE except the file writer. PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Get-SIDataModelItemKey -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'SI-DataModelTemplates.ps1'))
|}
|
|$script:SIDataModelProKeyMax = 128
|$script:SIDataModelProKeyPattern = '^[a-z][a-z0-9\-]{0,40}(/[a-z0-9][a-z0-9_\-]{0,60})?(:[^\r\n]{1,126})?$'
|$script:SIDataModelProTopNames = @('field-catalog', 'value-maps', 'risk-factors', 'lists', 'trust', 'criticality-mapping', 'collection-scope', 'coverage-checks', 'recommendation-equivalence', 'report-scope', 'relations', 'recommendation-exclusions', 'dimensions', 'classification', 'finding-texts', 'severity-model')
|
|function Get-SIDataModelProKeyPattern { $script:SIDataModelProKeyPattern }
|
|function Get-SIDataModelProTemplateKind {
|    <# PURE. The data-model kind a template name holds (what decides its item key). #>
|    param([Parameter(Mandatory)][string]$Name)
|    if ($Name -like 'mappings/*') { return 'field-mapping' }
|    if ($Name -like 'outputs/*') { return 'output-map' }
|    # #462: a CI rule pack (data-model/rules/<Pack>.locked.yaml) -- its header (stage, on / off, priority, source) + one row per rule
|    if ($Name -like 'rules/*') { return 'ci-rule-pack' }
|    if ($Name -eq 'recommendation-equivalence') { return 'recommendation-equivalence' }
|    if ($Name -eq 'recommendation-exclusions') { return 'recommendation-exclusion' }
|    # #561 / #562 the classification dimensions and rows (one generic classification mechanism)
|    if ($Name -eq 'dimensions') { return 'dimension' }
|    if ($Name -eq 'classification') { return 'classification' }
|    # #560 the finding texts of SI's own reports (one item per report)
|    if ($Name -eq 'finding-texts') { return 'finding-text' }
|    # #690 (15) the severity model (one item per report)
|    if ($Name -eq 'severity-model') { return 'severity-model' }
|    switch ($Name) {
|        'field-catalog' { 'field-catalog' } 'value-maps' { 'value-map' } 'risk-factors' { 'risk-factor' } 'lists' { 'list' }
|        'trust' { 'trust' } 'criticality-mapping' { 'criticality-mapping' } 'collection-scope' { 'collection-scope' }
|        'coverage-checks' { 'coverage-check' } 'report-scope' { 'report-scope' } 'relations' { 'relation' } default { '' }
|    }
|}
|
|function Get-SIDataModelProItemKey {
|    <# PURE. '<template>:<item key>', shortened with a hash suffix when it would pass 128 characters. #>
|    param([Parameter(Mandatory)][string]$Name, [AllowEmptyString()][string]$ItemKey)
|    if (-not $ItemKey) { return $Name }
|    $full = '{0}:{1}' -f $Name, $ItemKey
|    if ($full.Length -le $script:SIDataModelProKeyMax) { return $full }
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $h = (-join ($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($ItemKey)) | ForEach-Object { $_.ToString('x2') })).Substring(0, 12) } finally { $sha.Dispose() }
|    $keep = $script:SIDataModelProKeyMax - $Name.Length - 1 - 13
|    return ('{0}:{1}~{2}' -f $Name, $ItemKey.Substring(0, $keep), $h)
|}
|
|function Split-SIDataModelProKey {
|    <# PURE. @{ Name; ItemKey (as stored, '' for a header) }. #>
|    param([Parameter(Mandatory)][string]$Key)
|    $i = $Key.IndexOf(':')
|    if ($i -lt 0) { return @{ Name = $Key; ItemKey = '' } }
|    return @{ Name = $Key.Substring(0, $i); ItemKey = $Key.Substring($i + 1) }
|}
|
|function Get-SIDataModelProTemplateNames {
|    <# The data-model templates a release ships, in a fixed order: the top-level files, then mappings/*, then outputs/*. #>
|    param([Parameter(Mandatory)][string]$DataModelRoot)
|    $names = New-Object System.Collections.Generic.List[string]
|    foreach ($n in $script:SIDataModelProTopNames) { if (Test-Path -LiteralPath (Join-Path $DataModelRoot ($n + '.locked.json'))) { $names.Add($n) } }
|    foreach ($sub in 'mappings', 'outputs') {
|        $dir = Join-Path $DataModelRoot $sub
|        if (-not (Test-Path -LiteralPath $dir)) { continue }
|        $fs = [string[]]@(Get-ChildItem -LiteralPath $dir -Filter '*.locked.json' | ForEach-Object { $_.Name })
|        [Array]::Sort($fs, [StringComparer]::Ordinal)
|        foreach ($f in $fs) { $names.Add(('{0}/{1}' -f $sub, $f.Replace('.locked.json', ''))) }
|    }
|    return $names.ToArray()   # unrolled: foreach and @() both read it as the list of names
|}
|
|function Get-SIDataModelProItems {
|    <#
|    .SYNOPSIS  PURE. One parsed template document -> its rows: the header and one per item, keyed as the file-based merge
|               keys them (a repeated mapping key gets '#<n>', as Merge-SIDataModelItems does).
|    .OUTPUTS   [ @{ Key; ItemKey; Value; SortOrder } ]
|    #>
|    param([Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)]$Document)
|    $kind = [string]$Document.kind
|    if (-not $kind) { $kind = Get-SIDataModelProTemplateKind $Name }
|    $arr = Get-SIDataModelItemArrayName $kind
|    $out = New-Object System.Collections.Generic.List[object]
|    $header = [ordered]@{}
|    # the item array stays in the header as null, so the document is put back with its properties in the shipped order
|    foreach ($p in $Document.PSObject.Properties) { if ($arr -and $p.Name -eq $arr) { $header[$p.Name] = $null } else { $header[$p.Name] = $p.Value } }
|    $out.Add([pscustomobject]@{ Key = $Name; ItemKey = ''; Value = [pscustomobject]$header; SortOrder = 0 })
|    if ($arr) {
|        $occ = @{}; $i = 0
|        foreach ($it in @($Document.$arr)) {
|            if ($null -eq $it) { continue }
|            $i++
|            $base = Get-SIDataModelItemKey $kind $it
|            $k = $base
|            if ($kind -eq 'field-mapping') {
|                $n = 1; if ($occ.ContainsKey($base)) { $n = [int]$occ[$base] + 1 }
|                $occ[$base] = $n
|                if ($n -gt 1) { $k = '{0}#{1}' -f $base, $n }
|            }
|            $out.Add([pscustomobject]@{ Key = (Get-SIDataModelProItemKey -Name $Name -ItemKey $k); ItemKey = $k; Value = $it; SortOrder = $i })
|        }
|    }
|    # the rows one by one (never ', $array'): @(Get-SIDataModelProItems ...) is then the rows, not ONE item holding them all
|    foreach ($r in $out) { $r }
|}
|
|function Get-SIDataModelTemplateRows {
|    <#
|    .SYNOPSIS  The 'datamodel' template rows a release ships, from its data-model folder: @{ Key; Body; SortOrder; Source }.
|               Bodies are written by -ToJson (the template store's canonical writer, ConvertTo-SIProJson).
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot, [Parameter(Mandatory)][scriptblock]$ToJson)
|    $dm = Join-Path $SIRoot 'data-model'
|    $rows = New-Object System.Collections.Generic.List[object]
|    if (-not (Test-Path -LiteralPath $dm)) { return }
|    $base = 0
|    foreach ($n in (Get-SIDataModelProTemplateNames -DataModelRoot $dm)) {
|        $path = Join-Path $dm ($n + '.locked.json')
|        $doc = [IO.File]::ReadAllText($path).TrimStart([char]0xFEFF) | ConvertFrom-Json
|        foreach ($r in (Get-SIDataModelProItems -Name $n -Document $doc)) {
|            # one SortOrder series over every template, so the store's order is the shipped order
|            $rows.Add([pscustomobject]@{ Key = $r.Key; Body = (& $ToJson $r.Value); SortOrder = ($base + [int]$r.SortOrder); Source = ('data-model/{0}.locked.json' -f $n) })
|        }
|        $base += 100000
|    }
|    # #462: the CI rule packs (YAML) -- one template per pack, 'rules/<lower-case pack>', its header + one row per rule
|    foreach ($p in @(Get-SIRulePackTemplateDocuments -DataModelRoot $dm)) {
|        foreach ($r in (Get-SIDataModelProItems -Name $p.Name -Document $p.Document)) {
|            $rows.Add([pscustomobject]@{ Key = $r.Key; Body = (& $ToJson $r.Value); SortOrder = ($base + [int]$r.SortOrder); Source = $p.Source })
|        }
|        $base += 100000
|    }
|    # one by one (never ', $array'): @(Get-SIDataModelTemplateRows ...) is then the rows, not ONE item holding them all
|    foreach ($x in $rows) { $x }
|}
|
|function Get-SIRulePackTemplateDocuments {
|    <#
|    .SYNOPSIS  The shipped CI rule packs (data-model/rules/*.locked.yaml) as data-model documents: kind 'ci-rule-pack', the
|               pack's header (pack, name, description, stage, priority, source) and its rules. A pack that does not parse
|               is skipped with a warning (the release's rule lint refuses it before it ships).
|    .OUTPUTS   [ @{ Name ('rules/<pack>'); Document; Source } ]
|    #>
|    param([Parameter(Mandatory)][string]$DataModelRoot)
|    $dir = Join-Path $DataModelRoot 'rules'
|    $out = New-Object System.Collections.Generic.List[object]
|    if (-not (Test-Path -LiteralPath $dir)) { return }
|    if (-not (Get-Command -Name Get-SIRulePackKey -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'SI-CiRules.ps1')) }
|    if (-not (Get-Command -Name ConvertFrom-SIYaml -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-Yaml.ps1')) }
|    $fs = [string[]]@(Get-ChildItem -LiteralPath $dir -File -Filter '*.locked.yaml' | ForEach-Object { $_.Name })
|    [Array]::Sort($fs, [StringComparer]::Ordinal)
|    foreach ($f in $fs) {
|        $pack = $f -replace '\.locked\.yaml$', ''
|        try {
|            $y = ConvertFrom-SIYaml -Yaml ([IO.File]::ReadAllText((Join-Path $dir $f))) -SourceName $f
|            $doc = [ordered]@{ kind = 'ci-rule-pack'; pack = $pack }
|            foreach ($k in 'name', 'description', 'stage', 'priority', 'enabled', 'source') { $v = Get-SIItemValue $y $k; if ($null -ne $v -and [string]$v -ne '') { $doc[$k] = $v } }
|            if (-not $doc.Contains('source')) { $doc['source'] = 'shipped' }
|            # Get-SIValueList returns ONE list (', $out'): @() around it would make the rules a single item holding every rule
|            $doc['rules'] = (Get-SIValueList (Get-SIItemValue $y 'rules')).ToArray()
|            # one JSON shape (the YAML reader's dictionaries -> objects), as every other data-model document
|            $obj = ConvertTo-Json -InputObject $doc -Depth 30 | ConvertFrom-Json
|            $out.Add([pscustomobject]@{ Name = (Get-SIRulePackKey -Pack $pack); Document = $obj; Source = ('data-model/rules/{0}' -f $f) })
|        } catch { Write-Warning ("rule pack {0} could not be published -- {1}" -f $f, $_.Exception.Message) }
|    }
|    # one by one: @(Get-SIRulePackTemplateDocuments ...) -- as the rows above read it -- is then the packs, not ONE item holding them
|    foreach ($x in $out) { $x }
|}
|
|function Test-SIDataModelProItem {
|    <#
|    .SYNOPSIS  PURE. The reasons a 'datamodel' item is not accepted (empty = accepted). -Value: the parsed body.
|               A header must carry the template's kind; an item's body must give back the key it is stored under (the key
|               names the item, as for every other kind), so an override can never land on another item.
|    #>
|    param([Parameter(Mandatory)][string]$Key, $Value)
|    $why = New-Object System.Collections.Generic.List[string]
|    if ($Key.Length -gt $script:SIDataModelProKeyMax -or $Key -notmatch $script:SIDataModelProKeyPattern) { $why.Add(("'{0}' is not a data-model key ('<template>' or '<template>:<item key>')" -f $Key)); return $why.ToArray() }
|    if ($Value -isnot [System.Management.Automation.PSCustomObject]) { $why.Add('a data-model item must be a JSON object'); return $why.ToArray() }
|    $s = Split-SIDataModelProKey $Key
|    $kind = Get-SIDataModelProTemplateKind $s.Name
|    if (-not $kind) { $why.Add(("'{0}' is not a data-model template" -f $s.Name)); return $why.ToArray() }
|    if (-not $s.ItemKey) {
|        if ($Value.PSObject.Properties['kind'] -and [string]$Value.kind -ne $kind) { $why.Add(("the {0} header must have kind '{1}'" -f $s.Name, $kind)) }
|        return $why.ToArray()
|    }
|    if (-not (Get-SIDataModelItemArrayName $kind)) { $why.Add(("{0} has no items -- it is one document ('{0}')" -f $s.Name)); return $why.ToArray() }
|    $own = Get-SIDataModelItemKey $kind $Value
|    if (-not $own) { $why.Add('the item has no key (field / name / id / target / type)'); return $why.ToArray() }
|    $expect = Get-SIDataModelProItemKey -Name $s.Name -ItemKey $own
|    $ok = ($Key -ceq $expect)
|    if (-not $ok -and $kind -eq 'field-mapping') {
|        # a repeated mapping key ('#<n>'; inside the hashed part when the key was shortened)
|        for ($n = 2; $n -le 64 -and -not $ok; $n++) { $ok = ($Key -ceq (Get-SIDataModelProItemKey -Name $s.Name -ItemKey ('{0}#{1}' -f $own, $n))) }
|    }
|    if (-not $ok) { $why.Add(("the key must be '{0}' -- it is made of the item's own key" -f $expect)) }
|    # #527 (5)-(7): a risk factor keeps one scope, no tier, SI fields only -- a customer's override too (SI-RiskFactorCatalog.ps1)
|    if ($kind -eq 'risk-factor' -and (Get-Command -Name Test-SIRiskFactorItem -ErrorAction SilentlyContinue)) { foreach ($x in (Test-SIRiskFactorItem -Factor $Value)) { $why.Add([string]$x) } }
|    # #462: a rule of a CI rule pack must convert (SI fields only, a known stage / class / operation, sets something)
|    if ($kind -eq 'ci-rule-pack') {
|        if (-not (Get-Command -Name ConvertTo-SICiNativeRule -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'SI-CiRules.ps1')) }
|        try { $null = ConvertTo-SICiNativeRule -Item $Value -Pack $s.Name } catch { $why.Add([string]$_.Exception.Message) }
|    }
|    # #464: one equivalence group (SI-RecommendationEquivalence.ps1)
|    # #546: one default exclusion rule (SI-RecommendationExclusions.ps1)
|    if ($kind -eq 'recommendation-exclusion') {
|        if (-not (Get-Command -Name Test-SIRecommendationExclusionRule -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'SI-RecommendationExclusions.ps1')) }
|        foreach ($x in (Test-SIRecommendationExclusionRule -Rule $Value)) { $why.Add([string]$x) }
|    }
|    # #561 / #562: one dimension / one classification row (SI-Classification.ps1); a row is checked on its shape here, against
|    # the dimensions in force when the run's whole model is validated (Test-SIDataModel)
|    if ($kind -eq 'finding-text') {
|        if (-not (Get-Command -Name Test-SIFindingTextItem -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'SI-FindingTexts.ps1')) }
|        foreach ($x in (Test-SIFindingTextItem -Item $Value)) { $why.Add([string]$x) }
|    }
|    # #690 (15): one report of the severity model -- its order ends with owner_defined, its own severity is one of the five
|    if ($kind -eq 'severity-model') { foreach ($x in (Test-SISeverityModelReportItem -Item $Value)) { $why.Add([string]$x) } }
|    if ($kind -in 'dimension', 'classification') {
|        if (-not (Get-Command -Name Test-SIClassificationRule -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'SI-Classification.ps1')) }
|        if ($kind -eq 'dimension') { foreach ($x in (Test-SIDimensionItem -Dimension $Value)) { $why.Add([string]$x) } }
|        else { foreach ($x in (Test-SIClassificationRule -Rule $Value)) { $why.Add([string]$x) } }
|    }
|    if ($kind -eq 'recommendation-equivalence') {
|        if (-not (Get-Command -Name Test-SIRecommendationEquivalenceGroup -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'SI-RecommendationEquivalence.ps1')) }
|        foreach ($x in (Test-SIRecommendationEquivalenceGroup -Group $Value)) { $why.Add([string]$x) }
|    }
|    return $why.ToArray()
|}
|
|function ConvertTo-SIDataModelProDocuments {
|    <#
|    .SYNOPSIS  PURE. The run's effective 'datamodel' items -> one document per template, the items in store order
|               (SortOrder; the customer's own items after the shipped ones, by key).
|    .OUTPUTS   ordered hashtable  template name -> document (pscustomobject)
|    #>
|    param([AllowEmptyCollection()][object[]]$Items = @(), [Parameter(Mandatory)][scriptblock]$FromJson)
|    $byName = [ordered]@{}
|    foreach ($it in @($Items)) {
|        if ($null -eq $it) { continue }
|        $s = Split-SIDataModelProKey ([string]$it.Key)
|        if (-not $byName.Contains($s.Name)) { $byName[$s.Name] = @{ Header = $null; Items = (New-Object System.Collections.Generic.List[object]) } }
|        $v = & $FromJson ([string]$it.Body)
|        if (-not $s.ItemKey) { $byName[$s.Name].Header = $v }
|        else { $byName[$s.Name].Items.Add([pscustomobject]@{ Order = [long]$it.SortOrder; Key = [string]$s.ItemKey; Value = $v }) }
|    }
|    $docs = [ordered]@{}
|    foreach ($n in $byName.Keys) {
|        $e = $byName[$n]
|        if ($null -eq $e.Header) { throw ("data-model template '{0}': items without its header -- republish the templates" -f $n) }
|        $kind = [string]$e.Header.kind
|        if (-not $kind) { $kind = Get-SIDataModelProTemplateKind $n }
|        $arr = Get-SIDataModelItemArrayName $kind
|        $doc = [ordered]@{}
|        foreach ($p in $e.Header.PSObject.Properties) { $doc[$p.Name] = $p.Value }
|        if ($arr) {
|            $its = $e.Items.ToArray()
|            $keys = [string[]]@($its | ForEach-Object { '{0:D20}|{1}' -f $_.Order, $_.Key })
|            $idx = [int[]]@(0..([Math]::Max(0, $its.Count - 1)))
|            if ($its.Count -gt 0) { [Array]::Sort($keys, $idx, [StringComparer]::Ordinal) }
|            $doc[$arr] = @(if ($its.Count -gt 0) { foreach ($i in $idx) { $its[$i].Value } })
|        }
|        $docs[$n] = [pscustomobject]$doc
|    }
|    return $docs
|}
|
|function Export-SIDataModelProRoot {
|    <#
|    .SYNOPSIS  Writes the run's data model to <RunFolder>\data-model\<template>.locked.json and validates it.
|               Templates the database does not hold (none published yet for that file) are copied from -ShippedRoot, so
|               the folder is always a whole model. A model that does not validate NEVER stops the run: the templates a
|               problem names go back to the shipped copy, and if that is not enough the whole shipped model is used -- said
|               in Notes. Throws only when the SHIPPED model itself does not validate (a product defect).
|    .OUTPUTS   @{ Root; Templates (written from the database); Copied (from the installation); Fallback (shipped for this run); Notes }
|    #>
|    param([AllowEmptyCollection()][object[]]$Items = @(), [Parameter(Mandatory)][string]$RunFolder, [Parameter(Mandatory)][string]$ShippedRoot,
|          [Parameter(Mandatory)][scriptblock]$FromJson, [Parameter(Mandatory)][scriptblock]$ToJson)
|    $root = [IO.Path]::Combine($RunFolder, 'data-model')
|    foreach ($d in @($root, [IO.Path]::Combine($root, 'mappings'), [IO.Path]::Combine($root, 'outputs'), [IO.Path]::Combine($root, 'rules'))) { if (-not (Test-Path -LiteralPath $d)) { New-Item -ItemType Directory -Path $d -Force | Out-Null } }
|    $docs = ConvertTo-SIDataModelProDocuments -Items @($Items) -FromJson $FromJson
|    $utf8 = New-Object System.Text.UTF8Encoding($false)
|    foreach ($n in $docs.Keys) { [IO.File]::WriteAllText([IO.Path]::Combine($root, ($n.Replace('/', [IO.Path]::DirectorySeparatorChar) + '.locked.json')), (& $ToJson $docs[$n]), $utf8) }
|    $copied = New-Object System.Collections.Generic.List[string]
|    foreach ($n in (Get-SIDataModelProTemplateNames -DataModelRoot $ShippedRoot)) {
|        if ($docs.Contains($n)) { continue }
|        $rel = $n.Replace('/', [IO.Path]::DirectorySeparatorChar) + '.locked.json'
|        [IO.File]::Copy([IO.Path]::Combine($ShippedRoot, $rel), [IO.Path]::Combine($root, $rel), $true)
|        $copied.Add($n)
|    }
|    $check = { @(Test-SIDataModel -Model (Get-SIDataModel -Root $root) | ForEach-Object { $_ } | Where-Object { $_ }) }
|    $short = { param($p) (@($p | Select-Object -First 5) -join '; ') + $(if (@($p).Count -gt 5) { (' (+{0} more)' -f (@($p).Count - 5)) } else { '' }) }
|    $problems = & $check
|    $notes = New-Object System.Collections.Generic.List[string]; $fallback = New-Object System.Collections.Generic.List[string]
|    $shippedNames = @(Get-SIDataModelProTemplateNames -DataModelRoot $ShippedRoot)
|    # A SETTINGS PROBLEM NEVER STOPS THE RUN (owner, ring 1 2026-10-10: a run that read the settings database while the
|    # template publish was half-way -- the field catalog partly written, its mappings not yet -- stopped the whole pipeline
|    # with "unknown field" x471). Step 1: every template from the database a problem names goes back to the shipped copy
|    # for this run. Step 2: still not valid -> this run uses the whole shipped data model. Each is said, per template.
|    if ($problems.Count) {
|        $named = New-Object System.Collections.Generic.List[string]
|        foreach ($p in $problems) {
|            $m = [regex]::Match([string]$p, '^([a-z][a-z0-9\-]*(?:/[a-z0-9][a-z0-9\-]*)?):')
|            if ($m.Success -and $docs.Contains($m.Groups[1].Value) -and -not $named.Contains($m.Groups[1].Value)) { $named.Add($m.Groups[1].Value) }
|        }
|        foreach ($n in $named) {
|            if ($shippedNames -notcontains $n) { continue }
|            $rel = $n.Replace('/', [IO.Path]::DirectorySeparatorChar) + '.locked.json'
|            [IO.File]::Copy([IO.Path]::Combine($ShippedRoot, $rel), [IO.Path]::Combine($root, $rel), $true)
|            $fallback.Add($n)
|        }
|        $first = $problems
|        if ($fallback.Count) { $problems = & $check }
|        if ($problems.Count) {
|            foreach ($n in $shippedNames) {
|                $rel = $n.Replace('/', [IO.Path]::DirectorySeparatorChar) + '.locked.json'
|                [IO.File]::Copy([IO.Path]::Combine($ShippedRoot, $rel), [IO.Path]::Combine($root, $rel), $true)
|            }
|            foreach ($n in @($docs.Keys)) { if ($shippedNames -notcontains $n) { Remove-Item -LiteralPath ([IO.Path]::Combine($root, ($n.Replace('/', [IO.Path]::DirectorySeparatorChar) + '.locked.json'))) -Force -ErrorAction SilentlyContinue } }
|            $notes.Add(('the data model in the settings database does not validate ({0}) -- this run uses the data model shipped with this release; your data-model changes apply again once it validates (a template publish that was still running finishes; otherwise review the data model on the web app)' -f (& $short $first)))
|            $fallback.Clear(); foreach ($n in $shippedNames) { $fallback.Add($n) }
|            $problems = & $check
|            # the shipped model itself does not validate: a product defect, not a setting -- nothing else to fall back to
|            if ($problems.Count) { throw ('the data model shipped with this release does not validate -- ' + (& $short $problems)) }
|        } else {
|            $notes.Add(('the data model in the settings database does not validate ({0}) -- this run uses the shipped {1} for: {2}' -f (& $short $first), $(if ($fallback.Count -eq 1) { 'template' } else { 'templates' }), ($fallback -join ', ')))
|        }
|    }
|    return @{ Root = $root; Templates = @($docs.Keys); Copied = $copied.ToArray(); Fallback = $fallback.ToArray(); Notes = $notes.ToArray() }
|}
'@ }
$__siSupportFiles['engine/data-model/SI-DataModelTemplates.ps1'] = @{ Sha256 = 'ae4134274adaaf78943a67bb11bdd170c9ebc7272d72f7f8e153e55cb0e72714'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight data-model templates: load, merge customer overrides PER ITEM, flag conflicts, and validate.
|    V3-DATA-MODEL part 2 (2.4.5). Folder: <solution>\data-model\
|
|      <name>.locked.json    shipped by Invardia, updated automatically (never edit)
|      <name>.custom.json    the customer's overrides: the SAME shape, holding only the items that differ
|                            (Community: on disk, never shipped, never overwritten; Pro: materialised from the settings
|                            database into an overlay folder the same way)
|
|    MERGE RULES -- the same for every template kind; only the item key differs (Get-SIDataModelItemKey):
|      * a custom item with the same key REPLACES the shipped item (override); "remove": true drops it (disabled)
|      * a custom item with a new key is ADDED (the customer's own)
|      * a custom item may carry "baseHash" = the hash of the shipped item it was written against. When the shipped
|        item has changed since, the item's state is UpgradeAvailable: the override still wins, and the change is
|        flagged for review -- never merged silently (same states as the Pro template store:
|        UpToDate | Overridden | Disabled | UpgradeAvailable | Own)
|      * value maps merge one level deeper (per key inside a map); the trust list keeps the shipped ORDER and a custom
|        entry changes trust by id (silence = inherit), and may move with "after": <id>
|
|    PowerShell 5.1: no ?. / ??, no ternary, no Set-StrictMode.
|#>
|
|. (Join-Path $PSScriptRoot 'SI-Conditions.ps1')
|. (Join-Path $PSScriptRoot 'SI-FieldMapper.ps1')
|. (Join-Path $PSScriptRoot 'SI-RiskFactorCatalog.ps1')
|# #561 / #562 the one classification mechanism (asset type / subtype, dimensions)
|. (Join-Path $PSScriptRoot 'SI-Classification.ps1')
|# #560 the generic SI finding fields of SI's own reports, as data
|. (Join-Path $PSScriptRoot 'SI-FindingTexts.ps1')
|# the Azure CI scope and the child resources that roll up into their parent (collection-scope rollUpInto, validated below)
|. (Join-Path $PSScriptRoot 'SI-AzureChildren.ps1')
|
|function Get-SIDataModelRoot {
|    param([string]$Root)
|    if ($Root) { return $Root }
|    # #456 Pro: the run's data model from the settings database (templates + the customer's overrides), materialised by
|    # the settings layer (Export-SIDataModelProRoot) -- the shipped folder is then not read
|    if ($global:SI_DataModelRoot -and (Test-Path -LiteralPath ([string]$global:SI_DataModelRoot))) { return [string]$global:SI_DataModelRoot }
|    return (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'data-model')
|}
|
|function Get-SIDataModelItemHash {
|    <# SHA-256 of an item's compact JSON -- what a custom item's baseHash refers to. #>
|    param($Item)
|    $json = $Item | ConvertTo-Json -Compress -Depth 30
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { return ([BitConverter]::ToString($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($json))) -replace '-', '').ToLowerInvariant() }
|    finally { $sha.Dispose() }
|}
|
|function Get-SIDataModelItemKey {
|    <# The key that identifies one item of a template kind (what a custom override matches on). #>
|    param([string]$Kind, $Item)
|    switch ($Kind) {
|        'field-catalog' { return [string]$Item.name }
|        'field-mapping' {
|            $rt = @($Item.recordTypes) -join ','
|            $res = @(Get-SIItemValue $Item 'resourceTypes') -join ','
|            return ('{0}|{1}|{2}' -f $Item.field, $rt, $res)
|        }
|        'output-map' { return [string]$Item.target }
|        'collection-scope' { return [string]$Item.type }
|        default { return [string]$Item.id }
|    }
|}
|
|function Get-SIDataModelItemArrayName {
|    <# Which array of a template holds its items. #>
|    param([string]$Kind)
|    switch ($Kind) {
|        'field-catalog' { 'fields' } 'field-mapping' { 'mappings' } 'risk-factor' { 'factors' } 'list' { 'lists' }
|        'output-map' { 'columns' } 'trust' { 'order' } 'coverage-check' { 'checks' } 'collection-scope' { 'azureResourceTypes' }
|        # #462 a CI rule pack (one rule per id); #464 the recommendation equivalence (one group per id)
|        'ci-rule-pack' { 'rules' } 'recommendation-equivalence' { 'groups' } 'report-scope' { 'reports' }
|        'relation' { 'relations' }
|        # #546 the default exclusion rules for known false positives of a provider's recommendation
|        'recommendation-exclusion' { 'rules' }
|        # #561 / #562 the classification dimensions (one per id: its values) and the classification rows (one per id)
|        'dimension' { 'dimensions' } 'classification' { 'rules' }
|        # #560 the finding texts of SI's own reports (one item per report)
|        'finding-text' { 'reports' }
|        # #690 (15) the severity model: one item per report (its ordered metric kinds + its own severity)
|        'severity-model' { 'reports' }
|        default { $null }
|    }
|}
|
|function Merge-SIDataModelItems {
|    <# Merges one item array: shipped + custom -> merged list + per-item state. #>
|    param([string]$Kind, $Locked, $Custom)
|    $states = New-Object System.Collections.Generic.List[object]
|    # A field mapping may hold SEVERAL items for one field and record type (eg: four si_device_roles|device items, each
|    # a different flag, unioned by the mapper). They used to share one key, so only the last survived the merge. Each
|    # repeat now gets its own key -- the first keeps the plain key (existing overrides still match it), the n-th is
|    # '<key>#<n>' -- and a custom file's n-th item with that key overrides the shipped n-th. The mapper then merges the
|    # items by the field's own rule (union for a list field, first-wins for a single value). Other kinds keep one item
|    # per key: a repeat there is a template error the validator reports.
|    $occ = @{}
|    $keyOf = {
|        param($item, $counts)
|        $base = Get-SIDataModelItemKey $Kind $item
|        if ($Kind -ne 'field-mapping') { return $base }
|        $n = 1; if ($counts.ContainsKey($base)) { $n = [int]$counts[$base] + 1 }
|        $counts[$base] = $n
|        if ($n -eq 1) { return $base }
|        return ('{0}#{1}' -f $base, $n)
|    }
|    $byKey = [ordered]@{}
|    foreach ($it in @($Locked)) { if ($null -ne $it) { $byKey[(& $keyOf $it $occ)] = $it } }
|    $result = [ordered]@{}
|    foreach ($k in $byKey.Keys) { $result[$k] = $byKey[$k] }
|    $customKeys = @{}
|    $occC = @{}
|    foreach ($c in @($Custom)) {
|        if ($null -eq $c) { continue }
|        $k = & $keyOf $c $occC
|        $customKeys[$k] = $true
|        $remove = (ConvertTo-SIBoolOrNull (Get-SIItemValue $c 'remove')) -eq $true
|        if ($byKey.Contains($k)) {
|            $lockedHash = Get-SIDataModelItemHash $byKey[$k]
|            $base = [string](Get-SIItemValue $c 'baseHash')
|            $state = 'Overridden'
|            if ($remove) { $state = 'Disabled' }
|            if ($base -and $base -ne $lockedHash) { $state = 'UpgradeAvailable' }
|            $states.Add([pscustomobject]@{ Key = $k; State = $state; LockedHash = $lockedHash; BaseHash = $base })
|            if ($remove) { $result.Remove($k) } else { $result[$k] = $c }
|        } else {
|            if (-not $remove) { $result[$k] = $c; $states.Add([pscustomobject]@{ Key = $k; State = 'Own'; LockedHash = $null; BaseHash = $null }) }
|        }
|    }
|    foreach ($k in $byKey.Keys) { if (-not $customKeys.ContainsKey($k)) { $states.Add([pscustomobject]@{ Key = $k; State = 'UpToDate'; LockedHash = $null; BaseHash = $null }) } }
|    return @{ Items = @($result.Values); States = $states.ToArray() }
|}
|
|function Merge-SITrustOrder {
|    <# The trust list: shipped order; a custom entry changes fields by id; "after": <id> moves it; a new id is appended (or placed after). #>
|    param($Locked, $Custom)
|    $list = New-Object System.Collections.Generic.List[object]
|    foreach ($e in @($Locked)) { $list.Add(($e | ConvertTo-Json -Depth 10 | ConvertFrom-Json)) }
|    foreach ($c in @($Custom)) {
|        $id = [string]$c.id
|        $idx = -1
|        for ($i = 0; $i -lt $list.Count; $i++) { if ([string]$list[$i].id -eq $id) { $idx = $i; break } }
|        $entry = $null
|        if ($idx -ge 0) {
|            $entry = $list[$idx]
|            foreach ($p in $c.PSObject.Properties) { if ($p.Name -notin 'id', 'after') { $entry | Add-Member -NotePropertyName $p.Name -NotePropertyValue $p.Value -Force } }
|            $list.RemoveAt($idx)
|        } else { $entry = $c }
|        $after = [string](Get-SIItemValue $c 'after')
|        $at = $idx
|        if ($after) { for ($i = 0; $i -lt $list.Count; $i++) { if ([string]$list[$i].id -eq $after) { $at = $i + 1; break } } }
|        if ($at -lt 0 -or $at -gt $list.Count) { $at = $list.Count }
|        $list.Insert($at, $entry)
|    }
|    return , $list.ToArray()
|}
|
|function Read-SIJsonFile {
|    param([string]$Path)
|    if (-not (Test-Path -LiteralPath $Path)) { return $null }
|    $text = [System.IO.File]::ReadAllText($Path)
|    if ([string]::IsNullOrWhiteSpace($text)) { return $null }
|    try { return ($text | ConvertFrom-Json) } catch { throw "data-model template ${Path}: not valid JSON -- $($_.Exception.Message)" }
|}
|
|function Get-SIDataModelTemplate {
|    <#
|    .SYNOPSIS  One template (shipped + customer overrides), merged.
|    .PARAMETER Name         the file name without .locked.json, e.g. 'field-catalog', 'mappings/mde', 'outputs/servicenow-ci'
|    .PARAMETER OverlayRoot  where the customer's *.custom.json live (default: next to the shipped file)
|    .OUTPUTS   @{ Document; States; Kind; Name }
|    #>
|    param([Parameter(Mandatory)][string]$Name, [string]$Root, [string]$OverlayRoot)
|    $Root = Get-SIDataModelRoot $Root
|    $lockedPath = Join-Path $Root ($Name + '.locked.json')
|    $locked = Read-SIJsonFile $lockedPath
|    if ($null -eq $locked) { throw "data-model template '$Name' not found ($lockedPath)" }
|    $customRoot = $Root; if ($OverlayRoot) { $customRoot = $OverlayRoot }
|    $custom = Read-SIJsonFile (Join-Path $customRoot ($Name + '.custom.json'))
|    $kind = [string]$locked.kind
|    $doc = $locked | ConvertTo-Json -Depth 30 | ConvertFrom-Json      # a copy: callers may change it
|    $states = @()
|    if ($null -ne $custom) {
|        if ($custom.kind -and [string]$custom.kind -ne $kind) { throw "data-model override '$Name': kind '$($custom.kind)' does not match '$kind'" }
|        $arr = Get-SIDataModelItemArrayName $kind
|        if ($kind -eq 'trust') {
|            $doc.order = Merge-SITrustOrder -Locked $locked.order -Custom $custom.order
|        } elseif ($kind -eq 'value-map') {
|            foreach ($mp in $custom.maps.PSObject.Properties) {
|                $target = $doc.maps.PSObject.Properties[$mp.Name]
|                if ($null -eq $target) { $doc.maps | Add-Member -NotePropertyName $mp.Name -NotePropertyValue $mp.Value; continue }
|                foreach ($kv in $mp.Value.PSObject.Properties) { $target.Value | Add-Member -NotePropertyName $kv.Name -NotePropertyValue $kv.Value -Force }
|            }
|        } elseif ($kind -eq 'criticality-mapping') {
|            foreach ($sect in 'criticality', 'dataSensitivity') {
|                $cs = Get-SIItemValue $custom $sect
|                if ($null -eq $cs) { continue }
|                foreach ($prov in $cs.PSObject.Properties) {
|                    if ($prov.Name.StartsWith('$')) { continue }
|                    $doc.$sect | Add-Member -NotePropertyName $prov.Name -NotePropertyValue $prov.Value -Force   # a provider's vocabulary is replaced as a whole
|                }
|            }
|            foreach ($p in 'defaultFactor', 'combine', 'cap') { $v = Get-SIItemValue $custom $p; if ($null -ne $v) { $doc.$p = $v } }
|        } elseif ($arr) {
|            $m = Merge-SIDataModelItems -Kind $kind -Locked $locked.$arr -Custom $custom.$arr
|            $doc.$arr = $m.Items
|            $states = $m.States
|            if ($kind -eq 'collection-scope' -and $custom.providers) {
|                foreach ($pp in $custom.providers.PSObject.Properties) { $doc.providers | Add-Member -NotePropertyName $pp.Name -NotePropertyValue $pp.Value -Force }
|            }
|        }
|    }
|    return @{ Document = $doc; States = $states; Kind = $kind; Name = $Name }
|}
|
|function Get-SIDataModel {
|    <#
|    .SYNOPSIS  Every data-model template, merged, in one object the pipeline steps share.
|    #>
|    param([string]$Root, [string]$OverlayRoot)
|    $Root = Get-SIDataModelRoot $Root
|    $model = [ordered]@{ Root = $Root; Mappings = [ordered]@{}; Outputs = [ordered]@{}; States = [ordered]@{} }
|    foreach ($n in 'field-catalog', 'value-maps', 'risk-factors', 'lists', 'trust', 'criticality-mapping', 'collection-scope', 'coverage-checks', 'report-scope') {
|        # #541: report-scope is Risk Analysis's -- optional, so a run folder materialised before the template was published
|        # (Pro, the first run after the update) still loads; Risk Analysis then reads the shipped copy (RA-ScopePreamble.ps1)
|        if ($n -eq 'report-scope' -and -not (Test-Path -LiteralPath (Join-Path $Root ($n + '.locked.json')))) { continue }
|        $t = Get-SIDataModelTemplate -Name $n -Root $Root -OverlayRoot $OverlayRoot
|        $model[$n] = $t.Document
|        $model.States[$n] = $t.States
|    }
|    # the relations between CIs (#493, the asset graph): a template like the others; a data-model folder without it (a test
|    # root, a model materialised before it existed) has no relations, never an error
|    if (Test-Path -LiteralPath (Join-Path $Root 'relations.locked.json')) {
|        $t = Get-SIDataModelTemplate -Name 'relations' -Root $Root -OverlayRoot $OverlayRoot
|        $model['relations'] = $t.Document
|        $model.States['relations'] = $t.States
|    } else {
|        $model['relations'] = [pscustomobject]@{ kind = 'relation'; version = '0'; relations = @() }
|    }
|    # #561 / #562 the classification dimensions and rows: optional -- a data-model folder without them (a test root, a model
|    # materialised before they were published) classifies nothing, never an error
|    foreach ($n in 'dimensions', 'classification', 'finding-texts', 'severity-model') {
|        if (-not (Test-Path -LiteralPath (Join-Path $Root ($n + '.locked.json')))) { continue }
|        $t = Get-SIDataModelTemplate -Name $n -Root $Root -OverlayRoot $OverlayRoot
|        $model[$n] = $t.Document
|        $model.States[$n] = $t.States
|    }
|    foreach ($f in (Get-ChildItem -LiteralPath (Join-Path $Root 'mappings') -Filter '*.locked.json' | Sort-Object Name)) {
|        $n = 'mappings/' + $f.Name.Replace('.locked.json', '')
|        $t = Get-SIDataModelTemplate -Name $n -Root $Root -OverlayRoot $OverlayRoot
|        $model.Mappings[[string]$t.Document.provider] = $t.Document
|        $model.States[$n] = $t.States
|    }
|    foreach ($f in (Get-ChildItem -LiteralPath (Join-Path $Root 'outputs') -Filter '*.locked.json' | Sort-Object Name)) {
|        $n = 'outputs/' + $f.Name.Replace('.locked.json', '')
|        $t = Get-SIDataModelTemplate -Name $n -Root $Root -OverlayRoot $OverlayRoot
|        $model.Outputs[[string]$t.Document.id] = $t.Document
|        $model.States[$n] = $t.States
|    }
|    return $model
|}
|
|function Get-SIDataModelStatusLine {
|    <#
|    .SYNOPSIS  PURE. One plain line about the customer's data-model overrides (Community *.custom.json): how many items are
|               overridden / own / disabled, and which templates hold an override whose shipped item changed since it was
|               written (UpgradeAvailable -- review it; it is never merged). '' when nothing is overridden.
|    #>
|    param([Parameter(Mandatory)]$Model)
|    $c = @{ Overridden = 0; Own = 0; Disabled = 0; UpgradeAvailable = 0 }
|    $up = New-Object System.Collections.Generic.List[string]
|    foreach ($n in @($Model.States.Keys)) {
|        foreach ($s in @($Model.States[$n])) {
|            if ($null -eq $s -or -not $c.ContainsKey([string]$s.State)) { continue }
|            $c[[string]$s.State]++
|            if ($s.State -eq 'UpgradeAvailable') { $up.Add(('{0}:{1}' -f $n, $s.Key)) }
|        }
|    }
|    if (($c.Overridden + $c.Own + $c.Disabled + $c.UpgradeAvailable) -eq 0) { return '' }
|    $line = 'data model: your overrides are in force -- {0} overridden, {1} own, {2} removed' -f ($c.Overridden + $c.UpgradeAvailable), $c.Own, $c.Disabled
|    if ($up.Count) { $line += ('; {0} of them were written against an older shipped item (UpgradeAvailable -- compare and keep yours or take ours): {1}' -f $up.Count, (@($up | Select-Object -First 5) -join ', ')) }
|    return $line
|}
|
|function Get-SIDataModelListContext {
|    <# The condition context's Lists hashtable from the merged lists template. #>
|    param($Model)
|    $lists = @{}
|    foreach ($l in @($Model['lists'].lists)) { $lists[[string]$l.id] = $l }
|    return $lists
|}
|
|function Get-SIOutputMapOps { return , @('enum', 'first', 'join', 'join_ids', 'render', 'format_date', 'round', 'mask', 'domain_part', 'finding_key', 'if_class', 'lower', 'upper') }
|
|function Test-SIDataModel {
|    <#
|    .SYNOPSIS  Validates every template against every other. Returns a list of problems ("<template>: <problem>"); empty = valid.
|               What it proves: every field a mapping, factor, rule, check or output names exists in the catalog at the right
|               level and class; every operation is in its closed set; every value map and list a template names exists.
|    #>
|    param($Model)
|    $p = New-Object System.Collections.Generic.List[string]
|    $cat = $Model['field-catalog']
|    $validClasses = @($cat.classes) + 'finding'
|    $validTypes = 'string', 'bool', 'int', 'real', 'datetime', 'dynamic'
|    $validLevels = @($cat.levels.PSObject.Properties.Name)
|    $validPolicies = @($cat.policies.PSObject.Properties.Name)
|    $providers = @($cat.providers) + @($cat.authorityTokens.PSObject.Properties.Name)
|    $fields = @{}
|    foreach ($f in @($cat.fields)) {
|        $n = [string]$f.name
|        if ($fields.ContainsKey($n)) { $p.Add("field-catalog: '$n' is defined twice") }
|        $fields[$n] = $f
|        if ($n -cnotmatch '^[a-z][a-z0-9_]*$') { $p.Add("field-catalog: '$n' is not lower snake_case") }
|        if ($n -notmatch '^(si_|properties_)' -and -not ($providers -contains ($n.Split('_')[0])) -and $n -notmatch '^cmdb_record_id$') { $p.Add("field-catalog: '$n' has no owner prefix (si_ or a provider)") }
|        if ($validTypes -notcontains [string]$f.type) { $p.Add("field-catalog: '$n' has type '$($f.type)'") }
|        if ($validLevels -notcontains [string]$f.level) { $p.Add("field-catalog: '$n' has level '$($f.level)'") }
|        foreach ($c in @($f.classes)) { if ($validClasses -notcontains [string]$c) { $p.Add("field-catalog: '$n' has class '$c'") } }
|        if ($validPolicies -notcontains [string]$f.resolution.policy) { $p.Add("field-catalog: '$n' has policy '$($f.resolution.policy)'") }
|        foreach ($a in @($f.resolution.authority)) { if ($a -and $providers -notcontains [string]$a) { $p.Add("field-catalog: '$n' authority names unknown provider '$a'") } }
|        # #546 field authority by identity origin: resolution.byOrigin.<synced|cloud> = { policy, authority, decidedBy }
|        $bo = $null; if ($f.resolution) { $bo = Get-SIItemValue $f.resolution 'byOrigin' }
|        if ($null -ne $bo) {
|            foreach ($op in @($bo.PSObject.Properties)) {
|                if ($op.Name -notin 'synced', 'cloud') { $p.Add("field-catalog: '$n' byOrigin names unknown origin '$($op.Name)' (synced or cloud)"); continue }
|                $r = $op.Value
|                $rp = [string](Get-SIItemValue $r 'policy')
|                if ($rp -and ($validPolicies -notcontains $rp -or $rp -eq 'computed')) { $p.Add("field-catalog: '$n' byOrigin.$($op.Name) has policy '$rp'") }
|                $ra = @(@(Get-SIItemValue $r 'authority') | Where-Object { $_ })
|                if ($ra.Count -eq 0) { $p.Add("field-catalog: '$n' byOrigin.$($op.Name) names no authority provider") }
|                foreach ($a in $ra + @(@(Get-SIItemValue $r 'decidedBy') | Where-Object { $_ })) { if ($providers -notcontains [string]$a) { $p.Add("field-catalog: '$n' byOrigin.$($op.Name) names unknown provider '$a'") } }
|                foreach ($a in @(@(Get-SIItemValue $r 'decidedBy') | Where-Object { $_ })) { if ($ra -notcontains $a) { $p.Add("field-catalog: '$n' byOrigin.$($op.Name) decidedBy '$a' is not one of its authority providers") } }
|            }
|        }
|        if (@('strong', 'weak', 'none') -notcontains [string]$f.join) { $p.Add("field-catalog: '$n' has join '$($f.join)'") }
|    }
|
|    $vmaps = $Model['value-maps'].maps
|    $mapOps = Get-SIFieldMapperOps
|    foreach ($prov in $Model.Mappings.Keys) {
|        $m = $Model.Mappings[$prov]
|        if ($providers -notcontains $prov) { $p.Add("mappings/${prov}: provider is not in the catalog's provider list") }
|        $objs = @{}
|        foreach ($o in @($m.objects)) {
|            $objs[[string]$o.recordType] = [string]$o.class
|            if (-not $o.key) { $p.Add("mappings/${prov}: object '$($o.recordType)' has no key") }
|            if (-not $o.timestamp) { $p.Add("mappings/${prov}: object '$($o.recordType)' has no timestamp") }
|        }
|        foreach ($i in @($m.mappings)) {
|            $f = $fields[[string]$i.field]
|            if (-not $f) { $p.Add("mappings/${prov}: unknown field '$($i.field)'"); continue }
|            # #560 a FINDING record type (object class 'finding': a provider's vulnerability / recommendation) maps the generic SI
|            # finding fields -- a finding field, or a CI field that is also carried on a finding (its catalog 'finding' block);
|            # any other record type maps record fields only, as before
|            $rtsI = @(@($i.recordTypes) | Where-Object { $objs.ContainsKey([string]$_) })
|            $onFinding = ($rtsI.Count -gt 0 -and @($rtsI | Where-Object { $objs[[string]$_] -ne 'finding' }).Count -eq 0)
|            $alsoFinding = ($null -ne (Get-SIItemValue $f 'finding'))
|            if ($onFinding) {
|                if ([string]$f.level -ne 'finding' -and -not $alsoFinding) { $p.Add("mappings/${prov}: '$($i.field)' is not a finding field (a finding record type maps finding fields)") }
|            } elseif ([string]$f.level -in 'ci', 'finding') { $p.Add("mappings/${prov}: '$($i.field)' is a $($f.level) field and cannot be mapped") }
|            if (@(@($i.recordTypes) | Where-Object { $objs.ContainsKey([string]$_) -and $objs[[string]$_] -eq 'finding' }).Count -gt 0 -and -not $onFinding) { $p.Add("mappings/${prov}: '$($i.field)' mixes a finding record type with an asset record type") }
|            foreach ($rt in @($i.recordTypes)) {
|                if (-not $objs.ContainsKey([string]$rt)) { $p.Add("mappings/${prov}: '$($i.field)' names record type '$rt' with no object"); continue }
|                $cls = $objs[[string]$rt]
|                if ($cls -eq 'finding') { continue }
|                if ($cls -ne '*' -and @($f.classes) -notcontains $cls) { $p.Add("mappings/${prov}: '$($i.field)' is not a $cls field") }
|            }
|            if (@($i.sources).Count -eq 0) { $p.Add("mappings/${prov}: '$($i.field)' has no source") }
|            foreach ($step in @($i.normalize)) {
|                if (-not $step) { continue }
|                $op = ([string]$step).Split(':')[0]
|                if ($mapOps -notcontains $op) { $p.Add("mappings/${prov}: '$($i.field)' uses unknown operation '$op'") }
|                if ($op -eq 'enum') { $id = ([string]$step).Substring(5); if ($null -eq $vmaps.PSObject.Properties[$id]) { $p.Add("mappings/${prov}: '$($i.field)' names unknown value map '$id'") } }
|            }
|            if ($i.combine -and @('first', 'max', 'min', 'any_true', 'union') -notcontains [string]$i.combine) { $p.Add("mappings/${prov}: '$($i.field)' has combine '$($i.combine)'") }
|            # #455: an authority field says which provider wins -- a provider that fills it must have its place in that
|            # order (a CMDB provider's place is the cmdb_owner token), or its value only ever wins by accident
|            if ([string]$f.resolution.policy -eq 'authority') {
|                $auth = @($f.resolution.authority)
|                $placed = ($auth -contains $prov) -or ($prov -in 'cmdb', 'servicenow' -and $auth -contains 'cmdb_owner')
|                if (-not $placed) { $p.Add("mappings/${prov}: fills '$($i.field)' but '$prov' has no place in the field's authority order") }
|            }
|        }
|    }
|
|    $lists = @{}
|    foreach ($l in @($Model['lists'].lists)) {
|        if ($lists.ContainsKey([string]$l.id)) { $p.Add("lists: '$($l.id)' is defined twice") }
|        $lists[[string]$l.id] = $l
|        if (@('conditions', 'values', 'ranges') -notcontains [string]$l.type) { $p.Add("lists: '$($l.id)' has type '$($l.type)'") }
|        if ([string]$l.type -eq 'ranges') { foreach ($r in @($l.values)) { if ($r -and -not (Test-SIIpInCidr ([string]$r).Split('/')[0] ([string]$r))) { $p.Add("lists: '$($l.id)' range '$r' is not a CIDR") } } }
|    }
|    $condOps = Get-SIConditionOps
|    $checkCondition = {
|        param([string]$Where, $Cond)
|        if ($null -eq $Cond) { return }
|        foreach ($g in 'all', 'any') {
|            if ($Cond.PSObject.Properties[$g]) { foreach ($c in @($Cond.$g)) { & $checkCondition $Where $c }; return }
|        }
|        $fn = [string]$Cond.field
|        if (-not $fields.ContainsKey($fn) -and $fn -notmatch '^properties\.') { $p.Add("${Where}: condition reads unknown field '$fn'") }
|        if ($condOps -notcontains [string]$Cond.op) { $p.Add("${Where}: unknown condition operation '$($Cond.op)'") }
|        if ([string]$Cond.op -in 'in_list', 'in_ranges' -and -not $lists.ContainsKey([string]$Cond.value)) { $p.Add("${Where}: names unknown list '$($Cond.value)'") }
|        if ([string]$Cond.op -eq 'contains_any' -and $Cond.value -is [string] -and -not $lists.ContainsKey([string]$Cond.value)) { $p.Add("${Where}: names unknown list '$($Cond.value)'") }
|        if ([string]$Cond.op -eq 'matches') { try { [void][regex]::new([string]$Cond.value) } catch { $p.Add("${Where}: invalid pattern '$($Cond.value)'") } }
|    }
|    foreach ($l in $lists.Values) { if ([string]$l.type -eq 'conditions') { foreach ($e in @($l.entries)) { & $checkCondition "lists/$($l.id)/$($e.name)" $e.when } } }
|
|    $factorIds = @{}; $tokens = @{}; $shortNames = @{}
|    foreach ($fc in @($Model['risk-factors'].factors)) {
|        $id = [string]$fc.id
|        if ($factorIds.ContainsKey($id)) { $p.Add("risk-factors: '$id' is defined twice") }
|        $factorIds[$id] = $fc
|        if (@('asset', 'finding') -notcontains [string]$fc.appliesTo) { $p.Add("risk-factors: '$id' appliesTo '$($fc.appliesTo)'") }
|        if (@('probability', 'consequence') -notcontains [string]$fc.axis) { $p.Add("risk-factors: '$id' axis '$($fc.axis)'") }
|        # #559 risk factor model v2: state replaces stage (shortName / group / class / impact 1-5 / a builtin is never
|        # disabled are checked per item by Test-SIRiskFactorItem, below, so a customer override is held to them too)
|        if (@('enabled', 'disabled') -notcontains [string](Get-SIItemValue $fc 'state')) { $p.Add("risk-factors: '$id' state '$(Get-SIItemValue $fc 'state')' (enabled | disabled)") }
|        if (@('catalog', 'report') -notcontains [string]$fc.evaluatedBy) { $p.Add("risk-factors: '$id' evaluatedBy '$($fc.evaluatedBy)'") }
|        if ($null -eq (ConvertTo-SINumberOrNull $fc.impact)) { $p.Add("risk-factors: '$id' impact is not a number") }
|        $sn = ([string](Get-SIItemValue $fc 'shortName')).ToLowerInvariant()
|        if ($sn) { if ($shortNames.ContainsKey($sn)) { $p.Add("risk-factors: short name '$(Get-SIItemValue $fc 'shortName')' is used by '$($shortNames[$sn])' and '$id'") } else { $shortNames[$sn] = $id } }
|        foreach ($t in @($fc.legacyTokens)) { if ($t) { if ($tokens.ContainsKey([string]$t)) { $p.Add("risk-factors: legacy token '$t' is claimed by '$($tokens[[string]$t])' and '$id'") }; $tokens[[string]$t] = $id } }
|        if ([string]$fc.evaluatedBy -eq 'catalog') {
|            & $checkCondition "risk-factors/$id" $fc.when
|            foreach ($fn in (Get-SIConditionFields $fc.when)) {
|                $fd = $fields[$fn]
|                if ($fd -and [string]$fc.appliesTo -eq 'asset' -and [string]$fd.level -eq 'finding') { $p.Add("risk-factors/${id}: an asset factor reads finding field '$fn'") }
|            }
|        }
|    }
|
|    # the Azure CI scope: every Azure type is an ARM type, and a child type's rollUpInto names its parent types, 'path' or
|    # dot paths to find the parent, and a catalog field to be listed in (SI-AzureChildren.ps1)
|    if ($null -ne $Model['collection-scope']) {
|        foreach ($x in @(Test-SIAzureCiScopeItems -Document $Model['collection-scope'] -Fields $fields)) { $p.Add("collection-scope: $x") }
|    }
|
|    foreach ($ck in @($Model['coverage-checks'].checks)) {
|        if (@('tenant', 'subscription', 'ci') -notcontains [string]$ck.scope) { $p.Add("coverage-checks: '$($ck.id)' scope '$($ck.scope)'") }
|        if ([string]$ck.scope -eq 'ci') { & $checkCondition "coverage-checks/$($ck.id)" $ck.fail }
|        if ($ck.riskFactor -and -not $factorIds.ContainsKey([string]$ck.riskFactor)) { $p.Add("coverage-checks: '$($ck.id)' names unknown risk factor '$($ck.riskFactor)'") }
|    }
|
|    $outOps = Get-SIOutputMapOps
|    foreach ($oid in $Model.Outputs.Keys) {
|        $o = $Model.Outputs[$oid]
|        if (@('ci', 'ci_finding', 'finding_summary', 'record') -notcontains [string]$o.grain) { $p.Add("outputs/${oid}: grain '$($o.grain)'") }
|        $targets = @{}
|        $names = @{}
|        foreach ($c in @($o.columns)) {
|            if ($targets.ContainsKey([string]$c.target)) { $p.Add("outputs/${oid}: column '$($c.target)' appears twice") }
|            $targets[[string]$c.target] = 1
|            # the name the output gives the column: 'as' (a customer's rename) or the target -- one line, unique per output
|            $as = [string](Get-SIItemValue $c 'as')
|            $name = [string]$c.target
|            if (-not [string]::IsNullOrWhiteSpace($as)) {
|                $name = $as.Trim()
|                if ($name.Length -gt 128 -or $name -match '[\r\n\t]') { $p.Add("outputs/${oid}: column '$($c.target)' has a name ('as') that is not one line of at most 128 characters") }
|            }
|            if ($names.ContainsKey($name.ToLowerInvariant())) { $p.Add("outputs/${oid}: two columns are named '$name'") }
|            $names[$name.ToLowerInvariant()] = 1
|            $from = [string]$c.from
|            if (-not ($from.StartsWith('$') -or $from -match '^(finding|summary|record)\.' -or $fields.ContainsKey($from))) { $p.Add("outputs/${oid}: column '$($c.target)' reads unknown field '$from'") }
|            if ($c.op) {
|                $op = ([string]$c.op).Split(':')[0]
|                if ($outOps -notcontains $op) { $p.Add("outputs/${oid}: column '$($c.target)' uses unknown operation '$op'") }
|                if ($op -eq 'enum') { $id = ([string]$c.op).Substring(5); if ($null -eq $vmaps.PSObject.Properties[$id]) { $p.Add("outputs/${oid}: column '$($c.target)' names unknown value map '$id'") } }
|            }
|        }
|    }
|
|    $seen = @{}
|    foreach ($t in @($Model['trust'].order)) { if ($seen.ContainsKey([string]$t.id)) { $p.Add("trust: '$($t.id)' appears twice") }; $seen[[string]$t.id] = 1 }
|
|    foreach ($sect in 'criticality', 'dataSensitivity') {
|        foreach ($prov in $Model['criticality-mapping'].$sect.PSObject.Properties) {
|            if ($prov.Name.StartsWith('$')) { continue }
|            if (@('cmdb', 'servicenow') -notcontains $prov.Name) { $p.Add("criticality-mapping: $sect names unknown CMDB provider '$($prov.Name)'") }
|            foreach ($e in @($prov.Value)) {
|                if ($null -eq (ConvertTo-SINumberOrNull $e.factor)) { $p.Add("criticality-mapping: $sect/$($prov.Name) '$($e.value)' has no numeric factor") }
|                if ($sect -eq 'criticality' -and @('critical', 'high', 'medium', 'low') -notcontains [string]$e.level) { $p.Add("criticality-mapping: $($prov.Name) '$($e.value)' has level '$($e.level)'") }
|            }
|        }
|    }
|    # #527 (5)-(7): one scope per factor, no tier, SI fields only (SI-RiskFactorCatalog.ps1) -- a customer override is held to them too
|    # (Test-SIRiskFactorRules includes #559 Test-SIRiskFactorModelV2: shortName, group, class, impact 1-5, a built-in factor
|    #  is never disabled -- the engine-side twin of the web app's check)
|    foreach ($x in (Test-SIRiskFactorRules -Model $Model)) { $p.Add($x) }
|    # #559 break_glass_patterns: a values list of glob patterns, never wildcards only (the web app's rule too)
|    foreach ($x in (Test-SIBreakGlassPatterns -Model $Model)) { $p.Add($x) }
|    # the break-glass extension attribute the customer defines: attribute=value entries (engine/data-model/SI-BreakGlass.ps1)
|    if (-not (Get-Command -Name Test-SIBreakGlassAttributeList -ErrorAction SilentlyContinue)) { $bgFile = Join-Path $PSScriptRoot 'SI-BreakGlass.ps1'; if (Test-Path -LiteralPath $bgFile) { . $bgFile } }
|    if (Get-Command -Name Test-SIBreakGlassAttributeList -ErrorAction SilentlyContinue) { foreach ($x in (Test-SIBreakGlassAttributeList -Model $Model)) { $p.Add($x) } }
|    # the risk rating bands are data (owner decision pending): three whole numbers, highest first
|    foreach ($x in (Test-SIRiskRatingBands -Model $Model)) { $p.Add($x) }
|
|    # #493 the relations between CIs: every relation reads a catalog field valid on its classes, names a known target kind,
|    # an identifier type for 'id', a node type for 'node'; a reversed relation must point at CI ids
|    $relSeen = @{}
|    foreach ($r in @(Get-SIItemValue $Model['relations'] 'relations')) {
|        if ($null -eq $r) { continue }
|        $rid = [string]$r.id
|        if (-not $rid -or $rid -cnotmatch '^[a-z][a-z0-9_]{0,47}$') { $p.Add("relations: '$rid' is not a lower snake_case id of at most 48 characters"); continue }
|        if ($relSeen.ContainsKey($rid)) { $p.Add("relations: '$rid' is defined twice") }
|        $relSeen[$rid] = 1
|        if ([string]$r.kind -cnotmatch '^[a-z][a-z0-9_]{0,47}$') { $p.Add("relations/${rid}: kind '$($r.kind)' is not a lower snake_case word of at most 48 characters") }
|        $fd = $fields[[string]$r.field]
|        if (-not $fd) { $p.Add("relations/${rid}: reads unknown field '$($r.field)'") }
|        elseif ([string]$fd.level -eq 'finding') { $p.Add("relations/${rid}: '$($r.field)' is a finding field") }
|        foreach ($c in @($r.from)) {
|            if (@($cat.classes) -notcontains [string]$c) { $p.Add("relations/${rid}: from names unknown class '$c'") }
|            elseif ($fd -and @($fd.classes) -notcontains [string]$c) { $p.Add("relations/${rid}: '$($r.field)' is not a $c field") }
|        }
|        if (@($r.from).Count -eq 0) { $p.Add("relations/${rid}: names no 'from' class") }
|        switch ([string]$r.target) {
|            'ci' { }
|            'id' { if (-not ([string]$r.idType)) { $p.Add("relations/${rid}: target 'id' needs an idType") } }
|            'node' { if (-not ([string]$r.nodeType)) { $p.Add("relations/${rid}: target 'node' needs a nodeType") } }
|            default { $p.Add("relations/${rid}: target '$($r.target)' (ci | id | node)") }
|        }
|        if ((Get-SIItemValue $r 'reverse') -eq $true -and [string]$r.target -ne 'ci') { $p.Add("relations/${rid}: only a relation to CI ids can be reversed") }
|        $q = [string](Get-SIItemValue $r 'qualifyWith'); if ($q -and -not $fields.ContainsKey($q)) { $p.Add("relations/${rid}: qualifyWith names unknown field '$q'") }
|        if (@('exact', 'strong', 'weak') -notcontains [string]$r.confidence) { $p.Add("relations/${rid}: confidence '$($r.confidence)' (exact | strong | weak)") }
|        $st = [string](Get-SIItemValue $r 'stage'); if ($st -and @('production', 'testing', 'not_used') -notcontains $st) { $p.Add("relations/${rid}: stage '$st'") }
|    }
|    # #561 / #562 the classification dimensions and rows: valid, and every field they read or write is in the catalog
|    if ($null -ne $Model['dimensions'] -or $null -ne $Model['classification']) {
|        foreach ($x in (Test-SIClassifications -Dimensions $Model['dimensions'] -Classification $Model['classification'] -Fields $fields)) { $p.Add([string]$x) }
|    }
|    # #560 the finding texts of SI's own reports: every field they fill is a finding field of the catalog
|    if ($null -ne $Model['finding-texts']) {
|        $ff = [string[]]@($fields.Keys | Where-Object { [string]$fields[$_].level -eq 'finding' -or $null -ne (Get-SIItemValue $fields[$_] 'finding') })
|        foreach ($x in (Test-SIFindingTexts -Document $Model['finding-texts'] -FindingFields $ff)) { $p.Add([string]$x) }
|    }
|    # #690 (15) the severity model: five SI values, every report ends with its own severity
|    if ($null -ne $Model['severity-model']) {
|        foreach ($x in (Test-SISeverityModel -Model $Model['severity-model'])) { $p.Add([string]$x) }
|    }
|    # one problem per output item: @(Test-SIDataModel ...) and a pipeline filter see each problem, never one array
|    return $p.ToArray()
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE SEVERITY MODEL (#690 (15), data-model/severity-model.locked.json)
|#  Owner 2026-10-15: "all security findings must have severity" / "it comes from different metrics, often impact score or
|#  directly from the source" / "unknown is not supported in any report" / "field must be normalized". Every report declares
|#  an ORDERED list of metric kinds; the first kind whose metric a row carries decides; owner_defined is always last, so a
|#  row always ends with exactly one of the five SI values. The reports' queries do not read the model yet (the generated
|#  severity block is the next step) -- these functions are the model's one reader and its validation.
|# ------------------------------------------------------------------------------------------------------------------
|
|function Get-SISeverityScale { <# The five SI severities -- the only values a report's SecuritySeverity may hold. #> @('Very High', 'High', 'Medium-High', 'Medium', 'Low') }
|
|function Get-SISeverityModel {
|    <# The severity model of the run (the data model + its overrides), else the shipped file next to this file's data model. #>
|    param($Model, [string]$Root)
|    if ($Model -and $null -ne $Model['severity-model']) { return $Model['severity-model'] }
|    $r = Get-SIDataModelRoot $Root
|    $f = Join-Path $r 'severity-model.locked.json'
|    if (-not (Test-Path -LiteralPath $f)) { return $null }
|    return (Get-SIDataModelTemplate -Name 'severity-model' -Root $r).Document
|}
|
|function Test-SISeverityModel {
|    <# PURE. The problems of a severity model (none = valid): the scale is exactly the five SI values, every kind maps
|       only into it, every report's order names known kinds and ends with owner_defined, and its own severity is one of
|       the five. #>
|    param([Parameter(Mandatory)]$Model)
|    $p = New-Object System.Collections.Generic.List[string]
|    $scale = @(Get-SIItemValue $Model 'scale' | ForEach-Object { [string]$_ })
|    if (($scale -join '|') -cne ((Get-SISeverityScale) -join '|')) { $p.Add("severity-model: the scale must be exactly $((Get-SISeverityScale) -join ', ')") }
|    $kinds = @{}
|    foreach ($m in @(Get-SIItemValue $Model 'models')) {
|        $id = [string](Get-SIItemValue $m 'id'); $ty = [string](Get-SIItemValue $m 'type')
|        if (-not $id) { $p.Add('severity-model: a model has no id'); continue }
|        if ($kinds.ContainsKey($id)) { $p.Add("severity-model: '$id' is defined twice") }
|        $kinds[$id] = $m
|        if (@('map', 'bands', 'fixed') -cnotcontains $ty) { $p.Add("severity-model/${id}: type '$ty' (map | bands | fixed)") }
|        if ($ty -eq 'map') {
|            $map = Get-SIItemValue $m 'map'
|            if ($null -eq $map) { $p.Add("severity-model/${id}: a map model has a 'map'") }
|            else { foreach ($e in $map.PSObject.Properties) { if ((Get-SISeverityScale) -cnotcontains [string]$e.Value) { $p.Add("severity-model/${id}: '$($e.Name)' maps to '$($e.Value)', not an SI severity") } } }
|        }
|        if ($ty -eq 'bands') {
|            $prev = [double]::MaxValue
|            $bands = @(Get-SIItemValue $m 'bands')
|            if ($bands.Count -eq 0) { $p.Add("severity-model/${id}: a bands model has 'bands'") }
|            foreach ($b in $bands) {
|                $min = ConvertTo-SINumberOrNull (Get-SIItemValue $b 'min')
|                if ($null -eq $min) { $p.Add("severity-model/${id}: a band has no numeric min"); continue }
|                if ($min -ge $prev) { $p.Add("severity-model/${id}: bands are highest first") }
|                $prev = $min
|                if ((Get-SISeverityScale) -cnotcontains [string](Get-SIItemValue $b 'severity')) { $p.Add("severity-model/${id}: band $min maps to '$(Get-SIItemValue $b 'severity')', not an SI severity") }
|            }
|        }
|    }
|    if (-not $kinds.ContainsKey('owner_defined')) { $p.Add("severity-model: the owner_defined kind is missing") }
|    $seen = @{}
|    foreach ($r in @(Get-SIItemValue $Model 'reports')) {
|        $rid = [string](Get-SIItemValue $r 'id')
|        if (-not $rid) { $p.Add('severity-model: a report has no id'); continue }
|        if ($seen.ContainsKey($rid)) { $p.Add("severity-model: report '$rid' is listed twice") }
|        $seen[$rid] = $true
|        $order = @(Get-SIItemValue $r 'order' | ForEach-Object { [string]$_ })
|        if ($order.Count -eq 0 -or $order[$order.Count - 1] -cne 'owner_defined') { $p.Add("severity-model/${rid}: the order ends with owner_defined (every row gets a severity)") }
|        foreach ($k in $order) { if (-not $kinds.ContainsKey($k)) { $p.Add("severity-model/${rid}: unknown kind '$k'") } }
|        if ((Get-SISeverityScale) -cnotcontains [string](Get-SIItemValue $r 'ownerDefined')) { $p.Add("severity-model/${rid}: ownerDefined '$(Get-SIItemValue $r 'ownerDefined')' is not an SI severity") }
|    }
|    return $p.ToArray()
|}
|
|function Test-SISeverityModelReportItem {
|    <# PURE. One report item of the severity model on its own (a Pro override): the problems, none = accepted. The kinds
|       it names are checked against the model when the run's whole model is validated (Test-SIDataModel). #>
|    param([Parameter(Mandatory)]$Item)
|    $p = New-Object System.Collections.Generic.List[string]
|    $rid = [string](Get-SIItemValue $Item 'id')
|    $order = @(Get-SIItemValue $Item 'order' | ForEach-Object { [string]$_ })
|    if ($order.Count -eq 0 -or $order[$order.Count - 1] -cne 'owner_defined') { $p.Add("severity-model/${rid}: the order ends with owner_defined (every row gets a severity)") }
|    if ((Get-SISeverityScale) -cnotcontains [string](Get-SIItemValue $Item 'ownerDefined')) { $p.Add("severity-model/${rid}: ownerDefined must be one of $((Get-SISeverityScale) -join ', ')") }
|    return $p.ToArray()
|}
|
|function Resolve-SISeverity {
|    <#
|        PURE. One row's severity: the report's kinds in order, the first whose metric -Metrics carries (a hashtable kind ->
|        value: a word for a map kind, a number for a bands kind) decides; owner_defined (the report's ownerDefined) last.
|        A report the model does not list returns $null -- never a guessed value (SIv3-SeverityModel keeps every shipped
|        report listed). Always one of the five SI values or $null; never 'Unknown'.
|    #>
|    param([Parameter(Mandatory)]$Model, [Parameter(Mandatory)][string]$ReportName, [hashtable]$Metrics = @{})
|    $rep = @(@(Get-SIItemValue $Model 'reports') | Where-Object { [string](Get-SIItemValue $_ 'id') -eq $ReportName }) | Select-Object -First 1
|    if ($null -eq $rep) { return $null }
|    $kinds = @{}; foreach ($m in @(Get-SIItemValue $Model 'models')) { $kinds[[string](Get-SIItemValue $m 'id')] = $m }
|    foreach ($k in @(Get-SIItemValue $rep 'order' | ForEach-Object { [string]$_ })) {
|        if ($k -eq 'owner_defined') { return [string](Get-SIItemValue $rep 'ownerDefined') }
|        $m = $kinds[$k]; if ($null -eq $m -or -not $Metrics.ContainsKey($k)) { continue }
|        $v = $Metrics[$k]; if ($null -eq $v -or ([string]$v).Trim() -eq '') { continue }
|        switch ([string](Get-SIItemValue $m 'type')) {
|            'map' {
|                $map = Get-SIItemValue $m 'map'; $key = ([string]$v).Trim().ToLowerInvariant()
|                $hit = $null; foreach ($e in $map.PSObject.Properties) { if ($e.Name.ToLowerInvariant() -eq $key) { $hit = [string]$e.Value; break } }
|                if ($hit) { return $hit }
|            }
|            'bands' {
|                $n = ConvertTo-SINumberOrNull $v
|                if ($null -eq $n) { break }
|                foreach ($b in @(Get-SIItemValue $m 'bands')) { if ($n -ge [double](ConvertTo-SINumberOrNull (Get-SIItemValue $b 'min'))) { return [string](Get-SIItemValue $b 'severity') } }
|            }
|        }
|    }
|    return [string](Get-SIItemValue $rep 'ownerDefined')
|}
'@ }
$__siSupportFiles['engine/data-model/SI-Conditions.ps1'] = @{ Sha256 = 'd03c9b8ed4b1682d5d47e22ac3a93a5ad43d3096e9e0e3609ca0afc4da02d68b'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight condition evaluator -- the ONE implementation of the closed condition language that risk factors,
|    enrichment rules, coverage checks and lists use (data-model/*.json, V3-DATA-MODEL part 2).
|
|    A condition is a leaf or a group:
|        leaf   { "field": "si_tier", "op": "lte", "value": 1 }
|        group  { "all": [ ... ] }   { "any": [ ... ] }      (an empty "all" is true, an empty "any" is false)
|
|    THE OPERATION SET IS CLOSED. A template (and a customer override) can only combine these operations; there is no
|    expression language, so a customer-authored file can never run code in the engine:
|        eq ne in not_in is_true is_false is_empty not_empty gt gte lt lte like contains contains_any matches
|        older_than_days newer_than_days in_ranges in_list
|    An unknown operation throws -- a condition must never evaluate as something its author did not write.
|
|    The item is anything with named values: a hashtable, an ordered dictionary or a PSObject (a CI, a record, a finding).
|    String comparison is case-insensitive. Dates are read with InvariantCulture and compared in UTC.
|
|    Context (optional hashtable):
|        Lists = @{ <id> = <list object from lists.json: type conditions | values | ranges> }
|        Now   = [datetime] UTC   (default: the current time; tests pass a fixed one)
|
|    PowerShell 5.1: no ?. / ??, no ternary; no Set-StrictMode here (it would leak into the caller).
|#>
|
|function Get-SIItemValue {
|    <# The value of a named field on a hashtable / dictionary / PSObject, or $null. Case-insensitive. #>
|    param($Item, [string]$Name)
|    if ($null -eq $Item -or [string]::IsNullOrEmpty($Name)) { return $null }
|    if ($Item -is [System.Collections.IDictionary]) {
|        if ($Item.Contains($Name)) { return $Item[$Name] }
|        foreach ($k in $Item.Keys) { if ([string]::Equals([string]$k, $Name, [StringComparison]::OrdinalIgnoreCase)) { return $Item[$k] } }
|        return $null
|    }
|    $p = $Item.PSObject.Properties[$Name]
|    if ($p) { return $p.Value }
|    return $null
|}
|
|function Test-SIValueEmpty {
|    param($Value)
|    if ($null -eq $Value) { return $true }
|    if ($Value -is [string]) { return [string]::IsNullOrWhiteSpace($Value) }
|    if ($Value -is [System.Collections.IDictionary]) { return ($Value.Count -eq 0) }
|    if ($Value -is [System.Collections.IEnumerable]) { foreach ($x in $Value) { return $false }; return $true }
|    return $false
|}
|
|function ConvertTo-SIBoolOrNull {
|    param($Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [bool]) { return $Value }
|    $s = ([string]$Value).Trim()
|    if ($s -eq '') { return $null }
|    if ($s -in 'true', '1', 'yes', 'y', 'on', 'enabled') { return $true }
|    if ($s -in 'false', '0', 'no', 'n', 'off', 'disabled') { return $false }
|    return $null
|}
|
|function ConvertTo-SINumberOrNull {
|    <# A number, or the leading number of a version-like string ("12.6.1" -> 12.6), or $null. #>
|    param($Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [int] -or $Value -is [long] -or $Value -is [double] -or $Value -is [decimal] -or $Value -is [single]) { return [double]$Value }
|    $s = ([string]$Value).Trim()
|    if ($s -eq '') { return $null }
|    $d = 0.0
|    if ([double]::TryParse($s, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $d }
|    $m = [regex]::Match($s, '^-?\d+(\.\d+)?')
|    if ($m.Success -and [double]::TryParse($m.Value, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $d }
|    return $null
|}
|
|function ConvertTo-SIUtcOrNull {
|    param($Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [datetime]) { return $Value.ToUniversalTime() }
|    if ($Value -is [datetimeoffset]) { return $Value.UtcDateTime }
|    $s = ([string]$Value).Trim()
|    if ($s -eq '') { return $null }
|    $dto = [datetimeoffset]::MinValue
|    if ([datetimeoffset]::TryParse($s, [System.Globalization.CultureInfo]::InvariantCulture, [System.Globalization.DateTimeStyles]::AssumeUniversal, [ref]$dto)) { return $dto.UtcDateTime }
|    return $null
|}
|
|function Get-SIValueList {
|    <# A value as a flat list: $null -> empty; a scalar -> one item; a list -> its items. Strings are never split. #>
|    param($Value)
|    $out = [System.Collections.Generic.List[object]]::new()
|    if ($null -eq $Value) { return , $out }
|    if ($Value -is [string] -or $Value -is [System.Collections.IDictionary] -or -not ($Value -is [System.Collections.IEnumerable])) { $out.Add($Value); return , $out }
|    foreach ($x in $Value) { if ($null -ne $x) { $out.Add($x) } }
|    return , $out
|}
|
|function ConvertTo-SITagScopeText {
|    <# PURE. Where an inherited tag came from, in plain words: resourceGroup -> 'resource group', subscription ->
|       'subscription', managementGroup -> 'management group'; '' when the tag is the asset's own (no scope). #>
|    param([AllowNull()][AllowEmptyString()][string]$Scope)
|    $s = ([string]$Scope).Trim()
|    if (-not $s) { return '' }
|    switch ($s.ToLowerInvariant()) { 'resourcegroup' { return 'resource group' } 'subscription' { return 'subscription' } 'managementgroup' { return 'management group' } }
|    return ($s -creplace '([a-z])([A-Z])', '$1 $2').ToLowerInvariant()
|}
|
|function ConvertTo-SITagEntryText {
|    <#
|        PURE. ONE tag entry as text a person (and ServiceNow) reads: { name; value } -> 'name = value', a name without a value
|        -> 'name', an inherited tag (it has a scope) -> 'name = value (resource group)' / '(subscription)'. The same words the
|        web app's CI page shows (CiDocument.Item). $null when the item is not a tag entry: a name AND a value key, and no id
|        (an object with an id is a linked object, never a tag).
|    #>
|    param($Item)
|    if ($null -eq $Item -or $Item -is [string] -or $Item -is [ValueType]) { return $null }
|    $has = {
|        param($o, [string]$k)
|        if ($o -is [System.Collections.IDictionary]) { foreach ($x in $o.Keys) { if ([string]::Equals([string]$x, $k, [StringComparison]::OrdinalIgnoreCase)) { return $true } }; return $false }
|        return ($null -ne $o.PSObject.Properties[$k])
|    }
|    if (-not (& $has $Item 'name') -or -not (& $has $Item 'value') -or (& $has $Item 'id')) { return $null }
|    $n = ([string](Get-SIItemValue $Item 'name')).Trim()
|    if (-not $n) { return $null }
|    $v = ([string](Get-SIItemValue $Item 'value')).Trim()
|    $t = $n; if ($v) { $t = '{0} = {1}' -f $n, $v }
|    $sc = ConvertTo-SITagScopeText ([string](Get-SIItemValue $Item 'scope'))
|    if ($sc) { $t = '{0} ({1})' -f $t, $sc }
|    return $t
|}
|
|function ConvertTo-SITagListText {
|    <# PURE. A list of tag entries as ONE text, '; '-joined (ConvertTo-SITagEntryText each); $null when the value is not a
|       non-empty list made only of tag entries (every other value keeps its own form). #>
|    param($Value)
|    if ($null -eq $Value -or $Value -is [string] -or $Value -is [System.Collections.IDictionary] -or -not ($Value -is [System.Collections.IEnumerable])) { return $null }
|    $parts = [System.Collections.Generic.List[string]]::new()
|    foreach ($x in $Value) {
|        if ($null -eq $x) { continue }
|        $t = ConvertTo-SITagEntryText $x
|        if ($null -eq $t) { return $null }
|        $parts.Add($t)
|    }
|    if ($parts.Count -eq 0) { return $null }
|    return ($parts -join '; ')
|}
|
|function Test-SIScalarEqual {
|    param($A, $B)
|    if ($null -eq $A -or $null -eq $B) { return ($null -eq $A -and $null -eq $B) }
|    if ($A -is [bool] -or $B -is [bool]) {
|        $x = ConvertTo-SIBoolOrNull $A; $y = ConvertTo-SIBoolOrNull $B
|        return ($null -ne $x -and $x -eq $y)
|    }
|    $na = $null; $nb = $null
|    if (-not ($A -is [string]) -or -not ($B -is [string])) { $na = ConvertTo-SINumberOrNull $A; $nb = ConvertTo-SINumberOrNull $B }
|    if ($null -ne $na -and $null -ne $nb) { return ($na -eq $nb) }
|    return [string]::Equals(([string]$A).Trim(), ([string]$B).Trim(), [StringComparison]::OrdinalIgnoreCase)
|}
|
|function Test-SIIpInCidr {
|    <# True when the address is inside the CIDR (IPv4 or IPv6). A bare address is a /32 or /128. #>
|    param([string]$Ip, [string]$Cidr)
|    $addr = $null
|    if (-not [System.Net.IPAddress]::TryParse(($Ip -split '/')[0].Trim(), [ref]$addr)) { return $false }
|    $parts = $Cidr.Trim() -split '/'
|    $net = $null
|    if (-not [System.Net.IPAddress]::TryParse($parts[0], [ref]$net)) { return $false }
|    if ($addr.AddressFamily -ne $net.AddressFamily) {
|        if ($addr.IsIPv4MappedToIPv6) { $addr = $addr.MapToIPv4() } else { return $false }
|        if ($addr.AddressFamily -ne $net.AddressFamily) { return $false }
|    }
|    $a = $addr.GetAddressBytes(); $n = $net.GetAddressBytes()
|    $bits = $a.Length * 8
|    if ($parts.Count -gt 1) { $bits = [int]$parts[1] }
|    if ($bits -lt 0 -or $bits -gt $a.Length * 8) { return $false }
|    for ($i = 0; $i -lt $a.Length; $i++) {
|        $take = [Math]::Min(8, [Math]::Max(0, $bits - ($i * 8)))
|        if ($take -eq 0) { break }
|        $mask = [byte]((0xFF -shl (8 - $take)) -band 0xFF)
|        if (($a[$i] -band $mask) -ne ($n[$i] -band $mask)) { return $false }
|    }
|    return $true
|}
|
|function Resolve-SIListValues {
|    <# A "value" that names a list (a string id found in Context.Lists) -> that list's values; otherwise the value itself as a list. #>
|    param($Value, $Context)
|    if ($Value -is [string] -and $Context -and $Context.Lists -and $Context.Lists.ContainsKey($Value)) {
|        $l = $Context.Lists[$Value]
|        $v = Get-SIItemValue $l 'values'
|        return , (Get-SIValueList $v)
|    }
|    return , (Get-SIValueList $Value)
|}
|
|function Get-SIMatchTexts {
|    <# The texts a value is matched as: a tag entry {source, name, value} -> 'name=value', name, value; anything else -> itself. #>
|    param($Value)
|    if ($null -eq $Value) { return }
|    $n = Get-SIItemValue $Value 'name'
|    if ($null -ne $n -and -not ($Value -is [string])) {
|        $v = [string](Get-SIItemValue $Value 'value')
|        if ($v) { '{0}={1}' -f $n, $v }
|        [string]$n
|        if ($v) { $v }
|        return
|    }
|    [string]$Value
|    # #690 (48) an OBJECT value (an Azure role assignment {RoleName, Scope, EffectiveTier ...}) is matched as its compact
|    # JSON as well -- its text form alone is the type name for a dictionary, so no pattern could read its properties
|    if ($Value -is [System.Collections.IDictionary] -or $Value -is [System.Management.Automation.PSCustomObject]) {
|        try { ConvertTo-Json -InputObject $Value -Compress -Depth 4 } catch { }
|    }
|}
|
|# =====================================================================================================================
|#  A LONG LIST IS MATCHED ONCE PER PATTERN, NOT ONCE PER PATTERN AND VALUE (2026-10-13)
|#  A device's installed software is a list of several hundred to a few thousand names, and the device rules test it with
|#  about three thousand name patterns ('like'). Every test built its pattern again and walked the list value by value
|#  through a function call: a device with 1,200 names took MINUTES to classify, and a batch of such devices stood still
|#  for hours without a line in the log (measured on the test VM, tests/pester/SIv3-CiBuildHeavyResources.Tests.ps1).
|#    * a pattern is built once and kept (Get-SIConditionRegex, Get-SIConditionWildcard) -- the same pattern object, so
|#      the same answer;
|#    * a list of 16 values or more is turned into its match texts once per item and field (Get-SIMatchTextList), and
|#    * a wildcard made of plain text and '*' only is answered by ONE search over those texts joined together
|#      (Get-SIWildcardLineRegex). Every other wildcard ('?', '[a-z]', an escape) is matched text by text as before.
|#  The answers are the same as before. One known difference: the joined search compares the lower-case forms of the
|#  texts and the pattern (invariant rules), a wildcard compares letter by letter in the process's culture -- the same for the names SecurityInsight reads (they are
|#  lower-cased when they are mapped; only a culture with its own letter-case rules, such as Turkish, could differ).
|#  Kept per process (a parallel thread has its own): nothing here is shared between threads.
|# =====================================================================================================================
|
|function Get-SIConditionRegex {
|    <# A 'matches' pattern as its Regex (no case, invariant, 200 ms per match), built once. A pattern that is not valid throws, as before. #>
|    param([string]$Pattern)
|    $cache = $script:SIConditionRegexCache
|    if ($null -eq $cache -or $cache.Count -gt 20000) { $cache = New-Object 'System.Collections.Generic.Dictionary[string,object]' ([StringComparer]::Ordinal); $script:SIConditionRegexCache = $cache }
|    $rx = $null
|    if ($cache.TryGetValue($Pattern, [ref]$rx)) { return $rx }
|    $rx = New-Object System.Text.RegularExpressions.Regex($Pattern, ([System.Text.RegularExpressions.RegexOptions]::IgnoreCase -bor [System.Text.RegularExpressions.RegexOptions]::CultureInvariant), ([TimeSpan]::FromMilliseconds(200)))
|    $cache[$Pattern] = $rx
|    return $rx
|}
|
|function Get-SIConditionWildcard {
|    <# A 'like' pattern as its WildcardPattern (no case), built once. #>
|    param([string]$Pattern)
|    $cache = $script:SIConditionWildcardCache
|    if ($null -eq $cache -or $cache.Count -gt 20000) { $cache = New-Object 'System.Collections.Generic.Dictionary[string,object]' ([StringComparer]::Ordinal); $script:SIConditionWildcardCache = $cache }
|    $wc = $null
|    if ($cache.TryGetValue($Pattern, [ref]$wc)) { return $wc }
|    $wc = New-Object System.Management.Automation.WildcardPattern($Pattern, [System.Management.Automation.WildcardOptions]::IgnoreCase)
|    $cache[$Pattern] = $wc
|    return $wc
|}
|
|function Get-SIWildcardLineRegex {
|    <#
|        PURE. A wildcard made of plain text and '*' only -> the Regex that finds a WHOLE text matching it in texts joined
|        with the character U+0001 (also before the first and after the last text); $null for any other wildcard ('?',
|        '[', ']', an escape), which is matched text by text.
|          'sql*'    -> <sep>sql            '*/sql*' -> /sql            'a*b' -> <sep>a[^<sep>]*b<sep>
|    #>
|    param([string]$Pattern)
|    $cache = $script:SIConditionLineCache
|    if ($null -eq $cache -or $cache.Count -gt 20000) { $cache = New-Object 'System.Collections.Generic.Dictionary[string,object]' ([StringComparer]::Ordinal); $script:SIConditionLineCache = $cache }
|    $hit = $null
|    if ($cache.TryGetValue($Pattern, [ref]$hit)) { if ($hit -is [regex]) { return $hit }; return $null }
|    $rx = $null
|    if ($Pattern.IndexOfAny([char[]]@('?', '[', ']', '`', [char]1)) -lt 0) {
|        $sep = '\u0001'
|        # the texts are searched in lower case (Get-SIMatchTextList), so the pattern is lower case too and the search is exact
|        $parts = @($Pattern.ToLowerInvariant().Split('*') | Where-Object { $_ -ne '' } | ForEach-Object { [regex]::Escape($_) })
|        $text = ($parts -join ('[^' + $sep + ']*'))
|        if (-not $Pattern.StartsWith('*')) { $text = $sep + $text }
|        if (-not $Pattern.EndsWith('*')) { $text = $text + $sep }
|        try { $rx = New-Object System.Text.RegularExpressions.Regex($text, [System.Text.RegularExpressions.RegexOptions]::CultureInvariant, ([TimeSpan]::FromSeconds(2))) } catch { $rx = $null }
|    }
|    $cache[$Pattern] = $(if ($null -ne $rx) { $rx } else { $false })
|    return $rx
|}
|
|function Get-SIMatchTextList {
|    <#
|        The match texts of a LONG list value (16 values or more), made once per item and field: @{ Texts (every value's
|        Get-SIMatchTexts, in order); Joined (the texts in lower case joined with U+0001, one before and one after -- $null when a text
|        holds that character) }. $null for anything else (a scalar, a short list): the caller walks it as before.
|        Kept for the last value seen per field, recognised by the list object itself -- a rule set is evaluated item by
|        item, so every rule that reads the field of one item gets the same texts.
|    #>
|    param([string]$Field, $Actual)
|    if ($null -eq $Actual -or $Actual -is [string] -or $Actual -isnot [System.Collections.IList] -or $Actual -is [System.Collections.IDictionary]) { return $null }
|    $n = $Actual.Count
|    if ($n -lt 16) { return $null }
|    $cache = $script:SIConditionTextCache
|    if ($null -eq $cache) { $cache = @{}; $script:SIConditionTextCache = $cache }
|    $e = $cache[$Field]
|    if ($null -ne $e -and [object]::ReferenceEquals($e.Ref, $Actual) -and $e.Count -eq $n) { return $e }
|    $texts = New-Object System.Collections.Generic.List[string]
|    foreach ($v in $Actual) {
|        if ($null -eq $v) { continue }
|        if ($v -is [string]) { $texts.Add($v) } else { foreach ($s in (Get-SIMatchTexts $v)) { $texts.Add([string]$s) } }
|    }
|    $arr = $texts.ToArray()
|    $joined = $null
|    if ($arr.Length -gt 0) {
|        $sep = [string][char]1
|        $body = [string]::Join($sep, $arr)
|        # a text that holds the separator itself cannot be told apart: such a list is matched text by text
|        if ($body.Split([char]1).Length -eq $arr.Length) { $joined = ($sep + $body + $sep).ToLowerInvariant() }
|    }
|    $e = [pscustomobject]@{ Ref = $Actual; Count = $n; Texts = $arr; Joined = $joined }
|    $cache[$Field] = $e
|    return $e
|}
|
|function Get-SIConditionOps { return , @('eq', 'ne', 'in', 'not_in', 'is_true', 'is_false', 'is_empty', 'not_empty', 'gt', 'gte', 'lt', 'lte', 'like',
|        'contains', 'contains_any', 'matches', 'older_than_days', 'newer_than_days', 'in_ranges', 'in_list') }
|
|function Test-SICondition {
|    <#
|    .SYNOPSIS  Evaluates a condition (leaf or all/any group) against an item. Returns $true / $false.
|    #>
|    param([Parameter(Mandatory)]$Condition, $Item, [hashtable]$Context)
|    if ($null -eq $Condition) { return $true }
|    # (2026-10-16, the CI build of a large install: this runs some hundred times for every CI. A dictionary's group / leaf
|    # keys are read with its own Contains, an object's with its properties -- what Get-SIItemValue does, without a function
|    # call each time when the name is there as written. A dictionary has no 'all' / 'any' PROPERTY, so the group test is
|    # the one before.)
|    $isDict = $Condition -is [System.Collections.IDictionary]
|    if ($isDict) { $hasAll = $Condition.Contains('all'); $hasAny = $Condition.Contains('any') }
|    else { $hasAll = [bool]$Condition.PSObject.Properties['all']; $hasAny = [bool]$Condition.PSObject.Properties['any'] }
|    if ($hasAll) {
|        foreach ($c in (Get-SIValueList (Get-SIItemValue $Condition 'all'))) { if (-not (Test-SICondition -Condition $c -Item $Item -Context $Context)) { return $false } }
|        return $true
|    }
|    if ($hasAny) {
|        foreach ($c in (Get-SIValueList (Get-SIItemValue $Condition 'any'))) { if (Test-SICondition -Condition $c -Item $Item -Context $Context) { return $true } }
|        return $false
|    }
|
|    if ($isDict) {
|        if ($Condition.Contains('field')) { $field = [string]$Condition['field'] } else { $field = [string](Get-SIItemValue $Condition 'field') }
|        if ($Condition.Contains('op')) { $op = [string]$Condition['op'] } else { $op = [string](Get-SIItemValue $Condition 'op') }
|        if ($Condition.Contains('value')) { $expected = $Condition['value'] } else { $expected = Get-SIItemValue $Condition 'value' }
|    } else {
|        $pp = $Condition.PSObject.Properties['field']; if ($pp) { $field = [string]$pp.Value } else { $field = '' }
|        $pp = $Condition.PSObject.Properties['op']; if ($pp) { $op = [string]$pp.Value } else { $op = '' }
|        $pp = $Condition.PSObject.Properties['value']; if ($pp) { $expected = $pp.Value } else { $expected = $null }
|    }
|    if ([string]::IsNullOrEmpty($field)) { throw "condition without a field: $($Condition | ConvertTo-Json -Compress -Depth 5)" }
|    if ($Item -is [System.Collections.IDictionary] -and $Item.Contains($field)) { $actual = $Item[$field] } else { $actual = Get-SIItemValue $Item $field }
|
|    # TWO TEXTS ARE COMPARED IN PLACE (2026-10-16, the CI build of a large install): Test-SIScalarEqual compares two texts as
|    # trimmed and without case -- the same comparison is made here without a function call per value pair; every other pair
|    # (a number, a yes / no, an empty value) still goes through Test-SIScalarEqual. Same answers.
|    $ic = [StringComparison]::OrdinalIgnoreCase
|    switch ($op) {
|        'eq' {
|            foreach ($v in (Get-SIValueList $actual)) {
|                if ($v -is [string] -and $expected -is [string]) { if ([string]::Equals($v.Trim(), $expected.Trim(), $ic)) { return $true }; continue }
|                if (Test-SIScalarEqual $v $expected) { return $true }
|            }
|            return $false
|        }
|        'ne' {
|            foreach ($v in (Get-SIValueList $actual)) {
|                if ($v -is [string] -and $expected -is [string]) { if ([string]::Equals($v.Trim(), $expected.Trim(), $ic)) { return $false }; continue }
|                if (Test-SIScalarEqual $v $expected) { return $false }
|            }
|            return (-not (Test-SIValueEmpty $actual))
|        }
|        'in' {
|            $set = Resolve-SIListValues $expected $Context
|            foreach ($v in (Get-SIValueList $actual)) {
|                $vs = $null; if ($v -is [string]) { $vs = $v.Trim() }
|                foreach ($e in $set) {
|                    if ($null -ne $vs -and $e -is [string]) { if ([string]::Equals($vs, $e.Trim(), $ic)) { return $true }; continue }
|                    if (Test-SIScalarEqual $v $e) { return $true }
|                }
|            }
|            return $false
|        }
|        'not_in' {
|            if (Test-SIValueEmpty $actual) { return $false }
|            $set = Resolve-SIListValues $expected $Context
|            foreach ($v in (Get-SIValueList $actual)) {
|                $vs = $null; if ($v -is [string]) { $vs = $v.Trim() }
|                foreach ($e in $set) {
|                    if ($null -ne $vs -and $e -is [string]) { if ([string]::Equals($vs, $e.Trim(), $ic)) { return $false }; continue }
|                    if (Test-SIScalarEqual $v $e) { return $false }
|                }
|            }
|            return $true
|        }
|        'is_true' { return ((ConvertTo-SIBoolOrNull $actual) -eq $true) }
|        'is_false' { $b = ConvertTo-SIBoolOrNull $actual; return ($null -ne $b -and $b -eq $false) }
|        'is_empty' { return (Test-SIValueEmpty $actual) }
|        'not_empty' { return (-not (Test-SIValueEmpty $actual)) }
|        { $_ -in 'gt', 'gte', 'lt', 'lte' } {
|            $e = ConvertTo-SINumberOrNull $expected
|            if ($null -eq $e) { throw "condition '$field $op' needs a number, got '$expected'" }
|            foreach ($v in (Get-SIValueList $actual)) {
|                $n = ConvertTo-SINumberOrNull $v
|                if ($null -eq $n) { continue }
|                $ok = switch ($op) { 'gt' { $n -gt $e } 'gte' { $n -ge $e } 'lt' { $n -lt $e } 'lte' { $n -le $e } }
|                if ($ok) { return $true }
|            }
|            return $false
|        }
|        'contains' {
|            if ($actual -is [string]) { return ($actual.IndexOf([string]$expected, [StringComparison]::OrdinalIgnoreCase) -ge 0) }
|            foreach ($v in (Get-SIValueList $actual)) {
|                if (Test-SIScalarEqual $v $expected) { return $true }
|                $vn = Get-SIItemValue $v 'name'; $vv = Get-SIItemValue $v 'value'          # si_tags entries {source, name, value}
|                if ($null -ne $vn -and ((Test-SIScalarEqual $vn $expected) -or (Test-SIScalarEqual $vv $expected) -or (Test-SIScalarEqual ("{0}={1}" -f $vn, $vv) $expected))) { return $true }
|            }
|            return $false
|        }
|        'contains_any' {
|            $set = Resolve-SIListValues $expected $Context
|            foreach ($v in (Get-SIValueList $actual)) {
|                $vs = $null; if ($v -is [string]) { $vs = $v.Trim() }
|                foreach ($e in $set) {
|                    if ($null -ne $vs -and $e -is [string]) { if ([string]::Equals($vs, $e.Trim(), $ic)) { return $true }; continue }
|                    if (Test-SIScalarEqual $v $e) { return $true }
|                }
|            }
|            return $false
|        }
|        'matches' {
|            # bounded: a pathological pattern times out instead of hanging the run. value = one pattern or a list (any).
|            # A tag entry {source, name, value} is matched as "name=value", as its name and as its value.
|            # A pattern is built once and kept; a long list's match texts are made once per item (Get-SIMatchTextList).
|            $tl = Get-SIMatchTextList $field $actual
|            foreach ($pat in (Get-SIValueList $expected)) {
|                $rx = Get-SIConditionRegex ([string]$pat)
|                if ($null -ne $tl) { foreach ($s in $tl.Texts) { if ($rx.IsMatch($s)) { return $true } } }
|                else { foreach ($v in (Get-SIValueList $actual)) { foreach ($s in (Get-SIMatchTexts $v)) { if ($rx.IsMatch($s)) { return $true } } } }
|            }
|            return $false
|        }
|        'like' {
|            # PowerShell wildcards (* ? [ab]), case-insensitive; value = one pattern or a list (any). Tag entries as in matches.
|            # A pattern is built once and kept. A long list (a device's installed software) is matched ONCE per pattern: a
|            # wildcard of plain text and '*' by one search over the list's texts joined together, any other wildcard text
|            # by text -- never value by value through a function call (see the block above Get-SIConditionRegex).
|            $tl = Get-SIMatchTextList $field $actual
|            foreach ($pat in (Get-SIValueList $expected)) {
|                $p = [string]$pat
|                if ($null -ne $tl) {
|                    if ($tl.Texts.Length -eq 0) { continue }
|                    if ($null -ne $tl.Joined) {
|                        $line = Get-SIWildcardLineRegex $p
|                        if ($null -ne $line) {
|                            $found = $null
|                            try { $found = $line.IsMatch($tl.Joined) } catch { $found = $null }
|                            if ($found -eq $true) { return $true }
|                            if ($found -eq $false) { continue }
|                        }
|                    }
|                    $wc = Get-SIConditionWildcard $p
|                    foreach ($s in $tl.Texts) { if ($wc.IsMatch($s)) { return $true } }
|                    continue
|                }
|                $wc = Get-SIConditionWildcard $p
|                foreach ($v in (Get-SIValueList $actual)) { foreach ($s in (Get-SIMatchTexts $v)) { if ($wc.IsMatch($s)) { return $true } } }
|            }
|            return $false
|        }
|        { $_ -in 'older_than_days', 'newer_than_days' } {
|            $days = ConvertTo-SINumberOrNull $expected
|            if ($null -eq $days) { throw "condition '$field $op' needs a number of days, got '$expected'" }
|            $now = [datetime]::UtcNow
|            if ($Context -and $Context.Now) { $now = ([datetime]$Context.Now).ToUniversalTime() }
|            $t = ConvertTo-SIUtcOrNull $actual
|            if ($null -eq $t) { return $false }
|            $age = ($now - $t).TotalDays
|            if ($op -eq 'older_than_days') { return ($age -gt $days) }
|            return ($age -le $days)
|        }
|        'in_ranges' {
|            $ranges = Resolve-SIListValues $expected $Context
|            foreach ($ip in (Get-SIValueList $actual)) { foreach ($r in $ranges) { if (Test-SIIpInCidr ([string]$ip) ([string]$r)) { return $true } } }
|            return $false
|        }
|        'in_list' {
|            $id = [string]$expected
|            if (-not ($Context -and $Context.Lists -and $Context.Lists.ContainsKey($id))) { throw "condition '$field in_list $id': no such list" }
|            $l = $Context.Lists[$id]
|            $type = [string](Get-SIItemValue $l 'type')
|            if ($type -eq 'conditions') {
|                foreach ($entry in (Get-SIValueList (Get-SIItemValue $l 'entries'))) {
|                    $w = Get-SIItemValue $entry 'when'
|                    # an entry that needs a field the item does not carry is false (Get-SIConditionNullFalseField) -- not evaluated
|                    $rf = Get-SIConditionNullFalseField $w
|                    if ($rf -and $null -eq (Get-SIItemValue $Item $rf)) { continue }
|                    if (Test-SICondition -Condition $w -Item $Item -Context $Context) { return $true }
|                }
|                return $false
|            }
|            foreach ($v in (Get-SIValueList $actual)) { foreach ($e in (Get-SIValueList (Get-SIItemValue $l 'values'))) { if (Test-SIScalarEqual $v $e) { return $true } } }
|            return $false
|        }
|        default { throw "unknown condition operation '$op' (field '$field')" }
|    }
|}
|
|function Get-SIConditionNullFalseField {
|    <#
|        The field that makes a condition FALSE when the item does not carry it (no value at all), or '' when there is none:
|        a leaf -- or the FIRST condition of an 'all' group -- that compares the field (eq, ne, in, not_in, is_true, is_false,
|        not_empty, contains, contains_any, like, in_ranges; matches when its patterns are valid) answers false for no value,
|        and an 'all' stops at its first false. Such a condition need not be evaluated on an item without the field: the
|        answer is the same (2026-10-16: the unsupported_os list's 25 entries were evaluated on every identity). Kept per
|        condition object.
|    #>
|    param($Condition)
|    if ($null -eq $Condition -or $Condition -is [string] -or $Condition -is [ValueType]) { return '' }
|    $cache = $script:SIConditionNullFalseCache
|    if ($null -eq $cache) { $cache = New-Object 'System.Runtime.CompilerServices.ConditionalWeakTable[object,object]'; $script:SIConditionNullFalseCache = $cache }
|    $hit = $null
|    if ($cache.TryGetValue($Condition, [ref]$hit)) { return [string]$hit }
|    $leaf = $Condition
|    $isDict = $Condition -is [System.Collections.IDictionary]
|    if ($isDict) { $hasAll = $Condition.Contains('all'); $hasAny = $Condition.Contains('any') }
|    else { $hasAll = [bool]$Condition.PSObject.Properties['all']; $hasAny = [bool]$Condition.PSObject.Properties['any'] }
|    $field = ''
|    if ($hasAll) {
|        $kids = Get-SIValueList (Get-SIItemValue $Condition 'all')
|        $leaf = $null; if ($kids.Count -gt 0) { $leaf = $kids[0] }
|    } elseif ($hasAny) { $leaf = $null }
|    if ($null -ne $leaf -and $leaf -isnot [string] -and $leaf -isnot [ValueType]) {
|        $lAll = $false; $lAny = $false
|        if ($leaf -is [System.Collections.IDictionary]) { $lAll = $leaf.Contains('all'); $lAny = $leaf.Contains('any') } else { $lAll = [bool]$leaf.PSObject.Properties['all']; $lAny = [bool]$leaf.PSObject.Properties['any'] }
|        if (-not $lAll -and -not $lAny) {
|            $lf = [string](Get-SIItemValue $leaf 'field'); $op = [string](Get-SIItemValue $leaf 'op')
|            if ($lf -and $op -in 'eq', 'ne', 'in', 'not_in', 'is_true', 'is_false', 'not_empty', 'contains', 'contains_any', 'like', 'in_ranges') { $field = $lf }
|            elseif ($lf -and $op -eq 'matches') {
|                $ok = $true
|                try { foreach ($p in (Get-SIValueList (Get-SIItemValue $leaf 'value'))) { $null = Get-SIConditionRegex ([string]$p) } } catch { $ok = $false }
|                if ($ok) { $field = $lf }
|            }
|        }
|    }
|    try { $cache.Add($Condition, $field) } catch { }
|    return $field
|}
|
|function Test-SIConditionTri {
|    <#
|    .SYNOPSIS  #546 UNKNOWN IS NEVER A FINDING. A condition evaluated in THREE states: $true, $false, or $null = unknown.
|               A leaf is unknown when
|                 * its field is in -UnknownFields (the CI build could not decide the field: the provider that decides it for
|                   this identity's origin is not linked -- si_unknown_fields), or
|                 * it compares a date or a number (older_than_days, newer_than_days, gt, gte, lt, lte) and the value is empty:
|                   an age that was never read is not "older than 365 days".
|               Every other leaf is Test-SICondition (so an empty value in a population leaf -- in, eq -- stays false: the
|               item is simply not in the population). all: any false -> false, else any unknown -> unknown, else true.
|               any: any true -> true, else any unknown -> unknown, else false.
|               A caller counts a finding ONLY on $true; $null is counted as unknown.
|    #>
|    param([Parameter(Mandatory)]$Condition, $Item, [hashtable]$Context, [string[]]$UnknownFields = @())
|    if ($null -eq $Condition) { return $true }
|    # (the group test as in Test-SICondition: a dictionary's own Contains, an object's properties)
|    $isDict = $Condition -is [System.Collections.IDictionary]
|    if ($isDict) { $hasAll = $Condition.Contains('all'); $hasAny = $Condition.Contains('any') }
|    else { $hasAll = [bool]$Condition.PSObject.Properties['all']; $hasAny = [bool]$Condition.PSObject.Properties['any'] }
|    if ($hasAll) {
|        $unknown = $false
|        foreach ($c in (Get-SIValueList (Get-SIItemValue $Condition 'all'))) {
|            $r = Test-SIConditionTri -Condition $c -Item $Item -Context $Context -UnknownFields $UnknownFields
|            if ($r -eq $false) { return $false }
|            if ($null -eq $r) { $unknown = $true }
|        }
|        if ($unknown) { return $null }
|        return $true
|    }
|    if ($hasAny) {
|        $unknown = $false
|        foreach ($c in (Get-SIValueList (Get-SIItemValue $Condition 'any'))) {
|            $r = Test-SIConditionTri -Condition $c -Item $Item -Context $Context -UnknownFields $UnknownFields
|            if ($r -eq $true) { return $true }
|            if ($null -eq $r) { $unknown = $true }
|        }
|        if ($unknown) { return $null }
|        return $false
|    }
|    if ($isDict) {
|        if ($Condition.Contains('field')) { $field = [string]$Condition['field'] } else { $field = [string](Get-SIItemValue $Condition 'field') }
|        if ($Condition.Contains('op')) { $op = [string]$Condition['op'] } else { $op = [string](Get-SIItemValue $Condition 'op') }
|    } else {
|        $pp = $Condition.PSObject.Properties['field']; if ($pp) { $field = [string]$pp.Value } else { $field = '' }
|        $pp = $Condition.PSObject.Properties['op']; if ($pp) { $op = [string]$pp.Value } else { $op = '' }
|    }
|    foreach ($u in @($UnknownFields)) { if ($u -and [string]::Equals([string]$u, $field, [StringComparison]::OrdinalIgnoreCase)) { return $null } }
|    # A FIELD THE ITEM DOES NOT CARRY AT ALL (no value) is answered here, without a second evaluation (2026-10-16: most
|    # factor and classification leaves read a field the CI does not have) -- the answers Test-SICondition gives for $null:
|    # a comparison, a text or list test is false, is_empty is true, a date / number test is unknown (below). in_list,
|    # matches (an invalid pattern throws even on no value) and anything else are evaluated as before.
|    if ($field) {
|        if ($Item -is [System.Collections.IDictionary] -and $Item.Contains($field)) { $av = $Item[$field] } else { $av = Get-SIItemValue $Item $field }
|        if ($null -eq $av) {
|            if ($op -in 'eq', 'ne', 'in', 'not_in', 'is_true', 'is_false', 'not_empty', 'contains', 'contains_any', 'like', 'in_ranges') { return $false }
|            # matches: false too when its patterns are valid (an invalid one throws, as before)
|            if ($op -eq 'matches' -and (Get-SIConditionNullFalseField $Condition) -ceq $field) { return $false }
|            if ($op -eq 'is_empty') { return $true }
|            if ($op -in 'older_than_days', 'newer_than_days', 'gt', 'gte', 'lt', 'lte') { return $null }
|        }
|    }
|    if ($op -in 'older_than_days', 'newer_than_days', 'gt', 'gte', 'lt', 'lte') {
|        if (Test-SIValueEmpty (Get-SIItemValue $Item $field)) { return $null }
|    }
|    return [bool](Test-SICondition -Condition $Condition -Item $Item -Context $Context)
|}
|
|function Get-SIConditionFields {
|    <# Every field name a condition reads (for template validation). #>
|    param($Condition)
|    $out = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Condition) { return $out.ToArray() }
|    foreach ($k in 'all', 'any') {
|        $g = Get-SIItemValue $Condition $k
|        if ($null -ne $g -or (($Condition -is [System.Collections.IDictionary] -and $Condition.Contains($k)) -or $Condition.PSObject.Properties[$k])) {
|            foreach ($c in (Get-SIValueList $g)) { foreach ($f in (Get-SIConditionFields $c)) { $out.Add($f) } }
|            return $out.ToArray()
|        }
|    }
|    $f = [string](Get-SIItemValue $Condition 'field')
|    if ($f) { $out.Add($f) }
|    return $out.ToArray()
|}
'@ }
$__siSupportFiles['engine/data-model/SI-FieldMapper.ps1'] = @{ Sha256 = '7cbad047b4bd072006357b8336ea5133ae19e4cef1e73a743cf1539435398a80'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight field mapper -- turns one provider object into one SI RECORD, using the provider's field mapping
|    (data-model/mappings/<provider>.json), the shared value maps and the field catalog. V3-DATA-MODEL part 2, P1.
|
|    A mapping item:  { field, recordTypes[], sources[], normalize[], combine?, resourceTypes? }
|      sources    dot paths into the provider object, case-insensitive; "[*]" walks an array. Tried in order.
|      normalize  a chain from the CLOSED operation set below, applied to every value a source produced.
|      combine    first (default: the first source with a value) | max | min | any_true | union (all sources).
|      resourceTypes  the item applies only to records of these Azure resource types.
|    For one field, the first applicable mapping item that yields a value wins (more specific items come first).
|
|    THE OPERATION SET IS CLOSED (a template or a customer override cannot run code):
|      lower upper trim split:<sep> first require_contains:<text> ip mac cidr enum:<value-map> bool not equals:<value>
|      present int number count datetime_utc filetime_utc parse_json to_list tags:<source> select:<key>=<value>:<take>
|      base64_guid regex_extract:<pattern> host_from_url uac_enabled uac_flag:<n> dn_cn if_true:<value>
|    An unknown operation throws.
|
|    A source field that is missing is NOT an error: the SI field stays empty and the field is reported in .Missing, so
|    the collector can count "mapped field missing" per (provider, field) -- the signal Invardia's provider scan uses.
|
|    PowerShell 5.1: no ?. / ??, no ternary, no Set-StrictMode.
|#>
|
|. (Join-Path $PSScriptRoot 'SI-Conditions.ps1')
|
|function Get-SIFieldMapperOps {
|    return , @('lower', 'upper', 'trim', 'split', 'first', 'require_contains', 'ip', 'mac', 'cidr', 'enum', 'bool', 'not', 'equals',
|        'present', 'int', 'number', 'count', 'datetime_utc', 'filetime_utc', 'parse_json', 'to_list', 'tags', 'select',
|        'base64_guid', 'regex_extract', 'host_from_url', 'uac_enabled', 'uac_flag', 'dn_cn', 'if_true')
|}
|
|function Get-SIMapItemWhenAbsent {
|    <#
|        PURE. A mapping item's `whenAbsent` -- the value the field gets when the record carries the source OBJECT but none of
|        the item's paths has a value (si_publisher_verified: an SP without verifiedPublisher.verifiedPublisherId is NOT
|        verified, so false). Returns @{ Has; Value }.
|        Opt-in per item on purpose, not a change to `present`: present feeds si_fix_available too, and the zero-day factor
|        fires on si_fix_available false -- a generic "absent = false" would have marked every CVE without a named security
|        update (all third-party software) a zero-day.
|    #>
|    param($MapItem)
|    if ($null -eq $MapItem) { return @{ Has = $false; Value = $null } }
|    if ($MapItem -is [System.Collections.IDictionary]) {
|        if ($MapItem.Contains('whenAbsent')) { return @{ Has = $true; Value = $MapItem['whenAbsent'] } }
|        return @{ Has = $false; Value = $null }
|    }
|    $p = $MapItem.PSObject.Properties['whenAbsent']
|    if ($null -ne $p -and $null -ne $p.Value) { return @{ Has = $true; Value = $p.Value } }
|    return @{ Has = $false; Value = $null }
|}
|
|function Test-SISourceRootPresent {
|    <#
|        PURE. Is the OBJECT a source path starts in there (sp in "sp.verifiedPublisher.verifiedPublisherId")? Only then is a
|        missing rest of the path a real "absent" (whenAbsent applies). A one-segment path, or an object without that root,
|        says nothing: a record that never carried the object must not be told the value is absent.
|    #>
|    param($Object, [string]$Path)
|    if ($null -eq $Object -or [string]::IsNullOrEmpty($Path)) { return $false }
|    $i = $Path.IndexOf('.')
|    if ($i -le 0) { return $false }
|    $root = $Path.Substring(0, $i) -replace '\[\*\]$', ''
|    if ($Object -is [System.Collections.IDictionary]) {
|        foreach ($k in $Object.Keys) { if ([string]::Equals([string]$k, $root, [StringComparison]::OrdinalIgnoreCase)) { return ($null -ne $Object[$k]) } }
|        return $false
|    }
|    $p = $Object.PSObject.Properties[$root]
|    return ($null -ne $p -and $null -ne $p.Value)
|}
|
|function Resolve-SISourcePath {
|    <#
|    .SYNOPSIS  Every value at a dot path in an object (case-insensitive). "a.b[*].c" walks the array b. Returns a list.
|               Without [*] an array value is returned as ONE value (so count / select / tags can see the whole array).
|               A JSON string met on the way (e.g. an advanced-hunting dynamic column) is parsed and walked into.
|    #>
|    param($Object, [Parameter(Mandatory)][string]$Path)
|    $current = [System.Collections.Generic.List[object]]::new()
|    $current.Add($Object)
|    foreach ($segRaw in $Path.Split('.')) {
|        $walk = $segRaw.EndsWith('[*]')
|        $seg = $segRaw
|        if ($walk) { $seg = $segRaw.Substring(0, $segRaw.Length - 3) }
|        $next = [System.Collections.Generic.List[object]]::new()
|        foreach ($o in $current) {
|            if ($null -eq $o) { continue }
|            $node = $o
|            if ($node -is [string]) {
|                $t = $node.Trim()
|                if ($t.StartsWith('{') -or $t.StartsWith('[')) { try { $node = $t | ConvertFrom-Json } catch { continue } } else { continue }
|            }
|            # Get-SIItemValue, inline (the innermost call of every mapped field of every record -- #475)
|            $v = $null
|            if ([string]::IsNullOrEmpty($seg)) { continue }
|            if ($node -is [System.Collections.IDictionary]) {
|                if ($node.Contains($seg)) { $v = $node[$seg] }
|                else { foreach ($k in $node.Keys) { if ([string]::Equals([string]$k, $seg, [StringComparison]::OrdinalIgnoreCase)) { $v = $node[$k]; break } } }
|            } else {
|                $pp0 = $node.PSObject.Properties[$seg]
|                if ($pp0) { $v = $pp0.Value }
|            }
|            if ($null -eq $v) { continue }
|            if ($walk) {
|                if ($v -is [string]) {
|                    $t = $v.Trim()
|                    if ($t.StartsWith('[')) { try { $v = $t | ConvertFrom-Json } catch { } }
|                }
|                if ($v -is [System.Collections.IDictionary]) {
|                    # [*] over an object keyed by name (Shodan's vulns: { "CVE-...": {...} }) walks its values
|                    foreach ($x in $v.Values) { if ($null -ne $x) { $next.Add($x) } }
|                } elseif ($v -is [System.Collections.IEnumerable] -and -not ($v -is [string])) {
|                    foreach ($x in $v) { if ($null -ne $x) { $next.Add($x) } }
|                } elseif ($v -is [System.Management.Automation.PSCustomObject]) {
|                    foreach ($pp in $v.PSObject.Properties) { if ($null -ne $pp.Value) { $next.Add($pp.Value) } }
|                } else { $next.Add($v) }
|            } else { $next.Add($v) }
|        }
|        $current = $next
|    }
|    return , $current
|}
|
|function Get-SIValueMapResult {
|    <# Looks a value up in a value map: { "$match": exact|prefix|contains, "<key>": <value>, ..., "$default": ... }. #>
|    param($Map, $Value)
|    $mode = [string](Get-SIItemValue $Map '$match'); if (-not $mode) { $mode = 'exact' }
|    $s = ([string]$Value).Trim()
|    $keys = @()
|    if ($Map -is [System.Collections.IDictionary]) { $keys = @($Map.Keys) } else { $keys = @($Map.PSObject.Properties.Name) }
|    # longest key first, so "WindowsServer" wins over "Windows" in prefix / contains mode
|    foreach ($k in ($keys | Where-Object { -not ([string]$_).StartsWith('$') } | Sort-Object { ([string]$_).Length } -Descending)) {
|        $ks = [string]$k
|        $hit = $false
|        switch ($mode) {
|            'prefix' { $hit = $s.StartsWith($ks, [StringComparison]::OrdinalIgnoreCase) }
|            'contains' { $hit = ($s.IndexOf($ks, [StringComparison]::OrdinalIgnoreCase) -ge 0) }
|            default { $hit = [string]::Equals($s, $ks, [StringComparison]::OrdinalIgnoreCase) }
|        }
|        if ($hit) { return , @{ Found = $true; Value = (Get-SIItemValue $Map $ks) } }
|    }
|    $hasDefault = ($Map -is [System.Collections.IDictionary] -and $Map.Contains('$default')) -or ($Map.PSObject.Properties['$default'])
|    if ($hasDefault) {
|        $d = Get-SIItemValue $Map '$default'
|        if ([string]$d -eq '$self_lower') { return , @{ Found = $true; Value = $s.ToLowerInvariant() } }
|        return , @{ Found = $true; Value = $d }
|    }
|    return , @{ Found = $false; Value = $null }
|}
|
|function Invoke-SINormalizeOp {
|    <# One operation over a list of values -> a new list. #>
|    param([System.Collections.Generic.List[object]]$Values, [string]$Op, [string]$Arg, $ValueMaps)
|    $out = [System.Collections.Generic.List[object]]::new()
|    switch ($Op) {
|        'lower' { foreach ($v in $Values) { $out.Add(([string]$v).ToLowerInvariant()) } }
|        'upper' { foreach ($v in $Values) { $out.Add(([string]$v).ToUpperInvariant()) } }
|        'trim' { foreach ($v in $Values) { if ($v -is [string]) { $t = $v.Trim(); if ($t) { $out.Add($t) } } else { $out.Add($v) } } }
|        'split' { foreach ($v in $Values) { foreach ($p in ([string]$v).Split([string[]]@($Arg), [StringSplitOptions]::None)) { $out.Add($p) } } }
|        'first' { if ($Values.Count -gt 0) { $out.Add($Values[0]) } }
|        'require_contains' { foreach ($v in $Values) { if (([string]$v).Contains($Arg)) { $out.Add($v) } } }
|        'ip' {
|            foreach ($v in $Values) {
|                $a = $null
|                if ([System.Net.IPAddress]::TryParse(([string]$v).Trim(), [ref]$a)) { $out.Add($a.ToString().ToLowerInvariant()) }
|            }
|        }
|        'mac' {
|            foreach ($v in $Values) {
|                $hex = ([string]$v -replace '[^0-9A-Fa-f]', '').ToLowerInvariant()
|                if ($hex.Length -eq 12 -and $hex -ne '000000000000' -and $hex -ne 'ffffffffffff') {
|                    $out.Add((($hex -split '(..)' | Where-Object { $_ }) -join ':'))
|                }
|            }
|        }
|        'cidr' {
|            foreach ($v in $Values) {
|                $s = ([string]$v).Trim(); $parts = $s.Split('/')
|                $a = $null
|                if ([System.Net.IPAddress]::TryParse($parts[0], [ref]$a)) { $out.Add($s.ToLowerInvariant()) }
|                elseif ($s -in '*', 'Internet', 'Any') { $out.Add('0.0.0.0/0') }
|            }
|        }
|        'enum' {
|            $map = Get-SIItemValue $ValueMaps $Arg
|            if ($null -eq $map) { throw "normalize enum:${Arg}: no such value map" }
|            foreach ($v in $Values) {
|                $r = Get-SIValueMapResult -Map $map -Value $v
|                if ($r.Found -and $null -ne $r.Value) { $out.Add($r.Value) }
|            }
|        }
|        'bool' { foreach ($v in $Values) { $b = ConvertTo-SIBoolOrNull $v; if ($null -ne $b) { $out.Add($b) } } }
|        'not' { foreach ($v in $Values) { $b = ConvertTo-SIBoolOrNull $v; if ($null -ne $b) { $out.Add((-not $b)) } } }
|        'equals' { foreach ($v in $Values) { $out.Add((Test-SIScalarEqual $v $Arg)) } }
|        'present' { $out.Add(($Values.Count -gt 0 -and -not (Test-SIValueEmpty $Values[0]))) }
|        'int' { foreach ($v in $Values) { $n = ConvertTo-SINumberOrNull $v; if ($null -ne $n) { $out.Add([long][Math]::Truncate($n)) } } }
|        'number' { foreach ($v in $Values) { $n = ConvertTo-SINumberOrNull $v; if ($null -ne $n) { $out.Add([double]$n) } } }
|        'count' {
|            if ($Values.Count -eq 1 -and $Values[0] -is [System.Collections.IEnumerable] -and -not ($Values[0] -is [string])) {
|                $c = 0; foreach ($x in $Values[0]) { $c++ }; $out.Add([long]$c)
|            } else { $out.Add([long]$Values.Count) }
|        }
|        'datetime_utc' { foreach ($v in $Values) { $t = ConvertTo-SIUtcOrNull $v; if ($null -ne $t -and $t.Year -gt 1601) { $out.Add($t) } } }
|        'filetime_utc' {
|            foreach ($v in $Values) {
|                $n = ConvertTo-SINumberOrNull $v
|                if ($null -ne $n -and $n -gt 0 -and $n -lt 2650467743999999999) { $out.Add([datetime]::FromFileTimeUtc([long]$n)) }
|            }
|        }
|        'parse_json' {
|            # #690 (35) a text that is not JSON is the value itself: the identity profile writes a ONE-item list as the bare
|            # item ("Global Administrator", not ["Global Administrator"]) -- dropping it lost every identity with exactly one
|            # role, permission or group (internal 2026-10-15: 3 of 6 Global Administrators, 17 of 22 standing roles). A text
|            # that parses is taken parsed, as before; only a text that looks like JSON ([ { ") and does not parse is dropped.
|            foreach ($v in $Values) {
|                if ($v -is [string]) {
|                    $t = $v.Trim()
|                    if (-not $t) { continue }
|                    $parsed = $null; $ok = $false
|                    try { $parsed = ($t | ConvertFrom-Json); $ok = $true } catch { $ok = $false }
|                    if ($ok) { if ($null -ne $parsed) { $out.Add($parsed) } }
|                    elseif (-not ($t.StartsWith('[') -or $t.StartsWith('{') -or $t.StartsWith('"'))) { $out.Add($t) }
|                } else { $out.Add($v) }
|            }
|        }
|        'to_list' { foreach ($v in $Values) { $out.Add($v) } }
|        'tags' {
|            foreach ($v in $Values) {
|                $node = $v
|                if ($node -is [string] -and $node.Trim().StartsWith('{')) { try { $node = $node | ConvertFrom-Json } catch { } }
|                if ($node -is [string]) {
|                    $kv = $node.Split([char[]]@('=', ':'), 2)
|                    if ($kv.Count -eq 2) { $out.Add([ordered]@{ source = $Arg; name = $kv[0].Trim(); value = $kv[1].Trim() }) }
|                    elseif ($node.Trim()) { $out.Add([ordered]@{ source = $Arg; name = $node.Trim(); value = '' }) }
|                } elseif ($node -is [System.Collections.IDictionary]) {
|                    foreach ($k in $node.Keys) { if (-not (Test-SIValueEmpty $node[$k])) { $out.Add([ordered]@{ source = $Arg; name = [string]$k; value = [string]$node[$k] }) } }
|                } elseif ($null -ne $node) {
|                    foreach ($p in $node.PSObject.Properties) { if (-not (Test-SIValueEmpty $p.Value)) { $out.Add([ordered]@{ source = $Arg; name = $p.Name; value = [string]$p.Value }) } }
|                }
|            }
|        }
|        'select' {
|            # select:<key>=<value>:<take>  -- e.g. select:type=AadDeviceId:id over an EntityIds array
|            # <value> may name alternatives a|b: the values of the FIRST alternative come first (then 'first' picks it)
|            $m = [regex]::Match($Arg, '^(?<k>[^=]+)=(?<v>[^:]+):(?<t>.+)$')
|            if (-not $m.Success) { throw "normalize select:${Arg}: expected <key>=<value>:<take>" }
|            # 🔴 Exposure Graph's EntityIds is an array of JSON TEXT, one string per id
|            # (["{\"type\":\"DeviceInventoryId\",\"id\":\"...\"}"]): an element that is JSON text is read as its object. It was
|            # not, so no Exposure Graph device or resource record carried its Defender device id or resource id, the CI build
|            # never joined it with its Defender / Azure record, and the two groups collided on one CI id -- ring 1 2026-10-10:
|            # 211 of 218 device CIs without their Defender link, every CVE finding without its CI (tier, factors).
|            $toObj = { param($x) if ($x -is [string]) { $t = $x.Trim(); if ($t.StartsWith('[') -or $t.StartsWith('{')) { try { return ($t | ConvertFrom-Json) } catch { return $null } }; return $null }; $x }
|            $alts = @($m.Groups['v'].Value -split '\|' | ForEach-Object { $_.Trim() } | Where-Object { $_ })
|            $elems = New-Object System.Collections.Generic.List[object]
|            foreach ($v in $Values) {
|                # an array, or ONE object (select:<key>=<value>:<take> as a condition on an object, e.g. Exposure Graph rawData)
|                $arr = & $toObj $v
|                if ($null -eq $arr) { continue }
|                foreach ($e in (Get-SIValueList $arr)) { $o = & $toObj $e; if ($null -ne $o) { $elems.Add($o) } }
|            }
|            foreach ($alt in $alts) {
|                foreach ($e in $elems) {
|                    if (Test-SIScalarEqual (Get-SIItemValue $e $m.Groups['k'].Value) $alt) {
|                        $x = Get-SIItemValue $e $m.Groups['t'].Value
|                        if (-not (Test-SIValueEmpty $x)) { $out.Add($x) }
|                    }
|                }
|            }
|        }
|        'base64_guid' {
|            foreach ($v in $Values) {
|                try { $b = [Convert]::FromBase64String([string]$v); if ($b.Length -eq 16) { $out.Add((New-Object Guid (, $b)).ToString()) } } catch { }
|            }
|        }
|        'regex_extract' {
|            $rx = New-Object System.Text.RegularExpressions.Regex($Arg, [System.Text.RegularExpressions.RegexOptions]::IgnoreCase, ([TimeSpan]::FromMilliseconds(200)))
|            foreach ($v in $Values) {
|                $mm = $rx.Match([string]$v)
|                if ($mm.Success) { if ($mm.Groups.Count -gt 1) { $out.Add($mm.Groups[1].Value) } else { $out.Add($mm.Value) } }
|            }
|        }
|        'host_from_url' {
|            foreach ($v in $Values) {
|                $s = [string]$v; $u = $null
|                if ($s -match '^[a-z]+://' -and [Uri]::TryCreate($s, [UriKind]::Absolute, [ref]$u)) { $out.Add($u.Host.ToLowerInvariant()) } else { $out.Add($s.TrimEnd('/')) }
|            }
|        }
|        'if_true' { foreach ($v in $Values) { if ((ConvertTo-SIBoolOrNull $v) -eq $true) { $out.Add($Arg) } } }
|        'uac_enabled' { foreach ($v in $Values) { $n = ConvertTo-SINumberOrNull $v; if ($null -ne $n) { $out.Add((([long]$n -band 2) -eq 0)) } } }
|        # #546 one userAccountControl flag set (true) or clear (false), e.g. uac_flag:65536 = DONT_EXPIRE_PASSWORD; no value = nothing
|        'uac_flag' {
|            $bit = [long]0
|            if (-not [long]::TryParse([string]$Arg, [ref]$bit) -or $bit -le 0) { throw "uac_flag needs a positive flag value, got '$Arg'" }
|            foreach ($v in $Values) { $n = ConvertTo-SINumberOrNull $v; if ($null -ne $n) { $out.Add((([long]$n -band $bit) -ne 0)) } }
|        }
|        'dn_cn' { foreach ($v in $Values) { $mm = [regex]::Match([string]$v, '^CN=(?<cn>(\\,|[^,])+)', 'IgnoreCase'); if ($mm.Success) { $out.Add(($mm.Groups['cn'].Value -replace '\\,', ',')) } } }
|        default { throw "unknown normalize operation '$Op'" }
|    }
|    return , $out
|}
|
|function Invoke-SINormalize {
|    <# A normalisation chain ("op" or "op:arg" strings, split on the FIRST colon) over a list of values. #>
|    param([System.Collections.Generic.List[object]]$Values, [string[]]$Chain, $ValueMaps)
|    $cur = $Values
|    foreach ($step in @($Chain)) {
|        if ([string]::IsNullOrWhiteSpace($step)) { continue }
|        $i = $step.IndexOf(':')
|        $op = $step; $arg = ''
|        if ($i -ge 0) { $op = $step.Substring(0, $i); $arg = $step.Substring($i + 1) }
|        $cur = Invoke-SINormalizeOp -Values $cur -Op $op -Arg $arg -ValueMaps $ValueMaps
|        if ($cur.Count -eq 0 -and $op -ne 'present') { break }
|    }
|    return , $cur
|}
|
|function ConvertTo-SIFieldValue {
|    <# The final value of a field from the values its mapping produced, by the catalog type. #>
|    param([System.Collections.Generic.List[object]]$Values, [string]$Type)
|    if ($null -eq $Values -or $Values.Count -eq 0) { return $null }
|    switch ($Type) {
|        'dynamic' {
|            # de-duplicate scalars, keep objects as they are
|            $seen = [System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
|            $list = [System.Collections.Generic.List[object]]::new()
|            foreach ($v in $Values) {
|                if ($v -is [string] -or $v -is [ValueType]) { if ($seen.Add([string]$v)) { $list.Add($v) } }
|                elseif ($v -is [System.Collections.IDictionary]) {
|                    $k = (($v.Keys | Sort-Object | ForEach-Object { "$_=$($v[$_])" }) -join '|')
|                    if ($seen.Add($k)) { $list.Add($v) }
|                } elseif ($v -is [System.Collections.IEnumerable]) { foreach ($x in $v) { $list.Add($x) } }
|                else { $list.Add($v) }
|            }
|            return , $list.ToArray()
|        }
|        'bool' { return (ConvertTo-SIBoolOrNull $Values[0]) }
|        'int' { $n = ConvertTo-SINumberOrNull $Values[0]; if ($null -eq $n) { return $null }; return [long][Math]::Truncate($n) }
|        'real' { return (ConvertTo-SINumberOrNull $Values[0]) }
|        'datetime' { return (ConvertTo-SIUtcOrNull $Values[0]) }
|        default { $v = $Values[0]; if ($null -eq $v) { return $null }; return [string]$v }
|    }
|}
|
|function Get-SIMappingValues {
|    <# The normalised values of ONE mapping item for an object, honouring "combine". #>
|    param($MapItem, $Object, $ValueMaps)
|    $combine = [string](Get-SIItemValue $MapItem 'combine'); if (-not $combine) { $combine = 'first' }
|    $chain = @(Get-SIItemValue $MapItem 'normalize')
|    $all = [System.Collections.Generic.List[object]]::new()
|    $wa = Get-SIMapItemWhenAbsent $MapItem
|    $absent = $false
|    foreach ($src in @(Get-SIItemValue $MapItem 'sources')) {
|        $raw = Resolve-SISourcePath -Object $Object -Path ([string]$src)
|        if ($raw.Count -eq 0) {
|            if ($wa.Has -and (Test-SISourceRootPresent -Object $Object -Path ([string]$src))) { $absent = $true }
|            continue
|        }
|        $vals = Invoke-SINormalize -Values $raw -Chain $chain -ValueMaps $ValueMaps
|        $vals = @($vals | Where-Object { -not (Test-SIValueEmpty $_) -or $_ -is [bool] })
|        if ($vals.Count -eq 0) { continue }
|        if ($combine -eq 'first') { $l = [System.Collections.Generic.List[object]]::new(); foreach ($v in $vals) { $l.Add($v) }; return , $l }
|        foreach ($v in $vals) { $all.Add($v) }
|    }
|    if ($all.Count -eq 0 -and $absent) {
|        # the object is there, no path had a value: the item's whenAbsent (Get-SIMapItemWhenAbsent)
|        $all.Add($wa.Value)
|        if ($combine -eq 'first') { return , $all }
|    }
|    $res = [System.Collections.Generic.List[object]]::new()
|    if ($all.Count -eq 0) { return , $res }
|    switch ($combine) {
|        'max' {
|            $best = $null
|            foreach ($v in $all) {
|                if ($null -eq $best) { $best = $v; continue }
|                $a = $v; $b = $best
|                if ($v -is [datetime] -or $best -is [datetime]) { if ((ConvertTo-SIUtcOrNull $a) -gt (ConvertTo-SIUtcOrNull $b)) { $best = $v } }
|                elseif ((ConvertTo-SINumberOrNull $a) -gt (ConvertTo-SINumberOrNull $b)) { $best = $v }
|            }
|            $res.Add($best)
|        }
|        'min' {
|            $best = $null
|            foreach ($v in $all) {
|                if ($null -eq $best) { $best = $v; continue }
|                if ($v -is [datetime] -or $best -is [datetime]) { if ((ConvertTo-SIUtcOrNull $v) -lt (ConvertTo-SIUtcOrNull $best)) { $best = $v } }
|                elseif ((ConvertTo-SINumberOrNull $v) -lt (ConvertTo-SINumberOrNull $best)) { $best = $v }
|            }
|            $res.Add($best)
|        }
|        'any_true' {
|            $sawFalse = $false
|            foreach ($v in $all) { $b = ConvertTo-SIBoolOrNull $v; if ($b -eq $true) { $res.Add($true); return , $res }; if ($b -eq $false) { $sawFalse = $true } }
|            if ($sawFalse) { $res.Add($false) }
|        }
|        'union' { foreach ($v in $all) { $res.Add($v) } }
|        default { throw "unknown combine '$combine'" }
|    }
|    return , $res
|}
|
|function ConvertTo-SIRecord {
|    <#
|    .SYNOPSIS  One provider object -> one SI record (ordered dictionary of SI fields) + the fields whose sources were missing.
|    .OUTPUTS   @{ Record = [ordered]; Missing = [string[]] }
|    #>
|    param(
|        [Parameter(Mandatory)]$Object,
|        [Parameter(Mandatory)]$Mapping,        # one parsed mappings/<provider>.json (merged with overrides)
|        [Parameter(Mandatory)][string]$RecordType,
|        [Parameter(Mandatory)]$Catalog,        # parsed field catalog (merged)
|        [Parameter(Mandatory)]$ValueMaps,      # the "maps" object of value-maps.json (merged)
|        [string]$ResourceType,
|        [datetime]$CollectionTime = [datetime]::UtcNow,
|        [string]$RunId
|    )
|    $plan = Get-SIMapperPlan -Mapping $Mapping -RecordType $RecordType -ResourceType $ResourceType -Catalog $Catalog
|    $provider = $plan.Provider
|
|    $rec = [ordered]@{}
|    $keyVals = Resolve-SISourcePath -Object $Object -Path $plan.KeyPath
|    $nativeKey = $null; if ($keyVals.Count -gt 0) { $nativeKey = ([string]$keyVals[0]).ToLowerInvariant() }
|    $rec['si_provider'] = $provider
|    $rec['si_record_type'] = $RecordType
|    $rec['si_class'] = $plan.Class
|    $rec['si_record_key'] = if ($nativeKey) { "${provider}:$nativeKey" } else { $null }
|    $rec['si_collection_time'] = $CollectionTime.ToUniversalTime()
|    if ($RunId) { $rec['si_run_id'] = $RunId }
|    $tsPath = $plan.TsPath
|    $ts = $null
|    if ($tsPath -and $tsPath -ne '$collection_time') {
|        $tv = Resolve-SISourcePath -Object $Object -Path $tsPath
|        if ($tv.Count -gt 0) {
|            $tn = Invoke-SINormalize -Values $tv -Chain @('datetime_utc') -ValueMaps $ValueMaps
|            if ($tn.Count -eq 0 -and $provider -eq 'ad') { $tn = Invoke-SINormalize -Values $tv -Chain @('filetime_utc') -ValueMaps $ValueMaps }
|            if ($tn.Count -gt 0) { $ts = $tn[0] }
|        }
|    }
|    if ($null -eq $ts) { $ts = $CollectionTime.ToUniversalTime() }
|    $rec['si_source_last_seen'] = $ts
|
|    $done = [System.Collections.Generic.HashSet[string]]::new()
|    foreach ($it in $plan.Items) {
|        $field = $it.Field
|        if ($done.Contains($field)) { continue }
|        # the values of this item (Get-SIMappingValues, compiled: the item's settings were read once, no pipeline)
|        $vals = $null
|        $all = $null
|        $absent = $false
|        foreach ($src in $it.Sources) {
|            # Resolve-SISourcePath, inline for a path without [*]: at most ONE value; a JSON string met on the way (or a
|            # [*] path) takes the full resolver, which handles both
|            $raw = $null
|            if ($src.Simple) {
|                $node = $Object; $hit = $true
|                foreach ($seg in $src.Segs) {
|                    if ($null -eq $node) { $hit = $false; break }
|                    if ($node -is [string]) { $raw = Resolve-SISourcePath -Object $Object -Path $src.Path; break }
|                    $nx = $null
|                    if ([string]::IsNullOrEmpty($seg)) { $hit = $false; break }
|                    if ($node -is [System.Collections.IDictionary]) {
|                        if ($node.Contains($seg)) { $nx = $node[$seg] }
|                        else { foreach ($k in $node.Keys) { if ([string]::Equals([string]$k, $seg, [StringComparison]::OrdinalIgnoreCase)) { $nx = $node[$k]; break } } }
|                    } else {
|                        $pp1 = $node.PSObject.Properties[$seg]
|                        if ($pp1) { $nx = $pp1.Value }
|                    }
|                    if ($null -eq $nx) { $hit = $false; break }
|                    $node = $nx
|                }
|                if ($null -eq $raw) {
|                    $raw = [System.Collections.Generic.List[object]]::new()
|                    if ($hit) { $raw.Add($node) }
|                }
|            } else { $raw = Resolve-SISourcePath -Object $Object -Path $src.Path }
|            if ($raw.Count -eq 0) {
|                if ($it.WhenAbsent.Has -and (Test-SISourceRootPresent -Object $Object -Path $src.Path)) { $absent = $true }
|                continue
|            }
|            # Invoke-SINormalize, inline: lower / trim / upper here, every other operation by Invoke-SINormalizeOp
|            $nv = $raw
|            foreach ($st in $it.Steps) {
|                switch ($st.Op) {
|                    'lower' { $n2 = [System.Collections.Generic.List[object]]::new(); foreach ($y in $nv) { $n2.Add(([string]$y).ToLowerInvariant()) }; $nv = $n2 }
|                    'upper' { $n2 = [System.Collections.Generic.List[object]]::new(); foreach ($y in $nv) { $n2.Add(([string]$y).ToUpperInvariant()) }; $nv = $n2 }
|                    'trim' { $n2 = [System.Collections.Generic.List[object]]::new(); foreach ($y in $nv) { if ($y -is [string]) { $ty = $y.Trim(); if ($ty) { $n2.Add($ty) } } else { $n2.Add($y) } }; $nv = $n2 }
|                    default { $nv = Invoke-SINormalizeOp -Values $nv -Op $st.Op -Arg $st.Arg -ValueMaps $ValueMaps }
|                }
|                if ($nv.Count -eq 0 -and $st.Op -ne 'present') { break }
|            }
|            # Test-SIValueEmpty, inline (a bool is always kept)
|            $kept = [System.Collections.Generic.List[object]]::new()
|            foreach ($x in $nv) {
|                $empty = $false
|                if ($null -eq $x) { $empty = $true }
|                elseif ($x -is [string]) { $empty = [string]::IsNullOrWhiteSpace($x) }
|                elseif ($x -is [System.Collections.IDictionary]) { $empty = ($x.Count -eq 0) }
|                elseif ($x -is [System.Collections.IEnumerable]) { $empty = $true; foreach ($z in $x) { $empty = $false; break } }
|                if (-not $empty -or $x -is [bool]) { $kept.Add($x) }
|            }
|            if ($kept.Count -eq 0) { continue }
|            if ($it.Combine -eq 'first') { $vals = $kept; break }
|            if ($null -eq $all) { $all = [System.Collections.Generic.List[object]]::new() }
|            foreach ($x in $kept) { $all.Add($x) }
|        }
|        if ($absent -and $null -eq $vals -and ($null -eq $all -or $all.Count -eq 0)) {
|            # the object is there, no path had a value: the item's whenAbsent (Get-SIMapItemWhenAbsent)
|            $all = [System.Collections.Generic.List[object]]::new(); $all.Add($it.WhenAbsent.Value)
|            if ($it.Combine -eq 'first') { $vals = $all }
|        }
|        if ($null -eq $vals -and $it.Combine -ne 'first') { $vals = Get-SIMapperCombined -Values $all -Combine $it.Combine }
|        if ($null -eq $vals -or $vals.Count -eq 0) { continue }
|        # ConvertTo-SIFieldValue; its default branch (every type but dynamic / bool / int / real / datetime) inline
|        if ($it.PlainType) { $v = $vals[0]; if ($null -ne $v) { $v = [string]$v } }
|        else { $v = ConvertTo-SIFieldValue -Values $vals -Type $it.Type }
|        if ($null -eq $v) { continue }
|        if ($it.Union) {
|            # a union field ADDS up over every applicable item (several Exposure Graph flags -> one si_device_roles)
|            if ($rec.Contains($field)) {
|                $acc = [System.Collections.Generic.List[object]]::new()
|                foreach ($x in @($rec[$field])) { $acc.Add($x) }
|                foreach ($x in @($v)) { if (-not ($acc -contains $x)) { $acc.Add($x) } }
|                $rec[$field] = $acc.ToArray()
|            } else { $rec[$field] = $v }
|            continue
|        }
|        $rec[$field] = $v
|        [void]$done.Add($field)
|    }
|    $missing = [System.Collections.Generic.List[string]]::new()
|    foreach ($it in $plan.Items) {
|        $field = $it.Field
|        if ($done.Contains($field) -or $rec.Contains($field) -or $missing.Contains($field)) { continue }
|        $missing.Add($field)
|    }
|    return @{ Record = $rec; Missing = $missing.ToArray() }
|}
|
|function Get-SIMapperCombined {
|    <# The "combine" of a mapping item over every source's values (max / min / any_true / union) -- as Get-SIMappingValues. #>
|    param([System.Collections.Generic.List[object]]$Values, [string]$Combine)
|    $res = [System.Collections.Generic.List[object]]::new()
|    if ($null -eq $Values -or $Values.Count -eq 0) { return , $res }
|    switch ($Combine) {
|        'max' {
|            $best = $null
|            foreach ($v in $Values) {
|                if ($null -eq $best) { $best = $v; continue }
|                $a = $v; $b = $best
|                if ($v -is [datetime] -or $best -is [datetime]) { if ((ConvertTo-SIUtcOrNull $a) -gt (ConvertTo-SIUtcOrNull $b)) { $best = $v } }
|                elseif ((ConvertTo-SINumberOrNull $a) -gt (ConvertTo-SINumberOrNull $b)) { $best = $v }
|            }
|            $res.Add($best)
|        }
|        'min' {
|            $best = $null
|            foreach ($v in $Values) {
|                if ($null -eq $best) { $best = $v; continue }
|                if ($v -is [datetime] -or $best -is [datetime]) { if ((ConvertTo-SIUtcOrNull $v) -lt (ConvertTo-SIUtcOrNull $best)) { $best = $v } }
|                elseif ((ConvertTo-SINumberOrNull $v) -lt (ConvertTo-SINumberOrNull $best)) { $best = $v }
|            }
|            $res.Add($best)
|        }
|        'any_true' {
|            $sawFalse = $false
|            foreach ($v in $Values) { $b = ConvertTo-SIBoolOrNull $v; if ($b -eq $true) { $res.Add($true); return , $res }; if ($b -eq $false) { $sawFalse = $true } }
|            if ($sawFalse) { $res.Add($false) }
|        }
|        'union' { foreach ($v in $Values) { $res.Add($v) } }
|        default { throw "unknown combine '$Combine'" }
|    }
|    return , $res
|}
|
|$script:SIMapperPlans = @{}
|
|function Get-SIMapperPlan {
|    <#
|        The mapping of ONE (provider mapping, record type, resource type), read ONCE (#475): the object definition, the field
|        types from the catalog and the applicable mapping items in their order, each with its sources, normalisation chain,
|        combine and type. Every record of that kind reuses it -- before, every record re-read the whole catalog and walked
|        every mapping item twice through the generic accessors (measured: ~90% of the time of publishing a run's records).
|        Cached by the mapping and catalog OBJECTS (reference), so a changed or different mapping is never mistaken for one
|        already read.
|    #>
|    param([Parameter(Mandatory)]$Mapping, [Parameter(Mandatory)][string]$RecordType, [string]$ResourceType, [Parameter(Mandatory)]$Catalog)
|    $rt = ''; if ($ResourceType) { $rt = $ResourceType.ToLowerInvariant() }
|    $key = '{0}|{1}|{2}|{3}' -f [System.Runtime.CompilerServices.RuntimeHelpers]::GetHashCode($Mapping), [System.Runtime.CompilerServices.RuntimeHelpers]::GetHashCode($Catalog), $RecordType, $rt
|    $p = $script:SIMapperPlans[$key]
|    if ($p -and [object]::ReferenceEquals($p.Mapping, $Mapping) -and [object]::ReferenceEquals($p.Catalog, $Catalog)) { return $p }
|
|    $provider = [string](Get-SIItemValue $Mapping 'provider')
|    $objDef = $null
|    foreach ($o in @(Get-SIItemValue $Mapping 'objects')) { if ([string](Get-SIItemValue $o 'recordType') -eq $RecordType) { $objDef = $o; break } }
|    if ($null -eq $objDef) { throw "mapping '$provider' has no object for record type '$RecordType'" }
|    $types = @{}
|    foreach ($f in @(Get-SIItemValue $Catalog 'fields')) { $types[[string]$f.name] = [string]$f.type }
|    $items = [System.Collections.Generic.List[object]]::new()
|    foreach ($item in @(Get-SIItemValue $Mapping 'mappings')) {
|        if (@($item.recordTypes) -notcontains $RecordType) { continue }
|        $rts = @(Get-SIItemValue $item 'resourceTypes')
|        if ($rts.Count -gt 0 -and $rts[0]) { if (-not $rt -or $rts -notcontains $rt) { continue } }
|        $field = [string]$item.field
|        $combine = [string](Get-SIItemValue $item 'combine'); if (-not $combine) { $combine = 'first' }
|        $type = $types[$field]; if (-not $type) { $type = 'string' }
|        # the normalisation chain as steps (Invoke-SINormalize's parsing: blank steps skipped, "op:arg" split on the FIRST colon)
|        $steps = [System.Collections.Generic.List[object]]::new()
|        foreach ($c in @(Get-SIItemValue $item 'normalize')) {
|            $cs = [string]$c
|            if ([string]::IsNullOrWhiteSpace($cs)) { continue }
|            $ci = $cs.IndexOf(':'); $op = $cs; $arg = ''
|            if ($ci -ge 0) { $op = $cs.Substring(0, $ci); $arg = $cs.Substring($ci + 1) }
|            $steps.Add([pscustomobject]@{ Op = $op; Arg = $arg })
|        }
|        # each source path split once; "Simple" = no [*] (walked inline; a [*] path goes through Resolve-SISourcePath)
|        $srcs = [System.Collections.Generic.List[object]]::new()
|        foreach ($s in @(Get-SIItemValue $item 'sources')) {
|            $sp = [string]$s
|            $srcs.Add([pscustomobject]@{ Path = $sp; Segs = $sp.Split('.'); Simple = ($sp -ne '' -and $sp.IndexOf('[*]') -lt 0) })
|        }
|        $items.Add([pscustomobject]@{ Field = $field; Combine = $combine; Type = $type; Union = ($combine -eq 'union' -and $type -eq 'dynamic')
|                PlainType = ($type -notin @('dynamic', 'bool', 'int', 'real', 'datetime'))
|                WhenAbsent = (Get-SIMapItemWhenAbsent $item)
|                Steps = $steps.ToArray(); Sources = $srcs.ToArray() })
|    }
|    $p = [pscustomobject]@{ Mapping = $Mapping; Catalog = $Catalog; Provider = $provider; Class = [string](Get-SIItemValue $objDef 'class')
|        KeyPath = [string](Get-SIItemValue $objDef 'key'); TsPath = [string](Get-SIItemValue $objDef 'timestamp'); Items = $items.ToArray() }
|    if ($script:SIMapperPlans.Count -ge 500) { $script:SIMapperPlans.Clear() }
|    $script:SIMapperPlans[$key] = $p
|    $p
|}
'@ }
$__siSupportFiles['engine/data-model/SI-RiskFactorCatalog.ps1'] = @{ Sha256 = 'fd6d8e25c6aa48f14e796263e7f477f12a41a43287833431cd213a62eb2ebc49'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight RISK-FACTOR CATALOG -- factor groups with their provider links (#458, V3-DATA-MODEL 2.7).
|
|    One catalog of risk factors (data-model/risk-factors.locked.json). Every factor is defined ONCE over SI fields; what
|    this file adds is the link back to the providers that can PROVE it:
|
|      proof fields   the SI fields the factor's condition reads, minus the scoping fields (si_identity_type, si_class: they
|                     say WHICH assets the factor is about, not whether it holds), plus the fields a conditions-list it uses
|                     reads (unsupported_os reads si_os_name through its list)
|      providers      per provider (mde, eg, entra, azure, mdi, ad, intune, shodan, ...) the provider fields that fill each
|                     proof field -- read from the provider's field mapping (data-model/mappings), so a factor never names a
|                     provider field of its own and a provider rename is fixed once, in the mapping
|      network        an in_ranges condition is proven by a NETWORK RANGE list (internet_exposed_ranges: DMZ, online landing
|                     zones) -- customer data: Community lists.custom.json, Pro / either edition the setting
|                     SI_InternetExposedRanges (Merge-SIRiskFactorRanges)
|      computed       a field SecurityInsight computes on the CI (si_tier from the enrichment rules, the CMDB criticality level,
|                     privilege tiers, finding signals), named with what computes it (the field catalog's description)
|
|    The catalog STORES each factor's providers block (what a person and the Pro pages read); Test-SIRiskFactorProviders
|    proves the stored block equals what the mappings say, so the copy can never drift (SIv3-RiskFactorCatalog.Tests).
|    Update-SIRiskFactorProviders rewrites it after a mapping change.
|
|    PURE except Update-SIRiskFactorProviders (writes the catalog file). PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Get-SIConditionFields -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-Conditions.ps1') }
|
|$script:SIRiskFactorScopingFields = @('si_identity_type', 'si_class')
|
|function Get-SIRiskFactorConditionLeaves {
|    <# PURE. Every leaf condition (field / op / value) of a condition group. #>
|    param($Condition)
|    $out = New-Object System.Collections.Generic.List[object]
|    if ($null -eq $Condition) { return , $out }
|    # kept per condition object (2026-10-16: asked again for every factor of every CI); a copy is handed out
|    $cache = $script:SIRiskFactorLeavesCache
|    if ($null -eq $cache) { $cache = New-Object 'System.Runtime.CompilerServices.ConditionalWeakTable[object,object]'; $script:SIRiskFactorLeavesCache = $cache }
|    $hit = $null
|    if ($Condition -isnot [string] -and $Condition -isnot [ValueType] -and $cache.TryGetValue($Condition, [ref]$hit)) { foreach ($l in $hit) { $out.Add($l) }; return , $out }
|    $done = $false
|    foreach ($k in 'all', 'any') {
|        $hasK = ($Condition -is [System.Collections.IDictionary] -and $Condition.Contains($k)) -or ($Condition.PSObject.Properties[$k])
|        if ($hasK) { foreach ($c in (Get-SIValueList (Get-SIItemValue $Condition $k))) { foreach ($l in (Get-SIRiskFactorConditionLeaves $c)) { $out.Add($l) } }; $done = $true; break }
|    }
|    if (-not $done -and (Get-SIItemValue $Condition 'field')) { $out.Add($Condition) }
|    if ($Condition -isnot [string] -and $Condition -isnot [ValueType]) { try { $cache.Add($Condition, $out.ToArray()) } catch { } }
|    return , $out
|}
|
|function Get-SIRiskFactorProofFields {
|    <# PURE. The SI fields that prove a factor (see the header), in condition order, unique. #>
|    param([Parameter(Mandatory)]$Factor, [hashtable]$Lists = @{})
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($leaf in (Get-SIRiskFactorConditionLeaves $Factor.when)) {
|        $f = [string](Get-SIItemValue $leaf 'field'); $op = [string](Get-SIItemValue $leaf 'op'); $v = Get-SIItemValue $leaf 'value'
|        $fields = @($f)
|        if ($op -eq 'in_list' -and $v -is [string] -and $Lists.ContainsKey($v) -and [string](Get-SIItemValue $Lists[$v] 'type') -eq 'conditions') {
|            $fields = @()
|            foreach ($e in (Get-SIValueList (Get-SIItemValue $Lists[$v] 'entries'))) { foreach ($x in (Get-SIConditionFields (Get-SIItemValue $e 'when'))) { $fields += $x } }
|        }
|        foreach ($x in $fields) { if ($x -and $script:SIRiskFactorScopingFields -notcontains $x -and -not $out.Contains($x)) { $out.Add($x) } }
|    }
|    return , $out
|}
|
|function Get-SIRiskFactorProviderLinks {
|    <#
|    .SYNOPSIS  PURE. A factor's provider links from the data model: [ordered]@{ <provider> = @( @{ siField; sources; recordTypes } ) }
|               plus 'network' (in_ranges lists) and 'rules' (si_tier). Providers in name order, items in mapping order.
|    #>
|    param([Parameter(Mandatory)]$Factor, [Parameter(Mandatory)]$Model)
|    $lists = @{}; foreach ($l in @($Model['lists'].lists)) { if ($l) { $lists[[string]$l.id] = $l } }
|    $proof = Get-SIRiskFactorProofFields -Factor $Factor -Lists $lists
|    $out = [ordered]@{}
|    foreach ($prov in @($Model.Mappings.Keys | Sort-Object)) {
|        $items = New-Object System.Collections.Generic.List[object]
|        foreach ($m in @($Model.Mappings[$prov].mappings)) {
|            if ($null -eq $m -or -not $proof.Contains([string]$m.field)) { continue }
|            $items.Add([ordered]@{ siField = [string]$m.field; sources = @(@($m.sources) | ForEach-Object { [string]$_ }); recordTypes = @(@($m.recordTypes) | ForEach-Object { [string]$_ }) })
|        }
|        if ($items.Count -gt 0) { $out[[string]$prov] = $items.ToArray() }
|    }
|    $net = New-Object System.Collections.Generic.List[object]
|    foreach ($leaf in (Get-SIRiskFactorConditionLeaves $Factor.when)) {
|        if ([string](Get-SIItemValue $leaf 'op') -eq 'in_ranges') { $net.Add([ordered]@{ siField = [string]$leaf.field; list = [string]$leaf.value; setting = 'SI_InternetExposedRanges' }) }
|    }
|    if ($net.Count -gt 0) { $out['network'] = $net.ToArray() }
|    # fields SecurityInsight computes on the CI itself (tier from the rules, CMDB criticality level, privilege tiers,
|    # finding signals): named with what computes them, from the field catalog
|    $comp = New-Object System.Collections.Generic.List[object]
|    foreach ($pf in $proof) {
|        $fd = @($Model['field-catalog'].fields | Where-Object { $_ -and [string]$_.name -eq $pf })[0]
|        if ($fd -and [string]$fd.resolution.policy -eq 'computed') { $comp.Add([ordered]@{ siField = $pf; sources = @([string]$fd.description) }) }
|    }
|    if ($comp.Count -gt 0) { $out['computed'] = $comp.ToArray() }
|    return $out
|}
|
|function Test-SIRiskFactorProviders {
|    <#
|    .SYNOPSIS  PURE. Problems where a catalog factor's stored providers block differs from its derived provider links
|               (empty = in step). Only catalog-evaluated factors are checked; a factor without a providers block is a problem.
|    #>
|    param([Parameter(Mandatory)]$Model)
|    $p = New-Object System.Collections.Generic.List[string]
|    foreach ($f in @($Model['risk-factors'].factors)) {
|        if ($null -eq $f -or [string]$f.evaluatedBy -ne 'catalog') { continue }
|        $want = (Get-SIRiskFactorProviderLinks -Factor $f -Model $Model | ConvertTo-Json -Compress -Depth 8)
|        $haveObj = Get-SIItemValue $f 'providers'
|        if ($null -eq $haveObj) { $p.Add("risk-factors/$($f.id): no providers block"); continue }
|        $have = ($haveObj | ConvertTo-Json -Compress -Depth 8)
|        if ($have -ne $want) { $p.Add("risk-factors/$($f.id): the providers block is not what the mappings say -- run Update-SIRiskFactorProviders") }
|        $comb = [string](Get-SIItemValue $f 'combine')
|        $top = 'all'; if (($f.when -is [System.Collections.IDictionary] -and $f.when.Contains('any')) -or $f.when.PSObject.Properties['any']) { $top = 'any' }
|        if ($comb -ne $top) { $p.Add("risk-factors/$($f.id): combine '$comb' but its condition is '$top'") }
|        if (-not [string](Get-SIItemValue $f 'description')) { $p.Add("risk-factors/$($f.id): no description") }
|    }
|    return , $p
|}
|
|function Get-SIRiskFactorCiColumns {
|    <# PURE. The factors that get their own SI_CI_CL column (si_rf_<id>): catalog asset factors marked ciColumn. #>
|    param([Parameter(Mandatory)]$Factors)
|    # a loop, not a pipeline: it runs for every CI of the build
|    @(foreach ($f in @($Factors.factors)) { if ($f -and [string]$f.appliesTo -eq 'asset' -and [string]$f.evaluatedBy -eq 'catalog' -and (ConvertTo-SIBoolOrNull (Get-SIItemValue $f 'ciColumn')) -eq $true) { [string]$f.id } })
|}
|
|function Merge-SIRiskFactorRanges {
|    <#
|    .SYNOPSIS  PURE. The condition context's lists with the customer's network ranges added: SI_InternetExposedRanges (a Pro
|               database setting; Community may set it in its custom file, or fill lists.custom.json) is appended to the
|               internet_exposed_ranges list. A value that is not an IPv4 / IPv6 CIDR or address is left out.
|    #>
|    param([hashtable]$Lists = @{}, $Setting = $global:SI_InternetExposedRanges)
|    $extra = New-Object System.Collections.Generic.List[string]
|    foreach ($v in @($Setting)) {
|        foreach ($s in ([string]$v -split '[,;\s]+')) {
|            $t = $s.Trim(); if (-not $t) { continue }
|            $ip = $t; $bits = $null; $i = $t.IndexOf('/'); if ($i -gt 0) { $ip = $t.Substring(0, $i); $bits = $t.Substring($i + 1) }
|            $a = $null
|            if (-not [System.Net.IPAddress]::TryParse($ip, [ref]$a)) { continue }
|            if ($null -ne $bits) { $n = 0; if (-not [int]::TryParse($bits, [ref]$n) -or $n -lt 0 -or $n -gt 128) { continue } }
|            if (-not $extra.Contains($t)) { $extra.Add($t) }
|        }
|    }
|    if ($extra.Count -eq 0) { return $Lists }
|    $out = @{}; foreach ($k in $Lists.Keys) { $out[$k] = $Lists[$k] }
|    $vals = New-Object System.Collections.Generic.List[object]
|    if ($out.ContainsKey('internet_exposed_ranges')) { foreach ($x in (Get-SIValueList (Get-SIItemValue $out['internet_exposed_ranges'] 'values'))) { $vals.Add($x) } }
|    foreach ($x in $extra) { if (-not $vals.Contains($x)) { $vals.Add($x) } }
|    $out['internet_exposed_ranges'] = [pscustomobject]@{ id = 'internet_exposed_ranges'; type = 'ranges'; values = $vals.ToArray() }
|    return $out
|}
|
|function Update-SIRiskFactorProviders {
|    <#
|    .SYNOPSIS  Rewrites every catalog factor's providers block from the mappings (vendor tool, after a mapping change).
|               Each factor stays on its own lines; only the "providers" line is replaced or inserted.
|    #>
|    param([string]$Root)
|    . (Join-Path $PSScriptRoot 'SI-DataModelTemplates.ps1')
|    $Root = Get-SIDataModelRoot $Root
|    $model = Get-SIDataModel -Root $Root
|    $path = Join-Path $Root 'risk-factors.locked.json'
|    $text = [System.IO.File]::ReadAllText($path)
|    $nl = "`n"; if ($text.Contains("`r`n")) { $nl = "`r`n" }
|    foreach ($f in @($model['risk-factors'].factors)) {
|        if ([string]$f.evaluatedBy -ne 'catalog') { continue }
|        $json = (Get-SIRiskFactorProviderLinks -Factor $f -Model $model | ConvertTo-Json -Compress -Depth 8)
|        $line = '      "providers": ' + $json + ','
|        $idRx = '(?m)^(\s*\{ "id": "' + [regex]::Escape([string]$f.id) + '",[^\r\n]*\r?\n)'
|        $m = [regex]::Match($text, $idRx)
|        if (-not $m.Success) { throw "factor $($f.id): its first line was not found" }
|        $after = $text.Substring($m.Index + $m.Length)
|        $pm = [regex]::Match($after, '^      "providers": [^\r\n]*\r?\n')
|        if ($pm.Success) { $text = $text.Substring(0, $m.Index + $m.Length) + $line + $nl + $after.Substring($pm.Length) }
|        else { $text = $text.Substring(0, $m.Index + $m.Length) + $line + $nl + $after }
|    }
|    [System.IO.File]::WriteAllText($path, $text, (New-Object System.Text.UTF8Encoding($false)))
|}
|
|function Add-SICiRiskFactorEvidence {
|    <#
|    .SYNOPSIS  PURE. #464 -- the catalog's factors PER CI, with their evidence, after Invoke-SICiRiskFactors evaluated them:
|                 * every si_risk_factors entry gets 'evidence' (one item per provider that proves it: provider, SI field,
|                   the provider fields of its mapping, the record, stale) and 'by' (those providers)
|                 * de-duplicated across providers: ONE entry per factor, however many providers prove it
|                 * si_rf_<id> = true / false for every factor the catalog marks ciColumn, si_rf_count = the factors that
|                   count (production, impact > 0) -- the SI_CI_CL columns Risk Analysis can read without parsing JSON
|               Evidence comes from si_field_sources (the CI build's source of truth per field); for a risk boolean resolved
|               any-true it lists EVERY provider that said true (si_field_sources.<field>.providers). A computed field (si_tier)
|               names what computed it; an address in a network range names the range list.
|    #>
|    param([Parameter(Mandatory)]$Ci, [Parameter(Mandatory)]$Factors, [hashtable]$Lists = @{},
|          # read once for a set of CIs (New-SICiRiskFactorPlan): the factors by id and the factor columns; else read here
|          [hashtable]$ById, [AllowNull()][AllowEmptyCollection()][string[]]$CiColumns)
|    $byId = $ById
|    if ($null -eq $byId) { $byId = @{}; foreach ($f in @($Factors.factors)) { if ($f) { $byId[[string]$f.id] = $f } } }
|    $src = Get-SIItemValue $Ci 'si_field_sources'
|    $count = 0
|    $present = @{}
|    foreach ($e in @($Ci['si_risk_factors'])) {
|        if ($null -eq $e) { continue }
|        $id = [string](Get-SIItemValue $e 'id')
|        $f = $byId[$id]
|        $ev = New-Object System.Collections.Generic.List[object]
|        if ($f) {
|            $provBlock = Get-SIItemValue $f 'providers'
|            # an ANY factor: only the fields whose own condition holds are its evidence (an address outside every range
|            # proves nothing); fields read through a conditions list always count
|            $isAny = (($f.when -is [System.Collections.IDictionary] -and $f.when.Contains('any')) -or $f.when.PSObject.Properties['any'])
|            $holds = @{}; $leafFields = @{}
|            foreach ($leaf in (Get-SIRiskFactorConditionLeaves $f.when)) {
|                $lf = [string]$leaf.field; $leafFields[$lf] = $true
|                if ([string](Get-SIItemValue $leaf 'op') -eq 'in_list') { continue }
|                $ok = $false; try { $ok = Test-SICondition -Condition $leaf -Item $Ci -Context @{ Lists = $Lists } } catch { $ok = $false }
|                if ($ok) { $holds[$lf] = $true }
|            }
|            foreach ($field in (Get-SIRiskFactorProofFields -Factor $f -Lists $Lists)) {
|                if ($isAny -and $leafFields.ContainsKey($field) -and -not $holds.ContainsKey($field)) { continue }
|                $s = Get-SIItemValue $src $field
|                $val = Get-SIItemValue $Ci $field
|                if ($null -eq $s -and (Test-SIValueEmpty $val) -and -not ($val -is [bool])) { continue }
|                $provs = @()
|                if ($s) { $provs = (Get-SIValueList (Get-SIItemValue $s 'providers')).ToArray(); if ($provs.Count -eq 0 -and (Get-SIItemValue $s 'provider')) { $provs = @(([string](Get-SIItemValue $s 'provider')) -split ',' | Where-Object { $_ }) } }
|                if ($provs.Count -eq 0) {
|                    $why = ''; if ($field -eq 'si_tier') { $why = [string](Get-SIItemValue $Ci 'si_tier_reason') }
|                    $ev.Add([ordered]@{ provider = 'computed'; field = $field; reason = $why }); continue
|                }
|                foreach ($pv in $provs) {
|                    $pfs = @()
|                    if ($provBlock) { foreach ($it in (Get-SIValueList (Get-SIItemValue $provBlock ([string]$pv)))) { if ([string](Get-SIItemValue $it 'siField') -eq $field) { $pfs += (Get-SIValueList (Get-SIItemValue $it 'sources')).ToArray() } } }
|                    $rec = $null; if ($s -and [string](Get-SIItemValue $s 'provider') -eq [string]$pv) { $rec = Get-SIItemValue $s 'record' }
|                    # no observed_at: it moves every build and would make every CI "changed" (the build sends only changed CIs)
|                    $ev.Add([ordered]@{ provider = [string]$pv; field = $field; providerFields = @($pfs | Select-Object -Unique); record = $rec; stale = $(if ($s) { [bool](Get-SIItemValue $s 'stale') } else { $false }) })
|                }
|            }
|            foreach ($leaf in (Get-SIRiskFactorConditionLeaves $f.when)) {
|                if ([string](Get-SIItemValue $leaf 'op') -ne 'in_ranges') { continue }
|                $one = [ordered]@{ field = [string]$leaf.field; op = 'in_ranges'; value = $leaf.value }
|                $hit = $false; try { $hit = Test-SICondition -Condition $one -Item $Ci -Context @{ Lists = $Lists } } catch { $hit = $false }
|                if ($hit) { $ev.Add([ordered]@{ provider = 'network'; field = [string]$leaf.field; list = [string]$leaf.value }) }
|            }
|        }
|        if ($e -is [System.Collections.IDictionary]) { $e['evidence'] = $ev.ToArray(); $e['by'] = @($ev | ForEach-Object { $_.provider } | Select-Object -Unique) }
|        else { $e | Add-Member -NotePropertyName evidence -NotePropertyValue $ev.ToArray() -Force; $e | Add-Member -NotePropertyName by -NotePropertyValue @($ev | ForEach-Object { $_.provider } | Select-Object -Unique) -Force }
|        $imp = ConvertTo-SINumberOrNull (Get-SIItemValue $e 'impact')
|        if ($null -ne $imp -and $imp -gt 0) { $count++; $present[$id] = $true }
|    }
|    # #546 a factor the CI could not decide (si_rf_unknown) is NULL in its column -- unknown, never false, never true
|    $unk = @(foreach ($x in @(Get-SIItemValue $Ci 'si_rf_unknown')) { if ($x) { [string]$x } })
|    if ($null -eq $CiColumns) { $CiColumns = @(Get-SIRiskFactorCiColumns -Factors $Factors) }
|    foreach ($cid in $CiColumns) {
|        if ($unk -contains $cid -and -not $present.ContainsKey($cid)) { $Ci['si_rf_' + $cid] = $null } else { $Ci['si_rf_' + $cid] = [bool]$present.ContainsKey($cid) }
|    }
|    $Ci['si_rf_count'] = $count
|    return $Ci
|}
|function Add-SICiUnknownFactorCounts {
|    <# PURE. #546 -- adds each CI's undecided factors (si_rf_unknown) to -Counts (factor id -> CIs). Returns -Counts. #>
|    param([Parameter(Mandatory)][hashtable]$Counts, [AllowEmptyCollection()][object[]]$Cis = @())
|    foreach ($c in $Cis) {
|        if ($null -eq $c) { continue }
|        foreach ($id in @(Get-SIItemValue $c 'si_rf_unknown')) { if ($id) { $k = [string]$id; if ($Counts.ContainsKey($k)) { $Counts[$k]++ } else { $Counts[$k] = 1 } } }
|    }
|    return $Counts
|}
|
|function Format-SICiUnknownFactorLine {
|    <# PURE. #546 -- one plain run-log line: the factors the CIs could not decide (not counted as findings). '' when none. #>
|    param([hashtable]$Counts = @{})
|    if ($null -eq $Counts -or $Counts.Count -eq 0) { return '' }
|    $parts = @($Counts.Keys | Sort-Object | ForEach-Object { '{0} {1}' -f $_, $Counts[$_] })
|    return ('CIs: risk factors that could not be decided -- the value is unknown, so they are NOT findings (CIs per factor): {0}' -f ($parts -join ', '))
|}
|
|function Test-SIRiskFactorRules {
|    <#
|    .SYNOPSIS  PURE. #527 (5)-(7): the rules every risk factor (shipped or a customer's) must keep. Returns problems; empty = valid.
|                 * exactly ONE scope: appliesTo is 'asset' (the asset's exposure, hygiene, importance) or 'finding' (extra
|                   about the recommendation / vulnerability) -- never none, never both
|                 * NO TIER: a condition never reads si_tier (tier is its own dimension: the risk index's asset base, #559)
|                 * SI FIELDS ONLY: every field a condition reads (and every field of a conditions-list it uses) is an SI field
|                   (si_*), and no value is a raw provider path (node.NodeProperties.rawData..., identity.BlastRadius,
|                   ci.u_data_sensitivity) -- a renamed or new source field is a MAPPING change, never a factor change
|    #>
|    param([Parameter(Mandatory)]$Model)
|    $p = New-Object System.Collections.Generic.List[string]
|    $lists = @{}; foreach ($l in @($Model['lists'].lists)) { if ($l) { $lists[[string]$l.id] = $l } }
|    foreach ($f in @($Model['risk-factors'].factors)) { foreach ($x in (Test-SIRiskFactorItem -Factor $f -Lists $lists)) { $p.Add($x) } }
|    return , $p
|}
|
|# ================================================================================================================
|# #559 RISK FACTOR MODEL V2 -- every factor: shortName, name (description), appliesTo, group, class, impact 1-5, state
|# ================================================================================================================
|$script:SIRiskFactorGroups = @('Exposure', 'Device health', 'Identity', 'Privilege', 'Apps', 'Importance', 'Exploitability', 'Impact', 'Severity', 'Lifecycle')
|
|function Get-SIRiskFactorClass {
|    <# PURE. 'builtin' or 'optional'. A factor WITHOUT a class is treated as builtin -- the contract the web app is built
|       against (it reads a class-less factor as built-in), so the engine and the GUI never disagree; every shipped factor
|       carries its class explicitly, and a customer's own factor should say 'optional' to be switchable. #>
|    param($Factor)
|    if ([string](Get-SIItemValue $Factor 'class') -eq 'optional') { return 'optional' }
|    return 'builtin'
|}
|
|function Get-SIRiskFactorState {
|    <#
|    .SYNOPSIS  PURE. #559 the factor's state as the engine applies it: 'enabled' or 'disabled'.
|                 * a BUILT-IN factor is always enabled -- a stored 'disabled' is refused by the validation and the web app,
|                   and ignored here (the run-start check says so, Resolve-SIRiskFactorBuiltinState)
|                 * state 'disabled' -> disabled; no state: the pre-v2 stage decides (not_used / testing -> disabled, so an
|                   old customer override that switched a factor off stays off), else enabled
|    #>
|    param($Factor)
|    if ($null -eq $Factor) { return 'disabled' }
|    if ((Get-SIRiskFactorClass $Factor) -eq 'builtin') { return 'enabled' }
|    $st = ([string](Get-SIItemValue $Factor 'state')).Trim().ToLowerInvariant()
|    if ($st -eq 'disabled') { return 'disabled' }
|    if ($st -eq 'enabled') { return 'enabled' }
|    $stage = ([string](Get-SIItemValue $Factor 'stage')).Trim().ToLowerInvariant()
|    if ($stage -in 'not_used', 'testing') { return 'disabled' }
|    return 'enabled'
|}
|
|function Test-SIRiskFactorEnabled { param($Factor) return ((Get-SIRiskFactorState $Factor) -eq 'enabled') }
|
|function Get-SIRiskFactorSide {
|    <# PURE. #559 the side of the score a factor adds to: 'asset' (appliesTo asset) or 'vulnerability' (appliesTo finding). #>
|    param($Factor)
|    if ([string](Get-SIItemValue $Factor 'appliesTo') -eq 'finding') { return 'vulnerability' }
|    return 'asset'
|}
|
|function Get-SIRiskFactorImpact {
|    <# PURE. #559 what an ENABLED factor adds to its side: its impact, 1..5 (a value outside is held to the range; not a
|       number = 1). A disabled factor adds 0. #>
|    param($Factor)
|    if (-not (Test-SIRiskFactorEnabled $Factor)) { return 0 }
|    $n = ConvertTo-SINumberOrNull (Get-SIItemValue $Factor 'impact')
|    if ($null -eq $n) { return 1 }
|    if ($n -lt 1) { return 1 }
|    if ($n -gt 5) { return 5 }
|    return [int][Math]::Round($n)
|}
|
|function Get-SIRiskFactorShortName {
|    <# PURE. The name reports show: shortName, else the description (name), else the id. #>
|    param($Factor)
|    $s = ([string](Get-SIItemValue $Factor 'shortName')).Trim(); if ($s) { return $s }
|    $n = ([string](Get-SIItemValue $Factor 'name')).Trim(); if ($n) { return $n }
|    return [string](Get-SIItemValue $Factor 'id')
|}
|
|function Resolve-SIRiskFactorBuiltinState {
|    <#
|    .SYNOPSIS  PURE. #558 / #559 the run-start check: a built-in factor is never switched off. Returns @{ Factors (the
|               factors, a built-in one with state 'enabled' whatever was stored); Lines (one plain run-log line per built-in
|               factor a customer override tried to disable -- empty when none) }.
|    #>
|    param([AllowEmptyCollection()][object[]]$Factors = @())
|    $lines = New-Object System.Collections.Generic.List[string]
|    foreach ($f in $Factors) {
|        if ($null -eq $f -or (Get-SIRiskFactorClass $f) -ne 'builtin') { continue }
|        $st = ([string](Get-SIItemValue $f 'state')).Trim().ToLowerInvariant()
|        $stage = ([string](Get-SIItemValue $f 'stage')).Trim().ToLowerInvariant()
|        if ($st -eq 'disabled' -or ($st -eq '' -and $stage -in 'not_used', 'testing')) {
|            $lines.Add(("Risk factor {0} ({1}) is built-in and cannot be switched off -- it stays enabled. Lower its impact instead." -f (Get-SIRiskFactorShortName $f), [string]$f.id))
|            if ($f -is [System.Collections.IDictionary]) { $f['state'] = 'enabled' } else { $f | Add-Member -NotePropertyName state -NotePropertyValue 'enabled' -Force }
|        }
|    }
|    return @{ Factors = $Factors; Lines = $lines.ToArray() }
|}
|
|function Get-SIRiskFactorLegend {
|    <#
|    .SYNOPSIS  PURE. #558 / #559 the "Risk factors" legend every Excel export (a sheet) and every PDF (an appendix) carries:
|               one row per factor -- ShortName, Description, AppliesTo ("Asset" / "Vulnerability"), Impact, Class, Group,
|               State, Id -- asset factors first, then vulnerability factors, each by group then short name. Disabled factors
|               are listed (State says so, Impact 0) unless -EnabledOnly.
|    #>
|    param([AllowEmptyCollection()][object[]]$Factors = @(), [switch]$EnabledOnly)
|    $rows = New-Object System.Collections.Generic.List[object]
|    foreach ($f in $Factors) {
|        if ($null -eq $f -or -not (Get-SIItemValue $f 'id')) { continue }
|        $en = Test-SIRiskFactorEnabled $f
|        if ($EnabledOnly -and -not $en) { continue }
|        $side = Get-SIRiskFactorSide $f
|        $desc = ([string](Get-SIItemValue $f 'name')).Trim(); if (-not $desc) { $desc = ([string](Get-SIItemValue $f 'description')).Trim() }
|        $rows.Add([pscustomobject][ordered]@{
|                ShortName   = (Get-SIRiskFactorShortName $f)
|                Description = $desc
|                AppliesTo   = $(if ($side -eq 'vulnerability') { 'Vulnerability' } else { 'Asset' })
|                Impact      = (Get-SIRiskFactorImpact $f)
|                Class       = $(if ((Get-SIRiskFactorClass $f) -eq 'builtin') { 'Built-in' } else { 'Optional' })
|                Group       = [string](Get-SIItemValue $f 'group')
|                State       = $(if ($en) { 'Enabled' } else { 'Disabled' })
|                Id          = [string](Get-SIItemValue $f 'id')
|            })
|    }
|    $gIdx = @{}; for ($i = 0; $i -lt $script:SIRiskFactorGroups.Count; $i++) { $gIdx[$script:SIRiskFactorGroups[$i]] = $i }
|    $sorted = @($rows | Sort-Object -Property @{ Expression = { if ($_.AppliesTo -eq 'Asset') { 0 } else { 1 } } }, @{ Expression = { if ($gIdx.ContainsKey($_.Group)) { $gIdx[$_.Group] } else { 99 } } }, ShortName)
|    return , $sorted
|}
|
|function Test-SIRiskFactorModelV2 {
|    <#
|    .SYNOPSIS  PURE. #559 the v2 fields of ONE factor. Returns problems; empty = valid.
|                 shortName  PascalCase letters and digits, at most 24 characters, no editable number: a factor whose criteria
|                            carry a threshold (days, a count) has no digit in its short name (EnabledNoSignInStale, not
|                            NoSignIn90d); a fixed fact may (CVSS9Plus)
|                 name       the description the GUI shows (not empty)
|                 group      one of the ten groups
|                 class      builtin | optional (a customer's own factor may leave it out: optional)
|                 impact     a whole number 1..5
|                 state      enabled | disabled; a builtin factor is never disabled
|    #>
|    param($Factor)
|    $p = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Factor) { return $p.ToArray() }
|    $id = [string](Get-SIItemValue $Factor 'id')
|    $sn = [string](Get-SIItemValue $Factor 'shortName')
|    if ($sn -cnotmatch '^[A-Z][A-Za-z0-9]{1,23}$') { $p.Add("risk-factors/${id}: shortName '$sn' must be PascalCase letters / digits, 2..24 characters (e.g. InternetExposed)") }
|    else {
|        $cr = Get-SIItemValue $Factor 'criteria'
|        if ($cr -and @('threshold', 'range') -contains [string](Get-SIItemValue $cr 'kind') -and $sn -match '\d') { $p.Add("risk-factors/${id}: shortName '$sn' carries a number but the factor's number is editable (criteria) -- name what it means, not the number") }
|    }
|    if (-not ([string](Get-SIItemValue $Factor 'name')).Trim()) { $p.Add("risk-factors/${id}: no name (the description the GUI shows)") }
|    $g = [string](Get-SIItemValue $Factor 'group')
|    if ($script:SIRiskFactorGroups -cnotcontains $g) { $p.Add("risk-factors/${id}: group '$g' ($($script:SIRiskFactorGroups -join ', '))") }
|    $cl = Get-SIItemValue $Factor 'class'
|    if ($null -ne $cl -and @('builtin', 'optional') -cnotcontains [string]$cl) { $p.Add("risk-factors/${id}: class '$cl' (builtin | optional)") }
|    $imp = ConvertTo-SINumberOrNull (Get-SIItemValue $Factor 'impact')
|    if ($null -eq $imp -or $imp -lt 1 -or $imp -gt 5 -or $imp -ne [Math]::Floor($imp)) { $p.Add("risk-factors/${id}: impact '$(Get-SIItemValue $Factor 'impact')' must be a whole number 1..5 (very low .. very high)") }
|    $st = [string](Get-SIItemValue $Factor 'state')
|    if ($st -and @('enabled', 'disabled') -cnotcontains $st) { $p.Add("risk-factors/${id}: state '$st' (enabled | disabled)") }
|    if ((Get-SIRiskFactorClass $Factor) -eq 'builtin' -and $st -eq 'disabled') { $p.Add("risk-factors/${id}: a built-in factor cannot be disabled -- lower its impact instead (a factor without a class is built-in)") }
|    return $p.ToArray()
|}
|
|# ================================================================================================================
|# #559 break glass naming patterns -- the data-model list break_glass_patterns (type values): glob patterns (* ?) over
|# letters, digits, space and . _ @ -; a pattern of wildcards only is refused (it would make everyone break-glass).
|# The web app validates the same rule (the contract both sides are built against).
|# ================================================================================================================
|function Test-SIBreakGlassPattern {
|    <# PURE. Problems with ONE break-glass glob pattern; empty = valid. #>
|    param([AllowNull()][AllowEmptyString()][string]$Pattern)
|    $p = New-Object System.Collections.Generic.List[string]
|    $s = [string]$Pattern
|    if ($s -cnotmatch '^[A-Za-z0-9 ._@*?-]{1,128}$') { $p.Add("lists/break_glass_patterns: '$s' -- a pattern is letters, digits, space, . _ @ - and the wildcards * ?, at most 128 characters") }
|    elseif ($s -match '^[\s*?]+$') { $p.Add("lists/break_glass_patterns: '$s' is wildcards only -- it would make every identity break-glass") }
|    return $p.ToArray()
|}
|
|function Test-SIRiskRatingBands {
|    <# PURE. The risk_rating_bands list of a model: type values, exactly three whole numbers > 0, strictly descending
|       (Critical, High, Moderate thresholds). Empty = valid (no list: the engine's built-in 50 / 30 / 15). #>
|    param([Parameter(Mandatory)]$Model)
|    $p = New-Object System.Collections.Generic.List[string]
|    $l = @(@($Model['lists'].lists) | Where-Object { $_ -and [string]$_.id -eq 'risk_rating_bands' })
|    if ($l.Count -eq 0) { return $p.ToArray() }
|    if ([string]$l[0].type -ne 'values') { $p.Add("lists/risk_rating_bands: type '$($l[0].type)' -- it is a values list of three numbers") }
|    $v = @(@(Get-SIItemValue $l[0] 'values') | ForEach-Object { ConvertTo-SINumberOrNull $_ })
|    $ok = ($v.Count -eq 3) -and (@($v | Where-Object { $null -eq $_ -or $_ -le 0 -or $_ -ne [Math]::Floor($_) }).Count -eq 0)
|    if ($ok) { $ok = ($v[0] -gt $v[1]) -and ($v[1] -gt $v[2]) }
|    if (-not $ok) { $p.Add("lists/risk_rating_bands: the values must be three whole numbers above 0, highest first (Critical, High, Moderate) -- has: $(ConvertTo-Json -InputObject @(Get-SIItemValue $l[0] 'values') -Compress)") }
|    return $p.ToArray()
|}
|
|function Test-SIBreakGlassPatterns {
|    <# PURE. The break_glass_patterns list of a model: type values, every value a valid pattern. Empty = valid (no list too). #>
|    param([Parameter(Mandatory)]$Model)
|    $p = New-Object System.Collections.Generic.List[string]
|    $l = @(@($Model['lists'].lists) | Where-Object { $_ -and [string]$_.id -eq 'break_glass_patterns' })
|    if ($l.Count -eq 0) { return $p.ToArray() }
|    if ([string]$l[0].type -ne 'values') { $p.Add("lists/break_glass_patterns: type '$($l[0].type)' -- it is a values list of glob patterns") }
|    foreach ($v in @(Get-SIItemValue $l[0] 'values')) { foreach ($x in (Test-SIBreakGlassPattern -Pattern ([string]$v))) { $p.Add($x) } }
|    return $p.ToArray()
|}
|
|function Test-SIRiskFactorItem {
|    <# PURE. Test-SIRiskFactorRules for ONE factor (a Pro cfg.ItemOverride 'risk-factors:<id>' is checked with it on write). #>
|    param($Factor, [hashtable]$Lists = @{})
|    $p = New-Object System.Collections.Generic.List[string]
|    $rawRx = '^(?i)(node|identity|ci|machine|deviceInfo|resource|derived|user|sp|app|registration|signIn|computer|device|host|exposure|roles|azureRoles|record|properties|rawData)(\[\*\])?(\.[A-Za-z0-9_$@-]+(\[\*\])?)+$'
|    $lists = $Lists
|    foreach ($f in @($Factor)) {
|        if ($null -eq $f) { continue }
|        $id = [string]$f.id
|        $scope = Get-SIItemValue $f 'appliesTo'
|        if ($null -eq $scope -or ($scope -is [System.Collections.IEnumerable] -and $scope -isnot [string]) -or @('asset', 'finding') -notcontains [string]$scope) {
|            $p.Add("risk-factors/${id}: must have exactly one scope -- appliesTo 'asset' or 'finding' (has: $(ConvertTo-Json -InputObject $scope -Compress))")
|        }
|        foreach ($x in (Test-SIRiskFactorModelV2 -Factor $f)) { $p.Add($x) }
|        foreach ($x in (Test-SIRiskFactorCriteria -Factor $f -Lists $lists)) { $p.Add($x) }
|        if ([string]$f.evaluatedBy -eq 'report') { continue }
|        foreach ($leaf in (Get-SIRiskFactorConditionLeaves $f.when)) {
|            $fields = @([string]$leaf.field)
|            $op = [string](Get-SIItemValue $leaf 'op'); $v = Get-SIItemValue $leaf 'value'
|            if ($op -eq 'in_list' -and $v -is [string] -and $lists.ContainsKey($v)) { foreach ($e in (Get-SIValueList (Get-SIItemValue $lists[$v] 'entries'))) { foreach ($x in (Get-SIConditionFields (Get-SIItemValue $e 'when'))) { $fields += [string]$x } } }
|            foreach ($fn in $fields) {
|                if ($fn -eq 'si_tier') { $p.Add("risk-factors/${id}: reads si_tier -- a risk factor never restates tier (tier counts once: the risk index's asset base)") }
|                elseif ($fn -notmatch '^si_[a-z0-9_]+$') { $p.Add("risk-factors/${id}: reads '$fn' -- a factor reads SI fields (si_*) only; a source field belongs in its provider mapping") }
|            }
|            foreach ($x in (Get-SIValueList $v)) { if ($x -is [string] -and $x -match $rawRx) { $p.Add("risk-factors/${id}: value '$x' is a raw source path -- it belongs in a provider mapping") } }
|        }
|    }
|    return , $p
|}
|
|function Test-SIRiskFactorCriteria {
|    <#
|    .SYNOPSIS  PURE. A factor's criteria block -- the part a customer changes through the web app's wizard, never as free
|               text (#541 (7)). Returns problems; empty = valid (also for a factor without criteria).
|                 criteria: { kind: list | threshold | range, field: si_*, source: collected | enum | lifecycle, ... }
|                   list       list = the id of a lists.locked.json list the factor's condition reads (in_list / in_ranges /
|                              contains_any); optional detailField (si_*) the wizard narrows an entry with
|                   threshold  op + min / max (numbers, min <= max): the factor's condition has a leaf on field with that op
|                              whose value is a number inside [min, max]
|                   range      min / max (numbers, min <= max) on field
|    #>
|    param($Factor, [hashtable]$Lists = @{})
|    $p = New-Object System.Collections.Generic.List[string]
|    $cr = Get-SIItemValue $Factor 'criteria'
|    if ($null -eq $cr) { return , $p }
|    $id = [string]$Factor.id
|    $kind = [string](Get-SIItemValue $cr 'kind'); $field = [string](Get-SIItemValue $cr 'field'); $src = [string](Get-SIItemValue $cr 'source')
|    if (@('list', 'threshold', 'range') -notcontains $kind) { $p.Add("risk-factors/${id}: criteria kind '$kind' (list, threshold or range)") }
|    if ($field -notmatch '^si_[a-z0-9_]+$' -or $field -eq 'si_tier') { $p.Add("risk-factors/${id}: criteria field '$field' must be an SI field (si_*), never si_tier") }
|    if (@('collected', 'enum', 'lifecycle') -notcontains $src) { $p.Add("risk-factors/${id}: criteria source '$src' (collected, enum or lifecycle)") }
|    $leaves = (Get-SIRiskFactorConditionLeaves $Factor.when).ToArray()
|    switch ($kind) {
|        'list' {
|            $lid = [string](Get-SIItemValue $cr 'list')
|            if (-not $lid -or ($Lists.Count -gt 0 -and -not $Lists.ContainsKey($lid))) { $p.Add("risk-factors/${id}: criteria list '$lid' is not a list") }
|            if (-not @($leaves | Where-Object { [string]$_.value -eq $lid -and @('in_list', 'in_ranges', 'contains_any') -contains [string]$_.op }).Count) { $p.Add("risk-factors/${id}: its condition does not read the criteria list '$lid'") }
|            $df = [string](Get-SIItemValue $cr 'detailField')
|            if ($df -and ($df -notmatch '^si_[a-z0-9_]+$' -or $df -eq 'si_tier')) { $p.Add("risk-factors/${id}: criteria detailField '$df' must be an SI field") }
|        }
|        { $_ -in 'threshold', 'range' } {
|            $min = ConvertTo-SINumberOrNull (Get-SIItemValue $cr 'min'); $max = ConvertTo-SINumberOrNull (Get-SIItemValue $cr 'max')
|            if ($null -eq $min -or $null -eq $max -or $min -gt $max) { $p.Add("risk-factors/${id}: criteria min / max must be numbers, min <= max") }
|            elseif ($kind -eq 'threshold') {
|                $op = [string](Get-SIItemValue $cr 'op')
|                $leaf = @($leaves | Where-Object { [string]$_.field -eq $field -and [string]$_.op -eq $op })
|                if ($leaf.Count -eq 0) { $p.Add("risk-factors/${id}: its condition has no '$field $op' leaf for the criteria") }
|                foreach ($l in $leaf) {
|                    $v = ConvertTo-SINumberOrNull $l.value
|                    if ($null -eq $v -or $v -lt $min -or $v -gt $max) { $p.Add("risk-factors/${id}: '$field $op $($l.value)' is outside the criteria range $min..$max") }
|                }
|            }
|        }
|    }
|    return , $p
|}
'@ }
$__siSupportFiles['engine/data-model/SI-Classification.ps1'] = @{ Sha256 = '64a9f79c67a8972bc419a5b1416c3e16aec7770f40a51b9900b8f41f5c9be169'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- ONE GENERIC CLASSIFICATION MECHANISM (REQUIREMENTS #561 dimensions, #562 asset type / subtype).
|
|    Every classification SI assigns from what the sources say -- the asset type, the asset subtype, the component of a
|    finding and the components of an asset, and every dimension that comes later -- is the SAME thing: rows of
|        source + field + match (equals | in | prefix | pattern) -> target SI field = set, with a priority
|    evaluated with the SAME condition engine the risk factors use (SI-Conditions.ps1, tri-state Test-SIConditionTri: a
|    field the CI could not decide is unknown and never matches). No code per dimension, no code per source.
|
|    TEMPLATES (the contract the web app's classification wizard is built against)
|      data-model/dimensions.locked.json      kind 'dimension', items 'dimensions', Pro key 'dimensions:<id>':
|                                             { id, name, values[] } -- ONLY the closed list of values
|      data-model/classification.locked.json  kind 'classification', items 'rules', Pro key 'classification:<row id>':
|                                             { id,
|                                               source    the provider whose naming the row normalises (documentation),
|                                               field     an SI field (si_*) or a source path (a dot path into the item),
|                                               match     equals | in      -> values  (a list)
|                                                         prefix | pattern -> pattern (a glob: * ? [..]; a list = any of them;
|                                                                             prefix = the glob followed by *),
|                                               target    the SI field the row sets (si_component, si_asset_type, ...),
|                                               set       the value (one of the target dimension's values),
|                                               priority  an integer 0..10000 (higher wins),
|                                               state     enabled | disabled,
|                                               when      OPTIONAL extra condition (the condition language, SI fields only)
|                                                         that must ALSO hold -- e.g. "a server" AND "SQL Server installed",
|                                               verify    true = the source spelling is still to be confirmed on live rows,
|                                               note }
|                                             HEADER 'targets' (Pro key 'classification'): per target field -- dimension,
|                                             appliesTo asset | finding, multi (an asset carries every matching value),
|                                             fallback (no row matches; '$keep' = the value the sources gave, then
|                                             fallbackEmpty), keepSourceIn. Evaluated in the header's order.
|    CUSTOMER  Pro: one cfg.ItemOverride per row / dimension -- override, disable or add. Community: classification.custom.json
|              / dimensions.custom.json, only the items that differ. Both through the data-model merge (Get-SIDataModelTemplate).
|              The web app's validators: Test-SIClassificationRule / Test-SIDimensionItem, and the C# mirror
|              SI.Management.Web/Changes/ClassificationItemValidator.cs (same closed sets, Get-SIClassificationShape).
|
|    EVALUATION
|      asset    the CI build (Invoke-SICiClassification, after enrichment): the asset targets in header order, each value
|               written before the next target is evaluated (so a component row may read si_asset_subtype).
|               single  the highest-priority enabled row whose condition is TRUE (file order breaks a tie)
|               multi   every matching row's value, in the dimension's value order
|               none    the target's fallback -- never blank
|      finding  Risk Analysis, per row (Set-SIRaRowDimensions): the row's own finding fields (title, category, affected
|               product / vendor / CPE, the Azure resource type of the asset it is on) -> one value per finding target. An
|               OS vulnerability on a SQL Server VM stays OS -- the VM carries both OS and SQL, the finding the one that
|               matches it. The finding targets in header order, each value written before the next is evaluated -- the
|               ServiceNow sub-CI (si_servicenow_subci, #772) reads the component it follows.
|
|    PURE except Get-SIClassificationIndex (reads the templates). PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Test-SIConditionTri -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-Conditions.ps1') }
|# #772 the release dates of Microsoft's updates per KB (the patch cycle reads them; loaded once per run by Risk Analysis)
|if (-not (Get-Command -Name Get-SIKbReleaseDate -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-KbReleaseDates.ps1') }
|
|function Get-SIClassificationMatchOps { return , @('equals', 'in', 'prefix', 'pattern') }
|
|function Get-SIClassificationShape {
|    <#
|    .SYNOPSIS  PURE. The shape the validators enforce, as data -- the contract the C# mirror and the web app's wizard read.
|    #>
|    [ordered]@{
|        dimension      = [ordered]@{ template = 'dimensions'; kind = 'dimension'; key = 'id'; idPattern = '^[a-z][a-z0-9_]{0,47}$'; valueMaxLength = 64 }
|        classification = [ordered]@{ template = 'classification'; kind = 'classification'; key = 'id'; idPattern = '^[a-z0-9][a-z0-9_\-\.]{0,99}$'
|                                     matchOps = (Get-SIClassificationMatchOps); valuesFor = @('equals', 'in'); patternFor = @('prefix', 'pattern')
|                                     states = @('enabled', 'disabled'); priorityMin = 0; priorityMax = 10000
|                                     fieldPattern = '^(si_[a-z0-9_]+|[A-Za-z_][A-Za-z0-9_]*(\[\*\])?(\.[A-Za-z0-9_$@-]+(\[\*\])?)*)$'
|                                     targetPattern = '^si_[a-z0-9_]+$'; sourcePattern = '^[a-z][a-z0-9_]{0,31}$' }
|    }
|}
|
|function Get-SIClassificationSqlAzureTypes {
|    <# The Azure resource types SI treats as SQL (documentation + tests; the shipped rows list them themselves). #>
|    return , @('microsoft.sql/servers', 'microsoft.sql/servers/databases', 'microsoft.sql/managedinstances', 'microsoft.sql/managedinstances/databases',
|        'microsoft.sqlvirtualmachine/sqlvirtualmachines', 'microsoft.dbforpostgresql/servers', 'microsoft.dbforpostgresql/flexibleservers',
|        'microsoft.dbformysql/servers', 'microsoft.dbformysql/flexibleservers', 'microsoft.dbformariadb/servers')
|}
|
|function Test-SIClassificationSiField { param([string]$Name) return ($Name -cmatch '^si_[a-z0-9_]+$') }
|
|function ConvertTo-SIClassificationCondition {
|    <#
|    .SYNOPSIS  PURE. A row's match -> a condition of the shared language (field = '$value' when the row reads a source path:
|               the evaluator resolves the path first). equals / in -> in (values); prefix -> like '<pattern>*'; pattern ->
|               like '<pattern>' (globs, case-insensitive). An extra 'when' is ANDed.
|    #>
|    param($Rule)
|    $field = [string](Get-SIItemValue $Rule 'field')
|    $leafField = $field; if (-not (Test-SIClassificationSiField $field)) { $leafField = '$value' }
|    $op = [string](Get-SIItemValue $Rule 'match')
|    $leaf = $null
|    switch ($op) {
|        { $_ -in 'equals', 'in' } { $leaf = @{ field = $leafField; op = 'in'; value = (Get-SIValueList (Get-SIItemValue $Rule 'values')).ToArray() } }
|        'prefix' { $leaf = @{ field = $leafField; op = 'like'; value = @(foreach ($x in (Get-SIValueList (Get-SIItemValue $Rule 'pattern'))) { $s = [string]$x; if ($s.EndsWith('*')) { $s } else { $s + '*' } }) } }
|        'pattern' { $leaf = @{ field = $leafField; op = 'like'; value = @(foreach ($x in (Get-SIValueList (Get-SIItemValue $Rule 'pattern'))) { [string]$x }) } }
|        default { throw ("classification row '{0}': unknown match '{1}'" -f [string](Get-SIItemValue $Rule 'id'), $op) }
|    }
|    $when = Get-SIItemValue $Rule 'when'
|    if ($null -ne $when) { return @{ all = @($leaf, $when) } }
|    return $leaf
|}
|
|function Resolve-SIClassificationPath {
|    <# PURE. Every value at a dot path in an item ("a.b[*].c"), case-insensitive -- a source-path row's field. #>
|    param($Item, [string]$Path)
|    $cur = [System.Collections.Generic.List[object]]::new(); $cur.Add($Item)
|    foreach ($segRaw in $Path.Split('.')) {
|        $walk = $segRaw.EndsWith('[*]'); $seg = $segRaw; if ($walk) { $seg = $segRaw.Substring(0, $segRaw.Length - 3) }
|        $next = [System.Collections.Generic.List[object]]::new()
|        foreach ($o in $cur) {
|            $v = Get-SIItemValue $o $seg
|            if ($null -eq $v) { continue }
|            if ($walk -or ($v -is [System.Collections.IEnumerable] -and $v -isnot [string] -and $v -isnot [System.Collections.IDictionary])) { foreach ($x in $v) { $next.Add($x) } } else { $next.Add($v) }
|        }
|        $cur = $next
|        if ($cur.Count -eq 0) { break }
|    }
|    , $cur.ToArray()
|}
|
|function Test-SIDimensionItem {
|    <# PURE. The reasons one dimension is not accepted (empty = accepted). The web app calls it on a 'dimensions:<id>' override. #>
|    param($Dimension)
|    $why = [System.Collections.Generic.List[string]]::new()
|    if ($null -eq $Dimension) { $why.Add('a dimension is empty'); return $why.ToArray() }
|    $id = [string](Get-SIItemValue $Dimension 'id')
|    if ($id -cnotmatch '^[a-z][a-z0-9_]{0,47}$') { $why.Add(("dimension id '{0}': a lower snake_case word of at most 48 characters" -f $id)) }
|    $values = @(@(Get-SIItemValue $Dimension 'values') | Where-Object { $null -ne $_ -and ([string]$_).Trim() } | ForEach-Object { [string]$_ })
|    if ($values.Count -eq 0) { $why.Add(("dimension '{0}': values names at least one value" -f $id)) }
|    $seen = @{}
|    foreach ($v in $values) {
|        if ($v.Length -gt 64 -or $v -match '[\r\n\t;]') { $why.Add(("dimension '{0}': value '{1}' must be one line of at most 64 characters without ';'" -f $id, $v)) }
|        if ($seen.ContainsKey($v.ToLowerInvariant())) { $why.Add(("dimension '{0}': value '{1}' is listed twice" -f $id, $v)) }
|        $seen[$v.ToLowerInvariant()] = 1
|    }
|    # #772 an optional default: the fallback of the dimension's finding / single-value targets -- one of its own values
|    $def = Get-SIItemValue $Dimension 'default'
|    if ($null -ne $def -and ([string]$def).Trim() -and -not $seen.ContainsKey(([string]$def).Trim().ToLowerInvariant())) {
|        $why.Add(("dimension '{0}': default '{1}' is not one of its values" -f $id, [string]$def))
|    }
|    $why.ToArray()
|}
|
|function Get-SIClassificationFallback {
|    <#
|    .SYNOPSIS  PURE. #772 the fallback a target uses: the dimension's own 'default' (one of its values) when it names one and
|               the target is not '$keep', else the target's fallback. So a customer who renames or removes the fallback
|               bucket (the ServiceNow sub-CI: Other) names the new one in the same dimension item -- never blank.
|    #>
|    param($Target, $Dimension)
|    $fb = [string](Get-SIItemValue $Target 'fallback')
|    if ($fb -eq '$keep' -or $null -eq $Dimension) { return $fb }
|    $def = ([string](Get-SIItemValue $Dimension 'default')).Trim()
|    if (-not $def) { return $fb }
|    foreach ($v in @(Get-SIItemValue $Dimension 'values')) { if ($null -ne $v -and ([string]$v).Trim() -ieq $def) { return ([string]$v).Trim() } }
|    $fb
|}
|
|function Test-SIClassificationTarget {
|    <# PURE. One target of the classification header (where a dimension's values are written, and the fallback). #>
|    param($Target, [hashtable]$Dimensions)
|    $why = [System.Collections.Generic.List[string]]::new()
|    $f = [string](Get-SIItemValue $Target 'field')
|    if ($f -cnotmatch '^si_[a-z0-9_]+$') { $why.Add(("target '{0}': must be an SI field (si_*)" -f $f)) }
|    $dimId = [string](Get-SIItemValue $Target 'dimension')
|    $vals = @()
|    $dimDoc = $null
|    if ($null -ne $Dimensions) {
|        if (-not $Dimensions.ContainsKey($dimId)) { $why.Add(("target '{0}': dimension '{1}' is not defined (dimensions.locked.json)" -f $f, $dimId)) }
|        else { $dimDoc = $Dimensions[$dimId]; $vals = @(@(Get-SIItemValue $dimDoc 'values') | ForEach-Object { ([string]$_).ToLowerInvariant() }) }
|    }
|    $scope = [string](Get-SIItemValue $Target 'appliesTo')
|    if ($scope -notin 'asset', 'finding') { $why.Add(("target '{0}': appliesTo '{1}' (asset or finding)" -f $f, $scope)) }
|    $multi = (ConvertTo-SIBoolOrNull (Get-SIItemValue $Target 'multi')) -eq $true
|    if ($multi -and $scope -eq 'finding') { $why.Add(("target '{0}': a finding carries ONE value per dimension (multi is for assets)" -f $f)) }
|    # #772 the dimension's default (when it names one of its values) is the fallback
|    $fb = Get-SIClassificationFallback -Target $Target -Dimension $dimDoc
|    if (-not $fb) { $why.Add(("target '{0}': a fallback is required -- a classification is never blank" -f $f)) }
|    elseif ($fb -eq '$keep') {
|        if ($scope -ne 'asset' -or $multi) { $why.Add(("target '{0}': '`$keep' is for a single-value asset target" -f $f)) }
|        $fe = [string](Get-SIItemValue $Target 'fallbackEmpty')
|        if (-not $fe -or ($vals.Count -and $vals -notcontains $fe.ToLowerInvariant())) { $why.Add(("target '{0}': '`$keep' needs a fallbackEmpty that is one of the dimension's values" -f $f)) }
|    } elseif ($vals.Count -and $vals -notcontains $fb.ToLowerInvariant()) { $why.Add(("target '{0}': fallback '{1}' is not a value of dimension '{2}'" -f $f, $fb, $dimId)) }
|    $k = [string](Get-SIItemValue $Target 'keepSourceIn')
|    if ($k -and $k -cnotmatch '^si_[a-z0-9_]+$') { $why.Add(("target '{0}': keepSourceIn '{1}' must be an SI field" -f $f, $k)) }
|    $why.ToArray()
|}
|
|function Test-SIClassificationRule {
|    <#
|    .SYNOPSIS  PURE. The reasons one classification row is not accepted (empty = accepted). -Targets: target field -> header
|               target; -Dimensions: id -> dimension (both from the merged templates); without them the row is checked on its
|               own shape only. The web app calls it on a 'classification:<id>' override; the C# mirror checks the same shape.
|    #>
|    param($Rule, [hashtable]$Targets, [hashtable]$Dimensions)
|    $why = [System.Collections.Generic.List[string]]::new()
|    if ($null -eq $Rule) { $why.Add('a classification row is empty'); return $why.ToArray() }
|    $shape = (Get-SIClassificationShape).classification
|    $id = [string](Get-SIItemValue $Rule 'id')
|    if ($id -notmatch $shape.idPattern) { $why.Add(("row id '{0}': lower-case letters, digits, - _ . (at most 100)" -f $id)) }
|    $field = [string](Get-SIItemValue $Rule 'field')
|    if ($field -cnotmatch $shape.fieldPattern) { $why.Add(("row '{0}': field '{1}' must be an SI field (si_*) or a source path (a.b[*].c)" -f $id, $field)) }
|    $op = [string](Get-SIItemValue $Rule 'match')
|    if ((Get-SIClassificationMatchOps) -notcontains $op) { $why.Add(("row '{0}': match '{1}' (equals | in | prefix | pattern)" -f $id, $op)) }
|    $values = @(@(Get-SIItemValue $Rule 'values') | Where-Object { $null -ne $_ -and ([string]$_) -ne '' })
|    $pattern = @(@(Get-SIItemValue $Rule 'pattern') | Where-Object { $null -ne $_ -and ([string]$_).Trim() })
|    if ($op -in 'equals', 'in') {
|        if ($values.Count -eq 0) { $why.Add(("row '{0}': match '{1}' needs values (a list)" -f $id, $op)) }
|        if ($op -eq 'equals' -and $values.Count -gt 1) { $why.Add(("row '{0}': equals takes one value -- use in for several" -f $id)) }
|        if ($pattern.Count) { $why.Add(("row '{0}': match '{1}' reads values, not pattern" -f $id, $op)) }
|    }
|    if ($op -in 'prefix', 'pattern') {
|        if ($pattern.Count -eq 0) { $why.Add(("row '{0}': match '{1}' needs a pattern (a glob)" -f $id, $op)) }
|        if ($values.Count) { $why.Add(("row '{0}': match '{1}' reads pattern, not values" -f $id, $op)) }
|        foreach ($p in $pattern) { try { $null = New-Object System.Management.Automation.WildcardPattern([string]$p) } catch { $why.Add(("row '{0}': invalid glob '{1}'" -f $id, $p)) } }
|    }
|    $target = [string](Get-SIItemValue $Rule 'target')
|    $set = [string](Get-SIItemValue $Rule 'set')
|    if ($target -cnotmatch $shape.targetPattern) { $why.Add(("row '{0}': target '{1}' must be an SI field (si_*)" -f $id, $target)) }
|    if (-not $set.Trim()) { $why.Add(("row '{0}': set (the value) is required" -f $id)) }
|    if ($null -ne $Targets) {
|        if (-not $Targets.ContainsKey($target)) { $why.Add(("row '{0}': target '{1}' is not a classification target (the template's targets)" -f $id, $target)) }
|        elseif ($null -ne $Dimensions) {
|            $dimId = [string](Get-SIItemValue $Targets[$target] 'dimension')
|            if ($Dimensions.ContainsKey($dimId)) {
|                $vals = @(@(Get-SIItemValue $Dimensions[$dimId] 'values') | ForEach-Object { ([string]$_).ToLowerInvariant() })
|                if ($set -and $vals -notcontains $set.ToLowerInvariant()) { $why.Add(("row '{0}': '{1}' is not a value of dimension '{2}'" -f $id, $set, $dimId)) }
|            }
|        }
|    }
|    $prio = Get-SIItemValue $Rule 'priority'
|    $pn = ConvertTo-SINumberOrNull $prio
|    if ($null -eq $pn -or $pn -lt $shape.priorityMin -or $pn -gt $shape.priorityMax -or [Math]::Floor($pn) -ne $pn) { $why.Add(("row '{0}': priority must be an integer 0..10000 (higher wins)" -f $id)) }
|    $st = [string](Get-SIItemValue $Rule 'state')
|    if ($st -and $st -notin 'enabled', 'disabled') { $why.Add(("row '{0}': state '{1}' (enabled | disabled)" -f $id, $st)) }
|    $src = [string](Get-SIItemValue $Rule 'source')
|    if ($src -and $src -cnotmatch $shape.sourcePattern) { $why.Add(("row '{0}': source '{1}' is not a provider name" -f $id, $src)) }
|    $when = Get-SIItemValue $Rule 'when'
|    if ($null -ne $when) {
|        $ops = Get-SIConditionOps
|        foreach ($leafField in (Get-SIConditionFields $when)) { if (-not (Test-SIClassificationSiField $leafField)) { $why.Add(("row '{0}': when reads '{1}' -- an extra condition reads SI fields (si_*) only" -f $id, $leafField)) } }
|        $stack = New-Object System.Collections.Generic.Stack[object]; $stack.Push($when)
|        while ($stack.Count -gt 0) {
|            $c = $stack.Pop()
|            $isGroup = $false
|            foreach ($k in 'all', 'any') {
|                $has = ($c -is [System.Collections.IDictionary] -and $c.Contains($k)) -or ($null -ne $c -and $null -ne $c.PSObject.Properties[$k])
|                if ($has) { $isGroup = $true; foreach ($x in (Get-SIValueList (Get-SIItemValue $c $k))) { $stack.Push($x) } }
|            }
|            if (-not $isGroup) {
|                $o = [string](Get-SIItemValue $c 'op')
|                if ($o -eq 'in_list') { $why.Add(("row '{0}': in_list is not available to a classification row -- list the values (in)" -f $id)) }
|                elseif ($ops -notcontains $o) { $why.Add(("row '{0}': unknown condition operation '{1}'" -f $id, $o)) }
|                if ($o -eq 'matches') { foreach ($p in (Get-SIValueList (Get-SIItemValue $c 'value'))) { try { [void][regex]::new([string]$p) } catch { $why.Add(("row '{0}': invalid pattern '{1}'" -f $id, $p)) } } }
|            }
|        }
|    }
|    $why.ToArray()
|}
|
|function Get-SIClassificationTargets {
|    <# PURE. The classification header's targets: field -> target (ordered, header order). #>
|    param($Classification)
|    $t = [ordered]@{}
|    foreach ($x in @(Get-SIItemValue $Classification 'targets')) { if ($null -ne $x) { $t[[string](Get-SIItemValue $x 'field')] = $x } }
|    $t
|}
|
|function Test-SIClassifications {
|    <#
|    .SYNOPSIS  PURE. Both templates together: every dimension, target and row valid, every id once, every SI field a row reads
|               or a target writes is in the field catalog (-Fields: name -> catalog entry; optional) at the right level.
|    #>
|    param($Dimensions, $Classification, [hashtable]$Fields)
|    $p = [System.Collections.Generic.List[string]]::new()
|    $dims = @{}
|    foreach ($d in @(Get-SIItemValue $Dimensions 'dimensions')) {
|        if ($null -eq $d) { continue }
|        foreach ($x in (Test-SIDimensionItem -Dimension $d)) { $p.Add('dimensions: ' + $x) }
|        $did = [string](Get-SIItemValue $d 'id')
|        if ($dims.ContainsKey($did)) { $p.Add(("dimensions: '{0}' is defined twice" -f $did)) }
|        $dims[$did] = $d
|    }
|    $targets = @{}
|    foreach ($t in @(Get-SIItemValue $Classification 'targets')) {
|        if ($null -eq $t) { continue }
|        foreach ($x in (Test-SIClassificationTarget -Target $t -Dimensions $dims)) { $p.Add('classification: ' + $x) }
|        $tf = [string](Get-SIItemValue $t 'field')
|        if ($targets.ContainsKey($tf)) { $p.Add(("classification: target '{0}' is defined twice" -f $tf)) }
|        $targets[$tf] = $t
|        if ($null -ne $Fields) {
|            foreach ($fn in @($tf, [string](Get-SIItemValue $t 'keepSourceIn'))) {
|                if (-not $fn) { continue }
|                if (-not $Fields.ContainsKey($fn)) { $p.Add(("classification: target '{0}' writes '{1}', which is not in the field catalog" -f $tf, $fn)); continue }
|                $lvl = [string]$Fields[$fn].level
|                $scope = [string](Get-SIItemValue $t 'appliesTo')
|                if ($scope -eq 'asset' -and $lvl -eq 'finding') { $p.Add(("classification: asset target '{0}' writes finding field '{1}'" -f $tf, $fn)) }
|                if ($scope -eq 'finding' -and $lvl -ne 'finding') { $p.Add(("classification: finding target '{0}' writes '{1}', which is not a finding field" -f $tf, $fn)) }
|            }
|        }
|    }
|    $ids = @{}
|    foreach ($r in @(Get-SIItemValue $Classification 'rules')) {
|        if ($null -eq $r) { continue }
|        $rid = [string](Get-SIItemValue $r 'id')
|        foreach ($x in (Test-SIClassificationRule -Rule $r -Targets $targets -Dimensions $dims)) { $p.Add('classification: ' + $x) }
|        if ($ids.ContainsKey($rid)) { $p.Add(("classification: row '{0}' is defined twice" -f $rid)) }
|        $ids[$rid] = 1
|        if ($null -ne $Fields) {
|            $scope = ''; $tg = $targets[[string](Get-SIItemValue $r 'target')]; if ($tg) { $scope = [string](Get-SIItemValue $tg 'appliesTo') }
|            $read = [System.Collections.Generic.List[string]]::new()
|            $f = [string](Get-SIItemValue $r 'field'); if (Test-SIClassificationSiField $f) { $read.Add($f) }
|            $w = Get-SIItemValue $r 'when'; if ($null -ne $w) { foreach ($x in (Get-SIConditionFields $w)) { $read.Add([string]$x) } }
|            foreach ($fn in $read) {
|                if (-not $Fields.ContainsKey($fn)) { $p.Add(("classification/{0}: reads '{1}', which is not in the field catalog" -f $rid, $fn)); continue }
|                if ($scope -eq 'asset' -and [string]$Fields[$fn].level -eq 'finding') { $p.Add(("classification/{0}: an asset row reads finding field '{1}'" -f $rid, $fn)) }
|            }
|        }
|    }
|    $p.ToArray()
|}
|
|function New-SIClassificationIndex {
|    <#
|    .SYNOPSIS  PURE. The merged templates -> what the evaluators walk: the targets in header order, each with its dimension's
|               values and its rows (enabled and valid only), highest priority first (file order breaks a tie), each row's
|               condition compiled once.
|    #>
|    param($Dimensions, $Classification)
|    $dims = @{}
|    foreach ($d in @(Get-SIItemValue $Dimensions 'dimensions')) { if ($null -ne $d -and @(Test-SIDimensionItem -Dimension $d).Count -eq 0) { $dims[[string]$d.id] = $d } }
|    $targets = [System.Collections.Generic.List[object]]::new()
|    $byField = @{}
|    foreach ($t in @(Get-SIItemValue $Classification 'targets')) {
|        if ($null -eq $t -or @(Test-SIClassificationTarget -Target $t -Dimensions $dims).Count -gt 0) { continue }
|        $d = $dims[[string]$t.dimension]
|        $e = [pscustomobject]@{ Field = [string]$t.field; Dimension = [string]$t.dimension; AppliesTo = [string]$t.appliesTo
|                                Multi = ((ConvertTo-SIBoolOrNull (Get-SIItemValue $t 'multi')) -eq $true); Fallback = (Get-SIClassificationFallback -Target $t -Dimension $d)
|                                FallbackEmpty = [string](Get-SIItemValue $t 'fallbackEmpty'); KeepSourceIn = [string](Get-SIItemValue $t 'keepSourceIn')
|                                Values = @(@($d.values) | ForEach-Object { [string]$_ }); Rules = ([System.Collections.Generic.List[object]]::new()) }
|        $targets.Add($e); $byField[$e.Field] = $e
|    }
|    $tgDocs = @{}; foreach ($t in @(Get-SIItemValue $Classification 'targets')) { if ($t) { $tgDocs[[string]$t.field] = $t } }
|    $n = 0
|    foreach ($r in @(Get-SIItemValue $Classification 'rules')) {
|        if ($null -eq $r) { continue }
|        $n++
|        if ([string](Get-SIItemValue $r 'state') -eq 'disabled') { continue }
|        if (@(Test-SIClassificationRule -Rule $r -Targets $tgDocs -Dimensions $dims).Count -gt 0) { continue }
|        $e = $byField[[string]$r.target]; if ($null -eq $e) { continue }
|        $f = [string]$r.field
|        $cond = ConvertTo-SIClassificationCondition -Rule $r
|        # the SI field the row's own match reads (none for a source-path row): Get-SIClassificationValue decides the row false
|        # without evaluating it when the CI does not carry that field
|        $lf = ''; if (Test-SIClassificationSiField $f) { $lf = $f }
|        $e.Rules.Add([pscustomobject]@{ Id = [string]$r.id; Value = [string]$r.set; Priority = [double](ConvertTo-SINumberOrNull $r.priority); Order = $n
|                                        SourcePath = $(if (Test-SIClassificationSiField $f) { '' } else { $f }); Condition = $cond; LeafField = $lf })
|    }
|    foreach ($e in $targets) {
|        $sorted = @($e.Rules.ToArray() | Sort-Object -Property @{ Expression = { $_.Priority }; Descending = $true }, @{ Expression = { $_.Order }; Descending = $false })
|        $e.Rules.Clear(); foreach ($x in $sorted) { $e.Rules.Add($x) }
|    }
|    # .ToArray(), never @() around a List[object] held in an object: pwsh 7 throws "Argument types do not match"
|    $hasPath = (@($targets.ToArray() | ForEach-Object { $_.Rules.ToArray() } | Where-Object { $_.SourcePath }).Count -gt 0)
|    [pscustomobject]@{ Targets = $targets.ToArray(); HasSourcePath = $hasPath; Cache = @{} }
|}
|
|function Get-SIClassificationValue {
|    <#
|    .SYNOPSIS  PURE. One target over one item: @{ Values (the value, or for multi every value); Rules (the deciding row ids);
|               Unknown (rows whose condition could not be decided) }. Values is empty when no row matched -- the caller
|               applies the fallback.
|    #>
|    param([Parameter(Mandatory)]$Target, $Item, [hashtable]$Context, [string[]]$UnknownFields = @())
|    $vals = [System.Collections.Generic.List[string]]::new()
|    $ids = [System.Collections.Generic.List[string]]::new()
|    $unknown = [System.Collections.Generic.List[string]]::new()
|    foreach ($r in $Target.Rules) {
|        if ($Target.Multi -and $vals.Contains($r.Value)) { continue }
|        $subject = $Item
|        if ($r.SourcePath) {
|            # a source-path row: the path's values become '$value' of a view that also carries the item's SI fields (for 'when')
|            $view = @{}
|            if ($Item -is [System.Collections.IDictionary]) { foreach ($k in @($Item.Keys)) { $view[[string]$k] = $Item[$k] } }
|            elseif ($null -ne $Item) { foreach ($pp in $Item.PSObject.Properties) { $view[$pp.Name] = $pp.Value } }
|            $view['$value'] = @(Resolve-SIClassificationPath -Item $Item -Path $r.SourcePath)
|            $subject = $view
|        }
|        # A ROW WHOSE FIELD THE CI DOES NOT CARRY IS FALSE (2026-10-16, the CI build of a large install: most rows read an Azure
|        # resource type, which an identity or a device never has). The row's match is 'in' or 'like' on that field and comes
|        # FIRST in its condition (ConvertTo-SIClassificationCondition), so an empty field -- no value, or a list without one --
|        # makes the whole row false, exactly as evaluating it would; a field the CI cannot decide (UnknownFields) is evaluated.
|        if ($r.PSObject.Properties['LeafField'] -and $r.LeafField -and -not $r.SourcePath) {
|            $lv = Get-SIItemValue $subject $r.LeafField
|            if ($null -eq $lv -or (Get-SIValueList $lv).Count -eq 0) {
|                $unk = $false; foreach ($u in $UnknownFields) { if ($u -and [string]::Equals([string]$u, [string]$r.LeafField, [StringComparison]::OrdinalIgnoreCase)) { $unk = $true; break } }
|                if (-not $unk) { continue }
|            }
|        }
|        $hit = $false
|        try { $hit = Test-SIConditionTri -Condition $r.Condition -Item $subject -Context $Context -UnknownFields $UnknownFields } catch { $hit = $false }
|        if ($null -eq $hit) { $unknown.Add($r.Id); continue }
|        if ($hit -ne $true) { continue }
|        $vals.Add($r.Value); $ids.Add($r.Id)
|        if (-not $Target.Multi) { break }
|    }
|    if ($Target.Multi -and $vals.Count -gt 1) {
|        # the dimension's own value order, so the same asset always reads the same way
|        $ordered = @($Target.Values | Where-Object { $vals -contains $_ })
|        $vals.Clear(); foreach ($v in $ordered) { $vals.Add($v) }
|    }
|    @{ Values = $vals.ToArray(); Rules = $ids.ToArray(); Unknown = $unknown.ToArray() }
|}
|
|function Set-SICiSqlIaasLinks {
|    <#
|    .SYNOPSIS  PURE. #561 / #562: a VM registered with the SQL IaaS extension has a microsoft.sqlvirtualmachine/sqlvirtualmachines
|               resource whose virtualMachineResourceId (si_sql_vm_resource_id) names the VM. The VM's CI (si_link_azure or a
|               linked Azure id) gets si_sql_iaas = true. Only within the CIs given (one build batch); a VM whose SQL resource is
|               in another batch is decided by its software inventory instead. Returns the number of VMs marked.
|    #>
|    param([AllowEmptyCollection()][object[]]$Cis = @())
|    $vmIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
|    foreach ($c in $Cis) { foreach ($v in (Get-SIValueList (Get-SIItemValue $c 'si_sql_vm_resource_id'))) { if ($v) { [void]$vmIds.Add(([string]$v).Trim()) } } }
|    if ($vmIds.Count -eq 0) { return 0 }
|    $n = 0
|    foreach ($c in $Cis) {
|        $ids = [System.Collections.Generic.List[string]]::new()
|        $la = [string](Get-SIItemValue $c 'si_link_azure'); if ($la) { $ids.Add($la) }
|        foreach ($lo in (Get-SIValueList (Get-SIItemValue $c 'si_linked_objects'))) { $lid = [string](Get-SIItemValue $lo 'id'); if ($lid -like '/subscriptions/*') { $ids.Add($lid) } }
|        foreach ($i in $ids) {
|            if ($vmIds.Contains($i.Trim())) {
|                if ($c -is [System.Collections.IDictionary]) { $c['si_sql_iaas'] = $true } else { $c | Add-Member -NotePropertyName si_sql_iaas -NotePropertyValue $true -Force }
|                $n++; break
|            }
|        }
|    }
|    $n
|}
|
|function Invoke-SIAssetClassification {
|    <#
|    .SYNOPSIS  PURE. Every asset target on ONE CI (an ordered dictionary): writes the target field (and keepSourceIn), and
|               si_classified_by (target field -> the row ids that decided, or 'fallback').
|    #>
|    param([Parameter(Mandatory)]$Ci, [Parameter(Mandatory)]$Index, [hashtable]$Context)
|    $unknownFields = @(foreach ($x in @(Get-SIItemValue $Ci 'si_unknown_fields')) { if ($x) { [string]$x } })
|    $by = [ordered]@{}
|    foreach ($t in @($Index.Targets)) {
|        if ($t.AppliesTo -ne 'asset') { continue }
|        $src = Get-SIItemValue $Ci $t.Field
|        if ($t.KeepSourceIn) {
|            # the value the sources gave, kept once: a CI classified before (an incremental build) keeps its source value
|            $prev = Get-SIItemValue $Ci $t.KeepSourceIn
|            if (-not (Test-SIValueEmpty $prev)) { $src = $prev } else { $Ci[$t.KeepSourceIn] = $src }
|        }
|        $r = Get-SIClassificationValue -Target $t -Item $Ci -Context $Context -UnknownFields $unknownFields
|        $vals = @($r.Values); $decided = @($r.Rules)
|        if ($vals.Count -eq 0) {
|            if ($t.Fallback -eq '$keep') {
|                $sv = @((Get-SIValueList $src).ToArray() | Where-Object { -not (Test-SIValueEmpty $_) })
|                if ($sv.Count) { $vals = @([string]$sv[0]) } else { $vals = @($t.FallbackEmpty) }
|            } else { $vals = @($t.Fallback) }
|            $decided = @('fallback')
|        }
|        if ($t.Multi) { $Ci[$t.Field] = [string[]]$vals } else { $Ci[$t.Field] = [string]$vals[0] }
|        $by[$t.Field] = $decided
|    }
|    $Ci['si_classified_by'] = $by
|    $Ci
|}
|
|function Invoke-SICiClassification {
|    <#
|    .SYNOPSIS  The CI build step: SQL IaaS links over the set, then every CI classified. Never throws (a classification that
|               cannot run leaves the CIs as the sources gave them, with a warning). Returns the number of CIs classified.
|    #>
|    param([AllowEmptyCollection()][object[]]$Cis = @(), [Parameter(Mandatory)]$Model, [hashtable]$Context)
|    try {
|        $dimDoc = $Model['dimensions']; $clsDoc = $Model['classification']
|        if ($null -eq $dimDoc -or $null -eq $clsDoc) { return 0 }
|        $idx = New-SIClassificationIndex -Dimensions $dimDoc -Classification $clsDoc
|        if (@($idx.Targets).Count -eq 0) { return 0 }
|        $null = Set-SICiSqlIaasLinks -Cis @($Cis)
|        $n = 0
|        foreach ($ci in $Cis) { if ($null -eq $ci) { continue }; $null = Invoke-SIAssetClassification -Ci $ci -Index $idx -Context $Context; $n++ }
|        return $n
|    } catch {
|        Write-Warning ('classification (asset type / subtype / components) not applied -- {0}' -f $_.Exception.Message)
|        return 0
|    }
|}
|
|function ConvertFrom-SIAzureResourceIdType {
|    <# PURE. '/subscriptions/../providers/Microsoft.Sql/servers/s1/databases/d1' -> 'microsoft.sql/servers/databases'; '' when it is not one. #>
|    param([AllowNull()][AllowEmptyString()][string]$Id)
|    if (-not $Id) { return '' }
|    $i = $Id.ToLowerInvariant().LastIndexOf('/providers/')
|    if ($i -lt 0) { return '' }
|    $segs = @($Id.Substring($i + 11).Split('/') | Where-Object { $_ -ne '' })
|    if ($segs.Count -lt 3) { return '' }
|    $t = $segs[0] + '/' + $segs[1]
|    for ($k = 3; $k -lt $segs.Count; $k += 2) { $t += '/' + $segs[$k] }
|    $t.ToLowerInvariant()
|}
|
|function ConvertTo-SIFindingClassificationItem {
|    <#
|    .SYNOPSIS  PURE. A Risk Analysis row (any report) -> the SI finding fields a classification row reads:
|               si_title (ConfigurationName), si_category, si_subcategory, si_security_domain, si_finding_key (ConfigurationId),
|               si_report_name (AssetDetectedInReportName / ReportName, #772),
|               si_affected_product / _vendor / _version / _cpe (the row's own si_* columns or SI_Affected*; ';'-joined lists
|               become lists) and si_azure_resource_type (AssetType when it is an Azure type, else parsed from
|               AzureResourceId / ResourceId / AssetId). The row's own columns stay readable by a source-path row. A field the
|               row does not carry is absent -- unknown, never guessed.
|    #>
|    param([Parameter(Mandatory)]$Row, [switch]$WithRow)
|    # PERFORMANCE (Risk Analysis calls this once per finding row): Get-SIItemValue's own rule -- the exact key first, else the
|    # first key equal ignoring case (in key order) -- with the case-insensitive view of a dictionary's keys built ONCE per
|    # row instead of a walk over every key for each name the row does not carry
|    $ciKeys = $null; $isDict = $false
|    if ($Row -is [System.Collections.IDictionary]) {
|        $isDict = $true
|        # a dictionary whose own lookup already ignores case (PowerShell's @{} and [ordered]@{}, probed on a key that has
|        # letters) needs no second view: the walk could find nothing its lookup missed
|        $insens = $false
|        if ($Row -is [hashtable] -or $Row -is [System.Collections.Specialized.OrderedDictionary]) {
|            foreach ($k in $Row.Keys) { $ks = [string]$k; $ku = $ks.ToUpperInvariant(); $kl = $ks.ToLowerInvariant(); if ($ku -cne $kl) { $insens = ($Row.Contains($ku) -and $Row.Contains($kl)); break } }
|        }
|        if (-not $insens) {
|            $ciKeys = [System.Collections.Generic.Dictionary[string,object]]::new([System.StringComparer]::OrdinalIgnoreCase)
|            foreach ($k in $Row.Keys) { $ks = [string]$k; if (-not $ciKeys.ContainsKey($ks)) { $ciKeys[$ks] = $k } }
|        }
|    }
|    # every name this reads, read ONCE, inline (no script block call per name): its value as trimmed text, or $null when
|    # absent / null / blank -- what the per-name reader returned
|    $tv = @{}
|    foreach ($n in $script:SIFindingItemReadNames) {
|        $v = $null
|        if ($isDict) {
|            if ($Row.Contains($n)) { $v = $Row[$n] }
|            elseif ($null -ne $ciKeys) { $ok = $null; if ($ciKeys.TryGetValue($n, [ref]$ok)) { $v = $Row[$ok] } }
|        } else { $v = Get-SIItemValue $Row $n }
|        $t = $null
|        if ($null -ne $v) { $s = [string]$v; if ($s.Trim()) { $t = $s.Trim() } }
|        $tv[$n] = $t
|    }
|    $o = @{}
|    # the row's own columns only when a source-path row reads them (a copy per row costs on 80,000-row reports)
|    if ($WithRow) {
|        if ($Row -is [System.Collections.IDictionary]) { foreach ($k in @($Row.Keys)) { $o[[string]$k] = $Row[$k] } }
|        else { foreach ($pp in $Row.PSObject.Properties) { $o[$pp.Name] = $pp.Value } }
|    }
|    foreach ($p in $script:SIFindingItemPairs) {
|        foreach ($src in $p[1]) {
|            $v = $tv[$src]
|            if ($null -eq $v) { continue }
|            if ($p[0] -like 'si_affected_*' -and $v.Contains(';')) { $o[$p[0]] = @($v.Split(';') | ForEach-Object { $_.Trim() } | Where-Object { $_ }) } else { $o[$p[0]] = $v }
|            break
|        }
|    }
|    $rt = $tv['si_azure_resource_type']
|    if (-not $rt) { $at = $tv['AssetType']; if ($at -and $at -match '^(?i)microsoft\.[a-z0-9]+/[a-z0-9/]+$') { $rt = $at.ToLowerInvariant() } }
|    if (-not $rt) {
|        foreach ($n in 'AzureResourceId', 'ResourceId', 'AssetId', 'AssetName') {
|            $idv = $tv[$n]
|            # ConvertFrom-SIAzureResourceIdType returns '' for an empty id and for one without '/providers/' (its own first
|            # two tests, made here so the call is skipped for the ids that are no Azure resource id)
|            if (-not $idv -or $idv.ToLowerInvariant().LastIndexOf('/providers/') -lt 0) { continue }
|            $t = ConvertFrom-SIAzureResourceIdType $idv; if ($t) { $rt = $t; break }
|        }
|    }
|    if ($rt) { $o['si_azure_resource_type'] = $rt }
|    $o
|}
|$script:SIFindingItemPairs = @(
|    @('si_title', @('si_title', 'ConfigurationName')), @('si_category', @('si_category', 'Category')), @('si_subcategory', @('si_subcategory', 'Subcategory')),
|    @('si_security_domain', @('si_security_domain', 'SecurityDomain')), @('si_finding_key', @('si_finding_key', 'ConfigurationId')),
|    @('si_affected_product', @('si_affected_product', 'SI_AffectedProduct')), @('si_affected_vendor', @('si_affected_vendor', 'SI_AffectedVendor')),
|    @('si_affected_version', @('si_affected_version', 'SI_AffectedVersion')), @('si_affected_cpe', @('si_affected_cpe', 'SI_AffectedCpe')),
|    # #772 the report that found it (a ServiceNow sub-CI rule may route by report)
|    @('si_report_name', @('si_report_name', 'AssetDetectedInReportName', 'ReportName')))
|$script:SIFindingItemReadNames = @(@($script:SIFindingItemPairs | ForEach-Object { $_[1] }) + @('si_azure_resource_type', 'AssetType', 'AzureResourceId', 'ResourceId', 'AssetId', 'AssetName'))
|
|function Get-SIFindingDimensionValues {
|    <#
|    .SYNOPSIS  PURE. Every finding target over one finding item -> ordered @{ <target field> = value } plus '_rules'
|               (target field -> the deciding row id or 'fallback'). One value per target, never blank.
|    #>
|    param([Parameter(Mandatory)]$Item, [Parameter(Mandatory)]$Index, [hashtable]$Context)
|    $out = [ordered]@{}
|    $rules = [ordered]@{}
|    foreach ($t in @($Index.Targets)) {
|        if ($t.AppliesTo -ne 'finding') { continue }
|        $r = Get-SIClassificationValue -Target $t -Item $Item -Context $Context
|        if (@($r.Values).Count) { $out[$t.Field] = [string]$r.Values[0]; $rules[$t.Field] = [string]$r.Rules[0] }
|        else { $out[$t.Field] = $t.Fallback; $rules[$t.Field] = 'fallback' }
|        # #772 each value is written before the next target is evaluated (as the asset targets are), so a later finding target
|        # reads an earlier one -- the ServiceNow sub-CI reads the finding's component
|        if ($Item -is [System.Collections.IDictionary]) { $Item[$t.Field] = $out[$t.Field] }
|    }
|    $out['_rules'] = $rules
|    $out
|}
|
|$script:SIClassificationIndexCache = $null
|
|# =====================================================================================================================
|# #772 THE PATCH CYCLE (owner 2026-10-19: "we need a filter option, where we filter between 'being fixed during monthly
|# lifecycle' vs. 'catch-up older than 1 month'"). si_patch_cycle is a finding target of the classification like every
|# other dimension -- its values and which facts give which value are DATA (data-model/classification.locked.json, rows
|# patch-cycle-*; the customer's overrides as for any row). What is CODE is the two facts the rows read, worked out once here
|# for both editions:
|#   si_patch_fix   'none' when the source says no fix exists (si_fix_available false, or a fix text such as "No fix")
|#   si_patch_age   'within' | 'over' -- the fix's RELEASE date (the month a "<Month> <Year> Security Updates" / "2026-10
|#                  Cumulative Update" text names -> that month's Patch Tuesday, the 2nd Tuesday; an explicit date wins,
|#                  e.g. an out-of-band update), else the finding's age since it was first detected, against
|#                  SI_PatchCycle_CatchUpDays (default 30; exactly the threshold is still within) at the collection time.
|# Nothing known -> neither fact -> the target's fallback (Unknown).
|# =====================================================================================================================
|
|function Get-SIPatchCycleCatchUpDays {
|    <# The catch-up threshold in days: SI_PatchCycle_CatchUpDays (a whole number of at least 1), else 30. #>
|    $v = $global:SI_PatchCycle_CatchUpDays
|    $n = 0
|    if ($null -ne $v -and [int]::TryParse(([string]$v).Trim(), [ref]$n) -and $n -ge 1) { return $n }
|    30
|}
|
|function Get-SIPatchTuesday {
|    <# PURE. The second Tuesday of a month (UTC midnight) -- Microsoft's monthly security release. #>
|    param([Parameter(Mandatory)][int]$Year, [Parameter(Mandatory)][int]$Month)
|    $first = [datetime]::new($Year, $Month, 1, 0, 0, 0, [System.DateTimeKind]::Utc)
|    $off = (([int][System.DayOfWeek]::Tuesday) - ([int]$first.DayOfWeek) + 7) % 7
|    $first.AddDays($off + 7)
|}
|
|$script:SIPatchMonths = @{ jan = 1; feb = 2; mar = 3; apr = 4; may = 5; jun = 6; jul = 7; aug = 8; sep = 9; oct = 10; nov = 11; dec = 12 }
|
|function ConvertFrom-SIFixReleaseDate {
|    <#
|    .SYNOPSIS  PURE. The release date a fix text names, or $null: an explicit date (2026-10-21, an out-of-band update) as it
|               is; a month -- "October 2026 Security Updates", "Oct 2026 (Hotpatch)", "2026-10 Cumulative Update for
|               Windows 11 (KB5127648)", "2026-10 Out-of-band update" -- as that month's Patch Tuesday. Several updates
|               (';'-joined): the newest one. A KB number alone names no date.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Text)
|    if ([string]::IsNullOrWhiteSpace($Text)) { return $null }
|    $best = $null
|    foreach ($part in $Text.Split(';')) {
|        $p = $part.Trim(); if (-not $p) { continue }
|        $d = $null
|        $m = [regex]::Match($p, '(?<!\d)(20\d{2})-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])(?!\d)')
|        if ($m.Success) {
|            try { $d = [datetime]::new([int]$m.Groups[1].Value, [int]$m.Groups[2].Value, [int]$m.Groups[3].Value, 0, 0, 0, [System.DateTimeKind]::Utc) } catch { $d = $null }
|        }
|        if ($null -eq $d) {
|            $m = [regex]::Match($p, '(?i)\b(jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)[a-z]*\.?\s*,?\s*(20\d{2})\b')
|            if ($m.Success) { $d = Get-SIPatchTuesday -Year ([int]$m.Groups[2].Value) -Month $script:SIPatchMonths[$m.Groups[1].Value.ToLowerInvariant()] }
|        }
|        if ($null -eq $d) {
|            $m = [regex]::Match($p, '(?<!\d)(20\d{2})-(0[1-9]|1[0-2])(?![\d-])')
|            if ($m.Success) { $d = Get-SIPatchTuesday -Year ([int]$m.Groups[1].Value) -Month ([int]$m.Groups[2].Value) }
|        }
|        if ($null -ne $d -and ($null -eq $best -or $d -gt $best)) { $best = $d }
|    }
|    $best
|}
|
|function ConvertTo-SIPatchDate {
|    <# PURE. A date value of a row (a datetime, or ISO / invariant text) as UTC, or $null. #>
|    param($Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [datetime]) { $d = [datetime]$Value; if ($d.Kind -eq [System.DateTimeKind]::Unspecified) { $d = [datetime]::SpecifyKind($d, [System.DateTimeKind]::Utc) }; return $d.ToUniversalTime() }
|    $s = ([string]$Value).Trim(); if (-not $s) { return $null }
|    $o = [datetime]::MinValue
|    if ([datetime]::TryParse($s, [System.Globalization.CultureInfo]::InvariantCulture, ([System.Globalization.DateTimeStyles]::AdjustToUniversal -bor [System.Globalization.DateTimeStyles]::AssumeUniversal), [ref]$o)) { return [datetime]::SpecifyKind($o, [System.DateTimeKind]::Utc) }
|    $null
|}
|
|$script:SIPatchFixTextNames = @('si_fix_recommended_update', 'RecommendedSecurityUpdate', 'SI_FixReference', 'si_fix_reference')
|$script:SIPatchFixDateNames = @('si_fix_release_date', 'FixReleaseDate', 'si_fix_published')
|# #906: si_source_first_seen is the field Risk Analysis writes (RA-SourceFirstSeen.ps1, Defender's software vulnerabilities
|# export) -- without it here every browser / third-party CVE (no dated update) had no age and fell to Unknown
|$script:SIPatchFirstNames = @('si_first_detected', 'si_source_first_seen', 'si_source_first_detected', 'FirstDetected', 'FirstSeenTimestamp', 'FirstSeen', 'si_first_seen')
|$script:SIPatchUpdateNames = @('si_fix_recommended_update', 'RecommendedSecurityUpdate', 'si_fix_recommended_update_id', 'RecommendedSecurityUpdateId')
|$script:SIPatchNowNames = @('si_collection_time', 'CollectionTime')
|
|function Get-SIPatchCycleFacts {
|    <#
|    .SYNOPSIS  PURE. The two facts the patch-cycle rows read, from one finding row: @{ si_patch_fix = 'none' | ''; si_patch_age =
|               'within' | 'over' | ''; Basis = 'fix release' | 'first detected' | ''; ReleaseDate; AgeDays }.
|               -Now: the collection time (default: the row's, else now); -CatchUpDays: the threshold (default the setting).
|    #>
|    param([Parameter(Mandatory)]$Row, $Now, [int]$CatchUpDays = 0)
|    $g = { param([string]$n) if ($Row -is [System.Collections.IDictionary]) { if ($Row.Contains($n)) { $Row[$n] } else { $null } } elseif ($null -ne $Row.PSObject.Properties[$n]) { $Row.$n } else { $null } }
|    if ($CatchUpDays -lt 1) { $CatchUpDays = Get-SIPatchCycleCatchUpDays }
|    $out = @{ si_patch_fix = ''; si_patch_age = ''; Basis = ''; ReleaseDate = $null; AgeDays = $null }
|    $fixText = ''
|    foreach ($n in $script:SIPatchFixTextNames) { $v = & $g $n; if ($null -ne $v -and ([string]$v).Trim()) { $fixText = ([string]$v).Trim(); break } }
|    $avail = ConvertTo-SIBoolOrNull (& $g 'si_fix_available')
|    if ($avail -eq $false -or $fixText -match '^(?i)(no (known )?(fix|patch|security update|update|remediation)( available)?|none|not available|n/?a)\.?$') {
|        $out.si_patch_fix = 'none'; return $out
|    }
|    $at = $null
|    foreach ($n in $script:SIPatchNowNames) { $at = ConvertTo-SIPatchDate (& $g $n); if ($null -ne $at) { break } }
|    if ($null -ne $Now) { $at = ConvertTo-SIPatchDate $Now }
|    if ($null -eq $at) { $at = [datetime]::UtcNow }
|    $rel = $null
|    foreach ($n in $script:SIPatchFixDateNames) { $rel = ConvertTo-SIPatchDate (& $g $n); if ($null -ne $rel) { break } }
|    $basis = 'fix release'
|    # #772 (owner: "read the fix release date"): a Microsoft update's own release date by its KB (the Security Update Guide,
|    # Get-SIKbReleaseDate -- Defender names the KB, never its date), before the month the update's name says
|    if ($null -eq $rel) {
|        $kbs = [System.Collections.Generic.List[string]]::new()
|        foreach ($n in 'si_fix_recommended_update_id', 'RecommendedSecurityUpdateId') { $v = & $g $n; if ($null -ne $v) { foreach ($x in (Get-SIKbKeysFromText ([string]$v))) { $kbs.Add($x) } } }
|        if ($fixText) { foreach ($x in (Get-SIKbKeysFromText $fixText)) { $kbs.Add($x) } }
|        if ($kbs.Count) { $rel = Get-SIKbReleaseDate -Kbs $kbs.ToArray(); if ($null -ne $rel) { $basis = 'kb release' } }
|    }
|    if ($null -eq $rel -and $fixText) { $rel = ConvertFrom-SIFixReleaseDate $fixText }
|    if ($null -eq $rel) {
|        $basis = 'first detected'
|        foreach ($n in $script:SIPatchFirstNames) { $rel = ConvertTo-SIPatchDate (& $g $n); if ($null -ne $rel) { break } }
|    }
|    if ($null -eq $rel) {
|        # #906: no dated update and no first-seen. A finding that names NO recommended update (no update name, no update id --
|        # a generic fix text such as "Update the affected software ..." is no update) has no single update: group 3, the same
|        # rule as the SQL twin and SI-PatchCycle.ps1 (no update = nofix). Unknown stays only for an update whose month
|        # cannot be read (a KB number alone, an update name without a month).
|        $hasUpd = $false
|        foreach ($n in $script:SIPatchUpdateNames) { $v = & $g $n; if ($null -ne $v -and -not ($v -is [System.DBNull]) -and ([string]$v).Trim()) { $hasUpd = $true; break } }
|        if (-not $hasUpd) { $out.si_patch_fix = 'none' }
|        return $out
|    }
|    $age = ($at - $rel).TotalDays
|    $out.Basis = $basis; $out.ReleaseDate = $rel; $out.AgeDays = [Math]::Floor($age)
|    # exactly the threshold is still in the cycle: catch-up is OLDER than it
|    $out.si_patch_age = $(if ($age -gt $CatchUpDays) { 'over' } else { 'within' })
|    $out
|}
|
|function Add-SIPatchCycleFacts {
|    <# The patch cycle's facts onto a finding classification item (only the ones that are known). The collection time is the
|       run's (RA_CollectionTime) when Risk Analysis set it. Never throws. #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Item, [Parameter(Mandatory)]$Row)
|    try {
|        $now = $null; if ($null -ne $global:RA_CollectionTime) { $now = $global:RA_CollectionTime }
|        $f = Get-SIPatchCycleFacts -Row $Row -Now $now
|        foreach ($k in 'si_patch_fix', 'si_patch_age') { if ($f[$k]) { $Item[$k] = $f[$k] } }
|        if ($Row -is [System.Collections.IDictionary]) {
|            # the fix's release date when the Security Update Guide gave it (si_fix_release_date), and the CVE's published date
|            # as its own field (si_cve_published: exposure age -- the patch cycle never reads it)
|            if ($f.Basis -eq 'kb release' -and -not $Row.Contains('si_fix_release_date')) { $Row['si_fix_release_date'] = ([datetime]$f.ReleaseDate).ToString('yyyy-MM-dd') }
|            if (-not $Row.Contains('si_cve_published')) {
|                foreach ($pn in 'si_published', 'PublishedDate', 'CVEPublishedDate', 'si_published_date') {
|                    $pv = $null; if ($Row.Contains($pn)) { $pv = ConvertTo-SIPatchDate $Row[$pn] }
|                    if ($null -ne $pv) { $Row['si_cve_published'] = $pv.ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture); break }
|                }
|            }
|        }
|    } catch { }
|    $Item
|}
|
|function Set-SIRaRowOsFamily {
|    <#
|    .SYNOPSIS  #772. A finding carries its asset's OS family (si_os_family, set on the row by the CI context). A row without
|               one -- no CI was found for its asset -- is classified from its OWN OS fields (si_os_platform / OSPlatform,
|               si_os_name / OSName / OsVersion..., DeviceCategory) with the SAME rows as the CIs (the asset target
|               si_os_family); nothing known = the fallback (Unknown). No OS family target in the model = the row is left as
|               it is. Never throws.
|    #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Row, $Index)
|    try {
|        if ($Row.Contains('si_os_family') -and -not (Test-SIValueEmpty $Row['si_os_family'])) { return $Row }
|        if ($null -eq $Index) { return $Row }
|        $t = $null
|        foreach ($x in @($Index.Targets)) { if ($x.Field -eq 'si_os_family') { $t = $x; break } }
|        if ($null -eq $t) { return $Row }
|        $item = @{}
|        foreach ($p in $script:SIOsFamilyRowPairs) {
|            foreach ($src in $p[1]) {
|                $v = $null; if ($Row.Contains($src)) { $v = $Row[$src] }
|                if ($null -ne $v -and ([string]$v).Trim()) { $item[$p[0]] = ([string]$v).Trim(); break }
|            }
|        }
|        $ck = 'osf' + [char]31 + [string]$item['si_os_platform'] + [char]31 + [string]$item['si_os_name'] + [char]31 + [string]$item['si_device_category']
|        $val = $null
|        if ($null -ne $Index.Cache -and $Index.Cache.ContainsKey($ck)) { $val = [string]$Index.Cache[$ck] }
|        else {
|            $r = Get-SIClassificationValue -Target $t -Item $item
|            $val = $t.Fallback; if (@($r.Values).Count) { $val = [string]$r.Values[0] }
|            if ($null -ne $Index.Cache) { $Index.Cache[$ck] = $val }
|        }
|        if ($val) { $Row['si_os_family'] = $val }
|    } catch { }
|    $Row
|}
|$script:SIOsFamilyRowPairs = @(
|    @('si_os_platform', @('si_os_platform', 'OSPlatform', 'OsPlatform', 'DeviceOsPlatform')),
|    @('si_os_name', @('si_os_name', 'OSName', 'OsName', 'OperatingSystem', 'OSVersion', 'OsVersion')),
|    @('si_device_category', @('si_device_category', 'DeviceCategory')))
|
|function Get-SIClassificationIndex {
|    <#
|    .SYNOPSIS  The merged templates (shipped + the customer's) as an index, read once per process; $null when there are none
|               or they cannot be read (nothing is classified -- never fails). -Refresh re-reads.
|    #>
|    param([string]$Root, [string]$OverlayRoot = $global:SI_DataModelOverlayRoot, [switch]$Refresh)
|    if ($script:SIClassificationIndexCache -and -not $Refresh -and -not $Root) { return $script:SIClassificationIndexCache }
|    try {
|        if (-not (Get-Command -Name Get-SIDataModelTemplate -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-DataModelTemplates.ps1') }
|        $r = Get-SIDataModelRoot $Root
|        if (-not (Test-Path -LiteralPath (Join-Path $r 'classification.locked.json'))) {
|            # Pro: a data model exported before these templates were published -- the shipped templates (no override yet)
|            $r = Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'data-model'
|            if (-not (Test-Path -LiteralPath (Join-Path $r 'classification.locked.json'))) { return $null }
|        }
|        $d = (Get-SIDataModelTemplate -Name 'dimensions' -Root $r -OverlayRoot $OverlayRoot).Document
|        $c = (Get-SIDataModelTemplate -Name 'classification' -Root $r -OverlayRoot $OverlayRoot).Document
|        foreach ($p in (Test-SIClassifications -Dimensions $d -Classification $c)) { Write-Warning ('classification: {0} -- not applied' -f $p) }
|        $idx = New-SIClassificationIndex -Dimensions $d -Classification $c
|        if (-not $Root) { $script:SIClassificationIndexCache = $idx }
|        return $idx
|    } catch {
|        Write-Warning ('classification could not be read -- {0}. Findings get the fallback values.' -f $_.Exception.Message)
|        return $null
|    }
|}
|
|function Set-SIRaRowDimensions {
|    <#
|    .SYNOPSIS  Risk Analysis, per output row (RA-RiskScore.ps1): the row's finding targets (si_component, ...) from the
|               classification rows. -Index: a prepared index (tests); default the cached one. A row the rows cannot classify
|               gets each target's fallback; no index at all = the row is left as it is. Never throws.
|    #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Row, $Index)
|    try {
|        if ($null -eq $Index) { $Index = Get-SIClassificationIndex }
|        if ($null -eq $Index) { return $Row }
|        $item = ConvertTo-SIFindingClassificationItem -Row $Row -WithRow:([bool]$Index.HasSourcePath)
|        # #772 the patch cycle's two facts (the rows patch-cycle-* read them): the fix's release / the finding's age
|        $null = Add-SIPatchCycleFacts -Item $item -Row $Row
|        # the same finding fields classify the same way: one evaluation per distinct combination (a report's rows repeat them)
|        $vals = $null; $ck = $null
|        if (-not $Index.HasSourcePath -and $null -ne $Index.Cache) {
|            # PERFORMANCE: the cache key is the values of the fields the finding rows' conditions READ (worked out once per
|            # index), not of every field of the item -- a value no condition reads (the affected version, the finding key)
|            # cannot change the result, and keying on it made almost every row of a CVE report a miss. Built in a loop.
|            $kfp = $Index.PSObject.Properties['SIKeyFields']
|            if (-not $kfp) {
|                $kfSet = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
|                foreach ($kt in @($Index.Targets)) {
|                    if ($null -eq $kt -or $kt.AppliesTo -ne 'finding') { continue }
|                    foreach ($kr in $kt.Rules) { foreach ($kfn in (Get-SIConditionFields $kr.Condition)) { [void]$kfSet.Add([string]$kfn) } }
|                }
|                $kfArr = [string[]]@($kfSet)
|                [System.Array]::Sort($kfArr, [System.StringComparer]::Ordinal)
|                Add-Member -InputObject $Index -NotePropertyName 'SIKeyFields' -NotePropertyValue $kfArr -Force
|                $kfp = $Index.PSObject.Properties['SIKeyFields']
|            }
|            $ckParts = [System.Collections.Generic.List[string]]::new()
|            $ckParts.Add('k2')
|            foreach ($ckn in $kfp.Value) {
|                $ckv = $item[$ckn]
|                $ckText = '~'
|                if ($null -ne $ckv) {
|                    if ($ckv -is [string] -or $ckv -is [System.Collections.IDictionary] -or -not ($ckv -is [System.Collections.IEnumerable])) { $ckText = 's' + [string]$ckv }
|                    else { $ckl = [System.Collections.Generic.List[object]]::new(); foreach ($x in $ckv) { if ($null -ne $x) { $ckl.Add($x) } }; $ckText = 'l' + $ckl.Count + ':' + ($ckl -join [char]30) }
|                }
|                $ckParts.Add(('{0}={1}' -f $ckn, $ckText))
|            }
|            $ck = $ckParts -join [char]31
|            if ($Index.Cache.ContainsKey($ck)) { $vals = $Index.Cache[$ck] }
|        }
|        if ($null -eq $vals) {
|            $vals = Get-SIFindingDimensionValues -Item $item -Index $Index
|            if ($null -ne $ck) { if ($Index.Cache.Count -ge 20000) { $Index.Cache.Clear() }; $Index.Cache[$ck] = $vals }
|        }
|        foreach ($k in @($vals.Keys)) { if ($k -ne '_rules') { $Row[$k] = $vals[$k] } }
|        # #772 the OS family: the asset's (the CI context set it); a row no CI was found for, from its own OS fields
|        $null = Set-SIRaRowOsFamily -Row $Row -Index $Index
|        foreach ($k in 'si_affected_product', 'si_affected_vendor', 'si_affected_version', 'si_affected_cpe') {
|            if ($item.ContainsKey($k) -and -not $Row.Contains($k)) { $Row[$k] = ((Get-SIValueList $item[$k]) -join ';') }
|        }
|    } catch { }
|    $Row
|}
'@ }
$__siSupportFiles['engine/data-model/SI-KbReleaseDates.ps1'] = @{ Sha256 = '96d3a82483422993083693d3a69c16d3f1bc9edeab5ee91ca8c6cf0719123fc0'; Text = @'
|#Requires -Version 5.1
|<#
|    #772 THE RELEASE DATE OF A MICROSOFT UPDATE, PER KB -- for the patch cycle (owner 2026-10-19: "yes, read the fix release
|    date from defender").
|
|    WHY HERE AND NOT FROM DEFENDER. None of the Defender vulnerability sources SI reads names when a FIX was released:
|      DeviceTvmSoftwareVulnerabilities     RecommendedSecurityUpdate (a name) + RecommendedSecurityUpdateId (the KB) -- no date
|      DeviceTvmSoftwareVulnerabilitiesKB   PublishedDate / LastModifiedTime are the CVE's (si_published), not the fix's
|      GET /api/vulnerabilities             publishedOn / updatedOn / firstDetected -- the CVE's
|      GET /api/recommendations             recommendedVersion, remediationType, status -- no date
|      GET machines/{id}/getmissingkbs      id (KB), name, osBuild, url, machineMissedOn, cveAddressed -- no date (SI does not call it)
|      Exposure Graph                       the CVE / device nodes -- no fix date
|    Microsoft's public Security Update Guide does: the CVRF v3.0 API (https://api.msrc.microsoft.com/cvrf/v3.0, public, no
|    sign-in) lists one document per release (2026-Oct, and an out-of-band release as its own document) with its release
|    date, and every document names the KB of each vendor fix (Remediations, Type 2 = Vendor Fix, Description = the KB
|    number). A KB's release date = the release date of the earliest document that names it (a remediation's own Date wins
|    when it carries one).
|
|    ONCE PER RUN, CACHED IN THE INSTALL, NEVER PER FINDING: Pro keeps the dates in sidata.KbReleaseDate (one row per KB + a
|    state row), Community in a file (SettingsPath\OUTPUT\msrc-kb-release-dates.json). A cache read within the last day is
|    used as it is; else the update list is read once, and only the documents of the last 24 months that are new or revised since the cache are read. An update older than that window keeps the name rule (its
|    month's Patch Tuesday) -- it is catch-up either way.
|
|    OFF / NO NETWORK: SI_PatchCycle_MsrcDates (default on) off = no call at all; a call that fails (no network, a private
|    network that does not allow api.msrc.microsoft.com, a proxy) is said in ONE line and the patch cycle uses what the cache
|    holds and, for the rest, the update names' Patch Tuesday. REST only (Invoke-RestMethod), no module. PowerShell 5.1.
|#>
|
|$script:SIMsrcBase = 'https://api.msrc.microsoft.com/cvrf/v3.0'
|$script:SIKbReleaseDates = $null
|
|function Test-SIMsrcDatesOn {
|    <# PURE over the setting. SI_PatchCycle_MsrcDates: on unless off / false / 0 / no. #>
|    param($Setting = $global:SI_PatchCycle_MsrcDates)
|    if ($null -eq $Setting -or -not ([string]$Setting).Trim()) { return $true }
|    ([string]$Setting).Trim().ToLowerInvariant() -notin 'off', 'false', '0', 'no', '$false'
|}
|
|function Get-SIMsrcMonths {
|    <# PURE. How many months back the release documents are read: 24 -- an update older than that is catch-up whichever
|       date it has, and its name's Patch Tuesday says so. #>
|    24
|}
|
|function ConvertTo-SIKbKey {
|    <# PURE. 'KB5127648' / '5127648' / 'kb 5127648' -> 'KB5127648'; '' when it is not a KB number. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    if ([string]::IsNullOrWhiteSpace($Value)) { return '' }
|    $m = [regex]::Match($Value.Trim(), '^(?i)(?:KB\s*)?(\d{6,8})$')
|    if ($m.Success) { return 'KB' + $m.Groups[1].Value }
|    ''
|}
|
|function Get-SIKbKeysFromText {
|    <# PURE. Every KB number a text names ("... (KB5127648)", "KB5127648;KB5127649"), in order, once each. #>
|    param([AllowNull()][AllowEmptyString()][string]$Text)
|    $out = [System.Collections.Generic.List[string]]::new()
|    if ([string]::IsNullOrWhiteSpace($Text)) { return , $out.ToArray() }
|    foreach ($m in [regex]::Matches($Text, '(?i)\bKB\s*(\d{6,8})\b')) { $k = 'KB' + $m.Groups[1].Value; if (-not $out.Contains($k)) { $out.Add($k) } }
|    foreach ($p in $Text.Split(';')) { $k = ConvertTo-SIKbKey $p; if ($k -and -not $out.Contains($k)) { $out.Add($k) } }
|    , $out.ToArray()
|}
|
|function ConvertTo-SIMsrcDate {
|    <# PURE. A CVRF date (ISO text or a parsed datetime) as a UTC date, or $null. #>
|    param($Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [datetime]) { return ([datetime]$Value).ToUniversalTime().Date }
|    $o = [datetime]::MinValue
|    if ([datetime]::TryParse(([string]$Value), [System.Globalization.CultureInfo]::InvariantCulture, ([System.Globalization.DateTimeStyles]::AdjustToUniversal -bor [System.Globalization.DateTimeStyles]::AssumeUniversal), [ref]$o)) { return [datetime]::SpecifyKind($o.Date, [System.DateTimeKind]::Utc) }
|    $null
|}
|
|function ConvertTo-SIMsrcStamp {
|    <# PURE. A document's revision time as one invariant text (ISO, UTC) -- the same whether JSON gave text or a parsed date. #>
|    param($Value)
|    $d = ConvertTo-SIMsrcDateTime $Value
|    if ($null -eq $d) { return [string]$Value }
|    $d.ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture)
|}
|
|function ConvertFrom-SIMsrcUpdateList {
|    <# PURE. The /updates answer -> the release documents: Id, Release (InitialReleaseDate), Current (CurrentReleaseDate), Url. #>
|    param($Answer)
|    $list = [System.Collections.Generic.List[object]]::new()
|    foreach ($u in @($Answer.value)) {
|        if ($null -eq $u -or -not $u.ID) { continue }
|        $list.Add([pscustomobject]@{ Id = [string]$u.ID; Release = (ConvertTo-SIMsrcDate $u.InitialReleaseDate); Current = (ConvertTo-SIMsrcStamp $u.CurrentReleaseDate)
|                                     Url = (Get-SIMsrcDocumentUrl -Id ([string]$u.ID) -CvrfUrl $u.CvrfUrl) })
|    }
|    , $list.ToArray()
|}
|
|function Get-SIMsrcDocumentUrl {
|    <# PURE. The address of one release document: the answer's own CvrfUrl when it is a whole https address with a host,
|       else built from the API's base and the document id. A link that is relative ('/cvrf/v3.0/cvrf/2026-Oct', 'cvrf/...'),
|       empty, padded with blanks or without a host ('https:///cvrf/...') made "Invalid URI: The hostname could not be parsed"
|       and stopped the whole read. #>
|    param([string]$Id, $CvrfUrl)
|    $raw = ([string]$CvrfUrl).Trim()
|    $u = $null
|    if ($raw -and [uri]::TryCreate($raw, [UriKind]::Absolute, [ref]$u) -and $u.Scheme -in 'https', 'http' -and $u.Host) { return $u.AbsoluteUri }
|    $base = [uri]($script:SIMsrcBase.TrimEnd('/') + '/')
|    if ($raw -and -not ($raw -match '^[a-z][a-z0-9+.-]*:')) {
|        # a relative link: against the API's host when it starts with '/', else under the API's base
|        $rel = $null
|        if ([uri]::TryCreate($base, $raw, [ref]$rel) -and $rel.Host) { return $rel.AbsoluteUri }
|    }
|    '{0}/cvrf/{1}' -f $script:SIMsrcBase.TrimEnd('/'), [uri]::EscapeDataString(([string]$Id).Trim())
|}
|
|function ConvertFrom-SIMsrcDocument {
|    <# PURE. One CVRF document -> KB -> its release date (the remediation's own Date, else the document's release date). #>
|    param($Document, $Release)
|    $out = @{}
|    $docDate = $Release
|    if ($null -eq $docDate -and $Document.DocumentTracking) { $docDate = ConvertTo-SIMsrcDate $Document.DocumentTracking.InitialReleaseDate }
|    foreach ($v in @($Document.Vulnerability)) {
|        foreach ($r in @($v.Remediations)) {
|            if ($null -eq $r) { continue }
|            # Type 2 = Vendor Fix (a KB); a mitigation / workaround names none
|            if ($null -ne $r.Type -and [string]$r.Type -notin '2', 'Vendor Fix') { continue }
|            $kb = ''
|            if ($r.Description) { $kb = ConvertTo-SIKbKey ([string]$(if ($r.Description.Value) { $r.Description.Value } else { $r.Description })) }
|            if (-not $kb) { continue }
|            $d = $null
|            foreach ($n in 'Date', 'ReleaseDate') { if ($r.PSObject.Properties[$n] -and $r.$n) { $d = ConvertTo-SIMsrcDate $r.$n; if ($d) { break } } }
|            if ($null -eq $d) { $d = $docDate }
|            if ($null -eq $d) { continue }
|            if (-not $out.ContainsKey($kb) -or $d -lt $out[$kb]) { $out[$kb] = $d }
|        }
|    }
|    $out
|}
|
|function Merge-SIKbReleaseDates {
|    <# PURE. KB dates into the cache's map: the EARLIER date of a KB wins (its first release). #>
|    param([hashtable]$Into, [hashtable]$From)
|    foreach ($k in @($From.Keys)) { $d = $From[$k]; if ($null -eq $d) { continue }; if (-not $Into.ContainsKey($k) -or $d -lt $Into[$k]) { $Into[$k] = $d } }
|    $Into
|}
|
|function New-SIKbDateFileStore {
|    <# The Community cache: one JSON file { fetchedAt, documents: { id: currentReleaseDate }, kbs: { KB: 'yyyy-MM-dd' } }. -Path '' = memory only. #>
|    param([string]$Path)
|    $s = [pscustomobject]@{ Kind = 'file'; Path = $Path }
|    $s | Add-Member -MemberType ScriptMethod -Name Load -Value {
|        $c = @{ FetchedAt = $null; Documents = @{}; Kbs = @{} }
|        if (-not $this.Path -or -not (Test-Path -LiteralPath $this.Path)) { return $c }
|        try {
|            $j = Get-Content -Raw -LiteralPath $this.Path | ConvertFrom-Json
|            $c.FetchedAt = ConvertTo-SIMsrcDateTime $j.fetchedAt
|            if ($j.documents) { foreach ($p in $j.documents.PSObject.Properties) { $c.Documents[$p.Name] = ConvertTo-SIMsrcStamp $p.Value } }
|            if ($j.kbs) { foreach ($p in $j.kbs.PSObject.Properties) { $d = ConvertTo-SIMsrcDate $p.Value; if ($d) { $c.Kbs[$p.Name] = $d } } }
|        } catch { }
|        $c
|    }
|    $s | Add-Member -MemberType ScriptMethod -Name Save -Value {
|        param($c)
|        if (-not $this.Path) { return }
|        $kbs = [ordered]@{}; foreach ($k in @($c.Kbs.Keys | Sort-Object)) { $kbs[$k] = ([datetime]$c.Kbs[$k]).ToString('yyyy-MM-dd') }
|        $doc = [ordered]@{ fetchedAt = ([datetime]$c.FetchedAt).ToUniversalTime().ToString('o'); documents = $c.Documents; kbs = $kbs }
|        $dir = Split-Path -Parent $this.Path
|        if ($dir -and -not (Test-Path -LiteralPath $dir)) { $null = New-Item -ItemType Directory -Path $dir -Force }
|        [IO.File]::WriteAllText($this.Path, ($doc | ConvertTo-Json -Depth 4 -Compress), (New-Object Text.UTF8Encoding($false)))
|    }
|    $s
|}
|
|function ConvertTo-SIMsrcDateTime {
|    <# PURE. A date-time (ISO text or a datetime) as UTC, or $null. #>
|    param($Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [datetime]) { return ([datetime]$Value).ToUniversalTime() }
|    $o = [datetime]::MinValue
|    if ([datetime]::TryParse(([string]$Value), [System.Globalization.CultureInfo]::InvariantCulture, ([System.Globalization.DateTimeStyles]::AdjustToUniversal -bor [System.Globalization.DateTimeStyles]::AssumeUniversal), [ref]$o)) { return [datetime]::SpecifyKind($o, [System.DateTimeKind]::Utc) }
|    $null
|}
|
|function Get-SIKbDateSqlReadSql {
|    <# Pro: the cached dates (sidata.KbReleaseDate; the state row Kb = '$state' carries the fetch time and the documents read). #>
|    "IF OBJECT_ID('sidata.KbReleaseDate') IS NULL BEGIN SELECT CAST(NULL AS NVARCHAR(16)) AS Kb, CAST(NULL AS DATE) AS ReleaseDate, CAST(NULL AS NVARCHAR(MAX)) AS Detail, CAST(NULL AS DATETIME2(0)) AS UpdatedAt WHERE 1 = 0; RETURN; END
|SELECT Kb, ReleaseDate, Detail, UpdatedAt FROM sidata.KbReleaseDate;"
|}
|
|function Get-SIKbDateSqlWriteSql {
|    <# Pro: the whole cache in ONE statement (@j = [{Kb, ReleaseDate, Detail}]); a KB keeps its earliest date. #>
|    @'
|IF OBJECT_ID('sidata.KbReleaseDate') IS NULL BEGIN SELECT 0; RETURN; END
|SET XACT_ABORT ON;
|BEGIN TRAN;
|MERGE sidata.KbReleaseDate AS t
|USING (SELECT Kb, TRY_CONVERT(date, ReleaseDate) AS ReleaseDate, Detail FROM OPENJSON(@j) WITH (Kb nvarchar(16), ReleaseDate nvarchar(10), Detail nvarchar(max) '$.Detail')) AS s
|ON t.Kb = s.Kb
|WHEN MATCHED THEN UPDATE SET ReleaseDate = CASE WHEN s.Kb = N'$state' OR t.ReleaseDate IS NULL OR s.ReleaseDate < t.ReleaseDate THEN s.ReleaseDate ELSE t.ReleaseDate END,
|                             Detail = s.Detail, UpdatedAt = SYSUTCDATETIME()
|WHEN NOT MATCHED THEN INSERT (Kb, ReleaseDate, Detail, UpdatedAt) VALUES (s.Kb, s.ReleaseDate, s.Detail, SYSUTCDATETIME());
|COMMIT;
|SELECT @@ROWCOUNT;
|'@
|}
|
|function New-SIKbDateSqlStore {
|    <# The Pro cache in sidata.KbReleaseDate, through the run's SQL invoke (& $Invoke $sql $params 'reader' | 'scalar'). #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke)
|    $s = [pscustomobject]@{ Kind = 'sql'; Invoke = $Invoke }
|    $s | Add-Member -MemberType ScriptMethod -Name Load -Value {
|        $c = @{ FetchedAt = $null; Documents = @{}; Kbs = @{} }
|        foreach ($r in @(& $this.Invoke (Get-SIKbDateSqlReadSql) @{} 'reader')) {
|            if ($null -eq $r) { continue }
|            $kb = [string]$r.Kb
|            if ($kb -eq '$state') {
|                $c.FetchedAt = ConvertTo-SIMsrcDateTime ([string]$r.UpdatedAt)
|                try { $j = ([string]$r.Detail) | ConvertFrom-Json; foreach ($p in $j.PSObject.Properties) { $c.Documents[$p.Name] = ConvertTo-SIMsrcStamp $p.Value } } catch { }
|                continue
|            }
|            $d = ConvertTo-SIMsrcDate $r.ReleaseDate; if ($kb -and $d) { $c.Kbs[$kb] = $d }
|        }
|        $c
|    }
|    $s | Add-Member -MemberType ScriptMethod -Name Save -Value {
|        param($c)
|        $rows = [System.Collections.Generic.List[object]]::new()
|        foreach ($k in @($c.Kbs.Keys)) { $rows.Add([ordered]@{ Kb = [string]$k; ReleaseDate = ([datetime]$c.Kbs[$k]).ToString('yyyy-MM-dd'); Detail = $null }) }
|        $rows.Add([ordered]@{ Kb = '$state'; ReleaseDate = ([datetime]$c.FetchedAt).ToString('yyyy-MM-dd'); Detail = ($c.Documents | ConvertTo-Json -Compress -Depth 3) })
|        $null = & $this.Invoke (Get-SIKbDateSqlWriteSql) @{ j = (ConvertTo-Json -InputObject $rows.ToArray() -Compress -Depth 3) } 'scalar'
|    }
|    $s
|}
|
|function Invoke-SIMsrcGet {
|    <# One GET of the public MSRC API as JSON (REST only; 30 s; no sign-in). #>
|    param([Parameter(Mandatory)][string]$Url)
|    Invoke-RestMethod -Method Get -Uri $Url -Headers @{ Accept = 'application/json' } -TimeoutSec 30 -ErrorAction Stop
|}
|
|function Initialize-SIKbReleaseDates {
|    <#
|    .SYNOPSIS  Once per run: the KB release dates into memory (Get-SIKbReleaseDate reads them), from the install's cache and,
|               when the cache is older than a day, the MSRC API (only the documents that are new or revised). Never throws:
|               a refused / failed call is said in ONE line and the cache (and the name rule) is used. Returns the number of KBs.
|               -Fetch: the GET (tests pass a fake); -Now: the clock (tests).
|    #>
|    param($Store, [scriptblock]$Fetch, $Now, [scriptblock]$Log)
|    if ($null -eq $Log) { $Log = { param($l, $m) } }
|    if ($null -eq $Fetch) { $Fetch = { param($u) Invoke-SIMsrcGet -Url $u } }
|    $at = $(if ($null -ne $Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow })
|    $cache = @{ FetchedAt = $null; Documents = @{}; Kbs = @{} }
|    if ($null -ne $Store) { try { $cache = $Store.Load() } catch { & $Log 'INFO' ('the cached Microsoft update release dates could not be read ({0}) -- they are read again' -f $_.Exception.Message) } }
|    $script:SIKbReleaseDates = $cache.Kbs
|    if (-not (Test-SIMsrcDatesOn)) {
|        & $Log 'INFO' 'patch cycle: the Microsoft update release dates are not read (SI_PatchCycle_MsrcDates is off) -- the update names'' Patch Tuesday is used'
|        return $cache.Kbs.Count
|    }
|    if ($null -ne $cache.FetchedAt -and ($at - [datetime]$cache.FetchedAt).TotalHours -lt 24 -and $cache.Kbs.Count -gt 0) { return $cache.Kbs.Count }
|    try {
|        $docs = ConvertFrom-SIMsrcUpdateList (& $Fetch ($script:SIMsrcBase + '/updates'))
|        $from = $at.AddMonths(-(Get-SIMsrcMonths))
|        $read = 0; $notRead = 0
|        foreach ($d in $docs) {
|            if ($null -ne $d.Release -and $d.Release -lt $from) { continue }
|            if ($cache.Documents.ContainsKey($d.Id) -and [string]$cache.Documents[$d.Id] -eq [string]$d.Current) { continue }
|            # ONE DOCUMENT FAILS ALONE: a document that cannot be read (a bad address, a time-out) is said once (its address
|            # in the verbose log) and NOT marked read, so it is asked again next run; every other document is kept and saved
|            try {
|                $kbs = ConvertFrom-SIMsrcDocument -Document (& $Fetch $d.Url) -Release $d.Release
|            } catch {
|                $notRead++
|                Write-Verbose ('patch cycle: the release document {0} ({1}) could not be read -- {2}' -f $d.Id, $d.Url, $_.Exception.Message)
|                continue
|            }
|            $null = Merge-SIKbReleaseDates -Into $cache.Kbs -From $kbs
|            $cache.Documents[$d.Id] = [string]$d.Current
|            $read++
|        }
|        if ($notRead -gt 0) { & $Log 'INFO' ('patch cycle: {0} of the Security Update Guide''s release documents could not be read this run -- the others are kept, and those are read again next run' -f $notRead) }
|        # a document not read makes the cache a day old, so the next run asks for it (and only it) again
|        $cache.FetchedAt = $(if ($notRead -gt 0) { $at.AddHours(-24) } else { $at })
|        if ($null -ne $Store) { try { $Store.Save($cache) } catch { & $Log 'INFO' ('the Microsoft update release dates could not be kept ({0}) -- they are read again next run' -f $_.Exception.Message) } }
|        $script:SIKbReleaseDates = $cache.Kbs
|        if ($read -gt 0) { & $Log 'INFO' ('patch cycle: the release dates of {0} Microsoft update(s) known ({1} release document(s) read from the Security Update Guide)' -f $cache.Kbs.Count, $read) }
|    } catch {
|        & $Log 'INFO' ('patch cycle: the Microsoft update release dates could not be read from api.msrc.microsoft.com ({0}) -- {1} cached date(s) and, for the rest, the update names'' Patch Tuesday are used' -f $_.Exception.Message, $cache.Kbs.Count)
|    }
|    $cache.Kbs.Count
|}
|
|function Get-SIKbReleaseDate {
|    <# PURE over the loaded dates. The newest release date of the KBs given (a fix that needs several is released when the last is), or $null. #>
|    param([string[]]$Kbs, [hashtable]$Dates = $script:SIKbReleaseDates)
|    if ($null -eq $Dates -or $Dates.Count -eq 0) { return $null }
|    $best = $null
|    foreach ($k in $Kbs) { if ($k -and $Dates.ContainsKey($k)) { $d = $Dates[$k]; if ($null -eq $best -or $d -gt $best) { $best = $d } } }
|    $best
|}
'@ }
$__siSupportFiles['engine/data-model/SI-FindingTexts.ps1'] = @{ Sha256 = 'd966ca27bd000b653b47a7477dbf4f70fcf4c7c39d49209b1b8370c3283f2eca'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE GENERIC SI FINDING FIELDS OF SI'S OWN REPORTS, AS DATA (REQUIREMENTS #560).
|
|    TEMPLATE  data-model/finding-texts.locked.json (kind 'finding-text', items 'reports', key = the report name):
|                reports[]   { id (ReportName), securityDomain, source report | provider,
|                              si_description / si_remediation / si_remediation_type / si_reference_url /
|                              si_compliance_tags / si_mitre_tactics / si_mitre_techniques ... (any SI finding field) }
|                rowColumns  SI finding field -> the Risk Analysis row columns that fill it (first non-empty)
|                inference   mitre / compliance: keyword rows (first match) + the security domain's default -- what a row
|                            gets when neither its source nor its report says (the rows the engine held in code before)
|    CUSTOMER  Pro: one cfg.ItemOverride per report ('finding-texts:<report>'); Community: finding-texts.custom.json.
|
|    WHO FILLS WHAT (one rule, every finding):
|      1. the row's own columns (the source's text: Defender's description, remediation, KB tags / MITRE ...) -- rowColumns
|      2. the report's item (SI's own text: what the finding is, how to fix it, its compliance and MITRE references)
|      3. MITRE / compliance only: the inference rows over SecurityDomain + Subcategory + ConfigurationName, then the
|         security domain's default
|      4. nothing says: the field is absent -- unknown, never guessed.
|
|    PURE except Get-SIFindingTextCatalog (reads the template). PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Get-SIItemValue -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-Conditions.ps1') }
|
|$script:SIFindingTextCache = $null
|
|function Test-SIFindingTextItem {
|    <# PURE. The reasons one report item is not accepted (empty = accepted). -FindingFields: the catalog's finding field names (optional). #>
|    param($Item, [string[]]$FindingFields)
|    $why = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Item) { $why.Add('a finding-text item is empty'); return $why.ToArray() }
|    $id = [string](Get-SIItemValue $Item 'id')
|    if ($id -notmatch '^[A-Za-z0-9][A-Za-z0-9_\-\.]{0,199}$') { $why.Add(("finding-texts: '{0}' is not a report name" -f $id)) }
|    $src = [string](Get-SIItemValue $Item 'source')
|    if ($src -and $src -notin 'report', 'provider') { $why.Add(("finding-texts/{0}: source '{1}' (report | provider)" -f $id, $src)) }
|    $rt = [string](Get-SIItemValue $Item 'si_remediation_type')
|    if ($rt -and $rt -notin 'patch', 'configuration', 'upgrade', 'policy', 'manual') { $why.Add(("finding-texts/{0}: si_remediation_type '{1}' (patch | configuration | upgrade | policy | manual)" -f $id, $rt)) }
|    $props = @(); if ($Item -is [System.Collections.IDictionary]) { $props = @($Item.Keys) } else { $props = @($Item.PSObject.Properties.Name) }
|    foreach ($p in $props) {
|        if ($p -in 'id', 'securityDomain', 'source', 'note', 'remove', 'baseHash') { continue }
|        if ($p -cnotmatch '^si_[a-z0-9_]+$') { $why.Add(("finding-texts/{0}: '{1}' is not an SI field" -f $id, $p)); continue }
|        if ($FindingFields -and $FindingFields -notcontains $p) { $why.Add(("finding-texts/{0}: '{1}' is not a finding field of the catalog" -f $id, $p)) }
|    }
|    foreach ($p in 'si_mitre_tactics') { foreach ($v in (Get-SIValueList (Get-SIItemValue $Item $p))) { if ($v -and [string]$v -notmatch '^TA\d{4}$') { $why.Add(("finding-texts/{0}: tactic '{1}' is not TA####" -f $id, $v)) } } }
|    foreach ($p in 'si_mitre_techniques') { foreach ($v in (Get-SIValueList (Get-SIItemValue $Item $p))) { if ($v -and [string]$v -notmatch '^T\d{4}(\.\d{3})?$') { $why.Add(("finding-texts/{0}: technique '{1}' is not T####" -f $id, $v)) } } }
|    $why.ToArray()
|}
|
|function Test-SIFindingTexts {
|    <# PURE. The whole template: every report item valid and once, every inference row's pattern compiles, every rowColumns field an SI field. #>
|    param($Document, [string[]]$FindingFields)
|    $p = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Document) { return $p.ToArray() }
|    $ids = @{}
|    foreach ($r in @(Get-SIItemValue $Document 'reports')) {
|        if ($null -eq $r) { continue }
|        foreach ($x in (Test-SIFindingTextItem -Item $r -FindingFields $FindingFields)) { $p.Add([string]$x) }
|        $id = [string](Get-SIItemValue $r 'id'); if ($ids.ContainsKey($id)) { $p.Add(("finding-texts: report '{0}' is listed twice" -f $id)) }; $ids[$id] = 1
|    }
|    $inf = Get-SIItemValue $Document 'inference'
|    foreach ($k in 'mitre', 'compliance') {
|        foreach ($r in @(Get-SIItemValue $inf $k)) {
|            if ($null -eq $r) { continue }
|            try { [void][regex]::new([string](Get-SIItemValue $r 'match')) } catch { $p.Add(("finding-texts: inference {0}/{1} has an invalid pattern" -f $k, [string](Get-SIItemValue $r 'id'))) }
|        }
|    }
|    $rc = Get-SIItemValue $Document 'rowColumns'
|    if ($null -ne $rc) { foreach ($pp in $rc.PSObject.Properties) { if ($pp.Name -cnotmatch '^si_[a-z0-9_]+$' -or ($FindingFields -and $FindingFields -notcontains $pp.Name)) { $p.Add(("finding-texts: rowColumns '{0}' is not a finding field" -f $pp.Name)) } } }
|    $p.ToArray()
|}
|
|function ConvertTo-SIFindingTextCatalog {
|    <# PURE. The merged template -> @{ Reports (name -> item, case-insensitive); RowColumns; Mitre; MitreDomains; Compliance; ComplianceDomains }. #>
|    param($Document)
|    $rep = New-Object System.Collections.Hashtable ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($r in @(Get-SIItemValue $Document 'reports')) { if ($null -ne $r -and @(Test-SIFindingTextItem -Item $r).Count -eq 0) { $rep[[string]$r.id] = $r } }
|    $inf = Get-SIItemValue $Document 'inference'
|    @{ Reports = $rep; RowColumns = (Get-SIItemValue $Document 'rowColumns')
|       Mitre = @(Get-SIItemValue $inf 'mitre'); MitreDomains = (Get-SIItemValue $inf 'mitreDomains')
|       Compliance = @(Get-SIItemValue $inf 'compliance'); ComplianceDomains = (Get-SIItemValue $inf 'complianceDomains') }
|}
|
|function Get-SIFindingTextCatalog {
|    <# The merged template, read once per process; $null when it cannot be read (nothing is filled -- never fails). #>
|    param([string]$Root, [string]$OverlayRoot = $global:SI_DataModelOverlayRoot, [switch]$Refresh)
|    if ($script:SIFindingTextCache -and -not $Refresh -and -not $Root) { return $script:SIFindingTextCache }
|    try {
|        if (-not (Get-Command -Name Get-SIDataModelTemplate -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-DataModelTemplates.ps1') }
|        $r = Get-SIDataModelRoot $Root
|        if (-not (Test-Path -LiteralPath (Join-Path $r 'finding-texts.locked.json'))) {
|            $r = Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'data-model'
|            if (-not (Test-Path -LiteralPath (Join-Path $r 'finding-texts.locked.json'))) { return $null }
|        }
|        $doc = (Get-SIDataModelTemplate -Name 'finding-texts' -Root $r -OverlayRoot $OverlayRoot).Document
|        foreach ($p in (Test-SIFindingTexts -Document $doc)) { Write-Warning ('finding texts: {0}' -f $p) }
|        $cat = ConvertTo-SIFindingTextCatalog -Document $doc
|        if (-not $Root) { $script:SIFindingTextCache = $cat }
|        return $cat
|    } catch {
|        Write-Warning ('finding texts could not be read -- {0}. The generic finding fields keep what the rows say.' -f $_.Exception.Message)
|        return $null
|    }
|}
|
|function Resolve-SIFindingTextInference {
|    <#
|    .SYNOPSIS  PURE. MITRE or compliance references for a row nothing else describes: the first inference row whose pattern
|               matches -Blob (case-insensitive), else the security domain's default, else nothing.
|    .OUTPUTS   @{ Tactics; Techniques } (mitre) or @{ Tags } (compliance), each a ';'-joined string ('' = none)
|    #>
|    param([Parameter(Mandatory)]$Catalog, [ValidateSet('mitre', 'compliance')][string]$Kind, [AllowEmptyString()][string]$Blob = '', [AllowEmptyString()][string]$Domain = '')
|    $rows = $Catalog.Mitre; $doms = $Catalog.MitreDomains
|    if ($Kind -eq 'compliance') { $rows = $Catalog.Compliance; $doms = $Catalog.ComplianceDomains }
|    $hit = $null
|    foreach ($r in @($rows)) {
|        if ($null -eq $r) { continue }
|        $pat = [string](Get-SIItemValue $r 'match'); if (-not $pat) { continue }
|        $ok = $false; try { $ok = [regex]::IsMatch($Blob, $pat, [System.Text.RegularExpressions.RegexOptions]::IgnoreCase, [TimeSpan]::FromMilliseconds(200)) } catch { $ok = $false }
|        if ($ok) { $hit = $r; break }
|    }
|    if ($null -eq $hit -and $Domain -and $null -ne $doms) { $hit = Get-SIItemValue $doms $Domain }
|    $j = { param($o, $n) (((Get-SIValueList (Get-SIItemValue $o $n)).ToArray() | Where-Object { $_ }) -join ';') }
|    if ($Kind -eq 'mitre') { return @{ Tactics = $(if ($hit) { & $j $hit 'si_mitre_tactics' } else { '' }); Techniques = $(if ($hit) { & $j $hit 'si_mitre_techniques' } else { '' }) } }
|    @{ Tags = $(if ($hit) { & $j $hit 'si_compliance_tags' } else { '' }) }
|}
|
|function Get-SIFindingTextReport {
|    <# PURE. The report's item of the catalog, or $null. #>
|    param($Catalog, [AllowEmptyString()][string]$ReportName)
|    if ($null -eq $Catalog -or -not $ReportName) { return $null }
|    if ($Catalog.Reports.ContainsKey($ReportName)) { return $Catalog.Reports[$ReportName] }
|    $null
|}
|
|function ConvertTo-SIFindingTextFields {
|    <#
|    .SYNOPSIS  PURE. The generic SI finding fields of one Risk Analysis row: the row's own columns (rowColumns, first
|               non-empty), then the report's item for what the row left empty. Lists (compliance, MITRE, affected
|               software, fix references) become lists; a field nothing fills is absent.
|    .OUTPUTS   ordered hashtable si_* -> value
|    #>
|    param([Parameter(Mandatory)]$Row, $Catalog, [AllowEmptyString()][string]$ReportName = '')
|    $out = [ordered]@{}
|    if ($null -eq $Catalog) { return $out }
|    $lists = @('si_compliance_tags', 'si_mitre_tactics', 'si_mitre_techniques', 'si_affected_product', 'si_affected_vendor', 'si_affected_version', 'si_fix_reference')
|    $norm = {
|        param([string]$f, $v)
|        if ($null -eq $v) { return $null }
|        if ($lists -contains $f) {
|            $xs = @(foreach ($x in (Get-SIValueList $v)) { foreach ($y in ([string]$x).Split(';')) { $t = $y.Trim(); if ($t) { $t } } })
|            if ($xs.Count -eq 0) { return $null }
|            return , ([string[]]@($xs | Select-Object -Unique))
|        }
|        $s = ([string]$v).Trim(); if (-not $s) { return $null }
|        $s
|    }
|    $rc = $Catalog.RowColumns
|    if ($null -ne $rc) {
|        foreach ($pp in $rc.PSObject.Properties) {
|            # Get-SIValueList returns its list whole: @() around it would make the column list ONE item ("A B C")
|            foreach ($col in (Get-SIValueList $pp.Value)) {
|                $v = & $norm $pp.Name (Get-SIItemValue $Row ([string]$col))
|                if ($null -ne $v) { $out[$pp.Name] = $v; break }
|            }
|        }
|    }
|    $rep = Get-SIFindingTextReport -Catalog $Catalog -ReportName $ReportName
|    if ($null -ne $rep) {
|        foreach ($pp in $rep.PSObject.Properties) {
|            if ($pp.Name -cnotmatch '^si_[a-z0-9_]+$' -or $out.Contains($pp.Name)) { continue }
|            $v = & $norm $pp.Name $pp.Value
|            if ($null -ne $v) { $out[$pp.Name] = $v }
|        }
|    }
|    $out
|}
'@ }
$__siSupportFiles['engine/data-model/SI-AzureChildren.ps1'] = @{ Sha256 = '67f850d5cbed4c161da98720f747b985bba2f39d544711c7495997d3fca19abc'; Text = @'
|#Requires -Version 5.1
|<#
|    AZURE CHILD RESOURCES ROLL UP INTO THEIR PARENT, AND ONLY THE LISTED TYPES BECOME CIs (owner 2026-10-11: "extensions
|    suddenly show as risk from azure ... we had defined some classes that we excluded. chk v2.2 code").
|
|    The list is data-model/collection-scope azureResourceTypes (customer-extendable like every data-model list:
|    collection-scope.custom.json, or the Pro data-model settings 'collection-scope:<type>'):
|      * a listed type WITHOUT rollUpInto is a CI type: its resources are recorded and become CIs
|      * a listed type WITH rollUpInto is a CHILD (v2.2 asset-profiling-schema SCHEMA subResourceRollupRules): never a record
|        of its own -- it becomes a PART of its parent's record ('child|<child id>'), listed on the parent CI in
|        rollUpInto.field (si_vm_extensions, si_disks, ...) and si_child_resources, and its id is a linked object of the parent
|        CI (sidata.CiLink, SI_CI_CL si_linked_objects) -- so a finding on the child's id lands on the parent CI
|          rollUpInto.parentBy     'path' (the ARM id one level up) or dot paths into the ARM object (managedBy,
|                                  properties.virtualMachine.id, properties.ipConfiguration.id), tried in order; the id
|                                  found is walked up until its type is one of parentTypes
|          rollUpInto.keepOwnCi    the type stays a CI of its own and is ALSO listed on its parent (a public IP)
|          rollUpInto.shape        what the parent lists of each child: { <name>: <dot path into the ARM object> }
|      * a nested type that is NOT listed (microsoft.web/sites/slots) is a child of its path parent when that parent is
|        listed; any other type is NOT recorded
|    A CI that a type no longer recorded had (a VM extension, a data collection rule) is never deleted: its records age, it is
|    not seen, and the CI build retires it once nothing has recorded it within the lookback.
|
|    PURE except the cached scope loader (Get-SIAzureCiScope). PowerShell 5.1 safe: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Get-SIItemValue -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-Conditions.ps1') }
|
|$script:SIAzureTypePattern = '(microsoft\.[a-z0-9]+/[a-z0-9/]+)'
|
|function ConvertTo-SIArmTypeName {
|    <# PURE. A resource type or an Exposure Graph node label ('microsoft.web/sites_webapp') -> the lower-case ARM type; ''. #>
|    param([AllowNull()][AllowEmptyString()][string]$Type)
|    if ([string]::IsNullOrWhiteSpace($Type)) { return '' }
|    $m = [regex]::Match($Type.Trim().ToLowerInvariant(), $script:SIAzureTypePattern)
|    if ($m.Success) { return $m.Groups[1].Value.TrimEnd('/') }
|    return ''
|}
|
|function Get-SIArmIdInfo {
|    <#
|        PURE. An ARM resource id -> @{ Id; Type; Name; Parent } (lower case), or $null when it is not a resource id.
|        Type is read after the LAST '/providers/' (an extension resource is typed by its own provider); Parent is the id one
|        level up in the same provider ('' for a top-level resource).
|          .../providers/Microsoft.Compute/virtualMachines/vm1/extensions/MDE.Windows
|            -> Type microsoft.compute/virtualmachines/extensions, Name mde.windows, Parent .../virtualmachines/vm1
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Id)
|    $s = ([string]$Id).Trim().TrimEnd('/').ToLowerInvariant()
|    if (-not $s.StartsWith('/subscriptions/')) { return $null }
|    $i = $s.LastIndexOf('/providers/')
|    if ($i -lt 0) { return $null }
|    $head = $s.Substring(0, $i)
|    $segs = $s.Substring($i + 11).Split('/')
|    if ($segs.Count -lt 3 -or (($segs.Count - 1) % 2) -ne 0) { return $null }
|    foreach ($x in $segs) { if (-not $x) { return $null } }
|    $types = New-Object System.Collections.Generic.List[string]
|    for ($k = 1; $k -lt $segs.Count; $k += 2) { $types.Add($segs[$k]) }
|    $parent = ''
|    if ($segs.Count -gt 3) { $parent = $head + '/providers/' + ($segs[0..($segs.Count - 3)] -join '/') }
|    return @{ Id = $s; Type = ($segs[0] + '/' + ($types.ToArray() -join '/')); Name = $segs[$segs.Count - 1]; Parent = $parent }
|}
|
|function Get-SIAzureObjectValues {
|    <# PURE. Every value at a dot path in an object ('a.b[*].c' walks the array b; JSON text met on the way is parsed). #>
|    param($Object, [string]$Path)
|    $cur = New-Object System.Collections.Generic.List[object]
|    if ($null -eq $Object -or -not $Path) { return , $cur }
|    $cur.Add($Object)
|    foreach ($segRaw in $Path.Split('.')) {
|        $walk = $segRaw.EndsWith('[*]'); $seg = $segRaw; if ($walk) { $seg = $segRaw.Substring(0, $segRaw.Length - 3) }
|        $next = New-Object System.Collections.Generic.List[object]
|        foreach ($o in $cur) {
|            $node = $o
|            if ($node -is [string]) { $t = $node.Trim(); if ($t.StartsWith('{') -or $t.StartsWith('[')) { try { $node = $t | ConvertFrom-Json } catch { continue } } else { continue } }
|            $v = $null
|            if ($node -is [System.Collections.IDictionary]) { foreach ($k in $node.Keys) { if ([string]::Equals([string]$k, $seg, [StringComparison]::OrdinalIgnoreCase)) { $v = $node[$k]; break } } }
|            elseif ($null -ne $node) { $pp = $node.PSObject.Properties[$seg]; if ($pp) { $v = $pp.Value } }
|            if ($null -eq $v) { continue }
|            if ($v -is [string] -and $walk) { $t = $v.Trim(); if ($t.StartsWith('[')) { try { $v = $t | ConvertFrom-Json } catch { } } }
|            if ($walk -and $v -is [System.Collections.IEnumerable] -and -not ($v -is [string]) -and -not ($v -is [System.Collections.IDictionary])) { foreach ($x in $v) { if ($null -ne $x) { $next.Add($x) } } }
|            else { $next.Add($v) }
|        }
|        $cur = $next
|    }
|    return , $cur
|}
|
|function ConvertTo-SIAzureCiScope {
|    <#
|        PURE. The collection-scope document -> @{ Top (the CI types); Rules (child type -> @{ Type; ParentTypes; ParentBy;
|        Field; Shape; KeepOwnCi }) }. A keepOwnCi type is in Top AND has a rule.
|    #>
|    param($Document)
|    $top = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $rules = @{}
|    foreach ($it in @(Get-SIItemValue $Document 'azureResourceTypes')) {
|        if ($null -eq $it) { continue }
|        $t = ConvertTo-SIArmTypeName ([string](Get-SIItemValue $it 'type'))
|        if (-not $t) { continue }
|        $r = Get-SIItemValue $it 'rollUpInto'
|        if ($null -eq $r) { [void]$top.Add($t); continue }
|        $keep = (ConvertTo-SIBoolOrNull (Get-SIItemValue $r 'keepOwnCi')) -eq $true
|        $by = @(@(Get-SIItemValue $r 'parentBy') | Where-Object { $_ } | ForEach-Object { [string]$_ })
|        if ($by.Count -eq 0) { $by = @('path') }
|        $shape = [ordered]@{}
|        $sh = Get-SIItemValue $r 'shape'
|        if ($null -ne $sh) {
|            if ($sh -is [System.Collections.IDictionary]) { foreach ($k in $sh.Keys) { $shape[[string]$k] = [string]$sh[$k] } }
|            else { foreach ($pp in $sh.PSObject.Properties) { if (-not $pp.Name.StartsWith('$')) { $shape[$pp.Name] = [string]$pp.Value } } }
|        }
|        $rules[$t] = @{
|            Type = $t; KeepOwnCi = $keep; ParentBy = $by; Field = [string](Get-SIItemValue $r 'field'); Shape = $shape
|            ParentTypes = @(@(Get-SIItemValue $r 'parentTypes') | ForEach-Object { ConvertTo-SIArmTypeName ([string]$_) } | Where-Object { $_ })
|        }
|        if ($keep) { [void]$top.Add($t) }
|    }
|    return @{ Top = $top; Rules = $rules }
|}
|
|function Test-SIAzureCiScopeItems {
|    <# PURE. The problems of a collection-scope document's rollUpInto items (Test-SIDataModel): '<type>: <problem>'. #>
|    param($Document, [hashtable]$Fields = @{})
|    foreach ($it in @(Get-SIItemValue $Document 'azureResourceTypes')) {
|        if ($null -eq $it) { continue }
|        $t = [string](Get-SIItemValue $it 'type')
|        if (-not (ConvertTo-SIArmTypeName $t)) { "'$t' is not an Azure resource type (microsoft.<namespace>/<type>)"; continue }
|        $r = Get-SIItemValue $it 'rollUpInto'
|        if ($null -eq $r) { continue }
|        $pt = @(@(Get-SIItemValue $r 'parentTypes') | Where-Object { $_ })
|        if ($pt.Count -eq 0) { "'$t' rollUpInto names no parentTypes" }
|        foreach ($b in @(Get-SIItemValue $r 'parentBy')) { if ($b -and [string]$b -ne 'path' -and [string]$b -notmatch '^[A-Za-z][A-Za-z0-9_]*(\[\*\])?(\.[A-Za-z][A-Za-z0-9_]*(\[\*\])?)*$') { "'$t' rollUpInto parentBy '$b' is neither 'path' nor a dot path" } }
|        $f = [string](Get-SIItemValue $r 'field')
|        if ($f -and $Fields.Count -gt 0 -and -not $Fields.ContainsKey($f)) { "'$t' rollUpInto field '$f' is not in the field catalog" }
|    }
|}
|
|function Set-SIAzureCiScope {
|    <# The scope this process uses (tests; a caller that already holds the model). $null = load it again on the next use. #>
|    param($Scope)
|    $script:SIAzureCiScope = $Scope
|    $script:SIAzureCiScopeLoaded = ($null -ne $Scope)
|}
|
|function Get-SIAzureCiScope {
|    <#
|        The Azure CI scope of this install, read ONCE per process: the merged collection-scope template (shipped + the
|        customer's overrides). Cannot be read: said once, and every Azure type is recorded as before ($null) -- never fewer
|        records because a file could not be read.
|    #>
|    if ($script:SIAzureCiScopeLoaded) { return $script:SIAzureCiScope }
|    $script:SIAzureCiScopeLoaded = $true
|    $script:SIAzureCiScope = $null
|    try {
|        if (-not (Get-Command -Name Get-SIDataModelTemplate -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-DataModelTemplates.ps1') }
|        $t = Get-SIDataModelTemplate -Name 'collection-scope' -OverlayRoot $global:SI_DataModelOverlayRoot
|        $script:SIAzureCiScope = ConvertTo-SIAzureCiScope -Document $t.Document
|    } catch {
|        Write-Warning ('Azure resources: the list of Azure resource types that become CIs could not be read ({0}) -- every Azure resource is recorded this run.' -f $_.Exception.Message)
|    }
|    return $script:SIAzureCiScope
|}
|
|function Resolve-SIAzureParentAncestor {
|    <# PURE. An ARM id walked up its path until its type is one of -ParentTypes -> that id (lower), else ''. #>
|    param([AllowNull()][AllowEmptyString()][string]$Id, [string[]]$ParentTypes = @())
|    $info = Get-SIArmIdInfo $Id
|    for ($i = 0; $i -lt 8 -and $null -ne $info; $i++) {
|        if ($ParentTypes.Count -eq 0 -or $ParentTypes -contains $info.Type) { return $info.Id }
|        if (-not $info.Parent) { break }
|        $info = Get-SIArmIdInfo $info.Parent
|    }
|    return ''
|}
|
|function Get-SIAzureChildParentId {
|    <# PURE. The parent of a child resource by its rule (parentBy in order), else the capture's known parent of it, else ''. #>
|    # -KnownParents: a hashtable or the producer's on-disk child map (SecurityInsight.DiskTextLookup, #727) -- both answer
|    # ContainsKey and [key]
|    param($Info, $Object, [Parameter(Mandatory)]$Rule, $KnownParents)
|    foreach ($by in @($Rule.ParentBy)) {
|        $cand = ''
|        if ([string]$by -eq 'path') { if ($Info) { $cand = [string]$Info.Parent } }
|        else { foreach ($v in (Get-SIAzureObjectValues -Object $Object -Path ([string]$by))) { if ($v -is [string] -and $v.Trim()) { $cand = $v.Trim(); break } } }
|        if (-not $cand) { continue }
|        $p = Resolve-SIAzureParentAncestor -Id $cand -ParentTypes @($Rule.ParentTypes)
|        if ($p) { return $p }
|    }
|    if ($KnownParents -and $Info -and $KnownParents.ContainsKey([string]$Info.Id)) { return [string]$KnownParents[[string]$Info.Id] }
|    return ''
|}
|
|function Resolve-SIAzurePlacement {
|    <#
|    .SYNOPSIS  PURE. Where an Azure object goes in the data model.
|    .OUTPUTS   @{ Action = record | child | drop; Id; Type; ParentId (child); Rule (child / keepOwnCi); AlsoChildOf (a keepOwnCi
|               type: the parent it is also listed on, '' when none); Reason (drop) }
|               No scope ($null): every object is a record, as before.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Id, [AllowNull()][AllowEmptyString()][string]$Type = '', $Object, $Scope, $KnownParents)
|    $info = Get-SIArmIdInfo $Id
|    $t = ConvertTo-SIArmTypeName $Type
|    if (-not $t -and $info) { $t = $info.Type }
|    $res = @{ Action = 'record'; Id = ([string]$Id).Trim().ToLowerInvariant(); Type = $t; ParentId = ''; Rule = $null; AlsoChildOf = ''; Reason = '' }
|    if ($null -eq $Scope -or -not $t) { return $res }
|    $rule = $Scope.Rules[$t]
|    if ($null -ne $rule) {
|        $p = Get-SIAzureChildParentId -Info $info -Object $Object -Rule $rule -KnownParents $KnownParents
|        $res.Rule = $rule
|        if ($rule.KeepOwnCi) { $res.AlsoChildOf = $p; return $res }
|        if (-not $p) { $res.Action = 'drop'; $res.Reason = 'a child resource whose parent is not known'; return $res }
|        $res.Action = 'child'; $res.ParentId = $p
|        return $res
|    }
|    if ($Scope.Top.Contains($t)) { return $res }
|    if ($info -and $info.Parent) {
|        $pi = Get-SIArmIdInfo $info.Parent
|        if ($pi -and ($Scope.Top.Contains($pi.Type) -or $Scope.Rules.ContainsKey($pi.Type))) { $res.Action = 'child'; $res.ParentId = $pi.Id; return $res }
|    }
|    $res.Action = 'drop'; $res.Reason = 'not a CI type (collection-scope azureResourceTypes)'
|    return $res
|}
|
|function New-SIAzureChildSummary {
|    <#
|        PURE. What the parent keeps of one child: { id; type; name; field (the parent's list it belongs to, '' = only
|        si_child_resources); shape (the rule's shape values read from the ARM object) }.
|    #>
|    param([Parameter(Mandatory)][string]$Id, [string]$Type = '', $Object, $Rule)
|    $info = Get-SIArmIdInfo $Id
|    $t = ConvertTo-SIArmTypeName $Type; if (-not $t -and $info) { $t = $info.Type }
|    $name = ''
|    foreach ($v in (Get-SIAzureObjectValues -Object $Object -Path 'name')) { if ($v -is [string] -and $v.Trim()) { $name = $v.Trim(); break } }
|    if (-not $name -and $info) { $name = $info.Name }
|    $o = [ordered]@{ id = $Id.Trim().ToLowerInvariant(); type = $t; name = $name }
|    $field = ''; if ($null -ne $Rule -and $Rule.Field) { $field = [string]$Rule.Field }
|    $o['field'] = $field
|    $shape = [ordered]@{}
|    if ($null -ne $Rule -and $null -ne $Rule.Shape) {
|        foreach ($k in @($Rule.Shape.Keys)) {
|            $path = [string]$Rule.Shape[$k]
|            if ($k -eq 'name') { $shape['name'] = $name; continue }
|            # assigned first: the call hands back ONE list (', $list'), which a pipeline would pass on as one item
|            $raw = Get-SIAzureObjectValues -Object $Object -Path $path
|            $vals = @($raw | Where-Object { $null -ne $_ -and -not ($_ -is [string] -and -not $_.Trim()) })
|            if ($vals.Count -eq 1) { $shape[$k] = $vals[0] } elseif ($vals.Count -gt 1) { $shape[$k] = $vals }
|        }
|    }
|    if ($shape.Count -eq 0) { $shape['name'] = $name }
|    $o['shape'] = [pscustomobject]$shape
|    return [pscustomobject]$o
|}
|
|function Get-SIAzureEgArmId {
|    <# PURE. The Azure resource id an Exposure Graph node names (EntityIds: { type AzureResourceId; id }), lower case; ''. #>
|    param($Node)
|    $e = Get-SIItemValue $Node 'EntityIds'
|    if ($e -is [string]) { $s = $e.Trim(); if ($s.StartsWith('[') -or $s.StartsWith('{')) { try { $e = $s | ConvertFrom-Json } catch { $e = $null } } }
|    foreach ($x in @($e)) {
|        if ($null -eq $x) { continue }
|        if ([string](Get-SIItemValue $x 'type') -eq 'AzureResourceId') { $id = ([string](Get-SIItemValue $x 'id')).Trim(); if ($id) { return $id.ToLowerInvariant() } }
|    }
|    return ''
|}
|
|function Get-SIAzurePipVia {
|    <# PURE. What a public IP address's ARM object says it is attached through: properties.ipConfiguration.id, else a NAT
|       gateway (properties.natGateway.id) -- lower case; '' when it is not attached. Properties kept as JSON text are parsed. #>
|    param($Resource)
|    if ($null -eq $Resource) { return '' }
|    $props = Get-SIItemValue $Resource 'properties'
|    if ($props -is [string]) { try { $props = $props | ConvertFrom-Json } catch { $props = $null } }
|    $via = ([string](Get-SIItemValue (Get-SIItemValue $props 'ipConfiguration') 'id')).Trim().ToLowerInvariant()
|    if (-not $via) { $via = ([string](Get-SIItemValue (Get-SIItemValue $props 'natGateway') 'id')).Trim().ToLowerInvariant() }
|    return $via
|}
|
|# ---------------------------------------------------------------------------------------------------------------------
|#  The capture state: the children as parts of their parent's record
|# ---------------------------------------------------------------------------------------------------------------------
|$script:SIRecordOwnlessParts = @('parentTags', 'parentTagScopes', 'egQueryRules', 'si_scope', 'diag')
|
|function Test-SIRecordChildOnly {
|    <# PURE. A captured record that holds child parts and no provider object of its own (its parent was not captured here). #>
|    param($Record)
|    if ($null -eq $Record -or $null -eq $Record.Parts) { return $false }
|    $child = $false
|    foreach ($k in @($Record.Parts.Keys)) {
|        $s = [string]$k
|        if ($s.StartsWith('child|')) { $child = $true; continue }
|        if ($script:SIRecordOwnlessParts -contains $s) { continue }
|        return $false
|    }
|    return $child
|}
|
|function Get-SIRecordChildState {
|    <# The capture state's child bookkeeping (created on first use): ChildOf (child id -> parent id), Dropped (reason -> count). #>
|    param($State)
|    if ($null -eq $State) { return $null }
|    if (-not $State.PSObject.Properties['ChildOf']) { $State | Add-Member -NotePropertyName 'ChildOf' -NotePropertyValue (@{}) -Force }
|    if (-not $State.PSObject.Properties['Dropped']) { $State | Add-Member -NotePropertyName 'Dropped' -NotePropertyValue (@{}) -Force }
|    return $State
|}
|
|function Resolve-SIRecordChildren {
|    <#
|        PURE over the capture state. A record made only of child parts whose OWN id is a child of another captured record (a
|        public IP's link on a network interface, which is itself the virtual machine's child) hands its child parts to that
|        record and is removed. Run before the records are published or handed over. Returns how many records were folded.
|    #>
|    param($State = $global:SIRecordCaptureState)
|    if ($null -eq $State -or $null -eq $State.Records) { return 0 }
|    $total = 0
|    for ($round = 0; $round -lt 4; $round++) {
|        $parentOf = @{}
|        foreach ($e in $State.Records.GetEnumerator()) {
|            foreach ($k in @($e.Value.Parts.Keys)) { $s = [string]$k; if ($s.StartsWith('child|')) { $parentOf[$s.Substring(6)] = [string]$e.Key } }
|        }
|        $moved = 0
|        foreach ($id in @($State.Records.Keys)) {
|            $rec = $State.Records[$id]
|            if ([string]$rec.Provider -ne 'azure' -or -not (Test-SIRecordChildOnly $rec)) { continue }
|            $target = [string]$parentOf[[string]$rec.Key]
|            if (-not $target -or $target -eq $id -or -not $State.Records.ContainsKey($target)) { continue }
|            $tr = $State.Records[$target]
|            foreach ($k in @($rec.Parts.Keys)) { $s = [string]$k; if ($s.StartsWith('child|') -and -not $tr.Parts.Contains($s)) { $tr.Parts[$s] = $rec.Parts[$k] } }
|            foreach ($en in @($rec.Engines)) { if ($en) { [void]$tr.Engines.Add([string]$en) } }
|            [void]$State.Records.Remove($id)
|            $moved++
|        }
|        $total += $moved
|        if ($moved -eq 0) { break }
|    }
|    return $total
|}
|
|function Get-SIRecordChildParentMap {
|    <# The child id -> parent id map of this process's capture (the Defender recommendations roll a disk / NIC up with it). #>
|    param($State = $global:SIRecordCaptureState)
|    $m = @{}
|    if ($null -eq $State -or -not $State.PSObject.Properties['ChildOf'] -or $null -eq $State.ChildOf) { return $m }    foreach ($k in @($State.ChildOf.Keys)) { $m[[string]$k] = [string]$State.ChildOf[$k] }
|    return $m
|}
'@ }
$__siSupportFiles['engine/data-model/SI-BreakGlass.ps1'] = @{ Sha256 = '74b4a39635a987c9c02a4658063d792f42abc036bb720ba3f326e640f276d826'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight BREAK GLASS -- a CLASSIFICATION, not a risk factor (REQUIREMENTS #559, owner 2026-10-10: "break glass
|    is not a factor: an SI classification (feeds tier and its own reports), detected from the platform (CA exclusions, the
|    emergency-access group) plus naming patterns SI and the customer set in a wizard").
|
|    An identity CI (users and guests) is break-glass when ANY of these holds:
|      provider    its provider already says so (si_is_break_glass true: the identity profiler's value on the Entra record)
|      naming      a pattern of the data-model list break_glass_patterns (type values: glob patterns, * and ?, over letters,
|                  digits, space and . _ @ -; never wildcards only -- Test-SIBreakGlassPattern) matches its sign-in name
|                  (si_upn), its display name (si_display_name)
|      group       ... or the name of one of its groups (si_group_memberships): a member of an emergency-access group
|      attribute   it carries the EXTENSION ATTRIBUTE and VALUE the customer defines (owner 2026-10-11: "extension attr tag
|                  value i define") -- the data-model list break_glass_attribute, entries "attribute=value"; NOTHING is
|                  shipped. The collector reads the attribute with the user and says which entry matched
|                  (si_break_glass_attribute)
|      ca_excluded_from_all
|                  it holds a PERMANENT TIER 0 role (si_privilege_tier_permanent = 0) and is excluded from ALL the enabled Conditional Access policies that would apply to it (owner: "or
|                  excluded all policies": si_ca_excluded_from_all true). Being excluded from ONE policy is NOT break-glass
|                  any more -- si_ca_excluded_policies still lists every policy that excludes the account, as context.
|    The customer overrides the lists (Community lists.custom.json; Pro the list's override -- the patterns in a wizard; the
|    web app holds a pattern to the same rule). The CI build calls Set-SICiBreakGlass BEFORE the enrichment rules
|    (SI-CiEnrich.ps1), so the tier rules and the break-glass reports read si_is_break_glass exactly as they read the old
|    factor's field. si_break_glass_reason says in plain words WHICH rule matched. Nothing here touches si_risk_factors or a
|    score.
|
|    #546 UNKNOWN IS NEVER A FINDING: a field the CI build could not decide (si_unknown_fields) is not read. A provider's
|    true is never cleared; a provider's false stays false unless a signal matches.
|
|    PURE. PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Get-SIItemValue -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-Conditions.ps1') }
|
|$script:SIBreakGlassListId = 'break_glass_patterns'
|$script:SIBreakGlassAttributeListId = 'break_glass_attribute'
|
|function Get-SIBreakGlassPatterns {
|    <# PURE. The valid glob patterns of the break_glass_patterns list in -Lists (a pattern of wildcards only, or with a
|       character outside the contract, is skipped -- the validation reports it). #>
|    param([hashtable]$Lists = @{})
|    $out = New-Object System.Collections.Generic.List[string]
|    if (-not $Lists -or -not $Lists.ContainsKey($script:SIBreakGlassListId)) { return , $out.ToArray() }
|    foreach ($v in (Get-SIValueList (Get-SIItemValue $Lists[$script:SIBreakGlassListId] 'values'))) {
|        $s = ([string]$v).Trim()
|        if ($s -cmatch '^[A-Za-z0-9 ._@*?-]{1,128}$' -and $s -notmatch '^[\s*?]+$') { $out.Add($s) }
|    }
|    return , $out.ToArray()
|}
|
|function ConvertTo-SIBreakGlassAttributeRule {
|    <#
|        PURE. One entry of the break_glass_attribute list -- "attribute=value" -- as @{ Attribute; Value; Kind; Text }, or
|        $null when it is not a valid entry.
|          attribute   extensionAttribute1 .. extensionAttribute15 (the user's on-premises extension attributes), or the
|                      name of a directory extension (extension_<application id without dashes>_<name>)
|          value       the text the attribute must hold, compared whole and without regard to case; never empty (an empty
|                      value would make every account break-glass)
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Entry)
|    $s = [string]$Entry
|    $i = $s.IndexOf('=')
|    if ($i -lt 1) { return $null }
|    $a = $s.Substring(0, $i).Trim(); $v = $s.Substring($i + 1).Trim()
|    if (-not $v -or $v.Length -gt 256) { return $null }
|    $kind = ''
|    if ($a -match '^(?i)extensionAttribute(?<n>1[0-5]|[1-9])$') { $kind = 'extensionAttribute'; $a = 'extensionAttribute' + $Matches['n'] }
|    elseif ($a -cmatch '^extension_[0-9a-fA-F]{32}_[A-Za-z0-9_]{1,128}$') { $kind = 'directoryExtension' }
|    else { return $null }
|    return @{ Attribute = $a; Value = $v; Kind = $kind; Text = ('{0}={1}' -f $a, $v) }
|}
|
|function Test-SIBreakGlassAttributeEntry {
|    <# PURE. Problems with ONE entry of the break_glass_attribute list; empty = valid. #>
|    param([AllowNull()][AllowEmptyString()][string]$Entry)
|    $p = New-Object System.Collections.Generic.List[string]
|    if ($null -eq (ConvertTo-SIBreakGlassAttributeRule -Entry $Entry)) {
|        $p.Add("lists/break_glass_attribute: '$Entry' -- an entry is attribute=value, the attribute extensionAttribute1 to extensionAttribute15 or a directory extension name (extension_<application id>_<name>), the value not empty and at most 256 characters")
|    }
|    return $p.ToArray()
|}
|
|function Test-SIBreakGlassAttributeList {
|    <# PURE. The break_glass_attribute list of a model: type values, every value a valid entry. Empty = valid (no list too). #>
|    param([Parameter(Mandatory)]$Model)
|    $p = New-Object System.Collections.Generic.List[string]
|    $l = @(@($Model['lists'].lists) | Where-Object { $_ -and [string]$_.id -eq $script:SIBreakGlassAttributeListId })
|    if ($l.Count -eq 0) { return $p.ToArray() }
|    if ([string]$l[0].type -ne 'values') { $p.Add("lists/break_glass_attribute: type '$($l[0].type)' -- it is a values list of attribute=value entries") }
|    foreach ($v in @(Get-SIItemValue $l[0] 'values')) {
|        if ($null -eq $v) { continue }
|        foreach ($x in (Test-SIBreakGlassAttributeEntry -Entry ([string]$v))) { $p.Add($x) }
|    }
|    return $p.ToArray()
|}
|
|function Get-SIBreakGlassAttributeRules {
|    <# PURE. The valid entries of the break_glass_attribute list in -Lists (an invalid entry is skipped -- the validation
|       reports it). Nothing shipped: empty until the customer defines one.
|       The rules are written to the output ONE BY ONE, never as one wrapped array: every caller reads them as
|       @(Get-SIBreakGlassAttributeRules ...) or in a foreach, and a wrapped array inside @( ) is ONE element -- an empty
|       list then counts as one rule, and two rules as one that matches nobody. #>
|    param([hashtable]$Lists = @{})
|    $out = New-Object System.Collections.Generic.List[object]
|    if (-not $Lists -or -not $Lists.ContainsKey($script:SIBreakGlassAttributeListId)) { return }
|    foreach ($v in (Get-SIValueList (Get-SIItemValue $Lists[$script:SIBreakGlassAttributeListId] 'values'))) {
|        $r = ConvertTo-SIBreakGlassAttributeRule -Entry ([string]$v)
|        if ($null -ne $r) { $out.Add($r) }
|    }
|    return $out.ToArray()
|}
|
|function Get-SIBreakGlassAttributeSelect {
|    <# PURE. The properties the user read must ask Microsoft Graph for so the rules can be decided:
|       onPremisesExtensionAttributes when a rule names an extensionAttributeN, and each directory extension by its name.
|       Empty when there is no rule -- the user read is then exactly as before. Written to the output one by one, as the
|       rules are: read it as @(Get-SIBreakGlassAttributeSelect ...). #>
|    param([AllowEmptyCollection()][object[]]$Rules = @())
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($r in @($Rules)) {
|        if ($null -eq $r) { continue }
|        $n = 'onPremisesExtensionAttributes'; if ([string]$r.Kind -eq 'directoryExtension') { $n = [string]$r.Attribute }
|        if (-not $out.Contains($n)) { $out.Add($n) }
|    }
|    return $out.ToArray()
|}
|
|function Get-SIBreakGlassAttributeMatch {
|    <#
|        PURE. The first rule the user object (as Microsoft Graph returned it) satisfies: { attribute; value; match } --
|        match is "attribute=value" as the rule reads -- or $null. An attribute the read did not return is not a match
|        (unknown is never break-glass).
|    #>
|    param($User, [AllowEmptyCollection()][object[]]$Rules = @())
|    if ($null -eq $User) { return $null }
|    $get = {
|        param($o, $n)
|        if ($null -eq $o) { return $null }
|        if ($o -is [System.Collections.IDictionary]) { foreach ($k in @($o.Keys)) { if ([string]$k -ieq $n) { return $o[$k] } }; return $null }
|        $p = $o.PSObject.Properties[$n]; if ($p) { return $p.Value }
|        return $null
|    }
|    foreach ($r in @($Rules)) {
|        if ($null -eq $r) { continue }
|        $have = $null
|        if ([string]$r.Kind -eq 'directoryExtension') { $have = & $get $User ([string]$r.Attribute) }
|        else { $have = & $get (& $get $User 'onPremisesExtensionAttributes') ([string]$r.Attribute) }
|        if ($null -eq $have) { continue }
|        foreach ($h in @($have)) {
|            if ($null -ne $h -and ([string]$h).Trim() -ieq [string]$r.Value) { return [ordered]@{ attribute = [string]$r.Attribute; value = ([string]$h).Trim(); match = [string]$r.Text } }
|        }
|    }
|    return $null
|}
|
|function Test-SIBreakGlassName {
|    <# PURE. $true when -Text matches any glob pattern (case-insensitive, the whole text). #>
|    param([AllowNull()][AllowEmptyString()][string]$Text, [string[]]$Patterns = @())
|    if ([string]::IsNullOrWhiteSpace($Text)) { return $false }
|    # a pattern is built once and kept (2026-10-16: it was built again for every group of every identity of the CI build)
|    $cache = $script:SIBreakGlassWildcardCache
|    if ($null -eq $cache -or $cache.Count -gt 5000) { $cache = New-Object 'System.Collections.Generic.Dictionary[string,object]' ([StringComparer]::Ordinal); $script:SIBreakGlassWildcardCache = $cache }
|    $t = $Text.Trim()
|    foreach ($p in $Patterns) {
|        $wc = $null
|        if (-not $cache.TryGetValue([string]$p, [ref]$wc)) { $wc = New-Object System.Management.Automation.WildcardPattern($p, [System.Management.Automation.WildcardOptions]::IgnoreCase); $cache[[string]$p] = $wc }
|        if ($wc.IsMatch($t)) { return $true }
|    }
|    return $false
|}
|
|function Get-SIBreakGlassReasonText {
|    <# PURE. The reasons (Get-SIBreakGlassClassification) in plain words: WHICH rule made the account break-glass. #>
|    param([AllowEmptyCollection()][string[]]$Reasons = @(), $Ci)
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($code in @($Reasons)) {
|        $c = [string]$code
|        if ($c -eq 'provider') { $out.Add('the identity collection marks it as an emergency-access account') }
|        elseif ($c -eq 'naming:si_upn') { $out.Add('its sign-in name matches a break-glass naming pattern') }
|        elseif ($c -eq 'naming:si_display_name') { $out.Add('its display name matches a break-glass naming pattern') }
|        elseif ($c -eq 'group') { $out.Add('it is a member of a group whose name matches a break-glass naming pattern') }
|        elseif ($c -eq 'attribute') {
|            $a = ''; if ($null -ne $Ci) { $a = [string](Get-SIItemValue $Ci 'si_break_glass_attribute') }
|            if ($a) { $out.Add(('it carries the extension attribute and value you defined ({0})' -f $a)) } else { $out.Add('it carries the extension attribute and value you defined') }
|        }
|        elseif ($c -eq 'ca_excluded_from_all') {
|            $n = 0; if ($null -ne $Ci) { $n = @((Get-SIValueList (Get-SIItemValue $Ci 'si_ca_excluded_policies')).ToArray() | Where-Object { $_ }).Count }
|            if ($n -gt 0) { $out.Add(('it holds a permanent Tier 0 role and is excluded from all {0} enabled Conditional Access policies that would apply to it' -f $n)) }
|            else { $out.Add('it holds a permanent Tier 0 role and is excluded from all the enabled Conditional Access policies that would apply to it') }
|        }
|        elseif ($c) { $out.Add($c) }
|    }
|    if ($out.Count -eq 0) { return '' }
|    return ('Break-glass because ' + ($out.ToArray() -join '; ') + '.')
|}
|
|function Get-SIBreakGlassClassification {
|    <#
|    .SYNOPSIS  PURE. One CI -> @{ IsBreakGlass = $true | $false | $null (not an identity user / guest, or nothing known);
|               Reasons = provider / naming:<field> / group / attribute / ca_excluded_from_all }.
|    #>
|    param([Parameter(Mandatory)]$Ci, [hashtable]$Context = @{})
|    $reasons = New-Object System.Collections.Generic.List[string]
|    $cls = [string](Get-SIItemValue $Ci 'si_class')
|    if ($cls -and $cls -ne 'identity') { return @{ IsBreakGlass = $null; Reasons = @() } }
|    $type = [string](Get-SIItemValue $Ci 'si_identity_type')
|    if ($type -and @('user', 'guest') -notcontains $type) { return @{ IsBreakGlass = $null; Reasons = @() } }
|    $unknown = @{}; foreach ($u in @(Get-SIItemValue $Ci 'si_unknown_fields')) { if ($u) { $unknown[[string]$u] = $true } }
|    $prov = ConvertTo-SIBoolOrNull (Get-SIItemValue $Ci 'si_is_break_glass')
|    if ($prov -eq $true) { $reasons.Add('provider') }
|    $lists = @{}; if ($Context -and $Context.Lists) { $lists = $Context.Lists }
|    $pats = Get-SIBreakGlassPatterns -Lists $lists
|    if ($pats.Count -gt 0) {
|        foreach ($fn in 'si_upn', 'si_display_name') {
|            if ($unknown.ContainsKey($fn)) { continue }
|            if (Test-SIBreakGlassName -Text ([string](Get-SIItemValue $Ci $fn)) -Patterns $pats) { $reasons.Add('naming:' + $fn) }
|        }
|        if (-not $unknown.ContainsKey('si_group_memberships')) {
|            foreach ($g in (Get-SIValueList (Get-SIItemValue $Ci 'si_group_memberships'))) {
|                $names = @()
|                if ($g -is [string]) { $names = @($g) } else { $names = @((Get-SIItemValue $g 'displayName'), (Get-SIItemValue $g 'name')) }
|                $hit = $false
|                foreach ($n in $names) { if (Test-SIBreakGlassName -Text ([string]$n) -Patterns $pats) { $hit = $true } }
|                if ($hit) { $reasons.Add('group'); break }
|            }
|        }
|    }
|    # (a) the extension attribute and value the customer defines: the collector matched it on the user it read
|    # (si_break_glass_attribute = "attribute=value"); it counts only while that entry is still in the list
|    if (-not $unknown.ContainsKey('si_break_glass_attribute')) {
|        $have = ([string](Get-SIItemValue $Ci 'si_break_glass_attribute')).Trim()
|        if ($have) {
|            foreach ($rule in (Get-SIBreakGlassAttributeRules -Lists $lists)) { if ([string]$rule.Text -ieq $have) { $reasons.Add('attribute'); break } }
|        }
|    }
|    # (b) a PERMANENT TIER 0 account that is excluded from ALL the enabled Conditional Access policies that would apply to it --
|    # one policy is not enough, and an ordinary account in a broad exclusion group is not break-glass (the rule has always
|    # been about the accounts that hold the tenant: si_privilege_tier_permanent = 0)
|    if (-not $unknown.ContainsKey('si_ca_excluded_from_all') -and -not $unknown.ContainsKey('si_privilege_tier_permanent')) {
|        $pt = ConvertTo-SINumberOrNull (Get-SIItemValue $Ci 'si_privilege_tier_permanent')
|        if ((ConvertTo-SIBoolOrNull (Get-SIItemValue $Ci 'si_ca_excluded_from_all')) -eq $true -and $null -ne $pt -and $pt -eq 0) { $reasons.Add('ca_excluded_from_all') }
|    }
|    if ($reasons.Count -gt 0) { return @{ IsBreakGlass = $true; Reasons = $reasons.ToArray() } }
|    return @{ IsBreakGlass = $prov; Reasons = @() }
|}
|
|function Set-SICiBreakGlass {
|    <#
|    .SYNOPSIS  PURE. Sets si_is_break_glass (true when classified; a provider's value is kept otherwise),
|               si_break_glass_reasons (the rules that matched) and si_break_glass_reason (the same in plain words) on one
|               identity CI. Returns the CI. Never touches the risk factors.
|    #>
|    param([Parameter(Mandatory)]$Ci, [hashtable]$Context = @{})
|    $r = Get-SIBreakGlassClassification -Ci $Ci -Context $Context
|    if ($r.IsBreakGlass -eq $true) {
|        $Ci['si_is_break_glass'] = $true
|        $Ci['si_break_glass_reasons'] = @($r.Reasons)
|        $Ci['si_break_glass_reason'] = Get-SIBreakGlassReasonText -Reasons @($r.Reasons) -Ci $Ci
|    } elseif ($Ci -is [System.Collections.IDictionary]) {
|        foreach ($n in 'si_break_glass_reasons', 'si_break_glass_reason') { if ($Ci.Contains($n)) { $Ci.Remove($n) } }
|    }
|    return $Ci
|}
'@ }
$__siSupportFiles['engine/data-model/SI-CiRules.ps1'] = @{ Sha256 = 'f0d5c87f876676a7b29506fcd5b55b5d0ca18f8229675c66feb54cc5dc035651'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight CI RULES -- the generic enrichment rule model run ON THE CI (#462, V3-DATA-MODEL 2.8 / 2.19.2).
|
|      NATIVE RULES   rule packs in the design's own shape, over SI FIELDS only (a rule never names a provider):
|                       data-model/rules/<Pack>.locked.yaml                (shipped)
|                       data-model/rules/<Pack>.custom.yaml                (the customer's, beside it)
|                       <SI_DataModelOverlayRoot>/rules/<Pack>.custom.yaml (the operator overlay -- wins)
|                     (data-model/, not asset-profiling-enrichment/: those folders hold the AssetProfileBy* rule files that the
|                     profilers, the Pro template packs and the rule lint read in their own shape)
|                     rules:
|                       - id: domain-controllers
|                         stage: production            # production | testing | not_used
|                         priority: 100                # a single-value field: the highest-priority deciding rule wins
|                         applies_to: [ device ]       # device | identity | cloud_resource | public_ip
|                         mechanism: eg.graph_field    # the trust-list entry the evidence belongs to (default name.pattern)
|                         when:
|                           any:
|                             - si_device_roles: { contains: domain_controller }
|                             - si_installed_software: { like: "*active directory domain services*" }
|                         set: { si_tier: 0, si_purpose: Domain controller, si_tags: [ AD-Tier0 ] }
|                     A condition is `<si field>: { <op>: <value> }` (ops: Get-SIConditionOps, the closed set) or
|                     `<si field>: <value>` (eq). The override grain is ONE RULE: a custom rule with a shipped id
|                     replaces it; `stage: not_used` turns it off. The result is the same CI-rule shape the converted
|                     AssetProfileBy* rules have (ConvertTo-SICiRules), evaluated by the same Invoke-SICiRules.
|      ASSET TAGGING  the tagging engine's auto-exclusion tags (AssetTagging.locked.yaml: KQL against Defender) expressed
|                     as a native pack (data-model/rules/AssetTagging.locked.yaml) over si_onboarding_status / si_asset_name, so the CI
|                     carries the same tag the engine writes; its per-rule switches (config/asset-tagging.config.json
|                     AutoExcludeRules.*) and the device-name patterns are honoured (Get-SIAssetTaggingCiRules).
|      OVERRIDES      a manual CI override (Admin, with a reason and an optional expiry; precedence 1 in 2.8) --
|                     sidata.CiOverride in the install database (both editions have one, #477). Applied after the rules:
|                     si_tier -> si_tier_set_by = override. Every override in force is listed on the CI (si_overrides).
|
|    PURE except Get-SICiNativeRules / Get-SIAssetTaggingCiRules (read rule files) and Read-SICiOverrides (one SQL read).
|    PowerShell 5.1: no ?. / ??, no ternary, no Set-StrictMode.
|#>
|
|if (-not (Get-Command -Name Test-SICondition -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-Conditions.ps1') }
|
|function ConvertTo-SICiNativeCondition {
|    <#
|        PURE. A design-shape condition -> the closed condition language ({ field; op; value } / { any } / { all }).
|          { any: [ ... ] } / { all: [ ... ] }      groups (nested)
|          { si_x: { op: value } }                 one leaf per op key (several keys = all of them)
|          { si_x: value }                         eq
|        Throws on an operation outside Get-SIConditionOps or a field that is not an SI field (si_ / properties.).
|    #>
|    param([Parameter(Mandatory)]$When, [string]$RuleId = '')
|    $ops = Get-SIConditionOps
|    $keys = @()
|    if ($When -is [System.Collections.IDictionary]) { $keys = @($When.Keys | ForEach-Object { [string]$_ }) } else { $keys = @($When.PSObject.Properties | ForEach-Object { $_.Name }) }
|    foreach ($g in 'any', 'all') {
|        if ($keys -contains $g) {
|            $items = @(foreach ($c in (Get-SIValueList (Get-SIItemValue $When $g))) { if ($null -ne $c) { ConvertTo-SICiNativeCondition -When $c -RuleId $RuleId } })
|            $o = [ordered]@{}; $o[$g] = $items; return $o
|        }
|    }
|    $leaves = New-Object System.Collections.Generic.List[object]
|    foreach ($f in $keys) {
|        if ($f -cnotmatch '^(si_[a-z0-9_]+|properties\..+)$') { throw ("rule '{0}': '{1}' is not an SI field -- a rule reads SI fields only, never a provider column" -f $RuleId, $f) }
|        $spec = Get-SIItemValue $When $f
|        $isMap = ($spec -is [System.Collections.IDictionary]) -or ($spec -is [System.Management.Automation.PSCustomObject])
|        if (-not $isMap) {
|            # a list is "one of these" (in), a single value is eq
|            if ($spec -is [System.Collections.IEnumerable] -and -not ($spec -is [string])) { $leaves.Add([ordered]@{ field = $f; op = 'in'; value = @($spec) }) }
|            else { $leaves.Add([ordered]@{ field = $f; op = 'eq'; value = $spec }) }
|            continue
|        }
|        $sk = @(); if ($spec -is [System.Collections.IDictionary]) { $sk = @($spec.Keys | ForEach-Object { [string]$_ }) } else { $sk = @($spec.PSObject.Properties | ForEach-Object { $_.Name }) }
|        foreach ($op in $sk) {
|            if ($ops -notcontains $op) { throw ("rule '{0}': '{1}' uses '{2}', which is not a condition operation ({3})" -f $RuleId, $f, $op, ($ops -join ', ')) }
|            $leaves.Add([ordered]@{ field = $f; op = $op; value = (Get-SIItemValue $spec $op) })
|        }
|    }
|    if ($leaves.Count -eq 1) { return $leaves[0] }
|    return [ordered]@{ all = $leaves.ToArray() }
|}
|
|function ConvertTo-SICiNativeRule {
|    <#
|        PURE. One native rule item -> a CI rule (the shape ConvertTo-SICiRules gives, so Invoke-SICiRules evaluates both).
|        -Pack: the pack (file) it came from; -Order: its place in the rule order.
|    #>
|    param([Parameter(Mandatory)]$Item, [string]$Pack = '', [int]$Order = 0, [string]$File = '', [int]$DefaultPriority = 100)
|    $id = [string](Get-SIItemValue $Item 'id')
|    if (-not $id) { throw ("a rule in pack '{0}' has no id" -f $Pack) }
|    $stage = ([string](Get-SIItemValue $Item 'stage')).Trim().ToLowerInvariant(); if (-not $stage) { $stage = 'production' }
|    if ($stage -notin 'production', 'testing', 'not_used') { throw ("rule '{0}': stage '{1}' (production | testing | not_used)" -f $id, $stage) }
|    # a rule without its own priority takes its pack's (Get-SIRulePackHeader; 100 when the pack names none)
|    $prio = $DefaultPriority; $pv = Get-SIItemValue $Item 'priority'; if ($null -ne $pv -and [string]$pv -match '^-?\d+$') { $prio = [int]$pv }
|    $classes = @((Get-SIValueList (Get-SIItemValue $Item 'applies_to')).ToArray() | ForEach-Object { ([string]$_).Trim().ToLowerInvariant() } | Where-Object { $_ })
|    foreach ($c in $classes) { if ($c -notin 'device', 'identity', 'cloud_resource', 'public_ip') { throw ("rule '{0}': applies_to '{1}' (device | identity | cloud_resource | public_ip)" -f $id, $c) } }
|    if ($classes.Count -eq 0) { $classes = @('device', 'identity', 'cloud_resource', 'public_ip') }
|    $whenRaw = Get-SIItemValue $Item 'when'
|    if ($null -eq $whenRaw) { throw ("rule '{0}' has no when" -f $id) }
|    $when = ConvertTo-SICiNativeCondition -When $whenRaw -RuleId $id
|    if (-not ($when.Contains('any') -or $when.Contains('all'))) { $when = [ordered]@{ all = @($when) } }
|    $set = [ordered]@{}
|    $rawSet = Get-SIItemValue $Item 'set'
|    if ($null -ne $rawSet) {
|        $sk = @(); if ($rawSet -is [System.Collections.IDictionary]) { $sk = @($rawSet.Keys | ForEach-Object { [string]$_ }) } else { $sk = @($rawSet.PSObject.Properties | ForEach-Object { $_.Name }) }
|        foreach ($k in $sk) {
|            if ($k -cnotmatch '^si_[a-z0-9_]+$') { throw ("rule '{0}': set '{1}' is not an SI field" -f $id, $k) }
|            $v = Get-SIItemValue $rawSet $k
|            if ($k -eq 'si_tags') { $set[$k] = @((Get-SIValueList $v).ToArray() | ForEach-Object { [string]$_ }); continue }
|            if ($k -eq 'si_tier') { $t = 0; if (-not [int]::TryParse([string]$v, [ref]$t) -or $t -lt 0 -or $t -gt 3) { throw ("rule '{0}': si_tier '{1}' (0-3)" -f $id, $v) }; $set[$k] = $t; continue }
|            $set[$k] = $v
|        }
|    }
|    if ($set.Count -eq 0) { throw ("rule '{0}' sets nothing" -f $id) }
|    $mech = [string](Get-SIItemValue $Item 'mechanism'); if (-not $mech) { $mech = 'name.pattern' }
|    $os = @((Get-SIValueList (Get-SIItemValue $Item 'os_scope')).ToArray() | ForEach-Object { ([string]$_).ToLowerInvariant() } | Where-Object { $_ })
|    $ex = @((Get-SIValueList (Get-SIItemValue $Item 'exclude')).ToArray() | ForEach-Object { [string]$_ } | Where-Object { $_ })
|    $name = [string](Get-SIItemValue $Item 'name'); if (-not $name) { $name = $id }
|    [pscustomobject][ordered]@{
|        id = $id; family = 'ci'; file = $File; name = $name; stage = $stage; priority = $prio; pack = $Pack; order = $Order; classes = $classes; osScope = $os
|        fallback = $false; mechanism = $mech; when = $when; set = $set; exclude = $ex; native = $true
|    }
|}
|
|function Merge-SICiNativeRuleItems {
|    <#
|        PURE. Rule items of one pack, shipped then custom (then overlay): the override grain is ONE RULE -- a later item with
|        the same id replaces the earlier one in its place; a new id is added at the end.
|    #>
|    param([AllowEmptyCollection()][object[]]$Layers = @())
|    $order = New-Object System.Collections.Generic.List[string]
|    $by = @{}
|    foreach ($layer in $Layers) {
|        foreach ($it in @($layer)) {
|            if ($null -eq $it) { continue }
|            $id = [string](Get-SIItemValue $it 'id'); if (-not $id) { continue }
|            if (-not $by.ContainsKey($id)) { $order.Add($id) }
|            $by[$id] = $it
|        }
|    }
|    foreach ($id in $order) { $by[$id] }
|}
|
|# ---------------------------------------------------------------------------------------------------
|# Rule PACKS (#462 GUI): one pack = one rule file. Besides its rules a pack carries a header -- its stage, whether it is
|# on, its default priority and where it came from -- so a whole pack is turned on or off, or promoted from testing to
|# live, in one decision:
|#   name / description   what the pack is for (shown on the Rule packs page)
|#   stage                production (live) | testing: a testing pack's rules only PROPOSE (si_rule_proposals)
|#   enabled              false = every rule of the pack is not_used
|#   priority             the priority of a rule that names none (default 100)
|#   source               shipped (SecurityInsight) | invardia (delivered through the template channel) | customer
|# An Invardia pack is NOT auto-imported: it arrives switched off and, once an Admin stages it, as testing -- it decides
|# only when an Admin promotes it to live (Pro: a cfg.ItemOverride on its header, 'rules/<pack>'; Community: the same keys
|# at the top of <Pack>.custom.yaml).
|# ---------------------------------------------------------------------------------------------------
|
|function Get-SIRulePackKey {
|    <# PURE. The data-model template name of a pack ('rules/<lower-case pack>'): what the Pro rows and overrides key on. #>
|    param([Parameter(Mandatory)][string]$Pack)
|    $k = ($Pack.ToLowerInvariant() -replace '[^a-z0-9_\-]', '')
|    if (-not $k) { throw ("rule pack '{0}' has no usable name" -f $Pack) }
|    if ($k.Length -gt 60) { $k = $k.Substring(0, 60) }
|    'rules/' + $k
|}
|
|function Get-SIRulePackHeader {
|    <#
|        PURE. A pack's header from its document layers (shipped, then custom / overlay / the Pro override: a later layer's
|        key wins). Returns @{ pack; name; description; stage; enabled; priority; source }. An Invardia pack defaults to
|        switched off and testing (never auto-imported).
|    #>
|    param([Parameter(Mandatory)][string]$Pack, [AllowEmptyCollection()][object[]]$Layers = @())
|    $h = [ordered]@{ pack = $Pack; name = $Pack; description = ''; stage = ''; enabled = $null; priority = 100; source = 'shipped' }
|    foreach ($l in @($Layers)) {
|        if ($null -eq $l) { continue }
|        foreach ($k in 'name', 'description', 'source') { $v = Get-SIItemValue $l $k; if ($null -ne $v -and [string]$v -ne '') { $h[$k] = [string]$v } }
|        $st = Get-SIItemValue $l 'stage'; if ($null -ne $st -and [string]$st -ne '') { $h.stage = ([string]$st).Trim().ToLowerInvariant() }
|        $en = Get-SIItemValue $l 'enabled'; if ($null -ne $en -and [string]$en -ne '') { $h.enabled = ((ConvertTo-SIBoolOrNull $en) -eq $true) }
|        $pr = Get-SIItemValue $l 'priority'; if ($null -ne $pr -and [string]$pr -match '^-?\d+$') { $h.priority = [int]$pr }
|    }
|    $h.source = ([string]$h.source).Trim().ToLowerInvariant(); if ($h.source -notin 'shipped', 'invardia', 'customer') { $h.source = 'shipped' }
|    if ($h.stage -eq 'live') { $h.stage = 'production' }
|    if (-not $h.stage) { if ($h.source -eq 'invardia') { $h.stage = 'testing' } else { $h.stage = 'production' } }
|    if ($h.stage -notin 'production', 'testing') { $h.stage = 'testing' }   # an unknown stage never decides
|    if ($null -eq $h.enabled) { $h.enabled = ($h.source -ne 'invardia') }
|    $h
|}
|
|function Set-SIRulePackState {
|    <#
|        PURE. A pack's header applied to its converted rules: switched off -> every rule not_used; a testing pack -> its
|        production rules become testing (they propose, never decide). A rule's own not_used / testing stays.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rules = @(), [Parameter(Mandatory)]$Header)
|    foreach ($r in @($Rules)) {
|        if ($null -eq $r) { continue }
|        if (-not $Header.enabled) { $r.stage = 'not_used' }
|        elseif ($Header.stage -eq 'testing' -and $r.stage -eq 'production') { $r.stage = 'testing' }
|        $r
|    }
|}
|
|function Get-SICiNativeRules {
|    <#
|        The native rule packs -> CI rules. -Root: the solution root (default: two folders up); -OverlayRoot: the operator
|        overlay (default $global:SI_DataModelOverlayRoot); -ProRoot: Pro's run data model exported from the settings
|        database (default $global:SI_DataModelRoot) -- a pack it holds (rules/<pack>.locked.json: the published pack with
|        the customer's overrides) replaces the file layers of that pack. A pack that does not parse, or a rule that is not
|        valid, is SKIPPED with a warning naming it -- the other rules still run. Every pack's header (stage, on / off,
|        priority) is applied to its rules (Set-SIRulePackState).
|        Returns @{ Rules; Problems; Packs (pack -> header) }.
|    #>
|    param([string]$Root, [string]$OverlayRoot = $global:SI_DataModelOverlayRoot, [int]$StartOrder = 100000, [string]$ProRoot = $global:SI_DataModelRoot)
|    if (-not (Get-Command -Name ConvertFrom-SIYaml -ErrorAction SilentlyContinue)) { . (Join-Path (Split-Path -Parent $PSScriptRoot) '_shared\SI-Yaml.ps1') }
|    if (-not $Root) { $Root = Split-Path -Parent (Split-Path -Parent $PSScriptRoot) }
|    $dirs = @([System.IO.Path]::Combine($Root, 'data-model', 'rules'))
|    $packs = [ordered]@{}
|    $heads = @{}
|    $problems = New-Object System.Collections.Generic.List[string]
|    $read = {
|        param([string]$Path, [string]$Pack)
|        try {
|            $y = ConvertFrom-SIYaml -Yaml ([System.IO.File]::ReadAllText($Path)) -SourceName $Path
|            if (-not $heads.ContainsKey($Pack)) { $heads[$Pack] = New-Object System.Collections.Generic.List[object] }
|            $heads[$Pack].Add($y)
|            return @(Get-SIValueList (Get-SIItemValue $y 'rules'))
|        }
|        catch { $problems.Add(('{0}: does not parse -- {1}' -f [System.IO.Path]::GetFileName($Path), $_.Exception.Message)); return @() }
|    }
|    foreach ($d in $dirs) {
|        if (-not (Test-Path -LiteralPath $d)) { continue }
|        foreach ($f in @(Get-ChildItem -LiteralPath $d -File -Filter '*.locked.yaml' | Sort-Object Name)) { $p = $f.Name -replace '\.locked\.yaml$', ''; $packs[$p] = @(, (& $read $f.FullName $p)) }
|        foreach ($f in @(Get-ChildItem -LiteralPath $d -File -Filter '*.custom.yaml' | Sort-Object Name)) { $p = $f.Name -replace '\.custom\.yaml$', ''; if (-not $packs.Contains($p)) { $packs[$p] = @() }; $packs[$p] = @($packs[$p]) + @(, (& $read $f.FullName $p)) }
|    }
|    if ($OverlayRoot) {
|        $od = [System.IO.Path]::Combine($OverlayRoot, 'rules')
|        if (Test-Path -LiteralPath $od) {
|            foreach ($f in @(Get-ChildItem -LiteralPath $od -File -Filter '*.custom.yaml' | Sort-Object Name)) { $p = $f.Name -replace '\.custom\.yaml$', ''; if (-not $packs.Contains($p)) { $packs[$p] = @() }; $packs[$p] = @($packs[$p]) + @(, (& $read $f.FullName $p)) }
|        }
|    }
|    # Pro: a pack the settings database holds (published + overridden in SQL, no custom files) replaces its file layers
|    if ($ProRoot) {
|        $pd = [System.IO.Path]::Combine($ProRoot, 'rules')
|        if (Test-Path -LiteralPath $pd) {
|            foreach ($f in @(Get-ChildItem -LiteralPath $pd -File -Filter '*.locked.json' | Sort-Object Name)) {
|                try {
|                    $doc = [System.IO.File]::ReadAllText($f.FullName).TrimStart([char]0xFEFF) | ConvertFrom-Json
|                    $p = [string](Get-SIItemValue $doc 'pack'); if (-not $p) { $p = $f.Name -replace '\.locked\.json$', '' }
|                    foreach ($k in @($packs.Keys)) { if ([string]$k -ieq $p) { $packs.Remove($k) } }
|                    foreach ($k in @($heads.Keys)) { if ([string]$k -ieq $p) { $heads.Remove($k) } }
|                    # one layer = the rules (Get-SIValueList returns ONE list: @() around it made the layer a single item)
|                    $packs[$p] = @(, (Get-SIValueList (Get-SIItemValue $doc 'rules')).ToArray())
|                    $heads[$p] = New-Object System.Collections.Generic.List[object]; $heads[$p].Add($doc)
|                } catch { $problems.Add(('{0}: does not parse -- {1}' -f $f.Name, $_.Exception.Message)) }
|            }
|        }
|    }
|    $rules = New-Object System.Collections.Generic.List[object]
|    $packHeads = [ordered]@{}
|    $order = $StartOrder
|    foreach ($p in $packs.Keys) {
|        $hl = @(); if ($heads.ContainsKey($p)) { $hl = $heads[$p].ToArray() }
|        $head = Get-SIRulePackHeader -Pack $p -Layers $hl
|        $packHeads[$p] = $head
|        $conv = New-Object System.Collections.Generic.List[object]
|        foreach ($it in @(Merge-SICiNativeRuleItems -Layers @($packs[$p]))) {
|            $order++
|            try { $conv.Add((ConvertTo-SICiNativeRule -Item $it -Pack $p -Order $order -File ("data-model/rules/{0}" -f $p) -DefaultPriority ([int]$head.priority))) }
|            catch { $problems.Add(('{0}: {1}' -f $p, $_.Exception.Message)) }
|        }
|        foreach ($r in @(Set-SIRulePackState -Rules $conv.ToArray() -Header $head)) { $rules.Add($r) }
|    }
|    foreach ($x in $problems) { Write-Warning ("CI rules: {0} -- skipped; the other rules run." -f $x) }
|    @{ Rules = $rules.ToArray(); Problems = $problems.ToArray(); Packs = $packHeads }
|}
|
|function Get-SIAssetTaggingCiRules {
|    <#
|        The tagging engine's switches and device-name patterns applied to the AssetTagging pack's CI rules (#462):
|          * a rule with `config_flag: AutoExcludeRules.<X>` is used ONLY when the tagging config sets that flag true -- no
|            config file, no flag, or anything but true = not_used. Every one of these rules writes an EXCLUSION tag
|            (<bucket>--Excluded--SI), and every report drops a CI that carries one, so an exclusion is the customer's choice,
|            never a default. The same rule as the tagging engine (AssetTagging.ps1 Test-TaggingConfigFlag: missing = false)
|            and the shipped sample (every switch false). #643: this used to read "no file = on" -- from the 10-12 CI build on,
|            every device CI whose onboarding status read "can be onboarded" (774 of 1,890 at a large install, 704 of them
|            onboarded in Defender) carried Auto-CanBeOnboarded--Excluded--SI and left every report, although nobody had chosen it;
|          * the name-pattern rule (`config_patterns: DeviceNamePatterns`) gets its condition from the config's
|            StartsWith / Contains / MatchesRegex lists (any of them); with no pattern configured it stays not_used --
|            on a CI a rule that matches every device would tag every device.
|          * ABOVE ALL OF IT: the customer setting "Asset tagging" (SI_AssetTagging_Enabled, owner 2026-10-13: "tagging must be
|            disabled by default. customer must enable it in settings"). Not a real true = EVERY rule of the pack is not_used,
|            whatever the switches say, and each carries strip_tags = $true: the CI build then also takes the tags these
|            rules name off the CI when a provider brings them back (a tag an earlier tagging run wrote to Defender) -- off
|            means no report treats a device as excluded because of a tagging rule. A customer's own tags are untouched.
|        -Rules: the CI rules (Get-SICiNativeRules); -Config: the parsed asset-tagging.config.json (or $null); -Enabled: the
|        setting SI_AssetTagging_Enabled. Returns the rules.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rules = @(), $Config, [hashtable]$RawItems = @{}, [AllowNull()]$Enabled = $global:SI_AssetTagging_Enabled)
|    $taggingOn = Test-SIAssetTaggingEnabled -Value $Enabled
|    foreach ($r in $Rules) {
|        if ($null -eq $r -or [string]$r.pack -ne 'AssetTagging') { $r; continue }
|        if (-not $taggingOn) {
|            $r.stage = 'not_used'
|            if ($r.PSObject.Properties['strip_tags']) { $r.strip_tags = $true } else { Add-Member -InputObject $r -NotePropertyName 'strip_tags' -NotePropertyValue $true }
|            $r; continue
|        }
|        $raw = $RawItems[[string]$r.id]
|        $flag = [string](Get-SIItemValue $raw 'config_flag')
|        if ($flag) {
|            $on = $false
|            if ($null -ne $Config) {
|                $v = $Config
|                foreach ($part in $flag.Split('.')) { $v = Get-SIItemValue $v $part }
|                $on = ($null -ne $v -and (ConvertTo-SIBoolOrNull $v) -eq $true)
|            }
|            if (-not $on) { $r.stage = 'not_used' }
|        }
|        if ([string](Get-SIItemValue $raw 'config_patterns') -eq 'DeviceNamePatterns') {
|            $np = Get-SIItemValue $Config 'DeviceNamePatterns'
|            $leaves = New-Object System.Collections.Generic.List[object]
|            foreach ($s in (Get-SIValueList (Get-SIItemValue $np 'StartsWith'))) { if ($s) { $leaves.Add([ordered]@{ field = 'si_asset_name'; op = 'like'; value = ([string]$s + '*') }) } }
|            foreach ($s in (Get-SIValueList (Get-SIItemValue $np 'Contains'))) { if ($s) { $leaves.Add([ordered]@{ field = 'si_asset_name'; op = 'like'; value = ('*' + [string]$s + '*') }) } }
|            foreach ($s in (Get-SIValueList (Get-SIItemValue $np 'MatchesRegex'))) { if ($s) { $leaves.Add([ordered]@{ field = 'si_asset_name'; op = 'matches'; value = [string]$s }) } }
|            if ($leaves.Count -eq 0) { $r.stage = 'not_used' } else { $r.when = [ordered]@{ any = $leaves.ToArray() } }
|        }
|        $r
|    }
|}
|
|function Test-SIAssetTaggingEnabled {
|    <# PURE. The customer setting "Asset tagging" (SI_AssetTagging_Enabled): ONLY a real true turns it on -- $true, 'true',
|       '$true' or 1. Missing, empty, false or anything else = off (the shipped default, #643). #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $false }
|    if ($Value -is [bool]) { return $Value }
|    return ("$Value".Trim().Trim('$').ToLowerInvariant() -in @('true', '1'))
|}
|
|function Get-SITaggingRuleTagNames {
|    <# PURE. The tags the asset-tagging rules that are switched off by the setting name (strip_tags) -- what the CI build
|       takes off a CI while asset tagging is off. A HashSet, case-insensitive. #>
|    param([AllowEmptyCollection()][object[]]$Rules = @())
|    $names = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($r in $Rules) {
|        if ($null -eq $r -or -not $r.PSObject.Properties['strip_tags'] -or -not [bool]$r.strip_tags) { continue }
|        $set = $r.set
|        if ($null -ne $set -and $set.Contains('si_tags')) { foreach ($t in @($set['si_tags'])) { if ($t) { [void]$names.Add([string]$t) } } }
|    }
|    , $names
|}
|
|function Read-SIAssetTaggingConfig {
|    <# The tagging engine's config (config/asset-tagging.config.json), or $null when there is none / it does not parse. #>
|    param([string]$Root)
|    if (-not $Root) { $Root = Split-Path -Parent (Split-Path -Parent $PSScriptRoot) }
|    $p = [System.IO.Path]::Combine($Root, 'config', 'asset-tagging.config.json')
|    if ($global:SI_ProConfigRoot) { $pp = [System.IO.Path]::Combine([string]$global:SI_ProConfigRoot, 'asset-tagging.config.json'); if (Test-Path -LiteralPath $pp) { $p = $pp } }
|    if (-not (Test-Path -LiteralPath $p)) { return $null }
|    try { return ([System.IO.File]::ReadAllText($p) | ConvertFrom-Json) } catch { Write-Warning ("CI rules: {0} does not parse -- the tagging switches are the defaults." -f $p); return $null }
|}
|
|function Get-SICiAllNativeRules {
|    <# Every native CI rule, with the tagging switches applied. Returns @{ Rules; Problems }. #>
|    param([string]$Root, [string]$OverlayRoot = $global:SI_DataModelOverlayRoot)
|    $n = Get-SICiNativeRules -Root $Root -OverlayRoot $OverlayRoot
|    $raw = @{}
|    if (-not $Root) { $Root = Split-Path -Parent (Split-Path -Parent $PSScriptRoot) }
|    $atFile = [System.IO.Path]::Combine($Root, 'data-model', 'rules', 'AssetTagging.locked.yaml')
|    if (Test-Path -LiteralPath $atFile) {
|        try { foreach ($it in (Get-SIValueList (Get-SIItemValue (ConvertFrom-SIYaml -Yaml ([System.IO.File]::ReadAllText($atFile)) -SourceName $atFile) 'rules'))) { $raw[[string](Get-SIItemValue $it 'id')] = $it } } catch { }
|    }
|    $rules = @(Get-SIAssetTaggingCiRules -Rules @($n.Rules) -Config (Read-SIAssetTaggingConfig -Root $Root) -RawItems $raw)
|    @{ Rules = $rules; Problems = @($n.Problems); Packs = $n.Packs }
|}
|
|# ---------------------------------------------------------------------------------------------------
|# The operator's tier tag (the profile's tenant_si_manual_tag contributor) on the CI
|# ---------------------------------------------------------------------------------------------------
|
|$script:SICiDefaultTierTagPattern = '(?i)tier[_-]?(?<tier>[0-3])(--SI)?'
|
|function ConvertTo-SICiTagTierRules {
|    <#
|        PURE. The operator's tier tag (e.g. EmployeeWorkstations--tier2--SI) as CI rules: one rule per tier 0..3, each matching
|        si_tags with the schema's tagPattern narrowed to that tier (its named group `tier` replaced by the digit). The profile
|        has done this since 2.3.6 (Get-SITierFromAssetTags); without it on the CI a device tagged tier 2 got the default
|        tier 3 and fell out of the tier-filtered reports.
|        Owner: "tags must continue to be used, just low prio" -- so every rule is ASSERTED (Invoke-SICiRules: it decides only
|        when no observed rule claims a tier, and always beats the default rule) and its mechanism, operator.tier_tag, is last
|        in the trust list. Several tier tags on one device: MIN, as everywhere else.
|        Devices only (the endpoint schema declares the contributor). A pattern without a `tier` group, or one that is not a
|        valid regex, gives no rules and a warning -- never a rule that matches every device.
|    #>
|    param([AllowNull()][string]$TagPattern, [int]$StartOrder = 900000)
|    if ([string]::IsNullOrWhiteSpace($TagPattern)) { $TagPattern = $script:SICiDefaultTierTagPattern }
|    try { $null = New-Object System.Text.RegularExpressions.Regex($TagPattern) }
|    catch { Write-Warning ("CI rules: the tier tag pattern '{0}' is not a valid regex ({1}) -- tier tags are not used." -f $TagPattern, $_.Exception.Message); return @() }
|    $group = New-Object System.Text.RegularExpressions.Regex('\(\?(?:<tier>|''tier'')(?:\\.|\[(?:\\.|[^\]\\])*\]|[^()\\])*\)')
|    if (-not $group.IsMatch($TagPattern)) { Write-Warning ("CI rules: the tier tag pattern '{0}' has no (?<tier>...) group -- tier tags are not used." -f $TagPattern); return @() }
|    $order = $StartOrder
|    foreach ($t in 0..3) {
|        $order++
|        $pat = $group.Replace($TagPattern, ('(?<tier>{0})' -f $t), 1)
|        [pscustomobject][ordered]@{
|            id = ('operator-tier-tag/tier{0}' -f $t); family = 'ci'; file = 'asset-profiling-schema/endpoint.schema (tenant_si_manual_tag)'
|            name = ('Operator tier tag: tier {0}' -f $t); stage = 'production'; priority = 1; pack = 'OperatorTierTag'; order = $order
|            classes = @('device'); osScope = @(); fallback = $false; mechanism = 'operator.tier_tag'
|            when = [ordered]@{ any = @([ordered]@{ field = 'si_tags'; op = 'matches'; value = $pat }) }
|            set = [ordered]@{ si_tier = $t }; exclude = @(); native = $true; asserted = $true
|        }
|    }
|}
|
|function Get-SICiTagTierRules {
|    <# The tier tag rules with the tagPattern of the merged endpoint schema (locked + custom + Pro overlay); the shipped default when it cannot be read. #>
|    $pattern = $null
|    try {
|        if (-not (Get-Command -Name Get-SISchemaWithCustomMerge -ErrorAction SilentlyContinue)) {
|            . (Join-Path (Split-Path -Parent $PSScriptRoot) 'asset-profiling\shared\Get-SISchemaWithCustomMerge.ps1')
|        }
|        $schema = Get-SISchemaWithCustomMerge -Engine endpoint
|        foreach ($c in @(Get-SIItemValue (Get-SIItemValue $schema 'aggregator') 'contributors')) {
|            if ($null -ne $c -and [string](Get-SIItemValue $c 'id') -eq 'tenant_si_manual_tag') { $pattern = [string](Get-SIItemValue $c 'tagPattern'); break }
|        }
|    } catch { Write-Warning ("CI rules: the endpoint schema could not be read for the tier tag pattern ({0}) -- the shipped pattern is used." -f $_.Exception.Message) }
|    @(ConvertTo-SICiTagTierRules -TagPattern $pattern)
|}
|
|# ---------------------------------------------------------------------------------------------------
|# #690 (48) The identity's tier = the tier of the HIGHEST privilege it holds today (owner 2026-10-15: "identity follows the
|# highest perm a user has today"), as SI tier rules over the privilege tier catalog
|# ---------------------------------------------------------------------------------------------------
|
|function ConvertTo-SICiPrivilegeTierRules {
|    <#
|        PURE. The privilege tier catalog (privilege-tier-catalog.locked.json; -Custom = the tenant's .custom.json, which moves
|        or adds an entry by its key) -> CI tier rules for identities, one per privilege kind and tier 0..2:
|          entra-role-tier<t>      a permanent or eligible Entra role of tier t (the profiler's catalog verdict on the record,
|                                  si_privilege_tier_permanent / _eligible, or the role's name in si_entra_roles_permanent /
|                                  _eligible -- custom roles included)
|          azure-rbac-tier<t>      an Azure RBAC assignment whose effective tier (role tier at its scope) is t
|                                  (si_azure_role_assignments, EffectiveTier)
|          app-permission-tier<t>  an application permission of tier t (si_app_permissions)
|          ad-group-tier<t>        a critical AD group of tier t (si_ad_critical_groups)
|        Every rule is an observed claim (mechanism privilege_catalog, never a fallback, never asserted); the CI's tier is the
|        MIN of every claim, so the account takes the tier of its highest privilege. Tier 3 has no rule: holding only Tier 3
|        privileges is what the default tier already says. Nothing is hard-coded: the names come from the catalog.
|    #>
|    param([Parameter(Mandatory)]$Catalog, $Custom, [int]$StartOrder = 800000)
|    $sect = {
|        param($Doc, [string]$Name)
|        if ($null -eq $Doc) { return @() }
|        $v = Get-SIItemValue $Doc $Name
|        if ($null -eq $v) { return @() }
|        @((Get-SIValueList $v).ToArray())
|    }
|    # key -> tier, the catalog first, then the tenant's file (a custom entry moves its key to its own tier)
|    $byKind = @{ entra = @{}; app = @{}; ad = @{} }
|    $collect = {
|        param($Doc)
|        foreach ($t in 0..3) {
|            foreach ($s in @('EntraID_BuiltInRoles_Tier{0}' -f $t), @('EntraID_CustomRoles_Tier{0}' -f $t)) {
|                foreach ($e in (& $sect $Doc $s)) { $k = [string](Get-SIItemValue $e 'DisplayName'); if ($k) { $byKind.entra[$k.ToLowerInvariant()] = @($k, $t) } }
|            }
|            foreach ($e in (& $sect $Doc ('EntraID_APIPermissions_Tier{0}' -f $t))) {
|                if ([string](Get-SIItemValue $e 'PermissionType') -ne 'Application') { continue }
|                $k = [string](Get-SIItemValue $e 'Value'); if ($k) { $byKind.app[$k.ToLowerInvariant()] = @($k, $t) }
|            }
|            foreach ($s in @('AD_BuiltInPermissionGroups_Tier{0}' -f $t), @('AD_CustomGroups_Tier{0}' -f $t)) {
|                foreach ($e in (& $sect $Doc $s)) { $k = [string](Get-SIItemValue $e 'Name'); if ($k) { $byKind.ad[$k.ToLowerInvariant()] = @($k, $t) } }
|            }
|        }
|    }
|    & $collect $Catalog
|    if ($null -ne $Custom) { & $collect $Custom }
|    $namesOf = { param([hashtable]$Map, [int]$Tier) @($Map.Values | Where-Object { $_[1] -eq $Tier } | ForEach-Object { [string]$_[0] } | Sort-Object -Unique) }
|    $rule = {
|        param([string]$Id, [string]$Name, [int]$Tier, $When)
|        $script:__siPtOrder++
|        [pscustomobject][ordered]@{
|            id = ('identity-privilege/{0}' -f $Id); family = 'ci'; file = 'privilege-tier-catalog/privilege-tier-catalog.locked.json'
|            name = $Name; stage = 'production'; priority = 100; pack = 'IdentityPrivilegeTier'; order = ($StartOrder + $script:__siPtOrder)
|            classes = @('identity'); osScope = @(); fallback = $false; mechanism = 'privilege_catalog'
|            when = $When; set = [ordered]@{ si_tier = $Tier }; exclude = @(); native = $true; asserted = $false
|        }
|    }
|    $script:__siPtOrder = 0
|    foreach ($t in 0..2) {
|        $roles = @(& $namesOf $byKind.entra $t)
|        $any = New-Object System.Collections.Generic.List[object]
|        $any.Add([ordered]@{ field = 'si_privilege_tier_permanent'; op = 'eq'; value = $t })
|        $any.Add([ordered]@{ field = 'si_privilege_tier_eligible'; op = 'eq'; value = $t })
|        if ($roles.Count) {
|            $any.Add([ordered]@{ field = 'si_entra_roles_permanent'; op = 'in'; value = $roles })
|            $any.Add([ordered]@{ field = 'si_entra_roles_eligible'; op = 'in'; value = $roles })
|        }
|        & $rule ('entra-role-tier{0}' -f $t) ('Holds a Tier {0} Entra role (permanent or eligible)' -f $t) $t ([ordered]@{ any = $any.ToArray() })
|        & $rule ('azure-rbac-tier{0}' -f $t) ('Holds a Tier {0} Azure RBAC role at its scope' -f $t) $t ([ordered]@{ any = @([ordered]@{ field = 'si_azure_role_assignments'; op = 'matches'; value = ('(EffectiveTier=|"EffectiveTier"\s*:\s*){0}(?![0-9])' -f $t) }) })
|        $perms = @(& $namesOf $byKind.app $t)
|        if ($perms.Count) { & $rule ('app-permission-tier{0}' -f $t) ('Holds a Tier {0} application permission' -f $t) $t ([ordered]@{ any = @([ordered]@{ field = 'si_app_permissions'; op = 'in'; value = $perms }) }) }
|        $groups = @(& $namesOf $byKind.ad $t)
|        if ($groups.Count) { & $rule ('ad-group-tier{0}' -f $t) ('Member of a Tier {0} AD group' -f $t) $t ([ordered]@{ any = @([ordered]@{ field = 'si_ad_critical_groups'; op = 'in'; value = $groups }) }) }
|    }
|}
|
|function Get-SICiPrivilegeTierRules {
|    <# The identity privilege tier rules from the shipped privilege tier catalog and the tenant's custom file beside it; none (and a warning) when the catalog cannot be read. #>
|    param([string]$Root)
|    if (-not $Root) { $Root = Split-Path -Parent (Split-Path -Parent $PSScriptRoot) }
|    $dir = [System.IO.Path]::Combine($Root, 'privilege-tier-catalog')
|    try {
|        $cat = [System.IO.File]::ReadAllText([System.IO.Path]::Combine($dir, 'privilege-tier-catalog.locked.json')).TrimStart([char]0xFEFF) | ConvertFrom-Json
|        $cus = $null
|        $cp = [System.IO.Path]::Combine($dir, 'privilege-tier-catalog.custom.json')
|        if (Test-Path -LiteralPath $cp) {
|            try { $cus = [System.IO.File]::ReadAllText($cp).TrimStart([char]0xFEFF) | ConvertFrom-Json } catch { Write-Warning ("CI rules: the tenant's privilege tier catalog could not be read ({0}) -- the shipped catalog is used." -f $_.Exception.Message) }
|        }
|        return @(ConvertTo-SICiPrivilegeTierRules -Catalog $cat -Custom $cus)
|    } catch {
|        Write-Warning ("CI rules: the privilege tier catalog could not be read ({0}) -- identities get no privilege tier this run." -f $_.Exception.Message)
|        return @()
|    }
|}
|
|# ---------------------------------------------------------------------------------------------------
|# Manual CI overrides (precedence 1)
|# ---------------------------------------------------------------------------------------------------
|
|function Get-SICiOverrideReadSql {
|    <# Every override in force (not expired). A database without the table answers no rows (it is created by the updater). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.CiOverride') IS NULL
|    SELECT CAST(NULL AS NVARCHAR(64)) AS CiId, CAST(NULL AS NVARCHAR(64)) AS Field, CAST(NULL AS NVARCHAR(400)) AS Value, CAST(NULL AS NVARCHAR(1000)) AS Reason,
|           CAST(NULL AS NVARCHAR(256)) AS SetBy, CAST(NULL AS DATETIME2(0)) AS SetAt, CAST(NULL AS DATETIME2(0)) AS ExpiresAt WHERE 1 = 0;
|ELSE
|    EXEC sp_executesql N'SELECT CiId, Field, Value, Reason, SetBy, SetAt, ExpiresAt FROM sidata.CiOverride WHERE (ExpiresAt IS NULL OR ExpiresAt > SYSUTCDATETIME()) AND ISNULL(Removed, 0) = 0';
|'@
|}
|
|function ConvertTo-SICiOverrideIndex {
|    <#
|        PURE. Override rows -> CiId (case-insensitive) -> [ { field; value; reason; set_by; set_at; expires_at } ]. Expired rows
|        (ExpiresAt <= -Now) and rows for a field that may not be overridden are left out. Overridable: si_tier, si_purpose,
|        si_category, si_department, si_cmdb_* (CMDB fields), si_lifecycle is NOT (it is evidence, never a decision).
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [datetime]$Now = [datetime]::UtcNow)
|    $idx = New-Object System.Collections.Hashtable ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($r in $Rows) {
|        if ($null -eq $r) { continue }
|        $ci = [string](Get-SIItemValue $r 'CiId'); $f = ([string](Get-SIItemValue $r 'Field')).Trim().ToLowerInvariant()
|        if (-not $ci -or -not $f) { continue }
|        if ($f -notmatch '^(si_tier|si_purpose|si_category|si_department|si_cmdb_[a-z_]+)$') { continue }
|        $exp = ConvertTo-SIUtcOrNull (Get-SIItemValue $r 'ExpiresAt')
|        if ($exp -and $exp -le $Now) { continue }
|        if (-not $idx.ContainsKey($ci)) { $idx[$ci] = New-Object System.Collections.Generic.List[object] }
|        $idx[$ci].Add([ordered]@{ field = $f; value = (Get-SIItemValue $r 'Value'); reason = [string](Get-SIItemValue $r 'Reason'); set_by = [string](Get-SIItemValue $r 'SetBy')
|                set_at = (ConvertTo-SIUtcOrNull (Get-SIItemValue $r 'SetAt')); expires_at = $exp })
|    }
|    # plain arrays (a caller's @() around a generic list throws "Argument types do not match")
|    foreach ($k in @($idx.Keys)) { $idx[$k] = $idx[$k].ToArray() }
|    $idx
|}
|
|function Set-SICiOverrides {
|    <#
|        PURE. The manual overrides of one CI applied OVER the rules' result (precedence 1, V3-DATA-MODEL 2.8): the field takes
|        the override's value; si_tier sets si_tier_set_by = override and si_tier_reason = the override's reason; the claim the
|        rules would have chosen stays in si_tier_claims (marked not winning). Every override in force -> si_overrides.
|    #>
|    param([Parameter(Mandatory)]$Ci, [hashtable]$Index)
|    if ($null -eq $Index) { return $Ci }
|    $id = [string]$Ci['si_ci_id']
|    if (-not $id -or -not $Index.ContainsKey($id)) { return $Ci }
|    $applied = New-Object System.Collections.Generic.List[object]
|    foreach ($o in $Index[$id]) {
|        $f = [string]$o.field
|        if ($f -eq 'si_tier') {
|            $t = 0
|            if (-not [int]::TryParse([string]$o.value, [ref]$t) -or $t -lt 0 -or $t -gt 3) { continue }
|            $was = $Ci['si_tier']
|            $Ci['si_tier'] = $t
|            $Ci['si_tier_set_by'] = 'override'
|            $Ci['si_tier_reason'] = ('manual override by {0}: {1}' -f $(if ($o.set_by) { $o.set_by } else { 'an administrator' }), $o.reason)
|            foreach ($c in @($Ci['si_tier_claims'])) { if ($c -and $c['winner']) { $c['winner'] = $false } }
|            $applied.Add([ordered]@{ field = $f; value = $t; rules_value = $was; reason = $o.reason; set_by = $o.set_by; set_at = $o.set_at; expires_at = $o.expires_at })
|            continue
|        }
|        $was = $Ci[$f]
|        $Ci[$f] = $o.value
|        $applied.Add([ordered]@{ field = $f; value = $o.value; rules_value = $was; reason = $o.reason; set_by = $o.set_by; set_at = $o.set_at; expires_at = $o.expires_at })
|    }
|    if ($applied.Count -gt 0) { $Ci['si_overrides'] = $applied.ToArray() }
|    # #579 the explanation names the override (who, reason, expiry) and what the rules would have chosen
|    if (@($applied | Where-Object { $_.field -eq 'si_tier' }).Count -gt 0 -and (Get-Command -Name Get-SICiTierExplanation -ErrorAction SilentlyContinue)) { $Ci['si_tier_explanation'] = Get-SICiTierExplanation -Ci $Ci }
|    return $Ci
|}
'@ }
$__siSupportFiles['engine/asset-profiling/shared/Get-SISchemaWithCustomMerge.ps1'] = @{ Sha256 = 'f5afebb232c70fadc4d5f133af68f008781c932545b0279f0bcc5a8797667a1e'; Text = @'
|#Requires -Version 5.1
|<#
|    Get-SISchemaWithCustomMerge.ps1
|
|    Loads profiles/<engine>.schema.json (locked) and merges it with the
|    optional profiles-custom/<engine>.schema.custom.json (customer
|    overlay). Used by every row builder + tier computer so the engine reads
|    the SAME merged schema regardless of source.
|
|    Merge semantics (mirrors the locked+custom pattern already used for
|    posture rules + privilege-tier-classifier catalog + endpoint-tiering catalog):
|
|      fields[*]                        -- same `name`     => REPLACES locked
|                                         -- new `name`      => APPENDS
|      aggregator.contributors[*]       -- same `id`       => REPLACES locked
|                                         -- new `id`        => APPENDS
|      rawPayload.sources.<src>.includePaths[*]
|                                       -- UNION (de-duped, locked first)
|      rawPayload.sources.<new-src>     -- new source bucket entirely => ADD
|      hashes / entityIds / aiEligibility / engine-meta
|                                       -- UNCHANGED (cannot be overridden;
|                                          these are engine invariants)
|
|    Cached per engine on first call. To force a reload (rare -- e.g., during
|    development), call: $script:_SISchemaMergeCache.Remove('<engine>')
|
|    Customer drops their override at:
|        v2.2/asset-profiling-schema/<engine>.schema.custom.json
|
|    See profiles-custom/<engine>.schema.custom.sample.json for a working
|    template per engine.
|#>
|
|if (-not (Get-Variable -Name _SISchemaMergeCache -Scope Script -ErrorAction SilentlyContinue)) {
|    $script:_SISchemaMergeCache = @{}
|}
|
|function Get-SISchemaWithCustomMerge {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)]
|        [ValidateSet('identity','endpoint','azure','publicip')]
|        [string]$Engine,
|
|        [switch]$NoCache    # force re-read + re-merge (development helper)
|    )
|
|    if (-not $NoCache -and $script:_SISchemaMergeCache.ContainsKey($Engine)) {
|        return $script:_SISchemaMergeCache[$Engine]
|    }
|
|    # Resolve solution paths from this script's location.
|    # $PSScriptRoot = v2.2/engine/asset-profiling/shared -> three parents = v2.2 root.
|    $siRoot    = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))
|    # publicip schema file is named 'public-ip.schema.json' (hyphen) for
|    # readability; engine token stays 'publicip' everywhere else.
|    $fileBase   = if ($Engine -eq 'publicip') { 'public-ip' } else { $Engine }
|    $lockedPath = Join-Path $siRoot ('asset-profiling-schema\{0}.schema.locked.json' -f $fileBase)
|    $customPath = Join-Path $siRoot ('asset-profiling-schema\{0}.schema.custom.json' -f $fileBase)
|    # SecurityInsight Pro (Phase C): a schema overlay materialised from the settings database wins over the installation's.
|    if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_ProConfigRoot)) {
|        $proCustom = [IO.Path]::Combine([string]$global:SI_ProConfigRoot, 'asset-profiling-schema', ('{0}.schema.custom.json' -f $fileBase))
|        if (Test-Path -LiteralPath $proCustom) { $customPath = $proCustom }
|    }
|
|    if (-not (Test-Path $lockedPath)) {
|        throw ('Locked schema not found at {0}' -f $lockedPath)
|    }
|
|    $locked = Get-Content $lockedPath -Raw -Encoding UTF8 | ConvertFrom-Json
|
|    # Locked-only path -- no custom overlay present
|    if (-not (Test-Path $customPath)) {
|        $script:_SISchemaMergeCache[$Engine] = $locked
|        return $locked
|    }
|
|    $custom = $null
|    try {
|        $custom = Get-Content $customPath -Raw -Encoding UTF8 | ConvertFrom-Json
|    } catch {
|        Write-Warning ("Custom schema overlay parse failed for engine '{0}'; using locked-only. Path: {1}. Error: {2}" -f $Engine, $customPath, $_.Exception.Message)
|        $script:_SISchemaMergeCache[$Engine] = $locked
|        return $locked
|    }
|    if (-not $custom) {
|        $script:_SISchemaMergeCache[$Engine] = $locked
|        return $locked
|    }
|
|    # ---- 1. Merge fields[] -----------------------------------------------
|    $fieldsAdded    = 0
|    $fieldsReplaced = 0
|    if ($custom.PSObject.Properties['fields'] -and $custom.fields) {
|        $merged = New-Object System.Collections.ArrayList
|        foreach ($f in $locked.fields) { [void]$merged.Add($f) }
|        $existingByName = @{}
|        for ($i = 0; $i -lt $merged.Count; $i++) {
|            if ($merged[$i].PSObject.Properties['name']) { $existingByName[[string]$merged[$i].name] = $i }
|        }
|        foreach ($cf in $custom.fields) {
|            if (-not $cf.PSObject.Properties['name']) { continue }
|            $cn = [string]$cf.name
|            if ($existingByName.ContainsKey($cn)) {
|                $merged[$existingByName[$cn]] = $cf
|                $fieldsReplaced++
|            } else {
|                [void]$merged.Add($cf)
|                $existingByName[$cn] = $merged.Count - 1
|                $fieldsAdded++
|            }
|        }
|        $locked.fields = $merged.ToArray()
|    }
|
|    # ---- 2. Merge aggregator.contributors[] ------------------------------
|    $contribAdded    = 0
|    $contribReplaced = 0
|    if ($custom.PSObject.Properties['aggregator'] -and $custom.aggregator -and
|        $custom.aggregator.PSObject.Properties['contributors'] -and $custom.aggregator.contributors) {
|        if (-not $locked.aggregator) {
|            # No locked aggregator at all; lift the custom one verbatim
|            $locked | Add-Member -NotePropertyName aggregator -NotePropertyValue $custom.aggregator -Force
|        } else {
|            $merged = New-Object System.Collections.ArrayList
|            foreach ($c in $locked.aggregator.contributors) { [void]$merged.Add($c) }
|            $existingById = @{}
|            for ($i = 0; $i -lt $merged.Count; $i++) {
|                if ($merged[$i].PSObject.Properties['id']) { $existingById[[string]$merged[$i].id] = $i }
|            }
|            foreach ($cc in $custom.aggregator.contributors) {
|                if (-not $cc.PSObject.Properties['id']) { continue }
|                $cid = [string]$cc.id
|                if ($existingById.ContainsKey($cid)) {
|                    $merged[$existingById[$cid]] = $cc
|                    $contribReplaced++
|                } else {
|                    [void]$merged.Add($cc)
|                    $existingById[$cid] = $merged.Count - 1
|                    $contribAdded++
|                }
|            }
|            $locked.aggregator.contributors = $merged.ToArray()
|        }
|    }
|
|    # ---- 3. Merge rawPayload.sources.<src>.includePaths[] (UNION) --------
|    $pathsAdded   = 0
|    $sourcesAdded = 0
|    if ($custom.PSObject.Properties['rawPayload'] -and $custom.rawPayload -and
|        $custom.rawPayload.PSObject.Properties['sources'] -and $custom.rawPayload.sources) {
|        foreach ($srcProp in $custom.rawPayload.sources.PSObject.Properties) {
|            $srcName = $srcProp.Name
|            $cs      = $srcProp.Value
|            $ls      = $null
|            if ($locked.rawPayload -and $locked.rawPayload.sources -and
|                $locked.rawPayload.sources.PSObject.Properties[$srcName]) {
|                $ls = $locked.rawPayload.sources.$srcName
|            }
|            if (-not $ls) {
|                # Entirely new source bucket
|                $locked.rawPayload.sources | Add-Member -NotePropertyName $srcName -NotePropertyValue $cs -Force
|                $sourcesAdded++
|                continue
|            }
|            if ($cs.PSObject.Properties['includePaths'] -and $cs.includePaths) {
|                $existing  = if ($ls.PSObject.Properties['includePaths'] -and $ls.includePaths) { @($ls.includePaths) } else { @() }
|                $additions = @($cs.includePaths) | Where-Object { $_ -notin $existing }
|                if ($additions.Count -gt 0) {
|                    $ls.includePaths = @($existing + $additions)
|                    $pathsAdded += $additions.Count
|                }
|            }
|        }
|    }
|
|    # ---- Diagnostic summary (only when something actually changed) -------
|    if ($fieldsAdded + $fieldsReplaced + $contribAdded + $contribReplaced + $pathsAdded + $sourcesAdded -gt 0) {
|        Write-SIInfo ('   [schema] {0} custom overlay merged: fields +{1}/replaced {2}, contributors +{3}/replaced {4}, includePaths +{5}, new source buckets +{6}' -f `
|            $Engine, $fieldsAdded, $fieldsReplaced, $contribAdded, $contribReplaced, $pathsAdded, $sourcesAdded)
|    }
|
|    $script:_SISchemaMergeCache[$Engine] = $locked
|    return $locked
|}
'@ }
$__siSupportFiles['data-model/rules/AssetTagging.locked.yaml'] = @{ Sha256 = 'ae7bda074da9db8f63c7b477b8219c44c619280a352591ad56251533b3cedb40'; Text = @'
|# SecurityInsight -- the AssetTagging rule pack on the CI (#462, V3-DATA-MODEL 2.8).
|# The asset-tagging engine (asset-profiling-enrichment/endpoint/AssetTagging.locked.yaml) decides its auto-exclusion
|# tags with KQL against Defender and WRITES them to Defender. This pack states the same decisions over SI FIELDS, so the
|# CI carries the tag the engine writes (si_tags, source rule) -- one rule model, no provider names.
|# The engine's switches apply here too: config_flag names its AutoExcludeRules.* switch (config/asset-tagging.config.json)
|# and the rule runs ONLY when that switch is true -- no file, no switch or false = the rule is not used (#643: every tag
|# here is an EXCLUSION, which every report honours, so it is the customer's choice and never a default -- the same rule as
|# the tagging engine and the shipped sample). config_patterns takes the condition from its DeviceNamePatterns
|# (StartsWith / Contains / MatchesRegex).
|# Customer changes: data-model/rules/AssetTagging.custom.yaml (or the data-model overlay's rules/ folder), one rule per id.
|# The pack header (name, stage, priority, source) is what the Rule packs page shows; a custom file may set stage /
|# enabled for the whole pack (Pro: Configuration > Rule packs, through Review & commit).
|name: Asset tagging
|description: Tags the devices Defender cannot onboard, has too little information about or does not support, and the devices whose name matches an exclusion pattern.
|stage: production
|priority: 100
|source: shipped
|rules:
|  - id: asset-tagging/can-be-onboarded
|    name: Defender can onboard this device, it is not onboarded
|    stage: production
|    priority: 100
|    applies_to: [device]
|    mechanism: mde.detection
|    config_flag: AutoExcludeRules.ExcludeCanBeOnboarded
|    when:
|      any:
|        - si_onboarding_status:
|            eq: can_be_onboarded
|    set:
|      si_tags: [Auto-CanBeOnboarded--Excluded--SI]
|  - id: asset-tagging/insufficient-info
|    name: Defender has insufficient information about this device
|    stage: production
|    priority: 100
|    applies_to: [device]
|    mechanism: mde.detection
|    config_flag: AutoExcludeRules.ExcludeInsufficientInfo
|    when:
|      any:
|        - si_onboarding_status:
|            eq: insufficient_info
|    set:
|      si_tags: [Auto-InsufficientInfo--Excluded--SI]
|  - id: asset-tagging/unsupported
|    name: Defender does not support this device
|    stage: production
|    priority: 100
|    applies_to: [device]
|    mechanism: mde.detection
|    config_flag: AutoExcludeRules.ExcludeUnsupported
|    when:
|      any:
|        - si_onboarding_status:
|            eq: unsupported
|    set:
|      si_tags: [Auto-Unsupported--Excluded--SI]
|  - id: asset-tagging/name-pattern
|    name: The device name matches an exclusion pattern
|    stage: production
|    priority: 100
|    applies_to: [device]
|    mechanism: name.pattern
|    config_flag: AutoExcludeRules.ExcludeByDeviceNamePattern
|    config_patterns: DeviceNamePatterns
|    when:
|      any:
|        - si_asset_name:
|            is_empty: true
|    set:
|      si_tags: [Auto-NamePattern--Excluded--SI]
'@ }
$__siSupportFiles['privilege-tier-catalog/privilege-tier-catalog.locked.json'] = @{ Sha256 = '9350070a214aca2618d93fb10c8e7fc3e8701149e663355d21a4ec05fadc3499'; Text = @'
|{
|    "Metadata":  {
|                     "GeneratedAt":  "2026-05-03 00:08:22",
|                     "GeneratedBy":  "SecurityInsight-PrivilegeTierClassifier.ps1 v2.0",
|                     "TenantId":  "<redacted -- audit #21>",
|                     "TieringModel":  "Attacker-centric (0=immediate compromise, 3=low blast radius)",
|                     "AICallsUsed":  4
|                 },
|    "AD_BuiltInPermissionGroups_Tier0":  [
|                                             {
|                                                 "Name":  "Administrators",
|                                                 "Tier":  0,
|                                                 "Reason":  "Full control over the domain and ability to assign roles or reset credentials, enabling immediate full environment compromise."
|                                             },
|                                             {
|                                                 "Name":  "Domain Admins",
|                                                 "Tier":  0,
|                                                 "Reason":  "Full domain control enabling immediate full environment compromise."
|                                             },
|                                             {
|                                                 "Name":  "Domain Controllers",
|                                                 "Tier":  0,
|                                                 "Reason":  "Membership grants control over domain controllers enabling full domain compromise."
|                                             },
|                                             {
|                                                 "Name":  "Schema Admins",
|                                                 "Tier":  0,
|                                                 "Reason":  "Can modify AD schema, enabling full domain compromise and identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Enterprise Admins",
|                                                 "Tier":  0,
|                                                 "Reason":  "Highest privilege group with full forest-wide control enabling immediate full environment compromise."
|                                             },
|                                             {
|                                                 "Name":  "Group Policy Creator Owners",
|                                                 "Tier":  0,
|                                                 "Reason":  "Can create and modify GPOs affecting tier 0 objects, enabling full domain compromise."
|                                             },
|                                             {
|                                                 "Name":  "Cert Publishers",
|                                                 "Tier":  0,
|                                                 "Reason":  "Can publish certificates to AD, enabling issuance of certificates for domain controllers and full compromise."
|                                             },
|                                             {
|                                                 "Name":  "Enterprise Domain Controllers",
|                                                 "Tier":  0,
|                                                 "Reason":  "Group for all domain controllers with full control enabling immediate full environment compromise."
|                                             },
|                                             {
|                                                 "Name":  "SYSTEM",
|                                                 "Tier":  0,
|                                                 "Reason":  "Highest privilege account on Windows systems; full control over domain controllers and identity plane."
|                                             }
|                                         ],
|    "AD_BuiltInPermissionGroups_Tier1":  [
|                                             {
|                                                 "Name":  "Print Operators",
|                                                 "Tier":  1,
|                                                 "Reason":  "Can manage printers and potentially escalate privileges via print spooler vulnerabilities or local admin rights on servers."
|                                             },
|                                             {
|                                                 "Name":  "Backup Operators",
|                                                 "Tier":  1,
|                                                 "Reason":  "Can back up and restore files including sensitive data and potentially escalate privileges via backup restoration or SeBackupPrivilege."
|                                             },
|                                             {
|                                                 "Name":  "Server Operators",
|                                                 "Tier":  1,
|                                                 "Reason":  "Can manage servers including starting/stopping services and creating users, enabling privilege escalation to domain admin in some cases."
|                                             },
|                                             {
|                                                 "Name":  "Account Operators",
|                                                 "Tier":  1,
|                                                 "Reason":  "Can create, modify, and delete user accounts except admins, enabling privilege escalation to domain admin."
|                                             },
|                                             {
|                                                 "Name":  "Key Admins",
|                                                 "Tier":  1,
|                                                 "Reason":  "Can manage cryptographic keys impacting identity plane security and enabling privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Enterprise Key Admins",
|                                                 "Tier":  1,
|                                                 "Reason":  "Can manage enterprise cryptographic keys enabling privilege escalation and identity plane control."
|                                             }
|                                         ],
|    "AD_BuiltInPermissionGroups_Tier2":  [
|                                             {
|                                                 "Name":  "Hyper-V Administrators",
|                                                 "Tier":  2,
|                                                 "Reason":  "Can manage Hyper-V hosts and VMs, enabling potential data or workload impact but no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Storage Replica Administrators",
|                                                 "Tier":  2,
|                                                 "Reason":  "Can manage storage replication, impacting workloads but no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "DnsAdmins",
|                                                 "Tier":  2,
|                                                 "Reason":  "Can manage DNS, enabling potential code execution on DCs but requires additional steps for full compromise."
|                                             }
|                                         ],
|    "AD_BuiltInPermissionGroups_Tier3":  [
|                                             {
|                                                 "Name":  "Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Default group for standard users with no direct path to identity plane control or tenant takeover."
|                                             },
|                                             {
|                                                 "Name":  "Guests",
|                                                 "Tier":  3,
|                                                 "Reason":  "Limited access group for guest accounts with no escalation path to identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Replicator",
|                                                 "Tier":  3,
|                                                 "Reason":  "Used for file replication with no direct identity plane control or privilege escalation path."
|                                             },
|                                             {
|                                                 "Name":  "Remote Desktop Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Allows remote desktop access but no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Network Configuration Operators",
|                                                 "Tier":  3,
|                                                 "Reason":  "Can manage network configuration but no direct path to identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Performance Monitor Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Can monitor performance counters but no identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Performance Log Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Can manage performance logs but no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Distributed COM Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Can launch DCOM applications but no direct path to identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "IIS_IUSRS",
|                                                 "Tier":  3,
|                                                 "Reason":  "Group for IIS worker process identity with no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Cryptographic Operators",
|                                                 "Tier":  3,
|                                                 "Reason":  "Can perform cryptographic operations but no direct path to identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Event Log Readers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Read access to event logs only; no identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Certificate Service DCOM Access",
|                                                 "Tier":  3,
|                                                 "Reason":  "Allows access to certificate services DCOM interface but no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "RDS Remote Access Servers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Role for Remote Desktop Services with no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "RDS Endpoint Servers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Role for Remote Desktop Services with no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "RDS Management Servers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Role for Remote Desktop Services with no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Access Control Assistance Operators",
|                                                 "Tier":  3,
|                                                 "Reason":  "Can remotely query authorization attributes but no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Remote Management Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Can perform remote management tasks but no direct path to identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Pre-Windows 2000 Compatible Access",
|                                                 "Tier":  3,
|                                                 "Reason":  "Legacy group for backward compatibility with no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Incoming Forest Trust Builders",
|                                                 "Tier":  3,
|                                                 "Reason":  "Can create incoming forest trusts but no direct identity plane control or credential access."
|                                             },
|                                             {
|                                                 "Name":  "Windows Authorization Access Group",
|                                                 "Tier":  3,
|                                                 "Reason":  "Allows reading of authorization attributes but no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Terminal Server License Servers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Manages TS licensing with no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Domain Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Default group for all domain users with no direct path to identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Domain Guests",
|                                                 "Tier":  3,
|                                                 "Reason":  "Default group for guest accounts with no escalation path to identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Domain Computers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Group for domain-joined computers with no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Read-only Domain Controllers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Read-only access to DCs with no write or identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Enterprise Read-only Domain Controllers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Read-only access to enterprise DCs with no write or identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Cloneable Domain Controllers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Allows cloning of DCs but no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Protected Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Security group to protect users from credential theft, no privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "DnsUpdateProxy",
|                                                 "Tier":  3,
|                                                 "Reason":  "Allows DNS updates with no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "RAS and IAS Servers",
|                                                 "Tier":  3,
|                                                 "Reason":  "Role for remote access servers with no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Allowed RODC Password Replication Group",
|                                                 "Tier":  3,
|                                                 "Reason":  "Controls which passwords can be cached on RODCs, no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Denied RODC Password Replication Group",
|                                                 "Tier":  3,
|                                                 "Reason":  "Controls which passwords cannot be cached on RODCs, no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Everyone",
|                                                 "Tier":  3,
|                                                 "Reason":  "Includes all users and guests with no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Authenticated Users",
|                                                 "Tier":  3,
|                                                 "Reason":  "Default group including all authenticated users; no direct identity plane control or privilege escalation path."
|                                             },
|                                             {
|                                                 "Name":  "Creator Owner",
|                                                 "Tier":  3,
|                                                 "Reason":  "Special identity representing the creator of an object; no direct path to tenant or domain takeover."
|                                             },
|                                             {
|                                                 "Name":  "Network",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents network logon type; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Interactive",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents interactive logon type; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Service",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents service logon type; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Dialup",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents dial-up logon type; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Anonymous Logon",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents anonymous logon; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Batch",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents batch logon type; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Proxy",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents proxy logon type; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "SELF",
|                                                 "Tier":  3,
|                                                 "Reason":  "Special identity representing the object itself; no direct path to identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Creator Group",
|                                                 "Tier":  3,
|                                                 "Reason":  "Special identity representing the creator\u0027s primary group; no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Local Service",
|                                                 "Tier":  3,
|                                                 "Reason":  "Built-in service account with limited privileges; no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Network Service",
|                                                 "Tier":  3,
|                                                 "Reason":  "Built-in service account with limited privileges; no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Remote Interactive Logon",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents remote interactive logon type; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "This Organization",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents all users in the organization; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "Other Organization",
|                                                 "Tier":  3,
|                                                 "Reason":  "Represents users outside the organization; no direct identity plane control or privilege escalation."
|                                             },
|                                             {
|                                                 "Name":  "IUSR",
|                                                 "Tier":  3,
|                                                 "Reason":  "Built-in account for anonymous IIS access; no direct identity plane control."
|                                             },
|                                             {
|                                                 "Name":  "Terminal Server User",
|                                                 "Tier":  3,
|                                                 "Reason":  "Group for terminal server users; no direct identity plane control or privilege escalation."
|                                             }
|                                         ],
|    "EntraID_BuiltInRoles_Tier0":  [
|                                       {
|                                           "Id":  "62e90394-69f5-4237-9190-012177145e10",
|                                           "DisplayName":  "Global Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  0,
|                                           "Reason":  "Direct full tenant control including role assignments and identity plane permissions enabling immediate full environment compromise.",
|                                           "Permissions":  [
|                                                               "microsoft.agentRegistry/allEntities/allProperties/allTasks",
|                                                               "microsoft.azure.advancedThreatProtection/allEntities/allTasks",
|                                                               "microsoft.azure.informationProtection/allEntities/allTasks",
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.backup/allEntities/allProperties/allTasks",
|                                                               "microsoft.cloudPC/allEntities/allProperties/allTasks",
|                                                               "microsoft.commerce.billing/allEntities/allProperties/allTasks",
|                                                               "microsoft.commerce.billing/purchases/standard/read",
|                                                               "microsoft.commerce.tenantRelationships/customerDelegatedAdminPrivileges/allProperties/allTasks",
|                                                               "microsoft.directory/accessReviews/allProperties/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions/allProperties/allTasks",
|                                                               "microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks",
|                                                               "microsoft.directory/administrativeUnits/allProperties/allTasks",
|                                                               "microsoft.directory/appConsent/appConsentRequests/allProperties/read",
|                                                               "microsoft.directory/applications/allProperties/allTasks",
|                                                               "microsoft.directory/applications/disablement/update",
|                                                               "microsoft.directory/applications/synchronization/standard/read",
|                                                               "microsoft.directory/applicationTemplates/instantiate",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/authorizationPolicy/allProperties/allTasks",
|                                                               "microsoft.directory/backup/preview/cancel",
|                                                               "microsoft.directory/backup/preview/create",
|                                                               "microsoft.directory/backup/recovery/cancel",
|                                                               "microsoft.directory/backup/recovery/create",
|                                                               "microsoft.directory/backup/standard/read",
|                                                               "microsoft.directory/bitlockerKeys/key/read",
|                                                               "microsoft.directory/bulkJobs/basic/update",
|                                                               "microsoft.directory/bulkJobs/create",
|                                                               "microsoft.directory/bulkJobs/standard/read",
|                                                               "microsoft.directory/cloudAppSecurity/allProperties/allTasks",
|                                                               "microsoft.directory/conditionalAccessPolicies/allProperties/allTasks",
|                                                               "microsoft.directory/connectorGroups/allProperties/read",
|                                                               "microsoft.directory/connectorGroups/allProperties/update",
|                                                               "microsoft.directory/connectorGroups/create",
|                                                               "microsoft.directory/connectorGroups/delete",
|                                                               "microsoft.directory/connectors/allProperties/read",
|                                                               "microsoft.directory/connectors/create",
|                                                               "microsoft.directory/contacts/allProperties/allTasks",
|                                                               "microsoft.directory/contracts/allProperties/allTasks",
|                                                               "microsoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/b2bCollaboration/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/b2bDirectConnect/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/tenantRestrictions/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/b2bCollaboration/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/b2bDirectConnect/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/create",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/delete",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/create",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/resetToDefaultSettings",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/resetToDefaultSettings",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/tenantRestrictions/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/standard/read",
|                                                               "microsoft.directory/customAuthenticationExtensions/allProperties/allTasks",
|                                                               "microsoft.directory/deletedItems/delete",
|                                                               "microsoft.directory/deletedItems/restore",
|                                                               "microsoft.directory/deviceLocalCredentials/password/read",
|                                                               "microsoft.directory/deviceManagementPolicies/basic/update",
|                                                               "microsoft.directory/deviceManagementPolicies/standard/read",
|                                                               "microsoft.directory/deviceRegistrationPolicy/basic/update",
|                                                               "microsoft.directory/deviceRegistrationPolicy/standard/read",
|                                                               "microsoft.directory/devices/allProperties/allTasks",
|                                                               "microsoft.directory/devices/permissions/update",
|                                                               "microsoft.directory/deviceTemplates/owners/read",
|                                                               "microsoft.directory/deviceTemplates/owners/update",
|                                                               "microsoft.directory/directoryRoles/allProperties/allTasks",
|                                                               "microsoft.directory/directoryRoleTemplates/allProperties/allTasks",
|                                                               "microsoft.directory/domains/allProperties/allTasks",
|                                                               "microsoft.directory/domains/federationConfiguration/basic/update",
|                                                               "microsoft.directory/domains/federationConfiguration/create",
|                                                               "microsoft.directory/domains/federationConfiguration/delete",
|                                                               "microsoft.directory/domains/federationConfiguration/standard/read",
|                                                               "microsoft.directory/entitlementManagement/allProperties/allTasks",
|                                                               "microsoft.directory/externalUserProfiles/basic/update",
|                                                               "microsoft.directory/externalUserProfiles/delete",
|                                                               "microsoft.directory/externalUserProfiles/standard/read",
|                                                               "microsoft.directory/groups/allProperties/allTasks",
|                                                               "microsoft.directory/groupsAssignableToRoles/allProperties/update",
|                                                               "microsoft.directory/groupsAssignableToRoles/assignLicense",
|                                                               "microsoft.directory/groupsAssignableToRoles/create",
|                                                               "microsoft.directory/groupsAssignableToRoles/delete",
|                                                               "microsoft.directory/groupsAssignableToRoles/reprocessLicenseAssignment",
|                                                               "microsoft.directory/groupsAssignableToRoles/restore",
|                                                               "microsoft.directory/groupSettings/allProperties/allTasks",
|                                                               "microsoft.directory/groupSettingTemplates/allProperties/allTasks",
|                                                               "microsoft.directory/hybridAuthenticationPolicy/allProperties/allTasks",
|                                                               "microsoft.directory/identityProtection/allProperties/allTasks",
|                                                               "microsoft.directory/lifecycleWorkflows/workflows/allProperties/allTasks",
|                                                               "microsoft.directory/loginOrganizationBranding/allProperties/allTasks",
|                                                               "microsoft.directory/multiTenantOrganization/basic/update",
|                                                               "microsoft.directory/multiTenantOrganization/create",
|                                                               "microsoft.directory/multiTenantOrganization/joinRequest/organizationDetails/update",
|                                                               "microsoft.directory/multiTenantOrganization/joinRequest/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/create",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/delete",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/organizationDetails/update",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/standard/read",
|                                                               "microsoft.directory/namedLocations/basic/update",
|                                                               "microsoft.directory/namedLocations/create",
|                                                               "microsoft.directory/namedLocations/delete",
|                                                               "microsoft.directory/namedLocations/standard/read",
|                                                               "microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks",
|                                                               "microsoft.directory/onPremisesSynchronization/basic/update",
|                                                               "microsoft.directory/onPremisesSynchronization/standard/read",
|                                                               "microsoft.directory/organization/allProperties/allTasks",
|                                                               "microsoft.directory/passwordHashSync/allProperties/allTasks",
|                                                               "microsoft.directory/pendingExternalUserProfiles/basic/update",
|                                                               "microsoft.directory/pendingExternalUserProfiles/create",
|                                                               "microsoft.directory/pendingExternalUserProfiles/delete",
|                                                               "microsoft.directory/pendingExternalUserProfiles/standard/read",
|                                                               "microsoft.directory/permissionGrantPolicies/basic/update",
|                                                               "microsoft.directory/permissionGrantPolicies/create",
|                                                               "microsoft.directory/permissionGrantPolicies/delete",
|                                                               "microsoft.directory/permissionGrantPolicies/standard/read",
|                                                               "microsoft.directory/policies/allProperties/allTasks",
|                                                               "microsoft.directory/privilegedIdentityManagement/allProperties/read",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/resourceNamespaces/resourceActions/authenticationContext/update",
|                                                               "microsoft.directory/roleAssignments/allProperties/allTasks",
|                                                               "microsoft.directory/roleDefinitions/allProperties/allTasks",
|                                                               "microsoft.directory/scopedRoleMemberships/allProperties/allTasks",
|                                                               "microsoft.directory/serviceAction/activateService",
|                                                               "microsoft.directory/serviceAction/disableDirectoryFeature",
|                                                               "microsoft.directory/serviceAction/enableDirectoryFeature",
|                                                               "microsoft.directory/serviceAction/getAvailableExtentionProperties",
|                                                               "microsoft.directory/servicePrincipalCreationPolicies/basic/update",
|                                                               "microsoft.directory/servicePrincipalCreationPolicies/create",
|                                                               "microsoft.directory/servicePrincipalCreationPolicies/delete",
|                                                               "microsoft.directory/servicePrincipalCreationPolicies/standard/read",
|                                                               "microsoft.directory/servicePrincipals/allProperties/allTasks",
|                                                               "microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-company-admin",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/credentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/jobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/schema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization/standard/read",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.directory/subscribedSkus/allProperties/allTasks",
|                                                               "microsoft.directory/tenantManagement/tenants/create",
|                                                               "microsoft.directory/users/allProperties/allTasks",
|                                                               "microsoft.directory/users/authenticationMethods/basic/update",
|                                                               "microsoft.directory/users/authenticationMethods/create",
|                                                               "microsoft.directory/users/authenticationMethods/delete",
|                                                               "microsoft.directory/users/authenticationMethods/standard/read",
|                                                               "microsoft.directory/users/convertExternalToInternalMemberUser",
|                                                               "microsoft.directory/verifiableCredentials/configuration/allProperties/read",
|                                                               "microsoft.directory/verifiableCredentials/configuration/allProperties/update",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/update",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/cards/revoke",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/create",
|                                                               "microsoft.directory/verifiableCredentials/configuration/create",
|                                                               "microsoft.directory/verifiableCredentials/configuration/delete",
|                                                               "microsoft.dynamics365/allEntities/allTasks",
|                                                               "microsoft.edge/allEntities/allProperties/allTasks",
|                                                               "microsoft.flow/allEntities/allTasks",
|                                                               "microsoft.graph.dataConnect/allEntities/allProperties/allTasks",
|                                                               "microsoft.hardware.support/shippingAddress/allProperties/allTasks",
|                                                               "microsoft.hardware.support/shippingStatus/allProperties/read",
|                                                               "microsoft.hardware.support/warrantyClaims/allProperties/allTasks",
|                                                               "microsoft.healthPlatform/allEntities/allProperties/allTasks",
|                                                               "microsoft.insights/allEntities/allProperties/allTasks",
|                                                               "microsoft.intune/allEntities/allTasks",
|                                                               "microsoft.microsoft365.organizationalData/allEntities/allProperties/allTasks",
|                                                               "microsoft.networkAccess/allEntities/allProperties/allTasks",
|                                                               "microsoft.networkAccess/trafficLogs/standard/read",
|                                                               "microsoft.office365.complianceManager/allEntities/allTasks",
|                                                               "microsoft.office365.copilot/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.desktopAnalytics/allEntities/allTasks",
|                                                               "microsoft.office365.exchange/allEntities/basic/allTasks",
|                                                               "microsoft.office365.fileStorageContainers/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.knowledge/contentUnderstanding/allProperties/allTasks",
|                                                               "microsoft.office365.knowledge/contentUnderstanding/analytics/allProperties/read",
|                                                               "microsoft.office365.knowledge/knowledgeNetwork/allProperties/allTasks",
|                                                               "microsoft.office365.knowledge/knowledgeNetwork/topicVisibility/allProperties/allTasks",
|                                                               "microsoft.office365.knowledge/learningSources/allProperties/allTasks",
|                                                               "microsoft.office365.lockbox/allEntities/allTasks",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.messageCenter/securityMessages/read",
|                                                               "microsoft.office365.migrations/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.organizationalMessages/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.protectionCenter/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.search/content/manage",
|                                                               "microsoft.office365.securityComplianceCenter/allEntities/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.sharePointAdvancedManagement/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.sharePoint/allEntities/allTasks",
|                                                               "microsoft.office365.skypeForBusiness/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.userCommunication/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.office365.yammer/allEntities/allProperties/allTasks",
|                                                               "microsoft.peopleAdmin/organization/allProperties/read",
|                                                               "microsoft.peopleAdmin/organization/allProperties/update",
|                                                               "microsoft.people/users/photo/read",
|                                                               "microsoft.people/users/photo/update",
|                                                               "microsoft.permissionsManagement/allEntities/allProperties/allTasks",
|                                                               "microsoft.powerApps/allEntities/allTasks",
|                                                               "microsoft.powerApps.powerBI/allEntities/allTasks",
|                                                               "microsoft.teams/allEntities/allProperties/allTasks",
|                                                               "microsoft.virtualVisits/allEntities/allProperties/allTasks",
|                                                               "microsoft.viva.glint/allEntities/allProperties/allTasks",
|                                                               "microsoft.viva.goals/allEntities/allProperties/allTasks",
|                                                               "microsoft.viva.pulse/allEntities/allProperties/allTasks",
|                                                               "microsoft.windows.defenderAdvancedThreatProtection/allEntities/allTasks",
|                                                               "microsoft.windows.updatesDeployments/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "d29b2b05-8046-44ba-8758-1e26182fcf32",
|                                           "DisplayName":  "Directory Synchronization Accounts",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  0,
|                                           "Reason":  "Has synchronization permissions that can be used to replicate credentials and control identity plane.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/onPremisesSynchronization/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e8611ab8-c189-46e8-94e1-60213ab1f814",
|                                           "DisplayName":  "Privileged Role Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  0,
|                                           "Reason":  "Can assign privileged roles including Global Administrator, enabling immediate full tenant compromise.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/accessReviews/definitions.applications/allProperties/read",
|                                                               "microsoft.directory/accessReviews/definitions.directoryRoles/allProperties/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions.groups/allProperties/read",
|                                                               "microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/allProperties/update",
|                                                               "microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/create",
|                                                               "microsoft.directory/accessReviews/definitions.groupsAssignableToRoles/delete",
|                                                               "microsoft.directory/administrativeUnits/allProperties/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/allProperties/allTasks",
|                                                               "microsoft.directory/directoryRoles/allProperties/allTasks",
|                                                               "microsoft.directory/groupsAssignableToRoles/allProperties/update",
|                                                               "microsoft.directory/groupsAssignableToRoles/assignLicense",
|                                                               "microsoft.directory/groupsAssignableToRoles/create",
|                                                               "microsoft.directory/groupsAssignableToRoles/delete",
|                                                               "microsoft.directory/groupsAssignableToRoles/reprocessLicenseAssignment",
|                                                               "microsoft.directory/groupsAssignableToRoles/restore",
|                                                               "microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks",
|                                                               "microsoft.directory/permissionGrantPolicies/allProperties/read",
|                                                               "microsoft.directory/permissionGrantPolicies/allProperties/update",
|                                                               "microsoft.directory/permissionGrantPolicies/create",
|                                                               "microsoft.directory/permissionGrantPolicies/delete",
|                                                               "microsoft.directory/privilegedIdentityManagement/allProperties/allTasks",
|                                                               "microsoft.directory/roleAssignments/allProperties/allTasks",
|                                                               "microsoft.directory/roleDefinitions/allProperties/allTasks",
|                                                               "microsoft.directory/scopedRoleMemberships/allProperties/allTasks",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-company-admin",
|                                                               "microsoft.directory/servicePrincipals/permissions/update",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "7be44c8a-adaf-4e2a-84d6-ab2649e08a13",
|                                           "DisplayName":  "Privileged Authentication Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  0,
|                                           "Reason":  "Can manage authentication methods for privileged accounts, enabling immediate full tenant compromise.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/deletedItems.users/restore",
|                                                               "microsoft.directory/users/authenticationMethods/basic/update",
|                                                               "microsoft.directory/users/authenticationMethods/create",
|                                                               "microsoft.directory/users/authenticationMethods/delete",
|                                                               "microsoft.directory/users/authenticationMethods/standard/read",
|                                                               "microsoft.directory/users/authorizationInfo/update",
|                                                               "microsoft.directory/users/basic/update",
|                                                               "microsoft.directory/users/delete",
|                                                               "microsoft.directory/users/disable",
|                                                               "microsoft.directory/users/enable",
|                                                               "microsoft.directory/users/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/users/manager/update",
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.directory/users/restore",
|                                                               "microsoft.directory/users/userPrincipalName/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2",
|                                           "DisplayName":  "Hybrid Identity Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  0,
|                                           "Reason":  "Can manage applications and authentication settings, enabling direct elevation to Global Administrator and full tenant compromise.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/applications/appRoles/update",
|                                                               "microsoft.directory/applications/audience/update",
|                                                               "microsoft.directory/applications/authentication/update",
|                                                               "microsoft.directory/applications/basic/update",
|                                                               "microsoft.directory/applications/create",
|                                                               "microsoft.directory/applications/delete",
|                                                               "microsoft.directory/applications/disablement/update",
|                                                               "microsoft.directory/applications/notes/update",
|                                                               "microsoft.directory/applications/owners/update",
|                                                               "microsoft.directory/applications/permissions/update",
|                                                               "microsoft.directory/applications/policies/update",
|                                                               "microsoft.directory/applications/synchronization/standard/read",
|                                                               "microsoft.directory/applications/tag/update",
|                                                               "microsoft.directory/applicationTemplates/instantiate",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/cloudProvisioning/allProperties/allTasks",
|                                                               "microsoft.directory/deletedItems.applications/delete",
|                                                               "microsoft.directory/deletedItems.applications/restore",
|                                                               "microsoft.directory/domains/allProperties/read",
|                                                               "microsoft.directory/domains/federationConfiguration/basic/update",
|                                                               "microsoft.directory/domains/federationConfiguration/create",
|                                                               "microsoft.directory/domains/federationConfiguration/delete",
|                                                               "microsoft.directory/domains/federationConfiguration/standard/read",
|                                                               "microsoft.directory/domains/federation/update",
|                                                               "microsoft.directory/hybridAuthenticationPolicy/allProperties/allTasks",
|                                                               "microsoft.directory/onPremisesSynchronization/basic/update",
|                                                               "microsoft.directory/onPremisesSynchronization/standard/read",
|                                                               "microsoft.directory/organization/dirSync/update",
|                                                               "microsoft.directory/passwordHashSync/allProperties/allTasks",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/servicePrincipals/audience/update",
|                                                               "microsoft.directory/servicePrincipals/authentication/update",
|                                                               "microsoft.directory/servicePrincipals/basic/update",
|                                                               "microsoft.directory/servicePrincipals/create",
|                                                               "microsoft.directory/servicePrincipals/delete",
|                                                               "microsoft.directory/servicePrincipals/disable",
|                                                               "microsoft.directory/servicePrincipals/enable",
|                                                               "microsoft.directory/servicePrincipals/notes/update",
|                                                               "microsoft.directory/servicePrincipals/owners/update",
|                                                               "microsoft.directory/servicePrincipals/permissions/update",
|                                                               "microsoft.directory/servicePrincipals/policies/update",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/credentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/jobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/schema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationCredentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationJobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationSchema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization/standard/read",
|                                                               "microsoft.directory/servicePrincipals/tag/update",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.directory/users/authorizationInfo/update",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       }
|                                   ],
|    "EntraID_BuiltInRoles_Tier1":  [
|                                       {
|                                           "Id":  "729827e3-9c14-49f7-bb1b-9608f156bbb8",
|                                           "DisplayName":  "Helpdesk Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can reset passwords and invalidate refresh tokens for users including admins, enabling a reliable path to tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/bitlockerKeys/key/read",
|                                                               "microsoft.directory/deviceLocalCredentials/standard/read",
|                                                               "microsoft.directory/users/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "b0f54661-2d74-4c50-afa3-1ec803f12efe",
|                                           "DisplayName":  "Billing Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can update organization info and billing settings, which can be leveraged in some escalation paths to tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.commerce.billing/allEntities/allProperties/allTasks",
|                                                               "microsoft.directory/organization/basic/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "4ba39ca4-527c-499a-b93d-d9b492c50246",
|                                           "DisplayName":  "Partner Tier1 Support",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can update application credentials and authentication settings, enabling escalation to tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/applications/appRoles/update",
|                                                               "microsoft.directory/applications/audience/update",
|                                                               "microsoft.directory/applications/authentication/update",
|                                                               "microsoft.directory/applications/basic/update",
|                                                               "microsoft.directory/applications/credentials/update",
|                                                               "microsoft.directory/applications/notes/update",
|                                                               "microsoft.directory/applications/owners/update",
|                                                               "microsoft.directory/applications/permissions/update",
|                                                               "microsoft.directory/applications/policies/update",
|                                                               "microsoft.directory/applications/tag/update",
|                                                               "microsoft.directory/contacts/basic/update",
|                                                               "microsoft.directory/contacts/create",
|                                                               "microsoft.directory/contacts/delete",
|                                                               "microsoft.directory/deletedItems.groups/restore",
|                                                               "microsoft.directory/deletedItems.users/restore",
|                                                               "microsoft.directory/groups/create",
|                                                               "microsoft.directory/groups/delete",
|                                                               "microsoft.directory/groups/members/update",
|                                                               "microsoft.directory/groups/owners/update",
|                                                               "microsoft.directory/groups/restore",
|                                                               "microsoft.directory/groups.unified/assignedLabels/update",
|                                                               "microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/users/assignLicense",
|                                                               "microsoft.directory/users/basic/update",
|                                                               "microsoft.directory/users/create",
|                                                               "microsoft.directory/users/delete",
|                                                               "microsoft.directory/users/disable",
|                                                               "microsoft.directory/users/enable",
|                                                               "microsoft.directory/users/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/users/manager/update",
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.directory/users/photo/update",
|                                                               "microsoft.directory/users/restore",
|                                                               "microsoft.directory/users/userPrincipalName/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e00e864a-17c5-4a4b-9c06-f5b95a8d5bd8",
|                                           "DisplayName":  "Partner Tier2 Support",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Similar to Tier1 Support with permissions to modify app credentials and authentication, enabling escalation.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/applications/appRoles/update",
|                                                               "microsoft.directory/applications/audience/update",
|                                                               "microsoft.directory/applications/authentication/update",
|                                                               "microsoft.directory/applications/basic/update",
|                                                               "microsoft.directory/applications/credentials/update",
|                                                               "microsoft.directory/applications/notes/update",
|                                                               "microsoft.directory/applications/owners/update",
|                                                               "microsoft.directory/applications/permissions/update",
|                                                               "microsoft.directory/applications/policies/update",
|                                                               "microsoft.directory/applications/tag/update",
|                                                               "microsoft.directory/contacts/basic/update",
|                                                               "microsoft.directory/contacts/create",
|                                                               "microsoft.directory/contacts/delete",
|                                                               "microsoft.directory/deletedItems.groups/restore",
|                                                               "microsoft.directory/deletedItems.users/restore",
|                                                               "microsoft.directory/domains/allProperties/allTasks",
|                                                               "microsoft.directory/groups/create",
|                                                               "microsoft.directory/groups/delete",
|                                                               "microsoft.directory/groups/members/update",
|                                                               "microsoft.directory/groups/owners/update",
|                                                               "microsoft.directory/groups/restore",
|                                                               "microsoft.directory/groups.unified/assignedLabels/update",
|                                                               "microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks",
|                                                               "microsoft.directory/organization/basic/update",
|                                                               "microsoft.directory/roleAssignments/allProperties/allTasks",
|                                                               "microsoft.directory/roleDefinitions/allProperties/allTasks",
|                                                               "microsoft.directory/scopedRoleMemberships/allProperties/allTasks",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/subscribedSkus/standard/read",
|                                                               "microsoft.directory/users/assignLicense",
|                                                               "microsoft.directory/users/basic/update",
|                                                               "microsoft.directory/users/create",
|                                                               "microsoft.directory/users/delete",
|                                                               "microsoft.directory/users/disable",
|                                                               "microsoft.directory/users/enable",
|                                                               "microsoft.directory/users/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/users/manager/update",
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.directory/users/photo/update",
|                                                               "microsoft.directory/users/restore",
|                                                               "microsoft.directory/users/userPrincipalName/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "29232cdf-9323-42fd-ade2-1d097af3e4de",
|                                           "DisplayName":  "Exchange Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage Exchange settings and mailboxes, enabling password resets and MFA bypass via mailbox access in some scenarios.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.backup/exchangeProtectionPolicies/allProperties/allTasks",
|                                                               "microsoft.backup/exchangeRestoreSessions/allProperties/allTasks",
|                                                               "microsoft.backup/restorePoints/userMailboxes/allProperties/allTasks",
|                                                               "microsoft.backup/userMailboxProtectionUnits/allProperties/allTasks",
|                                                               "microsoft.backup/userMailboxRestoreArtifacts/allProperties/allTasks",
|                                                               "microsoft.directory/contacts/allProperties/read",
|                                                               "microsoft.directory/contacts/memberOf/read",
|                                                               "microsoft.directory/contacts/standard/read",
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups.unified/assignedLabels/update",
|                                                               "microsoft.directory/groups.unified/basic/update",
|                                                               "microsoft.directory/groups.unified/create",
|                                                               "microsoft.directory/groups.unified/delete",
|                                                               "microsoft.directory/groups.unified/members/update",
|                                                               "microsoft.directory/groups.unified/owners/update",
|                                                               "microsoft.directory/groups.unified/restore",
|                                                               "microsoft.directory/onPremisesSynchronization/standard/read",
|                                                               "microsoft.office365.exchange/allEntities/basic/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3",
|                                           "DisplayName":  "Application Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage application policies and consent, enabling escalation to tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks",
|                                                               "microsoft.directory/appConsent/appConsentRequests/allProperties/read",
|                                                               "microsoft.directory/applicationPolicies/basic/update",
|                                                               "microsoft.directory/applicationPolicies/create",
|                                                               "microsoft.directory/applicationPolicies/delete",
|                                                               "microsoft.directory/applicationPolicies/owners/read",
|                                                               "microsoft.directory/applicationPolicies/owners/update",
|                                                               "microsoft.directory/applicationPolicies/policyAppliedTo/read",
|                                                               "microsoft.directory/applicationPolicies/standard/read",
|                                                               "microsoft.directory/applications/applicationProxyAuthentication/update",
|                                                               "microsoft.directory/applications/applicationProxy/read",
|                                                               "microsoft.directory/applications/applicationProxySslCertificate/update",
|                                                               "microsoft.directory/applications/applicationProxy/update",
|                                                               "microsoft.directory/applications/applicationProxyUrlSettings/update",
|                                                               "microsoft.directory/applications/appRoles/update",
|                                                               "microsoft.directory/applications/audience/update",
|                                                               "microsoft.directory/applications/authentication/update",
|                                                               "microsoft.directory/applications/basic/update",
|                                                               "microsoft.directory/applications/create",
|                                                               "microsoft.directory/applications/credentials/update",
|                                                               "microsoft.directory/applications/delete",
|                                                               "microsoft.directory/applications/disablement/update",
|                                                               "microsoft.directory/applications/extensionProperties/update",
|                                                               "microsoft.directory/applications/notes/update",
|                                                               "microsoft.directory/applications/owners/update",
|                                                               "microsoft.directory/applications/permissions/update",
|                                                               "microsoft.directory/applications/policies/update",
|                                                               "microsoft.directory/applications/synchronization/standard/read",
|                                                               "microsoft.directory/applications/tag/update",
|                                                               "microsoft.directory/applications/verification/update",
|                                                               "microsoft.directory/applicationTemplates/instantiate",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/connectorGroups/allProperties/read",
|                                                               "microsoft.directory/connectorGroups/allProperties/update",
|                                                               "microsoft.directory/connectorGroups/create",
|                                                               "microsoft.directory/connectorGroups/delete",
|                                                               "microsoft.directory/connectors/allProperties/read",
|                                                               "microsoft.directory/connectors/create",
|                                                               "microsoft.directory/customAuthenticationExtensions/allProperties/allTasks",
|                                                               "microsoft.directory/deletedItems.applications/delete",
|                                                               "microsoft.directory/deletedItems.applications/restore",
|                                                               "microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/servicePrincipals/audience/update",
|                                                               "microsoft.directory/servicePrincipals/authentication/update",
|                                                               "microsoft.directory/servicePrincipals/basic/update",
|                                                               "microsoft.directory/servicePrincipals/create",
|                                                               "microsoft.directory/servicePrincipals/credentials/update",
|                                                               "microsoft.directory/servicePrincipals/delete",
|                                                               "microsoft.directory/servicePrincipals/disable",
|                                                               "microsoft.directory/servicePrincipals/enable",
|                                                               "microsoft.directory/servicePrincipals/getPasswordSingleSignOnCredentials",
|                                                               "microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentials",
|                                                               "microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-application-admin",
|                                                               "microsoft.directory/servicePrincipals/notes/update",
|                                                               "microsoft.directory/servicePrincipals/owners/update",
|                                                               "microsoft.directory/servicePrincipals/permissions/update",
|                                                               "microsoft.directory/servicePrincipals/policies/update",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationCredentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationJobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationSchema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization/standard/read",
|                                                               "microsoft.directory/servicePrincipals/tag/update",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "194ae4cb-b126-40b2-bd5b-6091b380977d",
|                                           "DisplayName":  "Security Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can update application policies and security settings, enabling escalation to tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.agentRegistry/allEntities/allProperties/read",
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/applications/policies/update",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/bitlockerKeys/key/read",
|                                                               "microsoft.directory/bulkJobs/standard/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/basic/update",
|                                                               "microsoft.directory/conditionalAccessPolicies/create",
|                                                               "microsoft.directory/conditionalAccessPolicies/delete",
|                                                               "microsoft.directory/conditionalAccessPolicies/owners/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/owners/update",
|                                                               "microsoft.directory/conditionalAccessPolicies/policyAppliedTo/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/standard/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/tenantDefault/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/b2bCollaboration/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/b2bDirectConnect/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/tenantRestrictions/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/b2bCollaboration/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/b2bDirectConnect/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/create",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/delete",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/create",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/resetToDefaultSettings",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/resetToDefaultSettings",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/tenantRestrictions/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/standard/read",
|                                                               "microsoft.directory/deviceLocalCredentials/standard/read",
|                                                               "microsoft.directory/domains/federationConfiguration/basic/update",
|                                                               "microsoft.directory/domains/federationConfiguration/create",
|                                                               "microsoft.directory/domains/federationConfiguration/delete",
|                                                               "microsoft.directory/domains/federationConfiguration/standard/read",
|                                                               "microsoft.directory/domains/federation/update",
|                                                               "microsoft.directory/entitlementManagement/allProperties/read",
|                                                               "microsoft.directory/identityProtection/allProperties/read",
|                                                               "microsoft.directory/identityProtection/allProperties/update",
|                                                               "microsoft.directory/multiTenantOrganization/basic/update",
|                                                               "microsoft.directory/multiTenantOrganization/create",
|                                                               "microsoft.directory/multiTenantOrganization/joinRequest/organizationDetails/update",
|                                                               "microsoft.directory/multiTenantOrganization/joinRequest/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/create",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/delete",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/organizationDetails/update",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/standard/read",
|                                                               "microsoft.directory/namedLocations/basic/update",
|                                                               "microsoft.directory/namedLocations/create",
|                                                               "microsoft.directory/namedLocations/delete",
|                                                               "microsoft.directory/namedLocations/standard/read",
|                                                               "microsoft.directory/policies/basic/update",
|                                                               "microsoft.directory/policies/create",
|                                                               "microsoft.directory/policies/delete",
|                                                               "microsoft.directory/policies/owners/update",
|                                                               "microsoft.directory/policies/tenantDefault/update",
|                                                               "microsoft.directory/privilegedIdentityManagement/allProperties/read",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/resourceNamespaces/resourceActions/authenticationContext/update",
|                                                               "microsoft.directory/servicePrincipals/policies/update",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.networkAccess/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.protectionCenter/allEntities/basic/update",
|                                                               "microsoft.office365.protectionCenter/allEntities/standard/read",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/payload/allProperties/allTasks",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/reports/allProperties/read",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/simulation/allProperties/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "158c047a-c907-4556-b7ef-446551a6b5f7",
|                                           "DisplayName":  "Cloud Application Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage application policies and consent, enabling escalation to tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/adminConsentRequestPolicy/allProperties/allTasks",
|                                                               "microsoft.directory/appConsent/appConsentRequests/allProperties/read",
|                                                               "microsoft.directory/applicationPolicies/basic/update",
|                                                               "microsoft.directory/applicationPolicies/create",
|                                                               "microsoft.directory/applicationPolicies/delete",
|                                                               "microsoft.directory/applicationPolicies/owners/read",
|                                                               "microsoft.directory/applicationPolicies/owners/update",
|                                                               "microsoft.directory/applicationPolicies/policyAppliedTo/read",
|                                                               "microsoft.directory/applicationPolicies/standard/read",
|                                                               "microsoft.directory/applications/appRoles/update",
|                                                               "microsoft.directory/applications/audience/update",
|                                                               "microsoft.directory/applications/authentication/update",
|                                                               "microsoft.directory/applications/basic/update",
|                                                               "microsoft.directory/applications/create",
|                                                               "microsoft.directory/applications/credentials/update",
|                                                               "microsoft.directory/applications/delete",
|                                                               "microsoft.directory/applications/disablement/update",
|                                                               "microsoft.directory/applications/extensionProperties/update",
|                                                               "microsoft.directory/applications/notes/update",
|                                                               "microsoft.directory/applications/owners/update",
|                                                               "microsoft.directory/applications/permissions/update",
|                                                               "microsoft.directory/applications/policies/update",
|                                                               "microsoft.directory/applications/synchronization/standard/read",
|                                                               "microsoft.directory/applications/tag/update",
|                                                               "microsoft.directory/applications/verification/update",
|                                                               "microsoft.directory/applicationTemplates/instantiate",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/deletedItems.applications/delete",
|                                                               "microsoft.directory/deletedItems.applications/restore",
|                                                               "microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/servicePrincipals/audience/update",
|                                                               "microsoft.directory/servicePrincipals/authentication/update",
|                                                               "microsoft.directory/servicePrincipals/basic/update",
|                                                               "microsoft.directory/servicePrincipals/create",
|                                                               "microsoft.directory/servicePrincipals/credentials/update",
|                                                               "microsoft.directory/servicePrincipals/delete",
|                                                               "microsoft.directory/servicePrincipals/disable",
|                                                               "microsoft.directory/servicePrincipals/enable",
|                                                               "microsoft.directory/servicePrincipals/getPasswordSingleSignOnCredentials",
|                                                               "microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentials",
|                                                               "microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-application-admin",
|                                                               "microsoft.directory/servicePrincipals/notes/update",
|                                                               "microsoft.directory/servicePrincipals/owners/update",
|                                                               "microsoft.directory/servicePrincipals/permissions/update",
|                                                               "microsoft.directory/servicePrincipals/policies/update",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationCredentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationJobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationSchema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization/standard/read",
|                                                               "microsoft.directory/servicePrincipals/tag/update",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "b1be1c3e-b65d-4f19-8427-f6fa0d97feb9",
|                                           "DisplayName":  "Conditional Access Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can modify conditional access policies, enabling bypass of MFA and escalation to tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/conditionalAccessPolicies/basic/update",
|                                                               "microsoft.directory/conditionalAccessPolicies/create",
|                                                               "microsoft.directory/conditionalAccessPolicies/delete",
|                                                               "microsoft.directory/conditionalAccessPolicies/owners/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/owners/update",
|                                                               "microsoft.directory/conditionalAccessPolicies/policyAppliedTo/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/standard/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/tenantDefault/update",
|                                                               "microsoft.directory/namedLocations/basic/update",
|                                                               "microsoft.directory/namedLocations/create",
|                                                               "microsoft.directory/namedLocations/delete",
|                                                               "microsoft.directory/namedLocations/standard/read",
|                                                               "microsoft.directory/resourceNamespaces/resourceActions/authenticationContext/update"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "c4e39bd9-1100-46d3-8c65-fb160da0071f",
|                                           "DisplayName":  "Authentication Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage authentication methods and reset credentials, enabling escalation to tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/deletedItems.users/restore",
|                                                               "microsoft.directory/users/authenticationMethods/basic/update",
|                                                               "microsoft.directory/users/authenticationMethods/create",
|                                                               "microsoft.directory/users/authenticationMethods/delete",
|                                                               "microsoft.directory/users/authenticationMethods/standard/restrictedRead",
|                                                               "microsoft.directory/users/basic/update",
|                                                               "microsoft.directory/users/delete",
|                                                               "microsoft.directory/users/disable",
|                                                               "microsoft.directory/users/enable",
|                                                               "microsoft.directory/users/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/users/manager/update",
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.directory/users/restore",
|                                                               "microsoft.directory/users/userPrincipalName/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "6e591065-9bad-43ed-90f3-e9424366d2f0",
|                                           "DisplayName":  "External ID User Flow Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage B2C user flows, enabling modification of authentication policies and escalation.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/b2cUserFlow/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "0f971eea-41eb-4569-a71e-57bb8a3eff1e",
|                                           "DisplayName":  "External ID User Flow Attribute Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage B2C user attributes, enabling modification of authentication policies and escalation.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/b2cUserAttribute/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "aaf43236-0c0d-4d5f-883a-6955382ac081",
|                                           "DisplayName":  "B2C IEF Keyset Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage B2C trust framework keysets, enabling modification of authentication policies and potential elevation to tenant-wide control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/b2cTrustFrameworkKeySet/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "3edaf663-341e-4475-9f94-5c398ef6c070",
|                                           "DisplayName":  "B2C IEF Policy Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage B2C trust framework policies, allowing changes to authentication flows that can lead to tenant compromise.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/b2cTrustFrameworkPolicy/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "be2f45a1-457d-42af-a067-6ec1fa63bc45",
|                                           "DisplayName":  "External Identity Provider Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can modify federation settings and identity providers, enabling manipulation of authentication and potential tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/domains/federation/update",
|                                                               "microsoft.directory/identityProviders/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "966707d0-3269-4727-9be2-8c3a10f19b9d",
|                                           "DisplayName":  "Password Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can reset user passwords, enabling potential credential takeover and escalation to privileged roles.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "0526716b-113d-4c15-b2c8-68e3c22b9f80",
|                                           "DisplayName":  "Authentication Policy Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can modify authentication policies and user credential policies, enabling bypass or reset of MFA and credential protections.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/organization/strongAuthentication/allTasks",
|                                                               "microsoft.directory/userCredentialPolicies/basic/update",
|                                                               "microsoft.directory/userCredentialPolicies/create",
|                                                               "microsoft.directory/userCredentialPolicies/delete",
|                                                               "microsoft.directory/userCredentialPolicies/owners/read",
|                                                               "microsoft.directory/userCredentialPolicies/owners/update",
|                                                               "microsoft.directory/userCredentialPolicies/policyAppliedTo/read",
|                                                               "microsoft.directory/userCredentialPolicies/standard/read",
|                                                               "microsoft.directory/userCredentialPolicies/tenantDefault/update",
|                                                               "microsoft.directory/verifiableCredentials/configuration/allProperties/read",
|                                                               "microsoft.directory/verifiableCredentials/configuration/allProperties/update",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/update",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/cards/revoke",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/create",
|                                                               "microsoft.directory/verifiableCredentials/configuration/create",
|                                                               "microsoft.directory/verifiableCredentials/configuration/delete"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "8329153b-31d0-4727-b945-745eb3bc5f31",
|                                           "DisplayName":  "Domain Name Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage domain properties and federation, enabling manipulation of authentication and potential tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/domains/allProperties/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "45d8d3c5-c802-45c6-b32a-1d70b5e1e86e",
|                                           "DisplayName":  "Identity Governance Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Manages access reviews and entitlement management, enabling role assignment and potential elevation to privileged roles.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/accessReviews/allProperties/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions.applications/allProperties/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions.entitlementManagement/allProperties/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions.groups/allProperties/read",
|                                                               "microsoft.directory/accessReviews/definitions.groups/allProperties/update",
|                                                               "microsoft.directory/accessReviews/definitions.groups/create",
|                                                               "microsoft.directory/accessReviews/definitions.groups/delete",
|                                                               "microsoft.directory/entitlementManagement/allProperties/allTasks",
|                                                               "microsoft.directory/groups/members/update",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "11451d60-acb2-45eb-a7d6-43d0f0125c13",
|                                           "DisplayName":  "Windows 365 Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage cloud PC devices and policies, enabling potential escalation paths to privileged roles.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.cloudPC/allEntities/allProperties/allTasks",
|                                                               "microsoft.directory/deletedItems.devices/delete",
|                                                               "microsoft.directory/deletedItems.devices/restore",
|                                                               "microsoft.directory/deviceManagementPolicies/standard/read",
|                                                               "microsoft.directory/deviceRegistrationPolicy/standard/read",
|                                                               "microsoft.directory/devices/basic/update",
|                                                               "microsoft.directory/devices/create",
|                                                               "microsoft.directory/devices/delete",
|                                                               "microsoft.directory/devices/disable",
|                                                               "microsoft.directory/devices/enable",
|                                                               "microsoft.directory/devices/extensionAttributeSet1/update",
|                                                               "microsoft.directory/devices/extensionAttributeSet2/update",
|                                                               "microsoft.directory/devices/extensionAttributeSet3/update",
|                                                               "microsoft.directory/devices/registeredOwners/update",
|                                                               "microsoft.directory/devices/registeredUsers/update",
|                                                               "microsoft.directory/groups.security/assignedLabels/update",
|                                                               "microsoft.directory/groups.security/basic/update",
|                                                               "microsoft.directory/groups.security/classification/update",
|                                                               "microsoft.directory/groups.security/create",
|                                                               "microsoft.directory/groups.security/delete",
|                                                               "microsoft.directory/groups.security/dynamicMembershipRule/update",
|                                                               "microsoft.directory/groups.security/members/update",
|                                                               "microsoft.directory/groups.security/owners/update",
|                                                               "microsoft.directory/groups.security/visibility/update",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "25a516ed-2fa0-40ea-a2d0-12923a21473a",
|                                           "DisplayName":  "Authentication Extensibility Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can manage custom authentication extensions, enabling modification of authentication flows and potential tenant compromise.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/customAuthenticationExtensions/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "112ca1a2-15ad-4102-995e-45b0bc479a6a",
|                                           "DisplayName":  "Tenant Creator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Can create new tenants, which may enable attacker to establish footholds or pivot but no direct control over existing tenant identity plane.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/tenantManagement/tenants/create"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "af78dc32-cf4d-46f9-ba4e-4428526346b5",
|                                           "DisplayName":  "Permissions Management Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  1,
|                                           "Reason":  "Full control over permissions management, enabling assignment of privileged roles and potential tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.permissionsManagement/allEntities/allProperties/allTasks"
|                                                           ]
|                                       }
|                                   ],
|    "EntraID_BuiltInRoles_Tier2":  [
|                                       {
|                                           "Id":  "fe930be7-5e62-47db-91af-98c3a49a38b1",
|                                           "DisplayName":  "User Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can manage user accounts but no direct or reliable path to assign Global Administrator or control identity plane.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions.applications/allProperties/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions.directoryRoles/allProperties/read",
|                                                               "microsoft.directory/accessReviews/definitions.entitlementManagement/allProperties/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions.groups/allProperties/read",
|                                                               "microsoft.directory/accessReviews/definitions.groups/allProperties/update",
|                                                               "microsoft.directory/accessReviews/definitions.groups/create",
|                                                               "microsoft.directory/accessReviews/definitions.groups/delete",
|                                                               "microsoft.directory/contacts/basic/update",
|                                                               "microsoft.directory/contacts/create",
|                                                               "microsoft.directory/contacts/delete",
|                                                               "microsoft.directory/deletedItems.groups/restore",
|                                                               "microsoft.directory/deletedItems.users/restore",
|                                                               "microsoft.directory/entitlementManagement/allProperties/allTasks",
|                                                               "microsoft.directory/groups/assignLicense",
|                                                               "microsoft.directory/groups/basic/update",
|                                                               "microsoft.directory/groups/classification/update",
|                                                               "microsoft.directory/groups/create",
|                                                               "microsoft.directory/groups/delete",
|                                                               "microsoft.directory/groups/dynamicMembershipRule/update",
|                                                               "microsoft.directory/groups/groupType/update",
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups/members/update",
|                                                               "microsoft.directory/groups/onPremWriteBack/update",
|                                                               "microsoft.directory/groups/owners/update",
|                                                               "microsoft.directory/groups/reprocessLicenseAssignment",
|                                                               "microsoft.directory/groups/restore",
|                                                               "microsoft.directory/groups/settings/update",
|                                                               "microsoft.directory/groups.unified/assignedLabels/update",
|                                                               "microsoft.directory/groups/visibility/update",
|                                                               "microsoft.directory/oAuth2PermissionGrants/allProperties/allTasks",
|                                                               "microsoft.directory/onPremisesSynchronization/standard/read",
|                                                               "microsoft.directory/policies/standard/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/users/assignLicense",
|                                                               "microsoft.directory/users/basic/update",
|                                                               "microsoft.directory/users/convertExternalToInternalMemberUser",
|                                                               "microsoft.directory/users/create",
|                                                               "microsoft.directory/users/delete",
|                                                               "microsoft.directory/users/disable",
|                                                               "microsoft.directory/users/enable",
|                                                               "microsoft.directory/users/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/users/inviteGuest",
|                                                               "microsoft.directory/users/lifeCycleInfo/read",
|                                                               "microsoft.directory/users/manager/update",
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.directory/users/photo/update",
|                                                               "microsoft.directory/users/reprocessLicenseAssignment",
|                                                               "microsoft.directory/users/restore",
|                                                               "microsoft.directory/users/sponsors/update",
|                                                               "microsoft.directory/users/usageLocation/update",
|                                                               "microsoft.directory/users/userPrincipalName/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "9360feb5-f418-4baa-8175-e2a00bac4301",
|                                           "DisplayName":  "Directory Writers",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can modify groups and applications but no direct path to assign Global Administrator or control identity plane.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/applications/extensionProperties/update",
|                                                               "microsoft.directory/contacts/create",
|                                                               "microsoft.directory/groups/assignedLabels/update",
|                                                               "microsoft.directory/groups/assignLicense",
|                                                               "microsoft.directory/groups/basic/update",
|                                                               "microsoft.directory/groups/classification/update",
|                                                               "microsoft.directory/groups/create",
|                                                               "microsoft.directory/groups/dynamicMembershipRule/update",
|                                                               "microsoft.directory/groupSettings/basic/update",
|                                                               "microsoft.directory/groupSettings/create",
|                                                               "microsoft.directory/groupSettings/delete",
|                                                               "microsoft.directory/groups/groupType/update",
|                                                               "microsoft.directory/groups/members/update",
|                                                               "microsoft.directory/groups/onPremWriteBack/update",
|                                                               "microsoft.directory/groups/owners/update",
|                                                               "microsoft.directory/groups/reprocessLicenseAssignment",
|                                                               "microsoft.directory/groups/settings/update",
|                                                               "microsoft.directory/groups/visibility/update",
|                                                               "microsoft.directory/oAuth2PermissionGrants/basic/update",
|                                                               "microsoft.directory/oAuth2PermissionGrants/create",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/credentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/jobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToCloudTenant/schema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/credentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/jobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronization.cloudTenantToExternalSystem/schema/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationCredentials/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationJobs/manage",
|                                                               "microsoft.directory/servicePrincipals/synchronizationSchema/manage",
|                                                               "microsoft.directory/users/assignLicense",
|                                                               "microsoft.directory/users/basic/update",
|                                                               "microsoft.directory/users/create",
|                                                               "microsoft.directory/users/disable",
|                                                               "microsoft.directory/users/enable",
|                                                               "microsoft.directory/users/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/users/inviteGuest",
|                                                               "microsoft.directory/users/manager/update",
|                                                               "microsoft.directory/users/photo/update",
|                                                               "microsoft.directory/users/reprocessLicenseAssignment",
|                                                               "microsoft.directory/users/sponsors/update",
|                                                               "microsoft.directory/users/userPrincipalName/update"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "f28a1f50-f6e7-4571-818b-6a12f2af6b6c",
|                                           "DisplayName":  "SharePoint Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can manage SharePoint and OneDrive data but no direct identity plane control or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.backup/oneDriveForBusinessProtectionPolicies/allProperties/allTasks",
|                                                               "microsoft.backup/oneDriveForBusinessRestoreSessions/allProperties/allTasks",
|                                                               "microsoft.backup/restorePoints/sites/allProperties/allTasks",
|                                                               "microsoft.backup/restorePoints/userDrives/allProperties/allTasks",
|                                                               "microsoft.backup/sharePointProtectionPolicies/allProperties/allTasks",
|                                                               "microsoft.backup/sharePointRestoreSessions/allProperties/allTasks",
|                                                               "microsoft.backup/siteProtectionUnits/allProperties/allTasks",
|                                                               "microsoft.backup/siteRestoreArtifacts/allProperties/allTasks",
|                                                               "microsoft.backup/userDriveProtectionUnits/allProperties/allTasks",
|                                                               "microsoft.backup/userDriveRestoreArtifacts/allProperties/allTasks",
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups.unified/assignedLabels/update",
|                                                               "microsoft.directory/groups.unified/basic/update",
|                                                               "microsoft.directory/groups.unified/create",
|                                                               "microsoft.directory/groups.unified/delete",
|                                                               "microsoft.directory/groups.unified/members/update",
|                                                               "microsoft.directory/groups.unified/owners/update",
|                                                               "microsoft.directory/groups.unified/restore",
|                                                               "microsoft.office365.migrations/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.sharePoint/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "75941009-915a-4869-abe7-691bff18279e",
|                                           "DisplayName":  "Skype for Business Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages Skype for Business settings with no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.skypeForBusiness/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "17315797-102d-40b4-93e0-432062caca18",
|                                           "DisplayName":  "Compliance Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can manage compliance data and policies but no direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/entitlementManagement/allProperties/read",
|                                                               "microsoft.office365.complianceManager/allEntities/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "2b499bcd-da44-4968-8aec-78e1674fa64d",
|                                           "DisplayName":  "Device Managers",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can update device attributes but no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/devices/basic/update",
|                                                               "microsoft.directory/devices/extensionAttributeSet1/update",
|                                                               "microsoft.directory/devices/extensionAttributeSet2/update",
|                                                               "microsoft.directory/devices/extensionAttributeSet3/update",
|                                                               "microsoft.directory/devices/memberOf/read",
|                                                               "microsoft.directory/devices/registeredOwners/read",
|                                                               "microsoft.directory/devices/registeredOwners/update",
|                                                               "microsoft.directory/devices/registeredUsers/read",
|                                                               "microsoft.directory/devices/registeredUsers/update",
|                                                               "microsoft.directory/devices/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "cf1c38e5-3621-4004-a7cb-879624dced7c",
|                                           "DisplayName":  "Application Developer",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can create applications and service principals but no direct role assignment or identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/applications/createAsOwner",
|                                                               "microsoft.directory/oAuth2PermissionGrants/createAsOwner",
|                                                               "microsoft.directory/servicePrincipals/createAsOwner"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "3a2c62db-5318-420d-8d74-23affee5d9d5",
|                                           "DisplayName":  "Intune Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages devices and policies but no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.cloudPC/allEntities/allProperties/allTasks",
|                                                               "microsoft.directory/bitlockerKeys/key/read",
|                                                               "microsoft.directory/contacts/basic/update",
|                                                               "microsoft.directory/contacts/create",
|                                                               "microsoft.directory/contacts/delete",
|                                                               "microsoft.directory/deletedItems.devices/delete",
|                                                               "microsoft.directory/deletedItems.devices/restore",
|                                                               "microsoft.directory/deviceLocalCredentials/password/read",
|                                                               "microsoft.directory/deviceManagementPolicies/standard/read",
|                                                               "microsoft.directory/deviceRegistrationPolicy/standard/read",
|                                                               "microsoft.directory/devices/basic/update",
|                                                               "microsoft.directory/devices/create",
|                                                               "microsoft.directory/devices/delete",
|                                                               "microsoft.directory/devices/disable",
|                                                               "microsoft.directory/devices/enable",
|                                                               "microsoft.directory/devices/extensionAttributeSet1/update",
|                                                               "microsoft.directory/devices/extensionAttributeSet2/update",
|                                                               "microsoft.directory/devices/extensionAttributeSet3/update",
|                                                               "microsoft.directory/devices/registeredOwners/update",
|                                                               "microsoft.directory/devices/registeredUsers/update",
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups.security/assignedLabels/update",
|                                                               "microsoft.directory/groups.security/basic/update",
|                                                               "microsoft.directory/groups.security/classification/update",
|                                                               "microsoft.directory/groups.security/create",
|                                                               "microsoft.directory/groups.security/delete",
|                                                               "microsoft.directory/groups.security/dynamicMembershipRule/update",
|                                                               "microsoft.directory/groups.security/members/update",
|                                                               "microsoft.directory/groups.security/owners/update",
|                                                               "microsoft.directory/groups.security/visibility/update",
|                                                               "microsoft.directory/users/basic/update",
|                                                               "microsoft.directory/users/manager/update",
|                                                               "microsoft.directory/users/photo/update",
|                                                               "microsoft.intune/allEntities/allTasks",
|                                                               "microsoft.office365.organizationalMessages/allEntities/allProperties/read",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "44367163-eba1-44c3-98af-f5787879f96a",
|                                           "DisplayName":  "Dynamics 365 Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages Dynamics 365 services but no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.dynamics365/allEntities/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "a9ea8996-122f-4c74-9520-8edcd192826c",
|                                           "DisplayName":  "Fabric Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages PowerApps and related services but no direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.powerApps.powerBI/allEntities/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "7495fdc4-34c4-4d15-a289-98788ce399fd",
|                                           "DisplayName":  "Azure Information Protection Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages information protection policies but no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.informationProtection/allEntities/allTasks",
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "38a96431-2bdf-4b4c-8b6e-5d3d8abac1a4",
|                                           "DisplayName":  "Desktop Analytics Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages desktop analytics data with no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.office365.desktopAnalytics/allEntities/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "4d6ac14f-3453-41d0-bef9-a3e0c569773a",
|                                           "DisplayName":  "License Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can assign licenses but no direct path to role assignment or identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/groups/assignLicense",
|                                                               "microsoft.directory/groups/reprocessLicenseAssignment",
|                                                               "microsoft.directory/users/assignLicense",
|                                                               "microsoft.directory/users/reprocessLicenseAssignment",
|                                                               "microsoft.directory/users/usageLocation/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "7698a772-787b-4ac8-901f-60d6b08affd2",
|                                           "DisplayName":  "Cloud Device Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages devices and policies but no direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/bitlockerKeys/key/read",
|                                                               "microsoft.directory/deletedItems.devices/delete",
|                                                               "microsoft.directory/deletedItems.devices/restore",
|                                                               "microsoft.directory/deviceLocalCredentials/password/read",
|                                                               "microsoft.directory/deviceManagementPolicies/basic/update",
|                                                               "microsoft.directory/deviceManagementPolicies/standard/read",
|                                                               "microsoft.directory/deviceRegistrationPolicy/basic/update",
|                                                               "microsoft.directory/deviceRegistrationPolicy/standard/read",
|                                                               "microsoft.directory/devices/delete",
|                                                               "microsoft.directory/devices/disable",
|                                                               "microsoft.directory/devices/enable",
|                                                               "microsoft.directory/devices/permissions/update",
|                                                               "microsoft.directory/deviceTemplates/owners/read",
|                                                               "microsoft.directory/deviceTemplates/owners/update",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "baf37b3a-610e-45da-9e62-d9d1e5e8914b",
|                                           "DisplayName":  "Teams Communications Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages Teams and Skype settings but no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.skypeForBusiness/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.teams/callQuality/allProperties/read",
|                                                               "microsoft.teams/meetings/allProperties/allTasks",
|                                                               "microsoft.teams/voice/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "69091246-20e8-4a56-aa4d-066075b2a7a8",
|                                           "DisplayName":  "Teams Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can manage Teams policies but no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/create",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/standard/read",
|                                                               "microsoft.directory/externalUserProfiles/basic/update",
|                                                               "microsoft.directory/externalUserProfiles/delete",
|                                                               "microsoft.directory/externalUserProfiles/standard/read",
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups.unified/assignedLabels/update",
|                                                               "microsoft.directory/groups.unified/basic/update",
|                                                               "microsoft.directory/groups.unified/create",
|                                                               "microsoft.directory/groups.unified/delete",
|                                                               "microsoft.directory/groups.unified/members/update",
|                                                               "microsoft.directory/groups.unified/owners/update",
|                                                               "microsoft.directory/groups.unified/restore",
|                                                               "microsoft.directory/pendingExternalUserProfiles/basic/update",
|                                                               "microsoft.directory/pendingExternalUserProfiles/create",
|                                                               "microsoft.directory/pendingExternalUserProfiles/delete",
|                                                               "microsoft.directory/pendingExternalUserProfiles/standard/read",
|                                                               "microsoft.directory/permissionGrantPolicies/standard/read",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.skypeForBusiness/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.teams/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "eb1f4a8d-243a-41f0-9fbd-c7cdf6c5ef7c",
|                                           "DisplayName":  "Insights Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages insights and monitoring data but no direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.insights/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "fdd7a751-b60b-444a-984c-02652fe8fa1c",
|                                           "DisplayName":  "Groups Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can manage groups including deletion and restoration but no direct role assignment or credential reset capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/bulkJobs.groups/basic/update",
|                                                               "microsoft.directory/bulkJobs.groups/create",
|                                                               "microsoft.directory/bulkJobs.groups/standard/read",
|                                                               "microsoft.directory/deletedItems.groups/delete",
|                                                               "microsoft.directory/deletedItems.groups/restore",
|                                                               "microsoft.directory/groups/assignedLabels/update",
|                                                               "microsoft.directory/groups/assignLicense",
|                                                               "microsoft.directory/groups/basic/update",
|                                                               "microsoft.directory/groups/classification/update",
|                                                               "microsoft.directory/groups/create",
|                                                               "microsoft.directory/groups/delete",
|                                                               "microsoft.directory/groups/dynamicMembershipRule/update",
|                                                               "microsoft.directory/groups/groupType/update",
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups/members/update",
|                                                               "microsoft.directory/groups/onPremWriteBack/update",
|                                                               "microsoft.directory/groups/owners/update",
|                                                               "microsoft.directory/groups/reprocessLicenseAssignment",
|                                                               "microsoft.directory/groups/restore",
|                                                               "microsoft.directory/groups/settings/update",
|                                                               "microsoft.directory/groups/visibility/update",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "31392ffb-586c-42d1-9346-e59415a2cc4e",
|                                           "DisplayName":  "Exchange Recipient Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Can manage Exchange recipients and migrations but no direct identity plane control or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.exchange/migration/allProperties/allTasks",
|                                                               "microsoft.office365.exchange/recipients/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "59d46f88-662b-457b-bceb-5c3809e5908f",
|                                           "DisplayName":  "Lifecycle Workflows Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  2,
|                                           "Reason":  "Manages lifecycle workflows and reads authentication info but lacks direct role assignment or credential reset capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/lifecycleWorkflows/workflows/allProperties/allTasks",
|                                                               "microsoft.directory/organization/strongAuthentication/read",
|                                                               "microsoft.directory/users/lifeCycleInfo/read"
|                                                           ]
|                                       }
|                                   ],
|    "EntraID_BuiltInRoles_Tier3":  [
|                                       {
|                                           "Id":  "10dae51f-b6af-4016-8d66-8c2a99b929b3",
|                                           "DisplayName":  "Guest User",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only limited permissions with no path to identity plane control or tenant takeover.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/applications/owners/limitedRead",
|                                                               "microsoft.directory/applications/policies/limitedRead",
|                                                               "microsoft.directory/applications/standard/limitedRead",
|                                                               "microsoft.directory/directoryRoleTemplates/allProperties/read",
|                                                               "microsoft.directory/domains/standard/read",
|                                                               "microsoft.directory/groups/appRoleAssignments/limitedRead",
|                                                               "microsoft.directory/groups/memberOf/limitedRead",
|                                                               "microsoft.directory/groups/members/limitedRead",
|                                                               "microsoft.directory/groups/owners/limitedRead",
|                                                               "microsoft.directory/groups/settings/limitedRead",
|                                                               "microsoft.directory/groups/standard/limitedRead",
|                                                               "microsoft.directory/multiTenantOrganization/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/standard/read",
|                                                               "microsoft.directory/organization/basicProfile/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignments/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/memberOf/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/oAuth2PermissionGrants/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/ownedObjects/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/owners/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/policies/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/standard/limitedRead",
|                                                               "microsoft.directory/users/guestBasicProfile/limitedRead",
|                                                               "microsoft.directory/users/inviteGuest",
|                                                               "microsoft.directory/users/appRoleAssignments/read",
|                                                               "microsoft.directory/users/authenticationMethods/basic/update",
|                                                               "microsoft.directory/users/authenticationMethods/create",
|                                                               "microsoft.directory/users/authenticationMethods/delete",
|                                                               "microsoft.directory/users/authenticationMethods/standard/read",
|                                                               "microsoft.directory/users/authenticationMethods/standard/restrictedRead",
|                                                               "microsoft.directory/users/deviceForResourceAccount/read",
|                                                               "microsoft.directory/users/directReports/read",
|                                                               "microsoft.directory/users/eligibleMemberOf/read",
|                                                               "microsoft.directory/users/invitedBy/read",
|                                                               "microsoft.directory/users/licenseDetails/read",
|                                                               "microsoft.directory/users/manager/read",
|                                                               "microsoft.directory/users/memberOf/read",
|                                                               "microsoft.directory/users/oAuth2PermissionGrants/read",
|                                                               "microsoft.directory/users/ownedDevices/read",
|                                                               "microsoft.directory/users/ownedObjects/read",
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.directory/users/pendingMemberOf/read",
|                                                               "microsoft.directory/users/photo/read",
|                                                               "microsoft.directory/users/registeredDevices/read",
|                                                               "microsoft.directory/users/scopedRoleMemberOf/read",
|                                                               "microsoft.directory/users/sponsorOf/read",
|                                                               "microsoft.directory/users/sponsors/read",
|                                                               "microsoft.directory/users/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "2af84b1e-32c8-42b7-82bc-daa82404023b",
|                                           "DisplayName":  "Restricted Guest User",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Limited read permissions without any ability to modify identity or role assignments.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/applications/owners/limitedRead",
|                                                               "microsoft.directory/applications/policies/limitedRead",
|                                                               "microsoft.directory/applications/standard/limitedRead",
|                                                               "microsoft.directory/directoryRoleTemplates/allProperties/read",
|                                                               "microsoft.directory/domains/standard/read",
|                                                               "microsoft.directory/organization/basicProfile/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignments/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/memberOf/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/oAuth2PermissionGrants/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/ownedObjects/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/owners/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/policies/limitedRead",
|                                                               "microsoft.directory/servicePrincipals/standard/limitedRead",
|                                                               "microsoft.directory/users/appRoleAssignments/read",
|                                                               "microsoft.directory/users/authenticationMethods/basic/update",
|                                                               "microsoft.directory/users/authenticationMethods/create",
|                                                               "microsoft.directory/users/authenticationMethods/delete",
|                                                               "microsoft.directory/users/authenticationMethods/standard/read",
|                                                               "microsoft.directory/users/authenticationMethods/standard/restrictedRead",
|                                                               "microsoft.directory/users/deviceForResourceAccount/read",
|                                                               "microsoft.directory/users/directReports/read",
|                                                               "microsoft.directory/users/eligibleMemberOf/read",
|                                                               "microsoft.directory/users/invitedBy/read",
|                                                               "microsoft.directory/users/licenseDetails/read",
|                                                               "microsoft.directory/users/manager/read",
|                                                               "microsoft.directory/users/memberOf/read",
|                                                               "microsoft.directory/users/oAuth2PermissionGrants/read",
|                                                               "microsoft.directory/users/ownedDevices/read",
|                                                               "microsoft.directory/users/ownedObjects/read",
|                                                               "microsoft.directory/users/password/update",
|                                                               "microsoft.directory/users/pendingMemberOf/read",
|                                                               "microsoft.directory/users/photo/read",
|                                                               "microsoft.directory/users/registeredDevices/read",
|                                                               "microsoft.directory/users/scopedRoleMemberOf/read",
|                                                               "microsoft.directory/users/sponsorOf/read",
|                                                               "microsoft.directory/users/sponsors/read",
|                                                               "microsoft.directory/users/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "95e79109-95c0-4d8e-aee3-d01accf2d47b",
|                                           "DisplayName":  "Guest Inviter",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can invite guests but lacks permissions to escalate privileges or control identity plane.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/users/appRoleAssignments/read",
|                                                               "microsoft.directory/users/deviceForResourceAccount/read",
|                                                               "microsoft.directory/users/directReports/read",
|                                                               "microsoft.directory/users/invitedBy/read",
|                                                               "microsoft.directory/users/inviteGuest",
|                                                               "microsoft.directory/users/licenseDetails/read",
|                                                               "microsoft.directory/users/manager/read",
|                                                               "microsoft.directory/users/memberOf/read",
|                                                               "microsoft.directory/users/oAuth2PermissionGrants/read",
|                                                               "microsoft.directory/users/ownedDevices/read",
|                                                               "microsoft.directory/users/ownedObjects/read",
|                                                               "microsoft.directory/users/photo/read",
|                                                               "microsoft.directory/users/registeredDevices/read",
|                                                               "microsoft.directory/users/scopedRoleMemberOf/read",
|                                                               "microsoft.directory/users/sponsorOf/read",
|                                                               "microsoft.directory/users/sponsors/read",
|                                                               "microsoft.directory/users/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "f023fd81-a637-4b56-95fd-791ac0226033",
|                                           "DisplayName":  "Service Support Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Primarily read access to service health and support tickets with no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "a0b1b346-4d3e-4e8b-98f8-753987be4970",
|                                           "DisplayName":  "User",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Basic user permissions with no ability to modify roles or identity plane objects.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/administrativeUnits/members/read",
|                                                               "microsoft.directory/administrativeUnits/standard/read",
|                                                               "microsoft.directory/applicationPolicies/createAsOwner",
|                                                               "microsoft.directory/applicationPolicies/standard/read",
|                                                               "microsoft.directory/applications/createAsOwner",
|                                                               "microsoft.directory/applications/owners/read",
|                                                               "microsoft.directory/applications/policies/read",
|                                                               "microsoft.directory/applications/standard/read",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/contacts/memberOf/read",
|                                                               "microsoft.directory/contacts/standard/read",
|                                                               "microsoft.directory/contracts/standard/read",
|                                                               "microsoft.directory/devices/memberOf/read",
|                                                               "microsoft.directory/devices/registeredOwners/read",
|                                                               "microsoft.directory/devices/registeredUsers/read",
|                                                               "microsoft.directory/devices/standard/read",
|                                                               "microsoft.directory/directoryRoles/eligibleMembers/read",
|                                                               "microsoft.directory/directoryRoles/members/read",
|                                                               "microsoft.directory/directoryRoles/standard/read",
|                                                               "microsoft.directory/directoryRoleTemplates/allProperties/read",
|                                                               "microsoft.directory/domains/standard/read",
|                                                               "microsoft.directory/groups/appRoleAssignments/read",
|                                                               "microsoft.directory/groups/createAsOwner",
|                                                               "microsoft.directory/groups/memberOf/read",
|                                                               "microsoft.directory/groups/members/read",
|                                                               "microsoft.directory/groups/owners/read",
|                                                               "microsoft.directory/groups/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/standard/read",
|                                                               "microsoft.directory/oAuth2PermissionGrants/standard/read",
|                                                               "microsoft.directory/organization/standard/read",
|                                                               "microsoft.directory/policies/owners/read",
|                                                               "microsoft.directory/policies/policyAppliedTo/read",
|                                                               "microsoft.directory/policies/standard/read",
|                                                               "microsoft.directory/roleAssignments/standard/read",
|                                                               "microsoft.directory/roleDefinitions/standard/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignments/read",
|                                                               "microsoft.directory/servicePrincipals/authentication/read",
|                                                               "microsoft.directory/servicePrincipals/createAsOwner",
|                                                               "microsoft.directory/servicePrincipals/memberOf/read",
|                                                               "microsoft.directory/servicePrincipals/oAuth2PermissionGrants/read",
|                                                               "microsoft.directory/servicePrincipals/ownedObjects/read",
|                                                               "microsoft.directory/servicePrincipals/owners/read",
|                                                               "microsoft.directory/servicePrincipals/policies/read",
|                                                               "microsoft.directory/servicePrincipals/standard/read",
|                                                               "microsoft.directory/subscribedSkus/standard/read",
|                                                               "microsoft.directory/tenantManagement/tenants/create",
|                                                               "microsoft.directory/users/activateServicePlan",
|                                                               "microsoft.directory/users/appRoleAssignments/read",
|                                                               "microsoft.directory/users/deviceForResourceAccount/read",
|                                                               "microsoft.directory/users/directReports/read",
|                                                               "microsoft.directory/users/inviteGuest",
|                                                               "microsoft.directory/users/licenseDetails/read",
|                                                               "microsoft.directory/users/manager/read",
|                                                               "microsoft.directory/users/memberOf/read",
|                                                               "microsoft.directory/users/oAuth2PermissionGrants/read",
|                                                               "microsoft.directory/users/ownedDevices/read",
|                                                               "microsoft.directory/users/ownedObjects/read",
|                                                               "microsoft.directory/users/photo/read",
|                                                               "microsoft.directory/users/registeredDevices/read",
|                                                               "microsoft.directory/users/scopedRoleMemberOf/read",
|                                                               "microsoft.directory/users/sponsorOf/read",
|                                                               "microsoft.directory/users/sponsors/read",
|                                                               "microsoft.directory/users/standard/read",
|                                                               "microsoft.directory/applications/appRoles/update",
|                                                               "microsoft.directory/applications/audience/update",
|                                                               "microsoft.directory/applications/authentication/update",
|                                                               "microsoft.directory/applications/basic/update",
|                                                               "microsoft.directory/applications/credentials/update",
|                                                               "microsoft.directory/applications/delete",
|                                                               "microsoft.directory/applications/disablement/update",
|                                                               "microsoft.directory/applications/extensionProperties/update",
|                                                               "microsoft.directory/applications/notes/update",
|                                                               "microsoft.directory/applications/owners/update",
|                                                               "microsoft.directory/applications/permissions/update",
|                                                               "microsoft.directory/applications/policies/update",
|                                                               "microsoft.directory/applications/tag/update",
|                                                               "microsoft.directory/applications/verification/update",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/deletedItems.applications/delete",
|                                                               "microsoft.directory/deletedItems.applications/restore",
|                                                               "microsoft.directory/deletedItems.groups/restore",
|                                                               "microsoft.directory/devices/disable",
|                                                               "microsoft.directory/groupsAssignableToRoles/allProperties/update",
|                                                               "microsoft.directory/groupsAssignableToRoles/assignLicense",
|                                                               "microsoft.directory/groupsAssignableToRoles/delete",
|                                                               "microsoft.directory/groupsAssignableToRoles/reprocessLicenseAssignment",
|                                                               "microsoft.directory/groupsAssignableToRoles/restore",
|                                                               "microsoft.directory/groups/assignedLabels/update",
|                                                               "microsoft.directory/groups/basic/update",
|                                                               "microsoft.directory/groups/classification/update",
|                                                               "microsoft.directory/groups/delete",
|                                                               "microsoft.directory/groups/groupType/update",
|                                                               "microsoft.directory/groups/members/update",
|                                                               "microsoft.directory/groups/owners/update",
|                                                               "microsoft.directory/groups/restore",
|                                                               "microsoft.directory/groups/settings/update",
|                                                               "microsoft.directory/groups/visibility/update",
|                                                               "microsoft.directory/policies/basic/update",
|                                                               "microsoft.directory/policies/delete",
|                                                               "microsoft.directory/policies/owners/update",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/update",
|                                                               "microsoft.directory/servicePrincipals/audience/update",
|                                                               "microsoft.directory/servicePrincipals/authentication/update",
|                                                               "microsoft.directory/servicePrincipals/basic/update",
|                                                               "microsoft.directory/servicePrincipals/credentials/update",
|                                                               "microsoft.directory/servicePrincipals/delete",
|                                                               "microsoft.directory/servicePrincipals/disable",
|                                                               "microsoft.directory/servicePrincipals/enable",
|                                                               "microsoft.directory/servicePrincipals/getPasswordSingleSignOnCredentials",
|                                                               "microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentials",
|                                                               "microsoft.directory/servicePrincipals/notes/update",
|                                                               "microsoft.directory/servicePrincipals/owners/update",
|                                                               "microsoft.directory/servicePrincipals/permissions/update",
|                                                               "microsoft.directory/servicePrincipals/policies/update",
|                                                               "microsoft.directory/servicePrincipals/tag/update",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.directory/userInfos/address/read",
|                                                               "microsoft.directory/userInfos/email/read",
|                                                               "microsoft.directory/userInfos/openId/read",
|                                                               "microsoft.directory/userInfos/phone/read",
|                                                               "microsoft.directory/userInfos/profile/read",
|                                                               "microsoft.directory/users/authenticationMethods/basic/update",
|                                                               "microsoft.directory/users/authenticationMethods/create",
|                                                               "microsoft.directory/users/authenticationMethods/delete",
|                                                               "microsoft.directory/users/authenticationMethods/standard/read",
|                                                               "microsoft.directory/users/authenticationMethods/standard/restrictedRead",
|                                                               "microsoft.directory/users/basicProfile/update",
|                                                               "microsoft.directory/users/changePassword",
|                                                               "microsoft.directory/users/identities/update",
|                                                               "microsoft.directory/users/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/users/mobile/update",
|                                                               "microsoft.directory/users/searchableDeviceKey/update"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "88d8e3e3-8f55-4a1e-953a-9b9898b8876b",
|                                           "DisplayName":  "Directory Readers",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only directory access without ability to modify roles or identity plane.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/administrativeUnits/members/read",
|                                                               "microsoft.directory/administrativeUnits/standard/read",
|                                                               "microsoft.directory/applicationPolicies/standard/read",
|                                                               "microsoft.directory/applications/owners/read",
|                                                               "microsoft.directory/applications/policies/read",
|                                                               "microsoft.directory/applications/standard/read",
|                                                               "microsoft.directory/contacts/memberOf/read",
|                                                               "microsoft.directory/contacts/standard/read",
|                                                               "microsoft.directory/contracts/standard/read",
|                                                               "microsoft.directory/devices/memberOf/read",
|                                                               "microsoft.directory/devices/registeredOwners/read",
|                                                               "microsoft.directory/devices/registeredUsers/read",
|                                                               "microsoft.directory/devices/standard/read",
|                                                               "microsoft.directory/directoryRoles/eligibleMembers/read",
|                                                               "microsoft.directory/directoryRoles/members/read",
|                                                               "microsoft.directory/directoryRoles/standard/read",
|                                                               "microsoft.directory/domains/standard/read",
|                                                               "microsoft.directory/groups/appRoleAssignments/read",
|                                                               "microsoft.directory/groupSettings/standard/read",
|                                                               "microsoft.directory/groupSettingTemplates/standard/read",
|                                                               "microsoft.directory/groups/memberOf/read",
|                                                               "microsoft.directory/groups/members/read",
|                                                               "microsoft.directory/groups/owners/read",
|                                                               "microsoft.directory/groups/settings/read",
|                                                               "microsoft.directory/groups/standard/read",
|                                                               "microsoft.directory/oAuth2PermissionGrants/standard/read",
|                                                               "microsoft.directory/organization/standard/read",
|                                                               "microsoft.directory/organization/trustedCAsForPasswordlessAuth/read",
|                                                               "microsoft.directory/roleAssignments/standard/read",
|                                                               "microsoft.directory/roleDefinitions/standard/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignments/read",
|                                                               "microsoft.directory/servicePrincipals/memberOf/read",
|                                                               "microsoft.directory/servicePrincipals/oAuth2PermissionGrants/read",
|                                                               "microsoft.directory/servicePrincipals/ownedObjects/read",
|                                                               "microsoft.directory/servicePrincipals/owners/read",
|                                                               "microsoft.directory/servicePrincipals/policies/read",
|                                                               "microsoft.directory/servicePrincipals/standard/read",
|                                                               "microsoft.directory/subscribedSkus/standard/read",
|                                                               "microsoft.directory/users/appRoleAssignments/read",
|                                                               "microsoft.directory/users/deviceForResourceAccount/read",
|                                                               "microsoft.directory/users/directReports/read",
|                                                               "microsoft.directory/users/invitedBy/read",
|                                                               "microsoft.directory/users/licenseDetails/read",
|                                                               "microsoft.directory/users/manager/read",
|                                                               "microsoft.directory/users/memberOf/read",
|                                                               "microsoft.directory/users/oAuth2PermissionGrants/read",
|                                                               "microsoft.directory/users/ownedDevices/read",
|                                                               "microsoft.directory/users/ownedObjects/read",
|                                                               "microsoft.directory/users/photo/read",
|                                                               "microsoft.directory/users/registeredDevices/read",
|                                                               "microsoft.directory/users/scopedRoleMemberOf/read",
|                                                               "microsoft.directory/users/sponsorOf/read",
|                                                               "microsoft.directory/users/sponsors/read",
|                                                               "microsoft.directory/users/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "d405c6df-0af8-4e3b-95e4-4d06e542189e",
|                                           "DisplayName":  "Device Users",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions and no path to identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "9f06204d-73c1-4d4c-880a-6edb90606fd8",
|                                           "DisplayName":  "Azure AD Joined Device Local Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only group settings access with no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/groupSettings/standard/read",
|                                                               "microsoft.directory/groupSettingTemplates/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "9c094953-4995-41c8-84c8-3ebb9b32c93f",
|                                           "DisplayName":  "Device Join",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions and no path to identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "c34f683f-4d5a-4403-affd-6615e00e3a7f",
|                                           "DisplayName":  "Workplace Device Join",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions and no path to identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "5d6b6bb7-de71-4623-b4af-96380a352509",
|                                           "DisplayName":  "Security Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to security logs and policies without ability to modify or escalate.",
|                                           "Permissions":  [
|                                                               "microsoft.agentRegistry/allEntities/allProperties/read",
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.directory/accessReviews/definitions/allProperties/read",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/bitlockerKeys/key/read",
|                                                               "microsoft.directory/bulkJobs/standard/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/owners/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/policyAppliedTo/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read",
|                                                               "microsoft.directory/deviceLocalCredentials/standard/read",
|                                                               "microsoft.directory/domains/federationConfiguration/standard/read",
|                                                               "microsoft.directory/entitlementManagement/allProperties/read",
|                                                               "microsoft.directory/identityProtection/allProperties/read",
|                                                               "microsoft.directory/multiTenantOrganization/joinRequest/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/standard/read",
|                                                               "microsoft.directory/namedLocations/standard/read",
|                                                               "microsoft.directory/policies/owners/read",
|                                                               "microsoft.directory/policies/policyAppliedTo/read",
|                                                               "microsoft.directory/policies/standard/read",
|                                                               "microsoft.directory/privilegedIdentityManagement/allProperties/read",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.networkAccess/allEntities/allProperties/read",
|                                                               "microsoft.office365.protectionCenter/allEntities/standard/read",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/payload/allProperties/read",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/reports/allProperties/read",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/simulation/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "5c4f9dcd-47dc-4cf7-8c9a-9e4207cbfc91",
|                                           "DisplayName":  "Customer LockBox Access Approver",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can approve LockBox requests but no identity plane control or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.lockbox/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "4a5d8f65-41da-4de4-8968-e035b65339cf",
|                                           "DisplayName":  "Reports Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to reports with no ability to modify identity or roles.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "790c1fb9-7f7d-4f88-86a1-ef1f95c05c1b",
|                                           "DisplayName":  "Message Center Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to message center with no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "f70938a0-fc10-4177-9e90-2178f8765737",
|                                           "DisplayName":  "Teams Communications Support Engineer",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to Teams call quality and support data with no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.skypeForBusiness/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.teams/callQuality/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "fcf91098-03e3-41a9-b5ba-6f0ec8188a12",
|                                           "DisplayName":  "Teams Communications Support Specialist",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to Teams call quality data with no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.skypeForBusiness/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.teams/callQuality/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "ac16e43d-7b2d-40e0-ac05-243ff356ab5b",
|                                           "DisplayName":  "Message Center Privacy Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to message center security messages with no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.messageCenter/securityMessages/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e6d1a23a-da11-4be4-9570-befc86d067a7",
|                                           "DisplayName":  "Compliance Data Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Primarily manages compliance and support data with no direct path to identity plane control or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.informationProtection/allEntities/allTasks",
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/cloudAppSecurity/allProperties/allTasks",
|                                                               "microsoft.office365.complianceManager/allEntities/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "5f2222b1-57c3-48ba-8ad5-d4759f1fde6f",
|                                           "DisplayName":  "Security Operator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Has read access to security logs and some security features but lacks permissions to modify identity or role assignments.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.advancedThreatProtection/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/bulkJobs/standard/read",
|                                                               "microsoft.directory/cloudAppSecurity/allProperties/allTasks",
|                                                               "microsoft.directory/identityProtection/allProperties/allTasks",
|                                                               "microsoft.directory/privilegedIdentityManagement/allProperties/read",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.intune/allEntities/read",
|                                                               "microsoft.office365.securityComplianceCenter/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.windows.defenderAdvancedThreatProtection/allEntities/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "74ef975b-6605-40af-a5d2-b9539d836353",
|                                           "DisplayName":  "Kaizala Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Limited to service health and support ticket access with no identity plane control capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "f2ef992c-3afb-46b9-b7cf-a126ee74c451",
|                                           "DisplayName":  "Global Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access across tenant data without ability to modify roles or credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.agentRegistry/allEntities/allProperties/read",
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.backup/allEntities/allProperties/read",
|                                                               "microsoft.cloudPC/allEntities/allProperties/read",
|                                                               "microsoft.commerce.billing/allEntities/allProperties/read",
|                                                               "microsoft.commerce.billing/purchases/standard/read",
|                                                               "microsoft.directory/accessReviews/allProperties/read",
|                                                               "microsoft.directory/accessReviews/definitions/allProperties/read",
|                                                               "microsoft.directory/adminConsentRequestPolicy/allProperties/read",
|                                                               "microsoft.directory/administrativeUnits/allProperties/read",
|                                                               "microsoft.directory/appConsent/appConsentRequests/allProperties/read",
|                                                               "microsoft.directory/applications/allProperties/read",
|                                                               "microsoft.directory/applications/synchronization/standard/read",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.directory/bitlockerKeys/key/read",
|                                                               "microsoft.directory/bulkJobs/standard/read",
|                                                               "microsoft.directory/cloudAppSecurity/allProperties/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/allProperties/read",
|                                                               "microsoft.directory/connectorGroups/allProperties/read",
|                                                               "microsoft.directory/connectors/allProperties/read",
|                                                               "microsoft.directory/contacts/allProperties/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationIdentitySynchronization/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/templates/multiTenantOrganizationPartnerConfiguration/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/standard/read",
|                                                               "microsoft.directory/customAuthenticationExtensions/allProperties/read",
|                                                               "microsoft.directory/deviceLocalCredentials/standard/read",
|                                                               "microsoft.directory/deviceManagementPolicies/standard/read",
|                                                               "microsoft.directory/deviceRegistrationPolicy/standard/read",
|                                                               "microsoft.directory/devices/allProperties/read",
|                                                               "microsoft.directory/directoryRoles/allProperties/read",
|                                                               "microsoft.directory/directoryRoleTemplates/allProperties/read",
|                                                               "microsoft.directory/domains/allProperties/read",
|                                                               "microsoft.directory/domains/federationConfiguration/standard/read",
|                                                               "microsoft.directory/entitlementManagement/allProperties/read",
|                                                               "microsoft.directory/externalUserProfiles/standard/read",
|                                                               "microsoft.directory/groups/allProperties/read",
|                                                               "microsoft.directory/groupSettings/allProperties/read",
|                                                               "microsoft.directory/groupSettingTemplates/allProperties/read",
|                                                               "microsoft.directory/identityProtection/allProperties/read",
|                                                               "microsoft.directory/lifecycleWorkflows/workflows/allProperties/read",
|                                                               "microsoft.directory/loginOrganizationBranding/allProperties/read",
|                                                               "microsoft.directory/multiTenantOrganization/joinRequest/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/standard/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/organizationDetails/read",
|                                                               "microsoft.directory/multiTenantOrganization/tenants/standard/read",
|                                                               "microsoft.directory/namedLocations/standard/read",
|                                                               "microsoft.directory/oAuth2PermissionGrants/allProperties/read",
|                                                               "microsoft.directory/onPremisesSynchronization/standard/read",
|                                                               "microsoft.directory/organization/allProperties/read",
|                                                               "microsoft.directory/pendingExternalUserProfiles/standard/read",
|                                                               "microsoft.directory/permissionGrantPolicies/standard/read",
|                                                               "microsoft.directory/policies/allProperties/read",
|                                                               "microsoft.directory/privilegedIdentityManagement/allProperties/read",
|                                                               "microsoft.directory/provisioningLogs/allProperties/read",
|                                                               "microsoft.directory/roleAssignments/allProperties/read",
|                                                               "microsoft.directory/roleDefinitions/allProperties/read",
|                                                               "microsoft.directory/scopedRoleMemberships/allProperties/read",
|                                                               "microsoft.directory/serviceAction/getAvailableExtentionProperties",
|                                                               "microsoft.directory/servicePrincipalCreationPolicies/standard/read",
|                                                               "microsoft.directory/servicePrincipals/allProperties/read",
|                                                               "microsoft.directory/servicePrincipals/synchronization/standard/read",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.directory/subscribedSkus/allProperties/read",
|                                                               "microsoft.directory/users/allProperties/read",
|                                                               "microsoft.directory/users/authenticationMethods/standard/restrictedRead",
|                                                               "microsoft.directory/verifiableCredentials/configuration/allProperties/read",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read",
|                                                               "microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read",
|                                                               "microsoft.edge/allEntities/allProperties/read",
|                                                               "microsoft.graph.dataConnect/allEntities/allProperties/read",
|                                                               "microsoft.hardware.support/shippingAddress/allProperties/read",
|                                                               "microsoft.hardware.support/shippingStatus/allProperties/read",
|                                                               "microsoft.hardware.support/warrantyClaims/allProperties/read",
|                                                               "microsoft.healthPlatform/allEntities/allProperties/read",
|                                                               "microsoft.insights/allEntities/allProperties/read",
|                                                               "microsoft.microsoft365.organizationalData/allEntities/allProperties/read",
|                                                               "microsoft.networkAccess/allEntities/allProperties/read",
|                                                               "microsoft.office365.copilot/allEntities/allProperties/read",
|                                                               "microsoft.office365.fileStorageContainers/allEntities/allProperties/read",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.messageCenter/securityMessages/read",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.organizationalMessages/allEntities/allProperties/read",
|                                                               "microsoft.office365.protectionCenter/allEntities/allProperties/read",
|                                                               "microsoft.office365.securityComplianceCenter/allEntities/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.office365.yammer/allEntities/allProperties/read",
|                                                               "microsoft.permissionsManagement/allEntities/allProperties/read",
|                                                               "microsoft.teams/allEntities/allProperties/read",
|                                                               "microsoft.virtualVisits/allEntities/allProperties/read",
|                                                               "microsoft.viva.glint/allEntities/allProperties/read",
|                                                               "microsoft.viva.goals/allEntities/allProperties/read",
|                                                               "microsoft.viva.pulse/allEntities/allProperties/read",
|                                                               "microsoft.windows.updatesDeployments/allEntities/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "0964bb5e-9bdb-4d7b-ac29-58e794862a40",
|                                           "DisplayName":  "Search Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages search content and messages but lacks permissions to affect identity or role assignments.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.search/content/manage",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "8835291a-918c-4fd7-a9ce-faa49f0cf7d9",
|                                           "DisplayName":  "Search Editor",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can manage search content but no access to identity plane or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.search/content/manage",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "644ef478-e28f-4e28-b9dc-3fdde9aa0b1f",
|                                           "DisplayName":  "Printer Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages printer resources without access to identity or role management.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.print/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e8cef6f1-e4bd-4ea8-bc07-4b8d950f4477",
|                                           "DisplayName":  "Printer Technician",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Limited to read and update printer properties; no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.print/connectors/allProperties/read",
|                                                               "microsoft.azure.print/printers/allProperties/read",
|                                                               "microsoft.azure.print/printers/basic/update",
|                                                               "microsoft.azure.print/printers/register",
|                                                               "microsoft.azure.print/printers/unregister"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "11648597-926c-4cf3-9c36-bcebb0ba8dcc",
|                                           "DisplayName":  "Power Platform Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages Power Platform resources without direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.dynamics365/allEntities/allTasks",
|                                                               "microsoft.flow/allEntities/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.powerApps/allEntities/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e3973bdf-4987-49ae-837a-ba8e231c7286",
|                                           "DisplayName":  "Azure DevOps Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full control over Azure DevOps but no direct path to tenant-wide identity or role control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.devOps/allEntities/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "2b745bdf-0803-4d80-aa65-822c4493daac",
|                                           "DisplayName":  "Office Apps Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages Office 365 service health and user communication without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.userCommunication/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "d37c8bed-0711-4417-ba38-b4abe66ce4c2",
|                                           "DisplayName":  "Network Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages network locations and performance data without identity or role assignment capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.network/locations/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "31e939ad-9672-4796-9c2e-873181342d2d",
|                                           "DisplayName":  "Insights Business Leader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can update reports and read insights but no identity plane or role assignment permissions.",
|                                           "Permissions":  [
|                                                               "microsoft.insights/programs/allProperties/update",
|                                                               "microsoft.insights/reports/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "3d762c5a-1b6c-493f-843e-55a3b42923d4",
|                                           "DisplayName":  "Teams Devices Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to Teams devices; no identity or role management.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.teams/devices/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "c430b396-e693-46cc-96f3-db01bf8bb62a",
|                                           "DisplayName":  "Attack Simulation Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages attack simulation payloads and reports but lacks identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.protectionCenter/attackSimulator/payload/allProperties/allTasks",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/reports/allProperties/read",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/simulation/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "9c6df0f2-1e7c-4dc3-b195-66dfbd24aa8f",
|                                           "DisplayName":  "Attack Payload Author",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can create attack payloads but no permissions to modify roles or credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.protectionCenter/attackSimulator/payload/allProperties/allTasks",
|                                                               "microsoft.office365.protectionCenter/attackSimulator/reports/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "75934031-6c7e-415a-99d7-48dbd49e875e",
|                                           "DisplayName":  "Usage Summary Reports Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to usage reports without identity or role management.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.usageReports/allEntities/standard/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "b5a8dcf3-09d5-43a9-a639-8e29ef291470",
|                                           "DisplayName":  "Knowledge Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages knowledge content and security groups but no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/groups.security/basic/update",
|                                                               "microsoft.directory/groups.security/create",
|                                                               "microsoft.directory/groups.security/createAsOwner",
|                                                               "microsoft.directory/groups.security/delete",
|                                                               "microsoft.directory/groups.security/members/update",
|                                                               "microsoft.directory/groups.security/owners/update",
|                                                               "microsoft.office365.knowledge/contentUnderstanding/allProperties/allTasks",
|                                                               "microsoft.office365.knowledge/knowledgeNetwork/allProperties/allTasks",
|                                                               "microsoft.office365.knowledge/learningSources/allProperties/allTasks",
|                                                               "microsoft.office365.protectionCenter/sensitivityLabels/allProperties/read",
|                                                               "microsoft.office365.sharePoint/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "744ec460-397e-42ad-a462-8b3f9747a02c",
|                                           "DisplayName":  "Knowledge Manager",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages knowledge content visibility and groups without identity or role assignment capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/groups.security/basic/update",
|                                                               "microsoft.directory/groups.security/create",
|                                                               "microsoft.directory/groups.security/createAsOwner",
|                                                               "microsoft.directory/groups.security/delete",
|                                                               "microsoft.directory/groups.security/members/update",
|                                                               "microsoft.directory/groups.security/owners/update",
|                                                               "microsoft.office365.knowledge/contentUnderstanding/analytics/allProperties/read",
|                                                               "microsoft.office365.knowledge/knowledgeNetwork/topicVisibility/allProperties/allTasks",
|                                                               "microsoft.office365.sharePoint/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "d2562ede-74db-457e-a7b6-544e236ebb61",
|                                           "DisplayName":  "AI Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages AI agent users but lacks permissions to modify roles or credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/agentUsers/assignLicense",
|                                                               "microsoft.directory/agentUsers/basic/update",
|                                                               "microsoft.directory/agentUsers/create",
|                                                               "microsoft.directory/agentUsers/delete",
|                                                               "microsoft.directory/agentUsers/disable",
|                                                               "microsoft.directory/agentUsers/enable",
|                                                               "microsoft.directory/agentUsers/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/agentUsers/lifeCycleInfo/read",
|                                                               "microsoft.directory/agentUsers/lifeCycleInfo/update",
|                                                               "microsoft.directory/agentUsers/manager/update",
|                                                               "microsoft.directory/agentUsers/photo/update",
|                                                               "microsoft.directory/agentUsers/reprocessLicenseAssignment",
|                                                               "microsoft.directory/agentUsers/restore",
|                                                               "microsoft.directory/agentUsers/revokeSignInSessions",
|                                                               "microsoft.directory/agentUsers/sponsors/update",
|                                                               "microsoft.directory/agentUsers/usageLocation/update",
|                                                               "microsoft.directory/agentUsers/userPrincipalName/update",
|                                                               "microsoft.directory/entitlementManagement/allProperties/read",
|                                                               "microsoft.directory/subscribedSkus/standard/read",
|                                                               "microsoft.directory/users/allProperties/read",
|                                                               "microsoft.office365.copilot/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.search/content/manage",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "1fe13547-53f6-408d-ac04-7f8eed167b38",
|                                           "DisplayName":  "AI Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to AI and application policies without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.directory/administrativeUnits/members/read",
|                                                               "microsoft.directory/administrativeUnits/standard/read",
|                                                               "microsoft.directory/agentUsers/lifeCycleInfo/read",
|                                                               "microsoft.directory/applicationPolicies/standard/read",
|                                                               "microsoft.directory/applications/owners/read",
|                                                               "microsoft.directory/applications/policies/read",
|                                                               "microsoft.directory/applications/standard/read",
|                                                               "microsoft.directory/contacts/memberOf/read",
|                                                               "microsoft.directory/contacts/standard/read",
|                                                               "microsoft.directory/contracts/standard/read",
|                                                               "microsoft.directory/domains/standard/read",
|                                                               "microsoft.directory/entitlementManagement/allProperties/read",
|                                                               "microsoft.directory/groups/appRoleAssignments/read",
|                                                               "microsoft.directory/groupSettings/standard/read",
|                                                               "microsoft.directory/groupSettingTemplates/standard/read",
|                                                               "microsoft.directory/groups/memberOf/read",
|                                                               "microsoft.directory/groups/members/read",
|                                                               "microsoft.directory/groups/owners/read",
|                                                               "microsoft.directory/groups/settings/read",
|                                                               "microsoft.directory/groups/standard/read",
|                                                               "microsoft.directory/oAuth2PermissionGrants/standard/read",
|                                                               "microsoft.directory/organization/standard/read",
|                                                               "microsoft.directory/organization/trustedCAsForPasswordlessAuth/read",
|                                                               "microsoft.directory/roleAssignments/standard/read",
|                                                               "microsoft.directory/roleDefinitions/standard/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignedTo/read",
|                                                               "microsoft.directory/servicePrincipals/appRoleAssignments/read",
|                                                               "microsoft.directory/servicePrincipals/memberOf/read",
|                                                               "microsoft.directory/servicePrincipals/oAuth2PermissionGrants/read",
|                                                               "microsoft.directory/servicePrincipals/ownedObjects/read",
|                                                               "microsoft.directory/servicePrincipals/owners/read",
|                                                               "microsoft.directory/servicePrincipals/policies/read",
|                                                               "microsoft.directory/servicePrincipals/standard/read",
|                                                               "microsoft.directory/subscribedSkus/standard/read",
|                                                               "microsoft.directory/users/allProperties/read",
|                                                               "microsoft.office365.copilot/allEntities/allProperties/read",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "8424c6f0-a189-499e-bbd0-26c1753c96d4",
|                                           "DisplayName":  "Attribute Definition Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages custom security attribute definitions without direct identity or role assignment capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/attributeSets/allProperties/allTasks",
|                                                               "microsoft.directory/customSecurityAttributeDefinitions/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "58a13ea3-c632-46ae-9ee0-9c0d43cd7f3d",
|                                           "DisplayName":  "Attribute Assignment Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can update custom security attributes but no direct path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/attributeSets/allProperties/read",
|                                                               "microsoft.directory/azureManagedIdentities/customSecurityAttributes/read",
|                                                               "microsoft.directory/azureManagedIdentities/customSecurityAttributes/update",
|                                                               "microsoft.directory/customSecurityAttributeDefinitions/allProperties/read",
|                                                               "microsoft.directory/devices/customSecurityAttributes/read",
|                                                               "microsoft.directory/devices/customSecurityAttributes/update",
|                                                               "microsoft.directory/servicePrincipals/customSecurityAttributes/read",
|                                                               "microsoft.directory/servicePrincipals/customSecurityAttributes/update",
|                                                               "microsoft.directory/users/customSecurityAttributes/read",
|                                                               "microsoft.directory/users/customSecurityAttributes/update"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "1d336d2c-4ae8-42ef-9711-b3604ce3fc2c",
|                                           "DisplayName":  "Attribute Definition Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to attribute definitions without identity or role management.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/attributeSets/allProperties/read",
|                                                               "microsoft.directory/customSecurityAttributeDefinitions/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "ffd52fa5-98dc-465c-991d-fc073eb59f8f",
|                                           "DisplayName":  "Attribute Assignment Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to custom security attributes without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/attributeSets/allProperties/read",
|                                                               "microsoft.directory/azureManagedIdentities/customSecurityAttributes/read",
|                                                               "microsoft.directory/customSecurityAttributeDefinitions/allProperties/read",
|                                                               "microsoft.directory/devices/customSecurityAttributes/read",
|                                                               "microsoft.directory/servicePrincipals/customSecurityAttributes/read",
|                                                               "microsoft.directory/users/customSecurityAttributes/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "892c5842-a9a6-463a-8041-72aa08ca3cf6",
|                                           "DisplayName":  "Cloud App Security Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages Cloud App Security settings but lacks direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/cloudAppSecurity/allProperties/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "32696413-001a-46ae-978c-ce0f6b3620d2",
|                                           "DisplayName":  "Windows Update Deployment Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages Windows update deployments without identity or role assignment capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.windows.updatesDeployments/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "3f1acade-1e04-4fbc-9b69-f0302cd84aef",
|                                           "DisplayName":  "Edge Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages Edge browser settings and support tickets without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.edge/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "810a2642-a034-447f-a5e8-41beaa378541",
|                                           "DisplayName":  "Yammer Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages Yammer groups and memberships without direct identity or role assignment capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups.unified/assignedLabels/update",
|                                                               "microsoft.directory/groups.unified/basic/update",
|                                                               "microsoft.directory/groups.unified/create",
|                                                               "microsoft.directory/groups.unified/delete",
|                                                               "microsoft.directory/groups.unified/members/update",
|                                                               "microsoft.directory/groups.unified/owners/update",
|                                                               "microsoft.directory/groups.unified/restore",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.office365.yammer/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e300d9e7-4a2b-4295-9eff-f1c78b36cc98",
|                                           "DisplayName":  "Virtual Visits Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages virtual visits features without identity or role assignment permissions.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.virtualVisits/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "25df335f-86eb-4119-b717-0ff02de207e9",
|                                           "DisplayName":  "Insights Analyst",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can run insights queries and read support tickets but lacks identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.insights/queries/allProperties/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "1501b917-7653-4ff9-a4b5-203eaf33784f",
|                                           "DisplayName":  "Microsoft Hardware Warranty Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages hardware warranty and support data without identity or role management.",
|                                           "Permissions":  [
|                                                               "microsoft.hardware.support/shippingAddress/allProperties/allTasks",
|                                                               "microsoft.hardware.support/shippingStatus/allProperties/read",
|                                                               "microsoft.hardware.support/warrantyClaims/allProperties/allTasks",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "281fe777-fb20-4fbb-b7a3-ccebce5b0d96",
|                                           "DisplayName":  "Microsoft Hardware Warranty Specialist",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Limited to read and create warranty claims without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.hardware.support/shippingAddress/allProperties/read",
|                                                               "microsoft.hardware.support/warrantyClaims/createAsOwner",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.hardware.support/shippingStatus/allProperties/read",
|                                                               "microsoft.hardware.support/warrantyClaims/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "92b086b3-e367-4ef2-b869-1de128fb986e",
|                                           "DisplayName":  "Viva Goals Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manages Viva Goals features without identity or role assignment permissions.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.viva.goals/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "27460883-1df1-4691-b032-3b79643e5e63",
|                                           "DisplayName":  "User Experience Success Manager",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to billing, messages, and reports without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.commerce.billing/purchases/standard/read",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.organizationalMessages/allEntities/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/standard/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "507f53e4-4e52-4077-abd3-d2e1558b6ea2",
|                                           "DisplayName":  "Organizational Messages Writer",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Permissions allow reading and writing organizational messages and usage reports but do not enable identity plane control or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.organizationalMessages/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/standard/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "ac434307-12b9-4fa1-a708-88bf58caabc1",
|                                           "DisplayName":  "Global Secure Access Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Primarily read access to application policies and audit logs with no direct ability to modify roles or credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/applicationPolicies/standard/read",
|                                                               "microsoft.directory/applications/applicationProxy/read",
|                                                               "microsoft.directory/applications/owners/read",
|                                                               "microsoft.directory/applications/policies/read",
|                                                               "microsoft.directory/applications/standard/read",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/conditionalAccessPolicies/standard/read",
|                                                               "microsoft.directory/connectorGroups/allProperties/read",
|                                                               "microsoft.directory/connectors/allProperties/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/standard/read",
|                                                               "microsoft.directory/namedLocations/standard/read",
|                                                               "microsoft.directory/signInReports/allProperties/read",
|                                                               "microsoft.networkAccess/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "87761b17-1ed2-4af3-9acd-92a150038160",
|                                           "DisplayName":  "Viva Pulse Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read and write access to service health and usage reports without identity plane control capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.viva.pulse/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "dd13091a-6207-4fc0-82ba-3641e056ab95",
|                                           "DisplayName":  "Extended Directory User Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can update and delete external user profiles but lacks permissions to assign roles or reset credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/externalUserProfiles/basic/update",
|                                                               "microsoft.directory/externalUserProfiles/delete",
|                                                               "microsoft.directory/externalUserProfiles/standard/read",
|                                                               "microsoft.directory/pendingExternalUserProfiles/basic/update",
|                                                               "microsoft.directory/pendingExternalUserProfiles/create",
|                                                               "microsoft.directory/pendingExternalUserProfiles/delete",
|                                                               "microsoft.directory/pendingExternalUserProfiles/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "5b784334-f94b-471a-a387-e7219fc49ca2",
|                                           "DisplayName":  "Attribute Log Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read and write access to custom security attribute logs without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.customSecurityAttributeDiagnosticSettings/allEntities/allProperties/allTasks",
|                                                               "microsoft.directory/customSecurityAttributeAuditLogs/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "9c99539d-8186-4804-835f-fd51ef9e2dcd",
|                                           "DisplayName":  "Attribute Log Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to custom security attribute audit logs with no privilege escalation path.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/customSecurityAttributeAuditLogs/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "1076ac91-f3d9-41a7-a339-dcdf5f480acc",
|                                           "DisplayName":  "Teams Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to Teams and web portal data without identity or role management capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.teams/allEntities/allProperties/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "aa38014f-0993-46e9-9b45-30501a20909d",
|                                           "DisplayName":  "Teams Telephony Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Access to service health and telephony settings but no direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.skypeForBusiness/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.teams/callQuality/allProperties/read",
|                                                               "microsoft.teams/voice/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "963797fb-eb3b-4cde-8ce3-5878b3f32a3f",
|                                           "DisplayName":  "Dynamics 365 Business Central Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read and write access to Dynamics 365 and related services without ability to modify identity or roles.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.directory/domains/standard/read",
|                                                               "microsoft.directory/organization/standard/read",
|                                                               "microsoft.directory/subscribedSkus/standard/read",
|                                                               "microsoft.directory/users/standard/read",
|                                                               "microsoft.dynamics365.businessCentral/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "8c8b803f-96e1-4129-9349-20738d9f9652",
|                                           "DisplayName":  "Microsoft 365 Migration Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full access to migration tasks but no permissions to modify roles or credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.migrations/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "1a7d78b6-429f-476b-b8eb-35fb715fffd4",
|                                           "DisplayName":  "SharePoint Embedded Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full control over file storage containers and reports but no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.fileStorageContainers/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "92ed04bf-c94a-4b82-9729-b799a7a4c178",
|                                           "DisplayName":  "Organizational Branding Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can modify branding settings but lacks permissions to affect identity or role assignments.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/loginOrganizationBranding/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e48398e2-f4bb-4074-8f31-4586725e205b",
|                                           "DisplayName":  "Organizational Messages Approver",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can read and update organizational messages but no path to identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.organizationalMessages/allEntities/allProperties/read",
|                                                               "microsoft.office365.organizationalMessages/allEntities/allProperties/update",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "ee67aa9c-e510-4759-b906-227085a7fd4d",
|                                           "DisplayName":  "Microsoft Graph Data Connect Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full access to data connect and message center but no direct role or credential management.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.graph.dataConnect/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "1707125e-0aa2-4d4d-8655-a7c786c76a25",
|                                           "DisplayName":  "Microsoft 365 Backup Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full backup and restore permissions without identity plane or role assignment capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.backup/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "a92aed5d-d78a-4d16-b381-09adb37eb3b0",
|                                           "DisplayName":  "On Premises Directory Sync Account",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to on-premises synchronization settings without ability to modify roles or credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/onPremisesSynchronization/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "422218e4-db15-4ef9-bbe0-8afb41546d79",
|                                           "DisplayName":  "Attribute Provisioning Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to custom security attribute schema with no privilege escalation path.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/servicePrincipals/synchronization.customSecurityAttributes/schema/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "ecb2c6bf-0ab6-418e-bd87-7986f8d63bbe",
|                                           "DisplayName":  "Attribute Provisioning Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can update custom security attribute schema but no direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/servicePrincipals/synchronization.customSecurityAttributes/schema/read",
|                                                               "microsoft.directory/servicePrincipals/synchronization.customSecurityAttributes/schema/update"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "843318fb-79a6-4168-9e6f-aa9a07481cc4",
|                                           "DisplayName":  "Global Secure Access Log Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to network traffic logs without identity or role management capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.networkAccess/trafficLogs/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "9d70768a-0cbc-4b4c-aea3-2e124b2477f4",
|                                           "DisplayName":  "Organizational Data Source Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full access to organizational data sources and service health but no identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.microsoft365.organizationalData/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "024906de-61e5-49c8-8572-40335f1e0e10",
|                                           "DisplayName":  "People Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Can update user photos and organization properties but cannot assign roles or reset credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.peopleAdmin/organization/allProperties/read",
|                                                               "microsoft.peopleAdmin/organization/allProperties/update",
|                                                               "microsoft.people/users/photo/read",
|                                                               "microsoft.people/users/photo/update"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "2ea5ce4c-b2d8-4668-bd81-3680bd2d227a",
|                                           "DisplayName":  "IoT Device Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manage device authentication configurations without identity plane or role assignment permissions.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/certificateBasedDeviceAuthConfigurations/create",
|                                                               "microsoft.directory/certificateBasedDeviceAuthConfigurations/credentials/update",
|                                                               "microsoft.directory/certificateBasedDeviceAuthConfigurations/delete",
|                                                               "microsoft.directory/certificateBasedDeviceAuthConfigurations/standard/read",
|                                                               "microsoft.directory/deviceTemplates/create",
|                                                               "microsoft.directory/deviceTemplates/createDeviceFromTemplate",
|                                                               "microsoft.directory/deviceTemplates/delete",
|                                                               "microsoft.directory/deviceTemplates/deviceInstances/read",
|                                                               "microsoft.directory/deviceTemplates/owners/read",
|                                                               "microsoft.directory/deviceTemplates/owners/update"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "0ec3f692-38d6-4d14-9e69-0377ca7797ad",
|                                           "DisplayName":  "Viva Glint Tenant Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Access to service health and usage reports without identity or role management capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.messageCenter/messages/read",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.viva.glint/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "78b0ccd1-afc2-4f92-9116-b41aedd09592",
|                                           "DisplayName":  "Places Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full control over places data but no path to identity plane control or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.places/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "9d3e04ba-3ee4-4d1b-a3a7-9aef423a09be",
|                                           "DisplayName":  "SharePoint Backup Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full backup and restore permissions for SharePoint without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.backup/oneDriveForBusinessProtectionPolicies/allProperties/allTasks",
|                                                               "microsoft.backup/oneDriveForBusinessRestoreSessions/allProperties/allTasks",
|                                                               "microsoft.backup/restorePoints/sites/allProperties/allTasks",
|                                                               "microsoft.backup/restorePoints/userDrives/allProperties/allTasks",
|                                                               "microsoft.backup/sharePointProtectionPolicies/allProperties/allTasks",
|                                                               "microsoft.backup/sharePointRestoreSessions/allProperties/allTasks",
|                                                               "microsoft.backup/siteProtectionUnits/allProperties/allTasks",
|                                                               "microsoft.backup/siteRestoreArtifacts/allProperties/allTasks",
|                                                               "microsoft.backup/userDriveProtectionUnits/allProperties/allTasks",
|                                                               "microsoft.backup/userDriveRestoreArtifacts/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "49eb8f75-97e9-4e37-9b2b-6c3ebfcffa31",
|                                           "DisplayName":  "Exchange Backup Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full backup and restore permissions for Exchange without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.backup/exchangeProtectionPolicies/allProperties/allTasks",
|                                                               "microsoft.backup/exchangeRestoreSessions/allProperties/allTasks",
|                                                               "microsoft.backup/restorePoints/userMailboxes/allProperties/allTasks",
|                                                               "microsoft.backup/userMailboxProtectionUnits/allProperties/allTasks",
|                                                               "microsoft.backup/userMailboxRestoreArtifacts/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e93e3737-fa85-474a-aee4-7d3fb86510f3",
|                                           "DisplayName":  "Dragon Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Access to health platform and service health without identity or role management capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.healthPlatform/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "99009c4a-3b3f-4957-82a9-9d35e12db77e",
|                                           "DisplayName":  "SharePoint Advanced Management Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full backup and restore permissions for SharePoint without identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.backup/oneDriveForBusinessProtectionPolicies/allProperties/allTasks",
|                                                               "microsoft.backup/oneDriveForBusinessRestoreSessions/allProperties/allTasks",
|                                                               "microsoft.backup/restorePoints/sites/allProperties/allTasks",
|                                                               "microsoft.backup/restorePoints/userDrives/allProperties/allTasks",
|                                                               "microsoft.backup/sharePointProtectionPolicies/allProperties/allTasks",
|                                                               "microsoft.backup/sharePointRestoreSessions/allProperties/allTasks",
|                                                               "microsoft.backup/siteProtectionUnits/allProperties/allTasks",
|                                                               "microsoft.backup/siteRestoreArtifacts/allProperties/allTasks",
|                                                               "microsoft.backup/userDriveProtectionUnits/allProperties/allTasks",
|                                                               "microsoft.backup/userDriveRestoreArtifacts/allProperties/allTasks",
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups.unified/assignedLabels/update",
|                                                               "microsoft.directory/groups.unified/basic/update",
|                                                               "microsoft.directory/groups.unified/create",
|                                                               "microsoft.directory/groups.unified/delete",
|                                                               "microsoft.directory/groups.unified/members/update",
|                                                               "microsoft.directory/groups.unified/owners/update",
|                                                               "microsoft.directory/groups.unified/restore",
|                                                               "microsoft.office365.migrations/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.network/performance/allProperties/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.sharePointAdvancedManagement/allEntities/allProperties/allTasks",
|                                                               "microsoft.office365.sharePoint/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks",
|                                                               "microsoft.office365.usageReports/allEntities/allProperties/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "2fe872fb-daa8-4afc-8f6c-53c4565cfef4",
|                                           "DisplayName":  "Teams External Collaboration Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manage external access policies but no direct ability to assign roles or reset credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/authorizationPolicy/standard/read",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read",
|                                                               "microsoft.teams/policies/externalAccessPolicy/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "adb2368d-a9be-41b5-8667-d96778e081b0",
|                                           "DisplayName":  "Agent ID Developer",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read-only access to service principals without privilege escalation path.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/servicePrincipals/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "0b00bede-4072-4d22-b441-e7df02a1ef63",
|                                           "DisplayName":  "Authentication Extensibility Password Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manage custom authentication extension settings without direct identity plane control.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/onPasswordSubmitCustomAuthenticationExtension/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "6b942400-691f-4bf0-9d12-d8a254a2baf5",
|                                           "DisplayName":  "Agent Registry Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Full control over agent registry but no identity or role assignment capabilities.",
|                                           "Permissions":  [
|                                                               "microsoft.agentRegistry/allEntities/allProperties/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "db506228-d27e-4b7d-95e5-295956d6615f",
|                                           "DisplayName":  "Agent ID Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manage agent users but no permissions to assign privileged roles or reset credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.azure.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.azure.supportTickets/allEntities/allTasks",
|                                                               "microsoft.directory/agentUsers/assignLicense",
|                                                               "microsoft.directory/agentUsers/basic/update",
|                                                               "microsoft.directory/agentUsers/create",
|                                                               "microsoft.directory/agentUsers/delete",
|                                                               "microsoft.directory/agentUsers/disable",
|                                                               "microsoft.directory/agentUsers/enable",
|                                                               "microsoft.directory/agentUsers/invalidateAllRefreshTokens",
|                                                               "microsoft.directory/agentUsers/lifeCycleInfo/read",
|                                                               "microsoft.directory/agentUsers/lifeCycleInfo/update",
|                                                               "microsoft.directory/agentUsers/manager/update",
|                                                               "microsoft.directory/agentUsers/photo/update",
|                                                               "microsoft.directory/agentUsers/reprocessLicenseAssignment",
|                                                               "microsoft.directory/agentUsers/restore",
|                                                               "microsoft.directory/agentUsers/revokeSignInSessions",
|                                                               "microsoft.directory/agentUsers/sponsors/update",
|                                                               "microsoft.directory/agentUsers/usageLocation/update",
|                                                               "microsoft.directory/agentUsers/userPrincipalName/update",
|                                                               "microsoft.directory/auditLogs/allProperties/read",
|                                                               "microsoft.directory/externalUserProfiles/standard/read",
|                                                               "microsoft.directory/groups/hiddenMembers/read",
|                                                               "microsoft.directory/groups.unified/createAsOwner",
|                                                               "microsoft.directory/organization/standard/read",
|                                                               "microsoft.directory/policies/standard/read",
|                                                               "microsoft.office365.serviceHealth/allEntities/allTasks",
|                                                               "microsoft.office365.supportTickets/allEntities/allTasks"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e07494ad-1654-4dd2-922e-6f81a71bf00f",
|                                           "DisplayName":  "Purview Workload Content Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions; presumed read-only content access without identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "02d5655b-c1cf-4e5f-98da-5fb919085bf6",
|                                           "DisplayName":  "Purview Workload Content Writer",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions; presumed content write access without identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "3f04f91a-4ad7-4bd3-bcfa-49882ea1a88a",
|                                           "DisplayName":  "Purview Workload Content Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions; presumed content admin without identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "fc8ad4e2-40e4-4724-8317-bcda7503ecbf",
|                                           "DisplayName":  "Customer Delegated Admin Relationship Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manage delegated admin privileges but no direct ability to assign global admin roles or reset credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.commerce.tenantRelationships/customerDelegatedAdminPrivileges/allProperties/allTasks",
|                                                               "microsoft.office365.webPortal/allEntities/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "f42252d9-5400-4d7b-b9ef-cc582dbb8577",
|                                           "DisplayName":  "Entra Backup Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Read and create backup previews without identity plane control or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/backup/preview/cancel",
|                                                               "microsoft.directory/backup/preview/create",
|                                                               "microsoft.directory/backup/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "b6a27b2b-f905-4b2e-81b5-0d90e0ef1fdb",
|                                           "DisplayName":  "Entra Backup Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manage backup and recovery but no direct identity plane control or role assignment.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/backup/preview/cancel",
|                                                               "microsoft.directory/backup/preview/create",
|                                                               "microsoft.directory/backup/recovery/cancel",
|                                                               "microsoft.directory/backup/recovery/create",
|                                                               "microsoft.directory/backup/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "1981f584-96e9-4a6f-95b0-f522373f8fae",
|                                           "DisplayName":  "Tenant Governance Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "Manage cross-tenant access policies but no direct ability to assign privileged roles or reset credentials.",
|                                           "Permissions":  [
|                                                               "microsoft.directory/crossTenantAccessPolicy/basic/update",
|                                                               "microsoft.directory/crossTenantAccessPolicy/default/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/create",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/delete",
|                                                               "microsoft.directory/crossTenantAccessPolicy/partners/standard/read",
|                                                               "microsoft.directory/crossTenantAccessPolicy/standard/read"
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "e0a4caa6-fe82-443f-b92f-d87341d17b2e",
|                                           "DisplayName":  "Tenant Governance Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions; presumed read-only without identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "b8e31d83-1534-480f-9b10-0338ded51b7e",
|                                           "DisplayName":  "Tenant Governance Relationship Administrator",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions; presumed limited scope without identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       },
|                                       {
|                                           "Id":  "124577f8-48ed-456a-839f-13b419002e33",
|                                           "DisplayName":  "Tenant Governance Relationship Reader",
|                                           "IsBuiltIn":  true,
|                                           "Tier":  3,
|                                           "Reason":  "No explicit permissions; presumed read-only without identity plane control.",
|                                           "Permissions":  [
|
|                                                           ]
|                                       }
|                                   ],
|    "EntraID_CustomRoles_Tier0":  [
|
|                                  ],
|    "EntraID_CustomRoles_Tier1":  [
|
|                                  ],
|    "EntraID_CustomRoles_Tier2":  [
|
|                                  ],
|    "EntraID_CustomRoles_Tier3":  [
|                                      {
|                                          "Id":  "5fae9c61-3aef-49d2-b441-ae8471522219",
|                                          "DisplayName":  "Users_Read_All_As_Scoped_Role_Delegation_on_SP",
|                                          "IsBuiltIn":  false,
|                                          "Tier":  3,
|                                          "Reason":  "Read-only access to users without ability to assign roles or reset credentials.",
|                                          "Permissions":  [
|                                                              "microsoft.directory/users/standard/read"
|                                                          ]
|                                      }
|                                  ],
|    "EntraID_APIPermissions_Tier0":  [
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AppRoleAssignment.ReadWrite.All",
|                                             "DisplayName":  "Manage app permission grants and app role assignments",
|                                             "Description":  "Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.",
|                                             "Tier":  0,
|                                             "Reason":  "Manage permission grants and app assignments for any app without signed-in user; direct role assignment control enabling full tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Policy.ReadWrite.AuthenticationMethod",
|                                             "DisplayName":  "Read and write all authentication method policies ",
|                                             "Description":  "Allows the app to read and write all authentication method policies for the tenant, without a signed-in user. ",
|                                             "Tier":  0,
|                                             "Reason":  "Write access to authentication method policies allows resetting MFA and credential controls, enabling immediate full tenant compromise."
|                                         }
|                                     ],
|    "EntraID_APIPermissions_Tier1":  [
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "APIConnectors.ReadWrite.All",
|                                             "DisplayName":  "Read and write API connectors for authentication flows",
|                                             "Description":  "Allows the app to read, create and manage the API connectors used in user authentication flows, on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Manage API connectors in authentication flows, enabling modification of authentication which can lead to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AppCatalog.ReadWrite.All",
|                                             "DisplayName":  "Read and write to all app catalogs",
|                                             "Description":  "Allows the app to create, read, update, and delete apps in the app catalogs without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Create, update, delete apps in app catalog without signed-in user; can modify app registrations enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AppCertTrustConfiguration.ReadWrite.All",
|                                             "DisplayName":  "Read and write the trusted certificate authority configuration for applications",
|                                             "Description":  "Allows the app to create, read, update and delete the trusted certificate authority configuration which can be used to restrict application certificates based on their issuing authority, on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Modify trusted certificate authority configuration; can impact app authentication and enable privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Application.ReadUpdate.All",
|                                             "DisplayName":  "Read and update all apps",
|                                             "Description":  "Allows the app to read and update all apps in your organization, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Read and update all apps without signed-in user; enables modification of app registrations leading to privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Application.ReadWrite.All",
|                                             "DisplayName":  "Read and write all applications",
|                                             "Description":  "Allows the app to create, read, update and delete applications and service principals on behalf of the signed-in user. Does not allow management of consent grants.",
|                                             "Tier":  1,
|                                             "Reason":  "Create, read, update, delete applications and service principals on behalf of user; enables role assignment and privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Application.ReadWrite.OwnedBy",
|                                             "DisplayName":  "Manage apps that this app creates or owns",
|                                             "Description":  "Allows the app to create other applications, and fully manage those applications (read, update, update application secrets and delete), without a signed-in user.  It cannot update any apps that it is not an owner of.",
|                                             "Tier":  1,
|                                             "Reason":  "Manage owned applications including secrets; can escalate privileges via owned app registrations."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuthenticationContext.ReadWrite.All",
|                                             "DisplayName":  "Read and write all authentication context information",
|                                             "Description":  "Allows the app to read and update all authentication context information in your organization on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Allows updating authentication context information, which can be leveraged to modify authentication policies and potentially bypass MFA, enabling a reliable path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DelegatedAdminRelationship.ReadWrite.All",
|                                             "DisplayName":  "Manage Delegated Admin relationships with customers",
|                                             "Description":  "Allows the app to manage (create-update-terminate) Delegated Admin relationships with customers and role assignments to security groups for active Delegated Admin relationships without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Can manage delegated admin relationships and role assignments, enabling a reliable path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DelegatedPermissionGrant.ReadWrite.All",
|                                             "DisplayName":  "Manage all delegated permission grants",
|                                             "Description":  "Allows the app to manage permission grants for delegated permissions exposed by any API (including Microsoft Graph), on behalf of the signed in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Can manage delegated permission grants, enabling assignment of high privilege roles and tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DeviceManagementRBAC.ReadWrite.All",
|                                             "DisplayName":  "Read and write Microsoft Intune RBAC settings",
|                                             "Description":  "Allows the app to read and write the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to Intune RBAC settings enables privilege escalation to assign roles, enabling near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceManagementServiceConfig.ReadWrite.All",
|                                             "DisplayName":  "Read and write Microsoft Intune configuration",
|                                             "Description":  "Allows the app to read and write Microsoft Intune service properties including device enrollment and third party service connection configuration, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to Intune service configuration including enrollment and third party connections enables privilege escalation and identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Domain.ReadWrite.All",
|                                             "DisplayName":  "Read and write domains",
|                                             "Description":  "Allows the app to read and write all domain properties without a signed in user.  Also allows the app to add,  verify and remove domains.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to domain properties including add, verify, and remove domains enables near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Domain-InternalFederation.ReadWrite.All",
|                                             "DisplayName":  "Create, read, update and delete internal federation configuration for a domain.",
|                                             "Description":  "Allows the app to create, read, update and delete internal federation configuration for a domain.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to internal federation configuration enables manipulation of trust relationships, enabling near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EventListener.ReadWrite.All",
|                                             "DisplayName":  "Read and write all authentication event listeners",
|                                             "Description":  "Allows the app to read or write your organization\u0027s authentication event listeners without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Application read/write access to authentication event listeners allows modification of authentication policies, enabling reliable escalation to full tenant compromise."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Exchange.Manage",
|                                             "DisplayName":  "Manage Exchange configuration",
|                                             "Description":  "Allows the app to manage the organization\u0027s Exchange environment, such as mailboxes, groups, and other configuration objects. To enable management actions, an admin must assign the appropriate roles to the app user.",
|                                             "Tier":  1,
|                                             "Reason":  "Delegated management of Exchange environment with admin role assignments enables reliable escalation to tenant-wide identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Exchange.ManageAsApp",
|                                             "DisplayName":  "Manage Exchange As Application",
|                                             "Description":  "Allows the app to manage the organization\u0027s Exchange environment without any user interaction. This includes mailboxes, groups, and other configuration objects. To enable management actions, an admin must assign the appropriate roles directly to the app.",
|                                             "Tier":  1,
|                                             "Reason":  "Application management of Exchange environment with admin role assignments enables reliable tenant-wide identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Exchange.ManageAsAppV2",
|                                             "DisplayName":  "Manage Exchange as application v2",
|                                             "Description":  "Allows the app to manage a limited set of Exchange Online configuration objects without user interaction, for specific scenarios supported by the adminapi/v2.0 endpoint. To enable management actions an admin must also assign the appropriate Exchange RBAC roles directly to the app.",
|                                             "Tier":  1,
|                                             "Reason":  "Application management of limited Exchange configuration with admin role assignments enables reliable escalation to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Exchange.ManageV2",
|                                             "DisplayName":  "Manage Exchange configuration v2",
|                                             "Description":  "Allows the app to manage a limited set of Exchange Online configuration objects via the adminapi/v2.0 endpoint. This permission is intended for specific scenarios and requires appropriate Exchange RBAC role assignments.",
|                                             "Tier":  1,
|                                             "Reason":  "Delegated management of limited Exchange configuration with admin role assignments enables reliable escalation to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IdentityProvider.ReadWrite.All",
|                                             "DisplayName":  "Read and write identity providers",
|                                             "Description":  "Allows the app to read and write your organization’s identity (authentication) providers’ properties on behalf of the user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to identity providers allows modification of authentication infrastructure, enabling reliable escalation to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OnPremDirectorySynchronization.ReadWrite.All",
|                                             "DisplayName":  "Read and write all on-premises directory synchronization information",
|                                             "Description":  "Allows the app to read and write all on-premises directory synchronization information for the organization, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Read and write access to on-prem directory sync info enables modification of sync objects, enabling near-direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OnPremisesPublishingProfiles.ReadWrite.All",
|                                             "DisplayName":  "Manage on-premises published resources",
|                                             "Description":  "Allows the app to create, view, update and delete on-premises published resources, on-premises agents and agent groups, as part of a hybrid identity configuration, without a signed in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Full control over on-prem publishing profiles and agents enables manipulation of hybrid identity configuration, enabling reliable escalation to tenant compromise."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Organization.ReadWrite.All",
|                                             "DisplayName":  "Read and write organization information",
|                                             "Description":  "Allows the app to read and write the organization and related resources, without a signed-in user. Related resources include things like subscribed skus and tenant branding information.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to organization info without user enables modification of tenant-wide settings, enabling near-direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OrgSettings-AppsAndServices.ReadWrite.All",
|                                             "DisplayName":  "Read and write organization-wide apps and services settings",
|                                             "Description":  "Allows the app to read and write organization-wide apps and services settings, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Read and write access to org-wide apps and services settings without user enables modification of tenant settings, enabling near-direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Policy.ReadWrite.AccessReview",
|                                             "DisplayName":  "Read and write your organization\u0027s directory access review default policy",
|                                             "Description":  "Allows the app to read and write your organization\u0027s directory access review default policy without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to directory access review policies enables modification of access reviews, a reliable pivot to elevate permissions."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.ApplicationConfiguration",
|                                             "DisplayName":  "Read and write your organization\u0027s application configuration policies",
|                                             "Description":  "Allows the app to read and write your organization\u0027s application configuration policies on behalf of the signed-in user.  This includes policies such as activityBasedTimeoutPolicy, claimsMappingPolicy, homeRealmDiscoveryPolicy,  tokenIssuancePolicy and tokenLifetimePolicy.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to application configuration policies allows modification of token issuance and claims policies, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Policy.ReadWrite.AuthenticationFlows",
|                                             "DisplayName":  "Read and write authentication flow policies",
|                                             "Description":  "Allows the app to read and write all authentication flow policies for the tenant, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to authentication flow policies enables modification of authentication processes, a direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.Authorization",
|                                             "DisplayName":  "Read and write your organization\u0027s authorization policy",
|                                             "Description":  "Allows the app to read and write your organization\u0027s authorization policy on behalf of the signed-in user.  For example, authorization policies can control some of the permissions that the out-of-the-box user role has by default.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to authorization policies allows modifying user role permissions, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Policy.ReadWrite.B2BManagementPolicy",
|                                             "DisplayName":  "Read and write your organization\u0027s B2BManagement policies",
|                                             "Description":  "Allows the app to read and write all your organization\u0027s B2BManagement policies without a signed in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to B2B management policies enables control over external collaboration, a reliable pivot to elevate privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.ConditionalAccess",
|                                             "DisplayName":  "Read and write your organization\u0027s conditional access policies",
|                                             "Description":  "Allows the app to read and write your organization\u0027s conditional access policies on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to conditional access policies allows disabling or modifying security controls, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Policy.ReadWrite.ConsentRequest",
|                                             "DisplayName":  "Read and write your organization\u0027s consent request policy",
|                                             "Description":  "Allows the app to read and write your organization\u0027s consent requests policy without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to consent request policies enables manipulation of app permissions, a reliable path to privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.CrossTenantAccess",
|                                             "DisplayName":  "Read and write your organization\u0027s cross tenant access policies",
|                                             "Description":  "Allows the app to read and write your organization\u0027s cross-tenant access policies and configuration for automatic user consent settings to suppress consent prompts for users of the other tenant on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to cross-tenant access policies enables modifying trust relationships, a reliable pivot to elevate privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.CrossTenantCapability",
|                                             "DisplayName":  "Read and write your organization\u0027s M365 cross tenant access capabilities",
|                                             "Description":  "Allows the app to read and write your organization\u0027s M365 cross tenant access capabilities on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to cross-tenant capabilities allows modifying M365 cross-tenant access, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.DeviceConfiguration",
|                                             "DisplayName":  "Read and write your organization\u0027s device configuration policies",
|                                             "Description":  "Allows the app to read and write your organization\u0027s device configuration policies on behalf of the signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to device configuration policies allows modifying device registration and controls, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.ExternalIdentities",
|                                             "DisplayName":  "Read and write your organization\u0027s external identities policy",
|                                             "Description":  "Allows the application to read and update the organization\u0027s external identities policy on behalf of the signed-in user.  For example, external identities policy controls if users invited to access resources in your organization via B2B collaboration or B2B direct connect are allowed to self-service leave.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to external identities policy allows modifying B2B collaboration settings, a reliable pivot to elevate privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.FedTokenValidation",
|                                             "DisplayName":  "Read and write your organization\u0027s federated token validation policy",
|                                             "Description":  "Allows the application to read and update the organization\u0027s federated token validation policy on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to federated token validation policies allows modifying token validation, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.IdentityProtection",
|                                             "DisplayName":  "Read and write your organization’s identity protection policy ",
|                                             "Description":  "Allows the app to read and write your organization’s identity protection policy on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to identity protection policies allows modifying security controls, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.PermissionGrant",
|                                             "DisplayName":  "Manage consent and permission grant policies",
|                                             "Description":  "Allows the app to manage policies related to consent and permission grants for applications, on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to consent and permission grant policies allows managing app permissions, a reliable path to privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.SecurityDefaults",
|                                             "DisplayName":  "Read and write your organization\u0027s security defaults policy",
|                                             "Description":  "Allows the app to read and write your organization\u0027s security defaults policy on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to security defaults policy allows disabling baseline protections, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.TrustFramework",
|                                             "DisplayName":  "Read and write your organization\u0027s trust framework policies",
|                                             "Description":  "Allows the app to read and write your organization\u0027s trust framework policies on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to trust framework policies allows modifying authentication and identity flows, enabling privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedAccess.ReadWrite.AzureAD",
|                                             "DisplayName":  "Read and write privileged access to Azure AD roles",
|                                             "Description":  "Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles in your organization, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Manage time-based assignment and just-in-time elevation of Azure AD roles without user; enables role assignment escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedAccess.ReadWrite.AzureADGroup",
|                                             "DisplayName":  "Read and write privileged access to Azure AD groups",
|                                             "Description":  "Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups in your organization, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Manage time-based assignment and elevation of Azure AD groups without user; enables role assignment escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup",
|                                             "DisplayName":  "Read, create, and delete assignment schedules for access to Azure AD groups",
|                                             "Description":  "Allows the app to read, create, and delete time-based assignment schedules for access to Azure AD groups, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Create and delete time-based assignment schedules for Azure AD groups without user; enables role assignment escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup",
|                                             "DisplayName":  "Read, create, and delete eligibility schedules for access to Azure AD groups",
|                                             "Description":  "Allows the app to read, create, and delete time-based eligibility schedules for access to Azure AD groups, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Manage eligibility schedules for Azure AD groups without user; enables role assignment escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PublicKeyInfrastructure.ReadWrite.All",
|                                             "DisplayName":  "Read and write all certificate based authentication configurations",
|                                             "Description":  "Allows the application to read and write certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Read and write certificate-based authentication configuration without user; can modify authentication infrastructure enabling escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleAssignmentSchedule.ReadWrite.Directory",
|                                             "DisplayName":  "Read, update, and delete all active role assignments for your company\u0027s directory",
|                                             "Description":  "Allows the app to read and manage the active role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user. This includes managing active directory role membership, and reading directory role templates, directory roles and active memberships.",
|                                             "Tier":  1,
|                                             "Reason":  "Manage active RBAC assignments including directory role membership; enables reliable privilege escalation to tenant-wide roles."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleAssignmentSchedule.Remove.Directory",
|                                             "DisplayName":  "Delete all active role assignments of your company\u0027s directory",
|                                             "Description":  "Delete all active privileged role-based access control (RBAC) assignments of your company\u0027s directory, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Delete active privileged RBAC assignments; enables manipulation of role assignments leading to tenant compromise."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleEligibilitySchedule.ReadWrite.Directory",
|                                             "DisplayName":  "Read, update, and delete  all eligible role assignments for your company\u0027s directory",
|                                             "Description":  "Allows the app to read and manage the eligible role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user. This includes managing eligible directory role membership, and reading directory role templates, directory roles and eligible memberships.",
|                                             "Tier":  1,
|                                             "Reason":  "Manage eligible RBAC assignments including directory role membership; enables reliable privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleEligibilitySchedule.Remove.Directory",
|                                             "DisplayName":  "Delete all eligible role assignments for your company\u0027s directory",
|                                             "Description":  "Allows the app to delete the eligible role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Delete eligible RBAC assignments; enables manipulation of role eligibility leading to privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleGroupMember.tenant.write",
|                                             "DisplayName":  "RoleGroupMember.tenant.write",
|                                             "Description":  "This allows to change RoleGroupMember to the tenant",
|                                             "Tier":  1,
|                                             "Reason":  "Write access to role group membership; allows adding self or others to privileged roles for tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagement.ReadWrite.Directory",
|                                             "DisplayName":  "Read and write directory RBAC settings",
|                                             "Description":  "Allows the app to read and manage the role-based access control (RBAC) settings for your company\u0027s directory, on behalf of the signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.",
|                                             "Tier":  1,
|                                             "Reason":  "Delegated permission to manage directory RBAC roles and memberships enables role assignment and potential elevation to Global Admin."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleManagementPolicy.ReadWrite.AzureADGroup",
|                                             "DisplayName":  "Read, update, and delete all policies in PIM for Groups",
|                                             "Description":  "Allows the app to read, update, and delete policies in Privileged Identity Management for Groups, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Application permission to modify PIM policies for groups can enable elevation or assignment of privileged roles."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleManagementPolicy.ReadWrite.Directory",
|                                             "DisplayName":  "Read, update, and delete all policies for privileged role assignments of your company\u0027s directory",
|                                             "Description":  "Allows the app to read, update, and delete policies for privileged role-based access control (RBAC) assignments of your company\u0027s directory, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Application permission to modify privileged RBAC assignment policies enables role assignment and elevation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleManagementPolicy.ReadWrite.EntraAppRole",
|                                             "DisplayName":  "Manage all policies in PIM for App Roles",
|                                             "Description":  "Allows the app to manage policies in Privileged Identity Management for App Roles, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Application permission to manage PIM policies for app roles enables role assignment and potential privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ServicePrincipalEndpoint.ReadWrite.All",
|                                             "DisplayName":  "Read and update service principal endpoints",
|                                             "Description":  "Allows the app to update service principal endpoints",
|                                             "Tier":  1,
|                                             "Reason":  "Update service principal endpoints without signed-in user; can modify app registrations enabling role assignment escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SharePointTenantSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and change SharePoint and OneDrive tenant settings",
|                                             "Description":  "Allows the application to read and change the tenant-level settings of SharePoint and OneDrive, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Read and modify tenant-level SharePoint and OneDrive settings without signed-in user; can impact security settings enabling escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SignInIdentifier.ReadWrite.All",
|                                             "DisplayName":  "Read and write all sign-in identifiers",
|                                             "Description":  "Allows the app to read and write your organization\u0027s sign-in identifiers, on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Read and write organization\u0027s sign-in identifiers on behalf of user; can modify authentication identifiers enabling escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SpiffeTrustDomain.ReadWrite.All",
|                                             "DisplayName":  "Read and write SPIFFE trust domains and child resources",
|                                             "Description":  "Allows the app to read and write your organization\u0027s SPIFFE trust domains and child resources without a signed in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Read and write SPIFFE trust domains without signed-in user; can modify trust relationships enabling escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Synchronization.ReadWrite.All",
|                                             "DisplayName":  "Read and write all Azure AD synchronization data.",
|                                             "Description":  "Allows the application to configure the Azure AD synchronization service, without a signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Configuring Azure AD sync service enables modification of identity synchronization, enabling reliable privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User-PasswordProfile.ReadWrite.All",
|                                             "DisplayName":  "Read and write password profiles and reset user passwords",
|                                             "Description":  "Allows the app to read and write password profiles and reset passwords for all users, on behalf of the signed-in user.",
|                                             "Tier":  1,
|                                             "Reason":  "Allows reading and resetting passwords for all users; direct path to tenant takeover via credential reset."
|                                         }
|                                     ],
|    "EntraID_APIPermissions_Tier2":  [
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AccessReview.ReadWrite.All",
|                                             "DisplayName":  "Manage all access reviews that user can access",
|                                             "Description":  "Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings that the signed-in user has access to in the organization.",
|                                             "Tier":  2,
|                                             "Reason":  "Can modify access reviews which may impact access governance but no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AccessReview.ReadWrite.Membership",
|                                             "DisplayName":  "Manage access reviews for group and app memberships",
|                                             "Description":  "Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings in the organization for group and app memberships, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Application-level access to modify group and app membership reviews; potential for data impact but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AdministrativeUnit.ReadWrite.All",
|                                             "DisplayName":  "Read and write all administrative units",
|                                             "Description":  "Allows the app to create, read, update, and delete administrative units and manage administrative unit membership without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Can create and modify administrative units and memberships; no direct identity plane control but potential for governance impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentity.Create.All",
|                                             "DisplayName":  "Create agent identities without an agent blueprint parent",
|                                             "Description":  "Allows the app to create agent identities, even if the app is not the parent agent identity blueprint.",
|                                             "Tier":  2,
|                                             "Reason":  "Can create agent identities without signed-in user; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentity.CreateAsManager",
|                                             "DisplayName":  "Create agent identities linked to itself.",
|                                             "Description":  "Allows the app to create linked agent identities without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Create linked agent identities without signed-in user; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentity.DeleteRestore.All",
|                                             "DisplayName":  "Delete and restore agent identities",
|                                             "Description":  "Allows the client to delete and restore agent identities.",
|                                             "Tier":  2,
|                                             "Reason":  "Delete and restore agent identities; potential impact on identity management but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentity.EnableDisable.All",
|                                             "DisplayName":  "Enable or disable agent identities",
|                                             "Description":  "Allows the client to enable or disable agent identities.",
|                                             "Tier":  2,
|                                             "Reason":  "Enable or disable agent identities; potential impact on identity management but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentity.ReadWrite.All",
|                                             "DisplayName":  "Read and write all agent identities",
|                                             "Description":  "Allows the client to read, update, and delete agent identities on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read, update, and delete agent identities on behalf of signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentityBlueprint.AddRemoveCreds.All",
|                                             "DisplayName":  "Update agent identity blueprint credentials",
|                                             "Description":  "Allows updating agent identity blueprint credentials on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Update agent identity blueprint credentials; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentityBlueprint.Create",
|                                             "DisplayName":  "Create agent identity blueprints.",
|                                             "Description":  "Allows creating new agent identity blueprints without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Create new agent identity blueprints; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentityBlueprint.DeleteRestore.All",
|                                             "DisplayName":  "Delete and restore agent identity blueprints.",
|                                             "Description":  "Allows deleting or restoring agent identity blueprints without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Delete or restore agent identity blueprints; potential impact on identity management but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentityBlueprint.ReadWrite.All",
|                                             "DisplayName":  "Read and write all agent identity blueprints.",
|                                             "Description":  "Allows the app to read, update, and delete agent identity blueprints without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read, update, and delete agent identity blueprints; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentityBlueprint.UpdateAuthProperties.All",
|                                             "DisplayName":  "Update agent identity blueprint authorization and authentication properties",
|                                             "Description":  "Allows updating agent identity blueprint authorization and authentication properties without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Update authorization and authentication properties of blueprints; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentityBlueprintPrincipal.Create",
|                                             "DisplayName":  "Create agent identity blueprint service principals.",
|                                             "Description":  "Allows creating new agent identity blueprint principals with a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Create new blueprint principals; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentityBlueprintPrincipal.DeleteRestore.All",
|                                             "DisplayName":  "Delete and restore agent identity blueprints.",
|                                             "Description":  "Allows deleting or restoring agent identity blueprints with a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Delete or restore blueprint principals; potential impact on identity management but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentityBlueprintPrincipal.EnableDisable.All",
|                                             "DisplayName":  "Enable or disable agent identity blueprint principals.",
|                                             "Description":  "Allows enabling or disabling agent identity blueprint principals with a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Enable or disable blueprint principals; potential impact on identity management but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentityBlueprintPrincipal.ReadWrite.All",
|                                             "DisplayName":  "Read and write all agent identity blueprint principals.",
|                                             "Description":  "Allows the app to read, update, and delete agent identity blueprint principals without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read, update, and delete blueprint principals; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdUser.ReadWrite.All",
|                                             "DisplayName":  "Read and write all agent ID users\u0027 full profiles",
|                                             "Description":  "Allows the app to read and update agent ID user profiles and read basic company properties without a signed in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read and update agent ID user profiles; no direct identity plane control but potential for data manipulation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdUser.ReadWrite.IdentityParentedBy",
|                                             "DisplayName":  "Read and write all agent ID users\u0027 full profiles",
|                                             "Description":  "Allows the app to read and write the full set of profile properties, reports, and managers of agent ID users in your organization, and read basic company properties, on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read and write full profile properties of agent ID users; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentInstance.ReadWrite.All",
|                                             "DisplayName":  "Read and write all agent instances in Agent Registry",
|                                             "Description":  "Allows the app to create, read, update, and delete all agent instances in your organization\u0027s Agent Registry without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Create, read, update, and delete agent instances; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentInstance.ReadWrite.ManagedBy",
|                                             "DisplayName":  "Read and write managed-by agent instances in Agent Registry",
|                                             "Description":  "Allows the app to create, read, update, and delete agent instances that designate the calling app as their manager in your organization\u0027s Agent Registry without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Manage agent instances designated to calling app; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentRegistration.ReadWrite.All",
|                                             "DisplayName":  "Read and write all agent registrations",
|                                             "Description":  "Allows the app to read and write agent registration information without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read and write agent registration information; potential for privilege escalation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Agreement.ReadWrite.All",
|                                             "DisplayName":  "Read and write all terms of use agreements",
|                                             "Description":  "Allows the app to read and write terms of use agreements on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read and write terms of use agreements; no direct identity plane control but can modify governance documents."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BitlockerKey.Read.All",
|                                             "DisplayName":  "Read all BitLocker keys",
|                                             "Description":  "Allows an app to read BitLocker keys for all devices, without a signed-in user. Allows read of the recovery key.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to BitLocker recovery keys enables significant data exposure but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CallTranscripts.Read.All",
|                                             "DisplayName":  "Read all call transcripts",
|                                             "Description":  "Allows the app to read call transcripts for all calls without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to call transcripts across tenant enables data exfiltration but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Chat.Read.All",
|                                             "DisplayName":  "Read all chat messages",
|                                             "Description":  "Allows the app to read all 1-to-1 or group chat messages in Microsoft Teams.",
|                                             "Tier":  2,
|                                             "Reason":  "Read all chat messages without signed-in user; enables mass data exfiltration but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Chat.Read.WhereInstalled",
|                                             "DisplayName":  "Read all chat messages for chats where the associated Teams application is installed.",
|                                             "Description":  "Allows the app to read all one-to-one or group chat messages in Microsoft Teams for chats where the associated Teams application is installed, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read chat messages where app installed without signed-in user; data exfiltration risk only."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChatMessage.Read.All",
|                                             "DisplayName":  "Read all chat messages",
|                                             "Description":  "Allows the app to read all one-to-one and group chats messages in Microsoft Teams, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read all chat messages without signed-in user; enables mass data exfiltration but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Device.ReadWrite.All",
|                                             "DisplayName":  "Read and write devices",
|                                             "Description":  "Allows the app to read and write all device properties without a signed in user.  Does not allow device creation, device deletion or update of device alternative security identifiers.",
|                                             "Tier":  2,
|                                             "Reason":  "Can modify all device properties without user context; may enable indirect privilege escalation but no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceLocalCredential.Read.All",
|                                             "DisplayName":  "Read device local credential passwords",
|                                             "Description":  "Allows the app to read device local credential properties including passwords, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read device local credentials including passwords; enables credential theft but no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceManagementApps.ReadWrite.All",
|                                             "DisplayName":  "Read and write Microsoft Intune apps",
|                                             "Description":  "Allows the app to read and write the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to Intune app configurations may enable policy manipulation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DeviceManagementCloudCA.ReadWrite.All",
|                                             "DisplayName":  "Read and write Microsoft Cloud PKI objects",
|                                             "Description":  "Allows the app to read and write certification authority information on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to certification authority info could impact device trust but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceManagementConfiguration.ReadWrite.All",
|                                             "DisplayName":  "Read and write Microsoft Intune device configuration and policies",
|                                             "Description":  "Allows the app to read and write properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to Intune device configuration and compliance policies; potential policy manipulation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DeviceManagementManagedDevices.PrivilegedOperations.All",
|                                             "DisplayName":  "Perform user-impacting remote actions on Microsoft Intune devices",
|                                             "Description":  "Allows the app to perform remote high impact actions such as wiping the device or resetting the passcode on devices managed by Microsoft Intune.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows remote wipe and passcode reset on managed devices; impactful but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceManagementManagedDevices.ReadWrite.All",
|                                             "DisplayName":  "Read and write Microsoft Intune devices",
|                                             "Description":  "Allows the app to read and write the properties of devices managed by Microsoft Intune, without a signed-in user. Does not allow high impact operations such as remote wipe and password reset on the device’s owner",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to managed device properties without high impact operations; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DeviceManagementScripts.ReadWrite.All",
|                                             "DisplayName":  "Read and write Microsoft Intune Scripts",
|                                             "Description":  "Allows the app to read and write Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts on behalf of the signed in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to device management scripts could enable policy manipulation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceTemplate.Create",
|                                             "DisplayName":  "Create device template",
|                                             "Description":  "Allows the app to create device templates. The app is marked as owner of the created device template. As a member of owners, the app will be allowed to manage devices created from the template.",
|                                             "Tier":  2,
|                                             "Reason":  "Ability to create device templates and manage devices from them; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DeviceTemplate.ReadWrite.All",
|                                             "DisplayName":  "Read and write all device templates",
|                                             "Description":  "Allows the app to create, read, update and delete the device template, on behalf of the signed in user. It also allows the app to add or remove owners on any device template.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to device templates including owner management; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DevX.ReadWrite.All",
|                                             "DisplayName":  "Create and Manage Developer Experience functionality",
|                                             "Description":  "Allows the app to make API calls to register and manage 3rd party Service Fabric workloads, on your behalf.",
|                                             "Tier":  2,
|                                             "Reason":  "Manage 3rd party Service Fabric workloads; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Directory.ReadWrite.All",
|                                             "DisplayName":  "Read and write directory data",
|                                             "Description":  "Allows the app to read and write data in your organization\u0027s directory, such as users, and groups.  It does not allow the app to delete users or groups, or reset user passwords.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to directory data excluding user deletion or password reset; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DirectoryRecommendations.ReadWrite.All",
|                                             "DisplayName":  "Read and update Azure AD recommendations",
|                                             "Description":  "Allows the app to read and update Azure AD recommendations, on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to Azure AD recommendations; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DynamicRiskPreventionTag.Tenant.Write",
|                                             "DisplayName":  "DynamicRiskPreventionTag.Tenant.Write",
|                                             "Description":  "DynamicRiskPreventionTag.Tenant.Write",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to risk prevention tags; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "eDiscovery.ReadWrite.All",
|                                             "DisplayName":  "Read and write all eDiscovery objects",
|                                             "Description":  "Allows the app to read and write eDiscovery objects such as cases, custodians, review sets and other related objects without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to eDiscovery objects; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduAdministration.ReadWrite",
|                                             "DisplayName":  "Manage education app settings",
|                                             "Description":  "Manage the state and settings of all Microsoft education apps on behalf of the user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to education app state and settings; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduAdministration.ReadWrite.All",
|                                             "DisplayName":  "Manage education app settings",
|                                             "Description":  "Manage the state and settings of all Microsoft education apps.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to all education app state and settings; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduAssignments.ReadWrite",
|                                             "DisplayName":  "Read and write users\u0027 class assignments and their grades",
|                                             "Description":  "Allows the app to read and write assignments and their grades on behalf of the user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to assignments and grades; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduAssignments.ReadWrite.All",
|                                             "DisplayName":  "Create, read, update and delete all class assignments with grades",
|                                             "Description":  "Allows the app to create, read, update and delete all class assignments with grades for all users without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to all class assignments and grades; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduAssignments.ReadWriteBasic",
|                                             "DisplayName":  "Read and write users\u0027 class assignments without grades",
|                                             "Description":  "Allows the app to read and write assignments without grades on behalf of the user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to assignments without grades; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduAssignments.ReadWriteBasic.All",
|                                             "DisplayName":  "Create, read, update and delete all class assignments without grades",
|                                             "Description":  "Allows the app to create, read, update and delete all class assignments without grades for all users without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to all class assignments without grades; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduCurricula.ReadWrite",
|                                             "DisplayName":  "Read and write the user\u0027s class modules and resources",
|                                             "Description":  "Allows the app to read and write user\u0027s modules and resources on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to user modules and resources; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduCurricula.ReadWrite.All",
|                                             "DisplayName":  "Read and write all class modules and resources",
|                                             "Description":  "Allows the app to read and write all modules and resources, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to all modules and resources; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "full_access_as_app",
|                                             "DisplayName":  "Use Exchange Web Services with full access to all mailboxes",
|                                             "Description":  "Allows the app to have full access via Exchange Web Services to all mailboxes without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Full mailbox access via Exchange Web Services without signed-in user; enables mass data exfiltration but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IdentityProvider.Read.All",
|                                             "DisplayName":  "Read identity providers",
|                                             "Description":  "Allows the app to read your organization’s identity (authentication) providers’ properties on behalf of the user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to identity providers reveals authentication configuration but no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IMAP.AccessAsApp",
|                                             "DisplayName":  "IMAP.AccessAsApp",
|                                             "Description":  "Allow application to access user’s mailbox via IMAP protocol",
|                                             "Tier":  2,
|                                             "Reason":  "Full mailbox access via IMAP enables data exfiltration but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Mail.Read",
|                                             "DisplayName":  "Read mail in all mailboxes",
|                                             "Description":  "Allows the app to read mail in all mailboxes without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to all mailboxes without a signed-in user enables mass data exfiltration but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.Read.All",
|                                             "DisplayName":  "Read user and shared mail ",
|                                             "Description":  "Allows the app to read mail a user can access, including their own and shared mail.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows reading mail across users for data exfiltration but no direct identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.Read.Shared",
|                                             "DisplayName":  "Read user and shared mail",
|                                             "Description":  "Allows the app to read mail a user can access, including their own and shared mail.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows reading shared mail for data exfiltration but no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Mail.ReadBasic.All",
|                                             "DisplayName":  "Read basic mail in all mailboxes",
|                                             "Description":  "Allows the app to read basic mail properties in all mailboxes without a signed-in user. Includes all properties except body, previewBody, attachments and any extended properties.",
|                                             "Tier":  2,
|                                             "Reason":  "Read basic mail properties across all mailboxes for data exfiltration but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Mail.ReadWrite",
|                                             "DisplayName":  "Read and write mail in all mailboxes",
|                                             "Description":  "Allows the app to create, read, update, and delete mail in all mailboxes without a signed-in user. Does not include permission to send mail.",
|                                             "Tier":  2,
|                                             "Reason":  "Create, read, update, delete mail in all mailboxes for data manipulation but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.ReadWrite.All",
|                                             "DisplayName":  "Read and write user and shared mail ",
|                                             "Description":  "Allows the app to create, read, update, and delete mail a user has permission to access, including their own and shared mail. Does not include permission to send mail.",
|                                             "Tier":  2,
|                                             "Reason":  "Delegated mail write access across user mailboxes for data manipulation but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.ReadWrite.Shared",
|                                             "DisplayName":  "Read and write user and shared mail",
|                                             "Description":  "Allows the app to create, read, update, and delete mail a user has permission to access, including their own and shared mail. Does not include permission to send mail.",
|                                             "Tier":  2,
|                                             "Reason":  "Delegated mail write access on shared mailboxes for data manipulation but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail-Advanced.ReadWrite",
|                                             "DisplayName":  "Read and write the user\u0027s mail, including modifying existing non-draft mails",
|                                             "Description":  "Allows the app to create, read, update, and delete email, including contents of non-draft emails in user mailboxes, on behalf of the signed-in user. Does not include permission to send mail.",
|                                             "Tier":  2,
|                                             "Reason":  "Delegated full mail read/write excluding send; data plane impact only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Mail-Advanced.ReadWrite.All",
|                                             "DisplayName":  "Read and write mail in all mailboxes, including modifying existing non-draft mails",
|                                             "Description":  "Allows the app to create, read, update, and delete all email, including contents of non-draft emails in user mailboxes, without a signed-in user. Does not include permission to send mail.",
|                                             "Tier":  2,
|                                             "Reason":  "Application full mail read/write excluding send; enables data manipulation but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail-Advanced.ReadWrite.Shared",
|                                             "DisplayName":  "Read and write all mail the user can access, including modifying existing non-draft mails",
|                                             "Description":  "Allows the app to create, read, update, and delete mail including contents of non-draft emails for all mails a user has permission to access, on behalf of the signed-in user. This includes their own and shared mail. Does not include permission to send mail.",
|                                             "Tier":  2,
|                                             "Reason":  "Delegated full mail read/write on accessible mailboxes; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Mailbox.Migration",
|                                             "DisplayName":  "Move mailboxes between organizations",
|                                             "Description":  "Application permission grants permission to move mailboxes between Office365 organizations",
|                                             "Tier":  2,
|                                             "Reason":  "Allows moving mailboxes between tenants; significant data impact but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailboxFolder.Read.All",
|                                             "DisplayName":  "Read all the users\u0027 mailbox folders",
|                                             "Description":  "Allows the app to read all the users\u0027 mailbox folders, without signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read mailbox folders across users for data exfiltration; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailboxFolder.ReadWrite.All",
|                                             "DisplayName":  "Read and write all the users\u0027 mailbox folders",
|                                             "Description":  "Allows the app to read and write all the users\u0027 mailbox folders, without signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write mailbox folders across users; data plane impact only."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailboxItem.Export.All",
|                                             "DisplayName":  "Export all the users\u0027 mailbox items",
|                                             "Description":  "Allows the app to export all the users\u0027 mailbox items, without signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Export mailbox items across users; data exfiltration risk but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailboxItem.ImportExport.All",
|                                             "DisplayName":  "Allows the app to perform backup and restore for all mailbox items",
|                                             "Description":  "Allows the app to backup, restore, and modify all mailbox items without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Backup/restore mailbox items across users; data plane impact only."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailboxItem.Read.All",
|                                             "DisplayName":  "Read all the users\u0027 mailbox items",
|                                             "Description":  "Allows the app to read all the users\u0027 mailbox items, without signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read mailbox items across users; data exfiltration risk but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OnPremDirectorySynchronization.Read.All",
|                                             "DisplayName":  "Read all on-premises directory synchronization information",
|                                             "Description":  "Allows the app to read all on-premises directory synchronization information for the organization, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to on-prem directory sync info; may aid reconnaissance but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedAccess.ReadWrite.AzureResources",
|                                             "DisplayName":  "Read and write privileged access to Azure resources",
|                                             "Description":  "Allows the app to request and manage time-based assignment and just-in-time elevation of Azure resources (like your subscriptions, resource groups, storage, compute) in your organization, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Manage time-based elevation of Azure resources without user; no direct identity plane control but high impact on resources."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagement.ReadWrite.CloudPC",
|                                             "DisplayName":  "Read and write Cloud PC RBAC settings",
|                                             "Description":  "Allows the app to read and manage the Cloud PC role-based access control (RBAC) settings, on behalf of the signed-in user. This includes reading and managing Cloud PC role definitions and role assignments.",
|                                             "Tier":  2,
|                                             "Reason":  "Manage Cloud PC RBAC roles and assignments but limited to Cloud PC scope; no direct tenant-wide identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SharePointCrossTenantMigration.Manage.All",
|                                             "DisplayName":  "Read, write and manage Cross-Tenant migration settings and tasks",
|                                             "Description":  "Read, write and manage Cross-Tenant migration settings and tasks, without a signed-in user",
|                                             "Tier":  2,
|                                             "Reason":  "Manage cross-tenant migration settings without signed-in user; significant data impact but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Sites.Archive.All",
|                                             "DisplayName":  "Archive/reactivate Site Collections without a signed in user.",
|                                             "Description":  "Allow the application to archive/reactivate site collections without a signed in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Archive/reactivate site collections without signed-in user; significant impact on workloads but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Sites.Create.All",
|                                             "DisplayName":  "Create Site Collections, on behalf of the signed-in user",
|                                             "Description":  "Allow the application to create site collections on behalf of the signed in user. Upon creation the application will be granted Sites.Selected(delegated) + FullControl to the newly created site.",
|                                             "Tier":  2,
|                                             "Reason":  "Create site collections on behalf of user with delegated full control on new site; no direct tenant-wide identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Sites.FullControl.All",
|                                             "DisplayName":  "Have full control of all site collections",
|                                             "Description":  "Allows the app to have full control of all site collections without a signed in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Full control of all site collections without signed-in user; significant data and workload impact but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Sites.Manage.All",
|                                             "DisplayName":  "Create, edit, and delete items and lists in all site collections",
|                                             "Description":  "Allows the app to create or delete document libraries and lists in all site collections without a signed in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Create or delete document libraries and lists in all site collections without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Sites.ReadWrite.All",
|                                             "DisplayName":  "Read and write items in all site collections",
|                                             "Description":  "Allows the app to create, read, update, and delete documents and list items in all site collections without a signed in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Create, read, update, delete documents and list items in all site collections without signed-in user; data and workload impact only."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SitesMetadataAdmin.ReadWrite.All",
|                                             "DisplayName":  "Read and write access to site collection metadata on the SharePoint admin site",
|                                             "Description":  "Allows the app to read and write site collection metadata without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read and write site collection metadata without signed-in user; potential workload impact but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Synchronization.Read.All",
|                                             "DisplayName":  "Read all Azure AD synchronization data.",
|                                             "Description":  "Allows the application to read Azure AD synchronization information, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to Azure AD sync info can reveal configuration but does not allow direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SynchronizationData-User.Upload",
|                                             "DisplayName":  "Upload user data to the identity synchronization service",
|                                             "Description":  "Allows the app to upload bulk user data to the identity synchronization service, on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Uploading bulk user data to sync service can impact data but does not directly enable identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SynchronizationData-User.Upload.OwnedBy",
|                                             "DisplayName":  "Upload user data to the identity sync service for apps that this application creates or owns",
|                                             "Description":  "Allows the application to upload bulk user data to the identity synchronization service for apps that this application creates or owns, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Uploading bulk user data for owned apps is scoped and does not enable direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamMember.ReadWrite.All",
|                                             "DisplayName":  "Add and remove members from all teams",
|                                             "Description":  "Add and remove members from all teams, without a signed-in user. Also allows changing a team member\u0027s role, for example from owner to non-owner.",
|                                             "Tier":  2,
|                                             "Reason":  "Modifying team membership and roles can impact collaboration but does not enable direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentForChat.All",
|                                             "DisplayName":  "Manage installation and permission grants of Teams apps for all chats",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any chat, without a signed-in user. Gives the ability to manage permission grants for accessing those specific chats\u0027 data.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in any chat, enabling data manipulation but no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentForTeam",
|                                             "DisplayName":  "Manage installed Teams apps in teams",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Gives the ability to manage permission grants for accessing those specific teams\u0027 data.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in accessible teams, enabling data manipulation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentForTeam.All",
|                                             "DisplayName":  "Manage installation and permission grants of Teams apps for all teams",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any team, without a signed-in user. Gives the ability to manage permission grants for accessing those specific teams\u0027 data.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in any team, enabling data manipulation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentForUser",
|                                             "DisplayName":  "Manage installation and permission grants of Teams apps in users\u0027 personal scope",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in user accounts, on behalf of the signed-in user. Gives the ability to manage permission grants for accessing those specific users\u0027 data.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in user accounts on behalf of signed-in user, enabling data manipulation but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentForUser.All",
|                                             "DisplayName":  "Manage installation and permission grants of Teams apps in a user account",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any user account, without a signed-in user. Gives the ability to manage permission grants for accessing those specific users\u0027 data.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in any user account, enabling data manipulation but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteForChat",
|                                             "DisplayName":  "Manage installed Teams apps in chats",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in chats the signed-in user can access. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in chats accessible to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteForChat.All",
|                                             "DisplayName":  "Manage Teams apps for all chats",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any chat, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in any chat without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteForTeam",
|                                             "DisplayName":  "Manage installed Teams apps in teams",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in teams accessible to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteForTeam.All",
|                                             "DisplayName":  "Manage Teams apps for all teams",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any team, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps in any team without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteForUser",
|                                             "DisplayName":  "Manage user\u0027s installed Teams apps",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps installed for the signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps installed for signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteForUser.All",
|                                             "DisplayName":  "Manage Teams apps for all users",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps for any user, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams apps for any user without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelectedForChat",
|                                             "DisplayName":  "Manage selected Teams apps installed in chats",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in chats the signed-in user can access. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing selected Teams apps in chats accessible to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelectedForChat.All",
|                                             "DisplayName":  "Manage selected installed Teams apps in all chats",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any chat, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing selected Teams apps in any chat without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelectedForTeam",
|                                             "DisplayName":  "Manage selected Teams apps installed in teams",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in teams the signed-in user can access. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing selected Teams apps in teams accessible to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelectedForTeam.All",
|                                             "DisplayName":  "Manage selected installed Teams apps in all teams",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any team, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing selected Teams apps in any team without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelectedForUser",
|                                             "DisplayName":  "Manage selected Teams apps installed for a user",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps installed for the signed in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing selected Teams apps for signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelectedForUser.All",
|                                             "DisplayName":  "Manage selected Teams apps installed for all users",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps for any user, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing selected Teams apps for any user without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamSettings.Read.All",
|                                             "DisplayName":  "Read all teams\u0027 settings",
|                                             "Description":  "Read all team\u0027s settings, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows reading all team settings without signed-in user; no identity plane control but potential data exposure."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and change all teams\u0027 settings",
|                                             "Description":  "Read and change all teams\u0027 settings, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows reading and changing all team settings without signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsPolicyUserAssign.ReadWrite.All",
|                                             "DisplayName":  "Read and Write Teams policy user assignment and unassigment for all policy types.",
|                                             "Description":  "Allow the app to read or write/update the policy assignment and unassigment for Teams users for all policy type categories.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows managing Teams user policy assignments; no direct identity plane control but can affect user experience."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsResourceAccount.Read.All",
|                                             "DisplayName":  "Read Teams resource accounts",
|                                             "Description":  "Allows the app to read your tenant\u0027s resource accounts without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows reading tenant resource accounts without signed-in user; data exposure only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Teamwork.Migrate.All",
|                                             "DisplayName":  "Create chat and channel messages with anyone\u0027s identity and with any timestamp",
|                                             "Description":  "Allows the app to create chat and channel messages, without a signed in user. The app specifies which user appears as the sender, and can backdate the message to appear as if it was sent long ago. The messages can be sent to any chat or channel in the organization.",
|                                             "Tier":  2,
|                                             "Reason":  "Can create chat and channel messages as any user, enabling impersonation and social engineering but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkAppSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and write Teams app settings",
|                                             "Description":  "Allows the app to read and write the Teams app settings without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to Teams app settings without signed-in user; potential to manipulate app behavior but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkDevice.ReadWrite.All",
|                                             "DisplayName":  "Read and write Teams devices",
|                                             "Description":  "Allow the app to read and write the management data for Teams devices, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to Teams device management data; may enable device manipulation but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkSection.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 sections",
|                                             "Description":  "Allows the app to read and write all users\u0027 sections (folders) for organizing chats and channels in Teams, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to all users\u0027 Teams sections without signed-in user; potential for broad content manipulation but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkTag.ReadWrite.All",
|                                             "DisplayName":  "Read and write tags in Teams",
|                                             "Description":  "Allows the app to read and write tags in Teams without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to Teams tags without signed-in user; potential for broad content manipulation but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TrustFrameworkKeySet.ReadWrite.All",
|                                             "DisplayName":  "Read and write trust framework key sets",
|                                             "Description":  "Allows the app to read and write trust framework key set properties on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Write access to trust framework key sets on behalf of signed-in user; potential to modify authentication policies but requires user context and no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User.DeleteRestore.All",
|                                             "DisplayName":  "Delete and restore users",
|                                             "Description":  "Allows the app to delete and restore all users, on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Can delete and restore all users on behalf of signed-in user; impactful but no direct role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User.EnableDisableAccount.All",
|                                             "DisplayName":  "Enable and disable user accounts",
|                                             "Description":  "Allows the app to enable and disable users\u0027 accounts, on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Can enable/disable user accounts on behalf of signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User.Export.All",
|                                             "DisplayName":  "Export user\u0027s data",
|                                             "Description":  "Allows the app to export data (e.g. customer content or system-generated logs), associated with any user in your company, when the app is used by a privileged user (e.g. a Company Administrator).",
|                                             "Tier":  2,
|                                             "Reason":  "Allows data export for any user by privileged user; data exfiltration risk but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User.ManageIdentities.All",
|                                             "DisplayName":  "Manage  user identities",
|                                             "Description":  "Allows the app to read, update and delete identities that are associated with a user\u0027s account that the signed-in user has access to. This controls the identities users can sign-in with.",
|                                             "Tier":  2,
|                                             "Reason":  "Can manage user-associated identities on behalf of signed-in user; no direct role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User.ReadWrite.All",
|                                             "DisplayName":  "Read and write user profiles",
|                                             "Description":  "Allows the app to read and update user profiles and to read basic site info on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read and update user profiles on behalf of signed-in user; no direct role assignment but broad write access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User.ReadWrite.CrossCloud",
|                                             "DisplayName":  "Read and write profiles of users that originate from an external cloud.",
|                                             "Description":  "Allows the app to read and update external cloud user profiles without a signed in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Read and update external cloud user profiles without signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User.RevokeSessions.All",
|                                             "DisplayName":  "Revoke all sign in sessions for a user",
|                                             "Description":  "Allow the app to revoke all sign in sessions for a user, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Can revoke all sign-in sessions for users; impacts sessions but no role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthenticationMethod.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 authentication methods.",
|                                             "Description":  " Allows the app to read and write authentication methods of all users in your organization that the signed-in user has access to.                       Authentication methods include things like a user’s phone numbers and Authenticator app settings. This                      does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write authentication methods of all users accessible to signed-in user; potential to modify MFA but requires user context and no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-Email.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 email methods",
|                                             "Description":  "Allows the application to read and write email methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write email authentication methods of all users; potential to modify MFA but no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-External.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 external methods.",
|                                             "Description":  "Allows the app to read and write external authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write external authentication methods of all users accessible to signed-in user; potential MFA modification but no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-HardwareOATH.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 HardwareOATH authentication methods",
|                                             "Description":  "Allows the application to read and write HardwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write HardwareOATH methods of all users; potential MFA modification but no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-MicrosoftAuthApp.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 Microsoft Authentication methods.",
|                                             "Description":  "Allows the app to read and write Microsoft Authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write Microsoft Authenticator methods of all users accessible to signed-in user; potential MFA modification but no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Passkey.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 passkey methods.",
|                                             "Description":  "Allows the app to read and write passkey authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write passkey authentication methods of all users accessible to signed-in user; potential MFA modification but no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Password.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 password methods.",
|                                             "Description":  "Allows the app to read and write password authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write password authentication methods of all users accessible to signed-in user; potential MFA modification but no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-Phone.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 phone methods",
|                                             "Description":  "Allows the application to read and write phone methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows read/write of phone auth methods for all users; no secret info or direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-PlatformCred.Read.All",
|                                             "DisplayName":  "Read all users\u0027 platform credentials methods",
|                                             "Description":  "Allows the app to read platform credentials methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to platform credentials of all users accessible to signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-PlatformCred.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 platform credentials methods.",
|                                             "Description":  "Allows the app to read and write platform credentials methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to platform credentials of all users accessible to signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-QR.Read.All",
|                                             "DisplayName":  "Read all users\u0027 QR methods",
|                                             "Description":  "Allows the app to read QR authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to QR auth methods of all users; no secret info or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-QR.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 QR methods.",
|                                             "Description":  "Allows the app to read and write QR authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to QR auth methods of all users accessible to signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-SoftwareOATH.Read.All",
|                                             "DisplayName":  "Read all users\u0027 SoftwareOATH methods",
|                                             "Description":  "Allows the app to read SoftwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to SoftwareOATH methods of all users; no secret info or direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-SoftwareOATH.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 SoftwareOATH methods",
|                                             "Description":  "Allows the application to read and write SoftwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to SoftwareOATH methods of all users; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-TAP.Read.All",
|                                             "DisplayName":  "Read all users\u0027 Temporary Access Pass methods",
|                                             "Description":  "Allows the app to read Temporary Access Pass authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to Temporary Access Pass methods of all users; no secret info or direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-TAP.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 Temporary Access Pass methods.",
|                                             "Description":  "Allows the app to read and write Temporary Access Pass authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to Temporary Access Pass methods of all users accessible to signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-WindowsHello.Read.All",
|                                             "DisplayName":  "Read all users\u0027 Windows Hello methods",
|                                             "Description":  "Allows the app to read Windows Hello authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read access to Windows Hello methods of all users; no secret info or direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-WindowsHello.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 Windows Hello authentication methods",
|                                             "Description":  "Allows the application to read and write Windows Hello authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  2,
|                                             "Reason":  "Read/write access to Windows Hello methods of all users; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User-ConvertToInternal.ReadWrite.All",
|                                             "DisplayName":  "Convert an external user to internal member user",
|                                             "Description":  "Allow the app to convert an external user to an internal member user, without a signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Allows converting external users to internal members; impacts user types but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User-OnPremisesSyncBehavior.ReadWrite.All",
|                                             "DisplayName":  "Read and update the on-premises sync behavior of users",
|                                             "Description":  "Allows the app to read and update the on-premises sync behavior of users on behalf of the signed-in user.",
|                                             "Tier":  2,
|                                             "Reason":  "Modify on-premises sync behavior for users; potential impact on sync but no direct identity plane control."
|                                         }
|                                     ],
|    "EntraID_APIPermissions_Tier3":  [
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AccessReview.Read.All",
|                                             "DisplayName":  "Read all access reviews that user can access",
|                                             "Description":  "Allows the app to read access reviews, reviewers, decisions and settings that the signed-in user has access to in the organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to access reviews limited to signed-in user\u0027s scope; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Acronym.Read.All",
|                                             "DisplayName":  "Read all acronyms",
|                                             "Description":  "Allows an app to read all acronyms without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to acronyms; no identity or security impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "activitydata.tenant.read",
|                                             "DisplayName":  "activitydata.tenant.read",
|                                             "Description":  "activitydata.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to tenant activity data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Management APIs",
|                                             "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ActivityFeed.Read",
|                                             "DisplayName":  "Read activity data for your organization",
|                                             "Description":  "Allows the application to read activity data for your organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to organizational activity data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Management APIs",
|                                             "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ActivityFeed.ReadDlp",
|                                             "DisplayName":  "Read DLP policy events including detected sensitive data",
|                                             "Description":  "Allows the application to read DLP policy events, including detected sensitive data, for your organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to DLP events; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AdministrativeUnit.Read.All",
|                                             "DisplayName":  "Read administrative units",
|                                             "Description":  "Allows the app to read administrative units and administrative unit membership on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to administrative units scoped to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentCard.ReadWrite.ManagedBy",
|                                             "DisplayName":  "Read and write managed-by agent cards in Agent Registry",
|                                             "Description":  "Allows the app to read and update agent cards that designate the calling app as their manager and manage their skills in your organization\u0027s Agent Registry without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage agent cards and skills; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentCardManifest.Read.All",
|                                             "DisplayName":  "Read all agent card manifests in Agent Registry",
|                                             "Description":  "Allows the app to read all agent card manifests in your organization\u0027s Agent Registry without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to agent card manifests; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentCardManifest.ReadWrite.All",
|                                             "DisplayName":  "Read and write agent card manifests in Agent Registry",
|                                             "Description":  "Allows the app to read and write agent card manifests in your organization\u0027s Agent Registry on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write agent card manifests on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentCardManifest.ReadWrite.ManagedBy",
|                                             "DisplayName":  "Read and write managed-by agent card manifests in Agent Registry",
|                                             "Description":  "Allows the app to read and write agent card manifests that name it as manager in your organization\u0027s Agent Registry without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage agent card manifests as manager; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentCollection.Read.All",
|                                             "DisplayName":  "Read all collections in Agent Registry",
|                                             "Description":  "Allows the app to read all collections and their membership in your organization\u0027s Agent Registry without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to collections and memberships; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentCollection.Read.Global",
|                                             "DisplayName":  "Read global collection in Agent Registry",
|                                             "Description":  "Allows the app to read global collection and its membership in your organization\u0027s Agent Registry on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to global collections; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentCollection.Read.Quarantined",
|                                             "DisplayName":  "Read quarantined collection in Agent Registry",
|                                             "Description":  "Allows the app to read quarantined collection and its membership in your organization\u0027s Agent Registry on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to quarantined collections; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentCollection.ReadWrite.All",
|                                             "DisplayName":  "Read and write all collections in Agent Registry",
|                                             "Description":  "Allows the app to create, read, update, and delete all collections and manage their membership in your organization\u0027s Agent Registry without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage all collections and memberships; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentCollection.ReadWrite.Global",
|                                             "DisplayName":  "Read and write global collection in Agent Registry",
|                                             "Description":  "Allows the app to read and update global collection and manage its membership in your organization\u0027s Agent Registry on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage global collections on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentCollection.ReadWrite.ManagedBy",
|                                             "DisplayName":  "Read and write managed-by collections in Agent Registry",
|                                             "Description":  "Allows the app to create, read, update, and delete collections that designate the calling app as their manager and manage their membership in your organization\u0027s Agent Registry without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage collections designated to calling app; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentCollection.ReadWrite.Quarantined",
|                                             "DisplayName":  "Read and write quarantined collection in Agent Registry",
|                                             "Description":  "Allows the app to read and update quarantined collection and manage its membership in your organization\u0027s Agent Registry on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage quarantined collections; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentity.Read.All",
|                                             "DisplayName":  "Read all agent identities",
|                                             "Description":  "Allows the app to read all agent identities without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to all agent identities; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentityBlueprint.Read.All",
|                                             "DisplayName":  "Read all agent identity blueprints",
|                                             "Description":  "Allows the client to read all agent identity blueprints.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to agent identity blueprints; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentIdentityBlueprint.UpdateBranding.All",
|                                             "DisplayName":  "Update agent identity blueprint branding",
|                                             "Description":  "Allows updating agent identity blueprint branding on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Update branding on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentIdentityBlueprintPrincipal.Read.All",
|                                             "DisplayName":  "Read agent identity blueprint principals.",
|                                             "Description":  "Allows reading agent identity blueprint principals without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to blueprint principals; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgentInstance.Read.All",
|                                             "DisplayName":  "Read agent instances in Agent Registry",
|                                             "Description":  "Allows the app to read agent instances and their related collections in your organization\u0027s Agent Registry on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to agent instances; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgentRegistration.Read.All",
|                                             "DisplayName":  "Read all agent registrations",
|                                             "Description":  "Allows the app to read agent registration information without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to agent registration information; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AggConsumptionBillingReport.Read.All",
|                                             "DisplayName":  "AggConsumptionBillingReport.Read.All",
|                                             "Description":  "AggConsumptionBillingReport.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to billing reports; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Agreement.Read.All",
|                                             "DisplayName":  "Read all terms of use agreements",
|                                             "Description":  "Allows the app to read terms of use agreements on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to terms of use agreements; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AgreementAcceptance.Read",
|                                             "DisplayName":  "Read user terms of use acceptance statuses",
|                                             "Description":  "Allows the app to read terms of use acceptance statuses on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to terms of use acceptance statuses; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AgreementAcceptance.Read.All",
|                                             "DisplayName":  "Read all terms of use acceptance statuses",
|                                             "Description":  "Allows the app to read terms of use acceptance statuses, without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to terms of use acceptance statuses without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AiEnterpriseInteraction.Read",
|                                             "DisplayName":  "Read user AI enterprise interactions.",
|                                             "Description":  "Allows the app to read user AI enterprise interactions, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to user AI interactions on behalf of signed-in user; no identity plane control or privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AiEnterpriseInteraction.Read.All",
|                                             "DisplayName":  "Read all AI enterprise interactions.",
|                                             "Description":  "Allows the app to read all AI enterprise interactions.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all AI enterprise interactions; data plane only with no path to identity or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AirAdminAction.tenant.read",
|                                             "DisplayName":  "AirAdminAction.tenant.read",
|                                             "Description":  "This allows the app to read AirAdminAction alerts",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to AirAdminAction alerts; no ability to modify identity or role assignments."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AirAdminAction.tenant.write",
|                                             "DisplayName":  "AirAdminAction.tenant.write",
|                                             "Description":  "This allows apps to write the AirAdminAction alerts",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to AirAdminAction alerts; does not enable identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "alert.read",
|                                             "DisplayName":  "alert.read",
|                                             "Description":  "This allows user to read Office 365 alerts.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to Office 365 alerts; no path to identity plane or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Alert.Read.All",
|                                             "DisplayName":  "Alert.Read.All",
|                                             "Description":  "Alert.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to all Office 365 alerts; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "alert.tenant.read",
|                                             "DisplayName":  "alert.tenant.read",
|                                             "Description":  "This allows to read tenant Office 365 alerts.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to tenant Office 365 alerts; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "alert.tenant.write",
|                                             "DisplayName":  "alert.tenant.write",
|                                             "Description":  "This allows to change any Office 365 alerts belong to the tenant.",
|                                             "Tier":  3,
|                                             "Reason":  "Application write access to tenant Office 365 alerts; no direct or near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "alert.write",
|                                             "DisplayName":  "alert.write",
|                                             "Description":  "This allows user to change Office 365 alerts.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated write access to Office 365 alerts; no path to role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AllSites.FullControl",
|                                             "DisplayName":  "Have full control of all site collections",
|                                             "Description":  "Allows the app to have full control of all site collections on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Full control of SharePoint sites on behalf of signed-in user; no identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AllSites.Manage",
|                                             "DisplayName":  "Read and write items and lists in all site collections",
|                                             "Description":  "Allows the app to read, create, update, and delete document libraries and lists in all site collections on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage document libraries and lists on behalf of signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AllSites.Read",
|                                             "DisplayName":  "Read items in all site collections",
|                                             "Description":  "Allows the app to read documents and list items in all site collections on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to SharePoint documents and lists; data plane only with no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AllSites.Write",
|                                             "DisplayName":  "Read and write items in all site collections",
|                                             "Description":  "Allows the app to create, read, update, and delete documents and list items in all site collections on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to SharePoint documents and lists; no path to identity or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Analytics.Read",
|                                             "DisplayName":  "Read user activity statistics",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s activity statistics, such as how much time the user has spent on emails, in meetings, or in chat sessions.",
|                                             "Tier":  3,
|                                             "Reason":  "Read user activity statistics; no identity plane or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Skype for Business Online",
|                                             "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Anonymous",
|                                             "DisplayName":  "Guest user join services (preview)",
|                                             "Description":  "Allows the app create an on-demand Skype meeting and join guest users into Skype for Business services",
|                                             "Tier":  3,
|                                             "Reason":  "Allows creation of Skype meetings and guest joins; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "APIConnectors.Read.All",
|                                             "DisplayName":  "Read API connectors for authentication flows",
|                                             "Description":  "Allows the app to read the API connectors used in user authentication flows, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read API connectors in authentication flows on behalf of user; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "App.Read.All",
|                                             "DisplayName":  "View all Power BI apps",
|                                             "Description":  "The app can view all Power BI apps the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Power BI apps user can access; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AppCatalog.Read.All",
|                                             "DisplayName":  "Read all app catalogs",
|                                             "Description":  "Allows the app to read apps in the app catalogs without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to app catalogs without signed-in user; no write or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AppCatalog.Submit",
|                                             "DisplayName":  "Submit application packages to the catalog and cancel pending submissions",
|                                             "Description":  "Allows the app to submit application packages to the catalog and cancel submissions that are pending review on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Submit application packages on behalf of signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AppCertTrustConfiguration.Read.All",
|                                             "DisplayName":  "Read the trusted certificate authority configuration for applications",
|                                             "Description":  "Allows the app to read the trusted certificate authority configuration which can be used to restrict application certificates based on their issuing authority, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read trusted certificate authority configuration; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Application.Read.All",
|                                             "DisplayName":  "Read applications",
|                                             "Description":  "Allows the app to read applications and service principals on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read applications and service principals on behalf of user; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Application-RemoteDesktopConfig.ReadWrite.All",
|                                             "DisplayName":  "Read and write the remote desktop security configuration for all apps",
|                                             "Description":  "Allows the app to read and write the remote desktop security configuration for all apps in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write remote desktop config for apps; no direct identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ApprovalSolution.Read",
|                                             "DisplayName":  "Read approvals",
|                                             "Description":  "Allows the app to read approvals on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read approvals on behalf of signed-in user; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ApprovalSolution.Read.All",
|                                             "DisplayName":  "Read all approvals",
|                                             "Description":  "Allows the app to read all approvals and approval item subscriptions, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read all approvals without signed-in user; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ApprovalSolution.ReadWrite",
|                                             "DisplayName":  "Read, create, and respond to approvals",
|                                             "Description":  "Allows the app to provision, read, create, and respond to approvals on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Provision and respond to approvals on behalf of signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ApprovalSolution.ReadWrite.All",
|                                             "DisplayName":  "Read all approvals and manage approval subscriptions",
|                                             "Description":  "Allows the app to read all approvals and create, update, or remove approval item subscriptions, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage approvals and subscriptions without signed-in user; no direct role assignment or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ApprovalSolutionResponse.ReadWrite",
|                                             "DisplayName":  "Read and respond to approvals assigned to the current user",
|                                             "Description":  "Allows the app to read and respond to approvals on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and respond to approvals on behalf of signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AtpStandardPolicy.Tenant.Read",
|                                             "DisplayName":  "AtpStandardPolicy.Tenant.Read",
|                                             "Description":  "AtpStandardPolicy.Tenant.Read",
|                                             "Tier":  3,
|                                             "Reason":  "Read ATP standard policy; no write or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AtpStandardPolicy.Tenant.Write",
|                                             "DisplayName":  "AtpStandardPolicy.Tenant.Write",
|                                             "Description":  "AtpStandardPolicy.Tenant.Write",
|                                             "Tier":  3,
|                                             "Reason":  "Write ATP standard policy; no direct identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AttackSimulation.Read.All",
|                                             "DisplayName":  "Read attack simulation data of an organization",
|                                             "Description":  "Allows the app to read attack simulation and training data for an organization for the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read attack simulation data on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AttackSimulation.ReadWrite.All",
|                                             "DisplayName":  "Read, create, and update attack simulation data of an organization",
|                                             "Description":  "Allows the app to read, create, and update attack simulation and training data for an organization for the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read, create, update attack simulation data on behalf of signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AttackSimulationData.tenant.read",
|                                             "DisplayName":  "AttackSimulationData.tenant.read",
|                                             "Description":  "AttackSimulationData.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read attack simulation data for tenant; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuditActivity.Read",
|                                             "DisplayName":  "Read activity audit log from the audit store.",
|                                             "Description":  "Read activity audit log from the audit store.",
|                                             "Tier":  3,
|                                             "Reason":  "Read audit logs on behalf of signed-in user; no write or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AuditActivity.Write",
|                                             "DisplayName":  "Upload activity audit logs to the audit store.",
|                                             "Description":  "Allows the application to upload bulk activity audit logs to the audit store.",
|                                             "Tier":  3,
|                                             "Reason":  "Upload audit logs; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuditLog.Read.All",
|                                             "DisplayName":  "Read audit log data",
|                                             "Description":  "Allows the app to read and query your audit log activities, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and query audit logs on behalf of signed-in user; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuditLogsQuery.Read.All",
|                                             "DisplayName":  "Read audit logs data from all services",
|                                             "Description":  "Allows the app to read and query audit logs from all services, on behalf of a signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read and query audit logs from all services on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AuditLogsQuery-CRM.Read.All",
|                                             "DisplayName":  "Read audit logs data from Dynamics CRM workload",
|                                             "Description":  "Allows the app to read and query audit logs from Dynamics CRM workload, without a signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read audit logs from Dynamics CRM without signed-in user; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AuditLogsQuery-Endpoint.Read.All",
|                                             "DisplayName":  "Read audit logs data from Endpoint Data Loss Prevention workload",
|                                             "Description":  "Allows the app to read and query audit logs from Endpoint Data Loss Prevention workload, without a signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read audit logs from Endpoint DLP without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuditLogsQuery-Entra.Read.All",
|                                             "DisplayName":  "Read audit logs data from Entra (Azure AD) workload",
|                                             "Description":  "Allows the app to read and query audit logs from Entra (Azure AD) workload, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read audit logs from Entra (Azure AD) on behalf of signed-in user; read-only with no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuditLogsQuery-Exchange.Read.All",
|                                             "DisplayName":  "Read audit logs data from Exchange workload",
|                                             "Description":  "Allows the app to read and query audit logs from Exchange workload, on behalf of a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read audit logs from Exchange on behalf of signed-in user; no write or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuditLogsQuery-OneDrive.Read.All",
|                                             "DisplayName":  "Read audit logs data from OneDrive workload",
|                                             "Description":  "Allows the app to read and query audit logs from OneDrive workload, on behalf of a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read audit logs from OneDrive on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuditLogsQuery-SharePoint.Read.All",
|                                             "DisplayName":  "Read audit logs data from SharePoint workload",
|                                             "Description":  "Allows the app to read and query audit logs from SharePoint workload, on behalf of a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read audit logs from SharePoint on behalf of signed-in user; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AuditProvisioningData.Tenant.Read",
|                                             "DisplayName":  "AuditProvisioningData.Tenant.Read",
|                                             "Description":  "AuditProvisioningData.Tenant.Read",
|                                             "Tier":  3,
|                                             "Reason":  "Read provisioning data for tenant; no write or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "AuthenticationContext.Read.All",
|                                             "DisplayName":  "Read all authentication context information",
|                                             "Description":  "Allows the app to read all authentication context information in your organization on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to authentication context information; no ability to modify roles or credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "AzureActivityData.Read.All",
|                                             "DisplayName":  "AzureActivityData.Read.All",
|                                             "Description":  "AzureActivityData.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Azure activity data; no identity plane control or credential modification."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BackupRestore-Configuration.Read.All",
|                                             "DisplayName":  "Read all backup configuration policies",
|                                             "Description":  "Allows the app to read all backup configurations, and lists of Microsoft 365 service resources to be backed-up, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to backup configurations; no path to identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BackupRestore-Configuration.ReadWrite.All",
|                                             "DisplayName":  "Read and edit backup configuration policies",
|                                             "Description":  "Allows the app to read and update the backup configuration, and list of Microsoft 365 service resources to be backed-up, on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to backup configurations but no direct or near-direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BackupRestore-Control.Read.All",
|                                             "DisplayName":  "Read the status of the M365 backup service",
|                                             "Description":  "Allows the app to read the status of M365 backup service (enable/disable), without signed in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to backup service status; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BackupRestore-Control.ReadWrite.All",
|                                             "DisplayName":  "Update or read the status of the M365 backup service",
|                                             "Description":  "Allows the app to update or read the status of M365 backup service (enable/disable), on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to backup service status; no direct identity plane control or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BackupRestore-Monitor.Read.All",
|                                             "DisplayName":  "Read all monitoring, quota and billing information for the tenant",
|                                             "Description":  "Allows the app to monitor all backup and restore jobs, view quota usage and billing details, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only monitoring of backup jobs and billing; no identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BackupRestore-Restore.Read.All",
|                                             "DisplayName":  "Read all restore sessions",
|                                             "Description":  "Allows the app to read all restore sessions, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to restore sessions; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BackupRestore-Restore.ReadWrite.All",
|                                             "DisplayName":  "Read restore all sessions and start restore sessions from backups",
|                                             "Description":  "Allows the app to search all backup snapshots for Microsoft 365 resources, and restore Microsoft 365 resources from a backed-up snapshot, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to restore backups but no direct path to identity or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BackupRestore-Search.Read.All",
|                                             "DisplayName":  "Search for metadata properties in backup snapshots",
|                                             "Description":  "Allows the app to search the backup snapshots for Microsoft 365 resources, on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only search of backup snapshots; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BillingConfiguration.ReadWrite.All",
|                                             "DisplayName":  "Read and write application billing configuration",
|                                             "Description":  "Allows the app to read and write the billing configuration on all applications on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to billing configuration; no direct or near-direct path to identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BitlockerKey.ReadBasic.All",
|                                             "DisplayName":  "Read all BitLocker keys basic information",
|                                             "Description":  "Allows an app to read basic BitLocker key properties for all devices, without a signed-in user. Does not allow read of the recovery key.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to basic BitLocker key properties without recovery keys; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Bookings.Manage.All",
|                                             "DisplayName":  "Manage bookings information",
|                                             "Description":  "Allows an app to read, write and manage bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage bookings data only; no path to identity or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Bookings.Read.All",
|                                             "DisplayName":  "Read bookings information",
|                                             "Description":  "Allows an app to read bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to bookings data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Bookings.ReadWrite.All",
|                                             "DisplayName":  "Read and write bookings information",
|                                             "Description":  "Allows an app to read and write bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user. Does not allow create, delete and publish of booking businesses.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to bookings data without role or credential control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BookingsAppointment.ReadWrite.All",
|                                             "DisplayName":  "Read and write booking appointments",
|                                             "Description":  "Allows an app to read and write bookings appointments and customers, and additionally allows read businesses information, services, and staff on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to bookings appointments; no identity or role management capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Bookmark.Read.All",
|                                             "DisplayName":  "Read all bookmarks that the user can access",
|                                             "Description":  "Allows an app to read all bookmarks that the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to bookmarks; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BrowserSiteLists.Read.All",
|                                             "DisplayName":  "Read all browser site lists for your organization",
|                                             "Description":  "Allows an app to read all browser site lists configured for your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to browser site lists; no identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BrowserSiteLists.ReadWrite.All",
|                                             "DisplayName":  "Read and write all browser site lists for your organization",
|                                             "Description":  "Allows an app to read and write all browser site lists configured for your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to browser site lists; no direct or near-direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BusinessScenarioConfig.Read.All",
|                                             "DisplayName":  "Read business scenario configurations",
|                                             "Description":  "Allows the app to read the configurations of your organization\u0027s business scenarios, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to business scenario configurations; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BusinessScenarioConfig.Read.OwnedBy",
|                                             "DisplayName":  "Read all business scenario configurations this app creates or owns",
|                                             "Description":  "Allows the app to read the configurations of business scenarios it owns, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to owned business scenarios; no identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BusinessScenarioConfig.ReadWrite.All",
|                                             "DisplayName":  "Read and write business scenario configurations",
|                                             "Description":  "Allows the app to read and write the configurations of your organization\u0027s business scenarios, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to business scenario configurations; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BusinessScenarioConfig.ReadWrite.OwnedBy",
|                                             "DisplayName":  "Read and write business scenario configurations this app creates or owns",
|                                             "Description":  "Allows the app to create new business scenarios and fully manage the configurations of scenarios it owns, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage owned business scenarios; no path to role assignment or credential control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "BusinessScenarioData.Read.OwnedBy",
|                                             "DisplayName":  "Read all data for business scenarios this app creates or owns",
|                                             "Description":  "Allows the app to read all data associated with the business scenarios it owns. Data access will be attributed to the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to owned business scenario data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "BusinessScenarioData.ReadWrite.OwnedBy",
|                                             "DisplayName":  "Read and write data for all business scenarios this app creates or owns",
|                                             "Description":  "Allows the app to fully manage the data associated with the business scenarios it owns, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Full management of owned business scenario data; no direct identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Calendars.Read",
|                                             "DisplayName":  "Read user calendars",
|                                             "Description":  "Allows the app to read events in user calendars.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to user calendar events; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Calendars.Read.All",
|                                             "DisplayName":  "Read user and shared calendars ",
|                                             "Description":  "Allows the app to read events in all calendars that the user can access, including delegate and shared calendars.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to all accessible calendars; no path to identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Calendars.Read.Shared",
|                                             "DisplayName":  "Read user and shared calendars",
|                                             "Description":  "Allows the app to read events in all calendars that the user can access, including delegate and shared calendars.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to shared calendars; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Calendars.ReadBasic",
|                                             "DisplayName":  "Read basic details of user calendars",
|                                             "Description":  "Allows the app to read events in user calendars, except for properties such as body, attachments, and extensions.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to basic calendar event properties; no identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Calendars.ReadBasic.All",
|                                             "DisplayName":  "Read basic details of calendars in all mailboxes ",
|                                             "Description":  "Allows the app to read events of all calendars, except for properties such as body, attachments, and extensions, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to basic calendar events across all calendars; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Calendars.ReadWrite",
|                                             "DisplayName":  "Read and write calendars in all mailboxes",
|                                             "Description":  "Allows the app to create, read, update, and delete events of all calendars without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to calendar events without identity or role management capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Calendars.ReadWrite.All",
|                                             "DisplayName":  "Read and write user and shared calendars ",
|                                             "Description":  "Allows the app to create, read, update and delete events in all calendars in the organization user has permissions to access. This includes delegate and shared calendars.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated write access to all calendars user can access; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Calendars.ReadWrite.Shared",
|                                             "DisplayName":  "Read and write user and shared calendars",
|                                             "Description":  "Allows the app to create, read, update and delete events in all calendars in the organization user has permissions to access. This includes delegate and shared calendars.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated write access to shared calendars; no path to role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CallAiInsights.Read.All",
|                                             "DisplayName":  "Read all AI Insights for calls. ",
|                                             "Description":  "Allows the app to read all AI Insights for calls, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to call AI insights; no identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CallDelegation.Read",
|                                             "DisplayName":  "Read delegation settings",
|                                             "Description":  "Allows the app to read delegation settings of you",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to own call delegation settings; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CallDelegation.Read.All",
|                                             "DisplayName":  "Read delegation settings",
|                                             "Description":  "Allows the app to read delegation settings of you",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to call delegation settings; no identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CallDelegation.ReadWrite",
|                                             "DisplayName":  "Read and write delegation settings",
|                                             "Description":  "Allows the app to read and write delegation settings of you",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to own call delegation settings only; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CallDelegation.ReadWrite.All",
|                                             "DisplayName":  "Read and write delegation settings",
|                                             "Description":  "Allows the app to read and write delegation settings of you",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to call delegation settings; no direct or near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CallEvents.Read",
|                                             "DisplayName":  "Read call event data",
|                                             "Description":  "Allows the app to read call event information for an organization for the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to call event info for signed-in user; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CallEvents.Read.All",
|                                             "DisplayName":  "Read all call events",
|                                             "Description":  "Allows the app to read call event information for all users in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to call events for all users; no role assignment or credential reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CallEvents-Emergency.Read.All",
|                                             "DisplayName":  "Read all emergency call events",
|                                             "Description":  "Allows the app to read emergency call event information for all users in your organization without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to emergency call events; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CallRecordings.Read.All",
|                                             "DisplayName":  "Read all recordings of calls. ",
|                                             "Description":  "Allows the app to read all recordings of calls, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to call recordings; no path to identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CallRecord-PstnCalls.Read.All",
|                                             "DisplayName":  "Read PSTN and direct routing call log data",
|                                             "Description":  "Allows the app to read all PSTN and direct routing call log data without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to PSTN call logs; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CallRecords.Read.All",
|                                             "DisplayName":  "Read all call records",
|                                             "Description":  "Allows the app to read call records for all calls and online meetings without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to call records and meetings; no role or credential control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Calls.AccessMedia.All",
|                                             "DisplayName":  "Access media streams in a call as an app",
|                                             "Description":  "Allows the app to get direct access to media streams in a call, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Access to media streams in calls; no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Calls.Initiate.All",
|                                             "DisplayName":  "Initiate outgoing 1 to 1 calls from the app",
|                                             "Description":  "Allows the app to place outbound calls to a single user and transfer calls to users in your organization’s directory, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to place calls and transfer calls; no path to tenant takeover or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Calls.InitiateGroupCall.All",
|                                             "DisplayName":  "Initiate outgoing group calls from the app",
|                                             "Description":  "Allows the app to place outbound calls to multiple users and add participants to meetings in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to place group calls and add participants; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Calls.JoinGroupCall.All",
|                                             "DisplayName":  "Join group calls and meetings as an app",
|                                             "Description":  "Allows the app to join group calls and scheduled meetings in your organization, without a signed-in user.  The app will be joined with the privileges of a directory user to meetings in your organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to join group calls as a user; no direct or near-direct path to identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Calls.JoinGroupCallAsGuest.All",
|                                             "DisplayName":  "Join group calls and meetings as a guest",
|                                             "Description":  "Allows the app to anonymously join group calls and scheduled meetings in your organization, without a signed-in user.  The app will be joined as a guest to meetings in your organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows anonymous joining of group calls as guest; no identity plane control or tenant takeover path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Capacity.Read.All",
|                                             "DisplayName":  "View all capacities",
|                                             "Description":  "The app can view all Power BI Premium and Power BI Embedded capacities that the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Power BI capacities scoped to signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Capacity.ReadWrite.All",
|                                             "DisplayName":  "Read and write all capacities",
|                                             "Description":  "The app can view and edit all Power BI Premium and Power BI Embedded capacities that the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to Power BI capacities scoped to signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Catalog.Read.All",
|                                             "DisplayName":  "Read catalog",
|                                             "Description":  "Allows reading catalog on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to catalog on user\u0027s behalf; no identity plane control or privilege escalation path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CatalogMirroring.Read.All",
|                                             "DisplayName":  "Read Iceberg and Delta table catalog metadata from the provider",
|                                             "Description":  "Allows reading Iceberg and Delta table catalog metadata from the external provider on the users behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to external catalog metadata on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChangeManagement.Read.All",
|                                             "DisplayName":  "Read Change Management items",
|                                             "Description":  "Allows to read all Change Management items.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to change management items; no ability to modify identity or role assignments."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Channel.Create",
|                                             "DisplayName":  "Create channels",
|                                             "Description":  "Create channels in any team, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to create Teams channels without signed-in user; no path to tenant takeover or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Channel.Delete.All",
|                                             "DisplayName":  "Delete channels",
|                                             "Description":  "Delete channels in any team, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to delete Teams channels; no direct or near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Channel.ReadBasic.All",
|                                             "DisplayName":  "Read the names and descriptions of channels",
|                                             "Description":  "Read channel names and channel descriptions, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read basic channel info on behalf of user; no identity plane or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChannelMember.Read.All",
|                                             "DisplayName":  "Read the members of all channels",
|                                             "Description":  "Read the members of all channels, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read members of all channels without signed-in user; no path to role assignment or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChannelMember.ReadWrite.All",
|                                             "DisplayName":  "Add and remove members from all channels",
|                                             "Description":  "Add and remove members from all channels, without a signed-in user. Also allows changing a member\u0027s role, for example from owner to non-owner.",
|                                             "Tier":  3,
|                                             "Reason":  "Add/remove channel members and change roles; no documented path to tenant takeover or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChannelMessage.Edit",
|                                             "DisplayName":  "Edit user\u0027s channel messages",
|                                             "Description":  "Allows an app to edit channel messages in Microsoft Teams, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Edit channel messages on behalf of user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChannelMessage.Read.All",
|                                             "DisplayName":  "Read user channel messages",
|                                             "Description":  "Allows an app to read a channel\u0027s messages in Microsoft Teams, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read channel messages on behalf of user; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChannelMessage.ReadWrite",
|                                             "DisplayName":  "Read and write user channel messages",
|                                             "Description":  "Allows the app to read and write channel messages, on behalf of the signed-in user. This doesn\u0027t allow the app to edit the policyViolation of a channel message.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write channel messages on behalf of user; no path to role assignment or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChannelMessage.Send",
|                                             "DisplayName":  "Send channel messages",
|                                             "Description":  "Allows an app to send channel messages in Microsoft Teams, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Send channel messages on behalf of user; no identity plane control or privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChannelMessage.UpdatePolicyViolation.All",
|                                             "DisplayName":  "Flag channel messages for violating policy",
|                                             "Description":  "Allows the app to update Microsoft Teams channel messages by patching a set of Data Loss Prevention (DLP) policy violation properties to handle the output of DLP processing.",
|                                             "Tier":  3,
|                                             "Reason":  "Update DLP policy violation properties on Teams messages; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChannelSettings.Read.All",
|                                             "DisplayName":  "Read the names, descriptions, and settings of channels",
|                                             "Description":  "Read all channel names, channel descriptions, and channel settings, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read channel settings on behalf of user; no path to identity plane or tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChannelSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and write the names, descriptions, and settings of channels",
|                                             "Description":  "Read and write the names, descriptions, and settings of all channels, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write channel settings on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Chat.Create",
|                                             "DisplayName":  "Create chats",
|                                             "Description":  "Allows the app to create chats on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Create chats on behalf of user; no path to identity plane control or tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Chat.ManageDeletion.All",
|                                             "DisplayName":  "Delete and recover deleted chats",
|                                             "Description":  "Allows the app to delete and recover deleted chats, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delete and recover chats on behalf of user; no identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Chat.Read",
|                                             "DisplayName":  "Read user chat messages",
|                                             "Description":  "Allows an app to read 1 on 1 or group chats threads, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read chat threads on behalf of user; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Chat.ReadBasic",
|                                             "DisplayName":  "Read names and members of user chat threads",
|                                             "Description":  "Allows an app to read the members and descriptions of one-to-one and group chat threads, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read chat members and descriptions on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Chat.ReadBasic.All",
|                                             "DisplayName":  "Read names and members of all chat threads",
|                                             "Description":  "Read names and members of all one-to-one and group chats in Microsoft Teams, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read chat names and members without signed-in user; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Chat.ReadBasic.WhereInstalled",
|                                             "DisplayName":  "Read names and members of all chat threads where the associated Teams application is installed.",
|                                             "Description":  "Allows the app to read names and members of all one-to-one and group chats in Microsoft Teams where the associated Teams application is installed, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read chat names and members where app installed; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Chat.ReadWrite",
|                                             "DisplayName":  "Read and write user chat messages",
|                                             "Description":  "Allows an app to read and write 1 on 1 or group chats threads, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write chats on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Chat.ReadWrite.All",
|                                             "DisplayName":  "Read and write all chat messages",
|                                             "Description":  "Allows an app to read and write all one-to-one and group chats in Microsoft Teams, without a signed-in user. Does not allow sending messages.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write all chats without signed-in user; does not allow sending messages or role changes."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Chat.ReadWrite.WhereInstalled",
|                                             "DisplayName":  "Read and write all chat messages for chats where the associated Teams application is installed.",
|                                             "Description":  "Allows the app to read and write all chat messages in Microsoft Teams for chats where the associated Teams application is installed, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write chat messages where app installed; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Chat.UpdatePolicyViolation.All",
|                                             "DisplayName":  "Flag chat messages for violating policy",
|                                             "Description":  "Allows the app to update Microsoft Teams 1-to-1 or group chat messages by patching a set of Data Loss Prevention (DLP) policy violation properties to handle the output of DLP processing.",
|                                             "Tier":  3,
|                                             "Reason":  "Update DLP policy violation properties on chat messages; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChatMember.Read",
|                                             "DisplayName":  "Read the members of chats",
|                                             "Description":  "Read the members of chats, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read chat members on behalf of user; no path to role assignment or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChatMember.Read.All",
|                                             "DisplayName":  "Read the members of all chats",
|                                             "Description":  "Read the members of all chats, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read members of all chats without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChatMember.Read.WhereInstalled",
|                                             "DisplayName":  "Read the members of all chats where the associated Teams application is installed.",
|                                             "Description":  "Allows the app to read the members of all chats where the associated Teams application is installed, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read chat members where app installed; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChatMember.ReadWrite",
|                                             "DisplayName":  "Add and remove members from chats",
|                                             "Description":  "Add and remove members from chats, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Add and remove chat members on behalf of user; no documented path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChatMember.ReadWrite.All",
|                                             "DisplayName":  "Add and remove members from all chats",
|                                             "Description":  "Add and remove members from all chats, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Add and remove members from all chats without signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ChatMember.ReadWrite.WhereInstalled",
|                                             "DisplayName":  "Add and remove members from all chats where the associated Teams application is installed.",
|                                             "Description":  "Allows the app to add and remove members from all chats where the associated Teams application is installed, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Add and remove chat members where app installed; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChatMessage.Read",
|                                             "DisplayName":  "Read user chat messages",
|                                             "Description":  "Allows an app to read one-to-one and group chat messages, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read chat messages on behalf of user; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ChatMessage.Send",
|                                             "DisplayName":  "Send user chat messages",
|                                             "Description":  "Allows an app to send one-to-one and group chat messages in Microsoft Teams, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Send chat messages on behalf of user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CloudApp-Discovery.Read.All",
|                                             "DisplayName":  "Read discovered cloud applications data",
|                                             "Description":  "Allows the app to read details of discovered cloud apps in the organization, on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read discovered cloud app details on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CloudPC.Read.All",
|                                             "DisplayName":  "Read Cloud PCs",
|                                             "Description":  "Allows the app to read the properties of Cloud PCs, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read properties of Cloud PCs without signed-in user; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CloudPC.ReadWrite.All",
|                                             "DisplayName":  "Read and write Cloud PCs",
|                                             "Description":  "Allows the app to read and write the properties of Cloud PCs on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write Cloud PC properties on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Code.AccessAzureDataExplorer.All",
|                                             "DisplayName":  "Access Azure Data Explorer",
|                                             "Description":  "Allow the application to access Azure Data Explorer on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Access Azure Data Explorer on behalf of user; no identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Code.AccessAzureDataLake.All",
|                                             "DisplayName":  "Have full access to the Azure Data Lake service",
|                                             "Description":  "Allow the application full access to the Azure Data Lake service on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Full access to Azure Data Lake on behalf of user; data plane access only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Code.AccessAzureKeyvault.All",
|                                             "DisplayName":  "Have full access to the Azure Key Vault service",
|                                             "Description":  "Allow the application full access to the Azure Key Vault service on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Full access to Azure Key Vault on behalf of user; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Code.AccessFabric.All",
|                                             "DisplayName":  "Allow API calls to access all Fabric resources on behalf of signed-in user",
|                                             "Description":  "Allows the app to make API calls to access all Fabric resources, on behalf of signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Access all Fabric resources on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Code.AccessSQL.All",
|                                             "DisplayName":  "Access Azure SQL database and data warehouse",
|                                             "Description":  "This is for Azure SQL database and data warehouse access",
|                                             "Tier":  3,
|                                             "Reason":  "Access Azure SQL database and data warehouse on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Code.AccessStorage.All",
|                                             "DisplayName":  "Access Azure Storage",
|                                             "Description":  "Allow the application to access Azure Storage on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Access Azure Storage on behalf of user; data plane access only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Community.Read.All",
|                                             "DisplayName":  "Read all Viva Engage communities",
|                                             "Description":  "Allows the app to list Viva Engage communities, and to read their properties without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Viva Engage communities without signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Community.ReadWrite.All",
|                                             "DisplayName":  "Read and write all Viva Engage communities",
|                                             "Description":  "Allows the app to create Viva Engage communities, read all community properties, update community properties, and delete communities without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows management of Viva Engage communities but does not provide identity plane control or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "compliancestatus.tenant.read",
|                                             "DisplayName":  "compliancestatus.tenant.read",
|                                             "Description":  "compliancestatus.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to compliance status data with no path to identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ConfigurationMonitoring.Read.All",
|                                             "DisplayName":  "Read all Configuration Monitoring entities",
|                                             "Description":  "Allows the app to read all Configuration Monitoring entities, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to configuration monitoring data without identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ConfigurationMonitoring.ReadWrite.All",
|                                             "DisplayName":  "Read and write all Configuration Monitoring entities",
|                                             "Description":  "Allows the app to read and write all Configuration Monitoring entities, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to configuration monitoring data but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Connection.Read.All",
|                                             "DisplayName":  "Make API calls that require read permissions on all Fabric connections",
|                                             "Description":  "Allows the app to make API calls that require read permissions on all Fabric connections, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to Power BI Fabric connections with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Connection.ReadWrite.All",
|                                             "DisplayName":  "Make API calls that require read and write permissions on all Fabric connections",
|                                             "Description":  "Allows the app to make API calls that require read and write permissions on all Fabric connections, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read/write access to Power BI Fabric connections but no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Connection.Reshare.All",
|                                             "DisplayName":  "Connection.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but likely limited to reshare actions without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ConsentRequest.Create",
|                                             "DisplayName":  "Create consent requests",
|                                             "Description":  "Allows the app to read create consent requests on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated creation of consent requests without ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ConsentRequest.Read",
|                                             "DisplayName":  "Read consent requests created by the user",
|                                             "Description":  "Allows the app to read consent requests and approvals created by the signed-in user, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to consent requests created by the user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ConsentRequest.Read.All",
|                                             "DisplayName":  "Read all consent requests",
|                                             "Description":  "Allows the app to read consent requests and approvals without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to consent requests but no ability to modify or assign roles."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ConsentRequest.ReadApprove.All",
|                                             "DisplayName":  "Read and approve consent requests",
|                                             "Description":  "Allows the app to read and approve consent requests on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read and approve consent requests but no direct role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ConsentRequest.ReadWrite.All",
|                                             "DisplayName":  "Read and write all consent requests",
|                                             "Description":  "Allows the app to read app consent requests and approvals, and deny or approve those requests without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read/write access to consent requests but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Contacts.Read",
|                                             "DisplayName":  "Read user contacts ",
|                                             "Description":  "Allows the app to read user contacts.  ",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to user contacts only; no path to identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Contacts.Read.All",
|                                             "DisplayName":  "Read user and shared contacts ",
|                                             "Description":  "Allows the app to read contacts a user has permissions to access, including their own and shared contacts.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to contacts across users but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Contacts.Read.Shared",
|                                             "DisplayName":  "Read user and shared contacts ",
|                                             "Description":  "Allows the app to read contacts a user has permissions to access, including their own and shared contacts.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to shared contacts only; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Contacts.ReadWrite",
|                                             "DisplayName":  "Have full access to user contacts ",
|                                             "Description":  "Allows the app to create, read, update, and delete user contacts.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated write access to user contacts only; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Contacts.ReadWrite.All",
|                                             "DisplayName":  "Read and write user and shared  contacts ",
|                                             "Description":  "Allows the app to create, read, update, and delete contacts a user has permissions to, including their own and shared contacts.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated write access to contacts but no identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Contacts.ReadWrite.Shared",
|                                             "DisplayName":  "Read and write user and shared  contacts ",
|                                             "Description":  "Allows the app to create, read, update, and delete contacts a user has permissions to, including their own and shared contacts.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated write access to shared contacts only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Contacts-OnPremisesSyncBehavior.ReadWrite.All",
|                                             "DisplayName":  "Read and update the on-premises sync behavior of contacts",
|                                             "Description":  "Allows the app to read and update the on-premises sync behavior of contacts a user has permissions to, including their own and shared contacts.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify on-premises sync behavior of contacts but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Content.Create",
|                                             "DisplayName":  "Create content",
|                                             "Description":  "App can automatically create content and datasets for a user.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to create content and datasets but no path to identity or role management."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Rights Management Services",
|                                             "AppId":  "00000012-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Content.DelegatedReader",
|                                             "DisplayName":  "Read protected content on behalf of a user",
|                                             "Description":  "Read protected content on behalf of a user",
|                                             "Tier":  3,
|                                             "Reason":  "Read protected content on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Rights Management Services",
|                                             "AppId":  "00000012-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Content.DelegatedWriter",
|                                             "DisplayName":  "Create protected content on behalf of a user",
|                                             "Description":  "Create protected content on behalf of a user",
|                                             "Tier":  3,
|                                             "Reason":  "Create protected content on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Content.Process.All",
|                                             "DisplayName":  "Process content for data security, governance and compliance",
|                                             "Description":  "Allows the app to process and evaluate content for data security, governance and compliance outcomes at tenant scope.",
|                                             "Tier":  3,
|                                             "Reason":  "Process and evaluate content for compliance but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Content.Process.User",
|                                             "DisplayName":  "Process content for data security, governance and compliance",
|                                             "Description":  "Allows the app to process and evaluate content for data security, governance and compliance outcomes for a user.",
|                                             "Tier":  3,
|                                             "Reason":  "Process content for a user only; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Rights Management Services",
|                                             "AppId":  "00000012-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Content.SuperUser",
|                                             "DisplayName":  "Read all protected content for this tenant",
|                                             "Description":  "Read all protected content for this tenant",
|                                             "Tier":  3,
|                                             "Reason":  "Read all protected content but no ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Rights Management Services",
|                                             "AppId":  "00000012-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Content.Writer",
|                                             "DisplayName":  "Create protected content",
|                                             "Description":  "Create protected content",
|                                             "Tier":  3,
|                                             "Reason":  "Create protected content only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ContentActivity.Read",
|                                             "DisplayName":  "Read contents activity audit log from the audit store.",
|                                             "Description":  "Read contents activity audit log from the audit store.",
|                                             "Tier":  3,
|                                             "Reason":  "Read content activity audit logs; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ContentActivity.Write",
|                                             "DisplayName":  "Upload content activity audit logs to the audit store.",
|                                             "Description":  "Allows the application to upload bulk contents activity audit logs to the audit store.",
|                                             "Tier":  3,
|                                             "Reason":  "Write content activity audit logs; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Contracts.Read.All",
|                                             "DisplayName":  "Read contracts",
|                                             "Description":  "Allows the app to read available properties on contracts, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read contract properties only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Skype for Business Online",
|                                             "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Conversations.AudioVideo",
|                                             "DisplayName":  "Send/Receive Audio and Video (preview)",
|                                             "Description":  "Allows the app to send and receive audio and video; and manage audio/video service scenarios",
|                                             "Tier":  3,
|                                             "Reason":  "Manage audio/video service scenarios; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Skype for Business Online",
|                                             "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Conversations.Chat",
|                                             "DisplayName":  "Send/Receive Instant Messages (preview)",
|                                             "Description":  "Allows the app to send and receive instant messages; and manage instant messaging service scenarios",
|                                             "Tier":  3,
|                                             "Reason":  "Manage instant messaging scenarios; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Skype for Business Online",
|                                             "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Conversations.PSTN",
|                                             "DisplayName":  "Send/Receive PSTN (preview)",
|                                             "Description":  "Allows the app to send and receive voice calls; and manage PSTN service scenarios",
|                                             "Tier":  3,
|                                             "Reason":  "Manage PSTN voice calls; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopilotConversation.Delete",
|                                             "DisplayName":  "Delete Microsoft 365 Copilot conversations",
|                                             "Description":  "Allows the app to delete Microsoft 365 Copilot conversations on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delete Copilot conversations on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CopilotPackages.Read.All",
|                                             "DisplayName":  "Read all packages information",
|                                             "Description":  "Allows the app to read packages information without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read package information only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopilotPackages.ReadWrite.All",
|                                             "DisplayName":  "Read and update all packages information",
|                                             "Description":  "Allows the user to read and update the packages information",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update package info; no path to role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopilotPolicySettings.Read",
|                                             "DisplayName":  "Read Copilot policy settings",
|                                             "Description":  "Allows the app to read Copilot policy settings for the organization, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Copilot policy settings on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CopilotPolicySettings.ReadWrite",
|                                             "DisplayName":  "Read and write Copilot policy settings",
|                                             "Description":  "Allows the app to read and write Copilot policy settings for the organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write Copilot policy settings but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopilotSettings-LimitedMode.Read",
|                                             "DisplayName":  "Read organization-wide copilot limited mode setting",
|                                             "Description":  "Allows the app to read organization-wide copilot limited mode setting on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read limited mode setting on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopilotSettings-LimitedMode.ReadWrite",
|                                             "DisplayName":  "Read and write organization-wide copilot limited mode setting",
|                                             "Description":  "Allows the app to read and write organization-wide copilot limited mode setting on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write limited mode setting on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopyJob.Execute.All",
|                                             "DisplayName":  "Execute copy jobs",
|                                             "Description":  "Allows executing copy jobs on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute copy jobs on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopyJob.Read.All",
|                                             "DisplayName":  "Read copy jobs",
|                                             "Description":  "Allows reading copy jobs on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read copy jobs on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopyJob.ReadWrite.All",
|                                             "DisplayName":  "Read and write copy jobs",
|                                             "Description":  "Allows modifying copy jobs on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify copy jobs on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CopyJob.Reshare.All",
|                                             "DisplayName":  "CopyJob.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but likely limited to reshare actions without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CrossTenantInformation.ReadBasic.All",
|                                             "DisplayName":  "Read cross-tenant basic information",
|                                             "Description":  "Allows the application to obtain basic tenant information about another target tenant within the Azure AD ecosystem on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read basic tenant info about other tenants; no identity plane control in current tenant."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CrossTenantUserProfileSharing.Read",
|                                             "DisplayName":  "Read shared cross-tenant user profile and export data",
|                                             "Description":  "Allows the application to list and query user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export external user data (e.g. customer content or system-generated logs), associated with the current tenant on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read user profile info and export external user data on behalf of user; no role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CrossTenantUserProfileSharing.Read.All",
|                                             "DisplayName":  "Read all shared cross-tenant user profiles and export their data",
|                                             "Description":  "Allows the application to list and query any shared user profile information associated with the current tenant without a signed-in user.  It also permits the application to export external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read shared user profile info and export external user data without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CrossTenantUserProfileSharing.ReadWrite",
|                                             "DisplayName":  "Read shared cross-tenant user profile and export or delete data",
|                                             "Description":  "Allows the application to list and query user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), associated with the current tenant on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read, export, and remove external user data on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CrossTenantUserProfileSharing.ReadWrite.All",
|                                             "DisplayName":  "Read all shared cross-tenant user profiles and export or delete their data",
|                                             "Description":  "Allows the application to list and query any shared user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read, export, and remove external user data for any user on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomAuthenticationExtension.Read.All",
|                                             "DisplayName":  "Read your organization\u0027s custom authentication extensions",
|                                             "Description":  "Allows the app to read your organization\u0027s custom authentication extensions on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read custom authentication extensions on behalf of user; no ability to modify roles or credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CustomAuthenticationExtension.ReadWrite.All",
|                                             "DisplayName":  "Read and write all custom authentication extensions",
|                                             "Description":  "Allows the app to read or write your organization\u0027s custom authentication extensions without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write custom authentication extensions but no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CustomAuthenticationExtension.Receive.Payload",
|                                             "DisplayName":  "Receive custom authentication extension HTTP requests",
|                                             "Description":  "Allows custom authentication extensions associated with the app to receive HTTP requests triggered by an authentication event. The request can include information about a user, client and resource service principals, and other information about the authentication.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows receiving authentication event payloads but does not enable role assignment or credential modification."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CustomDetection.Read.All",
|                                             "DisplayName":  "Read all custom detection rules",
|                                             "Description":  "Allows the app to read custom detection rules without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to custom detection rules without ability to modify identity or roles."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CustomDetection.ReadWrite.All",
|                                             "DisplayName":  "Read and write all custom detection rules",
|                                             "Description":  "Allows the app to read and write custom detection rules without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Can modify custom detection rules but no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomSecAttributeAssignment.Read.All",
|                                             "DisplayName":  "Read custom security attribute assignments",
|                                             "Description":  "Allows the app to read custom security attribute assignments for all principals in the tenant on behalf of a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to security attribute assignments only; no identity plane modification."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CustomSecAttributeAssignment.ReadWrite.All",
|                                             "DisplayName":  "Read and write custom security attribute assignments",
|                                             "Description":  "Allows the app to read and write custom security attribute assignments for all principals in the tenant without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to security attribute assignments but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomSecAttributeAuditLogs.Read.All",
|                                             "DisplayName":  "Read custom security attribute audit logs",
|                                             "Description":  "Allows the app to read audit logs for events that contain information about custom security attributes, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to audit logs related to custom security attributes; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomSecAttributeDefinition.Read.All",
|                                             "DisplayName":  "Read custom security attribute definitions",
|                                             "Description":  "Allows the app to read custom security attribute definitions for the tenant on behalf of a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to security attribute definitions; no ability to modify roles or credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomSecAttributeDefinition.ReadWrite.All",
|                                             "DisplayName":  "Read and write custom security attribute definitions",
|                                             "Description":  "Allows the app to read and write custom security attribute definitions for the tenant on behalf of a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Can modify security attribute definitions but no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomSecAttributeProvisioning.Read.All",
|                                             "DisplayName":  "Read the provisioning configuration of all active custom security attributes",
|                                             "Description":  "Allows the app to read the provisioning configuration of all active custom security attributes on behalf of a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to provisioning configuration; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomSecAttributeProvisioning.ReadWrite.All",
|                                             "DisplayName":  "Read and edit the provisioning configuration of all active custom security attributes",
|                                             "Description":  "Allows the app to read and edit the provisioning configuration of all active custom security attributes on behalf of a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Can modify provisioning configuration but no direct identity plane escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CustomTag.Tenant.Read",
|                                             "DisplayName":  "CustomTag.Tenant.Read",
|                                             "Description":  "CustomTag.Tenant.Read",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to custom tags; no path to identity or role modification."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "CustomTag.Tenant.Write",
|                                             "DisplayName":  "CustomTag.Tenant.Write",
|                                             "Description":  "CustomTag.Tenant.Write",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to custom tags but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomTags.Read.All",
|                                             "DisplayName":  "Read all custom tags data",
|                                             "Description":  "Read custom tags data on behalf of the signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to custom tags on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "CustomTags.ReadWrite.All",
|                                             "DisplayName":  "Read and write custom tags data",
|                                             "Description":  "Read and write custom tags data on behalf of the signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to custom tags on behalf of user; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dashboard.Execute.All",
|                                             "DisplayName":  "Dashboard.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Execute permissions on dashboards on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dashboard.Read.All",
|                                             "DisplayName":  "Read dashboards",
|                                             "Description":  "Allows reading dashboards on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to dashboards on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dashboard.ReadWrite.All",
|                                             "DisplayName":  "Read and write dashboards",
|                                             "Description":  "Allows modifying dashboards on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify dashboards on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dashboard.Reshare.All",
|                                             "DisplayName":  "Dashboard.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare dashboards on behalf of user; no path to role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DataAgent.Execute.All",
|                                             "DisplayName":  "Execute data agents",
|                                             "Description":  "Allows executing data agents on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute data agents on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DataAgent.Read.All",
|                                             "DisplayName":  "Read data agents",
|                                             "Description":  "Allows reading data agents on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read data agents on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DataAgent.ReadWrite.All",
|                                             "DisplayName":  "Read and write data agents",
|                                             "Description":  "Allows modifying data agents on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify data agents on behalf of user; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DataAgent.Reshare.All",
|                                             "DisplayName":  "DataAgent.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare data agents on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DatabricksCatalog.Read.All",
|                                             "DisplayName":  "Read Databricks workspaces catalog metadata.",
|                                             "Description":  "Allows reading Databricks workspaces catalog metadata on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Databricks workspace metadata on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dataflow.Execute.All",
|                                             "DisplayName":  "Execute dataflows",
|                                             "Description":  "Allows executing dataflows on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute dataflows on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dataflow.Read.All",
|                                             "DisplayName":  "Read dataflows",
|                                             "Description":  "Allows reading dataflows on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read dataflows on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dataflow.ReadWrite.All",
|                                             "DisplayName":  "Read and write dataflows",
|                                             "Description":  "Allows modifying dataflows on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify dataflows on behalf of user; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dataflow.Reshare.All",
|                                             "DisplayName":  "Dataflow.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare dataflows on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DataInsightsSubscription.tenant.read",
|                                             "DisplayName":  "DataInsightsSubscription.tenant.read",
|                                             "Description":  "DataInsightsSubscription.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to data insights subscription; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DataInsightsSubscription.tenant.write",
|                                             "DisplayName":  "DataInsightsSubscription.tenant.write",
|                                             "Description":  "DataInsightsSubscription.tenant.write",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to data insights subscription; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DataInsightsUsersData.tenant.read",
|                                             "DisplayName":  "DataInsightsUsersData.tenant.read",
|                                             "Description":  "DataInsightsUsersData.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to user data insights; no path to role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Datamart.Execute.All",
|                                             "DisplayName":  "Datamart.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Execute datamarts on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Datamart.Read.All",
|                                             "DisplayName":  "Read datamarts",
|                                             "Description":  "Allows reading datamarts on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read datamarts on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Datamart.ReadWrite.All",
|                                             "DisplayName":  "Read and write datamarts",
|                                             "Description":  "Allows modifying datamarts on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify datamarts on behalf of user; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Datamart.Reshare.All",
|                                             "DisplayName":  "Datamart.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare datamarts on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DataPipeline.Execute.All",
|                                             "DisplayName":  "Make API calls that require execute permissions all data pipelines",
|                                             "Description":  "Allows the app to make API calls that require execute permissions on all data pipelines, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute data pipelines on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DataPipeline.Read.All",
|                                             "DisplayName":  "Make API calls that require read permissions on all data pipelines",
|                                             "Description":  "Allows the app to make API calls that require read permissions on all data pipelines, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read data pipelines on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DataPipeline.ReadWrite.All",
|                                             "DisplayName":  "Make API calls that require read and write permissions on all data pipelines",
|                                             "Description":  "Allows the app to make API calls that require read and write permissions on all data pipelines, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify data pipelines on behalf of user; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DataPipeline.Reshare.All",
|                                             "DisplayName":  "DataPipeline.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare data pipelines on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dataset.Read.All",
|                                             "DisplayName":  "View all datasets",
|                                             "Description":  "The app can view all datasets for the signed in user and any datasets that the user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read datasets accessible to user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Dataset.ReadWrite.All",
|                                             "DisplayName":  "Read and write all datasets",
|                                             "Description":  "The app can view and write to all datasets for the signed in user and any datasets that the user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify datasets accessible to user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DelegatedAdminRelationship.Read.All",
|                                             "DisplayName":  "Read Delegated Admin relationships with customers",
|                                             "Description":  "Allows the app to read details of delegated admin relationships with customers like access details (that includes roles) and the duration as well as specific role assignments to security groups without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read delegated admin relationships but no ability to modify roles or credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DelegatedPermissionGrant.Read.All",
|                                             "DisplayName":  "Read all delegated permission grants",
|                                             "Description":  "Allows the app to read all delegated permission grants, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read delegated permission grants only; no ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Device.Command",
|                                             "DisplayName":  "Communicate with user devices",
|                                             "Description":  "Allows the app to launch another app or communicate with another app on a user\u0027s device on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows app communication on user\u0027s device but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Device.CreateFromOwnedTemplate",
|                                             "DisplayName":  "Create devices based on owned device templates",
|                                             "Description":  "Allows the app to create device objects based on device templates owned by the signed-in user, on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Create devices from templates owned by user; no path to role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Device.Read",
|                                             "DisplayName":  "Read user devices",
|                                             "Description":  "Allows the app to read a user\u0027s list of devices on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read user\u0027s devices only; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Device.Read.All",
|                                             "DisplayName":  "Read all devices",
|                                             "Description":  "Allows the app to read your organization\u0027s devices\u0027 configuration information on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read all devices\u0027 configuration on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceLocalCredential.ReadBasic.All",
|                                             "DisplayName":  "Read device local credential properties",
|                                             "Description":  "Allows the app to read device local credential properties excluding passwords, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to device local credential properties excluding passwords; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceManagementApps.Read.All",
|                                             "DisplayName":  "Read Microsoft Intune apps",
|                                             "Description":  "Allows the app to read the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Intune app properties and policies; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceManagementCloudCA.Read.All",
|                                             "DisplayName":  "Read Microsoft Cloud PKI objects",
|                                             "Description":  "Allows the app to read certification authority information without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to certification authority info; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DeviceManagementConfiguration.Read.All",
|                                             "DisplayName":  "Read Microsoft Intune Device Configuration and Policies",
|                                             "Description":  "Allows the app to read properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Intune device configuration and compliance policies; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DeviceManagementManagedDevices.Read.All",
|                                             "DisplayName":  "Read Microsoft Intune devices",
|                                             "Description":  "Allows the app to read the properties of devices managed by Microsoft Intune.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to managed device properties; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceManagementRBAC.Read.All",
|                                             "DisplayName":  "Read Microsoft Intune RBAC settings",
|                                             "Description":  "Allows the app to read the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Intune RBAC settings; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "DeviceManagementScripts.Read.All",
|                                             "DisplayName":  "Read Microsoft Intune Scripts",
|                                             "Description":  "Allows the app to read Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Intune device management scripts; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceManagementServiceConfig.Read.All",
|                                             "DisplayName":  "Read Microsoft Intune configuration",
|                                             "Description":  "Allows the app to read Microsoft Intune service properties including device enrollment and third party service connection configuration, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Intune service properties; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DeviceTemplate.Read.All",
|                                             "DisplayName":  "Read all device templates",
|                                             "Description":  "Allows the app to read all device templates, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to device templates; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Directory.AccessAsUser.All",
|                                             "DisplayName":  "Access directory as the signed in user",
|                                             "Description":  "Allows the app to have the same access to information in the directory as the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated access matching signed-in user rights; no direct identity plane control without admin privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Directory.Read.All",
|                                             "DisplayName":  "Read directory data",
|                                             "Description":  "Allows the app to read data in your organization\u0027s directory, such as users, groups and apps.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only directory access; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DirectoryRecommendations.Read.All",
|                                             "DisplayName":  "Read all Azure AD recommendations",
|                                             "Description":  "Allows the app to read all Azure AD recommendations, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Azure AD recommendations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Domain.Read.All",
|                                             "DisplayName":  "Read domains.",
|                                             "Description":  "Allows the app to read all domain properties on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to domain properties; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Domain-InternalFederation.Read.All",
|                                             "DisplayName":  "Read internal federation configuration for a domain.",
|                                             "Description":  "Allows the app to read internal federation configuration for a domain.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to internal federation configuration; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "DynamicRiskPreventionTag.Tenant.Read",
|                                             "DisplayName":  "DynamicRiskPreventionTag.Tenant.Read",
|                                             "Description":  "DynamicRiskPreventionTag.Tenant.Read",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to risk prevention tags; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EAS.AccessAsUser.All",
|                                             "DisplayName":  "Access mailboxes via Exchange ActiveSync",
|                                             "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via Exchange ActiveSync.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated mailbox access via Exchange ActiveSync; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "eDiscovery.Read.All",
|                                             "DisplayName":  "Read all eDiscovery objects",
|                                             "Description":  "Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to eDiscovery objects; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduAdministration.Read",
|                                             "DisplayName":  "Read education app settings",
|                                             "Description":  "Read the state and settings of all Microsoft education apps on behalf of the user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to education app state and settings; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduAdministration.Read.All",
|                                             "DisplayName":  "Read Education app settings",
|                                             "Description":  "Read the state and settings of all Microsoft education apps.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to all education app state and settings; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduAssignments.Read",
|                                             "DisplayName":  "Read users\u0027 class assignments and their grades",
|                                             "Description":  "Allows the app to read assignments and their grades on behalf of the user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to assignments and grades; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduAssignments.Read.All",
|                                             "DisplayName":  "Read all class assignments with grades",
|                                             "Description":  "Allows the app to read all class assignments with grades for all users without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to all class assignments and grades; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduAssignments.ReadBasic",
|                                             "DisplayName":  "Read users\u0027 class assignments without grades",
|                                             "Description":  "Allows the app to read assignments without grades on behalf of the user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to assignments without grades; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduAssignments.ReadBasic.All",
|                                             "DisplayName":  "Read all class assignments without grades",
|                                             "Description":  "Allows the app to read all class assignments without grades for all users without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to all class assignments without grades; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduCurricula.Read",
|                                             "DisplayName":  "Read the user\u0027s class modules and resources",
|                                             "Description":  "Allows the app to read the user\u0027s modules and resources on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to user modules and resources; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduCurricula.Read.All",
|                                             "DisplayName":  "Read all class modules and resources",
|                                             "Description":  "Allows the app to read all modules and resources, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to all modules and resources; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduReports-Reading.Read.All",
|                                             "DisplayName":  "Read all tenant reading assignments submissions data",
|                                             "Description":  "Allows the app to read all tenant users reading assignments submissions data without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to education data without identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduReports-Reading.ReadAnonymous.All",
|                                             "DisplayName":  "Read all tenant reading assignments submissions data",
|                                             "Description":  "Allows the app to read all tenant users reading assignments submissions data (excludes student-identifying information) without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to anonymized education data; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduReports-Reflect.Read.All",
|                                             "DisplayName":  "Read all tenant reflect check-ins submissions data",
|                                             "Description":  "Allows the app to read all tenant users reflect check-ins submissions data without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to reflect check-ins data without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduReports-Reflect.ReadAnonymous.All",
|                                             "DisplayName":  "Read all tenant reflect check-ins submissions data",
|                                             "Description":  "Allows the app to read all tenant users reflect check-ins submissions data (excludes responder-identifying information) without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to anonymized reflect check-ins data; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduRoster.Read",
|                                             "DisplayName":  "Read users\u0027 view of the roster",
|                                             "Description":  "Allows the app to read the structure of schools and classes in an organization\u0027s roster and education-specific information about users to be read on behalf of the user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to education roster data on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduRoster.Read.All",
|                                             "DisplayName":  "Read the organization\u0027s roster",
|                                             "Description":  "Allows the app to read the structure of schools and classes in the organization\u0027s roster and education-specific information about all users to be read.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to education roster data; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduRoster.ReadBasic",
|                                             "DisplayName":  "Read a limited subset of users\u0027 view of the roster",
|                                             "Description":  "Allows the app to read a limited subset of the properties from the structure of schools and classes in an organization\u0027s roster and a limited subset of properties about users to be read on behalf of the user. Includes name, status, education role, email address and photo.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to limited education roster properties; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduRoster.ReadBasic.All",
|                                             "DisplayName":  "Read a limited subset of the organization\u0027s roster",
|                                             "Description":  "Allows the app to read a limited subset of properties from both the structure of schools and classes in the organization\u0027s roster and education-specific information about all users. Includes name, status, role, email address and photo.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to limited education roster properties; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EduRoster.ReadWrite",
|                                             "DisplayName":  "Read and write users\u0027 view of the roster",
|                                             "Description":  "Allows the app to read and write the structure of schools and classes in an organization\u0027s roster and education-specific information about users to be read and written on behalf of the user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read/write access to education roster on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EduRoster.ReadWrite.All",
|                                             "DisplayName":  "Read and write the organization\u0027s roster",
|                                             "Description":  "Allows the app to read and write the structure of schools and classes in the organization\u0027s roster and education-specific information about all users to be read and written.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read/write access to education roster data; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "email",
|                                             "DisplayName":  "View users\u0027 email address",
|                                             "Description":  "Allows the app to read your users\u0027 primary email address",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to user\u0027s primary email address only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EngagementConversation.Migration.All",
|                                             "DisplayName":  "Read and write all Viva Engage conversations",
|                                             "Description":  "Allows the app to create Viva Engage conversations without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application create access to Viva Engage conversations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EngagementConversation.Read.All",
|                                             "DisplayName":  "Read all Viva Engage conversations",
|                                             "Description":  "Allows the app to list Viva Engage conversations, and to read their properties without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to Viva Engage conversations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EngagementConversation.ReadWrite.All",
|                                             "DisplayName":  "Read and write all Viva Engage conversations",
|                                             "Description":  "Allows the app to create Viva Engage conversations, read all conversation properties, update conversation properties, and delete conversations without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application full control of Viva Engage conversations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EngagementExport.Read.All",
|                                             "DisplayName":  "Export Viva Engage data",
|                                             "Description":  "Allows the app to export Viva Engage data for compliance, GDPR, and admin scenarios without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application export access to Viva Engage data; data exfiltration risk only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EngagementMeetingConversation.Read.All",
|                                             "DisplayName":  "Read all Viva Engage Teams QA conversations",
|                                             "Description":  "Allows the app to list Viva Engage Teams QA conversations, and to read their properties without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to Viva Engage Teams QA conversations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EngagementRole.Read",
|                                             "DisplayName":  "Read a user\u0027s Viva Engage roles ",
|                                             "Description":  "Allows the app to list a user\u0027s Viva Engage roles, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to user\u0027s Viva Engage roles; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EngagementRole.Read.All",
|                                             "DisplayName":  "Read all Viva Engage roles and role memberships",
|                                             "Description":  "Allows the app to list all Viva Engage roles and role memberships on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to all Viva Engage roles; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EngagementRole.ReadWrite.All",
|                                             "DisplayName":  "Modify Viva Engage role membership",
|                                             "Description":  "Allows the app to assign Viva Engage role to a user, and remove a Viva Engage role from a user behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated role assignment/removal for Viva Engage roles; no identity plane control or tenant takeover path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EnterpriseResource.Read",
|                                             "DisplayName":  "Read user project enterprise resources",
|                                             "Description":  "Allows the app to read the current user\u0027s enterprise resources.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to user\u0027s enterprise resources; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EnterpriseResource.Write",
|                                             "DisplayName":  "Read and write user project enterprise resources",
|                                             "Description":  "Allows the app to read, create, update, and delete the current user’s enterprise resources.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated write access to user\u0027s enterprise resources; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EntitlementManagement.Read.All",
|                                             "DisplayName":  "Read all entitlement management resources",
|                                             "Description":  "Allows the app to read access packages and related entitlement management resources on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to access packages; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EntitlementManagement.ReadWrite.All",
|                                             "DisplayName":  "Read and write entitlement management resources",
|                                             "Description":  "Allows the app to request access to and management of access packages and related entitlement management resources on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated manage access packages on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EntitlementMgmt-SubjectAccess.ReadWrite",
|                                             "DisplayName":  "Read and write entitlement management resources related to self-service operations",
|                                             "Description":  "Allows the app to manage self-service entitlement management resources on behalf of the signed-in user.  This includes operations such as requesting access and approving access of others.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated self-service entitlement management; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EntraBackup.Read.All",
|                                             "DisplayName":  "Read Preview jobs and snapshots",
|                                             "Description":  "Allows the app to list the all the snapshots, jobs and enumerate the changes of a specific preview job, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to backup snapshots and jobs; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EntraBackup.ReadWrite.Preview",
|                                             "DisplayName":  "Create a preview job, read preview job and snapshots",
|                                             "Description":  "Allows the app to  list the all the snapshots, create a preview job and enumerate the changes of a specific preview job, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated create and read preview backup jobs; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EntraBackup.ReadWrite.Recovery",
|                                             "DisplayName":  "Create preview and recovery job, read recovery job and snapshots",
|                                             "Description":  "Allows the app to  list the all the snapshots, create a recovery job and enumerate the changes of a specific recovery job, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated create and read recovery backup jobs; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Environment.Execute.All",
|                                             "DisplayName":  "Environment.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated execute permission in Power BI; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Environment.Read.All",
|                                             "DisplayName":  "Read environment items",
|                                             "Description":  "Allows reading environment items on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to Power BI environment items; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Environment.ReadWrite.All",
|                                             "DisplayName":  "Read and write environment items",
|                                             "Description":  "Allows modifying environment items on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated modify access to Power BI environment items; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Environment.Reshare.All",
|                                             "DisplayName":  "Environment.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated reshare permission in Power BI; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "EopDataInsights.AccessAsApp",
|                                             "DisplayName":  "EopDataInsights.AccessAsApp",
|                                             "Description":  "EopDataInsights.AccessAsApp",
|                                             "Tier":  3,
|                                             "Reason":  "Application access to data insights; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Eventhouse.Execute.All",
|                                             "DisplayName":  "Eventhouse.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated execute permission in Power BI; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Eventhouse.Read.All",
|                                             "DisplayName":  "Read eventhouses",
|                                             "Description":  "Allows reading eventhouses on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to eventhouses; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Eventhouse.ReadWrite.All",
|                                             "DisplayName":  "Read and write eventhouses",
|                                             "Description":  "Allows modifying eventhouses on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated modify access to eventhouses; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Eventhouse.Reshare.All",
|                                             "DisplayName":  "Eventhouse.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated reshare permission in Power BI; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EventListener.Read.All",
|                                             "DisplayName":  "Read your organization\u0027s authentication event listeners",
|                                             "Description":  "Allows the app to read your organization\u0027s authentication event listeners on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to authentication event listeners; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Eventstream.Execute.All",
|                                             "DisplayName":  "Eventstream.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated execute permission in Power BI; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Eventstream.Read.All",
|                                             "DisplayName":  "Read eventstreams",
|                                             "Description":  "Allows reading eventstreams on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to eventstreams; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Eventstream.ReadWrite.All",
|                                             "DisplayName":  "Read and write eventstreams",
|                                             "Description":  "Allows modifying eventstreams on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated modify access to eventstreams; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Eventstream.Reshare.All",
|                                             "DisplayName":  "Eventstream.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated reshare permission in Power BI; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "EWS.AccessAsUser.All",
|                                             "DisplayName":  "Access mailboxes as the signed-in user via Exchange Web Services",
|                                             "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via Exchange Web Services.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated mailbox access as signed-in user; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ExchangeMessageTrace.Read.All",
|                                             "DisplayName":  "Search the email message trace",
|                                             "Description":  "Allows the app to search the email message trace on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to email message trace; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ExternalConnection.Read.All",
|                                             "DisplayName":  "Read all external connections",
|                                             "Description":  "Allows the app to read all external connections without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to external connections; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ExternalConnection.ReadWrite.All",
|                                             "DisplayName":  "Read and write all external connections",
|                                             "Description":  "Allows the app to read and write all external connections without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read/write access to external connections; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ExternalConnection.ReadWrite.OwnedBy",
|                                             "DisplayName":  "Read and write external connections",
|                                             "Description":  "Allows the app to read and write settings of external connections on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read and write settings of connections that it is authorized to.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows read/write of external connection settings limited to authorized connections; no direct identity plane control or privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ExternalDataShare.Accept.All",
|                                             "DisplayName":  "Allows the app to accept the external data share invitation",
|                                             "Description":  "Allows the app to accept the external data share invitation on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows accepting external data share invitations on behalf of user; no path to identity plane or tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ExternalItem.Read.All",
|                                             "DisplayName":  "Read items in external datasets",
|                                             "Description":  "Allow the app to read external datasets and content, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to external datasets on behalf of user; no identity plane control or privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ExternalItem.ReadWrite.All",
|                                             "DisplayName":  "Read and write all external items",
|                                             "Description":  "Allows the app to read and write all external items on behalf of a signed-in user. The signed-in user must be an administrator.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to external items on behalf of admin user but no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ExternalItem.ReadWrite.OwnedBy",
|                                             "DisplayName":  "Read and write external items",
|                                             "Description":  "Allows the app to read and write external items without a signed-in user. The app can only read external items of the connection that it is authorized to.",
|                                             "Tier":  3,
|                                             "Reason":  "App-only read/write access limited to authorized external items; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ExternalUserProfile.Read.All",
|                                             "DisplayName":  "Read external user profiles",
|                                             "Description":  "Allows the app to read available properties of external user profiles, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to external user profiles on behalf of user; no path to identity plane or tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ExternalUserProfile.ReadWrite.All",
|                                             "DisplayName":  "Read and write external user profiles",
|                                             "Description":  "Allows the app to read and write available properties of external user profiles, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to external user profiles on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Fabric.Embed",
|                                             "DisplayName":  "Embed Fabric items, retrieve user identifiers and restricted metadata",
|                                             "Description":  "Allows retrieving item definitions, user identifiers, and other restricted metadata required for embedding Fabric items on the user’s behalf. To embed, the app must also be granted the appropriate contextual scope(s), such as Item.Read.All, Notebook.Read.All, or Workspace.Read.All.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows embedding Fabric items on behalf of user; no identity plane control or privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Fabric.Extend",
|                                             "DisplayName":  "Extend Fabric with new item types",
|                                             "Description":  "Allows the app to extend Fabric with new item types and have restricted access to Fabric items, user identifiers and other metadata, on behalf of the signed-in user. Protecting exports with sensitivity labels, enforcement of regional boundaries and some other Fabric capabilities are not available to partner items.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows extending Fabric with new item types on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Fabric.Extend.IframeSandbox",
|                                             "DisplayName":  "Run partner Fabric items in iframes with relaxed sandbox protection.",
|                                             "Description":  "Allow partner Fabric items managed by this app to run in iframes with the relaxed sandbox enabling additional operations.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows partner Fabric items to run in relaxed sandbox iframes; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Family.Read",
|                                             "DisplayName":  "Read your family info",
|                                             "Description":  "Allows the app to read your family information, members and their basic profile.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to family info and profiles; no path to identity plane or tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "FileIngestion.Ingest",
|                                             "DisplayName":  "Ingest SharePoint and OneDrive content to make it available in the search index",
|                                             "Description":  "Allows the app to ingest SharePoint and OneDrive content to make it available in the search index, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows ingestion of SharePoint and OneDrive content for search indexing; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "FileIngestionHybridOnboarding.Manage",
|                                             "DisplayName":  "Manage onboarding for a Hybrid Cloud tenant",
|                                             "Description":  "Allows the app to manage onboarding for a Hybrid Cloud tenant, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage onboarding for Hybrid Cloud tenant without signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Files.Read",
|                                             "DisplayName":  "Read user files",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s files.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to signed-in user\u0027s files only; no identity plane control or privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Files.Read.All",
|                                             "DisplayName":  "Read all files that user can access",
|                                             "Description":  "Allows the app to read all files the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all files user can access; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Files.Read.Selected",
|                                             "DisplayName":  "Read files that the user selects (preview)",
|                                             "Description":  "(Preview) Allows the app to read files that the user selects. The app has access for several hours after the user selects a file.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to user-selected files only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Files.ReadWrite",
|                                             "DisplayName":  "Have full access to user files",
|                                             "Description":  "Allows the app to read, create, update and delete the signed-in user\u0027s files.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to signed-in user\u0027s files only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Files.ReadWrite.All",
|                                             "DisplayName":  "Read and write files in all site collections",
|                                             "Description":  "Allows the app to read, create, update and delete all files in all site collections without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "App-only read/write access to all files in all site collections; no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Files.ReadWrite.AppFolder",
|                                             "DisplayName":  "Have full access to the application\u0027s folder (preview)",
|                                             "Description":  "(Preview) Allows the app to read, create, update and delete files in the application\u0027s folder.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access limited to app\u0027s folder; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Files.ReadWrite.Selected",
|                                             "DisplayName":  "Read and write files that the user selects (preview)",
|                                             "Description":  "(Preview) Allows the app to read and write files that the user selects. The app has access for several hours after the user selects a file.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to user-selected files only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Files.SelectedOperations.Selected",
|                                             "DisplayName":  "Access selected Files, on behalf of the signed-in user",
|                                             "Description":  "Allow the application to access files explicitly permissioned to the application on behalf of the signed in user.  The specific files and the permissions granted will be configured in SharePoint Online or OneDrive.",
|                                             "Tier":  3,
|                                             "Reason":  "Access limited to explicitly permissioned files; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "FileStorageContainer.Manage.All",
|                                             "DisplayName":  "Manage all file storage containers",
|                                             "Description":  "Allows the application to utilize the file storage container administration capabilities on behalf of an administrator user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows file storage container administration on behalf of admin user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "FileStorageContainer.Selected",
|                                             "DisplayName":  "Access selected file storage containers",
|                                             "Description":  "Allows the application to utilize the file storage container platform to manage containers, without a signed-in user. The specific file storage containers and the permissions granted to them will be configured in Microsoft 365 by the developer of each container type.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage file storage containers without signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "FileStorageContainerType.Manage.All",
|                                             "DisplayName":  "Manage file storage container types on behalf of the signed in user",
|                                             "Description":  "Allows the application to manage file storage container types on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage file storage container types on behalf of SharePoint Embedded or Global Admin; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "FileStorageContainerTypeReg.Manage.All",
|                                             "DisplayName":  "Manage file storage container type registrations on behalf of the signed in user",
|                                             "Description":  "Allows the application to manage file storage container type registrations on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage file storage container type registrations on behalf of SharePoint Embedded or Global Admin; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "FileStorageContainerTypeReg.Selected",
|                                             "DisplayName":  "Access selected file storage container type registrations.",
|                                             "Description":  "Allows the application to manage selected file storage container type registrations on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage selected file storage container type registrations on behalf of SharePoint Embedded or Global Admin; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Financials.ReadWrite.All",
|                                             "DisplayName":  "Read and write financials data",
|                                             "Description":  "Allows the app to read and write financials data on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write financial data on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Gateway.Read.All",
|                                             "DisplayName":  "View all gateways",
|                                             "Description":  "The app can view all gateways that the signed in user is an admin of.",
|                                             "Tier":  3,
|                                             "Reason":  "View gateways where user is admin; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Gateway.ReadWrite.All",
|                                             "DisplayName":  "Read and write all gateways",
|                                             "Description":  "The app can view and edit all gateways that the signed in user is an admin of.",
|                                             "Tier":  3,
|                                             "Reason":  "View and edit gateways where user is admin; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Goals-Export.Read.All",
|                                             "DisplayName":  "Read all goals and export jobs that a user can access",
|                                             "Description":  "Allows the app to read all goals and export jobs that the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Read goals and export jobs user can access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Goals-Export.ReadWrite.All",
|                                             "DisplayName":  "Have full access to all goals and export jobs a user can access",
|                                             "Description":  "Allows the app to read goals, create and read export jobs that the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and create export jobs user can access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphInstance.Execute.All",
|                                             "DisplayName":  "Execute graph instances",
|                                             "Description":  "Allows executing graph instances on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute graph instances on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphInstance.Read.All",
|                                             "DisplayName":  "Read graph instances",
|                                             "Description":  "Allows reading graph instances on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read graph instances on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphInstance.ReadWrite.All",
|                                             "DisplayName":  "Read and write graph instances",
|                                             "Description":  "Allows modifying graph instances on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify graph instances on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphInstance.Reshare.All",
|                                             "DisplayName":  "GraphInstance.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but likely limited to resharing graph instances; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphQL.Execute.All",
|                                             "DisplayName":  "Make API calls that executes requests on all API for GraphQL items",
|                                             "Description":  "Allows the app to make API calls that executes requests on all API for GraphQL items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute GraphQL API calls on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphQLApi.Execute.All",
|                                             "DisplayName":  "Execute GraphQLApis",
|                                             "Description":  "Allows executing GraphQLApis on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute GraphQL APIs on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphQLApi.Read.All",
|                                             "DisplayName":  "Read GraphQLApis",
|                                             "Description":  "Allows reading GraphQLApis on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read GraphQL APIs on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphQLApi.ReadWrite.All",
|                                             "DisplayName":  "Read and write GraphQLApis",
|                                             "Description":  "Allows modifying GraphQLApis on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify GraphQL APIs on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GraphQLApi.Reshare.All",
|                                             "DisplayName":  "GraphQLApi.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but likely limited to resharing GraphQL APIs; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Group.Create",
|                                             "DisplayName":  "Create groups",
|                                             "Description":  "Allows the app to create groups without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows app to create groups without signed-in user; no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Group.Read.All",
|                                             "DisplayName":  "Read all groups",
|                                             "Description":  "Allows the app to list groups, and to read their properties and all group memberships on behalf of the signed-in user.  Also allows the app to read calendar, conversations, files, and other group content for all groups the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Read groups and memberships user can access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Group.ReadWrite.All",
|                                             "DisplayName":  "Read and write all groups",
|                                             "Description":  "Allows the app to create groups and read all group properties and memberships on behalf of the signed-in user.  Additionally allows group owners to manage their groups and allows group members to update group content.",
|                                             "Tier":  3,
|                                             "Reason":  "Create and manage groups on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Group-Conversation.Read.All",
|                                             "DisplayName":  "Read group conversations",
|                                             "Description":  "Allows the app to read group conversations that the signed-in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read group conversations user can access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Group-Conversation.ReadWrite.All",
|                                             "DisplayName":  "Read and write group conversations",
|                                             "Description":  "Allows the app to read and write group conversations that the signed-in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write group conversations user can access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GroupMember.Read.All",
|                                             "DisplayName":  "Read group memberships",
|                                             "Description":  "Allows the app to list groups, read basic group properties and read membership of all groups the signed-in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read group memberships user can access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "GroupMember.ReadWrite.All",
|                                             "DisplayName":  "Read and write all group memberships",
|                                             "Description":  "Allows the app to list groups, read basic properties, read and update the membership of the groups this app has access to without a signed-in user. Group properties and owners cannot be updated and groups cannot be deleted.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update group memberships app has access to; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Group-NestingSupport.ReadWrite.All",
|                                             "DisplayName":  "Read and write groups\u0027 disableNesting property",
|                                             "Description":  "Allows the app to read and write groups\u0027 disableNesting property without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write groups\u0027 disableNesting property; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Group-OnPremisesSyncBehavior.ReadWrite.All",
|                                             "DisplayName":  "Read and update the on-premises sync behavior of groups",
|                                             "Description":  "Allows the app to read and update the on-premises sync behavior of groups on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update on-premises sync behavior of groups; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GroupSettings.Read.All",
|                                             "DisplayName":  "Read all group settings that user can access",
|                                             "Description":  "Allows the app to read a list of tenant-level or group-specific group settings objects, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to group settings only; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "GroupSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and write all group settings that user can access",
|                                             "Description":  "Allows the app to create, read, update, and delete on the list of tenant-level or group-specific group settings objects that you have access to in the organization, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to group settings only; no direct or near-direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "HealthMonitoringAlert.Read.All",
|                                             "DisplayName":  "Read all scenario health monitoring alerts",
|                                             "Description":  "Allows the app to read all scenario health monitoring alerts",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to health monitoring alerts; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "HealthMonitoringAlert.ReadWrite.All",
|                                             "DisplayName":  "Read and write all scenario monitoring alerts",
|                                             "Description":  "Allows the app to read and write all scenario monitoring alerts, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to health monitoring alerts; no direct identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "HealthMonitoringAlertConfig.Read.All",
|                                             "DisplayName":  "Read all scenario health monitoring alert configurations",
|                                             "Description":  "Allows the app to read all scenario health monitoring alert configurations",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to health monitoring alert configurations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "HealthMonitoringAlertConfig.ReadWrite.All",
|                                             "DisplayName":  "Read and write all scenario monitoring alert configurations.",
|                                             "Description":  "Allows the app to read and write all scenario monitoring alert configurations, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to alert configurations; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IdentityRiskEvent.Read.All",
|                                             "DisplayName":  "Read all identity risk event information",
|                                             "Description":  "Allows the app to read the identity risk event information for your organization without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to identity risk events; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IdentityRiskEvent.ReadWrite.All",
|                                             "DisplayName":  "Read and write all risk detection information",
|                                             "Description":  "Allows the app to read and update identity risk detection information for your organization without a signed-in user. Update operations include confirming risk event detections. ",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to risk event info but cannot assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IdentityRiskyAgent.Read.All",
|                                             "DisplayName":  "Read all risky agents information",
|                                             "Description":  "Allows the app to read the risky agents information in your organization without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to risky agents; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IdentityRiskyAgent.ReadWrite.All",
|                                             "DisplayName":  "Read and write risky agents information",
|                                             "Description":  "Allows the app to read and update identity risky agents information for all agents in your organization on behalf of the signed-in user. Update operations include dismissing risky agents.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to risky agents but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IdentityRiskyServicePrincipal.Read.All",
|                                             "DisplayName":  "Read all identity risky service principal information",
|                                             "Description":  "Allows the app to read all identity risky service principal information for your organization, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to risky service principals; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IdentityRiskyServicePrincipal.ReadWrite.All",
|                                             "DisplayName":  "Read and write all identity risky service principal information",
|                                             "Description":  "Allows the app to read and update identity risky service principal for your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to risky service principals but no direct role assignment or credential reset rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IdentityRiskyUser.Read.All",
|                                             "DisplayName":  "Read identity risky user information",
|                                             "Description":  "Allows the app to read identity risky user information for all users in your organization on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to risky user info; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IdentityRiskyUser.ReadWrite.All",
|                                             "DisplayName":  "Read and write all risky user information",
|                                             "Description":  "Allows the app to read and update identity risky user information for your organization without a signed-in user.  Update operations include dismissing risky users.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to risky user info but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IdentityUserFlow.Read.All",
|                                             "DisplayName":  "Read all identity user flows",
|                                             "Description":  "Allows the app to read your organization\u0027s user flows, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to user flows; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IdentityUserFlow.ReadWrite.All",
|                                             "DisplayName":  "Read and write all identity user flows",
|                                             "Description":  "Allows the app to read or write your organization\u0027s user flows, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to user flows but no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IMAP.AccessAsUser.All",
|                                             "DisplayName":  "Read and write access to mailboxes via IMAP.",
|                                             "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via IMAP protocol.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated IMAP access scoped to signed-in user; no tenant-wide impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IndustryData.ReadBasic.All",
|                                             "DisplayName":  "View basic service and resource information",
|                                             "Description":  "Allows the app to read basic service and resource information without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to basic service/resource info; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-DataConnector.Read.All",
|                                             "DisplayName":  "View data connector definitions",
|                                             "Description":  "Allows the app to read data connectors on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to data connectors; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-DataConnector.ReadWrite.All",
|                                             "DisplayName":  "Manage data connector definitions",
|                                             "Description":  "Allows the app to read and write data connectors on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to data connectors but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IndustryData-DataConnector.Upload",
|                                             "DisplayName":  "Upload files to a data connector",
|                                             "Description":  "Allows the app to upload data files to a data connector without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Upload access to data connectors; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-InboundFlow.Read.All",
|                                             "DisplayName":  "View inbound flow definitions",
|                                             "Description":  "Allows the app to read inbound data flows on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to inbound data flows; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-InboundFlow.ReadWrite.All",
|                                             "DisplayName":  "Manage inbound flow definitions",
|                                             "Description":  "Allows the app to read and write inbound data flows on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to inbound data flows; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-OutboundFlow.Read.All",
|                                             "DisplayName":  "View outbound flow definitions",
|                                             "Description":  "Allows the app to read outbound data flows on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to outbound data flows; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-OutboundFlow.ReadWrite.All",
|                                             "DisplayName":  "Manage outbound flow definitions",
|                                             "Description":  "Allows the app to read and write outbound data flows on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to outbound data flows; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-ReferenceDefinition.Read.All",
|                                             "DisplayName":  "View reference definitions",
|                                             "Description":  "Allows the app to read reference definitions on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to reference definitions; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-ReferenceDefinition.ReadWrite.All",
|                                             "DisplayName":  "Manage reference definitions",
|                                             "Description":  "Allows the app to read and write reference definitions on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to reference definitions; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IndustryData-Run.Read.All",
|                                             "DisplayName":  "View current and previous runs",
|                                             "Description":  "Allows the app to read current and previous IndustryData runs without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to IndustryData runs; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-Run.Start",
|                                             "DisplayName":  "View and start runs",
|                                             "Description":  "Allows the app to view and start IndustryData runs on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to start IndustryData runs; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IndustryData-SourceSystem.Read.All",
|                                             "DisplayName":  "View source system definitions",
|                                             "Description":  "Allows the app to read source system definitions without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to source system definitions; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-SourceSystem.ReadWrite.All",
|                                             "DisplayName":  "Manage source system definitions",
|                                             "Description":  "Allows the app to read and write source system definitions on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to source system definitions; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "IndustryData-TimePeriod.Read.All",
|                                             "DisplayName":  "Read time period definitions",
|                                             "Description":  "Allows the app to read time period definitions on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to time period definitions; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "IndustryData-TimePeriod.ReadWrite.All",
|                                             "DisplayName":  "Manage time period definitions",
|                                             "Description":  "Allows the app to read and write time period definitions without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to time period definitions; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "InformationProtectionConfig.Read",
|                                             "DisplayName":  "Read configurations for protecting organizational data applicable to the user",
|                                             "Description":  "Allows the app to read the configurations applicable to the signed-in user for protecting organizational data, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to data protection configurations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "InformationProtectionConfig.Read.All",
|                                             "DisplayName":  "Read all configurations for protecting organizational data applicable to users",
|                                             "Description":  "Allows the app to read all configurations applicable to users for protecting organizational data, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to all data protection configurations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "InformationProtectionContent.Sign.All",
|                                             "DisplayName":  "Sign digests for data",
|                                             "Description":  "Allows an app to sign digests for data without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to sign data digests; no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "InformationProtectionContent.Write.All",
|                                             "DisplayName":  "Create protected content",
|                                             "Description":  "Allows the app to create protected content without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to create protected content; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "InformationProtectionPolicy.Read",
|                                             "DisplayName":  "Read user sensitivity labels and label policies.",
|                                             "Description":  "Allows an app to read information protection sensitivity labels and label policy settings, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to sensitivity labels and policies; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "InformationProtectionPolicy.Read.All",
|                                             "DisplayName":  "Read all published labels and label policies for an organization.",
|                                             "Description":  "Allows an app to read published sensitivity labels and label policy settings for the entire organization or a specific user, without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to published sensitivity labels and policies; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "InsiderRiskData.Read.All",
|                                             "DisplayName":  "InsiderRiskData.Read.All",
|                                             "Description":  "InsiderRiskData.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to insider risk data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Insights-UserMetric.Read.All",
|                                             "DisplayName":  "Read user metrics insights",
|                                             "Description":  "Allows an app to read user metrics insights, such as daily and monthly active users, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to user metrics; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Item.Audit.All",
|                                             "DisplayName":  "Make API calls that require audit permissions on all items",
|                                             "Description":  "Allows the app to make API calls that require audit permissions on all items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Audit permissions on items; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Item.Execute.All",
|                                             "DisplayName":  "Make API calls that require execute permissions on all Fabric items",
|                                             "Description":  "Allows the app to make API calls that require execute permissions on all Fabric items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute permissions on items; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Item.ExternalDataShare.All",
|                                             "DisplayName":  "Allows the app to create and manage external data shares for all Fabric items",
|                                             "Description":  "Allows the app to create and manage external data shares for all Fabric items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage external data shares; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Item.Read.All",
|                                             "DisplayName":  "Make API calls that require read permissions on all Fabric items",
|                                             "Description":  "Allows the app to make API calls that require read permissions on all Fabric items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read permissions on items; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Item.ReadWrite.All",
|                                             "DisplayName":  "Make API calls that require read and write permissions on all Fabric items",
|                                             "Description":  "Allows the app to make API calls that require read and write permissions on all Fabric items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write permissions on items; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Item.Reshare.All",
|                                             "DisplayName":  "Make API calls that require reshare permissions on all Fabric items",
|                                             "Description":  "Allows the app to make API calls that require reshare permissions on all Fabric items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare permissions on items; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ItemMetadata.Read.All",
|                                             "DisplayName":  "Make API calls that can read item metadata for all Fabric items",
|                                             "Description":  "Allows the app to make API calls that can read the item metadata of all Fabric items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to item metadata on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ItemMetadata.ReadWrite.All",
|                                             "DisplayName":  "Make API calls that can read and write item metadata for all Fabric items",
|                                             "Description":  "Allows the app to make API calls that can read and write the item metadata of all Fabric items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to item metadata on behalf of the signed-in user; no direct identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDashboard.Execute.All",
|                                             "DisplayName":  "KQLDashboard.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Execute permission on dashboards on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDashboard.Read.All",
|                                             "DisplayName":  "Read KQL dashboards",
|                                             "Description":  "Allows reading KQL dashboards on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to dashboards on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDashboard.ReadWrite.All",
|                                             "DisplayName":  "Read and write KQL dashboards",
|                                             "Description":  "Allows modifying KQL dashboards on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify dashboards on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDashboard.Reshare.All",
|                                             "DisplayName":  "KQLDashboard.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare permission on dashboards on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDatabase.Execute.All",
|                                             "DisplayName":  "Execute KQL databases",
|                                             "Description":  "Allows executing KQL databases on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute permission on databases on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDatabase.ExternalDataShare.All",
|                                             "DisplayName":  "Allows the app to create and manage external data shares for all KQL databases",
|                                             "Description":  "Allows the app to create and manage external data shares for all KQL databases, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage external data shares on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDatabase.Read.All",
|                                             "DisplayName":  "Read KQL databases",
|                                             "Description":  "Allows reading KQL databases on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to databases on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDatabase.ReadWrite.All",
|                                             "DisplayName":  "Read and write KQL databases",
|                                             "Description":  "Allows modifying KQL databases on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify databases on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDatabase.Reshare.All",
|                                             "DisplayName":  "KQLDatabase.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare permission on databases on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDataConnection.Execute.All",
|                                             "DisplayName":  "KQLDataConnection.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Execute permission on data connections on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDataConnection.Read.All",
|                                             "DisplayName":  "Make API calls that require read permissions on all KQL data connections",
|                                             "Description":  "Allows the app to make API calls that require read permissions on all KQL data connections, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to data connections on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDataConnection.ReadWrite.All",
|                                             "DisplayName":  "Make API calls that require read and write permissions on and write all KQL data connections",
|                                             "Description":  "Allows the app to make API calls that require read and write permissions on all KQL data connections, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify data connections on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLDataConnection.Reshare.All",
|                                             "DisplayName":  "KQLDataConnection.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare permission on data connections on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLQueryset.Execute.All",
|                                             "DisplayName":  "KQLQueryset.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Execute permission on querysets on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLQueryset.Read.All",
|                                             "DisplayName":  "Read KQL querysets",
|                                             "Description":  "Allows reading KQL querysets on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to querysets on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLQueryset.ReadWrite.All",
|                                             "DisplayName":  "Read and write KQL querysets",
|                                             "Description":  "Allows modifying KQL querysets on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify querysets on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "KQLQueryset.Reshare.All",
|                                             "DisplayName":  "KQLQueryset.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare permission on querysets on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LabelAnalyticsActivityData.Read.All",
|                                             "DisplayName":  "LabelAnalyticsActivityData.Read.All",
|                                             "Description":  "LabelAnalyticsActivityData.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to label analytics activity data; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Lakehouse.Execute.All",
|                                             "DisplayName":  "Execute lakehouses",
|                                             "Description":  "Allows executing lakehouses on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute permission on lakehouses on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Lakehouse.ExternalDataShare.All",
|                                             "DisplayName":  "Allows the app to create and manage external data shares for all lakehouses",
|                                             "Description":  "Allows the app to create and manage external data shares for all lakehouses, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage external data shares on lakehouses on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Lakehouse.Read.All",
|                                             "DisplayName":  "Read lakehouses",
|                                             "Description":  "Allows reading lakehouses on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to lakehouses on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Lakehouse.ReadWrite.All",
|                                             "DisplayName":  "Read and write lakehouses",
|                                             "Description":  "Allows modifying lakehouses on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify lakehouses on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Lakehouse.Reshare.All",
|                                             "DisplayName":  "Lakehouse.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare permission on lakehouses on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LearningAssignedCourse.Read",
|                                             "DisplayName":  "Read user\u0027s assignments",
|                                             "Description":  "Allows the app to read data for the learner\u0027s assignments in the organization\u0027s directory, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to learner\u0027s assignments on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "LearningAssignedCourse.Read.All",
|                                             "DisplayName":  "Read all assignments",
|                                             "Description":  "Allows the app to read data for all assignments in the organization\u0027s directory, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all assignments without a signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "LearningAssignedCourse.ReadWrite.All",
|                                             "DisplayName":  "Read and write all assignments",
|                                             "Description":  "Allows the app to create, update, read and delete all assignments in the organization\u0027s directory, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage all assignments without a signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LearningContent.Read.All",
|                                             "DisplayName":  "Read learning content",
|                                             "Description":  "Allows the app to read learning content in the organization\u0027s directory, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to learning content on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "LearningContent.ReadWrite.All",
|                                             "DisplayName":  "Manage all learning content",
|                                             "Description":  "Allows the app to manage all learning content in the organization\u0027s directory, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage learning content without a signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LearningProvider.Read",
|                                             "DisplayName":  "Read learning provider",
|                                             "Description":  "Allows the app to read data for the learning provider in the organization\u0027s directory, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to learning provider data on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LearningProvider.ReadWrite",
|                                             "DisplayName":  "Manage learning provider",
|                                             "Description":  "Allows the app to create, update, read, and delete data for the learning provider in the organization\u0027s directory, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage learning provider data on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LearningSelfInitiatedCourse.Read",
|                                             "DisplayName":  "Read user\u0027s self-initiated courses",
|                                             "Description":  "Allows the app to read data for the learner\u0027s self-initiated courses in the organization\u0027s directory, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to learner\u0027s self-initiated courses on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "LearningSelfInitiatedCourse.Read.All",
|                                             "DisplayName":  "Read all self-initiated courses",
|                                             "Description":  "Allows the app to read data for all self-initiated courses in the organization\u0027s directory, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all self-initiated courses without a signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "LearningSelfInitiatedCourse.ReadWrite.All",
|                                             "DisplayName":  "Read and write all self-initiated courses",
|                                             "Description":  "Allows the app to create, update, read and delete all self-initiated courses in the organization\u0027s directory, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage all self-initiated courses without a signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LicenseAssignment.Read.All",
|                                             "DisplayName":  "Read all license assignments.",
|                                             "Description":  "Allows an app to read license assignments for users and groups, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read license assignments on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LicenseAssignment.ReadWrite.All",
|                                             "DisplayName":  "Manage all license assignments",
|                                             "Description":  "Allows an app to manage license assignments for users and groups, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage license assignments on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LifecycleWorkflows.Read.All",
|                                             "DisplayName":  "Read all lifecycle workflows resources",
|                                             "Description":  "Allows the app to list and read all workflows, tasks and related lifecycle workflows resources on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read lifecycle workflows on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LifecycleWorkflows.ReadWrite.All",
|                                             "DisplayName":  "Read and write all lifecycle workflows resources",
|                                             "Description":  "Allows the app to create, update, list, read and delete all workflows, tasks and related lifecycle workflows resources on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage lifecycle workflows on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LifecycleWorkflows-CustomExt.Read.All",
|                                             "DisplayName":  "Read all Lifecycle workflows custom task extensions",
|                                             "Description":  "Allows the app to read all Lifecycle workflows custom task extensions on behalf of a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read lifecycle workflows custom task extensions on behalf of the signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LifecycleWorkflows-CustomExt.ReadWrite.All",
|                                             "DisplayName":  "Read and write all Lifecycle workflows custom task extensions",
|                                             "Description":  "Allows the app to create, update, list, read and delete all Lifecycle workflows custom task extensions on behalf of a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage lifecycle workflows custom task extensions on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "LifecycleWorkflows-Reports.Read.All",
|                                             "DisplayName":  "Read all Lifecycle workflows reports",
|                                             "Description":  "Allows the app to read all Lifecycle workflows reports without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read lifecycle workflows reports without a signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LifecycleWorkflows-Workflow.Activate",
|                                             "DisplayName":  "Run workflows on-demand in Lifecycle workflows",
|                                             "Description":  "Allows the app to run workflows on-demand on behalf of a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Run workflows on behalf of the signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "LifecycleWorkflows-Workflow.Read.All",
|                                             "DisplayName":  "Read all workflows in Lifecycle workflows",
|                                             "Description":  "Allows the app to list and read all workflows and tasks on behalf of a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read workflows and tasks on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "LifecycleWorkflows-Workflow.ReadBasic.All",
|                                             "DisplayName":  "List all workflows in Lifecycle workflows",
|                                             "Description":  "Allows the app to list all workflows without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "List workflows without a signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "LifecycleWorkflows-Workflow.ReadWrite.All",
|                                             "DisplayName":  "Read and write all workflows in Lifecycle workflows",
|                                             "Description":  "Allows the app to create, update, list, read and delete all workflows and tasks in lifecycle workflows without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage workflows and tasks without a signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ListItems.SelectedOperations.Selected",
|                                             "DisplayName":  "Access selected ListItems, on behalf of the signed-in user",
|                                             "Description":  "Allow the application to access a subset of listitems on behalf of the signed in user.  The specific listitems and the permissions granted will be configured in SharePoint Online.",
|                                             "Tier":  3,
|                                             "Reason":  "Access to a subset of list items on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Lists.SelectedOperations.Selected",
|                                             "DisplayName":  "Access selected Lists, on behalf of the signed-in user",
|                                             "Description":  "Allow the application to access a subset of lists on behalf of the signed in user.  The specific lists and the permissions granted will be configured in SharePoint Online.",
|                                             "Tier":  3,
|                                             "Reason":  "Access to a subset of lists on behalf of the signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "M365ContentExplorer.Read.All",
|                                             "DisplayName":  "M365ContentExplorer.Read.All",
|                                             "Description":  "M365ContentExplorer.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to M365 content explorer data without a signed-in user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.ReadBasic",
|                                             "DisplayName":  "Read user basic mail",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s mailbox except body, previewBody, attachments and any extended properties.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access limited to signed-in user\u0027s mailbox excluding sensitive parts; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.ReadBasic.Shared",
|                                             "DisplayName":  "Read user and shared basic mail",
|                                             "Description":  "Allows the app to read mail the signed-in user can access, including their own and shared mail, except for body, bodyPreview, uniqueBody, attachments, extensions, and any extended properties.",
|                                             "Tier":  3,
|                                             "Reason":  "Read basic mail properties for signed-in user and shared mail; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.Send",
|                                             "DisplayName":  "Send mail as a user",
|                                             "Description":  "Allows the app to send mail as users in the organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Send mail as user only; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.Send.All",
|                                             "DisplayName":  "Send mail on behalf of others",
|                                             "Description":  "Allows the app to send mail as the signed-in user, including sending on-behalf of others.",
|                                             "Tier":  3,
|                                             "Reason":  "Send mail as signed-in user including on-behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Mail.Send.Shared",
|                                             "DisplayName":  "Send mail on behalf of others",
|                                             "Description":  "Allows the app to send mail as the signed-in user, including sending on-behalf of others.",
|                                             "Tier":  3,
|                                             "Reason":  "Send mail as signed-in user on shared mail; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailboxConfigItem.Read",
|                                             "DisplayName":  "Read all users\u0027 UserConfiguration objects",
|                                             "Description":  "Allows the app to read all users\u0027 UserConfiguration objects.",
|                                             "Tier":  3,
|                                             "Reason":  "Read user configuration objects only; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailboxConfigItem.ReadWrite",
|                                             "DisplayName":  "Read and write all users\u0027 UserConfiguration objects",
|                                             "Description":  "Allows the app to create, read, update and delete all users\u0027 UserConfiguration objects.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify user configuration objects only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MailboxFolder.Read",
|                                             "DisplayName":  "Read a user\u0027s mailbox folders",
|                                             "Description":  "Allows the app to read the user\u0027s mailbox folders, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read mailbox folders for signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MailboxFolder.ReadWrite",
|                                             "DisplayName":  "Read and write a user\u0027s mailbox folders",
|                                             "Description":  "Allows the app to read and write the user\u0027s mailbox folders, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write mailbox folders for signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MailboxItem.Export",
|                                             "DisplayName":  "Export a user\u0027s mailbox items",
|                                             "Description":  "Allows the app to export the user\u0027s mailbox items, on behalf of the the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Export mailbox items for signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MailboxItem.ImportExport",
|                                             "DisplayName":  "Allows the app to perform backup and restore of mailbox items",
|                                             "Description":  "Allows the app to backup, restore, and modify mailbox items on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Backup/restore mailbox items for signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MailboxItem.Read",
|                                             "DisplayName":  "Read a user\u0027s mailbox items",
|                                             "Description":  "Allows the app to read the user\u0027s mailbox items, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read mailbox items for signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailboxSettings.Read",
|                                             "DisplayName":  "Read all user mailbox settings",
|                                             "Description":  "Allows the app to read user\u0027s mailbox settings without a signed-in user. Does not include permission to send mail.",
|                                             "Tier":  3,
|                                             "Reason":  "Read mailbox settings only; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MailboxSettings.ReadWrite",
|                                             "DisplayName":  "Read and write user mailbox settings",
|                                             "Description":  "Allows the app to create, read, update, and delete user\u0027s mailbox settings. Does not include permission to send mail.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify mailbox settings for signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MailTips.ReadBasic.All",
|                                             "DisplayName":  "Read mail tips for all users",
|                                             "Description":  "Allows the app to read mail tips for all users in the organization without a signed-in user. Mail tips include automatic replies, mailbox status, custom tips, and delivery information.",
|                                             "Tier":  3,
|                                             "Reason":  "Read mail tips for all users; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MailTips.ReadBasic.Shared",
|                                             "DisplayName":  "Read mail tips for mailboxes you can access",
|                                             "Description":  "Allows the app to read mail tips on behalf of the signed-in user for mailboxes they have access to. Mail tips include automatic replies, mailbox status, custom tips, and delivery information.",
|                                             "Tier":  3,
|                                             "Reason":  "Read mail tips for accessible mailboxes; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ManagedTenants.Read.All",
|                                             "DisplayName":  "Read all managed tenant information",
|                                             "Description":  "Allows the app to read all managed tenant information on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read managed tenant info on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ManagedTenants.ReadWrite.All",
|                                             "DisplayName":  "Read and write all managed tenant information",
|                                             "Description":  "Allows the app to read and write all managed tenant information on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write managed tenant info on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Dataverse",
|                                             "AppId":  "00000007-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "mcp.tools",
|                                             "DisplayName":  "Access Dataverse MCP tools as organization users",
|                                             "Description":  "Allows the application to access Dataverse MCP tools as organization users",
|                                             "Tier":  3,
|                                             "Reason":  "Access Dataverse MCP tools as org users; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Skype for Business Online",
|                                             "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Meetings.JoinManage",
|                                             "DisplayName":  "Join and Manage Skype Meetings (preview)",
|                                             "Description":  "Allows the app to join and manage Skype meetings",
|                                             "Tier":  3,
|                                             "Reason":  "Join and manage Skype meetings; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Skype for Business Online",
|                                             "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Meetings.ScheduleOnDemand",
|                                             "DisplayName":  "Create on-demand Skype meetings (preview)",
|                                             "Description":  "Allows the app to create on-demand Skype meetings (short term expiry)",
|                                             "Tier":  3,
|                                             "Reason":  "Create on-demand Skype meetings; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Member.Read.Hidden",
|                                             "DisplayName":  "Read all hidden memberships",
|                                             "Description":  "Allows the app to read the memberships of hidden groups and administrative units without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read memberships of hidden groups and admin units; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "messageeventsummary.tenant.read",
|                                             "DisplayName":  "messageeventsummary.tenant.read",
|                                             "Description":  "This scope allows Apps to read tenant\u0027s MessageEventSummary data",
|                                             "Tier":  3,
|                                             "Reason":  "Read tenant message event summary data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MessageTrace.Read.All",
|                                             "DisplayName":  "MessageTrace.Read.All",
|                                             "Description":  "MessageTrace.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read message trace data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MessageTraceDetail.tenant.read",
|                                             "DisplayName":  "MessageTraceDetail.tenant.read",
|                                             "Description":  "MessageTraceDetail.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read detailed message trace data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MetricSet.Execute.All",
|                                             "DisplayName":  "MetricSet.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Execute metric sets on userâs behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MetricSet.Read.All",
|                                             "DisplayName":  "Read metric sets",
|                                             "Description":  "Allows reading metric sets on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read metric sets on userâs behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MetricSet.ReadWrite.All",
|                                             "DisplayName":  "Read and write metric sets",
|                                             "Description":  "Allows modifying metric sets on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify metric sets on userâs behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MetricSet.Reshare.All",
|                                             "DisplayName":  "MetricSet.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare metric sets on userâs behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Intune",
|                                             "AppId":  "0000000a-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MicrosoftTunnelGatewayEnrollment",
|                                             "DisplayName":  "MicrosoftTunnelGatewayEnrollment",
|                                             "Description":  "Allows Intune Admins to enroll a Microsoft Tunnel Gateway Agent",
|                                             "Tier":  3,
|                                             "Reason":  "Enroll Microsoft Tunnel Gateway Agent; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Migration.Read.All",
|                                             "DisplayName":  "Read access to migration data on the SharePoint admin site",
|                                             "Description":  "Allows the app to read migration data via the SharePoint admin site without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read migration data via SharePoint admin site; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Migration.ReadWrite.All",
|                                             "DisplayName":  "Can view and edit migration data from the admin site",
|                                             "Description":  "Allows the app to read and write migration data using the SharePoint admin site, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write migration data via SharePoint admin site; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredAzureDatabricksCatalog.Execute.All",
|                                             "DisplayName":  "Execute mirrored azure databricks catalogs",
|                                             "Description":  "Allows executing mirrored azure databricks catalogs on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute mirrored Azure Databricks catalogs on userâs behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredAzureDatabricksCatalog.Read.All",
|                                             "DisplayName":  "Read mirrored azure databricks catalogs",
|                                             "Description":  "Allows reading mirrored azure databricks catalogs on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read mirrored Azure Databricks catalogs on userâs behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredAzureDatabricksCatalog.ReadWrite.All",
|                                             "DisplayName":  "Read and write mirrored azure databricks catalogs",
|                                             "Description":  "Allows modifying mirrored azure databricks catalogs on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify mirrored Azure Databricks catalogs on userâs behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredAzureDatabricksCatalog.Reshare.All",
|                                             "DisplayName":  "MirroredAzureDatabricksCatalog.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Resharing mirrored Databricks catalogs does not provide identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredDatabase.Execute.All",
|                                             "DisplayName":  "MirroredDatabase.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Executing mirrored databases on behalf of user is data plane access without identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredDatabase.ExternalDataShare.All",
|                                             "DisplayName":  "Allows the app to create and manage external data shares for all mirrored Databases",
|                                             "Description":  "Allows the app to create and manage external data shares for all mirrored Databases, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Managing external data shares is data manipulation without direct identity or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredDatabase.Read.All",
|                                             "DisplayName":  "Read mirrored databases",
|                                             "Description":  "Allows reading mirrored databases on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to mirrored databases is data exfiltration only, no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredDatabase.ReadWrite.All",
|                                             "DisplayName":  "Read and write mirrored databases",
|                                             "Description":  "Allows modifying mirrored databases on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to mirrored databases affects data but not identity or role assignments."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MirroredDatabase.Reshare.All",
|                                             "DisplayName":  "MirroredDatabase.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Resharing mirrored databases is data sharing without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MLExperiment.Execute.All",
|                                             "DisplayName":  "Execute ML experiments",
|                                             "Description":  "Allows executing ML experiments on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Executing ML experiments is workload execution without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MLExperiment.Read.All",
|                                             "DisplayName":  "Read ML experiments",
|                                             "Description":  "Allows reading ML experiments on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to ML experiments is data access only, no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MLExperiment.ReadWrite.All",
|                                             "DisplayName":  "Read and write ML experiments",
|                                             "Description":  "Allows modifying ML experiments on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify ML experiments is data manipulation without identity or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MLExperiment.Reshare.All",
|                                             "DisplayName":  "MLExperiment.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Resharing ML experiments is data sharing without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MLModel.Execute.All",
|                                             "DisplayName":  "Execute ML models",
|                                             "Description":  "Allows executing ML models on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Executing ML models is workload execution without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MLModel.Read.All",
|                                             "DisplayName":  "Read ML models",
|                                             "Description":  "Allows reading ML models on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to ML models is data access only, no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MLModel.ReadWrite.All",
|                                             "DisplayName":  "Read and write ML models",
|                                             "Description":  "Allows modifying ML models on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify ML models is data manipulation without identity or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MLModel.Reshare.All",
|                                             "DisplayName":  "Reshare ML models",
|                                             "Description":  "Allows resharing ML models on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Resharing ML models is data sharing without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MountedDataFactory.Execute.All",
|                                             "DisplayName":  "MountedDataFactory.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Executing data factories is workload execution without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MountedDataFactory.Read.All",
|                                             "DisplayName":  "Read Azure Data Factories",
|                                             "Description":  "Allows reading Azure Data Factories on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to data factories is data access only, no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MountedDataFactory.ReadWrite.All",
|                                             "DisplayName":  "Read and write Azure Data Factories",
|                                             "Description":  "Allows modifying Azure Data Factories on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to data factories affects data but not identity or role assignments."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MountedDataFactory.Reshare.All",
|                                             "DisplayName":  "MountedDataFactory.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Resharing data factories is data sharing without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MtpAction.tenant.read",
|                                             "DisplayName":  "MtpAction.tenant.read",
|                                             "Description":  "This allows apps to read the MtpAction",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to MtpAction is data plane only, no identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MtpAction.tenant.write",
|                                             "DisplayName":  "MtpAction.tenant.write",
|                                             "Description":  "This allows apps to write the MtpAction",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to MtpAction is data manipulation without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MtpMailboxRuleAction.tenant.read",
|                                             "DisplayName":  "MtpMailboxRuleAction.tenant.read",
|                                             "Description":  "MtpMailboxRuleAction.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to mailbox rule actions is data plane only, no identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MtpMailboxRuleAction.tenant.write",
|                                             "DisplayName":  "MtpMailboxRuleAction.tenant.write",
|                                             "Description":  "MtpMailboxRuleAction.tenant.write",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to mailbox rule actions is data manipulation without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "mtproleinfo.read",
|                                             "DisplayName":  "mtproleinfo.read",
|                                             "Description":  "This allows user to read MtpRoleInfo",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to MtpRoleInfo is data plane only, no identity or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "mtpstatus.tenant.read",
|                                             "DisplayName":  "mtpstatus.tenant.read",
|                                             "Description":  "Allow o365 applications to read MTP Status",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to MTP status is data plane only, no identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MultiTenantOrganization.Read.All",
|                                             "DisplayName":  "Read multi-tenant organization details and tenants",
|                                             "Description":  "Allows the app to read multi-tenant organization details and tenants on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to multi-tenant organization details is data access only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MultiTenantOrganization.ReadBasic.All",
|                                             "DisplayName":  "Read multi-tenant organization basic details and active tenants",
|                                             "Description":  "Allows the app to read multi-tenant organization basic details and active tenants, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read basic multi-tenant organization details is data access only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MultiTenantOrganization.ReadWrite.All",
|                                             "DisplayName":  "Read and write multi-tenant organization details and tenants",
|                                             "Description":  "Allows the app to read and write multi-tenant organization details and tenants on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to multi-tenant organization details is data manipulation without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "MutualTlsOauthConfiguration.Read.All",
|                                             "DisplayName":  "Read all configurations used for mutual-TLS client authentication.",
|                                             "Description":  "Allows the app to read configuration used for OAuth 2.0 mutual-TLS client authentication, without a signed-in user. This includes reading trusted certificate authorities.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to mutual-TLS OAuth configuration is data access only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MutualTlsOauthConfiguration.ReadWrite.All",
|                                             "DisplayName":  "Read and write all configurations used for mutual-TLS client authentication.",
|                                             "Description":  "Allows the app to read and update configuration used for OAuth 2.0 mutual-TLS client authentication, on behalf of the signed-in user. This includes adding and updating trusted certificate authorities.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to mutual-TLS OAuth configuration is data manipulation without direct identity or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MyFiles.Read",
|                                             "DisplayName":  "Read user files",
|                                             "Description":  "Allows the app to read the current user\u0027s files.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to user\u0027s files is data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "MyFiles.Write",
|                                             "DisplayName":  "Read and write user files",
|                                             "Description":  "Allows the app to read, create, update, and delete the current user\u0027s files.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to user\u0027s files is data manipulation without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "NetworkAccess.Read.All",
|                                             "DisplayName":  "Read all network access information",
|                                             "Description":  "Allows the app to read all network access information and configuration settings without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to network access info is data plane only, no identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "NetworkAccess.ReadWrite.All",
|                                             "DisplayName":  "Read and write all network access information",
|                                             "Description":  "Allows the app to read and write all network access information and configuration settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to network access info is data manipulation without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "NetworkAccessBranch.Read.All",
|                                             "DisplayName":  "Read properties of branches for network access",
|                                             "Description":  "Allows the app to read your organization\u0027s branches for network access on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to network access branches is data plane only, no identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "NetworkAccessBranch.ReadWrite.All",
|                                             "DisplayName":  "Read and write properties of all branches for network access",
|                                             "Description":  "Allows the app to read and write your organization\u0027s network access branches, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to network access branches is data manipulation without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "NetworkAccessPolicy.Read.All",
|                                             "DisplayName":  "Read all security and routing policies for network access",
|                                             "Description":  "Allows the app to read your organization\u0027s network access policies, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to network access policies is data plane only, no identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "NetworkAccessPolicy.ReadWrite.All",
|                                             "DisplayName":  "Read and write all security and routing policies for network access",
|                                             "Description":  "Allows the app to read and write your organization\u0027s network access policies, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to network access policies is data manipulation without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "NetworkAccess-Reports.Read.All",
|                                             "DisplayName":  "Read all network access reports",
|                                             "Description":  "Allows the app to read all network access reports on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to network access reports is data plane only, no identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notebook.Execute.All",
|                                             "DisplayName":  "Execute notebooks",
|                                             "Description":  "Allows executing notebooks on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute access to notebooks is workload execution without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notebook.Read.All",
|                                             "DisplayName":  "Read notebooks",
|                                             "Description":  "Allows reading notebooks on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to notebooks is data access only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notebook.ReadWrite.All",
|                                             "DisplayName":  "Read and write notebooks",
|                                             "Description":  "Allows modifying notebooks on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to notebooks is data manipulation without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notebook.Reshare.All",
|                                             "DisplayName":  "Notebook.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Resharing notebooks is data sharing without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notes.Create",
|                                             "DisplayName":  "Create user OneNote notebooks",
|                                             "Description":  "Allows the app to read the titles of OneNote notebooks and sections and to create new pages, notebooks, and sections on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Create access to notes is data creation without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notes.Read",
|                                             "DisplayName":  "Read user notes",
|                                             "Description":  "Allows the app to read user notes",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to user notes is data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Notes.Read.All",
|                                             "DisplayName":  "Read all OneNote notebooks",
|                                             "Description":  "Allows the app to read all the OneNote notebooks in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all OneNote notebooks is data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notes.ReadWrite",
|                                             "DisplayName":  "Read and write user OneNote notebooks",
|                                             "Description":  "Allows the app to read, share, and modify OneNote notebooks on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to OneNote notebooks is data manipulation without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Notes.ReadWrite.All",
|                                             "DisplayName":  "Read and write all OneNote notebooks",
|                                             "Description":  "Allows the app to read all the OneNote notebooks in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to all OneNote notebooks is data manipulation without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notes.ReadWrite.CreatedByApp",
|                                             "DisplayName":  "Limited notebook access (deprecated)",
|                                             "Description":  "This is deprecated!  Do not use! This permission no longer has any effect. You can safely consent to it. No additional privileges will be granted to the app.",
|                                             "Tier":  3,
|                                             "Reason":  "Deprecated permission with no effect; no identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Notifications.ReadWrite.CreatedByApp",
|                                             "DisplayName":  "Deliver and manage user notifications for this app",
|                                             "Description":  "Allows the app to deliver its notifications on behalf of signed-in users. Also allows the app to read, update, and delete the user\u0027s notification items for this app.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage app notifications only; no path to identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OcrBillingConfiguration-Internal.Write.All",
|                                             "DisplayName":  "OcrBillingConfiguration-Internal.Write.All",
|                                             "Description":  "OcrBillingConfiguration-Internal.Write.All",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to billing configuration is data manipulation without identity or role control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "offline_access",
|                                             "DisplayName":  "Maintain access to data you have given it access to",
|                                             "Description":  "Allows the app to see and update the data you gave it access to, even when users are not currently using the app. This does not give the app any additional permissions.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows app to maintain access tokens but does not grant additional permissions or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OneCyberRelocationData.tenant.read",
|                                             "DisplayName":  "OneCyberRelocationData.tenant.read",
|                                             "Description":  "This allows apps to read the OneCyberRelocationData",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to specific tenant data without identity plane control or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OneCyberRelocationData.tenant.write",
|                                             "DisplayName":  "OneCyberRelocationData.tenant.write",
|                                             "Description":  "This allows apps to write the OneCyberRelocationData",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to specific tenant data without ability to escalate privileges or control identity plane."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OneLake.Read.All",
|                                             "DisplayName":  "Make API calls that read OneLake metadata",
|                                             "Description":  "Allows the app to make API calls that read OneLake metadata on your behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to OneLake metadata on behalf of user; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OneLake.ReadWrite.All",
|                                             "DisplayName":  "Make API calls that read and write OneLake metadata",
|                                             "Description":  "Allows the app to make API calls that read and write OneLake metadata, on your behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to OneLake metadata on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OnlineMeetingAiInsight.Read.All",
|                                             "DisplayName":  "Read all AI Insights for online meetings.",
|                                             "Description":  "Allows the app to read all AI Insights for online meetings, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to AI insights for meetings on behalf of user; no identity plane or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OnlineMeetingAiInsight.Read.Chat",
|                                             "DisplayName":  "Read all AI Insights for online meetings where the Teams application is installed.",
|                                             "Description":  "Allows the teams-app to read all aiInsights for online meetings where the Teams-app is installed, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to AI insights for meetings where app is installed; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OnlineMeetingArtifact.Read.All",
|                                             "DisplayName":  "Read user\u0027s online meeting artifacts",
|                                             "Description":  "Allows the app to read online meeting artifacts on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to online meeting artifacts on behalf of user; no path to tenant compromise."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OnlineMeetingRecording.Read.All",
|                                             "DisplayName":  "Read all recordings of online meetings.",
|                                             "Description":  "Allows the app to read all recordings of all online meetings, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to meeting recordings without user context; no identity plane or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OnlineMeetings.Read",
|                                             "DisplayName":  "Read user\u0027s online meetings",
|                                             "Description":  "Allows the app to read online meeting details on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to online meeting details on behalf of user; no privilege escalation path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OnlineMeetings.Read.All",
|                                             "DisplayName":  "Read online meeting details",
|                                             "Description":  "Allows the app to read online meeting details in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to online meetings organization-wide without user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OnlineMeetings.ReadWrite",
|                                             "DisplayName":  "Read and create user\u0027s online meetings",
|                                             "Description":  "Allows the app to read and create online meetings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and create meetings on behalf of user; no direct or near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OnlineMeetings.ReadWrite.All",
|                                             "DisplayName":  "Read and create online meetings",
|                                             "Description":  "Allows the app to read and create online meetings as an application in your organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and create meetings organization-wide; no direct path to role assignment or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OnlineMeetingTranscript.Read.All",
|                                             "DisplayName":  "Read all transcripts of online meetings.",
|                                             "Description":  "Allows the app to read all transcripts of online meetings, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read transcripts on behalf of user; no identity plane or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "openid",
|                                             "DisplayName":  "Sign users in",
|                                             "Description":  "Allows users to sign in to the app with their work or school accounts and allows the app to see basic user profile information.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows sign-in and basic profile read; no privilege escalation or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OPX.MyDay",
|                                             "DisplayName":  "OPX.MyDay",
|                                             "Description":  "This allows the application to host MyDay Owa powered experience",
|                                             "Tier":  3,
|                                             "Reason":  "Allows hosting of MyDay experience; no identity plane or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OPX.MyDay.All",
|                                             "DisplayName":  "OPX.MyDay.All",
|                                             "Description":  "This allows application to host MyDay Owa powered experience for both user and shared mailbox and calendar",
|                                             "Tier":  3,
|                                             "Reason":  "Allows hosting MyDay for user and shared mailboxes; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OPX.MyDay.Shared",
|                                             "DisplayName":  "OPX.MyDay.Shared",
|                                             "Description":  "This allows application to host MyDay Owa powered experience for shared mailbox and calendar",
|                                             "Tier":  3,
|                                             "Reason":  "Allows hosting MyDay for shared mailboxes; no privilege escalation path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Organization.Read.All",
|                                             "DisplayName":  "Read organization information",
|                                             "Description":  "Allows the app to read the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed skus and tenant branding information.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to organization info on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OrganizationalBranding.Read.All",
|                                             "DisplayName":  "Read organizational branding information",
|                                             "Description":  "Allows the app to read the organizational branding information, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to branding info; no identity plane or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrganizationalBranding.ReadWrite.All",
|                                             "DisplayName":  "Read and write organizational branding information",
|                                             "Description":  "Allows the app to read and write the organizational branding information, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write branding info on behalf of user; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrgApp.Read.All",
|                                             "DisplayName":  "Read org apps",
|                                             "Description":  "Allows reading org apps on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to org apps on behalf of user; no privilege escalation path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrgApp.ReadWrite.All",
|                                             "DisplayName":  "Read and write org apps",
|                                             "Description":  "Allows modifying org apps on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify org apps on behalf of user; no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrgApp.Reshare.All",
|                                             "DisplayName":  "OrgApp.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but likely related to reshare; no identity plane control indicated."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OrgContact.Read.All",
|                                             "DisplayName":  "Read organizational contacts",
|                                             "Description":  "Allows the app to read all organizational contacts without a signed-in user.  These contacts are managed by the organization and are different from a user\u0027s personal contacts.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to organizational contacts without user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrgSettings-AppsAndServices.Read.All",
|                                             "DisplayName":  "Read organization-wide apps and services settings",
|                                             "Description":  "Allows the app to read organization-wide apps and services settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to org-wide apps and services settings on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrgSettings-DynamicsVoice.Read.All",
|                                             "DisplayName":  "Read organization-wide Dynamics customer voice settings",
|                                             "Description":  "Allows the app to read organization-wide Dynamics customer voice settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Dynamics customer voice settings on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrgSettings-DynamicsVoice.ReadWrite.All",
|                                             "DisplayName":  "Read and write organization-wide Dynamics customer voice settings",
|                                             "Description":  "Allows the app to read and write organization-wide Dynamics customer voice settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write Dynamics customer voice settings on behalf of user; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OrgSettings-Forms.Read.All",
|                                             "DisplayName":  "Read organization-wide Microsoft Forms settings",
|                                             "Description":  "Allows the app to read organization-wide Microsoft Forms settings, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Microsoft Forms settings without user; no privilege escalation path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OrgSettings-Forms.ReadWrite.All",
|                                             "DisplayName":  "Read and write organization-wide Microsoft Forms settings",
|                                             "Description":  "Allows the app to read and write organization-wide Microsoft Forms settings, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write Forms settings without user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OrgSettings-Microsoft365Install.Read.All",
|                                             "DisplayName":  "Read organization-wide Microsoft 365 apps installation settings",
|                                             "Description":  "Allows the app to read organization-wide Microsoft 365 apps installation settings, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Microsoft 365 install settings without user; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "OrgSettings-Microsoft365Install.ReadWrite.All",
|                                             "DisplayName":  "Read and write organization-wide Microsoft 365 apps installation settings",
|                                             "Description":  "Allows the app to read and write organization-wide Microsoft 365 apps installation settings, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write Microsoft 365 install settings without user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrgSettings-Todo.Read.All",
|                                             "DisplayName":  "Read organization-wide Microsoft To Do settings",
|                                             "Description":  "Allows the app to read organization-wide Microsoft To Do settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Microsoft To Do settings on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "OrgSettings-Todo.ReadWrite.All",
|                                             "DisplayName":  "Read and write organization-wide Microsoft To Do settings",
|                                             "Description":  "Allows the app to read and write organization-wide Microsoft To Do settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write To Do settings on behalf of user; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PaginatedReport.Execute.All",
|                                             "DisplayName":  "PaginatedReport.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but likely execution of reports on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PaginatedReport.Read.All",
|                                             "DisplayName":  "Read paginated reports",
|                                             "Description":  "Allows reading paginated reports on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to paginated reports on behalf of user; no privilege escalation path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PaginatedReport.ReadWrite.All",
|                                             "DisplayName":  "Read and write paginated reports",
|                                             "Description":  "Allows modifying paginated reports on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify paginated reports on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PaginatedReport.Reshare.All",
|                                             "DisplayName":  "PaginatedReport.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but likely reshare of reports; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PartnerBilling.Read.All",
|                                             "DisplayName":  "Read all billing data for your company\u0027s tenant",
|                                             "Description":  "Allows the app to read all of billing data from Microsoft for your company\u0027s tenant, without a signed-in user. This includes reading billed and unbilled azure usage and invoice reconciliation data.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to billing data without user; data exfiltration risk but no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PartnerSecurity.Read.All",
|                                             "DisplayName":  "Read security alerts of customer with CSP relationship",
|                                             "Description":  "Allows the app to read security alerts of customer with CSP relationship on behalf of the partner signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read security alerts on behalf of partner user; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PartnerSecurity.ReadWrite.All",
|                                             "DisplayName":  "Read security alerts and update status of security alerts of customer with CSP relationship",
|                                             "Description":  "Allows the app to read security alerts and update status of alerts of customer with CSP relationship, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update security alerts without user; no identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PendingExternalUserProfile.Read.All",
|                                             "DisplayName":  "Read pending external user profiles",
|                                             "Description":  "Allows the app to read available properties of pending external user profiles, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to pending external user profiles on behalf of user; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PendingExternalUserProfile.ReadWrite.All",
|                                             "DisplayName":  "Read and write all pending external user profiles",
|                                             "Description":  "Allows the app to read and write available properties of pending external user profiles, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write pending external user profiles without user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "People.Read",
|                                             "DisplayName":  "Read users\u0027 relevant people lists (preview)",
|                                             "Description":  "Allows the app to read a ranked list of relevant people of the signed-in user. The list includes local contacts, contacts from social networking, your organization\u0027s directory, and people from recent communications (such as email and Skype).",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to relevant people on behalf of user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "People.Read.All",
|                                             "DisplayName":  "Read all users\u0027 relevant people lists",
|                                             "Description":  "Allows the app to read a scored list of relevant people of the signed-in user or other users in the signed-in user\u0027s organization. The list can include local contacts, contacts from social networking, your organization\u0027s directory, and people from recent communications (such as email and Skype).",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to relevant people organization-wide on behalf of user; no privilege escalation path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "People.ReadWrite",
|                                             "DisplayName":  "Read and write users\u0027 relevant people lists (preview)",
|                                             "Description":  "Allows the app to create, read and write to the ranked list of relevant people of the signed-in user. The list includes local contacts, contacts from social networking, your organization\u0027s directory, and people from recent communications (such as email and Skype).",
|                                             "Tier":  3,
|                                             "Reason":  "Allows write access to the signed-in user\u0027s people list only; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PeopleSettings.Read.All",
|                                             "DisplayName":  "Read all tenant-wide people settings",
|                                             "Description":  "Allows the application to read tenant-wide people settings without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to tenant-wide people settings; no ability to modify identity or role assignments."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PeopleSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and write all tenant-wide people settings",
|                                             "Description":  "Allows the application to read and write tenant-wide people settings without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to tenant-wide people settings without identity plane control or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Pipeline.Deploy",
|                                             "DisplayName":  "Deploy in all pipelines",
|                                             "Description":  "The app can deploy content in all pipelines and pipeline stages in deployment pipelines, which the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to deploy content in pipelines scoped to user access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Pipeline.Read.All",
|                                             "DisplayName":  "View all pipelines",
|                                             "Description":  "The app can view all deployment pipelines that the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to deployment pipelines scoped to user access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Pipeline.ReadWrite.All",
|                                             "DisplayName":  "Read and write all pipelines",
|                                             "Description":  "The app can view and edit all deployment pipelines that the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to deployment pipelines scoped to user access; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Place.Read.All",
|                                             "DisplayName":  "Read all company places",
|                                             "Description":  "Allows the app to read company places (conference rooms and room lists) for calendar events and other applications, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to company places without identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Place.ReadWrite.All",
|                                             "DisplayName":  "Read and write organization places",
|                                             "Description":  "Allows the app to manage organization places (conference rooms and room lists) for calendar events and other applications, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to organization places on behalf of signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PlaceDevice.Read.All",
|                                             "DisplayName":  "Read all workplace devices",
|                                             "Description":  "Allows the app to read all workplace devices, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to workplace devices without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PlaceDevice.ReadWrite.All",
|                                             "DisplayName":  "Read and write all workplace devices",
|                                             "Description":  "Allows the app to read and write all workplace devices, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to workplace devices on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PlaceDeviceTelemetry.ReadWrite.All",
|                                             "DisplayName":  "Read and write telemetry for all workplace devices.",
|                                             "Description":  "Allows the app to read and write telemetry for all workplace devices, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write telemetry for workplace devices without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.Read.All",
|                                             "DisplayName":  "Read your organization\u0027s policies",
|                                             "Description":  "Allows the app to read your organization\u0027s policies on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to organization policies on behalf of signed-in user; no write or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.Read.AuthenticationMethod",
|                                             "DisplayName":  "Read authentication method policies",
|                                             "Description":  "Allows the app to read the authentication method policies, on behalf of the signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to authentication method policies; no write or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.Read.B2BManagementPolicy",
|                                             "DisplayName":  "Read your organization\u0027s B2BManagement policies",
|                                             "Description":  "Allows the app to read your organization\u0027s B2BManagement policies on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to B2B management policies; no write or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.Read.ConditionalAccess",
|                                             "DisplayName":  "Read your organization\u0027s conditional access policies",
|                                             "Description":  "Allows the app to read your organization\u0027s conditional access policies on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to conditional access policies; no write or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Policy.Read.DeviceConfiguration",
|                                             "DisplayName":  "Read your organization\u0027s device configuration policies",
|                                             "Description":  "Allows the application to read your organization\u0027s device configuration policies without a signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to device configuration policies without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.Read.IdentityProtection",
|                                             "DisplayName":  "Read your organization’s identity protection policy",
|                                             "Description":  "Allows the app to read your organization’s identity protection policy on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to identity protection policies; no write or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Policy.Read.PermissionGrant",
|                                             "DisplayName":  "Read consent and permission grant policies",
|                                             "Description":  "Allows the app to read policies related to consent and permission grants for applications, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to consent and permission grant policies; no write or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Policy.ReadWrite.FeatureRollout",
|                                             "DisplayName":  "Read and write feature rollout policies",
|                                             "Description":  "Allows the app to read and write feature rollout policies without a signed-in user. Includes abilities to assign and remove users and groups to rollout of a specific feature.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to feature rollout policies does not provide identity plane control or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Policy.ReadWrite.MobilityManagement",
|                                             "DisplayName":  "Read and write your organization\u0027s mobility management policies",
|                                             "Description":  "Allows the app to read and write your organization\u0027s mobility management policies on behalf of the signed-in user.  For example, a mobility management policy can set the enrollment scope for a given mobility management application.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to mobility management policies affects device enrollment but does not enable identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PolicyStatusSummary-Internal.Write.All",
|                                             "DisplayName":  "PolicyStatusSummary-Internal.Write.All",
|                                             "Description":  "PolicyStatusSummary-Internal.Write.All",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to internal policy status summaries does not provide identity plane control or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "POP.AccessAsApp",
|                                             "DisplayName":  "POP.AccessAsApp",
|                                             "Description":  "Allow application to access user’s mailbox via POP protocol",
|                                             "Tier":  3,
|                                             "Reason":  "Access to mailboxes via POP protocol enables data exfiltration but no identity plane control or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "POP.AccessAsUser.All",
|                                             "DisplayName":  "Read and write access to mailboxes via POP.",
|                                             "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via POP protocol.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated POP access to mailboxes enables data exfiltration but no identity plane control or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Presence.Read",
|                                             "DisplayName":  "Read user\u0027s presence information",
|                                             "Description":  "Allows the app to read presence information on behalf of the signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to presence information on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Presence.Read.All",
|                                             "DisplayName":  "Read presence information for all users",
|                                             "Description":  "Allows the app to read presence information of all users in the directory without a signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to presence information of all users; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Presence.ReadWrite",
|                                             "DisplayName":  "Read and write a user\u0027s presence information",
|                                             "Description":  "Allows the app to read the presence information and write activity and availability on behalf of the signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to presence information on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Presence.ReadWrite.All",
|                                             "DisplayName":  "Read and write presence information for all users",
|                                             "Description":  "Allows the app to read all presence information and write activity and availability of all users in the directory without a signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, time zone and location.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to presence information of all users; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrincipalDetails.ReadBasic.All",
|                                             "DisplayName":  "Read Entra ID identities basic properties",
|                                             "Description":  "Allows the app to read basic properties of Entra ID identities in your organization that are known to Microsoft Fabric, on behalf of the signed-in user. This includes display names and email addresses of users, service principals and security groups.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to basic properties of identities; no write or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintConnector.Read.All",
|                                             "DisplayName":  "Read print connectors",
|                                             "Description":  "Allows the application to read print connectors on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to print connectors; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintConnector.ReadWrite.All",
|                                             "DisplayName":  "Read and write print connectors",
|                                             "Description":  "Allows the application to read and write print connectors on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to print connectors; no identity plane control or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Printer.Create",
|                                             "DisplayName":  "Register printers  ",
|                                             "Description":  "Allows the application to create (register) printers on behalf of the signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to create printers on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Printer.FullControl.All",
|                                             "DisplayName":  "Register, read, update, and unregister printers",
|                                             "Description":  "Allows the application to create (register), read, update, and delete (unregister) printers on behalf of the signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Full control over printers on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Printer.Read.All",
|                                             "DisplayName":  "Read printers",
|                                             "Description":  "Allows the application to read printers without a signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to printers without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Printer.ReadWrite.All",
|                                             "DisplayName":  "Read and update printers",
|                                             "Description":  "Allows the application to read and update printers without a signed-in user. Does not allow creating (registering) or deleting (unregistering) printers.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows read and update of printers only; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrinterShare.Read.All",
|                                             "DisplayName":  "Read printer shares",
|                                             "Description":  "Allows the application to read printer shares on behalf of the signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to printer shares on behalf of user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrinterShare.ReadBasic.All",
|                                             "DisplayName":  "Read basic information about printer shares",
|                                             "Description":  "Allows the application to read basic information about printer shares on behalf of the signed-in user. Does not allow reading access control information.",
|                                             "Tier":  3,
|                                             "Reason":  "Read basic printer share info only; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrinterShare.ReadWrite.All",
|                                             "DisplayName":  "Read and write printer shares",
|                                             "Description":  "Allows the application to read and update printer shares on behalf of the signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update printer shares on behalf of user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintJob.Create",
|                                             "DisplayName":  "Create print jobs",
|                                             "Description":  "Allows the application to create print jobs on behalf of the signed-in user and upload document content to print jobs that the signed-in user created.",
|                                             "Tier":  3,
|                                             "Reason":  "Create print jobs on behalf of user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrintJob.Manage.All",
|                                             "DisplayName":  "Perform advanced operations on print jobs",
|                                             "Description":  "Allows the application to perform advanced operations like redirecting a print job to another printer without a signed-in user. Also allows the application to read and update the metadata of print jobs.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage print jobs without user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintJob.Read",
|                                             "DisplayName":  "Read user\u0027s print jobs",
|                                             "Description":  "Allows the application to read the metadata and document content of print jobs that the signed-in user created.",
|                                             "Tier":  3,
|                                             "Reason":  "Read print jobs created by user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrintJob.Read.All",
|                                             "DisplayName":  "Read print jobs",
|                                             "Description":  "Allows the application to read the metadata and document content of print jobs without a signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Read print jobs without user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintJob.ReadBasic",
|                                             "DisplayName":  "Read basic information of user\u0027s print jobs",
|                                             "Description":  "Allows the application to read the metadata of print jobs that the signed-in user created. Does not allow access to print job document content.",
|                                             "Tier":  3,
|                                             "Reason":  "Read metadata of print jobs created by user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrintJob.ReadBasic.All",
|                                             "DisplayName":  "Read basic information for print jobs",
|                                             "Description":  "Allows the application to read the metadata of print jobs without a signed-in user. Does not allow access to print job document content.",
|                                             "Tier":  3,
|                                             "Reason":  "Read metadata of print jobs without user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintJob.ReadWrite",
|                                             "DisplayName":  "Read and write user\u0027s print jobs",
|                                             "Description":  "Allows the application to read and update the metadata and document content of print jobs that the signed-in user created.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update print jobs created by user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrintJob.ReadWrite.All",
|                                             "DisplayName":  "Read and write print jobs",
|                                             "Description":  "Allows the application to read and update the metadata and document content of print jobs without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update print jobs without user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintJob.ReadWriteBasic",
|                                             "DisplayName":  "Read and write basic information of user\u0027s print jobs",
|                                             "Description":  "Allows the application to read and update the metadata of print jobs that the signed-in user created. Does not allow access to print job document content.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update metadata of print jobs created by user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintJob.ReadWriteBasic.All",
|                                             "DisplayName":  "Read and write basic information of print jobs",
|                                             "Description":  "Allows the application to read and update the metadata of print jobs on behalf of the signed-in user. Does not allow access to print job document content.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update metadata of print jobs without user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintSettings.Read.All",
|                                             "DisplayName":  "Read tenant-wide print settings",
|                                             "Description":  "Allows the application to read tenant-wide print settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read tenant-wide print settings on behalf of user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrintSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and write tenant-wide print settings",
|                                             "Description":  "Allows the application to read and write tenant-wide print settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write tenant-wide print settings on behalf of user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrintTaskDefinition.ReadWrite.All",
|                                             "DisplayName":  "Read, write and update print task definitions",
|                                             "Description":  "Allows the application to read and update print task definitions without a signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Read and update print task definitions without user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedAccess.Read.AzureAD",
|                                             "DisplayName":  "Read privileged access to Azure AD",
|                                             "Description":  "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read time-based assignment and elevation info on behalf of user; no direct role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedAccess.Read.AzureADGroup",
|                                             "DisplayName":  "Read privileged access to Azure AD groups",
|                                             "Description":  "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read time-based assignment and elevation of Azure AD groups on behalf of user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedAccess.Read.AzureResources",
|                                             "DisplayName":  "Read privileged access to Azure resources",
|                                             "Description":  "Allows the app to read time-based assignment and just-in-time elevation of user privileges to audit Azure resources in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read time-based elevation of Azure resources without user; no identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedAccess-CustomExt.Read.All",
|                                             "DisplayName":  "Read Privileged Access (PIM) custom extensions",
|                                             "Description":  "Allows the app to read Privileged Access (PIM) custom extensions for your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read privileged access custom extensions without user; no direct role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedAccess-CustomExt.ReadWrite.All",
|                                             "DisplayName":  "Read and write Privileged Access (PIM) custom extensions",
|                                             "Description":  "Allows the app to read and write Privileged Access (PIM) custom extensions for your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write privileged access custom extensions without user; no direct role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedAssignmentSchedule.Read.AzureADGroup",
|                                             "DisplayName":  "Read assignment schedules for access to Azure AD groups",
|                                             "Description":  "Allows the app to read time-based assignment schedules for access to Azure AD groups, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read time-based assignment schedules for Azure AD groups on behalf of user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedAssignmentSchedule.Read.EntraAppRole",
|                                             "DisplayName":  "Read assignment schedules for app permission grants and app role assignments",
|                                             "Description":  "Allows the app to read time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read time-based assignment schedules for app permissions on behalf of user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedAssignmentSchedule.ReadWrite.EntraAppRole",
|                                             "DisplayName":  "Read, create, and delete assignment schedules for app permission grants and app role assignments",
|                                             "Description":  "Allows the app to read, create, and delete time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage time-based assignment schedules for app permissions on behalf of user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedAssignmentSchedule.Remove.AzureADGroup",
|                                             "DisplayName":  "Delete assignment schedules for access to Azure AD groups",
|                                             "Description":  "Allows the app to delete time-based assignment schedules for access to Azure AD groups, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delete time-based assignment schedules for Azure AD groups on behalf of user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedEligibilitySchedule.Read.AzureADGroup",
|                                             "DisplayName":  "Read eligibility schedules for access to Azure AD groups",
|                                             "Description":  "Allows the app to read time-based eligibility schedules for access to Azure AD groups, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read eligibility schedules for Azure AD groups without user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedEligibilitySchedule.Read.EntraAppRole",
|                                             "DisplayName":  "Read eligibility schedules for app permission grants and app role assignments",
|                                             "Description":  "Allows the app to read time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read eligibility schedules for app permissions without user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PrivilegedEligibilitySchedule.ReadWrite.EntraAppRole",
|                                             "DisplayName":  "Read, create, and delete eligibility schedules for app permission grants and app role assignments",
|                                             "Description":  "Allows the app to read, create, and delete time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage eligibility schedules for app permissions without user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "PrivilegedEligibilitySchedule.Remove.AzureADGroup",
|                                             "DisplayName":  "Delete eligibility schedules for access to Azure AD groups",
|                                             "Description":  "Allows the app to delete time-based eligibility schedules for access to Azure AD groups, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delete eligibility schedules for Azure AD groups on behalf of user; no direct role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "profile",
|                                             "DisplayName":  "View users\u0027 basic profile",
|                                             "Description":  "Allows the app to see your users\u0027 basic profile (e.g., name, picture, user name, email address)",
|                                             "Tier":  3,
|                                             "Reason":  "Read basic user profile info only; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ProfilePhoto.Read.All",
|                                             "DisplayName":  "Read profile photo of a user or group",
|                                             "Description":  "Allows the app to read all profile photos of users and groups, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read all profile photos on behalf of user; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ProfilePhoto.ReadWrite.All",
|                                             "DisplayName":  "Read and write profile photo of a user or group",
|                                             "Description":  "Allows the app to read and write all profile photos of users and groups, without a signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write profile photos without user; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ProgramControl.Read.All",
|                                             "DisplayName":  "Read all programs",
|                                             "Description":  "Allows the app to read programs and program controls in the organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read programs and controls without user; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ProgramControl.ReadWrite.All",
|                                             "DisplayName":  "Manage all programs that user can access",
|                                             "Description":  "Allows the app to read, update, delete and perform actions on programs and program controls that the signed-in user has access to in the organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage programs and controls on behalf of user; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Project.Read",
|                                             "DisplayName":  "Read user projects",
|                                             "Description":  "Allows the app to read the current user\u0027s projects.",
|                                             "Tier":  3,
|                                             "Reason":  "Read current user\u0027s projects only; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Project.Write",
|                                             "DisplayName":  "Read and write user projects",
|                                             "Description":  "Allows the app to read, create, update, and delete the current users’ projects.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage current user\u0027s projects only; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ProjectWebApp.FullControl",
|                                             "DisplayName":  "Have full control of all ProjectWebApp site collections",
|                                             "Description":  "Allows the app to have full control of all ProjectWebApp site collections the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Full control of ProjectWebApp site collections for user; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ProjectWebAppReporting.Read",
|                                             "DisplayName":  "Read ProjectWebApp OData reporting data",
|                                             "Description":  "Allows the app to read all OData reporting data from all ProjectWebApp site collections for the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read reporting data for ProjectWebApp site collections for user; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ProtectionScopes.Compute.All",
|                                             "DisplayName":  "Compute Purview policies at tenant scope",
|                                             "Description":  "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for all users across tenant.",
|                                             "Tier":  3,
|                                             "Reason":  "Identify Purview data protection scopes tenant-wide; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ProtectionScopes.Compute.User",
|                                             "DisplayName":  "Compute Purview policies for an individual user",
|                                             "Description":  "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for an individual user.",
|                                             "Tier":  3,
|                                             "Reason":  "Identify Purview data protection scopes for individual user; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ProvisioningLog.Read.All",
|                                             "DisplayName":  "Read provisioning log data",
|                                             "Description":  "Allows the app to read and query your provisioning log activities, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read provisioning log activities on behalf of user; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "PublicKeyInfrastructure.Read.All",
|                                             "DisplayName":  "Read all certificate based authentication configurations",
|                                             "Description":  "Allows the application to read  certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read certificate-based authentication configuration without user; no write or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Purview.DataAccess.All",
|                                             "DisplayName":  "Purview.DataAccess.All",
|                                             "Description":  "Purview.DataAccess.All",
|                                             "Tier":  3,
|                                             "Reason":  "Access Purview data; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "QnA.Read.All",
|                                             "DisplayName":  "Read all Question and Answers ",
|                                             "Description":  "Allows an app to read all question and answers, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to question and answers data; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "QuarantinedMessage.Read.All",
|                                             "DisplayName":  "QuarantinedMessage.Read.All",
|                                             "Description":  "QuarantinedMessage.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to quarantined messages only; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RbacAccessCheck.read",
|                                             "DisplayName":  "RbacAccessCheck.read",
|                                             "Description":  "This Allows User to read the Rbac Roles",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to RBAC roles; no ability to modify roles or escalate privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RbacTenantStatus.Read",
|                                             "DisplayName":  "RbacTenantStatus.Read",
|                                             "Description":  "RbacTenantStatus.Read",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to tenant RBAC status; no privilege escalation or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RbacTenantStatus.Write",
|                                             "DisplayName":  "RbacTenantStatus.Write",
|                                             "Description":  "RbacTenantStatus.Write",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to tenant RBAC status without direct role assignment or credential control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RealTimeActivityFeed.Read.All",
|                                             "DisplayName":  "Access real-time enriched data in a meeting as an app",
|                                             "Description":  "Allows the app to get direct access to real-time enriched data in a meeting, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to real-time meeting data; no identity plane or role assignment impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Recipient.tenant.read",
|                                             "DisplayName":  "Recipient.tenant.read",
|                                             "Description":  "Recipient.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to recipient data; no path to identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Recipient.tenant.write",
|                                             "DisplayName":  "Recipient.tenant.write",
|                                             "Description":  "Recipient.tenant.write",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to recipient data without ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RecipientBatch.tenant.write",
|                                             "DisplayName":  "RecipientBatch.tenant.write",
|                                             "Description":  "RecipientBatch.tenant.write",
|                                             "Tier":  3,
|                                             "Reason":  "Batch write access to recipient data; no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RecordsManagement.Read.All",
|                                             "DisplayName":  "Read Records Management configuration, labels and policies",
|                                             "Description":  "Allows the application to read any data from Records Management, such as configuration, labels, and policies without the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to records management data; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RecordsManagement.ReadWrite.All",
|                                             "DisplayName":  "Read and write Records Management configuration, labels and policies",
|                                             "Description":  "Allow the application to create, update and delete any data from Records Management, such as configuration, labels, and policies without the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to records management data without ability to assign roles or control identity plane."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "reducedrecipient.read.all",
|                                             "DisplayName":  "reducedrecipient.read.all",
|                                             "Description":  "this allows to read reducedrecipient",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to reduced recipient data only; no identity plane or role assignment impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Reflex.Execute.All",
|                                             "DisplayName":  "Reflex.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to execute Reflex actions on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Reflex.Read.All",
|                                             "DisplayName":  "Read Reflexes",
|                                             "Description":  "Allows reading Reflexes on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Reflex data on user\u0027s behalf; no privilege escalation or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Reflex.ReadWrite.All",
|                                             "DisplayName":  "Read and write Reflexes",
|                                             "Description":  "Allows modifying Reflexes on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify Reflex data on user\u0027s behalf; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Reflex.Reshare.All",
|                                             "DisplayName":  "Reflex.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare Reflex data on user\u0027s behalf; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Relocation.ReadWrite.All",
|                                             "DisplayName":  "Relocation.ReadWrite.All",
|                                             "Description":  "Relocation.ReadWrite.All",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to relocation data; no direct identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RemediationEmailResult.Read.All",
|                                             "DisplayName":  "RemediationEmailResult.Read.All",
|                                             "Description":  "RemediationEmailResult.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to remediation email results; no identity plane or role assignment impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RemediationEmailResult.ReadWrite.All",
|                                             "DisplayName":  "RemediationEmailResult.ReadWrite.All",
|                                             "Description":  "RemediationEmailResult.ReadWrite.All",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to remediation email results; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Report.Execute.All",
|                                             "DisplayName":  "Report.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to execute reports on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Report.Read.All",
|                                             "DisplayName":  "Read reports",
|                                             "Description":  "Allows reading reports on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to reports on user\u0027s behalf; no privilege escalation or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Report.ReadWrite.All",
|                                             "DisplayName":  "Read and write reports",
|                                             "Description":  "Allows modifying reports on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify reports on user\u0027s behalf; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Report.Reshare.All",
|                                             "DisplayName":  "Report.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare reports on user\u0027s behalf; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ReportingWebService.Read",
|                                             "DisplayName":  "ReportingWebService.Read",
|                                             "Description":  "Download reports via the Office 365 reporting web service",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Office 365 reports; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ReportingWebService.Read.All",
|                                             "DisplayName":  "ReportingWebService.Read.All",
|                                             "Description":  "Download all reports via the Office 365 reporting web service",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to all reports; no direct identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Reports.Read.All",
|                                             "DisplayName":  "Read all usage reports",
|                                             "Description":  "Allows an app to read all service usage reports without a signed-in user.  Services that provide usage reports include Office 365 and Azure Active Directory.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to service usage reports; no path to identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ReportSettings.Read.All",
|                                             "DisplayName":  "Read admin report settings",
|                                             "Description":  "Allows the app to read admin report settings, such as whether to display concealed information in reports, on behalf of the signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to admin report settings on user\u0027s behalf; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ReportSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and write admin report settings",
|                                             "Description":  "Allows the app to read and update admin report settings, such as whether to display concealed information in reports, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify admin report settings on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ResourceSpecificPermissionGrant.ReadForChat",
|                                             "DisplayName":  "Read resource specific permissions granted on a chat",
|                                             "Description":  "Allows the app to read the resource specific permissions granted on the chat, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read resource-specific permissions for chat on user\u0027s behalf; no role assignment or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ResourceSpecificPermissionGrant.ReadForChat.All",
|                                             "DisplayName":  "Read resource specific permissions granted on a chat",
|                                             "Description":  "Allows the app to read the resource specific permissions granted on the chat without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to chat permissions; no direct identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ResourceSpecificPermissionGrant.ReadForTeam",
|                                             "DisplayName":  "Read resource specific permissions granted on a team",
|                                             "Description":  "Allows the app to read the resource specific permissions granted on the team, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read resource-specific permissions for team on user\u0027s behalf; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ResourceSpecificPermissionGrant.ReadForTeam.All",
|                                             "DisplayName":  "Read resource specific permissions granted on a team",
|                                             "Description":  "Allows the app to read the resource specific permissions granted on the team without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to team permissions; no direct identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ResourceSpecificPermissionGrant.ReadForUser",
|                                             "DisplayName":  "Read resource specific permissions granted on a user account",
|                                             "Description":  "Allows the app to read the resource specific permissions granted on a user account, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read resource-specific permissions for user on user\u0027s behalf; no role assignment or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ResourceSpecificPermissionGrant.ReadForUser.All",
|                                             "DisplayName":  "Read all resource specific permissions granted on user accounts",
|                                             "Description":  "Allows the app to read all resource specific permissions granted on user accounts, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Application read access to user permissions; no direct identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RetailDataManager.Execute.All",
|                                             "DisplayName":  "RetailDataManager.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated execute permission on retail data manager; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RetailDataManager.Read.All",
|                                             "DisplayName":  "Read retail data manager items",
|                                             "Description":  "Allows reading retail data manager items on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to retail data manager items on user\u0027s behalf; no privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RetailDataManager.ReadWrite.All",
|                                             "DisplayName":  "Read and write retail data manager items",
|                                             "Description":  "Allows modifying retail data manager items on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify retail data manager items on user\u0027s behalf; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RetailDataManager.Reshare.All",
|                                             "DisplayName":  "RetailDataManager.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare retail data manager items on user\u0027s behalf; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RiskPreventionProviders.Read.All",
|                                             "DisplayName":  "Read all identity risk prevention providers",
|                                             "Description":  "Allows the app to read your organization\u0027s risk prevention providers, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to organization\u0027s risk prevention providers; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RiskPreventionProviders.ReadWrite.All",
|                                             "DisplayName":  "Read and write all identity risk prevention providers",
|                                             "Description":  "Allows the app to read and write your organization\u0027s risk prevention providers, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to risk prevention providers; no direct identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleAssignmentSchedule.Read.Directory",
|                                             "DisplayName":  "Read all active role assignments and role schedules for your company\u0027s directory",
|                                             "Description":  "Allows the app to read the active role-based access control (RBAC) assignments and schedules for your company\u0027s directory, without a signed-in user. This includes reading directory role templates, and directory roles.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to active RBAC assignments and schedules; no ability to modify or escalate roles."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleEligibilitySchedule.Read.Directory",
|                                             "DisplayName":  "Read all eligible role assignments for your company\u0027s directory",
|                                             "Description":  "Allows the app to read the eligible role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user. This includes reading directory role templates, and directory roles.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to eligible RBAC assignments; no ability to modify or escalate privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagement.Read.All",
|                                             "DisplayName":  "Read role management data for all RBAC providers",
|                                             "Description":  "Allows the app to read the role-based access control (RBAC) settings for all RBAC providers, on behalf of the signed-in user.  This includes reading role definitions and role assignments.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to RBAC settings; no ability to modify roles or escalate privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagement.Read.CloudPC",
|                                             "DisplayName":  "Read Cloud PC RBAC settings",
|                                             "Description":  "Allows the app to read the Cloud PC role-based access control (RBAC) settings, on behalf of the signed-in user.  This includes reading Cloud PC role definitions and role assignments.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Cloud PC RBAC settings; no privilege escalation or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagement.Read.Defender",
|                                             "DisplayName":  "Read M365 Defender RBAC configuration",
|                                             "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, on behalf of the signed-in user. This includes reading M365 Defender role definitions and role assignments.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Defender RBAC settings; no ability to modify roles or escalate privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleManagement.Read.Directory",
|                                             "DisplayName":  "Read all directory RBAC settings",
|                                             "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, without a signed-in user.  This includes reading directory role templates, directory roles and memberships.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to directory RBAC settings without ability to modify roles or assignments; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagement.Read.Exchange",
|                                             "DisplayName":  "Read Exchange Online RBAC configuration",
|                                             "Description":  "Allows the app to read the role-based access control (RBAC) settings for your organization\u0027s Exchange Online service, on behalf of the signed-in user. This includes reading Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only delegated access to Exchange RBAC settings; no ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleManagement.ReadWrite.Defender",
|                                             "DisplayName":  "Read M365 Defender RBAC configuration",
|                                             "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write Defender RBAC settings only; does not impact directory or identity plane roles."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleManagement.ReadWrite.Exchange",
|                                             "DisplayName":  "Read and write Exchange Online RBAC configuration",
|                                             "Description":  "Allows the app to read and manage the role-based access control (RBAC) settings for your organization\u0027s Exchange Online service, without a signed-in user. This includes reading, creating, updating, and deleting Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies.",
|                                             "Tier":  3,
|                                             "Reason":  "Application permission to manage Exchange RBAC roles but no direct ability to assign directory roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagementAlert.Read.Directory",
|                                             "DisplayName":  "Read all alert data for your company\u0027s directory",
|                                             "Description":  "Allows the app to read the role-based access control (RBAC) alerts for your company\u0027s directory, on behalf of the signed-in user. This includes reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to RBAC alerts; no ability to modify roles or escalate privileges."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleManagementAlert.ReadWrite.Directory",
|                                             "DisplayName":  "Read all alert data, configure alerts, and take actions on all alerts for your company\u0027s directory",
|                                             "Description":  "Allows the app to read and manage all role-based access control (RBAC) alerts for your company\u0027s directory, without a signed-in user. This includes managing alert settings, initiating alert scans, dismissing alerts, remediating alert incidents, and reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage RBAC alerts but no direct ability to assign roles or reset credentials; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "RoleManagementPolicy.Read.AzureADGroup",
|                                             "DisplayName":  "Read all policies in PIM for Groups",
|                                             "Description":  "Allows the app to read policies in Privileged Identity Management for Groups, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to PIM policies for groups; no ability to modify or assign roles."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagementPolicy.Read.Directory",
|                                             "DisplayName":  "Read all policies for privileged role assignments of your company\u0027s directory",
|                                             "Description":  "Allows the app to read policies for privileged role-based access control (RBAC) assignments of your company\u0027s directory, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to privileged RBAC assignment policies; no write or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "RoleManagementPolicy.Read.EntraAppRole",
|                                             "DisplayName":  "Read all policies in PIM for App Roles",
|                                             "Description":  "Allows the app to read policies in Privileged Identity Management for App Roles, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to PIM policies for app roles; no ability to modify or assign roles."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Schedule.Read.All",
|                                             "DisplayName":  "Read all schedule items",
|                                             "Description":  "Allows the app to read all schedules, schedule groups, shifts and associated entities in the Teams or Shifts application without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Teams/Shifts schedules; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Schedule.ReadWrite.All",
|                                             "DisplayName":  "Read and write all schedule items",
|                                             "Description":  "Allows the app to manage all schedules, schedule groups, shifts and associated entities in the Teams or Shifts application without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage Teams/Shifts schedules but no path to identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SchedulePermissions.ReadWrite.All",
|                                             "DisplayName":  "Read/Write schedule permissions for a role",
|                                             "Description":  "Allows the app to read/write schedule permissions for a specific role in Shifts application without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage schedule permissions in Shifts app only; no ability to assign directory roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Schedule-WorkingTime.ReadWrite.All",
|                                             "DisplayName":  "Trigger working time policies and read the working time status",
|                                             "Description":  "Allows the app to trigger the working time policies and read the working time status for other users in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage working time policies for users; no direct identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Scorecard.Execute.All",
|                                             "DisplayName":  "Scorecard.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to execute scorecard actions; no identity plane or role assignment impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Scorecard.Read.All",
|                                             "DisplayName":  "Make API calls that require read permissions on all scorecards",
|                                             "Description":  "Allows the app to make API calls that require read permissions on all scorecards, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only delegated access to all scorecards; no role assignment or credential reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Scorecard.ReadWrite.All",
|                                             "DisplayName":  "Scorecard.ReadWrite (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to read/write scorecards; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Scorecard.Reshare.All",
|                                             "DisplayName":  "Scorecard.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to reshare scorecards; no role assignment or identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SearchConfiguration.Read.All",
|                                             "DisplayName":  "Read your organization\u0027s search configuration",
|                                             "Description":  "Allows the app to read search configurations, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to search configurations; no ability to modify roles or authentication policies."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SearchConfiguration.ReadWrite.All",
|                                             "DisplayName":  "Read and write your organization\u0027s search configuration",
|                                             "Description":  "Allows the app to read and write search configuration, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to read/write search configurations; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityActions.Read.All",
|                                             "DisplayName":  "Read your organization\u0027s security actions",
|                                             "Description":  "Allows the app to read security actions, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to security actions; no ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityActions.ReadWrite.All",
|                                             "DisplayName":  "Read and update your organization\u0027s security actions",
|                                             "Description":  "Allows the app to read or update security actions, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to update security actions; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityAlert.Read.All",
|                                             "DisplayName":  "Read all security alerts",
|                                             "Description":  "Allows the app to read all security alerts, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to security alerts; no role assignment or credential reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityAlert.ReadWrite.All",
|                                             "DisplayName":  "Read and write to all security alerts",
|                                             "Description":  "Allows the app to read and write to all security alerts, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to read/write security alerts; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityAnalyzedMessage.Read.All",
|                                             "DisplayName":  "Read metadata and detection details for emails in your organization",
|                                             "Description":  "Read email metadata and security detection details on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read email metadata and security details; no ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityAnalyzedMessage.ReadWrite.All",
|                                             "DisplayName":  "Read metadata, detection details, and execute remediation actions on emails in your organization",
|                                             "Description":  "Read email metadata, security detection details, and execute remediation actions like deleting an email, on behalf of the signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write email metadata and execute remediation like deleting emails; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityCopilotWorkspaces.Read.All",
|                                             "DisplayName":  "Read all Security Copilot resources for the signed-in user",
|                                             "Description":  "Allows the app to read all Security Copilot signed-in user\u0027s resources on behalf of the signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to Security Copilot user resources; no role assignment or credential reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityCopilotWorkspaces.ReadWrite.All",
|                                             "DisplayName":  "Read and write individually owned Security Copilot resources of the signed-in user",
|                                             "Description":  "Allows the app to read and write Security Copilot resources owned by the signed-in user on their behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to Security Copilot user resources; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityEvents.Read.All",
|                                             "DisplayName":  "Read your organization’s security events",
|                                             "Description":  "Allows the app to read your organization’s security events on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read access to security events; no ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityEvents.ReadWrite.All",
|                                             "DisplayName":  "Read and update your organization’s security events",
|                                             "Description":  "Allows the app to read your organization’s security events without a signed-in user. Also allows the app to update editable properties in security events.",
|                                             "Tier":  3,
|                                             "Reason":  "Application permission to read and update security events; no direct role assignment or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityIdentitiesAccount.Read.All",
|                                             "DisplayName":  "Read all identity security available identity accounts",
|                                             "Description":  "Allows the app to read all the identity security available identity accounts without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to identity security accounts; no ability to modify roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityIdentitiesActions.ReadWrite.All",
|                                             "DisplayName":  "Read and perform all identity security available actions",
|                                             "Description":  "Allows the app to read and write identity security available actions without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to identity security actions; no direct path to role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityIdentitiesAutoConfig.Read.All",
|                                             "DisplayName":  "Read sensors window auditing configuration",
|                                             "Description":  "Allows the app to read sensors window auditing configuration without a signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to sensor auditing configuration; no identity plane or role assignment control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityIdentitiesAutoConfig.ReadWrite.All",
|                                             "DisplayName":  "Read and write sensors window auditing configuration",
|                                             "Description":  "Allows the app to read and write the sensors window auditing configuration of the signed in user",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read/write access to sensor auditing config for signed-in user only; no tenant-wide identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityIdentitiesHealth.Read.All",
|                                             "DisplayName":  "Read identity security health issues",
|                                             "Description":  "Allows the app to read all the identity security health issues of signed user",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to identity security health issues for signed-in user; no role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityIdentitiesHealth.ReadWrite.All",
|                                             "DisplayName":  "Read and write identity security health issues",
|                                             "Description":  "Allows the app to read and write identity security health issues on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read/write access to identity security health issues for signed-in user only; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityIdentitiesMigration.Read.All",
|                                             "DisplayName":  "Read all identity security sensor migration",
|                                             "Description":  "Allows the app to read all the identity security sensor migration information without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to identity security sensor migration info; no role assignment or credential reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityIdentitiesMigration.ReadWrite.All",
|                                             "DisplayName":  "Read and write identity security sensor migration",
|                                             "Description":  "Allows the app to read and write identity security sensor migration on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read/write access to identity security sensor migration for signed-in user only; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityIdentitiesSensors.Read.All",
|                                             "DisplayName":  "Read identity security sensors",
|                                             "Description":  "Allows the app to read all the identity security sensors of signed user",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to identity security sensors for signed-in user; no role assignment or credential reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityIdentitiesSensors.ReadWrite.All",
|                                             "DisplayName":  "Read and write identity security sensors",
|                                             "Description":  "Allows the app to read and write identity security sensors on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read/write access to identity security sensors for signed-in user only; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityIdentitiesUserActions.Read.All",
|                                             "DisplayName":  "Read all identity security available user actions",
|                                             "Description":  "Allows the app to read all the identity security available user actions without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to identity security user actions; no ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityIdentitiesUserActions.ReadWrite.All",
|                                             "DisplayName":  "Read and perform all identity security available user actions",
|                                             "Description":  "Allows the app to read and write identity security available user actions without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to identity security user actions; no direct path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SecurityIncident.Read.All",
|                                             "DisplayName":  "Read all security incidents",
|                                             "Description":  "Allows the app to read all security incidents, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to security incidents; no ability to assign roles or reset credentials."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SecurityIncident.ReadWrite.All",
|                                             "DisplayName":  "Read and write to incidents",
|                                             "Description":  "Allows the app to read and write security incidents, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated read/write access to security incidents; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SemanticModel.Execute.All",
|                                             "DisplayName":  "SemanticModel.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to execute semantic model actions; no role assignment or credential reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SemanticModel.ExternalDataShare.All",
|                                             "DisplayName":  "Allows the app to create and manage external data shares for all semantic models",
|                                             "Description":  "Allows the app to create and manage external data shares for all semantic models, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Delegated permission to create/manage external data shares; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SemanticModel.Read.All",
|                                             "DisplayName":  "Read semantic models",
|                                             "Description":  "Allows reading semantic models on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to semantic models on behalf of the user; no direct identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SemanticModel.ReadWrite.All",
|                                             "DisplayName":  "Read and write semantic models",
|                                             "Description":  "Allows modifying semantic models on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify semantic models on behalf of the user; no path to tenant takeover or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SemanticModel.Reshare.All",
|                                             "DisplayName":  "SemanticModel.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare permission on semantic models; no direct or near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SensitivityLabel.Evaluate",
|                                             "DisplayName":  "Evaluate sensitivity labels",
|                                             "Description":  "Allow the app to determine if there is any sensitivity label to be applied automatically to the content or recommended to the user for manual application, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Evaluate sensitivity labels without signed-in user; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SensitivityLabel.Evaluate.All",
|                                             "DisplayName":  "Evaluate labels tenant scope.",
|                                             "Description":  "Allows the app to evaluate all sensitivity label.",
|                                             "Tier":  3,
|                                             "Reason":  "Evaluate all sensitivity labels on behalf of user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SensitivityLabel.Read",
|                                             "DisplayName":  "Get labels application scope.",
|                                             "Description":  "Allows the app to get sensitivity labels.",
|                                             "Tier":  3,
|                                             "Reason":  "Read sensitivity labels without signed-in user; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SensitivityLabels.Read.All",
|                                             "DisplayName":  "Get labels app scope.",
|                                             "Description":  "Allows the app to get sensitivity labels.",
|                                             "Tier":  3,
|                                             "Reason":  "Read sensitivity labels on behalf of user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SentimentSurvey.Export.All",
|                                             "DisplayName":  "Export all Sentiment Survey",
|                                             "Description":  "Allows the app to export all Sentiment Survey, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Export sentiment survey data on behalf of user; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ServiceActivity-Exchange.Read.All",
|                                             "DisplayName":  "Read all Exchange service activity",
|                                             "Description":  "Allows the app to read all Exchange service activity, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Exchange service activity without signed-in user; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ServiceActivity-Microsoft365Web.Read.All",
|                                             "DisplayName":  "Read all Microsoft 365 Web service activity",
|                                             "Description":  "Allows the app to read all Microsoft 365 Web service activity, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Microsoft 365 Web service activity without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ServiceActivity-OneDrive.Read.All",
|                                             "DisplayName":  "Read all One Drive service activity",
|                                             "Description":  "Allows the app to read all One Drive service activity, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read OneDrive service activity without signed-in user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ServiceActivity-Teams.Read.All",
|                                             "DisplayName":  "Read all Teams service activity",
|                                             "Description":  "Allows the app to read all Teams service activity, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Teams service activity on behalf of user; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Management APIs",
|                                             "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ServiceHealth.Read",
|                                             "DisplayName":  "Read service health information for your organization",
|                                             "Description":  "Allows the application to read service health information for your organization.",
|                                             "Tier":  3,
|                                             "Reason":  "Read service health information without signed-in user; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ServiceHealth.Read.All",
|                                             "DisplayName":  "Read service health",
|                                             "Description":  "Allows the app to read your tenant\u0027s service health information on behalf of the signed-in user. Health information may include service issues or service health overviews.",
|                                             "Tier":  3,
|                                             "Reason":  "Read tenant service health on behalf of user; no identity plane or role assignment capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ServiceMessage.Read.All",
|                                             "DisplayName":  "Read service messages",
|                                             "Description":  "Allows the app to read your tenant\u0027s service announcement messages, without a signed-in user. Messages may include information about new or changed features.",
|                                             "Tier":  3,
|                                             "Reason":  "Read tenant service announcement messages without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ServiceMessageViewpoint.Write",
|                                             "DisplayName":  "Update user status on service announcement messages",
|                                             "Description":  "Allows the app to update service announcement messages\u0027 user status on behalf of the signed-in user. The message status can be marked as read, archive, or favorite.",
|                                             "Tier":  3,
|                                             "Reason":  "Update service announcement message status on behalf of user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ServicePrincipalEndpoint.Read.All",
|                                             "DisplayName":  "Read service principal endpoints",
|                                             "Description":  "Allows the app to read service principal endpoints",
|                                             "Tier":  3,
|                                             "Reason":  "Read service principal endpoints without signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SharePointCrossTenantMigration.Read.All",
|                                             "DisplayName":  "Read Cross-Tenant migration settings and tasks",
|                                             "Description":  "Read Cross-Tenant migration settings and tasks, on behalf of the signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read cross-tenant migration settings on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SharePointTenantSettings.Read.All",
|                                             "DisplayName":  "Read SharePoint and OneDrive tenant settings",
|                                             "Description":  "Allows the application to read the tenant-level settings in SharePoint and OneDrive on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read tenant-level SharePoint and OneDrive settings on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ShortNotes.Read",
|                                             "DisplayName":  "Read short notes of the signed-in user",
|                                             "Description":  "Allows the app to read all the short notes a sign-in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "Read short notes on behalf of user; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ShortNotes.Read.All",
|                                             "DisplayName":  "Read all users\u0027 short notes",
|                                             "Description":  "Allows the app to read all the short notes without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read all short notes without signed-in user; data access only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ShortNotes.ReadWrite",
|                                             "DisplayName":  "Read, create, edit, and delete short notes of the signed-in user",
|                                             "Description":  "Allows the app to read, create, edit, and delete short notes of a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and modify short notes on behalf of user; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ShortNotes.ReadWrite.All",
|                                             "DisplayName":  "Read, create, edit, and delete all users\u0027 short notes",
|                                             "Description":  "Allows the app to read, create, edit, and delete all the short notes without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and modify all short notes without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SignInIdentifier.Read.All",
|                                             "DisplayName":  "Read SignInIdentifiers",
|                                             "Description":  "Allows the app to read your organization\u0027s sign-in identifiers, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read organization\u0027s sign-in identifiers on behalf of user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Sites.Read.All",
|                                             "DisplayName":  "Read items in all site collections ",
|                                             "Description":  "Allows the app to read documents and list items in all site collections without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read documents and list items in all site collections without signed-in user; data access only."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Sites.Search.All",
|                                             "DisplayName":  "Run search queries as a user",
|                                             "Description":  "Allows the app to run search queries and to read basic site info on behalf of the current signed-in user. Search results are based on the user\u0027s permissions instead of the app\u0027s permissions.",
|                                             "Tier":  3,
|                                             "Reason":  "Run search queries and read basic site info on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Sites.Selected",
|                                             "DisplayName":  "Access selected site collections",
|                                             "Description":  "Allow the application to access a subset of site collections without a signed in user. The specific site collections and the permissions granted will be configured in SharePoint Online.",
|                                             "Tier":  3,
|                                             "Reason":  "Access subset of site collections without signed-in user; scoped access with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SitesMetadataAdmin.Read.All",
|                                             "DisplayName":  "Read access to site collection metadata on the SharePoint admin site",
|                                             "Description":  "Allows the app to read site collection metadata without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read site collection metadata without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SMTP.Send",
|                                             "DisplayName":  "Send emails from mailboxes using SMTP AUTH.",
|                                             "Description":  "Allows the app to be able to send emails from the user’s mailbox using the SMTP AUTH client submission protocol.",
|                                             "Tier":  3,
|                                             "Reason":  "Send emails from user\u0027s mailbox using SMTP AUTH; data exfiltration only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SMTP.SendAsApp",
|                                             "DisplayName":  "Application access for sending emails via SMTP AUTH",
|                                             "Description":  "Allows the app to have send access to all mailboxes",
|                                             "Tier":  3,
|                                             "Reason":  "Send access to all mailboxes; data exfiltration risk but no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SparkJobDefinition.Execute.All",
|                                             "DisplayName":  "Execute spark job definitions",
|                                             "Description":  "Allows executing spark job definitions on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute spark job definitions on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SparkJobDefinition.Read.All",
|                                             "DisplayName":  "Read spark job definitions",
|                                             "Description":  "Allows reading spark job definitions on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read spark job definitions on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SparkJobDefinition.ReadWrite.All",
|                                             "DisplayName":  "Read and write spark job definitions",
|                                             "Description":  "Allows modifying spark job definitions on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify spark job definitions on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SparkJobDefinition.Reshare.All",
|                                             "DisplayName":  "SparkJobDefinition.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Reshare spark job definitions on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SpiffeTrustDomain.Read.All",
|                                             "DisplayName":  "Read SPIFFE trust domains and child resources",
|                                             "Description":  "Allows the app to read your organization\u0027s SPIFFE trust domains and child resources on behalf of the user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read organization\u0027s SPIFFE trust domains on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLDatabase.Execute.All",
|                                             "DisplayName":  "SQLDatabase.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Execute SQL database commands on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLDatabase.ExternalDataShare.All",
|                                             "DisplayName":  "Allows the app to create and manage external data shares for all SQL Databases",
|                                             "Description":  "Allows the app to create and manage external data shares for all SQL Databases, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Create and manage external data shares for SQL databases on behalf of user; data impact only."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLDatabase.Read.All",
|                                             "DisplayName":  "Read SQL databases",
|                                             "Description":  "Allows reading SQL databases on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read SQL databases on behalf of user; data access only."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLDatabase.ReadWrite.All",
|                                             "DisplayName":  "Read and write SQL databases",
|                                             "Description":  "Allows modifying SQL databases on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify SQL databases on behalf of user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLDatabase.Reshare.All",
|                                             "DisplayName":  "SQLDatabase.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Resharing SQL database access does not provide identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLEndpoint.Execute.All",
|                                             "DisplayName":  "SQLEndpoint.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Executing SQL endpoints does not enable role assignment or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLEndpoint.Read.All",
|                                             "DisplayName":  "Read SQL endpoints",
|                                             "Description":  "Allows reading SQL endpoints on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to SQL endpoints is data plane only with no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLEndpoint.ReadWrite.All",
|                                             "DisplayName":  "Read and write SQL endpoints",
|                                             "Description":  "Allows modifying SQL endpoints on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modifying SQL endpoints does not allow identity plane control or privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "SQLEndpoint.Reshare.All",
|                                             "DisplayName":  "SQLEndpoint.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "Resharing SQL endpoint access does not enable tenant takeover or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "StorageAccount.Read.All",
|                                             "DisplayName":  "View all storage accounts",
|                                             "Description":  "The app can view all storage accounts registered with Power BI that the signed in user is an admin of.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to storage accounts is data exfiltration risk only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "StorageAccount.ReadWrite.All",
|                                             "DisplayName":  "Read and write all storage accounts",
|                                             "Description":  "The app can view and edit all storage accounts registered with Power BI that the signed in user is an admin of.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to storage accounts does not provide direct or near-direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Storyline.ReadWrite.All",
|                                             "DisplayName":  "Read and write all Viva Engage storylines",
|                                             "Description":  "Allows the app to modify Viva Engage storylines, read all storylines properties, update storyline properties, and delete storyline properties without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Modifying Viva Engage storylines is content manipulation without identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SubjectRightsRequest.Read.All",
|                                             "DisplayName":  "Read all subject rights requests",
|                                             "Description":  "Allows the app to read subject rights requests without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to subject rights requests is data plane only with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "SubjectRightsRequest.ReadWrite.All",
|                                             "DisplayName":  "Read and write all subject rights requests",
|                                             "Description":  "Allows the app to read and write subject rights requests without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to subject rights requests does not enable role assignment or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Subscription.Read.All",
|                                             "DisplayName":  "Read all webhook subscriptions ",
|                                             "Description":  "Allows the app to read all webhook subscriptions on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading webhook subscriptions is data plane only with no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Tasks.Read",
|                                             "DisplayName":  "Read user tasks",
|                                             "Description":  "Allows the app to read user tasks",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to user tasks is data plane only with no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Tasks.Read.All",
|                                             "DisplayName":  "Read all users’ tasks and tasklist",
|                                             "Description":  "Allows the app to read all users’ tasks and task lists in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all users\u0027 tasks is data exfiltration risk only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Tasks.Read.Shared",
|                                             "DisplayName":  "Read all tasks a user has access to",
|                                             "Description":  "Allows the app to read all tasks a user has access to",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to shared tasks is data plane only with no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Tasks.ReadWrite",
|                                             "DisplayName":  "Create, read, update and delete user tasks ",
|                                             "Description":  "Allows the app to create, read, update and delete user tasks ",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to user tasks does not enable role assignment or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Tasks.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users’ tasks and tasklists",
|                                             "Description":  "Allows the app to create, read, update and delete all users’ tasks and task lists in your organization, without a signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to all users\u0027 tasks is data plane only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Tasks.ReadWrite.Shared",
|                                             "DisplayName":  "Create, read, update and delete all tasks a user has access to",
|                                             "Description":  "Allows the app to create, read, update and delete all tasks a user has access to",
|                                             "Tier":  3,
|                                             "Reason":  "Modify access to shared tasks does not enable identity plane control or privilege escalation."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TaskStatus.Submit",
|                                             "DisplayName":  "Submit project task status updates",
|                                             "Description":  "Allows the app to submit project task status updates the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Submitting project task status updates is content modification without identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Team.Create",
|                                             "DisplayName":  "Create teams",
|                                             "Description":  "Allows the app to create teams without a signed-in user. ",
|                                             "Tier":  3,
|                                             "Reason":  "Creating teams does not provide direct or near-direct control over identity or role assignments."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Team.ReadBasic.All",
|                                             "DisplayName":  "Get a list of all teams",
|                                             "Description":  "Get a list of all teams, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading basic team info is data plane only with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamMember.Read.All",
|                                             "DisplayName":  "Read the members of teams",
|                                             "Description":  "Read the members of teams, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading team members is data plane only without privilege escalation path."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamMember.ReadWriteNonOwnerRole.All",
|                                             "DisplayName":  "Add and remove members with non-owner role for all teams",
|                                             "Description":  "Add and remove members from all teams, without a signed-in user. Does not allow adding or removing a member with the owner role. Additionally, does not allow the app to elevate an existing member to the owner role.",
|                                             "Tier":  3,
|                                             "Reason":  "Modifying non-owner roles in teams does not allow elevation to owner or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsActivity.Read",
|                                             "DisplayName":  "Read user\u0027s teamwork activity feed",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s teamwork activity feed.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading user\u0027s teamwork activity feed is data plane only with no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsActivity.Read.All",
|                                             "DisplayName":  "Read all users\u0027 teamwork activity feed",
|                                             "Description":  "Allows the app to read all users\u0027 teamwork activity feed, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading all users\u0027 teamwork activity feeds is data exfiltration risk only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsActivity.Send",
|                                             "DisplayName":  "Send a teamwork activity to any user",
|                                             "Description":  "Allows the app to create new notifications in users\u0027 teamwork activity feeds without a signed in user. These notifications may not be discoverable or be held or governed by compliance policies.",
|                                             "Tier":  3,
|                                             "Reason":  "Sending notifications in teamwork feeds is content creation without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ManageSelectedForChat",
|                                             "DisplayName":  "Manage installation and permission grants of selected Teams apps in chats",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in chats the signed-in user can access. Gives the ability to manage permission grants for accessing those specific chats\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Managing Teams apps in chats user can access does not enable identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ManageSelectedForChat.All",
|                                             "DisplayName":  "Manage installation and permission grants of selected Teams apps in all chats",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any chat, without a signed-in user. Gives the ability to manage permission grants for accessing those specific chats\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Managing Teams apps in any chat is scoped to app management without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ManageSelectedForTeam",
|                                             "DisplayName":  "Manage installation and permission grants of selected Teams apps in teams",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Gives the ability to manage permission grants for accessing those specific teams\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Managing Teams apps in teams user can access does not enable role assignment or credential theft."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ManageSelectedForTeam.All",
|                                             "DisplayName":  "Manage installation and permission grants of selected Teams apps in all teams",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any team, without a signed-in user. Gives the ability to manage permission grants for accessing those specific teams\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Managing Teams apps in any team is app management only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ManageSelectedForUser",
|                                             "DisplayName":  "Manage installation and permission grants of selected Teams apps in users\u0027 personal scope",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall seleected Teams apps in user accounts, on behalf of the signed-in user. Gives the ability to manage permission grants for accessing those specific users\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Managing Teams apps in user accounts user can access is scoped and does not enable identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ManageSelectedForUser.All",
|                                             "DisplayName":  "Manage installation and permission grants of selected Teams apps for all user accounts",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any user account, without a signed-in user. Gives the ability to manage permission grants for accessing those specific users\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Managing Teams apps in any user account is app management only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.Read.All",
|                                             "DisplayName":  "Read installed Teams apps for all installation scopes",
|                                             "Description":  "Allows the app to read the Teams apps that are installed in any scope, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading installed Teams apps is data plane only with no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadForChat",
|                                             "DisplayName":  "Read installed Teams apps in chats",
|                                             "Description":  "Allows the app to read the Teams apps that are installed in chats the signed-in user can access. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading Teams apps in chats user can access is data plane only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadForChat.All",
|                                             "DisplayName":  "Read installed Teams apps for all chats",
|                                             "Description":  "Allows the app to read the Teams apps that are installed in any chat, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading Teams apps in any chat is data plane only with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadForTeam",
|                                             "DisplayName":  "Read installed Teams apps in teams",
|                                             "Description":  "Allows the app to read the Teams apps that are installed in teams the signed-in user can access. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading Teams apps in teams user can access is data plane only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadForTeam.All",
|                                             "DisplayName":  "Read installed Teams apps for all teams",
|                                             "Description":  "Allows the app to read the Teams apps that are installed in any team, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading Teams apps in any team is data plane only with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadForUser",
|                                             "DisplayName":  "Read user\u0027s installed Teams apps",
|                                             "Description":  "Allows the app to read the Teams apps that are installed for the signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading Teams apps installed for signed-in user is data plane only with no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadForUser.All",
|                                             "DisplayName":  "Read installed Teams apps for all users",
|                                             "Description":  "Allows the app to read the Teams apps that are installed for any user, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading Teams apps installed for any user is data plane only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadSelectedForChat",
|                                             "DisplayName":  "Read selected installed Teams apps in chats",
|                                             "Description":  "Allows the app to read the selected Teams apps that are installed in chats the signed-in user can access. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading selected Teams apps in chats user can access is data plane only with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadSelectedForChat.All",
|                                             "DisplayName":  "Read selected installed Teams apps in all chats",
|                                             "Description":  "Allows the app to read the selected Teams apps that are installed in any chat, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading selected Teams apps in any chat is data plane only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadSelectedForTeam",
|                                             "DisplayName":  "Read selected installed Teams apps in teams",
|                                             "Description":  "Allows the app to read the selected Teams apps that are installed in teams the signed-in user can access. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading selected Teams apps in teams user can access is data plane only with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadSelectedForTeam.All",
|                                             "DisplayName":  "Read selected installed Teams apps in all teams",
|                                             "Description":  "Allows the app to read the selected Teams apps that are installed in any team, without a signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading selected Teams apps in any team is data plane only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadSelectedForUser",
|                                             "DisplayName":  "Read user\u0027s selected installed Teams apps",
|                                             "Description":  "Allows the app to read the selected Teams apps that are installed for the signed-in user. Does not give the ability to read application-specific settings.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading selected Teams apps installed for signed-in user is data plane only with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadSelectedForUser.All",
|                                             "DisplayName":  "Read selected installed Teams apps for all users",
|                                             "Description":  "Allows an app to read, install, upgrade, and uninstall selected apps to any user, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Reading, installing, upgrading, and uninstalling selected apps for any user is app management only without identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentForChat",
|                                             "DisplayName":  "Manage installed Teams apps in chats",
|                                             "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in chats the signed-in user can access. Gives the ability to manage permission grants for accessing those specific chats\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Managing Teams apps in chats user can access with consent management does not enable identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForChat",
|                                             "DisplayName":  "Allow the Teams app to manage itself and its permission grants in chats",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in chats the signed-in user can access, and manage its permission grants for accessing those specific chats\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage itself in chats accessible to signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForChat.All",
|                                             "DisplayName":  "Allow the Teams app to manage itself and its permission grants for all chats",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for any chat, without a signed-in user, and manage its permission grants for accessing those specific chats\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage itself in any chat without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForTeam",
|                                             "DisplayName":  "Allow the Teams app to manage itself and its permission grants in teams",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in teams the signed-in user can access, and manage its permission grants for accessing those specific teams\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage itself in teams accessible to signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForTeam.All",
|                                             "DisplayName":  "Allow the Teams app to manage itself and its permission grants for all teams",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for any team, without a signed-in user, and manage its permission grants for accessing those specific teams\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage itself in any team without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForUser",
|                                             "DisplayName":  "Allow the Teams app to manage itself and its permission grants in user accounts",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in user accounts, and manage its permission grants for accessing those specific users\u0027 data, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage itself in user accounts on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForUser.All",
|                                             "DisplayName":  "Allow the Teams app to manage itself and its permission grants in all user accounts",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for any user account, without a signed-in user, and manage its permission grants for accessing those specific users\u0027 data.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage itself in any user account without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelfForChat",
|                                             "DisplayName":  "Allow the Teams app to manage itself in chats",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in chats the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs in chats accessible to signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelfForChat.All",
|                                             "DisplayName":  "Allow the Teams app to manage itself for all chats",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for any chat, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs in any chat without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelfForTeam",
|                                             "DisplayName":  "Allow the app to manage itself in teams",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself to teams the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs in teams accessible to signed-in user only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelfForTeam.All",
|                                             "DisplayName":  "Allow the Teams app to manage itself for all teams",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in any team, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs in any team without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelfForUser",
|                                             "DisplayName":  "Allow the Teams app to manage itself for a user",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs for signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsAppInstallation.ReadWriteSelfForUser.All",
|                                             "DisplayName":  "Allow the app to manage itself for all users",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself to any user, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs for any user without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsTab.Create",
|                                             "DisplayName":  "Create tabs in Microsoft Teams.",
|                                             "Description":  "Allows the app to create tabs in any team in Microsoft Teams, without a signed-in user. This does not grant the ability to read, modify or delete tabs after they are created, or give access to the content inside the tabs.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows creating tabs in any team without signed-in user; no access to content or identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTab.Read.All",
|                                             "DisplayName":  "Read tabs in Microsoft Teams.",
|                                             "Description":  "Read the names and settings of tabs inside any team in Microsoft Teams, on behalf of the signed-in user. This does not give access to the content inside the tabs.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows reading tab names and settings on behalf of signed-in user; no identity plane control or content access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTab.ReadWrite.All",
|                                             "DisplayName":  "Read and write tabs in Microsoft Teams.",
|                                             "Description":  "Read and write tabs in any team in Microsoft Teams, on behalf of the signed-in user. This does not give access to the content inside the tabs.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows reading and writing tabs on behalf of signed-in user; no identity plane control or content access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTab.ReadWriteForChat",
|                                             "DisplayName":  "Allow the Teams app to manage all tabs in chats",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs in chats the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows managing tabs in chats accessible to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsTab.ReadWriteForChat.All",
|                                             "DisplayName":  "Allow the Teams app to manage all tabs for all chats",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs for any chat, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows managing tabs in any chat without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTab.ReadWriteForTeam",
|                                             "DisplayName":  "Allow the Teams app to manage all tabs in teams",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs to teams the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows managing tabs in teams accessible to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsTab.ReadWriteForTeam.All",
|                                             "DisplayName":  "Allow the Teams app to manage all tabs for all teams",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs in any team, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows managing tabs in any team without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTab.ReadWriteForUser",
|                                             "DisplayName":  "Allow the Teams app to manage all tabs for a user",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs for the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows managing tabs for signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsTab.ReadWriteForUser.All",
|                                             "DisplayName":  "Allow the app to manage all tabs for all users",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs for any user, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows managing tabs for any user without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTab.ReadWriteSelfForChat",
|                                             "DisplayName":  "Allow the Teams app to manage only its own tabs in chats",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs in chats the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs in chats accessible to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsTab.ReadWriteSelfForChat.All",
|                                             "DisplayName":  "Allow the Teams app to manage only its own tabs for all chats",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for any chat, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs in any chat without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTab.ReadWriteSelfForTeam",
|                                             "DisplayName":  "Allow the Teams app to manage only its own tabs in teams",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs to teams the signed-in user can access.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs in teams accessible to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsTab.ReadWriteSelfForTeam.All",
|                                             "DisplayName":  "Allow the Teams app to manage only its own tabs for all teams",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs in any team, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs in any team without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTab.ReadWriteSelfForUser",
|                                             "DisplayName":  "Allow the Teams app to manage only its own tabs for a user",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs for signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsTab.ReadWriteSelfForUser.All",
|                                             "DisplayName":  "Allow the Teams app to manage only its own tabs for all users",
|                                             "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for any user, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows a Teams app to manage its own tabs for any user without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTelephoneNumber.Read.All",
|                                             "DisplayName":  "Read Tenant-Acquired Telephone Number Details",
|                                             "Description":  "Allows the app to read your tenant\u0027s acquired telephone number details on behalf of the signed-in admin user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows reading tenant telephone number details on behalf of signed-in admin; no identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamsTelephoneNumber.ReadWrite.All",
|                                             "DisplayName":  "Read and Modify Tenant-Acquired Telephone Number Details",
|                                             "Description":  "Allows the app to read and modify your tenant\u0027s acquired telephone number details on behalf of the signed-in admin user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows reading and modifying tenant telephone number details on behalf of signed-in admin; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamsUserConfiguration.Read.All",
|                                             "DisplayName":  "Read Teams user configurations",
|                                             "Description":  "Allows the app to read your tenant\u0027s user configurations, without a signed-in user. User configuration may include attributes related to user, such as telephone number, assigned policies, etc.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to user configurations only; no path to identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamTemplates.Read",
|                                             "DisplayName":  "Read available Teams templates",
|                                             "Description":  "Allows the app to read the available Teams templates, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Teams templates scoped to signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamTemplates.Read.All",
|                                             "DisplayName":  "Read all available Teams Templates",
|                                             "Description":  "Allows the app to read all available Teams Templates, without a signed-user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all Teams templates without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Teamwork.Read.All",
|                                             "DisplayName":  "Read organizational teamwork settings",
|                                             "Description":  "Allows the app to read all teamwork settings of the organization without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to teamwork settings without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkAppSettings.Read.All",
|                                             "DisplayName":  "Read Teams app settings",
|                                             "Description":  "Allows the app to read the Teams app settings without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Teams app settings without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkDevice.Read.All",
|                                             "DisplayName":  "Read Teams devices",
|                                             "Description":  "Allow the app to read the management data for Teams devices, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Teams device management data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamworkSection.Read",
|                                             "DisplayName":  "Read your sections",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s sections (folders) for organizing chats and channels in Teams.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to signed-in user\u0027s Teams sections; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkSection.Read.All",
|                                             "DisplayName":  "Read all users\u0027 sections",
|                                             "Description":  "Allows the app to read all users\u0027 sections (folders) for organizing chats and channels in Teams, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all users\u0027 Teams sections without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamworkSection.ReadWrite",
|                                             "DisplayName":  "Read and write your sections",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s sections (folders) for organizing chats and channels in Teams.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to signed-in user\u0027s Teams sections; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamworkTag.Read",
|                                             "DisplayName":  "Read tags in Teams",
|                                             "Description":  "Allows the app to read tags in Teams, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Teams tags on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkTag.Read.All",
|                                             "DisplayName":  "Read tags in Teams",
|                                             "Description":  "Allows the app to read tags in Teams without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Teams tags without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamworkTag.ReadWrite",
|                                             "DisplayName":  "Read and write tags in Teams",
|                                             "Description":  "Allows the app to read and write tags in Teams, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to Teams tags on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TeamworkTargetedMessage.Read.All",
|                                             "DisplayName":  "Read all targeted messages of group chat or channel",
|                                             "Description":  "Allows the app to read all group chat or channel targeted messages in Microsoft Teams.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to targeted Teams messages without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamworkTargetedMessage.ReadWrite",
|                                             "DisplayName":  "Update targeted messages belonging to the user",
|                                             "Description":  "Allows the user to update group chat or channel targeted messages in Microsoft Teams.",
|                                             "Tier":  3,
|                                             "Reason":  "Update access to targeted Teams messages on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TeamworkUserInteraction.Read.All",
|                                             "DisplayName":  "Read all of the possible Teams interactions between the user and other users",
|                                             "Description":  "Allows the app to read all of the possible Teams interactions between the signed-in user and other users",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Teams interactions for signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "Tenant.Read.All",
|                                             "DisplayName":  "View all content in tenant",
|                                             "Description":  "The app can view all content in the tenant without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all tenant content without signed-in user; data plane only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Tenant.ReadWrite.All",
|                                             "DisplayName":  "Read and write all content in tenant",
|                                             "Description":  "The app can create, edit, view, and delete all content in the tenant if the signed in user is in the Global administrator or Power BI service administrator role.",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to tenant content only if signed-in user is Global or Power BI admin; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TenantGovernance-Invitation.Read.All",
|                                             "DisplayName":  "Read Tenant Governance invitations",
|                                             "Description":  "Allows the application to list and read all Tenant Governance invitations without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Tenant Governance invitations without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-Invitation.ReadWrite.All",
|                                             "DisplayName":  "Read and write Tenant Governance invitations",
|                                             "Description":  "Allows the application to list, read, create, and delete Tenant Governance invitations on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to Tenant Governance invitations on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-PolicyTemplate.Read.All",
|                                             "DisplayName":  "Read Tenant Governance policy templates",
|                                             "Description":  "Allows the application to list and read all Tenant Governance policy templates on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Tenant Governance policy templates on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-PolicyTemplate.ReadWrite.All",
|                                             "DisplayName":  "Read and write Tenant Governance policy templates",
|                                             "Description":  "Allows the application to list, read, create, update, and delete Tenant Governance policy templates on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to Tenant Governance policy templates on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TenantGovernance-RelatedTenant.Read.All",
|                                             "DisplayName":  "Read related tenants",
|                                             "Description":  "Allows the application to list and read related tenants information without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to related tenants info without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-RelatedTenant.ReadWrite.All",
|                                             "DisplayName":  "Read and write related tenants",
|                                             "Description":  "Allows the application to list, read, and refresh related tenants information on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to related tenants info on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-Relationship.Read.All",
|                                             "DisplayName":  "Read Tenant Governance relationships",
|                                             "Description":  "Allows the application to list and read all Tenant Governance relationships on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Tenant Governance relationships on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-Relationship.ReadWrite.All",
|                                             "DisplayName":  "Read and write Tenant Governance relationships",
|                                             "Description":  "Allows the application to list, read, and update Tenant Governance relationships on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to Tenant Governance relationships on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TenantGovernance-Request.Read.All",
|                                             "DisplayName":  "Read Tenant Governance requests",
|                                             "Description":  "Allows the application to list and read all Tenant Governance requests without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Tenant Governance requests without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-Request.ReadWrite.All",
|                                             "DisplayName":  "Read and write Tenant Governance requests",
|                                             "Description":  "Allows the application to list, read, create, and update Tenant Governance requests on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to Tenant Governance requests on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-Setting.Read.All",
|                                             "DisplayName":  "Read Tenant Governance settings",
|                                             "Description":  "Allows the application to read Tenant Governance settings on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to Tenant Governance settings on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantGovernance-Setting.ReadWrite.All",
|                                             "DisplayName":  "Read and write Tenant Governance settings",
|                                             "Description":  "Allows the application to read Tenant Governance settings and update them on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to Tenant Governance settings on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantLicenseStatus.Read.All",
|                                             "DisplayName":  "TenantLicenseStatus.Read.All",
|                                             "Description":  "TenantLicenseStatus.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to tenant license status on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TenantReports.Read.All",
|                                             "DisplayName":  "Can view tenant reports from the admin site",
|                                             "Description":  "Allows the app to read tenant reports via the SharePoint admin site, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to tenant reports on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TenantReports.ReadWrite.All",
|                                             "DisplayName":  "Read and write access to tenant report data on the SharePoint admin site",
|                                             "Description":  "Allows the app to read and write tenant reports via the SharePoint admin site without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to tenant reports without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TermStore.Read.All",
|                                             "DisplayName":  "Read all term store data",
|                                             "Description":  "Allows the app to read all term store data, without a signed-in user. This includes all sets, groups and terms in the term store.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to term store data without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 SharePoint Online",
|                                             "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "TermStore.ReadWrite.All",
|                                             "DisplayName":  "Read and write managed metadata",
|                                             "Description":  "Allows the app to read, create, update, and delete managed metadata and to read basic site info on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to managed metadata on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ThreatAssessment.Read.All",
|                                             "DisplayName":  "Read threat assessment requests",
|                                             "Description":  "Allows an app to read your organization\u0027s threat assessment requests, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to threat assessment requests without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ThreatAssessment.ReadWrite.All",
|                                             "DisplayName":  "Read and write threat assessment requests",
|                                             "Description":  "Allows an app to read your organization\u0027s threat assessment requests on behalf of the signed-in user. Also allows the app to create new requests to assess threats received by your organization on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to threat assessment requests on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ThreatHunting.Read.All",
|                                             "DisplayName":  "Run hunting queries",
|                                             "Description":  "Allows the app to run hunting queries, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Run hunting queries on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ThreatIndicators.Read.All",
|                                             "DisplayName":  "Read all threat indicators",
|                                             "Description":  "Allows the app to read all the indicators for your organization, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to threat indicators on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ThreatIndicators.ReadWrite.OwnedBy",
|                                             "DisplayName":  "Manage threat indicators this app creates or owns",
|                                             "Description":  "Allows the app to create threat indicators, and fully manage those threat indicators (read, update and delete), without a signed-in user.  It cannot update any threat indicators it does not own.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage owned threat indicators without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ThreatIntelligence.Read.All",
|                                             "DisplayName":  "Read all threat intelligence information",
|                                             "Description":  "Allows the app to read threat intelligence information, such as indicators, observations, and articles, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read threat intelligence info on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ThreatSubmission.Read",
|                                             "DisplayName":  "Read threat submissions",
|                                             "Description":  "Allows the app to read the threat submissions and threat submission policies owned by the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read threat submissions owned by signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "ThreatSubmission.Read.All",
|                                             "DisplayName":  "Read all of the organization\u0027s threat submissions",
|                                             "Description":  "Allows the app to read your organization\u0027s threat submissions and to view threat submission policies without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read all threat submissions without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ThreatSubmission.ReadWrite",
|                                             "DisplayName":  "Read and write threat submissions",
|                                             "Description":  "Allows the app to read the threat submissions and threat submission policies owned by the signed-in user. Also allows the app to create new threat submissions on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write threat submissions owned by signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ThreatSubmission.ReadWrite.All",
|                                             "DisplayName":  "Read and write all threat submissions",
|                                             "Description":  "Allows the app to read your organization\u0027s threat submissions and threat submission policies on behalf of the signed-in user. Also allows the app to create new threat submissions on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write all threat submissions on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "ThreatSubmissionPolicy.ReadWrite.All",
|                                             "DisplayName":  "Read and write all threat submission policies",
|                                             "Description":  "Allows the app to read your organization\u0027s threat submission policies on behalf of the signed-in user. Also allows the app to create new threat submission policies on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write threat submission policies on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TiRemediation.Read.All",
|                                             "DisplayName":  "TiRemediation.Read.All",
|                                             "Description":  "TiRemediation.Read.All",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to TiRemediation data; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TiRemediation.ReadWrite.All",
|                                             "DisplayName":  "TiRemediation.ReadWrite.All",
|                                             "Description":  "TiRemediation.ReadWrite.All",
|                                             "Tier":  3,
|                                             "Reason":  "Write access to TiRemediation data only; does not enable identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Topic.Read.All",
|                                             "DisplayName":  "Read topic items",
|                                             "Description":  "Allows the app to read topics data on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to topics data on behalf of signed-in user; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "TrustFrameworkKeySet.Read.All",
|                                             "DisplayName":  "Read trust framework key sets",
|                                             "Description":  "Allows the app to read trust framework key set properties without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to trust framework key sets; no ability to modify or escalate."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UnifiedGroupMember.Read.AsGuest",
|                                             "DisplayName":  "Read unified group memberships as guest",
|                                             "Description":  "Allows the app to read basic unified group properties, memberships and owners of the group the signed-in guest is a member of.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to unified group membership as guest; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User.Invite.All",
|                                             "DisplayName":  "Invite guest users to the organization",
|                                             "Description":  "Allows the app to invite guest users to the organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Can invite guest users without signed-in user; no direct path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User.Read",
|                                             "DisplayName":  "Sign in and read user profile",
|                                             "Description":  "Allows users to sign-in to the app, and allows the app to read the profile of signed-in users. It also allows the app to read basic company information of signed-in users.",
|                                             "Tier":  3,
|                                             "Reason":  "Read basic profile of signed-in user only; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User.Read.All",
|                                             "DisplayName":  "Read all users\u0027 full profiles",
|                                             "Description":  "Allows the app to read user profiles without a signed in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read user profiles without signed-in user; no write or role assignment capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User.ReadBasic.All",
|                                             "DisplayName":  "Read all users\u0027 basic profiles",
|                                             "Description":  "Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address and photo.",
|                                             "Tier":  3,
|                                             "Reason":  "Read basic profile properties on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Exchange Online",
|                                             "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User.ReadWrite",
|                                             "DisplayName":  "Read and write user profiles",
|                                             "Description":  "Allows the app to create, read, and write a set of the current user\u0027s profile properties in your company or school. Includes display name, photo, and email address.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write own profile properties only; no tenant-wide impact or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Rights Management Services",
|                                             "AppId":  "00000012-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "user_impersonation",
|                                             "DisplayName":  "Create and access protected content for users",
|                                             "Description":  "Allow the application to use Azure Rights Management",
|                                             "Tier":  3,
|                                             "Reason":  "Allows use of Azure Rights Management; no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserActivity.ReadWrite.CreatedByApp",
|                                             "DisplayName":  "Read and write app activity to users\u0027 activity feed",
|                                             "Description":  "Allows the app to read and report the signed-in user\u0027s activity in the app.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write signed-in user activity in app; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthenticationMethod.Read",
|                                             "DisplayName":  "Read user authentication methods.",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s authentication methods, including phone numbers and Authenticator app settings. This does not allow the app to see secret information like the signed-in user\u0027s passwords, or to sign-in  or otherwise use the signed-in user\u0027s authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read own authentication methods without secrets; no credential reset or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthenticationMethod.Read.All",
|                                             "DisplayName":  "Read all users\u0027 authentication methods",
|                                             "Description":  "Allows the app to read authentication methods of all users in your organization that the signed-in user has access to. Authentication methods include things like a user’s phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read authentication methods of all users accessible to signed-in user; no write or reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthenticationMethod.ReadWrite",
|                                             "DisplayName":  "Read and write user authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s authentication methods, including phone numbers and Authenticator app settings.                       This does not allow the app to see secret information like the signed-in user\u0027s passwords, or                      to sign-in or otherwise use the signed-in user\u0027s authentication methods.  ",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write own authentication methods without secrets; no role assignment or credential reset."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Email.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s email authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s email authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read own email authentication methods without secrets; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-Email.Read.All",
|                                             "DisplayName":  "Read all users\u0027 email methods",
|                                             "Description":  "Allows the app to read email methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read email authentication methods of all users; no write or reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Email.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s email authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s email authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write own email authentication methods; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-External.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s external authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s external authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read own external authentication methods; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-External.Read.All",
|                                             "DisplayName":  "Read all users\u0027 external authentication methods",
|                                             "Description":  "Allows the app to read external authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read external authentication methods of all users; no write or reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-External.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s external authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s external authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write own external authentication methods; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-HardwareOATH.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s HardwareOATH authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s HardwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read own HardwareOATH methods; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserAuthMethod-HardwareOATH.Read.All",
|                                             "DisplayName":  "Read all users\u0027 HardwareOATH authentication methods",
|                                             "Description":  "Allows the app to read HardwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read HardwareOATH methods of all users; no write or reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-HardwareOATH.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s HardwareOATH authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s HardwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write own HardwareOATH methods; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-MicrosoftAuthApp.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s Microsoft Authenticator authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s Microsoft Authenticator authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read own Microsoft Authenticator methods; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-MicrosoftAuthApp.Read.All",
|                                             "DisplayName":  "Read all users\u0027 Microsoft authentication methods",
|                                             "Description":  "Allows the app to read Microsoft authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Microsoft Authenticator methods of all users accessible to signed-in user; no write or reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-MicrosoftAuthApp.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s Microsoft Authenticator authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s Microsoft Authenticator authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write own Microsoft Authenticator methods; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Passkey.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s passkey authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s passkey authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read own passkey authentication methods; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Passkey.Read.All",
|                                             "DisplayName":  "Read all users\u0027 passkey authentication methods",
|                                             "Description":  "Allows the app to read passkey authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read passkey authentication methods of all users accessible to signed-in user; no write or reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Passkey.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s passkey authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s passkey authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write own passkey authentication methods; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Password.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s password authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s password authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read own password authentication methods without secrets; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Password.Read.All",
|                                             "DisplayName":  "Read all users\u0027 password authentication methods",
|                                             "Description":  "Allows the app to read password authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read password authentication methods of all users accessible to signed-in user; no write or reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Password.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s password authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s password authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write own password authentication methods; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Phone.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s phone authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s phone authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read own phone authentication methods; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Phone.Read.All",
|                                             "DisplayName":  "Read all users\u0027 phone authentication methods",
|                                             "Description":  "Allows the app to read phone authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read phone authentication methods of all users accessible to signed-in user; no write or reset capability."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-Phone.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s phone authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s phone authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Allows read/write of signed-in user\u0027s phone auth methods only; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-PlatformCred.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s platform credential authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s platform credential authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to signed-in user\u0027s platform credentials only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-PlatformCred.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s platform credential authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s platform credential authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to signed-in user\u0027s platform credentials only; no tenant-wide impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-QR.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s QR authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s QR authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to signed-in user\u0027s QR auth methods only; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-QR.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s QR authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s QR authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to signed-in user\u0027s QR auth methods only; no tenant-wide impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-SoftwareOATH.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s SoftwareOATH authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s SoftwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to signed-in user\u0027s SoftwareOATH methods only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-SoftwareOATH.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s SoftwareOATH authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s SoftwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to signed-in user\u0027s SoftwareOATH methods only; no tenant-wide impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-TAP.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s Temporary Access Pass authentication methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s Temporary Access Pass authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to signed-in user\u0027s Temporary Access Pass methods only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-TAP.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s Temporary Access Pass authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s Temporary Access Pass authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to signed-in user\u0027s Temporary Access Pass methods only; no tenant-wide impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-WindowsHello.Read",
|                                             "DisplayName":  "Read the signed-in user\u0027s Windows Hello methods",
|                                             "Description":  "Allows the app to read the signed-in user\u0027s Windows Hello authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to signed-in user\u0027s Windows Hello methods only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserAuthMethod-WindowsHello.ReadWrite",
|                                             "DisplayName":  "Read and write the signed-in user\u0027s Windows Hello authentication methods",
|                                             "Description":  "Allows the app to read and write the signed-in user\u0027s Windows Hello authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write access to signed-in user\u0027s Windows Hello methods only; no tenant-wide impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserCloudClipboard.Read",
|                                             "DisplayName":  "Read cloud clipboard items",
|                                             "Description":  "Allows the app to read cloud clipboard data on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to signed-in user\u0027s cloud clipboard data only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserDataFunction.Execute.All",
|                                             "DisplayName":  "Execute user data function items",
|                                             "Description":  "Allows executing user data function items on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute user data functions on behalf of signed-in user; no tenant-wide identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserDataFunction.Read.All",
|                                             "DisplayName":  "Read user data function items",
|                                             "Description":  "Allows reading user data function items on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read user data functions on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserDataFunction.ReadWrite.All",
|                                             "DisplayName":  "Read and write user data function items",
|                                             "Description":  "Allows modifying user data function items on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify user data functions on behalf of signed-in user; no tenant-wide identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User-LifeCycleInfo.Read.All",
|                                             "DisplayName":  "Read all users\u0027 lifecycle information",
|                                             "Description":  "Allows the app to read the lifecycle information like employeeLeaveDateTime of users in your organization, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read lifecycle info on behalf of signed-in user; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User-LifeCycleInfo.ReadWrite.All",
|                                             "DisplayName":  "Read and write all users\u0027 lifecycle information",
|                                             "Description":  "Allows the app to read and write the lifecycle information like employeeLeaveDateTime of users in your organization, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write lifecycle info without signed-in user; no direct identity plane control or role assignment."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "User-Mail.ReadWrite.All",
|                                             "DisplayName":  "Read and write secondary mail addresses for users",
|                                             "Description":  "Allows the app to read and write secondary mail addresses for all users, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write secondary mail addresses for all users; data plane only, no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserNotification.ReadWrite.CreatedByApp",
|                                             "DisplayName":  "Deliver and manage user\u0027s notifications",
|                                             "Description":  "Allows the app to send, read, update and delete user’s notifications.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage user\u0027s notifications; no path to identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "User-Phone.ReadWrite.All",
|                                             "DisplayName":  "Read and write all user mobile phone and business phones",
|                                             "Description":  "Allows the app to read and write the mobile phone and business phones for all users, without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write phone numbers for all users; no direct identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Office 365 Information Protection",
|                                             "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UsersAggregateByAttackSimulation.tenant.read",
|                                             "DisplayName":  "UsersAggregateByAttackSimulation.tenant.read",
|                                             "Description":  "UsersAggregateByAttackSimulation.tenant.read",
|                                             "Tier":  3,
|                                             "Reason":  "Read-only access to attack simulation data; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserShiftPreferences.Read.All",
|                                             "DisplayName":  "Read all user shift preferences",
|                                             "Description":  "Allows the app to read all users\u0027 shift schedule preferences without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read all users\u0027 shift preferences; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserShiftPreferences.ReadWrite.All",
|                                             "DisplayName":  "Read and write all user shift preferences",
|                                             "Description":  "Allows the app to manage all users\u0027 shift schedule preferences without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage all users\u0027 shift preferences; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserState.ReadWrite.All",
|                                             "DisplayName":  "Read and write user settings and state",
|                                             "Description":  "The app can view and edit any user settings and the user-specific state associated with  content the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "View and edit user settings for accessible content; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserTeamwork.Read",
|                                             "DisplayName":  "Read user teamwork settings",
|                                             "Description":  "Allows the app to read the teamwork settings of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read teamwork settings of signed-in user only; no tenant-wide impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "UserTeamwork.Read.All",
|                                             "DisplayName":  "Read all user teamwork settings",
|                                             "Description":  "Allows the app to read all user teamwork settings without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read teamwork settings for all users; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserTimelineActivity.Write.CreatedByApp",
|                                             "DisplayName":  "Write app activity to users\u0027 timeline",
|                                             "Description":  "Allows the app to report the signed-in user\u0027s app activity information to Microsoft Timeline.",
|                                             "Tier":  3,
|                                             "Reason":  "Report signed-in user\u0027s app activity; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserWindowsSettings.Read.All",
|                                             "DisplayName":  "Read windows settings for all devices",
|                                             "Description":  "Allows the app to read a user\u0027s windows settings which are stored in cloud and their values on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read users\u0027 Windows settings on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "UserWindowsSettings.ReadWrite.All",
|                                             "DisplayName":  "Read and write windows settings for all devices",
|                                             "Description":  "Allows the app to read and write a user\u0027s windows settings which are stored in cloud and their values on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write users\u0027 Windows settings on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VariableLibrary.Execute.All",
|                                             "DisplayName":  "Execute variable libraries",
|                                             "Description":  "Allows executing variable libraries on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute variable libraries on behalf of signed-in user; no tenant-wide identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VariableLibrary.Read.All",
|                                             "DisplayName":  "Read variable libraries",
|                                             "Description":  "Allows reading variable libraries on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read variable libraries on behalf of signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VariableLibrary.ReadWrite.All",
|                                             "DisplayName":  "Read and write variable libraries",
|                                             "Description":  "Allows modifying variable libraries on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify variable libraries on behalf of signed-in user; no tenant-wide identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VariableLibrary.Reshare.All",
|                                             "DisplayName":  "VariableLibrary.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description; assumed low impact with no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VerifiedId-Profile.Read.All",
|                                             "DisplayName":  "Read Verified Id profiles",
|                                             "Description":  "This role can read Verified Id profiles in a tenant.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Verified ID profiles; no direct identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VerifiedId-Profile.ReadWrite.All",
|                                             "DisplayName":  "Read and write Verified Id profiles",
|                                             "Description":  "This role can read and write Verified Id profiles in a tenant.",
|                                             "Tier":  3,
|                                             "Reason":  "Read/write Verified ID profiles; no direct identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VirtualAppointment.Read",
|                                             "DisplayName":  "Read a user\u0027s virtual appointments",
|                                             "Description":  "Allows an application to read virtual appointments for the signed-in user. Only an organizer or participant user can read their virtual appointments.  ",
|                                             "Tier":  3,
|                                             "Reason":  "Read virtual appointments for signed-in user only; no tenant-wide identity control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "VirtualAppointment.Read.All",
|                                             "DisplayName":  "Read all virtual appointments for users, as authorized by online meetings application access policy",
|                                             "Description":  "Allows the application to read virtual appointments for all users, without a signed-in user. The app must also be authorized to access an individual user’s data by the online meetings application access policy.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to virtual appointments for all users; no identity plane control or credential access."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VirtualAppointment.ReadWrite",
|                                             "DisplayName":  "Read and write a user\u0027s virtual appointments  ",
|                                             "Description":  "Allows an application to read and write virtual appointments for the signed-in user. Only an organizer or participant user can read and write their virtual appointments. ",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access limited to signed-in user\u0027s virtual appointments; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "VirtualAppointment.ReadWrite.All",
|                                             "DisplayName":  "Read-write all virtual appointments for users, as authorized by online meetings app access policy",
|                                             "Description":  "Allows the application to read and write virtual appointments for all users, without a signed-in user. The app must also be authorized to access an individual user’s data by the online meetings application access policy.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to virtual appointments for all users; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "VirtualAppointmentNotification.Send",
|                                             "DisplayName":  "Send notification regarding virtual appointments as any user",
|                                             "Description":  "Allows the application to send notification regarding virtual appointments as any user, without a signed-in user. The app must also be authorized to access an individual user\u0027s data by the online meetings application access policy.",
|                                             "Tier":  3,
|                                             "Reason":  "Ability to send notifications as any user; no role assignment or credential reset capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VirtualEvent.Read",
|                                             "DisplayName":  "Read your virtual events",
|                                             "Description":  "Allows the app to read virtual events created by you",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to user\u0027s own virtual events only; no identity plane impact."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "VirtualEvent.Read.All",
|                                             "DisplayName":  "Read all users\u0027 virtual events",
|                                             "Description":  "Allows the app to read all virtual events without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to all virtual events without signed-in user; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "VirtualEvent.ReadWrite",
|                                             "DisplayName":  "Read and write your virtual events",
|                                             "Description":  "Allows the app to read and write virtual events for you",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to user\u0027s own virtual events; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "VirtualEventRegistration-Anon.ReadWrite.All",
|                                             "DisplayName":  "Read and write anonymous users\u0027 virtual event registrations",
|                                             "Description":  "Allows the app to read and write anonymous users\u0027 virtual event registrations, without a signed-in user",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write access to anonymous virtual event registrations; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Warehouse.Execute.All",
|                                             "DisplayName":  "Execute warehouses",
|                                             "Description":  "Allows executing warehouses on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Execute warehouses on user\u0027s behalf; no direct identity plane or role assignment rights."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Warehouse.ExternalDataShare.All",
|                                             "DisplayName":  "Allows the app to create and manage external data shares for all warehouses",
|                                             "Description":  "Allows the app to create and manage external data shares for all warehouses, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage external data shares on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Warehouse.Read.All",
|                                             "DisplayName":  "Read warehouses",
|                                             "Description":  "Allows reading warehouses on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read access to warehouses on user\u0027s behalf; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Warehouse.ReadWrite.All",
|                                             "DisplayName":  "Read and write warehouses",
|                                             "Description":  "Allows modifying warehouses on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify warehouses on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Warehouse.Reshare.All",
|                                             "DisplayName":  "Warehouse.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but delegated warehouse reshare likely data plane only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Warehouse.Restore.All",
|                                             "DisplayName":  "Make API calls that require restore permissions on all Warehouses",
|                                             "Description":  "Allows the app to make API calls that require restore permissions on all Warehouses, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Restore permissions on warehouses on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "WarehouseSnapshot.Execute.All",
|                                             "DisplayName":  "WarehouseSnapshot.Execute (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but delegated execute likely data plane only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "WarehouseSnapshot.Read.All",
|                                             "DisplayName":  "Read warehouse snapshots",
|                                             "Description":  "Allows reading warehouse snapshots on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Read warehouse snapshots on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "WarehouseSnapshot.ReadWrite.All",
|                                             "DisplayName":  "Read and write warehouse snapshots",
|                                             "Description":  "Allows modifying warehouse snapshots on the user’s behalf.",
|                                             "Tier":  3,
|                                             "Reason":  "Modify warehouse snapshots on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "WarehouseSnapshot.Reshare.All",
|                                             "DisplayName":  "WarehouseSnapshot.Reshare (retired)",
|                                             "Description":  " ",
|                                             "Tier":  3,
|                                             "Reason":  "No description but delegated reshare likely data plane only; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Application",
|                                             "Value":  "WindowsUpdates.Read.All",
|                                             "DisplayName":  "Read all Windows update deployment settings",
|                                             "Description":  "Allows the app to read all Windows update deployment settings for the organization without a signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read Windows update deployment settings; no role assignment or credential reset capabilities."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "WindowsUpdates.ReadWrite.All",
|                                             "DisplayName":  "Read and write all Windows update deployment settings",
|                                             "Description":  "Allows the app to read and write all Windows update deployment settings for the organization on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read and write Windows update deployment settings; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "WorkforceIntegration.Read.All",
|                                             "DisplayName":  "Read workforce integrations",
|                                             "Description":  "Allows the app to read workforce integrations, to synchronize data from Microsoft Teams Shifts, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Read workforce integrations on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Microsoft Graph",
|                                             "AppId":  "00000003-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "WorkforceIntegration.ReadWrite.All",
|                                             "DisplayName":  "Read and write workforce integrations",
|                                             "Description":  "Allows the app to manage workforce integrations, to synchronize data from Microsoft Teams Shifts, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Manage workforce integrations on user\u0027s behalf; no direct identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Workspace.GitCommit.All",
|                                             "DisplayName":  "Make API calls that commit workspace content and setting to remote git repository.",
|                                             "Description":  "Allows the app to make API calls that commit workspace content and setting to remote git repository, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Commit workspace content to git on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Workspace.GitUpdate.All",
|                                             "DisplayName":  "Make API calls that update workspace content and setting from remote git repository.",
|                                             "Description":  "Allows the app to make API calls that update workspace content and setting from remote git repository, on behalf of the signed-in user.",
|                                             "Tier":  3,
|                                             "Reason":  "Update workspace content from git on user\u0027s behalf; no identity plane control."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Workspace.Read.All",
|                                             "DisplayName":  "View all workspaces",
|                                             "Description":  "The app can view all workspaces that the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "View all workspaces user has access to; no path to tenant takeover."
|                                         },
|                                         {
|                                             "ServicePrincipal":  "Power BI Service",
|                                             "AppId":  "00000009-0000-0000-c000-000000000000",
|                                             "PermissionType":  "Delegated",
|                                             "Value":  "Workspace.ReadWrite.All",
|                                             "DisplayName":  "Read and write all workspaces",
|                                             "Description":  "The app can view and edit all workspaces that the signed in user has access to.",
|                                             "Tier":  3,
|                                             "Reason":  "View and edit all workspaces user has access to; no identity plane control."
|                                         }
|                                     ],
|    "EntraID_APIPermissions_Catalog":  [
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d07a8cc0-3d51-4b77-b3b0-32704d1f69fa",
|                                               "Value":  "AccessReview.Read.All",
|                                               "DisplayName":  "Read all access reviews",
|                                               "Description":  "Allows the app to read access reviews, reviewers, decisions and settings in the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ef5f7d5c-338f-44b0-86c3-351f46c8bb5f",
|                                               "Value":  "AccessReview.ReadWrite.All",
|                                               "DisplayName":  "Manage all access reviews",
|                                               "Description":  "Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings in the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "18228521-a591-40f1-b215-5fad4488c117",
|                                               "Value":  "AccessReview.ReadWrite.Membership",
|                                               "DisplayName":  "Manage access reviews for group and app memberships",
|                                               "Description":  "Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings in the organization for group and app memberships, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8c0aed2c-0c61-433d-b63c-6370ddc73248",
|                                               "Value":  "Acronym.Read.All",
|                                               "DisplayName":  "Read all acronyms",
|                                               "Description":  "Allows an app to read all acronyms without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "134fd756-38ce-4afd-ba33-e9623dbe66c2",
|                                               "Value":  "AdministrativeUnit.Read.All",
|                                               "DisplayName":  "Read all administrative units",
|                                               "Description":  "Allows the app to read administrative units and administrative unit membership without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5eb59dd3-1da2-4329-8733-9dabdc435916",
|                                               "Value":  "AdministrativeUnit.ReadWrite.All",
|                                               "DisplayName":  "Read and write all administrative units",
|                                               "Description":  "Allows the app to create, read, update, and delete administrative units and manage administrative unit membership without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9c4a07db-e0c1-4fb0-8e85-dfd8ae3b8201",
|                                               "Value":  "AgentCard.ReadWrite.ManagedBy",
|                                               "DisplayName":  "Read and write managed-by agent cards in Agent Registry",
|                                               "Description":  "Allows the app to read and update agent cards that designate the calling app as their manager and manage their skills in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3ee18438-e6e5-4858-8f1c-d7b723b45213",
|                                               "Value":  "AgentCardManifest.Read.All",
|                                               "DisplayName":  "Read all agent card manifests in Agent Registry",
|                                               "Description":  "Allows the app to read all agent card manifests in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "228b1a03-f7ca-4348-b50d-e8a547ab61af",
|                                               "Value":  "AgentCardManifest.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent card manifests in Agent Registry",
|                                               "Description":  "Allows the app to read and write to all agent card manifests in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "77f6034c-52f5-4526-9fa1-d55a67e72cc4",
|                                               "Value":  "AgentCardManifest.ReadWrite.ManagedBy",
|                                               "DisplayName":  "Read and write managed-by agent card manifests in Agent Registry",
|                                               "Description":  "Allows the app to read and write agent card manifests that name it as manager in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e65ee1da-d1d5-467b-bdd0-3e9bb94e6e0c",
|                                               "Value":  "AgentCollection.Read.All",
|                                               "DisplayName":  "Read all collections in Agent Registry",
|                                               "Description":  "Allows the app to read all collections and their membership in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "feb31d7d-a227-4487-898c-e014840d07b3",
|                                               "Value":  "AgentCollection.ReadWrite.All",
|                                               "DisplayName":  "Read and write all collections in Agent Registry",
|                                               "Description":  "Allows the app to create, read, update, and delete all collections and manage their membership in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2e0fb698-9996-479f-926b-ce63f4397829",
|                                               "Value":  "AgentCollection.ReadWrite.ManagedBy",
|                                               "DisplayName":  "Read and write managed-by collections in Agent Registry",
|                                               "Description":  "Allows the app to create, read, update, and delete collections that designate the calling app as their manager and manage their membership in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ad25cc1d-84d8-47df-a08e-b34c2e800819",
|                                               "Value":  "AgentIdentity.Create.All",
|                                               "DisplayName":  "Create agent identities without an agent blueprint parent",
|                                               "Description":  "Allows the app to create agent identities, even if the app is not the parent agent identity blueprint."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4c390976-b2b7-42e0-9187-c6be3bead001",
|                                               "Value":  "AgentIdentity.CreateAsManager",
|                                               "DisplayName":  "Create agent identities linked to itself.",
|                                               "Description":  "Allows the app to create linked agent identities without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5b016f9b-18eb-41d4-869a-66931914d1c8",
|                                               "Value":  "AgentIdentity.DeleteRestore.All",
|                                               "DisplayName":  "Delete and restore agent identities",
|                                               "Description":  "Allows the app to delete and restore agent identities without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "69ee0943-4fa4-4ec8-8e52-d12e4ea661a3",
|                                               "Value":  "AgentIdentity.EnableDisable.All",
|                                               "DisplayName":  "Enable or disable agent identities",
|                                               "Description":  "Allows the app to enable or disable agent identities without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b2b8f011-2898-4234-9092-5059f6c1ebfa",
|                                               "Value":  "AgentIdentity.Read.All",
|                                               "DisplayName":  "Read all agent identities",
|                                               "Description":  "Allows the app to read all agent identities without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dcf7150a-88d4-4fe6-9be1-c2744c455397",
|                                               "Value":  "AgentIdentity.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent identities",
|                                               "Description":  "Allows the app read, update, and delete agent identities without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0510736e-bdfb-4b37-9a1f-89b4a074763a",
|                                               "Value":  "AgentIdentityBlueprint.AddRemoveCreds.All",
|                                               "DisplayName":  "Update agent identity blueprint credentials",
|                                               "Description":  "Allows updating agent identity blueprint credentials without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ea4b2453-ad2d-4d94-9155-10d5d9493ce9",
|                                               "Value":  "AgentIdentityBlueprint.Create",
|                                               "DisplayName":  "Create agent identity blueprints.",
|                                               "Description":  "Allows creating new agent identity blueprints without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3f80b699-6405-4e36-a4df-4f19950ff91e",
|                                               "Value":  "AgentIdentityBlueprint.DeleteRestore.All",
|                                               "DisplayName":  "Delete and restore agent identity blueprints.",
|                                               "Description":  "Allows deleting or restoring agent identity blueprints without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7547a7d1-36fa-4479-9c31-559a600eaa4f",
|                                               "Value":  "AgentIdentityBlueprint.Read.All",
|                                               "DisplayName":  "Read all agent identity blueprints",
|                                               "Description":  "Allows the app to read all agent identity blueprints without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7fddd33b-d884-4ec0-8696-72cff90ff825",
|                                               "Value":  "AgentIdentityBlueprint.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent identity blueprints.",
|                                               "Description":  "Allows the app to read, update, and delete agent identity blueprints without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "19202363-278e-49c2-bf00-391e2ba00881",
|                                               "Value":  "AgentIdentityBlueprint.UpdateAuthProperties.All",
|                                               "DisplayName":  "Update agent identity blueprint authorization and authentication properties",
|                                               "Description":  "Allows updating agent identity blueprint authorization and authentication properties without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "76232daa-a1e4-4544-b664-495a006513bf",
|                                               "Value":  "AgentIdentityBlueprint.UpdateBranding.All",
|                                               "DisplayName":  "Update agent identity blueprint branding",
|                                               "Description":  "Allows updating agent identity blueprint branding without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8959696d-d07e-4916-9b1e-3ba9ce459161",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.Create",
|                                               "DisplayName":  "Create agent identity blueprint service principals.",
|                                               "Description":  "Allows creating new agent identity blueprint principals without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f86a2dd8-9298-4675-bd78-f5a3572da2d7",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.DeleteRestore.All",
|                                               "DisplayName":  "Delete and restore agent identity blueprints.",
|                                               "Description":  "Allows deleting or restoring agent identity blueprints without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a0bdd23d-8b19-4682-b428-574d96527c6f",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.EnableDisable.All",
|                                               "DisplayName":  "Enable or disable agent identity blueprint principals.",
|                                               "Description":  "Allows enabling or disabling agent identity blueprint principals without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9361dea9-4524-493d-941d-f1b65aaf6c7c",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.Read.All",
|                                               "DisplayName":  "Read agent identity blueprint principals.",
|                                               "Description":  "Allows reading agent identity blueprint principals without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3bc933bc-8b4d-4cb6-ac49-b73774299250",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent identity blueprint principals.",
|                                               "Description":  "Allows the app to read, update, and delete agent identity blueprint principals without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b782c9ad-6f2b-4894-a21b-72bf22417f0a",
|                                               "Value":  "AgentIdUser.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent ID users\u0027 full profiles",
|                                               "Description":  "Allows the app to read and update agent ID user profiles and read basic company properties without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4aa6e624-eee0-40ab-bdd8-f9639038a614",
|                                               "Value":  "AgentIdUser.ReadWrite.IdentityParentedBy",
|                                               "DisplayName":  "Read and write all agent ID users\u0027 full profiles",
|                                               "Description":  "Allows the app to read and update ID agent user profiles and read basic company properties without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "799a4732-85b8-4c67-b048-75f0e88a232b",
|                                               "Value":  "AgentInstance.Read.All",
|                                               "DisplayName":  "Read all agent instances in Agent Registry",
|                                               "Description":  "Allows the app to read all agent instances and their related collections in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "07abdd95-78dc-4353-bd32-09f880ea43d0",
|                                               "Value":  "AgentInstance.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent instances in Agent Registry",
|                                               "Description":  "Allows the app to create, read, update, and delete all agent instances in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "782ab1bf-24f1-4c27-8bbc-2006d42792a6",
|                                               "Value":  "AgentInstance.ReadWrite.ManagedBy",
|                                               "DisplayName":  "Read and write managed-by agent instances in Agent Registry",
|                                               "Description":  "Allows the app to create, read, update, and delete agent instances that designate the calling app as their manager in your organization\u0027s Agent Registry without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d3acceb6-4673-47c0-aeac-582f2c7cf72c",
|                                               "Value":  "AgentRegistration.Read.All",
|                                               "DisplayName":  "Read all agent registrations",
|                                               "Description":  "Allows the app to read agent registration information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "39fb8c64-7bd3-4107-8515-14d6e55ddda4",
|                                               "Value":  "AgentRegistration.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent registrations",
|                                               "Description":  "Allows the app to read and write agent registration information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2f3e6f8c-093b-4c57-a58b-ba5ce494a169",
|                                               "Value":  "Agreement.Read.All",
|                                               "DisplayName":  "Read all terms of use agreements",
|                                               "Description":  "Allows the app to read terms of use agreements, without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c9090d00-6101-42f0-a729-c41074260d47",
|                                               "Value":  "Agreement.ReadWrite.All",
|                                               "DisplayName":  "Read and write all terms of use agreements",
|                                               "Description":  "Allows the app to read and write terms of use agreements, without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d8e4ec18-f6c0-4620-8122-c8b1f2bf400e",
|                                               "Value":  "AgreementAcceptance.Read.All",
|                                               "DisplayName":  "Read all terms of use acceptance statuses",
|                                               "Description":  "Allows the app to read terms of use acceptance statuses, without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "839c90ab-5771-41ee-aef8-a562e8487c1e",
|                                               "Value":  "AiEnterpriseInteraction.Read.All",
|                                               "DisplayName":  "Read all AI enterprise interactions.",
|                                               "Description":  "Allows the app to read all AI enterprise interactions."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b86848a7-d5b1-41eb-a9b4-54a4e6306e97",
|                                               "Value":  "APIConnectors.Read.All",
|                                               "DisplayName":  "Read API connectors for authentication flows",
|                                               "Description":  "Allows the app to read the API connectors used in user authentication flows, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1dfe531a-24a6-4f1b-80f4-7a0dc5a0a171",
|                                               "Value":  "APIConnectors.ReadWrite.All",
|                                               "DisplayName":  "Read and write API connectors for authentication flows",
|                                               "Description":  "Allows the app to read, create and manage the API connectors used in user authentication flows, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e12dae10-5a57-4817-b79d-dfbec5348930",
|                                               "Value":  "AppCatalog.Read.All",
|                                               "DisplayName":  "Read all app catalogs",
|                                               "Description":  "Allows the app to read apps in the app catalogs without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dc149144-f292-421e-b185-5953f2e98d7f",
|                                               "Value":  "AppCatalog.ReadWrite.All",
|                                               "DisplayName":  "Read and write to all app catalogs",
|                                               "Description":  "Allows the app to create, read, update, and delete apps in the app catalogs without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3be0012a-cc4e-426b-895b-f9c836bf6381",
|                                               "Value":  "Application-RemoteDesktopConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write the remote desktop security configuration for all apps",
|                                               "Description":  "Allows the app to read and write the remote desktop security configuration for all apps in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9a5d68dd-52b0-4cc2-bd40-abcf44ac3a30",
|                                               "Value":  "Application.Read.All",
|                                               "DisplayName":  "Read all applications",
|                                               "Description":  "Allows the app to read all applications and service principals without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fc023787-fd04-4e44-9bc7-d454f00c0f0a",
|                                               "Value":  "Application.ReadUpdate.All",
|                                               "DisplayName":  "Read and update all apps",
|                                               "Description":  "Allows the app to read and update all apps in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9",
|                                               "Value":  "Application.ReadWrite.All",
|                                               "DisplayName":  "Read and write all applications",
|                                               "Description":  "Allows the app to create, read, update and delete applications and service principals without a signed-in user.  Does not allow management of consent grants."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "18a4783c-866b-4cc7-a460-3d5e5662c884",
|                                               "Value":  "Application.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Manage apps that this app creates or owns",
|                                               "Description":  "Allows the app to create other applications, and fully manage those applications (read, update, update application secrets and delete), without a signed-in user.  It cannot update any apps that it is not an owner of."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "06b708a9-e830-4db3-a914-8e69da51d44f",
|                                               "Value":  "AppRoleAssignment.ReadWrite.All",
|                                               "DisplayName":  "Manage app permission grants and app role assignments",
|                                               "Description":  "Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9f265de7-8d5e-4e9a-a805-5e8bbc49656f",
|                                               "Value":  "ApprovalSolution.Read.All",
|                                               "DisplayName":  "Read all approvals",
|                                               "Description":  "Allows the app to read all approvals and approval item subscriptions, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "45583558-1113-4d06-8969-e79a28edc9ad",
|                                               "Value":  "ApprovalSolution.ReadWrite.All",
|                                               "DisplayName":  "Read all approvals and manage approval subscriptions",
|                                               "Description":  "Allows the app to read all approvals and create, update, or remove approval item subscriptions, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "93283d0a-6322-4fa8-966b-8c121624760d",
|                                               "Value":  "AttackSimulation.Read.All",
|                                               "DisplayName":  "Read attack simulation data of an organization",
|                                               "Description":  "Allows the app to read attack simulation and training data for an organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e125258e-8c8a-42a8-8f55-ab502afa52f3",
|                                               "Value":  "AttackSimulation.ReadWrite.All",
|                                               "DisplayName":  "Read, create, and update all attack simulation data of an organization",
|                                               "Description":  "Allows the app to read, create, and update attack simulation and training data for an organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "99bc85fb-e857-4220-9f8c-3a1c83148d2e",
|                                               "Value":  "AuditActivity.Read",
|                                               "DisplayName":  "Read activity audit log from the audit store.",
|                                               "Description":  "Read activity audit log from the audit store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f6318678-2713-4bb6-b123-233e7336c1bd",
|                                               "Value":  "AuditActivity.Write",
|                                               "DisplayName":  "Upload activity audit logs to the audit store.",
|                                               "Description":  "Allows the application to upload bulk activity audit logs to the audit store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b0afded3-3588-46d8-8b3d-9842eff778da",
|                                               "Value":  "AuditLog.Read.All",
|                                               "DisplayName":  "Read all audit log data",
|                                               "Description":  "Allows the app to read and query your audit log activities, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "20e6f8e4-ffac-4cf7-82f7-70ddb7564318",
|                                               "Value":  "AuditLogsQuery-CRM.Read.All",
|                                               "DisplayName":  "Read audit logs data from Dynamics CRM workload",
|                                               "Description":  "Allows the app to read and query audit logs from Dynamics CRM workload, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0bc85aed-7b0b-437a-bac8-3b29a1b84c99",
|                                               "Value":  "AuditLogsQuery-Endpoint.Read.All",
|                                               "DisplayName":  "Read audit logs data from Endpoint Data Loss Prevention workload",
|                                               "Description":  "Allows the app to read and query audit logs from Endpoint Data Loss Prevention workload, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7276d950-48fc-4269-8348-f22f2bb296d0",
|                                               "Value":  "AuditLogsQuery-Entra.Read.All",
|                                               "DisplayName":  "Read audit logs data from Entra (Azure AD) workload",
|                                               "Description":  "Allows the app to read and query audit logs from Entra (Azure AD) workload, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6b0d2622-d34e-4470-935b-b96550e5ca8d",
|                                               "Value":  "AuditLogsQuery-Exchange.Read.All",
|                                               "DisplayName":  "Read audit logs data from Exchange workload",
|                                               "Description":  "Allows the app to read and query audit logs from Exchange workload, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8a169a81-841c-45fd-ad43-96aede8801a0",
|                                               "Value":  "AuditLogsQuery-OneDrive.Read.All",
|                                               "DisplayName":  "Read audit logs data from OneDrive workload",
|                                               "Description":  "Allows the app to read and query audit logs from OneDrive workload, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "91c64a47-a524-4fce-9bf3-3d569a344ecf",
|                                               "Value":  "AuditLogsQuery-SharePoint.Read.All",
|                                               "DisplayName":  "Read audit logs data from SharePoint workload",
|                                               "Description":  "Allows the app to read and query audit logs from SharePoint workload, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5e1e9171-754d-478c-812c-f1755a9a4c2d",
|                                               "Value":  "AuditLogsQuery.Read.All",
|                                               "DisplayName":  "Read audit logs data from all services",
|                                               "Description":  "Allows the app to read and query audit logs from all services."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "381f742f-e1f8-4309-b4ab-e3d91ae4c5c1",
|                                               "Value":  "AuthenticationContext.Read.All",
|                                               "DisplayName":  "Read all authentication context information",
|                                               "Description":  "Allows the app to read the authentication context information in your organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a88eef72-fed0-4bf7-a2a9-f19df33f8b83",
|                                               "Value":  "AuthenticationContext.ReadWrite.All",
|                                               "DisplayName":  "Read and write all authentication context information",
|                                               "Description":  "Allows the app to read and update the authentication context information in your organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5fbb5982-3230-4882-93c0-2167523ce0c2",
|                                               "Value":  "BackupRestore-Configuration.Read.All",
|                                               "DisplayName":  "Read all backup configuration policies",
|                                               "Description":  "Allows the app to read all backup configurations, and lists of Microsoft 365 service resources to be backed-up, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "18133149-5489-40ac-80f0-4b6fa85f6cdc",
|                                               "Value":  "BackupRestore-Configuration.ReadWrite.All",
|                                               "DisplayName":  "Read and edit all backup configuration policies",
|                                               "Description":  "Allows the app to read and update the backup configuration, and list of Microsoft 365 service resources to be backed-up, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6fe20a79-0e15-45a1-b019-834c125993a0",
|                                               "Value":  "BackupRestore-Control.Read.All",
|                                               "DisplayName":  "Read the status of the M365 backup service",
|                                               "Description":  "Allows the app to read the status of M365 backup service (enable/disable), without signed in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fb240865-88f8-4a1d-923f-98dbc7920860",
|                                               "Value":  "BackupRestore-Control.ReadWrite.All",
|                                               "DisplayName":  "Update or read the status of the M365 backup service",
|                                               "Description":  "Allows the app to update or read the status of M365 backup service (enable/disable), without signed in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ecae8511-f2d7-4be4-bdbf-91f244d45986",
|                                               "Value":  "BackupRestore-Monitor.Read.All",
|                                               "DisplayName":  "Read all monitoring, quota and billing information for the tenant",
|                                               "Description":  "Allows the app to monitor all backup and restore jobs, view quota usage and billing details, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "87853aa5-0372-4710-b34b-cef27bb7156e",
|                                               "Value":  "BackupRestore-Restore.Read.All",
|                                               "DisplayName":  "Read all restore sessions",
|                                               "Description":  "Allows the app to read all restore sessions, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bebd0841-a3d8-4313-a51d-731112c8ee41",
|                                               "Value":  "BackupRestore-Restore.ReadWrite.All",
|                                               "DisplayName":  "Read restore all sessions and start restore sessions from backups",
|                                               "Description":  "Allows the app to search all backup snapshots for Microsoft 365 resources, and restore Microsoft 365 resources from a backed-up snapshot, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f6135c51-c766-4be1-9638-ed90c2ed2443",
|                                               "Value":  "BackupRestore-Search.Read.All",
|                                               "DisplayName":  "Search for metadata properties in all backup snapshots",
|                                               "Description":  "Allows the app to search all backup snapshots for Microsoft 365 resources, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9e8be751-7eee-4c09-bcfd-d64f6b087fd8",
|                                               "Value":  "BillingConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write application billing configuration",
|                                               "Description":  "Allows the app to read and write the billing configuration on all applications without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "57f1cf28-c0c4-4ec3-9a30-19a2eaaf2f6e",
|                                               "Value":  "BitlockerKey.Read.All",
|                                               "DisplayName":  "Read all BitLocker keys",
|                                               "Description":  "Allows an app to read BitLocker keys for all devices, without a signed-in user. Allows read of the recovery key."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f690d423-6b29-4d04-98c6-694c42282419",
|                                               "Value":  "BitlockerKey.ReadBasic.All",
|                                               "DisplayName":  "Read all BitLocker keys basic information",
|                                               "Description":  "Allows an app to read basic BitLocker key properties for all devices, without a signed-in user. Does not allow read of the recovery key."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6b22000a-1228-42ec-88db-b8c00399aecb",
|                                               "Value":  "Bookings.Manage.All",
|                                               "DisplayName":  "Manage bookings information",
|                                               "Description":  "Allows an app to read, write and manage bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6e98f277-b046-4193-a4f2-6bf6a78cd491",
|                                               "Value":  "Bookings.Read.All",
|                                               "DisplayName":  "Read all Bookings related resources.",
|                                               "Description":  "Allows an app to read Bookings appointments, businesses, customers, services, and staff without a signed-in user.  "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0c4b2d20-7919-468d-8668-c54b09d4dee8",
|                                               "Value":  "Bookings.ReadWrite.All",
|                                               "DisplayName":  "Read and write bookings information",
|                                               "Description":  "Allows an app to read and write bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user. Does not allow create, delete and publish of booking businesses."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9769393e-5a9f-4302-9e3d-7e018ecb64a7",
|                                               "Value":  "BookingsAppointment.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Bookings related resources.",
|                                               "Description":  "Allows an app to read and write Bookings appointments and customers, and additionally allows reading businesses, services, and staff without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "be95e614-8ef3-49eb-8464-1c9503433b86",
|                                               "Value":  "Bookmark.Read.All",
|                                               "DisplayName":  "Read all bookmarks",
|                                               "Description":  "Allows an app to read all bookmarks without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c5ee1f21-fc7f-4937-9af0-c91648ff9597",
|                                               "Value":  "BrowserSiteLists.Read.All",
|                                               "DisplayName":  "Read all browser site lists for your organization",
|                                               "Description":  "Allows an app to read all browser site lists configured for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8349ca94-3061-44d5-9bfb-33774ea5e4f9",
|                                               "Value":  "BrowserSiteLists.ReadWrite.All",
|                                               "DisplayName":  "Read and write all browser site lists for your organization",
|                                               "Description":  "Allows an app to read and write all browser site lists configured for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "acc0fc4d-2cd6-4194-8700-1768d8423d86",
|                                               "Value":  "BusinessScenarioConfig.Read.OwnedBy",
|                                               "DisplayName":  "Read all business scenario configurations this app creates or owns",
|                                               "Description":  "Allows the app to read the configurations of business scenarios it owns, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bbea195a-4c47-4a4f-bff2-cba399e11698",
|                                               "Value":  "BusinessScenarioConfig.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Read and write all business scenario configurations this app creates or owns",
|                                               "Description":  "Allows the app to create new business scenarios and fully manage the configurations of scenarios it owns, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6c0257fd-cffe-415b-8239-2d0d70fdaa9c",
|                                               "Value":  "BusinessScenarioData.Read.OwnedBy",
|                                               "DisplayName":  "Read data for all business scenarios this app creates or owns",
|                                               "Description":  "Allows the app to read the data associated with the business scenarios it owns, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f2d21f22-5d80-499e-91cc-0a8a4ce16f54",
|                                               "Value":  "BusinessScenarioData.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Read and write data for all business scenarios this app creates or owns",
|                                               "Description":  "Allows the app to fully manage the data associated with the business scenarios it owns, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "798ee544-9d2d-430c-a058-570e29e34338",
|                                               "Value":  "Calendars.Read",
|                                               "DisplayName":  "Read calendars in all mailboxes",
|                                               "Description":  "Allows the app to read events of all calendars without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8ba4a692-bc31-4128-9094-475872af8a53",
|                                               "Value":  "Calendars.ReadBasic.All",
|                                               "DisplayName":  "Read basic details of calendars in all mailboxes ",
|                                               "Description":  "Allows the app to read events of all calendars, except for properties such as body, attachments, and extensions, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ef54d2bf-783f-4e0f-bca1-3210c0444d99",
|                                               "Value":  "Calendars.ReadWrite",
|                                               "DisplayName":  "Read and write calendars in all mailboxes",
|                                               "Description":  "Allows the app to create, read, update, and delete events of all calendars without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "792b782b-7822-4b92-8103-77e44f2f706c",
|                                               "Value":  "CallAiInsights.Read.All",
|                                               "DisplayName":  "Read all AI Insights for calls.",
|                                               "Description":  "Allows the app to read all AI Insights for all calls, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5aa33e77-b893-495e-bdc5-4bf6f27d42a0",
|                                               "Value":  "CallDelegation.Read.All",
|                                               "DisplayName":  "Read delegation settings",
|                                               "Description":  "Allows the app to read delegation settings of you"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8d06abce-e69b-4122-ba60-4f901bb1db2f",
|                                               "Value":  "CallDelegation.ReadWrite.All",
|                                               "DisplayName":  "Read and write delegation settings",
|                                               "Description":  "Allows the app to read and write delegation settings of you"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f0a35f91-2aa6-4a99-9d5a-5b6bcb66204e",
|                                               "Value":  "CallEvents-Emergency.Read.All",
|                                               "DisplayName":  "Read all emergency call events",
|                                               "Description":  "Allows the app to read emergency call event information for all users in your organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1abb026f-7572-49f6-9ddd-ad61cbba181e",
|                                               "Value":  "CallEvents.Read.All",
|                                               "DisplayName":  "Read all call events",
|                                               "Description":  "Allows the app to read call event information for all users in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a2611786-80b3-417e-adaa-707d4261a5f0",
|                                               "Value":  "CallRecord-PstnCalls.Read.All",
|                                               "DisplayName":  "Read PSTN and direct routing call log data",
|                                               "Description":  "Allows the app to read all PSTN and direct routing call log data without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ce8fb1f1-5e1f-44a0-b102-4ec28454d0dc",
|                                               "Value":  "CallRecordings.Read.All",
|                                               "DisplayName":  "Read all call recordings",
|                                               "Description":  "Allows the app to read call recordings for all calls without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "45bbb07e-7321-4fd7-a8f6-3ff27e6a81c8",
|                                               "Value":  "CallRecords.Read.All",
|                                               "DisplayName":  "Read all call records",
|                                               "Description":  "Allows the app to read call records for all calls and online meetings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a7a681dc-756e-4909-b988-f160edc6655f",
|                                               "Value":  "Calls.AccessMedia.All",
|                                               "DisplayName":  "Access media streams in a call as an app",
|                                               "Description":  "Allows the app to get direct access to media streams in a call, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "284383ee-7f6e-4e40-a2a8-e85dcb029101",
|                                               "Value":  "Calls.Initiate.All",
|                                               "DisplayName":  "Initiate outgoing 1 to 1 calls from the app",
|                                               "Description":  "Allows the app to place outbound calls to a single user and transfer calls to users in your organization’s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4c277553-8a09-487b-8023-29ee378d8324",
|                                               "Value":  "Calls.InitiateGroupCall.All",
|                                               "DisplayName":  "Initiate outgoing group calls from the app",
|                                               "Description":  "Allows the app to place outbound calls to multiple users and add participants to meetings in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f6b49018-60ab-4f81-83bd-22caeabfed2d",
|                                               "Value":  "Calls.JoinGroupCall.All",
|                                               "DisplayName":  "Join group calls and meetings as an app",
|                                               "Description":  "Allows the app to join group calls and scheduled meetings in your organization, without a signed-in user.  The app will be joined with the privileges of a directory user to meetings in your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fd7ccf6b-3d28-418b-9701-cd10f5cd2fd4",
|                                               "Value":  "Calls.JoinGroupCallAsGuest.All",
|                                               "DisplayName":  "Join group calls and meetings as a guest",
|                                               "Description":  "Allows the app to anonymously join group calls and scheduled meetings in your organization, without a signed-in user.  The app will be joined as a guest to meetings in your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4cd61b6d-8692-40bf-9d90-7f38db5e5fce",
|                                               "Value":  "CallTranscripts.Read.All",
|                                               "DisplayName":  "Read all call transcripts",
|                                               "Description":  "Allows the app to read call transcripts for all calls without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "418dae40-2b65-4819-900c-519a04e4d278",
|                                               "Value":  "ChangeManagement.Read.All",
|                                               "DisplayName":  "Read Change Management items",
|                                               "Description":  "Allows to read all Change Management items."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f3a65bd4-b703-46df-8f7e-0174fea562aa",
|                                               "Value":  "Channel.Create",
|                                               "DisplayName":  "Create channels",
|                                               "Description":  "Create channels in any team, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6a118a39-1227-45d4-af0c-ea7b40d210bc",
|                                               "Value":  "Channel.Delete.All",
|                                               "DisplayName":  "Delete channels",
|                                               "Description":  "Delete channels in any team, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "59a6b24b-4225-4393-8165-ebaec5f55d7a",
|                                               "Value":  "Channel.ReadBasic.All",
|                                               "DisplayName":  "Read the names and descriptions  of all channels",
|                                               "Description":  "Read all channel names and channel descriptions, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3b55498e-47ec-484f-8136-9013221c06a9",
|                                               "Value":  "ChannelMember.Read.All",
|                                               "DisplayName":  "Read the members of all channels",
|                                               "Description":  "Read the members of all channels, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "35930dcf-aceb-4bd1-b99a-8ffed403c974",
|                                               "Value":  "ChannelMember.ReadWrite.All",
|                                               "DisplayName":  "Add and remove members from all channels",
|                                               "Description":  "Add and remove members from all channels, without a signed-in user. Also allows changing a member\u0027s role, for example from owner to non-owner."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7b2449af-6ccd-4f4d-9f78-e550c193f0d1",
|                                               "Value":  "ChannelMessage.Read.All",
|                                               "DisplayName":  "Read all channel messages",
|                                               "Description":  "Allows the app to read all channel messages in Microsoft Teams"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4d02b0cc-d90b-441f-8d82-4fb55c34d6bb",
|                                               "Value":  "ChannelMessage.UpdatePolicyViolation.All",
|                                               "DisplayName":  "Flag channel messages for violating policy",
|                                               "Description":  "Allows the app to update Microsoft Teams channel messages by patching a set of Data Loss Prevention (DLP) policy violation properties to handle the output of DLP processing."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c97b873f-f59f-49aa-8a0e-52b32d762124",
|                                               "Value":  "ChannelSettings.Read.All",
|                                               "DisplayName":  "Read the names, descriptions, and settings of all channels",
|                                               "Description":  "Read all channel names, channel descriptions, and channel settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "243cded2-bd16-4fd6-a953-ff8177894c3d",
|                                               "Value":  "ChannelSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write the names, descriptions, and settings of all channels",
|                                               "Description":  "Read and write the names, descriptions, and settings of all channels, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d9c48af6-9ad9-47ad-82c3-63757137b9af",
|                                               "Value":  "Chat.Create",
|                                               "DisplayName":  "Create chats",
|                                               "Description":  "Allows the app to create chats without a signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9c7abde0-eacd-4319-bf9e-35994b1a1717",
|                                               "Value":  "Chat.ManageDeletion.All",
|                                               "DisplayName":  "Delete and recover deleted chats",
|                                               "Description":  "Allows the app to delete and recover deleted chats, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6b7d71aa-70aa-4810-a8d9-5d9fb2830017",
|                                               "Value":  "Chat.Read.All",
|                                               "DisplayName":  "Read all chat messages",
|                                               "Description":  "Allows the app to read all 1-to-1 or group chat messages in Microsoft Teams."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1c1b4c8e-3cc7-4c58-8470-9b92c9d5848b",
|                                               "Value":  "Chat.Read.WhereInstalled",
|                                               "DisplayName":  "Read all chat messages for chats where the associated Teams application is installed.",
|                                               "Description":  "Allows the app to read all one-to-one or group chat messages in Microsoft Teams for chats where the associated Teams application is installed, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b2e060da-3baf-4687-9611-f4ebc0f0cbde",
|                                               "Value":  "Chat.ReadBasic.All",
|                                               "DisplayName":  "Read names and members of all chat threads",
|                                               "Description":  "Read names and members of all one-to-one and group chats in Microsoft Teams, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "818ba5bd-5b3e-4fe0-bbe6-aa4686669073",
|                                               "Value":  "Chat.ReadBasic.WhereInstalled",
|                                               "DisplayName":  "Read names and members of all chat threads where the associated Teams application is installed.",
|                                               "Description":  "Allows the app to read names and members of all one-to-one and group chats in Microsoft Teams where the associated Teams application is installed, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "294ce7c9-31ba-490a-ad7d-97a7d075e4ed",
|                                               "Value":  "Chat.ReadWrite.All",
|                                               "DisplayName":  "Read and write all chat messages",
|                                               "Description":  "Allows an app to read and write all chat messages in Microsoft Teams, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ad73ce80-f3cd-40ce-b325-df12c33df713",
|                                               "Value":  "Chat.ReadWrite.WhereInstalled",
|                                               "DisplayName":  "Read and write all chat messages for chats where the associated Teams application is installed.",
|                                               "Description":  "Allows the app to read and write all chat messages in Microsoft Teams for chats where the associated Teams application is installed, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7e847308-e030-4183-9899-5235d7270f58",
|                                               "Value":  "Chat.UpdatePolicyViolation.All",
|                                               "DisplayName":  "Flag chat messages for violating policy",
|                                               "Description":  "Allows the app to update Microsoft Teams 1-to-1 or group chat messages by patching a set of Data Loss Prevention (DLP) policy violation properties to handle the output of DLP processing."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a3410be2-8e48-4f32-8454-c29a7465209d",
|                                               "Value":  "ChatMember.Read.All",
|                                               "DisplayName":  "Read the members of all chats",
|                                               "Description":  "Read the members of all chats, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "93e7c9e4-54c5-4a41-b796-f2a5adaacda7",
|                                               "Value":  "ChatMember.Read.WhereInstalled",
|                                               "DisplayName":  "Read the members of all chats where the associated Teams application is installed.",
|                                               "Description":  "Allows the app to read the members of all chats where the associated Teams application is installed, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "57257249-34ce-4810-a8a2-a03adf0c5693",
|                                               "Value":  "ChatMember.ReadWrite.All",
|                                               "DisplayName":  "Add and remove members from all chats",
|                                               "Description":  "Add and remove members from all chats, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e32c2cd9-0124-4e44-88fc-772cd98afbdb",
|                                               "Value":  "ChatMember.ReadWrite.WhereInstalled",
|                                               "DisplayName":  "Add and remove members from all chats where the associated Teams application is installed.",
|                                               "Description":  "Allows the app to add and remove members from all chats where the associated Teams application is installed, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b9bb2381-47a4-46cd-aafb-00cb12f68504",
|                                               "Value":  "ChatMessage.Read.All",
|                                               "DisplayName":  "Read all chat messages",
|                                               "Description":  "Allows the app to read all one-to-one and group chats messages in Microsoft Teams, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "64a59178-dad3-4673-89db-84fdcd622fec",
|                                               "Value":  "CloudApp-Discovery.Read.All",
|                                               "DisplayName":  "Read all discovered cloud applications data",
|                                               "Description":  "Allows the app to read all details of discovered cloud apps in the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a9e09520-8ed4-4cde-838e-4fdea192c227",
|                                               "Value":  "CloudPC.Read.All",
|                                               "DisplayName":  "Read Cloud PCs",
|                                               "Description":  "Allows the app to read the properties of Cloud PCs, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3b4349e1-8cf5-45a3-95b7-69d1751d3e6a",
|                                               "Value":  "CloudPC.ReadWrite.All",
|                                               "DisplayName":  "Read and write Cloud PCs",
|                                               "Description":  "Allows the app to read and write the properties of Cloud PCs, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "407f0cce-3212-441f-9f55-3bc91342cf86",
|                                               "Value":  "Community.Read.All",
|                                               "DisplayName":  "Read all Viva Engage communities",
|                                               "Description":  "Allows the app to list Viva Engage communities, and to read their properties without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "35d59e32-eab5-4553-9345-abb62b4c703c",
|                                               "Value":  "Community.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Viva Engage communities",
|                                               "Description":  "Allows the app to create Viva Engage communities, read all community properties, update community properties, and delete communities without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "aca929ec-9830-44dc-bda1-85cf938aaa95",
|                                               "Value":  "ConfigurationMonitoring.Read.All",
|                                               "DisplayName":  "Read all Configuration Monitoring entities",
|                                               "Description":  "Allows the app to read all Configuration Monitoring entities, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cfa85bfb-2ee8-4e13-8e7f-489e57a015a1",
|                                               "Value":  "ConfigurationMonitoring.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Configuration Monitoring entities",
|                                               "Description":  "Allows the app to read and write all Configuration Monitoring entities, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1260ad83-98fb-4785-abbb-d6cc1806fd41",
|                                               "Value":  "ConsentRequest.Read.All",
|                                               "DisplayName":  "Read all consent requests",
|                                               "Description":  "Allows the app to read consent requests and approvals without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9f1b81a7-0223-4428-bfa4-0bcb5535f27d",
|                                               "Value":  "ConsentRequest.ReadWrite.All",
|                                               "DisplayName":  "Read and write all consent requests",
|                                               "Description":  "Allows the app to read app consent requests and approvals, and deny or approve those requests without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c8948c23-e66b-42db-83fd-770b71ab78d2",
|                                               "Value":  "Contacts-OnPremisesSyncBehavior.ReadWrite.All",
|                                               "DisplayName":  "Read and update the on-premises sync behavior of contacts",
|                                               "Description":  "Allows the app to update the on-premises sync behavior of all contacts in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "089fe4d0-434a-44c5-8827-41ba8a0b17f5",
|                                               "Value":  "Contacts.Read",
|                                               "DisplayName":  "Read contacts in all mailboxes",
|                                               "Description":  "Allows the app to read all contacts in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6918b873-d17a-4dc1-b314-35f528134491",
|                                               "Value":  "Contacts.ReadWrite",
|                                               "DisplayName":  "Read and write contacts in all mailboxes",
|                                               "Description":  "Allows the app to create, read, update, and delete all contacts in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5ad511bf-571c-4ef6-8c3c-85b94b85df98",
|                                               "Value":  "Content.Process.All",
|                                               "DisplayName":  "Process content for data security, governance and compliance",
|                                               "Description":  "Allows the app to process and evaluate content for data security, governance and compliance outcomes at tenant scope."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "24ceb246-ad29-4680-90b4-3e91ffad15eb",
|                                               "Value":  "Content.Process.User",
|                                               "DisplayName":  "Process content for data security, governance and compliance",
|                                               "Description":  "Allows the app to process and evaluate content for data security, governance and compliance outcomes for a user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "368425e7-6954-4f5a-9d92-90b75bd580c9",
|                                               "Value":  "ContentActivity.Read",
|                                               "DisplayName":  "Read contents activity audit log from the audit store.",
|                                               "Description":  "Read contents activity audit log from the audit store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2932e07a-3c29-44e4-bb36-6d0fc176387f",
|                                               "Value":  "ContentActivity.Write",
|                                               "DisplayName":  "Upload content activity audit logs to the audit store.",
|                                               "Description":  "Allows the application to upload bulk contents activity audit logs to the audit store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f9af4646-98b0-4e9d-a53e-40d4f6452fc4",
|                                               "Value":  "Contracts.Read.All",
|                                               "DisplayName":  "Read contracts",
|                                               "Description":  "Allows the app to read available properties on contracts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "72f0655d-6228-4ddc-8e1b-164973b9213b",
|                                               "Value":  "CopilotPackages.Read.All",
|                                               "DisplayName":  "Read all packages information",
|                                               "Description":  "Allows the app to read packages information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ed31732f-9495-47ed-ba3b-4ed0948c1c64",
|                                               "Value":  "CopilotPackages.ReadWrite.All",
|                                               "DisplayName":  "Read and update all packages information",
|                                               "Description":  "Allows the app to read and update packages information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "556d5e2e-1081-4452-8147-26c3a1b06f58",
|                                               "Value":  "CopilotPolicySettings.Read",
|                                               "DisplayName":  "Read Copilot policy settings",
|                                               "Description":  "Allows the app to read Copilot policy settings for the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cc147c17-b8e8-4d3f-9f94-aa9e279a079a",
|                                               "Value":  "CopilotPolicySettings.ReadWrite",
|                                               "DisplayName":  "Read and write Copilot policy settings",
|                                               "Description":  "Allows the app to read and write Copilot policy settings for the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cac88765-0581-4025-9725-5ebc13f729ee",
|                                               "Value":  "CrossTenantInformation.ReadBasic.All",
|                                               "DisplayName":  "Read cross-tenant basic information",
|                                               "Description":  "Allows the application to obtain basic tenant information about another target tenant within the Azure AD ecosystem without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8b919d44-6192-4f3d-8a3b-f86f8069ae3c",
|                                               "Value":  "CrossTenantUserProfileSharing.Read.All",
|                                               "DisplayName":  "Read all shared cross-tenant user profiles and export their data",
|                                               "Description":  "Allows the application to list and query any shared user profile information associated with the current tenant without a signed-in user.  It also permits the application to export external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "306785c5-c09b-4ba0-a4ee-023f3da165cb",
|                                               "Value":  "CrossTenantUserProfileSharing.ReadWrite.All",
|                                               "DisplayName":  "Read all shared cross-tenant user profiles and export or delete their data",
|                                               "Description":  "Allows the application to list and query any shared user profile information associated with the current tenant without a signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "88bb2658-5d9e-454f-aacd-a3933e079526",
|                                               "Value":  "CustomAuthenticationExtension.Read.All",
|                                               "DisplayName":  "Read all custom authentication extensions",
|                                               "Description":  "Allows the app to read your organization\u0027s custom authentication extensions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c2667967-7050-4e7e-b059-4cbbb3811d03",
|                                               "Value":  "CustomAuthenticationExtension.ReadWrite.All",
|                                               "DisplayName":  "Read and write all custom authentication extensions",
|                                               "Description":  "Allows the app to read or write your organization\u0027s custom authentication extensions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "214e810f-fda8-4fd7-a475-29461495eb00",
|                                               "Value":  "CustomAuthenticationExtension.Receive.Payload",
|                                               "DisplayName":  "Receive custom authentication extension HTTP requests",
|                                               "Description":  "Allows custom authentication extensions associated with the app to receive HTTP requests triggered by an authentication event. The request can include information about a user, client and resource service principals, and other information about the authentication."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "673a007a-9e0f-4c97-b066-3c0164486909",
|                                               "Value":  "CustomDetection.Read.All",
|                                               "DisplayName":  "Read all custom detection rules",
|                                               "Description":  "Allows the app to read custom detection rules without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e0fd9c8d-a12e-4cc9-9827-20c8c3cd6fb8",
|                                               "Value":  "CustomDetection.ReadWrite.All",
|                                               "DisplayName":  "Read and write all custom detection rules",
|                                               "Description":  "Allows the app to read and write custom detection rules without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3b37c5a4-1226-493d-bec3-5d6c6b866f3f",
|                                               "Value":  "CustomSecAttributeAssignment.Read.All",
|                                               "DisplayName":  "Read custom security attribute assignments",
|                                               "Description":  "Allows the app to read custom security attribute assignments for all principals in the tenant without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "de89b5e4-5b8f-48eb-8925-29c2b33bd8bd",
|                                               "Value":  "CustomSecAttributeAssignment.ReadWrite.All",
|                                               "DisplayName":  "Read and write custom security attribute assignments",
|                                               "Description":  "Allows the app to read and write custom security attribute assignments for all principals in the tenant without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2a4f026d-e829-4e84-bdbf-d981a2703059",
|                                               "Value":  "CustomSecAttributeAuditLogs.Read.All",
|                                               "DisplayName":  "Read all custom security attribute audit logs",
|                                               "Description":  "Allows the app to read all audit logs for events that contain information about custom security attributes, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b185aa14-d8d2-42c1-a685-0f5596613624",
|                                               "Value":  "CustomSecAttributeDefinition.Read.All",
|                                               "DisplayName":  "Read custom security attribute definitions",
|                                               "Description":  "Allows the app to read custom security attribute definitions for the tenant without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "12338004-21f4-4896-bf5e-b75dfaf1016d",
|                                               "Value":  "CustomSecAttributeDefinition.ReadWrite.All",
|                                               "DisplayName":  "Read and write custom security attribute definitions",
|                                               "Description":  "Allows the app to read and write custom security attribute definitions for the tenant without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9fd1f8bf-a443-4df6-bc2a-5d00c5ec7828",
|                                               "Value":  "CustomSecAttributeProvisioning.Read.All",
|                                               "DisplayName":  "Read the provisioning configuration of all active custom security attributes",
|                                               "Description":  "Allows the app to read the provisioning configuration of all active custom security attributes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1db69e9c-8d0a-498d-a5df-11fd0b68ceab",
|                                               "Value":  "CustomSecAttributeProvisioning.ReadWrite.All",
|                                               "DisplayName":  "Read and edit the provisioning configuration of all active custom security attributes",
|                                               "Description":  "Allows the app to read and edit the provisioning configuration of all active custom security attributes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ab8a5872-7c88-47a6-8141-7becce939190",
|                                               "Value":  "CustomTags.Read.All",
|                                               "DisplayName":  "Read all custom tags data",
|                                               "Description":  "Read custom tags data, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2f503208-e509-4e39-974c-8cc16e5785c9",
|                                               "Value":  "CustomTags.ReadWrite.All",
|                                               "DisplayName":  "Read and write custom tags data",
|                                               "Description":  "Read and write custom tags data, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f6e9e124-4586-492f-adc0-c6f96e4823fd",
|                                               "Value":  "DelegatedAdminRelationship.Read.All",
|                                               "DisplayName":  "Read Delegated Admin relationships with customers",
|                                               "Description":  "Allows the app to read details of delegated admin relationships with customers like access details (that includes roles) and the duration as well as specific role assignments to security groups without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cc13eba4-8cd8-44c6-b4d4-f93237adce58",
|                                               "Value":  "DelegatedAdminRelationship.ReadWrite.All",
|                                               "DisplayName":  "Manage Delegated Admin relationships with customers",
|                                               "Description":  "Allows the app to manage (create-update-terminate) Delegated Admin relationships with customers and role assignments to security groups for active Delegated Admin relationships without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "81b4724a-58aa-41c1-8a55-84ef97466587",
|                                               "Value":  "DelegatedPermissionGrant.Read.All",
|                                               "DisplayName":  "Read all delegated permission grants",
|                                               "Description":  "Allows the app to read all delegated permission grants, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8e8e4742-1d95-4f68-9d56-6ee75648c72a",
|                                               "Value":  "DelegatedPermissionGrant.ReadWrite.All",
|                                               "DisplayName":  "Manage all delegated permission grants",
|                                               "Description":  "Allows the app to manage permission grants for delegated permissions exposed by any API (including Microsoft Graph), without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7438b122-aefc-4978-80ed-43db9fcc7715",
|                                               "Value":  "Device.Read.All",
|                                               "DisplayName":  "Read all devices",
|                                               "Description":  "Allows the app to read your organization\u0027s devices\u0027 configuration information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1138cb37-bd11-4084-a2b7-9f71582aeddb",
|                                               "Value":  "Device.ReadWrite.All",
|                                               "DisplayName":  "Read and write devices",
|                                               "Description":  "Allows the app to read and write all device properties without a signed in user.  Does not allow device creation, device deletion or update of device alternative security identifiers."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "884b599e-4d48-43a5-ba94-15c414d00588",
|                                               "Value":  "DeviceLocalCredential.Read.All",
|                                               "DisplayName":  "Read device local credential passwords",
|                                               "Description":  "Allows the app to read device local credential properties including passwords, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "db51be59-e728-414b-b800-e0f010df1a79",
|                                               "Value":  "DeviceLocalCredential.ReadBasic.All",
|                                               "DisplayName":  "Read device local credential properties",
|                                               "Description":  "Allows the app to read device local credential properties excluding passwords, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7a6ee1e7-141e-4cec-ae74-d9db155731ff",
|                                               "Value":  "DeviceManagementApps.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune apps",
|                                               "Description":  "Allows the app to read the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "78145de6-330d-4800-a6ce-494ff2d33d07",
|                                               "Value":  "DeviceManagementApps.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune apps",
|                                               "Description":  "Allows the app to read and write the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "315b6e8c-d92a-4691-919d-00ce76d1344a",
|                                               "Value":  "DeviceManagementCloudCA.Read.All",
|                                               "DisplayName":  "Read Microsoft Cloud PKI objects",
|                                               "Description":  "Allows the app to read certification authority information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f15eb2ba-ef8a-4f70-991d-da5d045154e2",
|                                               "Value":  "DeviceManagementCloudCA.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Cloud PKI objects",
|                                               "Description":  "Allows the app to read and write certification authority information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dc377aa6-52d8-4e23-b271-2a7ae04cedf3",
|                                               "Value":  "DeviceManagementConfiguration.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune device configuration and policies",
|                                               "Description":  "Allows the app to read properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9241abd9-d0e6-425a-bd4f-47ba86e767a4",
|                                               "Value":  "DeviceManagementConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune device configuration and policies",
|                                               "Description":  "Allows the app to read and write properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5b07b0dd-2377-4e44-a38d-703f09a0dc3c",
|                                               "Value":  "DeviceManagementManagedDevices.PrivilegedOperations.All",
|                                               "DisplayName":  "Perform user-impacting remote actions on Microsoft Intune devices",
|                                               "Description":  "Allows the app to perform remote high impact actions such as wiping the device or resetting the passcode on devices managed by Microsoft Intune, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2f51be20-0bb4-4fed-bf7b-db946066c75e",
|                                               "Value":  "DeviceManagementManagedDevices.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune devices",
|                                               "Description":  "Allows the app to read the properties of devices managed by Microsoft Intune, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "243333ab-4d21-40cb-a475-36241daa0842",
|                                               "Value":  "DeviceManagementManagedDevices.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune devices",
|                                               "Description":  "Allows the app to read and write the properties of devices managed by Microsoft Intune, without a signed-in user. Does not allow high impact operations such as remote wipe and password reset on the device’s owner"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "58ca0d9a-1575-47e1-a3cb-007ef2e4583b",
|                                               "Value":  "DeviceManagementRBAC.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune RBAC settings",
|                                               "Description":  "Allows the app to read the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e330c4f0-4170-414e-a55a-2f022ec2b57b",
|                                               "Value":  "DeviceManagementRBAC.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune RBAC settings",
|                                               "Description":  "Allows the app to read and write the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c7a5be92-2b3d-4540-8a67-c96dcaae8b43",
|                                               "Value":  "DeviceManagementScripts.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune Scripts",
|                                               "Description":  "Allows the app to read Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9255e99d-faf5-445e-bbf7-cb71482737c4",
|                                               "Value":  "DeviceManagementScripts.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune Scripts",
|                                               "Description":  "Allows the app to read and write Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "06a5fe6d-c49d-46a7-b082-56b1b14103c7",
|                                               "Value":  "DeviceManagementServiceConfig.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune configuration",
|                                               "Description":  "Allows the app to read Microsoft Intune service properties including device enrollment and third party service connection configuration, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5ac13192-7ace-4fcf-b828-1a26f28068ee",
|                                               "Value":  "DeviceManagementServiceConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune configuration",
|                                               "Description":  "Allows the app to read and write Microsoft Intune service properties including device enrollment and third party service connection configuration, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "abf6441f-0772-4932-96e7-0191478dd73a",
|                                               "Value":  "DeviceTemplate.Create",
|                                               "DisplayName":  "Create device template",
|                                               "Description":  "Allows the app to create device templates. The app is marked as owner of the created device template. As a member of owners, the app will be allowed to manage devices created from the template."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dd9febb5-0c6d-419f-b256-3afe12c6adeb",
|                                               "Value":  "DeviceTemplate.Read.All",
|                                               "DisplayName":  "Read all device templates",
|                                               "Description":  "Allows the app to read all device templates, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9fadb66e-6421-4744-aede-4ab6fb98a884",
|                                               "Value":  "DeviceTemplate.ReadWrite.All",
|                                               "DisplayName":  "Read and write all device templates",
|                                               "Description":  "Allows the app to create, read, update and delete any device template, without a signed-in user. It also allows the app to add or remove owners on any device template."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7ab1d382-f21e-4acd-a863-ba3e13f7da61",
|                                               "Value":  "Directory.Read.All",
|                                               "DisplayName":  "Read directory data",
|                                               "Description":  "Allows the app to read data in your organization\u0027s directory, such as users, groups and apps, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "19dbc75e-c2e2-444c-a770-ec69d8559fc7",
|                                               "Value":  "Directory.ReadWrite.All",
|                                               "DisplayName":  "Read and write directory data",
|                                               "Description":  "Allows the app to read and write data in your organization\u0027s directory, such as users, and groups, without a signed-in user.  Does not allow user or group deletion."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ae73097b-cb2a-4447-b064-5d80f6093921",
|                                               "Value":  "DirectoryRecommendations.Read.All",
|                                               "DisplayName":  "Read all Azure AD recommendations",
|                                               "Description":  "Allows the app to read all Azure AD recommendations, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0e9eea12-4f01-45f6-9b8d-3ea4c8144158",
|                                               "Value":  "DirectoryRecommendations.ReadWrite.All",
|                                               "DisplayName":  "Read and update all Azure AD recommendations",
|                                               "Description":  "Allows the app to read and update all Azure AD recommendations, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c0e5a7b0-e8b7-40a7-b8e0-8249e6ea81d5",
|                                               "Value":  "Domain-InternalFederation.Read.All",
|                                               "DisplayName":  "Read internal federation configuration for a domain.",
|                                               "Description":  "Allows the app to read internal federation configuration for a domain."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "64d40371-8d58-4270-bc8a-b4a66de36b9a",
|                                               "Value":  "Domain-InternalFederation.ReadWrite.All",
|                                               "DisplayName":  "Create, read, update and delete internal federation configuration for a domain.",
|                                               "Description":  "Allows the app to create, read, update and delete internal federation configuration for a domain."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dbb9058a-0e50-45d7-ae91-66909b5d4664",
|                                               "Value":  "Domain.Read.All",
|                                               "DisplayName":  "Read domains",
|                                               "Description":  "Allows the app to read all domain properties without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7e05723c-0bb0-42da-be95-ae9f08a6e53c",
|                                               "Value":  "Domain.ReadWrite.All",
|                                               "DisplayName":  "Read and write domains",
|                                               "Description":  "Allows the app to read and write all domain properties without a signed in user.  Also allows the app to add,  verify and remove domains."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "50180013-6191-4d1e-a373-e590ff4e66af",
|                                               "Value":  "eDiscovery.Read.All",
|                                               "DisplayName":  "Read all eDiscovery objects",
|                                               "Description":  "Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b2620db1-3bf7-4c5b-9cb9-576d29eac736",
|                                               "Value":  "eDiscovery.ReadWrite.All",
|                                               "DisplayName":  "Read and write all eDiscovery objects",
|                                               "Description":  "Allows the app to read and write eDiscovery objects such as cases, custodians, review sets and other related objects without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7c9db06a-ec2d-4e7b-a592-5a1e30992566",
|                                               "Value":  "EduAdministration.Read.All",
|                                               "DisplayName":  "Read Education app settings",
|                                               "Description":  "Read the state and settings of all Microsoft education apps."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9bc431c3-b8bc-4a8d-a219-40f10f92eff6",
|                                               "Value":  "EduAdministration.ReadWrite.All",
|                                               "DisplayName":  "Manage education app settings",
|                                               "Description":  "Manage the state and settings of all Microsoft education apps."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4c37e1b6-35a1-43bf-926a-6f30f2cdf585",
|                                               "Value":  "EduAssignments.Read.All",
|                                               "DisplayName":  "Read all class assignments with grades",
|                                               "Description":  "Allows the app to read all class assignments with grades for all users without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6e0a958b-b7fc-4348-b7c4-a6ab9fd3dd0e",
|                                               "Value":  "EduAssignments.ReadBasic.All",
|                                               "DisplayName":  "Read all class assignments without grades",
|                                               "Description":  "Allows the app to read all class assignments without grades for all users without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0d22204b-6cad-4dd0-8362-3e3f2ae699d9",
|                                               "Value":  "EduAssignments.ReadWrite.All",
|                                               "DisplayName":  "Create, read, update and delete all class assignments with grades",
|                                               "Description":  "Allows the app to create, read, update and delete all class assignments with grades for all users without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f431cc63-a2de-48c4-8054-a34bc093af84",
|                                               "Value":  "EduAssignments.ReadWriteBasic.All",
|                                               "DisplayName":  "Create, read, update and delete all class assignments without grades",
|                                               "Description":  "Allows the app to create, read, update and delete all class assignments without grades for all users without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6cdb464c-3a03-40f8-900b-4cb7ea1da9c0",
|                                               "Value":  "EduCurricula.Read.All",
|                                               "DisplayName":  "Read all class modules and resources",
|                                               "Description":  "Allows the app to read all modules and resources, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6a0c2318-d59d-4c7d-bf2e-5f3902dc2593",
|                                               "Value":  "EduCurricula.ReadWrite.All",
|                                               "DisplayName":  "Read and write all class modules and resources",
|                                               "Description":  "Allows the app to read and write all modules and resources, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ad248c30-1919-40c8-b3d2-304481894e88",
|                                               "Value":  "EduReports-Reading.Read.All",
|                                               "DisplayName":  "Read all tenant reading assignments submissions data",
|                                               "Description":  "Allows the app to read all tenant users reading assignments submissions data without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "040330d7-be7e-4130-b349-a6eb3a56e2f8",
|                                               "Value":  "EduReports-Reading.ReadAnonymous.All",
|                                               "DisplayName":  "Read all tenant reading assignments submissions data",
|                                               "Description":  "Allows the app to read all tenant users reading assignments submissions data (excludes student-identifying information) without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c5debf73-bdc8-473d-bf07-f4074ad05f71",
|                                               "Value":  "EduReports-Reflect.Read.All",
|                                               "DisplayName":  "Read all tenant reflect check-ins submissions data",
|                                               "Description":  "Allows the app to read all tenant users reflect check-ins submissions data without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f5d05dba-7ef0-46fc-b62c-a7282555f428",
|                                               "Value":  "EduReports-Reflect.ReadAnonymous.All",
|                                               "DisplayName":  "Read all tenant reflect check-ins submissions data",
|                                               "Description":  "Allows the app to read all tenant users reflect check-ins submissions data (excludes responder-identifying information) without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e0ac9e1b-cb65-4fc5-87c5-1a8bc181f648",
|                                               "Value":  "EduRoster.Read.All",
|                                               "DisplayName":  "Read the organization\u0027s roster",
|                                               "Description":  "Allows the app to read the structure of schools and classes in the organization\u0027s roster and education-specific information about all users to be read."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0d412a8c-a06c-439f-b3ec-8abcf54d2f96",
|                                               "Value":  "EduRoster.ReadBasic.All",
|                                               "DisplayName":  "Read a limited subset of the organization\u0027s roster",
|                                               "Description":  "Allows the app to read a limited subset of properties from both the structure of schools and classes in the organization\u0027s roster and education-specific information about all users. Includes name, status, role, email address and photo."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d1808e82-ce13-47af-ae0d-f9b254e6d58a",
|                                               "Value":  "EduRoster.ReadWrite.All",
|                                               "DisplayName":  "Read and write the organization\u0027s roster",
|                                               "Description":  "Allows the app to read and write the structure of schools and classes in the organization\u0027s roster and education-specific information about all users to be read and written."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e1d2136d-eaaf-427a-a7db-f97dbe847c27",
|                                               "Value":  "EngagementConversation.Migration.All",
|                                               "DisplayName":  "Read and write all Viva Engage conversations",
|                                               "Description":  "Allows the app to create Viva Engage conversations without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2c495153-cd0e-41b4-9980-3bcecf1ca22f",
|                                               "Value":  "EngagementConversation.Read.All",
|                                               "DisplayName":  "Read all Viva Engage conversations",
|                                               "Description":  "Allows the app to list Viva Engage conversations, and to read their properties without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bfbd4840-fba0-43a7-93a9-465b687e47d0",
|                                               "Value":  "EngagementConversation.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Viva Engage conversations",
|                                               "Description":  "Allows the app to create Viva Engage conversations, read all conversation properties, update conversation properties, and delete conversations without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "eda8c187-a7d5-42cb-b2e1-c9142f63899f",
|                                               "Value":  "EngagementExport.Read.All",
|                                               "DisplayName":  "Export Viva Engage data",
|                                               "Description":  "Allows the app to export Viva Engage data for compliance, GDPR, and admin scenarios without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d746beae-b46e-446e-924a-5b805a5c4467",
|                                               "Value":  "EngagementMeetingConversation.Read.All",
|                                               "DisplayName":  "Read all Viva Engage Teams QA conversations",
|                                               "Description":  "Allows the app to list Viva Engage Teams QA conversations, and to read their properties without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "30614864-4114-45ef-bdd9-0dd7894a1cc4",
|                                               "Value":  "EngagementRole.Read.All",
|                                               "DisplayName":  "Read all Viva Engage roles and role memberships",
|                                               "Description":  "Allows the app to list all Viva Engage roles and role memberships without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3ede5358-7366-4da8-a2f7-472bf9c7cc34",
|                                               "Value":  "EngagementRole.ReadWrite.All",
|                                               "DisplayName":  "Modify Viva Engage role membership",
|                                               "Description":  "Allows the app to assign Viva Engage role to a user, and remove a Viva Engage role from a user without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c74fd47d-ed3c-45c3-9a9e-b8676de685d2",
|                                               "Value":  "EntitlementManagement.Read.All",
|                                               "DisplayName":  "Read all entitlement management resources",
|                                               "Description":  "Allows the app to read access packages and related entitlement management resources without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9acd699f-1e81-4958-b001-93b1d2506e19",
|                                               "Value":  "EntitlementManagement.ReadWrite.All",
|                                               "DisplayName":  "Read and write all entitlement management resources",
|                                               "Description":  "Allows the app to read and write access packages and related entitlement management resources without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "56eda3c5-3834-4815-bd41-6f8fa1295247",
|                                               "Value":  "EntraBackup.Read.All",
|                                               "DisplayName":  "Read Preview jobs and snapshots",
|                                               "Description":  "Allows the app to list the all the snapshots, jobs and enumerate the changes of a specific preview job, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b7f6385c-6ce6-4639-a480-e23c42ed9784",
|                                               "Value":  "EventListener.Read.All",
|                                               "DisplayName":  "Read all authentication event listeners",
|                                               "Description":  "Allows the app to read your organization\u0027s authentication event listeners without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0edf5e9e-4ce8-468a-8432-d08631d18c43",
|                                               "Value":  "EventListener.ReadWrite.All",
|                                               "DisplayName":  "Read and write all authentication event listeners",
|                                               "Description":  "Allows the app to read or write your organization\u0027s authentication event listeners without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "89b20d8a-76e2-4057-867b-9961f800b9a4",
|                                               "Value":  "ExchangeMessageTrace.Read.All",
|                                               "DisplayName":  "Search the email message trace",
|                                               "Description":  "Allows the app to search the email message trace, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1914711b-a1cb-4793-b019-c2ce0ed21b8c",
|                                               "Value":  "ExternalConnection.Read.All",
|                                               "DisplayName":  "Read all external connections",
|                                               "Description":  "Allows the app to read all external connections without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "34c37bc0-2b40-4d5e-85e1-2365cd256d79",
|                                               "Value":  "ExternalConnection.ReadWrite.All",
|                                               "DisplayName":  "Read and write all external connections",
|                                               "Description":  "Allows the app to read and write all external connections without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f431331c-49a6-499f-be1c-62af19c34a9d",
|                                               "Value":  "ExternalConnection.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Read and write external connections",
|                                               "Description":  "Allows the app to read and write external connections without a signed-in user. The app can only read and write external connections that it is authorized to, or it can create new external connections."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7a7cffad-37d2-4f48-afa4-c6ab129adcc2",
|                                               "Value":  "ExternalItem.Read.All",
|                                               "DisplayName":  "Read all external items",
|                                               "Description":  "Allows the app to read all external items without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "38c3d6ee-69ee-422f-b954-e17819665354",
|                                               "Value":  "ExternalItem.ReadWrite.All",
|                                               "DisplayName":  "Read and write items in external datasets",
|                                               "Description":  "Allow the app to read or write items in all external datasets that the app is authorized to access"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8116ae0f-55c2-452d-9944-d18420f5b2c8",
|                                               "Value":  "ExternalItem.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Read and write external items",
|                                               "Description":  "Allows the app to read and write external items without a signed-in user. The app can only read external items of the connection that it is authorized to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1987d7a0-d602-4262-ab90-cfdd43b37545",
|                                               "Value":  "ExternalUserProfile.Read.All",
|                                               "DisplayName":  "Read all external user profiles",
|                                               "Description":  "Allows the app to read available properties of external user profiles, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "761327c9-d819-4c08-9a5f-874cd2826608",
|                                               "Value":  "ExternalUserProfile.ReadWrite.All",
|                                               "DisplayName":  "Read and write all external user profiles",
|                                               "Description":  "Allows the app to read and write available properties of external user profiles, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "65891b00-2fd9-4e33-be27-04a53132e3df",
|                                               "Value":  "FileIngestion.Ingest",
|                                               "DisplayName":  "Ingest SharePoint and OneDrive content to make it available in the search index",
|                                               "Description":  "Allows the app to ingest SharePoint and OneDrive content to make it available in the search index, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "766c601b-c009-4438-8290-c8b05fa00c4b",
|                                               "Value":  "FileIngestionHybridOnboarding.Manage",
|                                               "DisplayName":  "Manage onboarding for a Hybrid Cloud tenant",
|                                               "Description":  "Allows the app to manage onboarding for a Hybrid Cloud tenant, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "01d4889c-1287-42c6-ac1f-5d1e02578ef6",
|                                               "Value":  "Files.Read.All",
|                                               "DisplayName":  "Read files in all site collections",
|                                               "Description":  "Allows the app to read all files in all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "75359482-378d-4052-8f01-80520e7db3cd",
|                                               "Value":  "Files.ReadWrite.All",
|                                               "DisplayName":  "Read and write files in all site collections",
|                                               "Description":  "Allows the app to read, create, update and delete all files in all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b47b160b-1054-4efd-9ca0-e2f614696086",
|                                               "Value":  "Files.ReadWrite.AppFolder",
|                                               "DisplayName":  "Have full access to the application\u0027s folder without a signed in user.",
|                                               "Description":  "Allows the app to read, create, update and delete files in the application\u0027s folder without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bd61925e-3bf4-4d62-bc0b-06b06c96d95c",
|                                               "Value":  "Files.SelectedOperations.Selected",
|                                               "DisplayName":  "Access selected Files without a signed in user.",
|                                               "Description":  "Allow the application to access a subset of files without a signed in user.  The specific files and the permissions granted will be configured in SharePoint Online or OneDrive."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "40dc41bc-0f7e-42ff-89bd-d9516947e474",
|                                               "Value":  "FileStorageContainer.Selected",
|                                               "DisplayName":  "Access selected file storage containers",
|                                               "Description":  "Allows the application to utilize the file storage container platform to manage containers, without a signed-in user. The specific file storage containers and the permissions granted to them will be configured in Microsoft 365 by the developer of each container type."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2dcc6599-bd30-442b-8f11-90f88ad441dc",
|                                               "Value":  "FileStorageContainerTypeReg.Selected",
|                                               "DisplayName":  "Access selected file storage container type registrations",
|                                               "Description":  "Allows the application to manage file storage container type registrations without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4f0a8235-6f6f-4ec7-9500-34b452a4a0c3",
|                                               "Value":  "Group-Conversation.Read.All",
|                                               "DisplayName":  "Read all group conversations",
|                                               "Description":  "Allows the app to read conversations of the groups this app has access to without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6679c91b-820a-4900-ab47-e97b197a89c4",
|                                               "Value":  "Group-Conversation.ReadWrite.All",
|                                               "DisplayName":  "Read and write all group conversations",
|                                               "Description":  "Allows the app to read and write conversations of the groups this app has access to without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2d53948b-d2c5-4008-9c4e-6361bf192555",
|                                               "Value":  "Group-NestingSupport.ReadWrite.All",
|                                               "DisplayName":  "Read and write groups\u0027 disableNesting property",
|                                               "Description":  "Allows the app to read and write groups\u0027 disableNesting property without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2d9bd318-b883-40be-9df7-63ec4fcdc424",
|                                               "Value":  "Group-OnPremisesSyncBehavior.ReadWrite.All",
|                                               "DisplayName":  "Read and update the on-premises sync behavior of groups",
|                                               "Description":  "Allows the app to update the on-premises sync behavior of all groups without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bf7b1a76-6e77-406b-b258-bf5c7720e98f",
|                                               "Value":  "Group.Create",
|                                               "DisplayName":  "Create groups",
|                                               "Description":  "Allows the app to create groups without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5b567255-7703-4780-807c-7be8301ae99b",
|                                               "Value":  "Group.Read.All",
|                                               "DisplayName":  "Read all groups",
|                                               "Description":  "Allows the app to read group properties and memberships, and read conversations for all groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "62a82d76-70ea-41e2-9197-370581804d09",
|                                               "Value":  "Group.ReadWrite.All",
|                                               "DisplayName":  "Read and write all groups",
|                                               "Description":  "Allows the app to create groups, read all group properties and memberships, update group properties and memberships, and delete groups. Also allows the app to read and write conversations. All of these operations can be performed by the app without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "98830695-27a2-44f7-8c18-0c3ebc9698f6",
|                                               "Value":  "GroupMember.Read.All",
|                                               "DisplayName":  "Read all group memberships",
|                                               "Description":  "Allows the app to read memberships and basic group properties for all groups without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dbaae8cf-10b5-4b86-a4a1-f871c94c6695",
|                                               "Value":  "GroupMember.ReadWrite.All",
|                                               "DisplayName":  "Read and write all group memberships",
|                                               "Description":  "Allows the app to list groups, read basic properties, read and update the membership of the groups this app has access to without a signed-in user. Group properties and owners cannot be updated and groups cannot be deleted."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f3c4f514-c65a-43f5-bfce-1735872258dd",
|                                               "Value":  "GroupSettings.Read.All",
|                                               "DisplayName":  "Read all group settings",
|                                               "Description":  "Allows the app to read a list of tenant-level or group-specific group settings objects, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "546168c3-1183-4281-9491-fafb24dea37e",
|                                               "Value":  "GroupSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write all group settings",
|                                               "Description":  "Allows the app to create, read, update, and delete on the list of tenant-level or group-specific group settings objects, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5183ed5d-b7f8-4e9a-915e-dafb46b9cb62",
|                                               "Value":  "HealthMonitoringAlert.Read.All",
|                                               "DisplayName":  "Read all scenario health monitoring alert",
|                                               "Description":  "Allows the app to read all scenario health monitoring alerts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ac29eb50-f2f9-4518-a117-4bef18e84c7d",
|                                               "Value":  "HealthMonitoringAlert.ReadWrite.All",
|                                               "DisplayName":  "Read and write all scenario monitoring alerts",
|                                               "Description":  "Allows the app to read and write all scenario monitoring alerts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bb424d73-e898-4c97-9d42-688c32810003",
|                                               "Value":  "HealthMonitoringAlertConfig.Read.All",
|                                               "DisplayName":  "Read all scenario health monitoring alert configurations",
|                                               "Description":  "Allows the app to read all scenario health monitoring alert configurations, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "432e76f0-8af6-4315-a853-66ab9538f480",
|                                               "Value":  "HealthMonitoringAlertConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write all scenario monitoring alerts",
|                                               "Description":  "Allows the app to read and write all scenario monitoring alerts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e321f0bb-e7f7-481e-bb28-e3b0b32d4bd0",
|                                               "Value":  "IdentityProvider.Read.All",
|                                               "DisplayName":  "Read identity providers",
|                                               "Description":  "Allows the app to read your organization’s identity (authentication) providers’ properties without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "90db2b9a-d928-4d33-a4dd-8442ae3d41e4",
|                                               "Value":  "IdentityProvider.ReadWrite.All",
|                                               "DisplayName":  "Read and write identity providers",
|                                               "Description":  "Allows the app to read and write your organization’s identity (authentication) providers’ properties without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6e472fd1-ad78-48da-a0f0-97ab2c6b769e",
|                                               "Value":  "IdentityRiskEvent.Read.All",
|                                               "DisplayName":  "Read all identity risk event information",
|                                               "Description":  "Allows the app to read the identity risk event information for your organization without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "db06fb33-1953-4b7b-a2ac-f1e2c854f7ae",
|                                               "Value":  "IdentityRiskEvent.ReadWrite.All",
|                                               "DisplayName":  "Read and write all risk detection information",
|                                               "Description":  "Allows the app to read and update identity risk detection information for your organization without a signed-in user. Update operations include confirming risk event detections. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4aadfb66-d49a-414a-a883-d8c240b6fa33",
|                                               "Value":  "IdentityRiskyAgent.Read.All",
|                                               "DisplayName":  "Read all risky agents information",
|                                               "Description":  "Allows the app to read the risky agents information in your organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dca4e4fd-a7cf-4e6f-86d1-d1ec094d766e",
|                                               "Value":  "IdentityRiskyAgent.ReadWrite.All",
|                                               "DisplayName":  "Read and write risky agents information",
|                                               "Description":  "Allows the app to read and update risky agents information in your organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "607c7344-0eed-41e5-823a-9695ebe1b7b0",
|                                               "Value":  "IdentityRiskyServicePrincipal.Read.All",
|                                               "DisplayName":  "Read all identity risky service principal information",
|                                               "Description":  "Allows the app to read all risky service principal information for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cb8d6980-6bcb-4507-afec-ed6de3a2d798",
|                                               "Value":  "IdentityRiskyServicePrincipal.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity risky service principal information",
|                                               "Description":  "Allows the app to read and update identity risky service principal for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dc5007c0-2d7d-4c42-879c-2dab87571379",
|                                               "Value":  "IdentityRiskyUser.Read.All",
|                                               "DisplayName":  "Read all identity risky user information",
|                                               "Description":  "Allows the app to read the identity risky user information for your organization without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "656f6061-f9fe-4807-9708-6a2e0934df76",
|                                               "Value":  "IdentityRiskyUser.ReadWrite.All",
|                                               "DisplayName":  "Read and write all risky user information",
|                                               "Description":  "Allows the app to read and update identity risky user information for your organization without a signed-in user.  Update operations include dismissing risky users."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1b0c317f-dd31-4305-9932-259a8b6e8099",
|                                               "Value":  "IdentityUserFlow.Read.All",
|                                               "DisplayName":  "Read all identity user flows",
|                                               "Description":  "Allows the app to read your organization\u0027s user flows, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "65319a09-a2be-469d-8782-f6b07debf789",
|                                               "Value":  "IdentityUserFlow.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity user flows",
|                                               "Description":  "Allows the app to read or write your organization\u0027s user flows, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7ab52c2f-a2ee-4d98-9ebc-725e3934aae2",
|                                               "Value":  "IndustryData-DataConnector.Read.All",
|                                               "DisplayName":  "View data connector definitions",
|                                               "Description":  "Allows the app to read data connectors without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "eda0971c-482e-4345-b28f-69c309cb8a34",
|                                               "Value":  "IndustryData-DataConnector.ReadWrite.All",
|                                               "DisplayName":  "Manage data connector definitions",
|                                               "Description":  "Allows the app to read and write data connectors without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9334c44b-a7c6-4350-8036-6bf8e02b4c1f",
|                                               "Value":  "IndustryData-DataConnector.Upload",
|                                               "DisplayName":  "Upload files to a data connector",
|                                               "Description":  "Allows the app to upload data files to a data connector without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "305f6ba2-049a-4b1b-88bb-fe7e08758a00",
|                                               "Value":  "IndustryData-InboundFlow.Read.All",
|                                               "DisplayName":  "View inbound flow definitions",
|                                               "Description":  "Allows the app to read inbound data flows without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e688c61f-d4c6-4d64-a197-3bcf6ba1d6ad",
|                                               "Value":  "IndustryData-InboundFlow.ReadWrite.All",
|                                               "DisplayName":  "Manage inbound flow definitions",
|                                               "Description":  "Allows the app to read and write inbound data flows without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "61d0354c-5d88-483c-b974-a37ec3395a2c",
|                                               "Value":  "IndustryData-OutboundFlow.Read.All",
|                                               "DisplayName":  "View outbound flow definitions",
|                                               "Description":  "Allows the app to read outbound data flows without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "24a65b4a-e501-47e2-8849-d679517887f0",
|                                               "Value":  "IndustryData-OutboundFlow.ReadWrite.All",
|                                               "DisplayName":  "Manage outbound flow definitions",
|                                               "Description":  "Allows the app to read and write outbound data flows without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6ee891c3-74a4-4148-8463-0c834375dfaf",
|                                               "Value":  "IndustryData-ReferenceDefinition.Read.All",
|                                               "DisplayName":  "View reference definitions",
|                                               "Description":  "Allows the app to read reference definitions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bda16293-63d3-45b7-b16b-833841d27d56",
|                                               "Value":  "IndustryData-ReferenceDefinition.ReadWrite.All",
|                                               "DisplayName":  "Manage reference definitions",
|                                               "Description":  "Allows the app to read and write reference definitions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f6f5d10b-3024-4d1d-b674-aae4df4a1a73",
|                                               "Value":  "IndustryData-Run.Read.All",
|                                               "DisplayName":  "View current and previous runs",
|                                               "Description":  "Allows the app to read current and previous IndustryData runs without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7e429772-5b5e-47c0-8fd6-7279294c8033",
|                                               "Value":  "IndustryData-Run.Start",
|                                               "DisplayName":  "View and start runs",
|                                               "Description":  "Allows the app to view and start IndustryData runs without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bc167a60-39fe-4865-8b44-78400fc6ed03",
|                                               "Value":  "IndustryData-SourceSystem.Read.All",
|                                               "DisplayName":  "View source system definitions",
|                                               "Description":  "Allows the app to read source system definitions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7d866958-e06e-4dd6-91c6-a086b3f5cfeb",
|                                               "Value":  "IndustryData-SourceSystem.ReadWrite.All",
|                                               "DisplayName":  "Manage source system definitions",
|                                               "Description":  "Allows the app to read and write source system definitions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7c55c952-b095-4c23-a522-022bce4cc1e3",
|                                               "Value":  "IndustryData-TimePeriod.Read.All",
|                                               "DisplayName":  "Read time period definitions",
|                                               "Description":  "Allows the app to read time period definitions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7afa7744-a782-4a32-b8c2-e3db637e8de7",
|                                               "Value":  "IndustryData-TimePeriod.ReadWrite.All",
|                                               "DisplayName":  "Manage time period definitions",
|                                               "Description":  "Allows the app to read and write time period definitions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4f5ac95f-62fd-472c-b60f-125d24ca0bc5",
|                                               "Value":  "IndustryData.ReadBasic.All",
|                                               "DisplayName":  "View basic service and resource information",
|                                               "Description":  "Allows the app to read basic service and resource information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "14f49b9f-4bf2-4d24-b80e-b27ec58409bd",
|                                               "Value":  "InformationProtectionConfig.Read.All",
|                                               "DisplayName":  "Read all configurations for protecting organizational data applicable to users",
|                                               "Description":  "Allows the app to read all configurations applicable to users for protecting organizational data, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cbe6c7e4-09aa-4b8d-b3c3-2dbb59af4b54",
|                                               "Value":  "InformationProtectionContent.Sign.All",
|                                               "DisplayName":  "Sign digests for data",
|                                               "Description":  "Allows an app to sign digests for data without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "287bd98c-e865-4e8c-bade-1a85523195b9",
|                                               "Value":  "InformationProtectionContent.Write.All",
|                                               "DisplayName":  "Create protected content",
|                                               "Description":  "Allows the app to create protected content without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "19da66cb-0fb0-4390-b071-ebc76a349482",
|                                               "Value":  "InformationProtectionPolicy.Read.All",
|                                               "DisplayName":  "Read all published labels and label policies for an organization.",
|                                               "Description":  "Allows an app to read published sensitivity labels and label policy settings for the entire organization or a specific user, without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "34cbd96c-d824-4755-90d3-1008ef47efc1",
|                                               "Value":  "Insights-UserMetric.Read.All",
|                                               "DisplayName":  "Read all user metrics insights",
|                                               "Description":  "Allows an app to read all user metrics insights, such as daily and monthly active users, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "535e6066-2894-49ef-ab33-e2c6d064bb81",
|                                               "Value":  "LearningAssignedCourse.Read.All",
|                                               "DisplayName":  "Read all assignments",
|                                               "Description":  "Allows the app to read data for all assignments in the organization\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "236c1cbd-1187-427f-b0f5-b1852454973b",
|                                               "Value":  "LearningAssignedCourse.ReadWrite.All",
|                                               "DisplayName":  "Read and write all assignments",
|                                               "Description":  "Allows the app to create, update, read and delete all assignments in the organization\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8740813e-d8aa-4204-860e-2a0f8f84dbc8",
|                                               "Value":  "LearningContent.Read.All",
|                                               "DisplayName":  "Read all learning content",
|                                               "Description":  "Allows the app to read all learning content in the organization\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "444d6fcb-b738-41e5-b103-ac4f2a2628a3",
|                                               "Value":  "LearningContent.ReadWrite.All",
|                                               "DisplayName":  "Manage all learning content",
|                                               "Description":  "Allows the app to manage all learning content in the organization\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "467524fc-ed22-4356-a910-af61191e3503",
|                                               "Value":  "LearningSelfInitiatedCourse.Read.All",
|                                               "DisplayName":  "Read all self-initiated courses",
|                                               "Description":  "Allows the app to read data for all self-initiated courses in the organization\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7654ed61-8965-4025-846a-0856ec02b5b0",
|                                               "Value":  "LearningSelfInitiatedCourse.ReadWrite.All",
|                                               "DisplayName":  "Read and write all self-initiated courses",
|                                               "Description":  "Allows the app to create, update, read and delete all self-initiated courses in the organization\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e2f98668-2877-4f38-a2f4-8202e0717aa1",
|                                               "Value":  "LicenseAssignment.Read.All",
|                                               "DisplayName":  "Read all license assignments.",
|                                               "Description":  "Allows an app to read license assignments for users and groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5facf0c1-8979-4e95-abcf-ff3d079771c0",
|                                               "Value":  "LicenseAssignment.ReadWrite.All",
|                                               "DisplayName":  "Manage all license assignments",
|                                               "Description":  "Allows an app to manage license assignments for users and groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2cb19e7d-9012-40bf-9a22-69fc776af8b0",
|                                               "Value":  "LifecycleWorkflows-CustomExt.Read.All",
|                                               "DisplayName":  "Read all Lifecycle workflows custom task extensionss",
|                                               "Description":  "Allows the app to read all Lifecycle workflows custom task extensions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3351c766-bacc-4d93-94fa-f2c8b1986ee7",
|                                               "Value":  "LifecycleWorkflows-CustomExt.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Lifecycle workflows custom task extensions",
|                                               "Description":  "Allows the app to create, update, list, read and delete all Lifecycle workflows custom task extensions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fe615156-48b5-4c83-b613-e6e31a43c446",
|                                               "Value":  "LifecycleWorkflows-Reports.Read.All",
|                                               "DisplayName":  "Read all Lifecycle workflows reports",
|                                               "Description":  "Allows the app to read all Lifecycle workflows reports without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3a87a643-13d2-47aa-8d6a-b0a8377cb03b",
|                                               "Value":  "LifecycleWorkflows-Workflow.Activate",
|                                               "DisplayName":  "Run workflows on-demand in Lifecycle workflows",
|                                               "Description":  "Allows the app run workflows on-demand without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "03b0ad3e-fc2b-4ef1-b0ff-252e865cb608",
|                                               "Value":  "LifecycleWorkflows-Workflow.Read.All",
|                                               "DisplayName":  "Read all workflows in Lifecycle workflows",
|                                               "Description":  "Allows the app to list and read all workflows and tasks without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "021ea6db-c06b-45c6-8c9c-c1cd9a37a483",
|                                               "Value":  "LifecycleWorkflows-Workflow.ReadBasic.All",
|                                               "DisplayName":  "List all workflows in Lifecycle workflows",
|                                               "Description":  "Allows the app to list all workflows without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "94c88098-1d9d-4c42-a356-4d5a95312554",
|                                               "Value":  "LifecycleWorkflows-Workflow.ReadWrite.All",
|                                               "DisplayName":  "Read and write all workflows in Lifecycle workflows",
|                                               "Description":  "Allows the app to create, update, list, read and delete all workflows and tasks in lifecycle workflows without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7c67316a-232a-4b84-be22-cea2c0906404",
|                                               "Value":  "LifecycleWorkflows.Read.All",
|                                               "DisplayName":  "Read all lifecycle workflows resources",
|                                               "Description":  "Allows the app to list and read all workflows, tasks and related lifecycle workflows resources without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5c505cf4-8424-4b8e-aa14-ee06e3bb23e3",
|                                               "Value":  "LifecycleWorkflows.ReadWrite.All",
|                                               "DisplayName":  "Read and write all lifecycle workflows resources",
|                                               "Description":  "Allows the app to create, update, list, read and delete all workflows, tasks and related lifecycle workflows resources without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "de4e4161-a10a-4dfd-809c-e328d89aefeb",
|                                               "Value":  "ListItems.SelectedOperations.Selected",
|                                               "DisplayName":  "Access selected ListItems without a signed in user.",
|                                               "Description":  "Allow the application to access a subset of listitems without a signed in user.  The specific listitems and the permissions granted will be configured in SharePoint Online."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "23c5a9bd-d900-4ecf-be26-a0689755d9e5",
|                                               "Value":  "Lists.SelectedOperations.Selected",
|                                               "DisplayName":  "Access selected Lists without a signed in user.",
|                                               "Description":  "Allow the application to access a subset of lists without a signed in user.  The specific lists and the permissions granted will be configured in SharePoint Online."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e118f1da-5c1c-46cf-bff6-8858d786f46f",
|                                               "Value":  "Mail-Advanced.ReadWrite.All",
|                                               "DisplayName":  "Read and write mail in all mailboxes, including modifying existing non-draft mails",
|                                               "Description":  "Allows the app to create, read, update, and delete all email, including contents of non-draft emails in user mailboxes, without a signed-in user. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "810c84a8-4a9e-49e6-bf7d-12d183f40d01",
|                                               "Value":  "Mail.Read",
|                                               "DisplayName":  "Read mail in all mailboxes",
|                                               "Description":  "Allows the app to read mail in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6be147d2-ea4f-4b5a-a3fa-3eab6f3c140a",
|                                               "Value":  "Mail.ReadBasic",
|                                               "DisplayName":  "Read basic mail in all mailboxes",
|                                               "Description":  "Allows the app to read basic mail properties in all mailboxes without a signed-in user. Includes all properties except body, previewBody, attachments and any extended properties."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "693c5e45-0940-467d-9b8a-1022fb9d42ef",
|                                               "Value":  "Mail.ReadBasic.All",
|                                               "DisplayName":  "Read basic mail in all mailboxes",
|                                               "Description":  "Allows the app to read basic mail properties in all mailboxes without a signed-in user. Includes all properties except body, previewBody, attachments and any extended properties."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e2a3a72e-5f79-4c64-b1b1-878b674786c9",
|                                               "Value":  "Mail.ReadWrite",
|                                               "DisplayName":  "Read and write mail in all mailboxes",
|                                               "Description":  "Allows the app to create, read, update, and delete mail in all mailboxes without a signed-in user. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b633e1c5-b582-4048-a93e-9f11b44c7e96",
|                                               "Value":  "Mail.Send",
|                                               "DisplayName":  "Send mail as any user",
|                                               "Description":  "Allows the app to send mail as any user without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "27d9d776-f4d2-426d-80ad-5f22f2b01b0a",
|                                               "Value":  "MailboxConfigItem.Read",
|                                               "DisplayName":  "Read all users\u0027 UserConfiguration objects",
|                                               "Description":  "Allows the app to read all users\u0027 UserConfiguration objects."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "aa6d92d4-b25a-4640-aefe-3e3231e5e736",
|                                               "Value":  "MailboxConfigItem.ReadWrite",
|                                               "DisplayName":  "Read and write all users\u0027 UserConfiguration objects",
|                                               "Description":  "Allows the app to create, read, update and delete all users\u0027 UserConfiguration objects."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "99280d24-a782-4793-93cc-0888549957f6",
|                                               "Value":  "MailboxFolder.Read.All",
|                                               "DisplayName":  "Read all the users\u0027 mailbox folders",
|                                               "Description":  "Allows the app to read all the users\u0027 mailbox folders, without signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fef87b92-8391-4589-9da7-eb93dab7dc8a",
|                                               "Value":  "MailboxFolder.ReadWrite.All",
|                                               "DisplayName":  "Read and write all the users\u0027 mailbox folders",
|                                               "Description":  "Allows the app to read and write all the users\u0027 mailbox folders, without signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "937550e9-33a3-494b-88ae-d9cd394b1fbb",
|                                               "Value":  "MailboxItem.Export.All",
|                                               "DisplayName":  "Export all the users\u0027 mailbox items",
|                                               "Description":  "Allows the app to export all the users\u0027 mailbox items, without signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "76577085-e73d-4f1d-b26a-85fb33892327",
|                                               "Value":  "MailboxItem.ImportExport.All",
|                                               "DisplayName":  "Allows the app to perform backup and restore for all mailbox items",
|                                               "Description":  "Allows the app to backup, restore, and modify all mailbox items without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7d9f353d-a7bd-4fbb-822a-26d5dd39a3ce",
|                                               "Value":  "MailboxItem.Read.All",
|                                               "DisplayName":  "Read all the users\u0027 mailbox items",
|                                               "Description":  "Allows the app to read all the users\u0027 mailbox items, without signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "40f97065-369a-49f4-947c-6a255697ae91",
|                                               "Value":  "MailboxSettings.Read",
|                                               "DisplayName":  "Read all user mailbox settings",
|                                               "Description":  "Allows the app to read user\u0027s mailbox settings without a signed-in user. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6931bccd-447a-43d1-b442-00a195474933",
|                                               "Value":  "MailboxSettings.ReadWrite",
|                                               "DisplayName":  "Read and write all user mailbox settings",
|                                               "Description":  "Allows the app to create, read, update, and delete user\u0027s mailbox settings without a signed-in user. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a2c9652d-4d7f-4e4e-9d75-ac32fdc6f413",
|                                               "Value":  "MailTips.ReadBasic.All",
|                                               "DisplayName":  "Read mail tips for all users",
|                                               "Description":  "Allows the app to read mail tips for all users in the organization without a signed-in user. Mail tips include automatic replies, mailbox status, custom tips, and delivery information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "658aa5d8-239f-45c4-aa12-864f4fc7e490",
|                                               "Value":  "Member.Read.Hidden",
|                                               "DisplayName":  "Read all hidden memberships",
|                                               "Description":  "Allows the app to read the memberships of hidden groups and administrative units without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4f994bc0-31bb-44bb-b480-7a7c1be8c02e",
|                                               "Value":  "MultiTenantOrganization.Read.All",
|                                               "DisplayName":  "Read all multi-tenant organization details and tenants",
|                                               "Description":  "Allows the app to read all multi-tenant organization details and tenants, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f9c2b2a7-3895-4b2e-80f6-c924b456e50b",
|                                               "Value":  "MultiTenantOrganization.ReadBasic.All",
|                                               "DisplayName":  "Read multi-tenant organization basic details and active tenants",
|                                               "Description":  "Allows the app to read multi-tenant organization basic details and active tenants, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "920def01-ca61-4d2d-b3df-105b46046a70",
|                                               "Value":  "MultiTenantOrganization.ReadWrite.All",
|                                               "DisplayName":  "Read and write all multi-tenant organization details and tenants",
|                                               "Description":  "Allows the app to read and write all multi-tenant organization details and tenants, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6daaff82-2880-496d-9d80-57e8e31195e2",
|                                               "Value":  "MutualTlsOauthConfiguration.Read.All",
|                                               "DisplayName":  "Read all configurations used for mutual-TLS client authentication.",
|                                               "Description":  "Allows the app to read configuration used for OAuth 2.0 mutual-TLS client authentication, without a signed-in user. This includes reading trusted certificate authorities."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "78bbf8cf-07d8-45ba-b0eb-1a7b48efbcf1",
|                                               "Value":  "MutualTlsOauthConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write all configurations used for mutual-TLS client authentication.",
|                                               "Description":  "Allows the app to read and update configuration used for OAuth 2.0 mutual-TLS client authentication, without a signed-in user. This includes reading and updating trusted certificate authorities."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "40049381-3cc1-42af-94ec-5ce755db4b0d",
|                                               "Value":  "NetworkAccess-Reports.Read.All",
|                                               "DisplayName":  "Read all network access reports",
|                                               "Description":  "Allows the app to read all network access reports without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e30060de-caa5-4331-99d3-6ac6c966a9a4",
|                                               "Value":  "NetworkAccess.Read.All",
|                                               "DisplayName":  "Read all network access information",
|                                               "Description":  "Allows the app to read all network access information and configuration settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b10642fc-a6cf-4c46-87f9-e1f96c2a18aa",
|                                               "Value":  "NetworkAccess.ReadWrite.All",
|                                               "DisplayName":  "Read and write all network access information",
|                                               "Description":  "Allows the app to read and write all network access information and configuration settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "39ae4a24-1ef0-49e8-9d63-2a66f5c39edd",
|                                               "Value":  "NetworkAccessBranch.Read.All",
|                                               "DisplayName":  "Read properties of all branches for network access",
|                                               "Description":  "Allows the app to read your organization\u0027s network access branches, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8137102d-ec16-4191-aaf8-7aeda8026183",
|                                               "Value":  "NetworkAccessBranch.ReadWrite.All",
|                                               "DisplayName":  "Read and write properties of all branches for network access",
|                                               "Description":  "Allows the app to read and write your organization\u0027s network access branches, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8a3d36bf-cb46-4bcc-bec9-8d92829dab84",
|                                               "Value":  "NetworkAccessPolicy.Read.All",
|                                               "DisplayName":  "Read all security and routing policies for network access",
|                                               "Description":  "Allows the app to read your organization\u0027s network access policies, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f0c341be-8348-4989-8e43-660324294538",
|                                               "Value":  "NetworkAccessPolicy.ReadWrite.All",
|                                               "DisplayName":  "Read and write all security and routing policies for network access",
|                                               "Description":  "Allows the app to read and write your organization\u0027s network access policies, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3aeca27b-ee3a-4c2b-8ded-80376e2134a4",
|                                               "Value":  "Notes.Read.All",
|                                               "DisplayName":  "Read all OneNote notebooks",
|                                               "Description":  "Allows the app to read all the OneNote notebooks in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0c458cef-11f3-48c2-a568-c66751c238c0",
|                                               "Value":  "Notes.ReadWrite.All",
|                                               "DisplayName":  "Read and write all OneNote notebooks",
|                                               "Description":  "Allows the app to read all the OneNote notebooks in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c0cf7895-985f-42d4-a693-b618f36674ad",
|                                               "Value":  "OnlineMeetingAiInsight.Read.All",
|                                               "DisplayName":  "Read all AI Insights for online meetings.",
|                                               "Description":  "Allows the app to read all AI Insights for all online meetings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "01892c31-3b66-4bcf-b5f5-bf0a03d5ed9f",
|                                               "Value":  "OnlineMeetingAiInsight.Read.Chat",
|                                               "DisplayName":  "Read all AI Insights for online meetings where the Teams application is installed.",
|                                               "Description":  "Allows the teams-app to read all aiInsights for online meetings where the Teams-app is installed, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "df01ed3b-eb61-4eca-9965-6b3d789751b2",
|                                               "Value":  "OnlineMeetingArtifact.Read.All",
|                                               "DisplayName":  "Read online meeting artifacts",
|                                               "Description":  "Allows the app to read online meeting artifacts in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a4a08342-c95d-476b-b943-97e100569c8d",
|                                               "Value":  "OnlineMeetingRecording.Read.All",
|                                               "DisplayName":  "Read all recordings of online meetings.",
|                                               "Description":  "Allows the app to read all recordings of all online meetings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c1684f21-1984-47fa-9d61-2dc8c296bb70",
|                                               "Value":  "OnlineMeetings.Read.All",
|                                               "DisplayName":  "Read online meeting details",
|                                               "Description":  "Allows the app to read online meeting details in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b8bb2037-6e08-44ac-a4ea-4674e010e2a4",
|                                               "Value":  "OnlineMeetings.ReadWrite.All",
|                                               "DisplayName":  "Read and create online meetings",
|                                               "Description":  "Allows the app to read and create online meetings as an application in your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a4a80d8d-d283-4bd8-8504-555ec3870630",
|                                               "Value":  "OnlineMeetingTranscript.Read.All",
|                                               "DisplayName":  "Read all transcripts of online meetings.",
|                                               "Description":  "Allows the app to read all transcripts of all online meetings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bb70e231-92dc-4729-aff5-697b3f04be95",
|                                               "Value":  "OnPremDirectorySynchronization.Read.All",
|                                               "DisplayName":  "Read all on-premises directory synchronization information",
|                                               "Description":  "Allows the app to read all on-premises directory synchronization information for the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c22a92cc-79bf-4bb1-8b6c-e0a05d3d80ce",
|                                               "Value":  "OnPremDirectorySynchronization.ReadWrite.All",
|                                               "DisplayName":  "Read and write all on-premises directory synchronization information",
|                                               "Description":  "Allows the app to read and write all on-premises directory synchronization information for the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0b57845e-aa49-4e6f-8109-ce654fffa618",
|                                               "Value":  "OnPremisesPublishingProfiles.ReadWrite.All",
|                                               "DisplayName":  "Manage on-premises published resources",
|                                               "Description":  "Allows the app to create, view, update and delete on-premises published resources, on-premises agents and agent groups, as part of a hybrid identity configuration, without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "498476ce-e0fe-48b0-b801-37ba7e2685c6",
|                                               "Value":  "Organization.Read.All",
|                                               "DisplayName":  "Read organization information",
|                                               "Description":  "Allows the app to read the organization and related resources, without a signed-in user. Related resources include things like subscribed skus and tenant branding information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "292d869f-3427-49a8-9dab-8c70152b74e9",
|                                               "Value":  "Organization.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization information",
|                                               "Description":  "Allows the app to read and write the organization and related resources, without a signed-in user. Related resources include things like subscribed skus and tenant branding information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "eb76ac34-0d62-4454-b97c-185e4250dc20",
|                                               "Value":  "OrganizationalBranding.Read.All",
|                                               "DisplayName":  "Read organizational branding information",
|                                               "Description":  "Allows the app to read the organizational branding information, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d2ebfbc1-a5f8-424b-83a6-56ab5927a73c",
|                                               "Value":  "OrganizationalBranding.ReadWrite.All",
|                                               "DisplayName":  "Read and write organizational branding information",
|                                               "Description":  "Allows the app to read and write the organizational branding information, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e1a88a34-94c4-4418-be12-c87b00e26bea",
|                                               "Value":  "OrgContact.Read.All",
|                                               "DisplayName":  "Read organizational contacts",
|                                               "Description":  "Allows the app to read all organizational contacts without a signed-in user.  These contacts are managed by the organization and are different from a user\u0027s personal contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "56c84fa9-ea1f-4a15-90f2-90ef41ece2c9",
|                                               "Value":  "OrgSettings-AppsAndServices.Read.All",
|                                               "DisplayName":  "Read organization-wide apps and services settings",
|                                               "Description":  "Allows the app to read organization-wide apps and services settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4a8e4191-c1c8-45f8-b801-f9a1a5ee6ad3",
|                                               "Value":  "OrgSettings-AppsAndServices.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide apps and services settings",
|                                               "Description":  "Allows the app to read and write organization-wide apps and services settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c18ae2dc-d9f3-4495-a93f-18980a0e159f",
|                                               "Value":  "OrgSettings-DynamicsVoice.Read.All",
|                                               "DisplayName":  "Read organization-wide Dynamics customer voice settings",
|                                               "Description":  "Allows the app to read organization-wide Dynamics customer voice settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c3f1cc32-8bbd-4ab6-bd33-f270e0d9e041",
|                                               "Value":  "OrgSettings-DynamicsVoice.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide Dynamics customer voice settings",
|                                               "Description":  "Allows the app to read and write organization-wide Dynamics customer voice settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "434d7c66-07c6-4b1f-ab21-417cf2cdaaca",
|                                               "Value":  "OrgSettings-Forms.Read.All",
|                                               "DisplayName":  "Read organization-wide Microsoft Forms settings",
|                                               "Description":  "Allows the app to read organization-wide Microsoft Forms settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2cb92fee-97a3-4034-8702-24a6f5d0d1e9",
|                                               "Value":  "OrgSettings-Forms.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide Microsoft Forms settings",
|                                               "Description":  "Allows the app to read and write organization-wide Microsoft Forms settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6cdf1fb1-b46f-424f-9493-07247caa22e2",
|                                               "Value":  "OrgSettings-Microsoft365Install.Read.All",
|                                               "DisplayName":  "Read organization-wide Microsoft 365 apps installation settings",
|                                               "Description":  "Allows the app to read organization-wide Microsoft 365 apps installation settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "83f7232f-763c-47b2-a097-e35d2cbe1da5",
|                                               "Value":  "OrgSettings-Microsoft365Install.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide Microsoft 365 apps installation settings",
|                                               "Description":  "Allows the app to read and write organization-wide Microsoft 365 apps installation settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e4d9cd09-d858-4363-9410-abb96737f0cf",
|                                               "Value":  "OrgSettings-Todo.Read.All",
|                                               "DisplayName":  "Read organization-wide Microsoft To Do settings",
|                                               "Description":  "Allows the app to read organization-wide Microsoft To Do settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5febc9da-e0d0-4576-bd13-ae70b2179a39",
|                                               "Value":  "OrgSettings-Todo.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide Microsoft To Do settings",
|                                               "Description":  "Allows the app to read and write organization-wide Microsoft To Do settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7c3e1994-38ff-4412-a99b-9369f6bb7706",
|                                               "Value":  "PartnerBilling.Read.All",
|                                               "DisplayName":  "Read all billing data for your company\u0027s tenant",
|                                               "Description":  "Allows the app to read all of billing data from Microsoft for your company\u0027s tenant, without a signed-in user. This includes reading billed and unbilled azure usage and invoice reconciliation data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "21ffa320-2e7f-47d3-a466-7ff04d2dd68d",
|                                               "Value":  "PartnerSecurity.Read.All",
|                                               "DisplayName":  "Read security alerts of customer with CSP relationship",
|                                               "Description":  "Allows the app to read security alerts of customer with CSP relationship, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "04a2c935-5b4b-474a-be42-11f53111f271",
|                                               "Value":  "PartnerSecurity.ReadWrite.All",
|                                               "DisplayName":  "Read security alerts and update status of security alerts of customer with CSP relationship",
|                                               "Description":  "Allows the app to read security alerts and update status of alerts of customer with CSP relationship, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bdfb26d9-bb36-49be-9b4c-b8cbf4b05808",
|                                               "Value":  "PendingExternalUserProfile.Read.All",
|                                               "DisplayName":  "Read all pending external user profiles",
|                                               "Description":  "Allows the app to read available properties of pending external user profiles, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8363c2b8-6ff7-420b-9966-c5884c2d48bc",
|                                               "Value":  "PendingExternalUserProfile.ReadWrite.All",
|                                               "DisplayName":  "Read and write all pending external user profiles",
|                                               "Description":  "Allows the app to read and write available properties of pending external user profiles, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b528084d-ad10-4598-8b93-929746b4d7d6",
|                                               "Value":  "People.Read.All",
|                                               "DisplayName":  "Read all users\u0027 relevant people lists",
|                                               "Description":  "Allows the app to read any user\u0027s scored list of relevant people, without a signed-in user. The list can include local contacts, contacts from social networking, your organization\u0027s directory, and people from recent communications (such as email and Skype)."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ef02f2e7-e22d-4c77-8614-8f765683b86e",
|                                               "Value":  "PeopleSettings.Read.All",
|                                               "DisplayName":  "Read all tenant-wide people settings",
|                                               "Description":  "Allows the application to read tenant-wide people settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b6890674-9dd5-4e42-bb15-5af07f541ae1",
|                                               "Value":  "PeopleSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write all tenant-wide people settings",
|                                               "Description":  "Allows the application to read and write tenant-wide people settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "913b9306-0ce1-42b8-9137-6a7df690a760",
|                                               "Value":  "Place.Read.All",
|                                               "DisplayName":  "Read all company places",
|                                               "Description":  "Allows the app to read company places (conference rooms and room lists) for calendar events and other applications, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f1f5e9aa-ad18-4b97-883e-6aa7e95b7a5f",
|                                               "Value":  "Place.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization places",
|                                               "Description":  "Allows the app to manage organization places (conference rooms and room lists) for calendar events and other applications, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8b724a84-ceac-4fd9-897e-e31ba8f2d7a3",
|                                               "Value":  "PlaceDevice.Read.All",
|                                               "DisplayName":  "Read all workplace devices",
|                                               "Description":  "Allows the app to read all workplace devices, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2d510721-5c4e-43cd-bfdb-ac0f8819fb92",
|                                               "Value":  "PlaceDevice.ReadWrite.All",
|                                               "DisplayName":  "Read and write all workplace devices",
|                                               "Description":  "Allows the app to read and write all workplace devices, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "27fc435f-44e2-4b30-bf3c-e0ce74aed618",
|                                               "Value":  "PlaceDeviceTelemetry.ReadWrite.All",
|                                               "DisplayName":  "Read and write telemetry for all workplace devices.",
|                                               "Description":  "Allows the app to read and write telemetry for all workplace devices, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "246dd0d5-5bd0-4def-940b-0421030a5b68",
|                                               "Value":  "Policy.Read.All",
|                                               "DisplayName":  "Read your organization\u0027s policies",
|                                               "Description":  "Allows the app to read all your organization\u0027s policies without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8e3bc81b-d2f3-4b7b-838c-32c88218d2f0",
|                                               "Value":  "Policy.Read.AuthenticationMethod",
|                                               "DisplayName":  "Read authentication method policies",
|                                               "Description":  "Allows the app to read all authentication method policies for the tenant, without a signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "227900ff-df89-40f8-90e2-8157cf6995d5",
|                                               "Value":  "Policy.Read.B2BManagementPolicy",
|                                               "DisplayName":  "Read your organization\u0027s B2BManagement policies",
|                                               "Description":  "Allows the app to read all your organization\u0027s B2BManagement policies without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "37730810-e9ba-4e46-b07e-8ca78d182097",
|                                               "Value":  "Policy.Read.ConditionalAccess",
|                                               "DisplayName":  "Read your organization\u0027s conditional access policies",
|                                               "Description":  "Allows the app to read your organization\u0027s conditional access policies, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bdba4817-6ba1-4a7c-8a01-be9bc7c242dd",
|                                               "Value":  "Policy.Read.DeviceConfiguration",
|                                               "DisplayName":  "Read your organization\u0027s device configuration policies",
|                                               "Description":  "Allows the application to read your organization\u0027s device configuration policies without a signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b21b72f6-4e6a-4533-9112-47eea9f97b28",
|                                               "Value":  "Policy.Read.IdentityProtection",
|                                               "DisplayName":  "Read your organization’s identity protection policy",
|                                               "Description":  "Allows the app to read your organization’s identity protection policy without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9e640839-a198-48fb-8b9a-013fd6f6cbcd",
|                                               "Value":  "Policy.Read.PermissionGrant",
|                                               "DisplayName":  "Read consent and permission grant policies",
|                                               "Description":  "Allows the app to read policies related to consent and permission grants for applications, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "77c863fd-06c0-47ce-a7eb-49773e89d319",
|                                               "Value":  "Policy.ReadWrite.AccessReview",
|                                               "DisplayName":  "Read and write your organization\u0027s directory access review default policy",
|                                               "Description":  "Allows the app to read and write your organization\u0027s directory access review default policy without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "be74164b-cff1-491c-8741-e671cb536e13",
|                                               "Value":  "Policy.ReadWrite.ApplicationConfiguration",
|                                               "DisplayName":  "Read and write your organization\u0027s application configuration policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s application configuration policies, without a signed-in user.  This includes policies such as activityBasedTimeoutPolicy, claimsMappingPolicy, homeRealmDiscoveryPolicy, tokenIssuancePolicy  and tokenLifetimePolicy."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "25f85f3c-f66c-4205-8cd5-de92dd7f0cec",
|                                               "Value":  "Policy.ReadWrite.AuthenticationFlows",
|                                               "DisplayName":  "Read and write authentication flow policies",
|                                               "Description":  "Allows the app to read and write all authentication flow policies for the tenant, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "29c18626-4985-4dcd-85c0-193eef327366",
|                                               "Value":  "Policy.ReadWrite.AuthenticationMethod",
|                                               "DisplayName":  "Read and write all authentication method policies ",
|                                               "Description":  "Allows the app to read and write all authentication method policies for the tenant, without a signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fb221be6-99f2-473f-bd32-01c6a0e9ca3b",
|                                               "Value":  "Policy.ReadWrite.Authorization",
|                                               "DisplayName":  "Read and write your organization\u0027s authorization policy",
|                                               "Description":  "Allows the app to read and write your organization\u0027s authorization policy without a signed in user. For example, authorization policies can control some of the permissions that the out-of-the-box user role has by default."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "886bd2d9-5b8b-4b49-adea-ca75fb50d9ef",
|                                               "Value":  "Policy.ReadWrite.B2BManagementPolicy",
|                                               "DisplayName":  "Read and write your organization\u0027s B2BManagement policies",
|                                               "Description":  "Allows the app to read and write all your organization\u0027s B2BManagement policies without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "01c0a623-fc9b-48e9-b794-0756f8e8f067",
|                                               "Value":  "Policy.ReadWrite.ConditionalAccess",
|                                               "DisplayName":  "Read and write your organization\u0027s conditional access policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s conditional access policies, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "999f8c63-0a38-4f1b-91fd-ed1947bdd1a9",
|                                               "Value":  "Policy.ReadWrite.ConsentRequest",
|                                               "DisplayName":  "Read and write your organization\u0027s consent request policy",
|                                               "Description":  "Allows the app to read and write your organization\u0027s consent requests policy without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "338163d7-f101-4c92-94ba-ca46fe52447c",
|                                               "Value":  "Policy.ReadWrite.CrossTenantAccess",
|                                               "DisplayName":  "Read and write your organization\u0027s cross tenant access policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s cross-tenant access policies and configuration for automatic user consent settings to suppress consent prompts for users of the other tenant on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a6325ae7-2b73-4dbd-abed-fbeacfbf8696",
|                                               "Value":  "Policy.ReadWrite.CrossTenantCapability",
|                                               "DisplayName":  "Read and write your organization\u0027s M365 cross tenant access capabilities",
|                                               "Description":  "Allows the app to read and write your organization\u0027s M365 cross tenant access capabilities without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "230fb2d5-aa21-49c1-bfa7-ae1be179d867",
|                                               "Value":  "Policy.ReadWrite.DeviceConfiguration",
|                                               "DisplayName":  "Read and write your organization\u0027s device configuration policies",
|                                               "Description":  "Allows the application to read and write your organization\u0027s device configuration policies without a signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "03cc4f92-788e-4ede-b93f-199424d144a5",
|                                               "Value":  "Policy.ReadWrite.ExternalIdentities",
|                                               "DisplayName":  "Read and write your organization\u0027s external identities policy",
|                                               "Description":  "Allows the application to read and update the organization\u0027s external identities policy without a signed-in user.  For example, external identities policy controls if users invited to access resources in your organization via B2B collaboration or B2B direct connect are allowed to self-service leave."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2044e4f1-e56c-435b-925c-44cd8f6ba89a",
|                                               "Value":  "Policy.ReadWrite.FeatureRollout",
|                                               "DisplayName":  "Read and write feature rollout policies",
|                                               "Description":  "Allows the app to read and write feature rollout policies without a signed-in user. Includes abilities to assign and remove users and groups to rollout of a specific feature."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "90bbca0b-227c-4cdc-8083-1c6cfb95bac6",
|                                               "Value":  "Policy.ReadWrite.FedTokenValidation",
|                                               "DisplayName":  "Read and write your organization\u0027s federated token validation policy",
|                                               "Description":  "Allows the application to read and update the organization\u0027s federated token validation policy without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2dcf8603-09eb-4078-b1ec-d30a1a76b873",
|                                               "Value":  "Policy.ReadWrite.IdentityProtection",
|                                               "DisplayName":  "Read and write your organization’s identity protection policy ",
|                                               "Description":  "Allows the app to read and write your organization’s identity protection policy without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a402ca1c-2696-4531-972d-6e5ee4aa11ea",
|                                               "Value":  "Policy.ReadWrite.PermissionGrant",
|                                               "DisplayName":  "Manage consent and permission grant policies",
|                                               "Description":  "Allows the app to manage policies related to consent and permission grants for applications, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1c6e93a6-28e2-4cbb-9f64-1a46a821124d",
|                                               "Value":  "Policy.ReadWrite.SecurityDefaults",
|                                               "DisplayName":  "Read and write your organization\u0027s security defaults policy",
|                                               "Description":  "Allows the app to read and write your organization\u0027s security defaults policy, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "79a677f7-b79d-40d0-a36a-3e6f8688dd7a",
|                                               "Value":  "Policy.ReadWrite.TrustFramework",
|                                               "DisplayName":  "Read and write your organization\u0027s trust framework policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s trust framework policies without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a70e0c2d-e793-494c-94c4-118fa0a67f42",
|                                               "Value":  "Presence.Read.All",
|                                               "DisplayName":  "Read presence information for all users",
|                                               "Description":  "Allows the app to read presence information of all users in the directory without a signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "83cded22-8297-4ff6-a7fa-e97e9545a259",
|                                               "Value":  "Presence.ReadWrite.All",
|                                               "DisplayName":  "Read and write presence information for all users",
|                                               "Description":  "Allows the app to read all presence information and write activity and availability of all users in the directory without a signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, time zone and location."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9709bb33-4549-49d4-8ed9-a8f65e45bb0f",
|                                               "Value":  "Printer.Read.All",
|                                               "DisplayName":  "Read printers",
|                                               "Description":  "Allows the application to read printers without a signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f5b3f73d-6247-44df-a74c-866173fddab0",
|                                               "Value":  "Printer.ReadWrite.All",
|                                               "DisplayName":  "Read and update printers",
|                                               "Description":  "Allows the application to read and update printers without a signed-in user. Does not allow creating (registering) or deleting (unregistering) printers."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "58a52f47-9e36-4b17-9ebe-ce4ef7f3e6c8",
|                                               "Value":  "PrintJob.Manage.All",
|                                               "DisplayName":  "Perform advanced operations on print jobs",
|                                               "Description":  "Allows the application to perform advanced operations like redirecting a print job to another printer without a signed-in user. Also allows the application to read and update the metadata of print jobs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ac6f956c-edea-44e4-bd06-64b1b4b9aec9",
|                                               "Value":  "PrintJob.Read.All",
|                                               "DisplayName":  "Read print jobs",
|                                               "Description":  "Allows the application to read the metadata and document content of print jobs without a signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fbf67eee-e074-4ef7-b965-ab5ce1c1f689",
|                                               "Value":  "PrintJob.ReadBasic.All",
|                                               "DisplayName":  "Read basic information for print jobs",
|                                               "Description":  "Allows the application to read the metadata of print jobs without a signed-in user. Does not allow access to print job document content."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5114b07b-2898-4de7-a541-53b0004e2e13",
|                                               "Value":  "PrintJob.ReadWrite.All",
|                                               "DisplayName":  "Read and write print jobs",
|                                               "Description":  "Allows the application to read and update the metadata and document content of print jobs without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "57878358-37f4-4d3a-8c20-4816e0d457b1",
|                                               "Value":  "PrintJob.ReadWriteBasic.All",
|                                               "DisplayName":  "Read and write basic information for print jobs",
|                                               "Description":  "Allows the application to read and update the metadata of print jobs without a signed-in user. Does not allow access to print job document content."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b5991872-94cf-4652-9765-29535087c6d8",
|                                               "Value":  "PrintSettings.Read.All",
|                                               "DisplayName":  "Read tenant-wide print settings",
|                                               "Description":  "Allows the application to read tenant-wide print settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "456b71a7-0ee0-4588-9842-c123fcc8f664",
|                                               "Value":  "PrintTaskDefinition.ReadWrite.All",
|                                               "DisplayName":  "Read, write and update print task definitions",
|                                               "Description":  "Allows the application to read and update print task definitions without a signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e7ebe2d9-6e26-487a-8286-191d623a6904",
|                                               "Value":  "PrivilegedAccess-CustomExt.Read.All",
|                                               "DisplayName":  "Read Privileged Access (PIM) custom extensions",
|                                               "Description":  "Allows the app to read Privileged Access (PIM) custom extensions for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "124325f3-0c46-4c57-a050-d6d1a82510f6",
|                                               "Value":  "PrivilegedAccess-CustomExt.ReadWrite.All",
|                                               "DisplayName":  "Read and write Privileged Access (PIM) custom extensions",
|                                               "Description":  "Allows the app to read and write Privileged Access (PIM) custom extensions for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4cdc2547-9148-4295-8d11-be0db1391d6b",
|                                               "Value":  "PrivilegedAccess.Read.AzureAD",
|                                               "DisplayName":  "Read privileged access to Azure AD roles",
|                                               "Description":  "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "01e37dc9-c035-40bd-b438-b2879c4870a6",
|                                               "Value":  "PrivilegedAccess.Read.AzureADGroup",
|                                               "DisplayName":  "Read privileged access to Azure AD groups",
|                                               "Description":  "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5df6fe86-1be0-44eb-b916-7bd443a71236",
|                                               "Value":  "PrivilegedAccess.Read.AzureResources",
|                                               "DisplayName":  "Read privileged access to Azure resources",
|                                               "Description":  "Allows the app to read time-based assignment and just-in-time elevation of user privileges to audit Azure resources in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "854d9ab1-6657-4ec8-be45-823027bcd009",
|                                               "Value":  "PrivilegedAccess.ReadWrite.AzureAD",
|                                               "DisplayName":  "Read and write privileged access to Azure AD roles",
|                                               "Description":  "Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2f6817f8-7b12-4f0f-bc18-eeaf60705a9e",
|                                               "Value":  "PrivilegedAccess.ReadWrite.AzureADGroup",
|                                               "DisplayName":  "Read and write privileged access to Azure AD groups",
|                                               "Description":  "Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6f9d5abc-2db6-400b-a267-7de22a40fb87",
|                                               "Value":  "PrivilegedAccess.ReadWrite.AzureResources",
|                                               "DisplayName":  "Read and write privileged access to Azure resources",
|                                               "Description":  "Allows the app to request and manage time-based assignment and just-in-time elevation of Azure resources (like your subscriptions, resource groups, storage, compute) in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cd4161cb-f098-48f8-a884-1eda9a42434c",
|                                               "Value":  "PrivilegedAssignmentSchedule.Read.AzureADGroup",
|                                               "DisplayName":  "Read assignment schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to read time-based assignment schedules for access to Azure AD groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3a728f2e-df1d-4294-9899-86f601fae70a",
|                                               "Value":  "PrivilegedAssignmentSchedule.Read.EntraAppRole",
|                                               "DisplayName":  "Read assignment schedules for app permission grants and app role assignments",
|                                               "Description":  "Allows the app to read time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "41202f2c-f7ab-45be-b001-85c9728b9d69",
|                                               "Value":  "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup",
|                                               "DisplayName":  "Read, create, and delete assignment schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to read, create, and delete time-based assignment schedules for access to Azure AD groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "81adad77-a25a-489d-ac43-321115620139",
|                                               "Value":  "PrivilegedAssignmentSchedule.ReadWrite.EntraAppRole",
|                                               "DisplayName":  "Read, create, and delete assignment schedules for app permission grants and app role assignments",
|                                               "Description":  "Allows the app to read, create, and delete time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "55d1104b-3821-413d-b3ca-e2393d333cd3",
|                                               "Value":  "PrivilegedAssignmentSchedule.Remove.AzureADGroup",
|                                               "DisplayName":  "Delete assignment schedules for access to Azure AD groups",
|                                               "Description":  "Delete time-based assignment schedules for access to Azure AD groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "edb419d6-7edc-42a3-9345-509bfdf5d87c",
|                                               "Value":  "PrivilegedEligibilitySchedule.Read.AzureADGroup",
|                                               "DisplayName":  "Read eligibility schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to read time-based eligibility schedules for access to Azure AD groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d2ab45a0-ed46-4f7f-806a-0f1146144d5a",
|                                               "Value":  "PrivilegedEligibilitySchedule.Read.EntraAppRole",
|                                               "DisplayName":  "Read eligibility schedules for app permission grants and app role assignments",
|                                               "Description":  "Allows the app to read time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "618b6020-bca8-4de6-99f6-ef445fa4d857",
|                                               "Value":  "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup",
|                                               "DisplayName":  "Read, create, and delete eligibility schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to read, create, and delete time-based eligibility schedules for access to Azure AD groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7f4c39f1-1aa7-44b7-ab05-38df2609c37a",
|                                               "Value":  "PrivilegedEligibilitySchedule.ReadWrite.EntraAppRole",
|                                               "DisplayName":  "Read, create, and delete eligibility schedules for app permission grants and app role assignments",
|                                               "Description":  "Allows the app to read, create, and delete time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "55745561-7572-4314-a737-a2c2a1b0dd2e",
|                                               "Value":  "PrivilegedEligibilitySchedule.Remove.AzureADGroup",
|                                               "DisplayName":  "Delete eligibility schedules for access to Azure AD groups",
|                                               "Description":  "Delete time-based eligibility schedules for access to Azure AD groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e24d31aa-e1ab-4c80-85fe-23018690335d",
|                                               "Value":  "ProfilePhoto.Read.All",
|                                               "DisplayName":  "Read profile photo of a user or group",
|                                               "Description":  "Allows the app to read all profile photos of users and groups, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "27baa7f6-5dfb-4ba8-b1d3-1e812c143013",
|                                               "Value":  "ProfilePhoto.ReadWrite.All",
|                                               "DisplayName":  "Read and write profile photo of a user or group",
|                                               "Description":  "Allows the app to read and write all profile photos of users and groups, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "eedb7fdd-7539-4345-a38b-4839e4a84cbd",
|                                               "Value":  "ProgramControl.Read.All",
|                                               "DisplayName":  "Read all programs",
|                                               "Description":  "Allows the app to read programs and program controls in the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "60a901ed-09f7-4aa5-a16e-7dd3d6f9de36",
|                                               "Value":  "ProgramControl.ReadWrite.All",
|                                               "DisplayName":  "Manage all programs",
|                                               "Description":  "Allows the app to read, update, delete and perform actions on programs and program controls in the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e5a76501-dbb0-492c-ab55-5d09e8837263",
|                                               "Value":  "ProtectionScopes.Compute.All",
|                                               "DisplayName":  "Compute Purview policies at tenant scope",
|                                               "Description":  "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for all users across tenant."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fe696d63-5e1f-4515-8232-cccc316903c6",
|                                               "Value":  "ProtectionScopes.Compute.User",
|                                               "DisplayName":  "Compute Purview policies for an individual user",
|                                               "Description":  "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for an individual user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "091937d3-3e38-47a1-8649-b2f99d3035f1",
|                                               "Value":  "ProvisioningLog.Read.All",
|                                               "DisplayName":  "Read all provisioning log data",
|                                               "Description":  "Allows the app to read and query your provisioning log activities, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "214fda0c-514a-4650-b037-b562b1a66124",
|                                               "Value":  "PublicKeyInfrastructure.Read.All",
|                                               "DisplayName":  "Read all certificate based authentication configurations",
|                                               "Description":  "Allows the application to read  certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a2b63618-5350-462d-b1b3-ba6eb3684e26",
|                                               "Value":  "PublicKeyInfrastructure.ReadWrite.All",
|                                               "DisplayName":  "Read and write all certificate based authentication configurations",
|                                               "Description":  "Allows the application to read and write certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ee49e170-1dd1-4030-b44c-61ad6e98f743",
|                                               "Value":  "QnA.Read.All",
|                                               "DisplayName":  "Read all Question and Answers ",
|                                               "Description":  "Allows an app to read all question and answers, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "abafe00f-ea87-4c63-b8a8-0e7bb0a88144",
|                                               "Value":  "RealTimeActivityFeed.Read.All",
|                                               "DisplayName":  "Access real-time enriched data in a meeting as an app",
|                                               "Description":  "Allows the app to get direct access to real-time enriched data in a meeting, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ac3a2b8e-03a3-4da9-9ce0-cbe28bf1accd",
|                                               "Value":  "RecordsManagement.Read.All",
|                                               "DisplayName":  "Read Records Management configuration, labels and policies",
|                                               "Description":  "Allows the application to read any data from Records Management, such as configuration, labels, and policies without the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "eb158f57-df43-4751-8b21-b8932adb3d34",
|                                               "Value":  "RecordsManagement.ReadWrite.All",
|                                               "DisplayName":  "Read and write Records Management configuration, labels and policies",
|                                               "Description":  "Allow the application to create, update and delete any data from Records Management, such as configuration, labels, and policies without the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "230c1aed-a721-4c5d-9cb4-a90514e508ef",
|                                               "Value":  "Reports.Read.All",
|                                               "DisplayName":  "Read all usage reports",
|                                               "Description":  "Allows an app to read all service usage reports without a signed-in user.  Services that provide usage reports include Office 365 and Azure Active Directory."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ee353f83-55ef-4b78-82da-555bfa2b4b95",
|                                               "Value":  "ReportSettings.Read.All",
|                                               "DisplayName":  "Read all admin report settings",
|                                               "Description":  "Allows the app to read all admin report settings, such as whether to display concealed information in reports, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2a60023f-3219-47ad-baa4-40e17cd02a1d",
|                                               "Value":  "ReportSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write all admin report settings",
|                                               "Description":  "Allows the app to read and update all admin report settings, such as whether to display concealed information in reports, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2ff643d8-43e4-4a9b-88c1-86cb4a4b4c2f",
|                                               "Value":  "ResourceSpecificPermissionGrant.ReadForChat.All",
|                                               "DisplayName":  "Read resource specific permissions granted on a chat",
|                                               "Description":  "Allows the app to read the resource specific permissions granted on the chat without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ad4600ae-d900-42cb-a9a2-2415d05593d0",
|                                               "Value":  "ResourceSpecificPermissionGrant.ReadForTeam.All",
|                                               "DisplayName":  "Read resource specific permissions granted on a team",
|                                               "Description":  "Allows the app to read the resource specific permissions granted on the team without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "acfca4d5-f49f-40ed-9648-84068b474c73",
|                                               "Value":  "ResourceSpecificPermissionGrant.ReadForUser.All",
|                                               "DisplayName":  "Read all resource specific permissions granted on user accounts",
|                                               "Description":  "Allows the app to read all resource specific permissions granted on user accounts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2a6baefd-edea-4ff6-b24e-bebcaa27a50d",
|                                               "Value":  "RiskPreventionProviders.Read.All",
|                                               "DisplayName":  "Read all identity risk prevention providers",
|                                               "Description":  "Allows the app to read your organization\u0027s risk prevention providers, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7fc7225d-eb37-4c39-90f3-a33a57cf1081",
|                                               "Value":  "RiskPreventionProviders.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity risk prevention providers",
|                                               "Description":  "Allows the app to read and write your organization\u0027s risk prevention providers, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d5fe8ce8-684c-4c83-a52c-46e882ce4be1",
|                                               "Value":  "RoleAssignmentSchedule.Read.Directory",
|                                               "DisplayName":  "Read all active role assignments and role schedules for your company\u0027s directory",
|                                               "Description":  "Allows the app to read the active role-based access control (RBAC) assignments and schedules for your company\u0027s directory, without a signed-in user. This includes reading directory role templates, and directory roles."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dd199f4a-f148-40a4-a2ec-f0069cc799ec",
|                                               "Value":  "RoleAssignmentSchedule.ReadWrite.Directory",
|                                               "DisplayName":  "Read, update, and delete all policies for privileged role assignments of your company\u0027s directory",
|                                               "Description":  "Allows the app to read, update, and delete policies for privileged role-based access control (RBAC) assignments of your company\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d3495511-98b7-4df3-b317-4e35c19f6129",
|                                               "Value":  "RoleAssignmentSchedule.Remove.Directory",
|                                               "DisplayName":  "Delete all active role assignments of your company\u0027s directory",
|                                               "Description":  "Delete all active privileged role-based access control (RBAC) assignments of your company\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ff278e11-4a33-4d0c-83d2-d01dc58929a5",
|                                               "Value":  "RoleEligibilitySchedule.Read.Directory",
|                                               "DisplayName":  "Read all eligible role assignments and role schedules for your company\u0027s directory",
|                                               "Description":  "Allows the app to read the eligible role-based access control (RBAC) assignments and schedules for your company\u0027s directory, without a signed-in user. This includes reading directory role templates, and directory roles."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fee28b28-e1f3-4841-818e-2704dc62245f",
|                                               "Value":  "RoleEligibilitySchedule.ReadWrite.Directory",
|                                               "DisplayName":  "Read, update, and delete all eligible role assignments and schedules for your company\u0027s directory",
|                                               "Description":  "Allows the app to read and manage the eligible role-based access control (RBAC) assignments and schedules for your company\u0027s directory, without a signed-in user. This includes managing eligible directory role membership, and reading directory role templates, directory roles and eligible memberships."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "79c7e69c-0d9f-4eff-97a8-49170a5a08ba",
|                                               "Value":  "RoleEligibilitySchedule.Remove.Directory",
|                                               "DisplayName":  "Delete all eligible role assignments of your company\u0027s directory",
|                                               "Description":  "Delete all eligible privileged role-based access control (RBAC) assignments of your company\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c7fbd983-d9aa-4fa7-84b8-17382c103bc4",
|                                               "Value":  "RoleManagement.Read.All",
|                                               "DisplayName":  "Read role management data for all RBAC providers",
|                                               "Description":  "Allows the app to read role-based access control (RBAC) settings for all RBAC providers without a signed-in user. This includes reading role definitions and role assignments."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "031a549a-bb80-49b6-8032-2068448c6a3c",
|                                               "Value":  "RoleManagement.Read.CloudPC",
|                                               "DisplayName":  "Read Cloud PC RBAC settings",
|                                               "Description":  "Allows the app to read the Cloud PC role-based access control (RBAC) settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4d6e30d1-e64e-4ae7-bf9d-c706cc928cef",
|                                               "Value":  "RoleManagement.Read.Defender",
|                                               "DisplayName":  "Read M365 Defender RBAC configuration",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "483bed4a-2ad3-4361-a73b-c83ccdbdc53c",
|                                               "Value":  "RoleManagement.Read.Directory",
|                                               "DisplayName":  "Read all directory RBAC settings",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, without a signed-in user.  This includes reading directory role templates, directory roles and memberships."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c769435f-f061-4d0b-8ff1-3d39870e5f85",
|                                               "Value":  "RoleManagement.Read.Exchange",
|                                               "DisplayName":  "Read Exchange Online RBAC configuration",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) configuration for your organization\u0027s Exchange Online service, without a signed-in user. This includes reading Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "274d0592-d1b6-44bd-af1d-26d259bcb43a",
|                                               "Value":  "RoleManagement.ReadWrite.CloudPC",
|                                               "DisplayName":  "Read and write all Cloud PC RBAC settings",
|                                               "Description":  "Allows the app to read and manage the Cloud PC role-based access control (RBAC) settings, without a signed-in user. This includes reading and managing Cloud PC role definitions and memberships."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8b7e8c0a-7e9d-4049-97ec-04b5e1bcaf05",
|                                               "Value":  "RoleManagement.ReadWrite.Defender",
|                                               "DisplayName":  "Read M365 Defender RBAC configuration",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8",
|                                               "Value":  "RoleManagement.ReadWrite.Directory",
|                                               "DisplayName":  "Read and write all directory RBAC settings",
|                                               "Description":  "Allows the app to read and manage the role-based access control (RBAC) settings for your company\u0027s directory, without a signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "025d3225-3f02-4882-b4c0-cd5b541a4e80",
|                                               "Value":  "RoleManagement.ReadWrite.Exchange",
|                                               "DisplayName":  "Read and write Exchange Online RBAC configuration",
|                                               "Description":  "Allows the app to read and manage the role-based access control (RBAC) settings for your organization\u0027s Exchange Online service, without a signed-in user. This includes reading, creating, updating, and deleting Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ef31918f-2d50-4755-8943-b8638c0a077e",
|                                               "Value":  "RoleManagementAlert.Read.Directory",
|                                               "DisplayName":  "Read all alert data for your company\u0027s directory",
|                                               "Description":  "Allows the app to read all role-based access control (RBAC) alerts for your company\u0027s directory, without a signed-in user. This includes reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "11059518-d6a6-4851-98ed-509268489c4a",
|                                               "Value":  "RoleManagementAlert.ReadWrite.Directory",
|                                               "DisplayName":  "Read all alert data, configure alerts, and take actions on all alerts for your company\u0027s directory",
|                                               "Description":  "Allows the app to read and manage all role-based access control (RBAC) alerts for your company\u0027s directory, without a signed-in user. This includes managing alert settings, initiating alert scans, dismissing alerts, remediating alert incidents, and reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "69e67828-780e-47fd-b28c-7b27d14864e6",
|                                               "Value":  "RoleManagementPolicy.Read.AzureADGroup",
|                                               "DisplayName":  "Read all policies in PIM for Groups",
|                                               "Description":  "Allows the app to read policies in Privileged Identity Management for Groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fdc4c997-9942-4479-bfcb-75a36d1138df",
|                                               "Value":  "RoleManagementPolicy.Read.Directory",
|                                               "DisplayName":  "Read all policies for privileged role assignments of your company\u0027s directory",
|                                               "Description":  "Allows the app to read policies for privileged role-based access control (RBAC) assignments of your company\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3d201a4e-90f1-420d-bd4f-3beec28a46b9",
|                                               "Value":  "RoleManagementPolicy.Read.EntraAppRole",
|                                               "DisplayName":  "Read all policies in PIM for App Roles",
|                                               "Description":  "Allows the app to read policies in Privileged Identity Management for App Roles, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b38dcc4d-a239-4ed6-aa84-6c65b284f97c",
|                                               "Value":  "RoleManagementPolicy.ReadWrite.AzureADGroup",
|                                               "DisplayName":  "Read, update, and delete all policies in PIM for Groups",
|                                               "Description":  "Allows the app to read, update, and delete policies in Privileged Identity Management for Groups, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "31e08e0a-d3f7-4ca2-ac39-7343fb83e8ad",
|                                               "Value":  "RoleManagementPolicy.ReadWrite.Directory",
|                                               "DisplayName":  "Read, update, and delete all policies for privileged role assignments of your company\u0027s directory",
|                                               "Description":  "Allows the app to read, update, and delete policies for privileged role-based access control (RBAC) assignments of your company\u0027s directory, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ec563bdb-80dc-47c0-81d3-bff47cc6ac06",
|                                               "Value":  "RoleManagementPolicy.ReadWrite.EntraAppRole",
|                                               "DisplayName":  "Manage all policies in PIM for App Roles",
|                                               "Description":  "Allows the app to manage policies in Privileged Identity Management for App Roles, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0b21c159-dbf4-4dbb-a6f6-490e412c716e",
|                                               "Value":  "Schedule-WorkingTime.ReadWrite.All",
|                                               "DisplayName":  "Trigger working time policies and read the working time status",
|                                               "Description":  "Allows the app to trigger the working time policies and read the working time status for other users in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7b2ebf90-d836-437f-b90d-7b62722c4456",
|                                               "Value":  "Schedule.Read.All",
|                                               "DisplayName":  "Read all schedule items",
|                                               "Description":  "Allows the app to read all schedules, schedule groups, shifts and associated entities in the Teams or Shifts application without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b7760610-0545-4e8a-9ec3-cce9e63db01c",
|                                               "Value":  "Schedule.ReadWrite.All",
|                                               "DisplayName":  "Read and write all schedule items",
|                                               "Description":  "Allows the app to manage all schedules, schedule groups, shifts and associated entities in the Teams or Shifts application without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7239b71d-b402-4150-b13d-78ecfe8df441",
|                                               "Value":  "SchedulePermissions.ReadWrite.All",
|                                               "DisplayName":  "Read/Write schedule permissions for a role",
|                                               "Description":  "Allows the app to read/write schedule permissions for a specific role in Shifts application without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ada977a5-b8b1-493b-9a91-66c206d76ecf",
|                                               "Value":  "SearchConfiguration.Read.All",
|                                               "DisplayName":  "Read your organization\u0027s search configuration",
|                                               "Description":  "Allows the app to read search configurations, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0e778b85-fefa-466d-9eec-750569d92122",
|                                               "Value":  "SearchConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write your organization\u0027s search configuration",
|                                               "Description":  "Allows the app to read and write search configurations, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5e0edab9-c148-49d0-b423-ac253e121825",
|                                               "Value":  "SecurityActions.Read.All",
|                                               "DisplayName":  "Read your organization\u0027s security actions",
|                                               "Description":  "Allows the app to read security actions, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f2bf083f-0179-402a-bedb-b2784de8a49b",
|                                               "Value":  "SecurityActions.ReadWrite.All",
|                                               "DisplayName":  "Read and update your organization\u0027s security actions",
|                                               "Description":  "Allows the app to read or update security actions, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "472e4a4d-bb4a-4026-98d1-0b0d74cb74a5",
|                                               "Value":  "SecurityAlert.Read.All",
|                                               "DisplayName":  "Read all security alerts",
|                                               "Description":  "Allows the app to read all security alerts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ed4fca05-be46-441f-9803-1873825f8fdb",
|                                               "Value":  "SecurityAlert.ReadWrite.All",
|                                               "DisplayName":  "Read and write to all security alerts",
|                                               "Description":  "Allows the app to read and write to all security alerts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b48f7ac2-044d-4281-b02f-75db744d6f5f",
|                                               "Value":  "SecurityAnalyzedMessage.Read.All",
|                                               "DisplayName":  "Read metadata and detection details for all emails in your organization",
|                                               "Description":  "Read email metadata and security detection details, without a signed-in user.  "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "04c55753-2244-4c25-87fc-704ab82a4f69",
|                                               "Value":  "SecurityAnalyzedMessage.ReadWrite.All",
|                                               "DisplayName":  "Read metadata, detection details, and execute remediation actions on all emails in your organization",
|                                               "Description":  "Read email metadata and security detection details, and execute remediation actions like deleting an email, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bf394140-e372-4bf9-a898-299cfc7564e5",
|                                               "Value":  "SecurityEvents.Read.All",
|                                               "DisplayName":  "Read your organization’s security events",
|                                               "Description":  "Allows the app to read your organization’s security events without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d903a879-88e0-4c09-b0c9-82f6a1333f84",
|                                               "Value":  "SecurityEvents.ReadWrite.All",
|                                               "DisplayName":  "Read and update your organization’s security events",
|                                               "Description":  "Allows the app to read your organization’s security events without a signed-in user. Also allows the app to update editable properties in security events."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c5bc96f5-b4a1-4cfc-8189-d5f0d772278f",
|                                               "Value":  "SecurityIdentitiesAccount.Read.All",
|                                               "DisplayName":  "Read all identity security available identity accounts",
|                                               "Description":  "Allows the app to read all the identity security available identity accounts without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "af2bf46f-7bf1-4be3-8bad-e17e279e8462",
|                                               "Value":  "SecurityIdentitiesActions.ReadWrite.All",
|                                               "DisplayName":  "Read and perform all identity security available actions",
|                                               "Description":  "Allows the app to read and write identity security available actions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "58971758-9844-4fe4-9fba-7e4ce7a659bf",
|                                               "Value":  "SecurityIdentitiesAutoConfig.Read.All",
|                                               "DisplayName":  "Read sensors window auditing configuration",
|                                               "Description":  "Allows the app to read sensors window auditing configuration without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4f1f0deb-08d1-4ffb-8cca-21dfc362b7c0",
|                                               "Value":  "SecurityIdentitiesAutoConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write sensors window auditing configuration",
|                                               "Description":  "Allows the app to read and write sensors window auditing configuration without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f8dcd971-5d83-4e1e-aa95-ef44611ad351",
|                                               "Value":  "SecurityIdentitiesHealth.Read.All",
|                                               "DisplayName":  "Read all identity security health issues",
|                                               "Description":  "Allows the app to read all the identity security health issues without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ab03ddd5-7ae4-4f2e-8af8-86654f7e0a27",
|                                               "Value":  "SecurityIdentitiesHealth.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity security health issues",
|                                               "Description":  "Allows the app to read and write identity security health issues without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b018cc1c-c680-4e91-bb6e-462ee243fdb5",
|                                               "Value":  "SecurityIdentitiesMigration.Read.All",
|                                               "DisplayName":  "Read all identity security sensor migration",
|                                               "Description":  "Allows the app to read all the identity security sensor migration information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "afd28a5a-707f-4edf-85c2-c446291e63da",
|                                               "Value":  "SecurityIdentitiesMigration.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity security sensor migration",
|                                               "Description":  "Allows the app to read and write identity security sensor migration without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5f0ffea2-f474-4cf2-9834-61cda2bcea5c",
|                                               "Value":  "SecurityIdentitiesSensors.Read.All",
|                                               "DisplayName":  "Read all identity security sensors",
|                                               "Description":  "Allows the app to read all the identity security sensors without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d4dcee6d-0774-412a-b06c-aeabbd99e816",
|                                               "Value":  "SecurityIdentitiesSensors.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity security sensors",
|                                               "Description":  "Allows the app to read and write identity security sensors without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3e5d0bee-973f-4736-a123-4e1ab146f3a8",
|                                               "Value":  "SecurityIdentitiesUserActions.Read.All",
|                                               "DisplayName":  "Read all identity security available user actions",
|                                               "Description":  "Allows the app to read all the identity security available user actions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b4146a3a-dd4f-4af4-8d91-7cc0eef3d041",
|                                               "Value":  "SecurityIdentitiesUserActions.ReadWrite.All",
|                                               "DisplayName":  "Read and perform all identity security available user actions",
|                                               "Description":  "Allows the app to read and write identity security available user actions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "45cc0394-e837-488b-a098-1918f48d186c",
|                                               "Value":  "SecurityIncident.Read.All",
|                                               "DisplayName":  "Read all security incidents",
|                                               "Description":  "Allows the app to read all security incidents, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "34bf0e97-1971-4929-b999-9e2442d941d7",
|                                               "Value":  "SecurityIncident.ReadWrite.All",
|                                               "DisplayName":  "Read and write to all security incidents",
|                                               "Description":  "Allows the app to read and write to all security incidents, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "57f0b71b-a759-45a0-9a0f-cc099fbd9a44",
|                                               "Value":  "SensitivityLabel.Evaluate",
|                                               "DisplayName":  "Evaluate sensitivity labels",
|                                               "Description":  "Allow the app to determine if there is any sensitivity label to be applied automatically to the content or recommended to the user for manual application, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "986fa56a-6680-4aac-af09-4d1765376739",
|                                               "Value":  "SensitivityLabel.Evaluate.All",
|                                               "DisplayName":  "Evaluate labels tenant scope.",
|                                               "Description":  "Allows the app to evaluate all sensitivity label."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3b8e7aad-f6e3-4299-83f8-6fc6a5777f0b",
|                                               "Value":  "SensitivityLabel.Read",
|                                               "DisplayName":  "Get labels application scope.",
|                                               "Description":  "Allows the app to get sensitivity labels."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e46a01e9-b2cf-4d89-8424-bcdc6dd445ab",
|                                               "Value":  "SensitivityLabels.Read.All",
|                                               "DisplayName":  "Get labels tenant scope.",
|                                               "Description":  "Allows the app to get sensitivity labels."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "84fa35c1-f997-4c1c-894c-bb52108cfbbf",
|                                               "Value":  "SentimentSurvey.Export.All",
|                                               "DisplayName":  "Export all Sentiment Survey",
|                                               "Description":  "Allows the app to read all Sentiment Survey, without a signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2b655018-450a-4845-81e7-d603b1ebffdb",
|                                               "Value":  "ServiceActivity-Exchange.Read.All",
|                                               "DisplayName":  "Read all Exchange service activity",
|                                               "Description":  "Allows the app to read all Exchange service activity, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c766cb16-acc4-4663-ba09-6eedef5876c5",
|                                               "Value":  "ServiceActivity-Microsoft365Web.Read.All",
|                                               "DisplayName":  "Read all Microsoft 365 Web service activity",
|                                               "Description":  "Allows the app to read all Microsoft 365 Web service activity, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "57b4f899-b8c5-47c7-bdd3-c410c55602b7",
|                                               "Value":  "ServiceActivity-OneDrive.Read.All",
|                                               "DisplayName":  "Read all One Drive service activity",
|                                               "Description":  "Allows the app to read all One Drive service activity, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4dfee10b-fa4a-41b5-b34d-ccf54cc0c394",
|                                               "Value":  "ServiceActivity-Teams.Read.All",
|                                               "DisplayName":  "Read all Teams service activity",
|                                               "Description":  "Allows the app to read all Teams service activity, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "79c261e0-fe76-4144-aad5-bdc68fbe4037",
|                                               "Value":  "ServiceHealth.Read.All",
|                                               "DisplayName":  "Read service health",
|                                               "Description":  "Allows the app to read your tenant\u0027s service health information, without a signed-in user. Health information may include service issues or service health overviews."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1b620472-6534-4fe6-9df2-4680e8aa28ec",
|                                               "Value":  "ServiceMessage.Read.All",
|                                               "DisplayName":  "Read service messages",
|                                               "Description":  "Allows the app to read your tenant\u0027s service announcement messages, without a signed-in user. Messages may include information about new or changed features."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5256681e-b7f6-40c0-8447-2d9db68797a0",
|                                               "Value":  "ServicePrincipalEndpoint.Read.All",
|                                               "DisplayName":  "Read service principal endpoints",
|                                               "Description":  "Allows the app to read service principal endpoints"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "89c8469c-83ad-45f7-8ff2-6e3d4285709e",
|                                               "Value":  "ServicePrincipalEndpoint.ReadWrite.All",
|                                               "DisplayName":  "Read and update service principal endpoints",
|                                               "Description":  "Allows the app to update service principal endpoints"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a0521574-fcd8-4742-b29c-f796df57ea70",
|                                               "Value":  "SharePointCrossTenantMigration.Manage.All",
|                                               "DisplayName":  "Read, write and manage SharePoint Cross-Tenant migration settings and tasks",
|                                               "Description":  "Allows the app to read, write and manage your tenant\u0027s SharePoint Cross-Tenant migration settings and tasks, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f5fa52a5-b9ab-4dc3-885e-9e5b4a67068e",
|                                               "Value":  "SharePointCrossTenantMigration.Read.All",
|                                               "DisplayName":  "Read SharePoint Cross-Tenant migration settings and tasks",
|                                               "Description":  "Allows the app to read your tenant\u0027s SharePoint Cross-Tenant migration settings and tasks, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "83d4163d-a2d8-4d3b-9695-4ae3ca98f888",
|                                               "Value":  "SharePointTenantSettings.Read.All",
|                                               "DisplayName":  "Read SharePoint and OneDrive tenant settings",
|                                               "Description":  "Allows the application to read the tenant-level settings of SharePoint and OneDrive, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "19b94e34-907c-4f43-bde9-38b1909ed408",
|                                               "Value":  "SharePointTenantSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and change SharePoint and OneDrive tenant settings",
|                                               "Description":  "Allows the application to read and change the tenant-level settings of SharePoint and OneDrive, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0c7d31ec-31ca-4f58-b6ec-9950b6b0de69",
|                                               "Value":  "ShortNotes.Read.All",
|                                               "DisplayName":  "Read all users\u0027 short notes",
|                                               "Description":  "Allows the app to read all the short notes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "842c284c-763d-4a97-838d-79787d129bab",
|                                               "Value":  "ShortNotes.ReadWrite.All",
|                                               "DisplayName":  "Read, create, edit, and delete all users\u0027 short notes",
|                                               "Description":  "Allows the app to read, create, edit, and delete all the short notes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "28e1fe78-598f-4df4-b55e-18bf34218925",
|                                               "Value":  "SignInIdentifier.Read.All",
|                                               "DisplayName":  "Read all sign-in identifiers",
|                                               "Description":  "Allows the app to read your organization\u0027s sign-in identifiers, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7fc588a2-ea2d-4d1f-bcf7-33c324b149b8",
|                                               "Value":  "SignInIdentifier.ReadWrite.All",
|                                               "DisplayName":  "Read and write all sign-in identifiers",
|                                               "Description":  "Allows the app to read and write your organization\u0027s sign-in identifiers, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e3530185-4080-478c-a4ab-39322704df58",
|                                               "Value":  "Sites.Archive.All",
|                                               "DisplayName":  "Archive/reactivate Site Collections without a signed in user.",
|                                               "Description":  "Allow the application to archive/reactivate site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "80819dd8-2b3b-4551-a1ad-2700fc44f533",
|                                               "Value":  "Sites.Create.All",
|                                               "DisplayName":  "Create Site Collections without a signed in user.",
|                                               "Description":  "Allow the application to create site collections without a signed in user. Upon creation the application will be granted Sites.Selected(application) + FullControl to the newly created site."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a82116e5-55eb-4c41-a434-62fe8a61c773",
|                                               "Value":  "Sites.FullControl.All",
|                                               "DisplayName":  "Have full control of all site collections",
|                                               "Description":  "Allows the app to have full control of all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0c0bf378-bf22-4481-8f81-9e89a9b4960a",
|                                               "Value":  "Sites.Manage.All",
|                                               "DisplayName":  "Create, edit, and delete items and lists in all site collections",
|                                               "Description":  "Allows the app to create or delete document libraries and lists in all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "332a536c-c7ef-4017-ab91-336970924f0d",
|                                               "Value":  "Sites.Read.All",
|                                               "DisplayName":  "Read items in all site collections ",
|                                               "Description":  "Allows the app to read documents and list items in all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9492366f-7969-46a4-8d15-ed1a20078fff",
|                                               "Value":  "Sites.ReadWrite.All",
|                                               "DisplayName":  "Read and write items in all site collections",
|                                               "Description":  "Allows the app to create, read, update, and delete documents and list items in all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "883ea226-0bf2-4a8f-9f9d-92c9162a727d",
|                                               "Value":  "Sites.Selected",
|                                               "DisplayName":  "Access selected site collections",
|                                               "Description":  "Allow the application to access a subset of site collections without a signed in user.  The specific site collections and the permissions granted will be configured in SharePoint Online."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dcdfc277-41fd-4d68-ad0c-c3057235bd8e",
|                                               "Value":  "SpiffeTrustDomain.Read.All",
|                                               "DisplayName":  "Read SPIFFE trust domains and child resources",
|                                               "Description":  "Allows the app to read your organization\u0027s SPIFFE trust domains and child resources without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "17b78cfd-eeff-447d-8bab-2795af00055a",
|                                               "Value":  "SpiffeTrustDomain.ReadWrite.All",
|                                               "DisplayName":  "Read and write SPIFFE trust domains and child resources",
|                                               "Description":  "Allows the app to read and write your organization\u0027s SPIFFE trust domains and child resources without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6eff534b-699e-44d9-af61-a4182f0ec37e",
|                                               "Value":  "Storyline.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Viva Engage storylines",
|                                               "Description":  "Allows the app to modify Viva Engage storylines, read all storylines properties, update storyline properties, and delete storyline properties without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ee1460f0-368b-4153-870a-4e1ca7e72c42",
|                                               "Value":  "SubjectRightsRequest.Read.All",
|                                               "DisplayName":  "Read all subject rights requests",
|                                               "Description":  "Allows the app to read subject rights requests without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8387eaa4-1a3c-41f5-b261-f888138e6041",
|                                               "Value":  "SubjectRightsRequest.ReadWrite.All",
|                                               "DisplayName":  "Read and write all subject rights requests",
|                                               "Description":  "Allows the app to read and write subject rights requests without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5ba43d2f-fa88-4db2-bd1c-a67c5f0fb1ce",
|                                               "Value":  "Synchronization.Read.All",
|                                               "DisplayName":  "Read all Azure AD synchronization data.",
|                                               "Description":  "Allows the application to read Azure AD synchronization information, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9b50c33d-700f-43b1-b2eb-87e89b703581",
|                                               "Value":  "Synchronization.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Azure AD synchronization data.",
|                                               "Description":  "Allows the application to configure the Azure AD synchronization service, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "db31e92a-b9ea-4d87-bf6a-75a37a9ca35a",
|                                               "Value":  "SynchronizationData-User.Upload",
|                                               "DisplayName":  "Upload user data to the identity synchronization service",
|                                               "Description":  "Allows the application to upload bulk user data to the identity synchronization service, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "25c32ff3-849a-494b-b94f-20a8ac4e6774",
|                                               "Value":  "SynchronizationData-User.Upload.OwnedBy",
|                                               "DisplayName":  "Upload user data to the identity sync service for apps that this application creates or owns",
|                                               "Description":  "Allows the application to upload bulk user data to the identity synchronization service for apps that this application creates or owns, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f10e1f91-74ed-437f-a6fd-d6ae88e26c1f",
|                                               "Value":  "Tasks.Read.All",
|                                               "DisplayName":  "Read all users’ tasks and tasklist",
|                                               "Description":  "Allows the app to read all users’ tasks and task lists in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "44e666d1-d276-445b-a5fc-8815eeb81d55",
|                                               "Value":  "Tasks.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users’ tasks and tasklists",
|                                               "Description":  "Allows the app to create, read, update and delete all users’ tasks and task lists in your organization, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "23fc2474-f741-46ce-8465-674744c5c361",
|                                               "Value":  "Team.Create",
|                                               "DisplayName":  "Create teams",
|                                               "Description":  "Allows the app to create teams without a signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2280dda6-0bfd-44ee-a2f4-cb867cfc4c1e",
|                                               "Value":  "Team.ReadBasic.All",
|                                               "DisplayName":  "Get a list of all teams",
|                                               "Description":  "Get a list of all teams, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "660b7406-55f1-41ca-a0ed-0b035e182f3e",
|                                               "Value":  "TeamMember.Read.All",
|                                               "DisplayName":  "Read the members of all teams",
|                                               "Description":  "Read the members of all teams, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0121dc95-1b9f-4aed-8bac-58c5ac466691",
|                                               "Value":  "TeamMember.ReadWrite.All",
|                                               "DisplayName":  "Add and remove members from all teams",
|                                               "Description":  "Add and remove members from all teams, without a signed-in user. Also allows changing a team member\u0027s role, for example from owner to non-owner."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4437522e-9a86-4a41-a7da-e380edd4a97d",
|                                               "Value":  "TeamMember.ReadWriteNonOwnerRole.All",
|                                               "DisplayName":  "Add and remove members with non-owner role for all teams",
|                                               "Description":  "Add and remove members from all teams, without a signed-in user. Does not allow adding or removing a member with the owner role. Additionally, does not allow the app to elevate an existing member to the owner role."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "70dec828-f620-4914-aa83-a29117306807",
|                                               "Value":  "TeamsActivity.Read.All",
|                                               "DisplayName":  "Read all users\u0027 teamwork activity feed",
|                                               "Description":  "Allows the app to read all users\u0027 teamwork activity feed, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a267235f-af13-44dc-8385-c1dc93023186",
|                                               "Value":  "TeamsActivity.Send",
|                                               "DisplayName":  "Send a teamwork activity to any user",
|                                               "Description":  "Allows the app to create new notifications in users\u0027 teamwork activity feeds without a signed in user. These notifications may not be discoverable or be held or governed by compliance policies."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "22b74aab-d9e4-46f7-9424-f24b42307227",
|                                               "Value":  "TeamsAppInstallation.ManageSelectedForChat.All",
|                                               "DisplayName":  "Manage installation and permission grants of selected Teams apps in all chats",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any chat, without a signed-in user. Gives the ability to manage permission grants for accessing those specific chats\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b448d252-1f26-4227-b6ff-21ab510975a2",
|                                               "Value":  "TeamsAppInstallation.ManageSelectedForTeam.All",
|                                               "DisplayName":  "Manage installation and permission grants of selected Teams apps in all teams",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any team, without a signed-in user. Gives the ability to manage permission grants for accessing those specific teams\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e97a9235-5b3c-43c4-b37d-6786a173fae4",
|                                               "Value":  "TeamsAppInstallation.ManageSelectedForUser.All",
|                                               "DisplayName":  "Manage installation and permission grants of selected Teams apps for all user accounts",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any user account, without a signed-in user. Gives the ability to manage permission grants for accessing those specific users\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0fdf35a5-82f8-41ff-9ded-0b761cc73512",
|                                               "Value":  "TeamsAppInstallation.Read.All",
|                                               "DisplayName":  "Read installed Teams apps for all installation scopes",
|                                               "Description":  "Allows the app to read the Teams apps that are installed in any scope, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cc7e7635-2586-41d6-adaa-a8d3bcad5ee5",
|                                               "Value":  "TeamsAppInstallation.ReadForChat.All",
|                                               "DisplayName":  "Read installed Teams apps for all chats",
|                                               "Description":  "Allows the app to read the Teams apps that are installed in any chat, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1f615aea-6bf9-4b05-84bd-46388e138537",
|                                               "Value":  "TeamsAppInstallation.ReadForTeam.All",
|                                               "DisplayName":  "Read installed Teams apps for all teams",
|                                               "Description":  "Allows the app to read the Teams apps that are installed in any team, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9ce09611-f4f7-4abd-a629-a05450422a97",
|                                               "Value":  "TeamsAppInstallation.ReadForUser.All",
|                                               "DisplayName":  "Read installed Teams apps for all users",
|                                               "Description":  "Allows the app to read the Teams apps that are installed for any user, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "53d40ddb-9b27-4c97-b800-985be6041990",
|                                               "Value":  "TeamsAppInstallation.ReadSelectedForChat.All",
|                                               "DisplayName":  "Read selected installed Teams apps in all chats",
|                                               "Description":  "Allows the app to read the selected Teams apps that are installed in any chat, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "93c6a289-70fd-489e-a053-6cf8f7d772f6",
|                                               "Value":  "TeamsAppInstallation.ReadSelectedForTeam.All",
|                                               "DisplayName":  "Read selected installed Teams apps in all teams",
|                                               "Description":  "Allows the app to read the selected Teams apps that are installed in any team, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "44fb0e7c-1f9a-47f1-bb9e-7f92d48ed288",
|                                               "Value":  "TeamsAppInstallation.ReadSelectedForUser.All",
|                                               "DisplayName":  "Read selected installed Teams apps for all users",
|                                               "Description":  "Allows an app to read, install, upgrade, and uninstall selected apps to any user, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6e74eff9-4a21-45d6-bc03-3a20f61f8281",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentForChat.All",
|                                               "DisplayName":  "Manage installation and permission grants of Teams apps for all chats",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any chat, without a signed-in user. Gives the ability to manage permission grants for accessing those specific chats\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b0c13be0-8e20-4bc5-8c55-963c23a39ce9",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentForTeam.All",
|                                               "DisplayName":  "Manage installation and permission grants of Teams apps for all teams",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any team, without a signed-in user. Gives the ability to manage permission grants for accessing those specific teams\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "32ca478f-f89e-41d0-aaf8-101deb7da510",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentForUser.All",
|                                               "DisplayName":  "Manage installation and permission grants of Teams apps in a user account",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any user account, without a signed-in user. Gives the ability to manage permission grants for accessing those specific users\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ba1ba90b-2d8f-487e-9f16-80728d85bb5c",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForChat.All",
|                                               "DisplayName":  "Allow the Teams app to manage itself and its permission grants for all chats",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for any chat, without a signed-in user, and manage its permission grants for accessing those specific chats\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1e4be56c-312e-42b8-a2c9-009600d732c0",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForTeam.All",
|                                               "DisplayName":  "Allow the Teams app to manage itself and its permission grants for all teams",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for any team, without a signed-in user, and manage its permission grants for accessing those specific teams\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a87076cf-6abd-4e56-8559-4dbdf41bef96",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForUser.All",
|                                               "DisplayName":  "Allow the Teams app to manage itself and its permission grants in all user accounts",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for any user account, without a signed-in user, and manage its permission grants for accessing those specific users\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9e19bae1-2623-4c4f-ab6e-2664615ff9a0",
|                                               "Value":  "TeamsAppInstallation.ReadWriteForChat.All",
|                                               "DisplayName":  "Manage Teams apps for all chats",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any chat, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5dad17ba-f6cc-4954-a5a2-a0dcc95154f0",
|                                               "Value":  "TeamsAppInstallation.ReadWriteForTeam.All",
|                                               "DisplayName":  "Manage Teams apps for all teams",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in any team, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "74ef0291-ca83-4d02-8c7e-d2391e6a444f",
|                                               "Value":  "TeamsAppInstallation.ReadWriteForUser.All",
|                                               "DisplayName":  "Manage Teams apps for all users",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps for any user, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "25bbeaad-04be-4207-83ed-a263aae76ddf",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelectedForChat.All",
|                                               "DisplayName":  "Manage selected installed Teams apps in all chats",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any chat, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7b5823ae-d0f2-424d-b90c-d843ffada7d9",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelectedForTeam.All",
|                                               "DisplayName":  "Manage selected installed Teams apps in all teams",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in any team, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "650a76ec-4118-4b25-9d3a-1f98048a5ee0",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelectedForUser.All",
|                                               "DisplayName":  "Manage selected Teams apps installed for all users",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps for any user, without a signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "73a45059-f39c-4baf-9182-4954ac0e55cf",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelfForChat.All",
|                                               "DisplayName":  "Allow the Teams app to manage itself for all chats",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for any chat, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9f67436c-5415-4e7f-8ac1-3014a7132630",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelfForTeam.All",
|                                               "DisplayName":  "Allow the Teams app to manage itself for all teams",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in any team, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "908de74d-f8b2-4d6b-a9ed-2a17b3b78179",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelfForUser.All",
|                                               "DisplayName":  "Allow the app to manage itself for all users",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself to any user, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "242607bd-1d2c-432c-82eb-bdb27baa23ab",
|                                               "Value":  "TeamSettings.Read.All",
|                                               "DisplayName":  "Read all teams\u0027 settings",
|                                               "Description":  "Read all team\u0027s settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bdd80a03-d9bc-451d-b7c4-ce7c63fe3c8f",
|                                               "Value":  "TeamSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and change all teams\u0027 settings",
|                                               "Description":  "Read and change all teams\u0027 settings, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1801e8f4-cf09-4c4e-a1b5-036dfcca6c90",
|                                               "Value":  "TeamsPolicyUserAssign.ReadWrite.All",
|                                               "DisplayName":  "Read and Write Teams policy user assignment and unassigment for all policy types.",
|                                               "Description":  "Allow the app to read or write/update the policy assignment and unassigment for Teams users for all policy type categories."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b55aa226-33a1-4396-bcf4-edce5e7a31c1",
|                                               "Value":  "TeamsResourceAccount.Read.All",
|                                               "DisplayName":  "Read Teams resource accounts",
|                                               "Description":  "Allows the app to read your tenant\u0027s resource accounts without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "49981c42-fd7b-4530-be03-e77b21aed25e",
|                                               "Value":  "TeamsTab.Create",
|                                               "DisplayName":  "Create tabs in Microsoft Teams.",
|                                               "Description":  "Allows the app to create tabs in any team in Microsoft Teams, without a signed-in user. This does not grant the ability to read, modify or delete tabs after they are created, or give access to the content inside the tabs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "46890524-499a-4bb2-ad64-1476b4f3e1cf",
|                                               "Value":  "TeamsTab.Read.All",
|                                               "DisplayName":  "Read tabs in Microsoft Teams.",
|                                               "Description":  "Read the names and settings of tabs inside any team in Microsoft Teams, without a signed-in user. This does not give access to the content inside the tabs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a96d855f-016b-47d7-b51c-1218a98d791c",
|                                               "Value":  "TeamsTab.ReadWrite.All",
|                                               "DisplayName":  "Read and write tabs in Microsoft Teams.",
|                                               "Description":  "Read and write tabs in any team in Microsoft Teams, without a signed-in user. This does not give access to the content inside the tabs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fd9ce730-a250-40dc-bd44-8dc8d20f39ea",
|                                               "Value":  "TeamsTab.ReadWriteForChat.All",
|                                               "DisplayName":  "Allow the Teams app to manage all tabs for all chats",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs for any chat, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6163d4f4-fbf8-43da-a7b4-060fe85ed148",
|                                               "Value":  "TeamsTab.ReadWriteForTeam.All",
|                                               "DisplayName":  "Allow the Teams app to manage all tabs for all teams",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs in any team, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "425b4b59-d5af-45c8-832f-bb0b7402348a",
|                                               "Value":  "TeamsTab.ReadWriteForUser.All",
|                                               "DisplayName":  "Allow the app to manage all tabs for all users",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs for any user, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9f62e4a2-a2d6-4350-b28b-d244728c4f86",
|                                               "Value":  "TeamsTab.ReadWriteSelfForChat.All",
|                                               "DisplayName":  "Allow the Teams app to manage only its own tabs for all chats",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for any chat, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "91c32b81-0ef0-453f-a5c7-4ce2e562f449",
|                                               "Value":  "TeamsTab.ReadWriteSelfForTeam.All",
|                                               "DisplayName":  "Allow the Teams app to manage only its own tabs for all teams",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs in any team, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3c42dec6-49e8-4a0a-b469-36cff0d9da93",
|                                               "Value":  "TeamsTab.ReadWriteSelfForUser.All",
|                                               "DisplayName":  "Allow the Teams app to manage only its own tabs for all users",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for any user, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "39b17d18-680c-41f4-b9c2-5f30629e7cb6",
|                                               "Value":  "TeamsTelephoneNumber.Read.All",
|                                               "DisplayName":  "Read Tenant-Acquired Telephone Number Details",
|                                               "Description":  "Allows the app to read your tenant\u0027s acquired telephone number details, without a signed-in user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0a42382f-155c-4eb1-9bdc-21548ccaa387",
|                                               "Value":  "TeamsTelephoneNumber.ReadWrite.All",
|                                               "DisplayName":  "Read and Modify Tenant-Acquired Telephone Number Details",
|                                               "Description":  "Allows the app to read your tenant\u0027s acquired telephone number details, without a signed-in user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a91eadaf-2c3c-4362-908b-fb172d208fc6",
|                                               "Value":  "TeamsUserConfiguration.Read.All",
|                                               "DisplayName":  "Read Teams user configurations",
|                                               "Description":  "Allows the app to read your tenant\u0027s user configurations, without a signed-in user. User configuration may include attributes related to user, such as telephone number, assigned policies, etc."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6323133e-1f6e-46d4-9372-ac33a0870636",
|                                               "Value":  "TeamTemplates.Read.All",
|                                               "DisplayName":  "Read all available Teams Templates",
|                                               "Description":  "Allows the app to read all available Teams Templates, without a signed-user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dfb0dd15-61de-45b2-be36-d6a69fba3c79",
|                                               "Value":  "Teamwork.Migrate.All",
|                                               "DisplayName":  "Create chat and channel messages with anyone\u0027s identity and with any timestamp",
|                                               "Description":  "Allows the app to create chat and channel messages, without a signed in user. The app specifies which user appears as the sender, and can backdate the message to appear as if it was sent long ago. The messages can be sent to any chat or channel in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "75bcfbce-a647-4fba-ad51-b63d73b210f4",
|                                               "Value":  "Teamwork.Read.All",
|                                               "DisplayName":  "Read organizational teamwork settings",
|                                               "Description":  "Allows the app to read all teamwork settings of the organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "475ebe88-f071-4bd7-af2b-642952bd4986",
|                                               "Value":  "TeamworkAppSettings.Read.All",
|                                               "DisplayName":  "Read Teams app settings",
|                                               "Description":  "Allows the app to read the Teams app settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ab5b445e-8f10-45f4-9c79-dd3f8062cc4e",
|                                               "Value":  "TeamworkAppSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write Teams app settings",
|                                               "Description":  "Allows the app to read and write the Teams app settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0591bafd-7c1c-4c30-a2a5-2b9aacb1dfe8",
|                                               "Value":  "TeamworkDevice.Read.All",
|                                               "DisplayName":  "Read Teams devices",
|                                               "Description":  "Allow the app to read the management data for Teams devices, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "79c02f5b-bd4f-4713-bc2c-a8a4a66e127b",
|                                               "Value":  "TeamworkDevice.ReadWrite.All",
|                                               "DisplayName":  "Read and write Teams devices",
|                                               "Description":  "Allow the app to read and write the management data for Teams devices, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e9e1b87a-726e-4628-8fab-d1fc58d4d9ad",
|                                               "Value":  "TeamworkSection.Read.All",
|                                               "DisplayName":  "Read all users\u0027 sections",
|                                               "Description":  "Allows the app to read all users\u0027 sections (folders) for organizing chats and channels in Teams, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fd99f9da-42d6-4d00-8a41-4161bea42309",
|                                               "Value":  "TeamworkSection.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 sections",
|                                               "Description":  "Allows the app to read and write all users\u0027 sections (folders) for organizing chats and channels in Teams, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b74fd6c4-4bde-488e-9695-eeb100e4907f",
|                                               "Value":  "TeamworkTag.Read.All",
|                                               "DisplayName":  "Read tags in Teams",
|                                               "Description":  "Allows the app to read tags in Teams without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a3371ca5-911d-46d6-901c-42c8c7a937d8",
|                                               "Value":  "TeamworkTag.ReadWrite.All",
|                                               "DisplayName":  "Read and write tags in Teams",
|                                               "Description":  "Allows the app to read and write tags in Teams without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b0cfd829-be18-4b31-bb0e-ec1df8197ba3",
|                                               "Value":  "TeamworkTargetedMessage.Read.All",
|                                               "DisplayName":  "Read all targeted messages of group chat or channel",
|                                               "Description":  "Allows the app to read all group chat or channel targeted messages in Microsoft Teams."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3f4f98e9-6faf-4e5f-814b-ed2ed8a4ec9e",
|                                               "Value":  "TenantGovernance-Invitation.Read.All",
|                                               "DisplayName":  "Read Tenant Governance invitations",
|                                               "Description":  "Allows the application to list and read all Tenant Governance invitations without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "eb9465d8-e7c0-4301-8e51-927f34ee3134",
|                                               "Value":  "TenantGovernance-PolicyTemplate.Read.All",
|                                               "DisplayName":  "Read Tenant Governance policy templates",
|                                               "Description":  "Allows the application to list and read all Tenant Governance policy templates without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7ced9a83-8e7c-46df-b3e0-6b45a6ecedcd",
|                                               "Value":  "TenantGovernance-RelatedTenant.Read.All",
|                                               "DisplayName":  "Read related tenants",
|                                               "Description":  "Allows the application to list and read related tenants information without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "41c250d0-8793-44e1-a130-5fdbd5bccd0a",
|                                               "Value":  "TenantGovernance-Relationship.Read.All",
|                                               "DisplayName":  "Read Tenant Governance relationships",
|                                               "Description":  "Allows the application to list and read all Tenant Governance relationships without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "294294d5-2b81-4cf1-837c-28fc22bc3290",
|                                               "Value":  "TenantGovernance-Request.Read.All",
|                                               "DisplayName":  "Read Tenant Governance requests",
|                                               "Description":  "Allows the application to list and read all Tenant Governance requests without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e2d1cac5-0317-4ae3-aca9-59737eb75317",
|                                               "Value":  "TenantGovernance-Setting.Read.All",
|                                               "DisplayName":  "Read Tenant Governance settings",
|                                               "Description":  "Allows the application to read Tenant Governance settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ea047cc2-df29-4f3e-83a3-205de61501ca",
|                                               "Value":  "TermStore.Read.All",
|                                               "DisplayName":  "Read all term store data",
|                                               "Description":  "Allows the app to read all term store data, without a signed-in user. This includes all sets, groups and terms in the term store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f12eb8d6-28e3-46e6-b2c0-b7e4dc69fc95",
|                                               "Value":  "TermStore.ReadWrite.All",
|                                               "DisplayName":  "Read and write all term store data",
|                                               "Description":  "Allows the app to read, edit or write all term store data, without a signed-in user. This includes all sets, groups and terms in the term store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f8f035bb-2cce-47fb-8bf5-7baf3ecbee48",
|                                               "Value":  "ThreatAssessment.Read.All",
|                                               "DisplayName":  "Read threat assessment requests",
|                                               "Description":  "Allows an app to read your organization\u0027s threat assessment requests, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dd98c7f5-2d42-42d3-a0e4-633161547251",
|                                               "Value":  "ThreatHunting.Read.All",
|                                               "DisplayName":  "Run hunting queries",
|                                               "Description":  "Allows the app to run hunting queries, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "197ee4e9-b993-4066-898f-d6aecc55125b",
|                                               "Value":  "ThreatIndicators.Read.All",
|                                               "DisplayName":  "Read all threat indicators",
|                                               "Description":  "Allows the app to read all the indicators for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "21792b6c-c986-4ffc-85de-df9da54b52fa",
|                                               "Value":  "ThreatIndicators.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Manage threat indicators this app creates or owns",
|                                               "Description":  "Allows the app to create threat indicators, and fully manage those threat indicators (read, update and delete), without a signed-in user.  It cannot update any threat indicators it does not own."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e0b77adb-e790-44a3-b0a0-257d06303687",
|                                               "Value":  "ThreatIntelligence.Read.All",
|                                               "DisplayName":  "Read all Threat Intelligence Information",
|                                               "Description":  "Allows the app to read threat intelligence information, such as indicators, observations, and and articles, without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "86632667-cd15-4845-ad89-48a88e8412e1",
|                                               "Value":  "ThreatSubmission.Read.All",
|                                               "DisplayName":  "Read all of the organization\u0027s threat submissions",
|                                               "Description":  "Allows the app to read your organization\u0027s threat submissions and to view threat submission policies without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d72bdbf4-a59b-405c-8b04-5995895819ac",
|                                               "Value":  "ThreatSubmission.ReadWrite.All",
|                                               "DisplayName":  "Read and write all of the organization\u0027s threat submissions",
|                                               "Description":  "Allows the app to read your organization\u0027s threat submissions and threat submission policies without a signed-in user. Also allows the app to create new threat submissions without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "926a6798-b100-4a20-a22f-a4918f13951d",
|                                               "Value":  "ThreatSubmissionPolicy.ReadWrite.All",
|                                               "DisplayName":  "Read and write all of the organization\u0027s threat submission policies",
|                                               "Description":  "Allows the app to read your organization\u0027s threat submission policies without a signed-in user. Also allows the app to create new threat submission policies without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fff194f1-7dce-4428-8301-1badb5518201",
|                                               "Value":  "TrustFrameworkKeySet.Read.All",
|                                               "DisplayName":  "Read trust framework key sets",
|                                               "Description":  "Allows the app to read trust framework key set properties without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4a771c9a-1cf2-4609-b88e-3d3e02d539cd",
|                                               "Value":  "TrustFrameworkKeySet.ReadWrite.All",
|                                               "DisplayName":  "Read and write trust framework key sets",
|                                               "Description":  "Allows the app to read and write trust framework key set properties without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9d952b72-f741-4b40-9185-8c53076c2339",
|                                               "Value":  "User-ConvertToInternal.ReadWrite.All",
|                                               "DisplayName":  "Convert an external user to internal member user",
|                                               "Description":  "Allow the app to convert an external user to an internal member user, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8556a004-db57-4d7a-8b82-97a13428e96f",
|                                               "Value":  "User-LifeCycleInfo.Read.All",
|                                               "DisplayName":  "Read all users\u0027 lifecycle information",
|                                               "Description":  "Allows the app to read the lifecycle information like employeeLeaveDateTime of users in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "925f1248-0f97-47b9-8ec8-538c54e01325",
|                                               "Value":  "User-LifeCycleInfo.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 lifecycle information",
|                                               "Description":  "Allows the app to read and write the lifecycle information like employeeLeaveDateTime of users in your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "280d0935-0796-47d1-8d26-273470a3f17a",
|                                               "Value":  "User-Mail.ReadWrite.All",
|                                               "DisplayName":  "Read and write all secondary mail addresses for users",
|                                               "Description":  "Allows the app to read and write secondary mail addresses for all users, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a94a502d-0281-4d15-8cd2-682ac9362c4c",
|                                               "Value":  "User-OnPremisesSyncBehavior.ReadWrite.All",
|                                               "DisplayName":  "Read and update the on-premises sync behavior of users",
|                                               "Description":  "Allows the app to update the on-premises sync behavior of all users without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cc117bb9-00cf-4eb8-b580-ea2a878fe8f7",
|                                               "Value":  "User-PasswordProfile.ReadWrite.All",
|                                               "DisplayName":  "Read and write all password profiles and reset user passwords",
|                                               "Description":  "Allows the app to read and write password profiles and reset passwords for all users, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "86ceff06-c822-49ff-989a-d912845ffe69",
|                                               "Value":  "User-Phone.ReadWrite.All",
|                                               "DisplayName":  "Read and write all user mobile phone and business phones",
|                                               "Description":  "Allows the app to read and write the mobile phone and business phones for all users, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "eccc023d-eccf-4e7b-9683-8813ab36cecc",
|                                               "Value":  "User.DeleteRestore.All",
|                                               "DisplayName":  "Delete and restore all users",
|                                               "Description":  "Allows the app to delete and restore all users, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3011c876-62b7-4ada-afa2-506cbbecc68c",
|                                               "Value":  "User.EnableDisableAccount.All",
|                                               "DisplayName":  "Enable and disable user accounts",
|                                               "Description":  "Allows the app to enable and disable users\u0027 accounts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "405a51b5-8d8d-430b-9842-8be4b0e9f324",
|                                               "Value":  "User.Export.All",
|                                               "DisplayName":  "Export user\u0027s data",
|                                               "Description":  "Allows the app to export data (e.g. customer content or system-generated logs), associated with any user in your company, when the app is used by a privileged user (e.g. a Company Administrator)."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "09850681-111b-4a89-9bed-3f2cae46d706",
|                                               "Value":  "User.Invite.All",
|                                               "DisplayName":  "Invite guest users to the organization",
|                                               "Description":  "Allows the app to invite guest users to the organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c529cfca-c91b-489c-af2b-d92990b66ce6",
|                                               "Value":  "User.ManageIdentities.All",
|                                               "DisplayName":  "Manage all users\u0027 identities",
|                                               "Description":  "Allows the app to read, update and delete identities that are associated with a user\u0027s account, without a signed in user. This controls the identities users can sign-in with."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "df021288-bdef-4463-88db-98f22de89214",
|                                               "Value":  "User.Read.All",
|                                               "DisplayName":  "Read all users\u0027 full profiles",
|                                               "Description":  "Allows the app to read user profiles without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "97235f07-e226-4f63-ace3-39588e11d3a1",
|                                               "Value":  "User.ReadBasic.All",
|                                               "DisplayName":  "Read all users\u0027 basic profiles",
|                                               "Description":  "Allows the app to read a basic set of profile properties of other users in your organization without a signed-in user. Includes display name, first and last name, email address, open extensions, and photo."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "741f803b-c850-494e-b5df-cde7c675a1ca",
|                                               "Value":  "User.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 full profiles",
|                                               "Description":  "Allows the app to read and update user profiles without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5652f862-b626-407b-a3e6-248aeb95763c",
|                                               "Value":  "User.ReadWrite.CrossCloud",
|                                               "DisplayName":  "Read and write profiles of users that originate from an external cloud.",
|                                               "Description":  "Allows the app to read and update external cloud user profiles without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "77f3a031-c388-4f99-b373-dc68676a979e",
|                                               "Value":  "User.RevokeSessions.All",
|                                               "DisplayName":  "Revoke all sign in sessions for a user",
|                                               "Description":  "Allow the app to revoke all sign in sessions for a user, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "38d9df27-64da-44fd-b7c5-a6fbac20248f",
|                                               "Value":  "UserAuthenticationMethod.Read.All",
|                                               "DisplayName":  "Read all users\u0027 authentication methods",
|                                               "Description":  "Allows the app to read authentication methods of all users in your organization, without a signed-in user. Authentication methods include things like a user’s phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "50483e42-d915-4231-9639-7fdb7fd190e5",
|                                               "Value":  "UserAuthenticationMethod.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 authentication methods ",
|                                               "Description":  "Allows the application to read and write authentication methods of all users in your organization, without a signed-in user.                       Authentication methods include things like a user’s phone numbers and Authenticator app settings. This                      does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a1e58be0-1095-422b-b067-73434bd7d40f",
|                                               "Value":  "UserAuthMethod-Email.Read.All",
|                                               "DisplayName":  "Read all users\u0027 email methods",
|                                               "Description":  "Allows the app to read email methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e8ecb853-1435-4a49-95ba-ec5b31b11672",
|                                               "Value":  "UserAuthMethod-Email.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 email methods",
|                                               "Description":  "Allows the application to read and write email methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d2c4289f-9f95-40da-ad43-eeb1506f0db7",
|                                               "Value":  "UserAuthMethod-External.Read.All",
|                                               "DisplayName":  "Read all users\u0027 external authentication methods",
|                                               "Description":  "Allows the app to read external authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c7a22c2e-5b01-4129-8159-6c8be2c78f16",
|                                               "Value":  "UserAuthMethod-External.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 external authentication methods",
|                                               "Description":  "Allows the application to read and write external authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7b544555-7811-49ff-8223-a56be870e33a",
|                                               "Value":  "UserAuthMethod-HardwareOATH.Read.All",
|                                               "DisplayName":  "Read all users\u0027 HardwareOATH authentication methods",
|                                               "Description":  "Allows the app to read HardwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7e9ebcc1-90aa-4471-8051-e68d6b4e9c89",
|                                               "Value":  "UserAuthMethod-HardwareOATH.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 HardwareOATH authentication methods",
|                                               "Description":  "Allows the application to read and write HardwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a9c5f16e-e5ca-4e33-89ad-903fcfc01c23",
|                                               "Value":  "UserAuthMethod-MicrosoftAuthApp.Read.All",
|                                               "DisplayName":  "Read all users\u0027 Microsoft authentication methods",
|                                               "Description":  "Allows the app to read Microsoft authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c833c349-a1ab-4b6d-94a2-fa9a8674420c",
|                                               "Value":  "UserAuthMethod-MicrosoftAuthApp.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 Microsoft Authentication methods",
|                                               "Description":  "Allows the application to read and write Microsoft Authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "72e00c1d-3e3d-43bb-a0b9-c435611bb1d2",
|                                               "Value":  "UserAuthMethod-Passkey.Read.All",
|                                               "DisplayName":  "Read all users\u0027 passkey authentication methods",
|                                               "Description":  "Allows the app to read passkey authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0400e371-7db1-4338-a269-96069eb65227",
|                                               "Value":  "UserAuthMethod-Passkey.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 passkey authentication methods",
|                                               "Description":  "Allows the application to read and write passkey authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8d2c17ff-b93d-40d5-9def-d843680509cb",
|                                               "Value":  "UserAuthMethod-Password.Read.All",
|                                               "DisplayName":  "Read all users\u0027 password authentication methods",
|                                               "Description":  "Allows the app to read password authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f6d38dfd-ec08-4995-8f07-23e929df0936",
|                                               "Value":  "UserAuthMethod-Password.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 password authentication methods",
|                                               "Description":  "Allows the application to read and write password authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f529a223-ea70-43ec-b268-5012de2fbaa2",
|                                               "Value":  "UserAuthMethod-Phone.Read.All",
|                                               "DisplayName":  "Read all users\u0027 phone authentication methods",
|                                               "Description":  "Allows the app to read phone authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6e85d483-7092-4375-babe-0a94a8213a58",
|                                               "Value":  "UserAuthMethod-Phone.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 phone methods",
|                                               "Description":  "Allows the application to read and write phone methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "07c0b1e4-15bd-442f-834b-30f8291388d1",
|                                               "Value":  "UserAuthMethod-PlatformCred.Read.All",
|                                               "DisplayName":  "Read all users\u0027 platform credentials methods",
|                                               "Description":  "Allows the app to read platform credentials methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1a87acf4-a9ca-4576-a974-452ea265d5f6",
|                                               "Value":  "UserAuthMethod-PlatformCred.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 platform credentials methods",
|                                               "Description":  "Allows the application to read and write platform credentials methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9a45bc50-cddd-4ebe-bd9c-4f2eacf646ae",
|                                               "Value":  "UserAuthMethod-QR.Read.All",
|                                               "DisplayName":  "Read all users\u0027 QR methods",
|                                               "Description":  "Allows the app to read QR authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4869299f-18c3-40c8-98f2-222657e67db1",
|                                               "Value":  "UserAuthMethod-QR.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 QR methods",
|                                               "Description":  "Allows the application to read and write QR authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a6b423df-a0c8-411d-a809-a4a5985d2939",
|                                               "Value":  "UserAuthMethod-SoftwareOATH.Read.All",
|                                               "DisplayName":  "Read all users\u0027 SoftwareOATH methods",
|                                               "Description":  "Allows the app to read SoftwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "787442d4-3c6e-4e99-aa95-8ccca20a48ff",
|                                               "Value":  "UserAuthMethod-SoftwareOATH.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 SoftwareOATH methods",
|                                               "Description":  "Allows the application to read and write SoftwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bf82209c-b22b-4747-ac88-a68be99032cf",
|                                               "Value":  "UserAuthMethod-TAP.Read.All",
|                                               "DisplayName":  "Read all users\u0027 Temporary Access Pass methods",
|                                               "Description":  "Allows the app to read Temporary Access Pass authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "627169a8-8c15-451c-861a-5b80e383de5c",
|                                               "Value":  "UserAuthMethod-TAP.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 Temporary Access Pass methods",
|                                               "Description":  "Allows the application to read and write Temporary Access Pass authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9b8dd4c7-8cca-4ef5-a34a-9c2c75fcc934",
|                                               "Value":  "UserAuthMethod-WindowsHello.Read.All",
|                                               "DisplayName":  "Read all users\u0027 Windows Hello methods",
|                                               "Description":  "Allows the app to read Windows Hello authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f14eee8a-713e-45aa-8223-2ab74632db1a",
|                                               "Value":  "UserAuthMethod-WindowsHello.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 Windows Hello authentication methods",
|                                               "Description":  "Allows the application to read and write Windows Hello authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4e774092-a092-48d1-90bd-baad67c7eb47",
|                                               "Value":  "UserNotification.ReadWrite.CreatedByApp",
|                                               "DisplayName":  "Deliver and manage all user\u0027s notifications",
|                                               "Description":  "Allows the app to send, read, update and delete user’s notifications, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "de023814-96df-4f53-9376-1e2891ef5a18",
|                                               "Value":  "UserShiftPreferences.Read.All",
|                                               "DisplayName":  "Read all user shift preferences",
|                                               "Description":  "Allows the app to read all users\u0027 shift schedule preferences without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d1eec298-80f3-49b0-9efb-d90e224798ac",
|                                               "Value":  "UserShiftPreferences.ReadWrite.All",
|                                               "DisplayName":  "Read and write all user shift preferences",
|                                               "Description":  "Allows the app to manage all users\u0027 shift schedule preferences without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fbcd7ef1-df0d-4e05-bb28-93424a89c6df",
|                                               "Value":  "UserTeamwork.Read.All",
|                                               "DisplayName":  "Read all user teamwork settings",
|                                               "Description":  "Allows the app to read all user teamwork settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e227c591-dd64-4a8a-a033-816167f7c938",
|                                               "Value":  "VerifiedId-Profile.Read.All",
|                                               "DisplayName":  "Read Verified Id profiles",
|                                               "Description":  "This role can read Verified Id profiles in a tenant."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d4f67ec2-59b5-4bdc-b4af-d78f6f9c1954",
|                                               "Value":  "VirtualAppointment.Read.All",
|                                               "DisplayName":  "Read all virtual appointments for users, as authorized by online meetings application access policy",
|                                               "Description":  "Allows the application to read virtual appointments for all users, without a signed-in user. The app must also be authorized to access an individual user’s data by the online meetings application access policy."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bf46a256-f47d-448f-ab78-f226fff08d40",
|                                               "Value":  "VirtualAppointment.ReadWrite.All",
|                                               "DisplayName":  "Read-write all virtual appointments for users, as authorized by online meetings app access policy",
|                                               "Description":  "Allows the application to read and write virtual appointments for all users, without a signed-in user. The app must also be authorized to access an individual user’s data by the online meetings application access policy."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "97e45b36-1250-48e4-bd70-2df6dab7e94a",
|                                               "Value":  "VirtualAppointmentNotification.Send",
|                                               "DisplayName":  "Send notification regarding virtual appointments as any user",
|                                               "Description":  "Allows the application to send notification regarding virtual appointments as any user, without a signed-in user. The app must also be authorized to access an individual user\u0027s data by the online meetings application access policy."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1dccb351-c4e4-4e09-a8d1-7a9ecbf027cc",
|                                               "Value":  "VirtualEvent.Read.All",
|                                               "DisplayName":  "Read all users\u0027 virtual events",
|                                               "Description":  "Allows the app to read all virtual events without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "23211fc1-f9d1-4e8e-8e9e-08a5d0a109bb",
|                                               "Value":  "VirtualEventRegistration-Anon.ReadWrite.All",
|                                               "DisplayName":  "Read and write anonymous users\u0027 virtual event registrations",
|                                               "Description":  "Allows the app to read and write anonymous users\u0027 virtual event registrations, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "50a8bf5f-b06a-4ac7-881f-3ca0c4be7550",
|                                               "Value":  "WindowsUpdates.Read.All",
|                                               "DisplayName":  "Read all Windows update deployment settings",
|                                               "Description":  "Allows the app to read all Windows update deployment settings for the organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7dd1be58-6e76-4401-bf8d-31d1e8180d5b",
|                                               "Value":  "WindowsUpdates.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Windows update deployment settings",
|                                               "Description":  "Allows the app to read and write all Windows update deployment settings for the organization without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f10b94b9-37d1-4c88-8b7e-bf75a1152d39",
|                                               "Value":  "WorkforceIntegration.Read.All",
|                                               "DisplayName":  "Read workforce integrations",
|                                               "Description":  "Allows the app to read workforce integrations without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "202bf709-e8e6-478e-bcfd-5d63c50b68e3",
|                                               "Value":  "WorkforceIntegration.ReadWrite.All",
|                                               "DisplayName":  "Read and write workforce integrations",
|                                               "Description":  "Allows the app to manage workforce integrations to synchronize data from Microsoft Teams Shifts, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ebfcd32b-babb-40f4-a14b-42706e83bd28",
|                                               "Value":  "AccessReview.Read.All",
|                                               "DisplayName":  "Read all access reviews that user can access",
|                                               "Description":  "Allows the app to read access reviews, reviewers, decisions and settings that the signed-in user has access to in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e4aa47b9-9a69-4109-82ed-36ec70d85ff1",
|                                               "Value":  "AccessReview.ReadWrite.All",
|                                               "DisplayName":  "Manage all access reviews that user can access",
|                                               "Description":  "Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings that the signed-in user has access to in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5af8c3f5-baca-439a-97b0-ea58a435e269",
|                                               "Value":  "AccessReview.ReadWrite.Membership",
|                                               "DisplayName":  "Manage access reviews for group and app memberships",
|                                               "Description":  "Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings for group and app memberships that the signed-in user has access to in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9084c10f-a2d6-4713-8732-348def50fe02",
|                                               "Value":  "Acronym.Read.All",
|                                               "DisplayName":  "Read all acronyms that the user can access",
|                                               "Description":  "Allows an app to read all acronyms that the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3361d15d-be43-4de6-b441-3c746d05163d",
|                                               "Value":  "AdministrativeUnit.Read.All",
|                                               "DisplayName":  "Read administrative units",
|                                               "Description":  "Allows the app to read administrative units and administrative unit membership on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7b8a2d34-6b3f-4542-a343-54651608ad81",
|                                               "Value":  "AdministrativeUnit.ReadWrite.All",
|                                               "DisplayName":  "Read and write administrative units",
|                                               "Description":  "Allows the app to create, read, update, and delete administrative units and manage administrative unit membership on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ada96a26-9579-4c29-a578-c3482a765716",
|                                               "Value":  "AgentCardManifest.Read.All",
|                                               "DisplayName":  "Read agent card manifests in Agent Registry",
|                                               "Description":  "Allows the app to read agent card manifests in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "80151b1a-1c31-4846-ae0d-c79939ee13d1",
|                                               "Value":  "AgentCardManifest.ReadWrite.All",
|                                               "DisplayName":  "Read and write agent card manifests in Agent Registry",
|                                               "Description":  "Allows the app to read and write agent card manifests in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fa50be38-fdff-469c-96dc-ef5fce3c64bf",
|                                               "Value":  "AgentCollection.Read.All",
|                                               "DisplayName":  "Read collections in Agent Registry",
|                                               "Description":  "Allows the app to read collections and their membership in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b14924c8-87f1-438a-81f2-dc370ba2f45d",
|                                               "Value":  "AgentCollection.Read.Global",
|                                               "DisplayName":  "Read global collection in Agent Registry",
|                                               "Description":  "Allows the app to read global collection and its membership in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "43acfda3-daf3-4aa4-955d-b051d0024e82",
|                                               "Value":  "AgentCollection.Read.Quarantined",
|                                               "DisplayName":  "Read quarantined collection in Agent Registry",
|                                               "Description":  "Allows the app to read quarantined collection and its membership in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6d8a7002-a05e-4b95-a768-0e6f0badc6c8",
|                                               "Value":  "AgentCollection.ReadWrite.All",
|                                               "DisplayName":  "Read and write collections in Agent Registry",
|                                               "Description":  "Allows the app to create, read, update, and delete collections and manage their membership in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c001dd65-8a6b-4349-ab0c-4e8a410d28d2",
|                                               "Value":  "AgentCollection.ReadWrite.Global",
|                                               "DisplayName":  "Read and write global collection in Agent Registry",
|                                               "Description":  "Allows the app to read and update global collection and manage its membership in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ae331cc9-9f51-484b-a90b-124f2e4a6398",
|                                               "Value":  "AgentCollection.ReadWrite.Quarantined",
|                                               "DisplayName":  "Read and write quarantined collection in Agent Registry",
|                                               "Description":  "Allows the app to read and update quarantined collection and manage its membership in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c8ee41e5-35e7-4fe9-8ecb-93493adcac5b",
|                                               "Value":  "AgentIdentity.DeleteRestore.All",
|                                               "DisplayName":  "Delete and restore agent identities",
|                                               "Description":  "Allows the client to delete and restore agent identities."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a501206a-e364-4a3f-be6e-765806d0e323",
|                                               "Value":  "AgentIdentity.EnableDisable.All",
|                                               "DisplayName":  "Enable or disable agent identities",
|                                               "Description":  "Allows the client to enable or disable agent identities."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5e850691-d86a-4b24-bfa6-8a52fb37a0c1",
|                                               "Value":  "AgentIdentity.Read.All",
|                                               "DisplayName":  "Read all agent identities",
|                                               "Description":  "Allows the client to read all agent identities."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4a4facd5-0ee1-49b7-a5b2-fdcc2491685e",
|                                               "Value":  "AgentIdentity.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent identities",
|                                               "Description":  "Allows the client to read, update, and delete agent identities on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "75b5feb2-bfe7-423f-907d-cc505186f246",
|                                               "Value":  "AgentIdentityBlueprint.AddRemoveCreds.All",
|                                               "DisplayName":  "Update agent identity blueprint credentials",
|                                               "Description":  "Allows updating agent identity blueprint credentials on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8fc15edd-ba24-494e-9bf6-d38e1b7ba8fd",
|                                               "Value":  "AgentIdentityBlueprint.Create",
|                                               "DisplayName":  "Create agent identity blueprints.",
|                                               "Description":  "Allows creating new agent identity blueprints with a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f12ba1f6-afb7-4685-9a30-21e8c3f551d8",
|                                               "Value":  "AgentIdentityBlueprint.DeleteRestore.All",
|                                               "DisplayName":  "Delete and restore agent identity blueprints.",
|                                               "Description":  "Allows deleting or restoring agent identity blueprints with a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "26512dc8-1364-4e9f-867c-6d8b22a9e162",
|                                               "Value":  "AgentIdentityBlueprint.Read.All",
|                                               "DisplayName":  "Read all agent identity blueprints",
|                                               "Description":  "Allows the client to read all agent identity blueprints."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4fd490fc-1467-48eb-8a4c-421597ab0402",
|                                               "Value":  "AgentIdentityBlueprint.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent identity blueprints.",
|                                               "Description":  "Allows the app to read, update, and delete agent identity blueprints on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6f677aa9-25af-49a5-8a1d-628dc7f0d009",
|                                               "Value":  "AgentIdentityBlueprint.UpdateAuthProperties.All",
|                                               "DisplayName":  "Update agent identity blueprint authorization and authentication properties",
|                                               "Description":  "Allows updating agent identity blueprint authorization and authentication properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "60960e31-67cb-4d25-9d36-4922109923a2",
|                                               "Value":  "AgentIdentityBlueprint.UpdateBranding.All",
|                                               "DisplayName":  "Update agent identity blueprint branding",
|                                               "Description":  "Allows updating agent identity blueprint branding on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "00dcd896-6b23-42ce-b5de-c58493c05e22",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.Create",
|                                               "DisplayName":  "Create agent identity blueprint service principals.",
|                                               "Description":  "Allows creating new agent identity blueprint principals with a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2c70023e-a482-4af2-9ff1-51ded53e6bad",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.DeleteRestore.All",
|                                               "DisplayName":  "Delete and restore agent identity blueprints.",
|                                               "Description":  "Allows deleting or restoring agent identity blueprints with a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e7475e0a-9f02-43e2-a250-5c2ea74ccd0e",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.EnableDisable.All",
|                                               "DisplayName":  "Enable or disable agent identity blueprint principals.",
|                                               "Description":  "Allows enabling or disabling agent identity blueprint principals with a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "88c856a2-de61-4632-b2d4-ac503cbc8dd2",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.Read.All",
|                                               "DisplayName":  "Read agent identity blueprints principals.",
|                                               "Description":  "Allows reading agent identity blueprint principals with a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bf2cad6a-9082-438a-9a63-95fa2687af65",
|                                               "Value":  "AgentIdentityBlueprintPrincipal.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent identity blueprint principals.",
|                                               "Description":  "Allows the app to read, update, and delete agent identity blueprint principals on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ad57fb88-4658-4fd6-ab7d-e43184b08e4e",
|                                               "Value":  "AgentIdUser.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent ID users\u0027 full profiles",
|                                               "Description":  "Allows the app to read and write the full set of profile properties, reports, and managers of agent ID users in your organization, and read basic company properties, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "52a417d9-0b3c-4466-9a3b-66960de73d74",
|                                               "Value":  "AgentIdUser.ReadWrite.IdentityParentedBy",
|                                               "DisplayName":  "Read and write all agent ID users\u0027 full profiles",
|                                               "Description":  "Allows the app to read and write the full set of profile properties, reports, and managers of agent ID users in your organization, and read basic company properties, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4c3c738a-2df0-4877-bf4a-f796950ff34c",
|                                               "Value":  "AgentInstance.Read.All",
|                                               "DisplayName":  "Read agent instances in Agent Registry",
|                                               "Description":  "Allows the app to read agent instances and their related collections in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fc79e324-da24-497a-b5ec-e7de08320375",
|                                               "Value":  "AgentInstance.ReadWrite.All",
|                                               "DisplayName":  "Read and write agent instances in Agent Registry",
|                                               "Description":  "Allows the app to create, read, update, and delete agent instances in your organization\u0027s Agent Registry on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ef96ce0b-b2ea-4ae4-a783-108212d8ecee",
|                                               "Value":  "AgentRegistration.Read.All",
|                                               "DisplayName":  "Read all agent registrations",
|                                               "Description":  "Allows the user to read all agent registration information"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "20f263bf-7d50-4e66-912c-16b4b4194fd4",
|                                               "Value":  "AgentRegistration.ReadWrite.All",
|                                               "DisplayName":  "Read and write all agent registrations",
|                                               "Description":  "Allows the user to read and write all agent registration information"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "af2819c9-df71-4dd3-ade7-4d7c9dc653b7",
|                                               "Value":  "Agreement.Read.All",
|                                               "DisplayName":  "Read all terms of use agreements",
|                                               "Description":  "Allows the app to read terms of use agreements on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ef4b5d93-3104-4664-9053-a5c49ab44218",
|                                               "Value":  "Agreement.ReadWrite.All",
|                                               "DisplayName":  "Read and write all terms of use agreements",
|                                               "Description":  "Allows the app to read and write terms of use agreements on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0b7643bb-5336-476f-80b5-18fbfbc91806",
|                                               "Value":  "AgreementAcceptance.Read",
|                                               "DisplayName":  "Read user terms of use acceptance statuses",
|                                               "Description":  "Allows the app to read terms of use acceptance statuses on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a66a5341-e66e-4897-9d52-c2df58c2bfb9",
|                                               "Value":  "AgreementAcceptance.Read.All",
|                                               "DisplayName":  "Read terms of use acceptance statuses that user can access",
|                                               "Description":  "Allows the app to read terms of use acceptance statuses on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "859cceb9-2ec2-4e48-bcd7-b8490b5248a5",
|                                               "Value":  "AiEnterpriseInteraction.Read",
|                                               "DisplayName":  "Read user AI enterprise interactions.",
|                                               "Description":  "Allows the app to read user AI enterprise interactions, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e03cf23f-8056-446a-8994-7d93dfc8b50e",
|                                               "Value":  "Analytics.Read",
|                                               "DisplayName":  "Read user activity statistics",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s activity statistics, such as how much time the user has spent on emails, in meetings, or in chat sessions."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1b6ff35f-31df-4332-8571-d31ea5a4893f",
|                                               "Value":  "APIConnectors.Read.All",
|                                               "DisplayName":  "Read API connectors for authentication flows",
|                                               "Description":  "Allows the app to read the API connectors used in user authentication flows, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c67b52c5-7c69-48b6-9d48-7b3af3ded914",
|                                               "Value":  "APIConnectors.ReadWrite.All",
|                                               "DisplayName":  "Read and write API connectors for authentication flows",
|                                               "Description":  "Allows the app to read, create and manage the API connectors used in user authentication flows, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "88e58d74-d3df-44f3-ad47-e89edf4472e4",
|                                               "Value":  "AppCatalog.Read.All",
|                                               "DisplayName":  "Read all app catalogs",
|                                               "Description":  "Allows the app to read the apps in the app catalogs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1ca167d5-1655-44a1-8adf-1414072e1ef9",
|                                               "Value":  "AppCatalog.ReadWrite.All",
|                                               "DisplayName":  "Read and write to all app catalogs",
|                                               "Description":  "Allows the app to create, read, update, and delete apps in the app catalogs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3db89e36-7fa6-4012-b281-85f3d9d9fd2e",
|                                               "Value":  "AppCatalog.Submit",
|                                               "DisplayName":  "Submit application packages to the catalog and cancel pending submissions",
|                                               "Description":  "Allows the app to submit application packages to the catalog and cancel submissions that are pending review on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "af281d3a-030d-4122-886e-146fb30a0413",
|                                               "Value":  "AppCertTrustConfiguration.Read.All",
|                                               "DisplayName":  "Read the trusted certificate authority configuration for applications",
|                                               "Description":  "Allows the app to read the trusted certificate authority configuration which can be used to restrict application certificates based on their issuing authority, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4bae2ed4-473e-4841-a493-9829cfd51d48",
|                                               "Value":  "AppCertTrustConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write the trusted certificate authority configuration for applications",
|                                               "Description":  "Allows the app to create, read, update and delete the trusted certificate authority configuration which can be used to restrict application certificates based on their issuing authority, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ffa91d43-2ad8-45cc-b592-09caddeb24bb",
|                                               "Value":  "Application-RemoteDesktopConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write the remote desktop security configuration for apps",
|                                               "Description":  "Allows the app to read and write other apps\u0027 remote desktop security configuration, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c79f8feb-a9db-4090-85f9-90d820caa0eb",
|                                               "Value":  "Application.Read.All",
|                                               "DisplayName":  "Read applications",
|                                               "Description":  "Allows the app to read applications and service principals on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0586a906-4d89-4de8-b3c8-1aacdcc0c679",
|                                               "Value":  "Application.ReadUpdate.All",
|                                               "DisplayName":  "Read and update all apps",
|                                               "Description":  "Allows the app to read and update all apps in your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bdfbf15f-ee85-4955-8675-146e8e5296b5",
|                                               "Value":  "Application.ReadWrite.All",
|                                               "DisplayName":  "Read and write all applications",
|                                               "Description":  "Allows the app to create, read, update and delete applications and service principals on behalf of the signed-in user. Does not allow management of consent grants."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "84bccea3-f856-4a8a-967b-dbe0a3d53a64",
|                                               "Value":  "AppRoleAssignment.ReadWrite.All",
|                                               "DisplayName":  "Manage app permission grants and app role assignments",
|                                               "Description":  "Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b0df437d-d341-4df0-aa3e-89ca81a1207f",
|                                               "Value":  "ApprovalSolution.Read",
|                                               "DisplayName":  "Read approvals",
|                                               "Description":  "Allows the app to read approvals on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6768d3af-4562-48ff-82d2-c5e19eb21b9c",
|                                               "Value":  "ApprovalSolution.ReadWrite",
|                                               "DisplayName":  "Read, create, and respond to approvals",
|                                               "Description":  "Allows the app to provision, read, create, and respond to approvals on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "89d944f2-2011-44ad-830c-aa9bf5ef2319",
|                                               "Value":  "ApprovalSolutionResponse.ReadWrite",
|                                               "DisplayName":  "Read and respond to approvals assigned to the current user",
|                                               "Description":  "Allows the app to read and respond to approvals on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "104a7a4b-ca76-4677-b7e7-2f4bc482f381",
|                                               "Value":  "AttackSimulation.Read.All",
|                                               "DisplayName":  "Read attack simulation data of an organization",
|                                               "Description":  "Allows the app to read attack simulation and training data for an organization for the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "27608d7c-2c66-4cad-a657-951d575f5a60",
|                                               "Value":  "AttackSimulation.ReadWrite.All",
|                                               "DisplayName":  "Read, create, and update attack simulation data of an organization",
|                                               "Description":  "Allows the app to read, create, and update attack simulation and training data for an organization for the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "16786f81-40d2-4116-bb26-d1a753bf0b20",
|                                               "Value":  "AuditActivity.Read",
|                                               "DisplayName":  "Read activity audit log from the audit store.",
|                                               "Description":  "Read activity audit log from the audit store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a78fd341-0672-4792-a8ae-a5925b2546eb",
|                                               "Value":  "AuditActivity.Write",
|                                               "DisplayName":  "Upload activity audit logs to the audit store.",
|                                               "Description":  "Allows the application to upload bulk activity audit logs to the audit store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e4c9e354-4dc5-45b8-9e7c-e1393b0b1a20",
|                                               "Value":  "AuditLog.Read.All",
|                                               "DisplayName":  "Read audit log data",
|                                               "Description":  "Allows the app to read and query your audit log activities, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ba78b16f-1e01-41b6-89ca-73e0a32b304c",
|                                               "Value":  "AuditLogsQuery-CRM.Read.All",
|                                               "DisplayName":  "Read audit logs data from Dynamics CRM workload",
|                                               "Description":  "Allows the app to read and query audit logs from Dynamics CRM workload, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ee3409fe-617f-43cf-bd1e-fc8b38049e69",
|                                               "Value":  "AuditLogsQuery-Endpoint.Read.All",
|                                               "DisplayName":  "Read audit logs data from Endpoint Data Loss Prevention workload",
|                                               "Description":  "Allows the app to read and query audit logs from Endpoint Data Loss Prevention workload, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5ff2f415-e0f1-4d11-bfd0-6d87c0f667fd",
|                                               "Value":  "AuditLogsQuery-Entra.Read.All",
|                                               "DisplayName":  "Read audit logs data from Entra (Azure AD) workload",
|                                               "Description":  "Allows the app to read and query audit logs from Entra (Azure AD) workload, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6c8c71d2-c7e1-45b0-ac6d-1d2724fba6ae",
|                                               "Value":  "AuditLogsQuery-Exchange.Read.All",
|                                               "DisplayName":  "Read audit logs data from Exchange workload",
|                                               "Description":  "Allows the app to read and query audit logs from Exchange workload, on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4a72c235-a50d-4870-b598-fd88fd1fa074",
|                                               "Value":  "AuditLogsQuery-OneDrive.Read.All",
|                                               "DisplayName":  "Read audit logs data from OneDrive workload",
|                                               "Description":  "Allows the app to read and query audit logs from OneDrive workload, on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "30630b65-ed12-4a81-9130-e3a964109fae",
|                                               "Value":  "AuditLogsQuery-SharePoint.Read.All",
|                                               "DisplayName":  "Read audit logs data from SharePoint workload",
|                                               "Description":  "Allows the app to read and query audit logs from SharePoint workload, on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1d9e7ac3-0eca-442c-82f9-e92625af6e6d",
|                                               "Value":  "AuditLogsQuery.Read.All",
|                                               "DisplayName":  "Read audit logs data from all services",
|                                               "Description":  "Allows the app to read and query audit logs from all services, on behalf of a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "57b030f1-8c35-469c-b0d9-e4a077debe70",
|                                               "Value":  "AuthenticationContext.Read.All",
|                                               "DisplayName":  "Read all authentication context information",
|                                               "Description":  "Allows the app to read all authentication context information in your organization on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ba6d575a-1344-4516-b777-1404f5593057",
|                                               "Value":  "AuthenticationContext.ReadWrite.All",
|                                               "DisplayName":  "Read and write all authentication context information",
|                                               "Description":  "Allows the app to read and update all authentication context information in your organization on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "444ed4b6-0554-4dc6-8e9c-3f9a34ee3ff6",
|                                               "Value":  "BackupRestore-Configuration.Read.All",
|                                               "DisplayName":  "Read backup configuration policies",
|                                               "Description":  "Allows the app to read the backup configuration, and list of Microsoft 365 service resources to be backed-up, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a0244d16-171c-4496-8ffb-7b9b6954d339",
|                                               "Value":  "BackupRestore-Configuration.ReadWrite.All",
|                                               "DisplayName":  "Read and edit backup configuration policies",
|                                               "Description":  "Allows the app to read and update the backup configuration, and list of Microsoft 365 service resources to be backed-up, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "af598c63-4292-4437-b925-e996354d3854",
|                                               "Value":  "BackupRestore-Control.Read.All",
|                                               "DisplayName":  "Read the status of the M365 backup service",
|                                               "Description":  "Allows the app to read the status of M365 backup service (enable/disable), on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "96d46335-d92d-41b8-bc9f-273a692381ea",
|                                               "Value":  "BackupRestore-Control.ReadWrite.All",
|                                               "DisplayName":  "Update or read the status of the M365 backup service",
|                                               "Description":  "Allows the app to update or read the status of M365 backup service (enable/disable), on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b4e98de1-4600-4e90-b5e1-7c1dfef04e5c",
|                                               "Value":  "BackupRestore-Monitor.Read.All",
|                                               "DisplayName":  "Read monitoring, quota and billing information for the tenant",
|                                               "Description":  "Allows the app to monitor backup and restore jobs, view quota usage and billing details, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "94b36f78-434f-4904-8c08-421d9a9c1dc2",
|                                               "Value":  "BackupRestore-Restore.Read.All",
|                                               "DisplayName":  "Read restore sessions",
|                                               "Description":  "Allows the app to read restore sessions, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9f89e109-94b9-4c9b-b4fc-98cdaa54f574",
|                                               "Value":  "BackupRestore-Restore.ReadWrite.All",
|                                               "DisplayName":  "Read restore sessions and start restore sessions from backups",
|                                               "Description":  "Allows the app to search the backup snapshots for Microsoft 365 resources, and restore Microsoft 365 resources from a backed-up snapshot, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2b24830f-f435-446f-ab5a-b1e70d9a2eb5",
|                                               "Value":  "BackupRestore-Search.Read.All",
|                                               "DisplayName":  "Search for metadata properties in backup snapshots",
|                                               "Description":  "Allows the app to search the backup snapshots for Microsoft 365 resources, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2bf6d319-dfca-4c22-9879-f88dcfaee6be",
|                                               "Value":  "BillingConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write application billing configuration",
|                                               "Description":  "Allows the app to read and write the billing configuration on all applications on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b27a61ec-b99c-4d6a-b126-c4375d08ae30",
|                                               "Value":  "BitlockerKey.Read.All",
|                                               "DisplayName":  "Read BitLocker keys",
|                                               "Description":  "Allows the app to read BitLocker keys on behalf of the signed-in user, for their owned devices. Allows read of the recovery key."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5a107bfc-4f00-4e1a-b67e-66451267bc68",
|                                               "Value":  "BitlockerKey.ReadBasic.All",
|                                               "DisplayName":  "Read BitLocker keys basic information",
|                                               "Description":  "Allows the app to read basic BitLocker key properties on behalf of the signed-in user, for their owned devices. Does not allow read of the recovery key itself."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7f36b48e-542f-4d3b-9bcb-8406f0ab9fdb",
|                                               "Value":  "Bookings.Manage.All",
|                                               "DisplayName":  "Manage bookings information",
|                                               "Description":  "Allows an app to read, write and manage bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "33b1df99-4b29-4548-9339-7a7b83eaeebc",
|                                               "Value":  "Bookings.Read.All",
|                                               "DisplayName":  "Read bookings information",
|                                               "Description":  "Allows an app to read bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "948eb538-f19d-4ec5-9ccc-f059e1ea4c72",
|                                               "Value":  "Bookings.ReadWrite.All",
|                                               "DisplayName":  "Read and write bookings information",
|                                               "Description":  "Allows an app to read and write bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user. Does not allow create, delete and publish of booking businesses."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "02a5a114-36a6-46ff-a102-954d89d9ab02",
|                                               "Value":  "BookingsAppointment.ReadWrite.All",
|                                               "DisplayName":  "Read and write booking appointments",
|                                               "Description":  "Allows an app to read and write bookings appointments and customers, and additionally allows read businesses information, services, and staff on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "98b17b35-f3b1-4849-a85f-9f13733002f0",
|                                               "Value":  "Bookmark.Read.All",
|                                               "DisplayName":  "Read all bookmarks that the user can access",
|                                               "Description":  "Allows an app to read all bookmarks that the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fb9be2b7-a7fc-4182-aec1-eda4597c43d5",
|                                               "Value":  "BrowserSiteLists.Read.All",
|                                               "DisplayName":  "Read browser site lists for your organization",
|                                               "Description":  "Allows an app to read the browser site lists configured for your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "83b34c85-95bf-497b-a04e-b58eca9d49d0",
|                                               "Value":  "BrowserSiteLists.ReadWrite.All",
|                                               "DisplayName":  "Read and write browser site lists for your organization",
|                                               "Description":  "Allows an app to read and write the browser site lists configured for your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d16480b2-e469-4118-846b-d3d177327bee",
|                                               "Value":  "BusinessScenarioConfig.Read.All",
|                                               "DisplayName":  "Read business scenario configurations",
|                                               "Description":  "Allows the app to read the configurations of your organization\u0027s business scenarios, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c47e7b6e-d6f1-4be9-9ffd-1e00f3e32892",
|                                               "Value":  "BusinessScenarioConfig.Read.OwnedBy",
|                                               "DisplayName":  "Read business scenario configurations this app creates or owns",
|                                               "Description":  "Allows the app to read the configurations of business scenarios it owns, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "755e785b-b658-446f-bb22-5a46abd029ea",
|                                               "Value":  "BusinessScenarioConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write business scenario configurations",
|                                               "Description":  "Allows the app to read and write the configurations of your organization\u0027s business scenarios, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b3b7fcff-b4d4-4230-bf6f-90bd91285395",
|                                               "Value":  "BusinessScenarioConfig.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Read and write business scenario configurations this app creates or owns",
|                                               "Description":  "Allows the app to create new business scenarios and fully manage the configurations of scenarios it owns, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "25b265c4-5d34-4e44-952d-b567f6d3b96d",
|                                               "Value":  "BusinessScenarioData.Read.OwnedBy",
|                                               "DisplayName":  "Read all data for business scenarios this app creates or owns",
|                                               "Description":  "Allows the app to read all data associated with the business scenarios it owns. Data access will be attributed to the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "19932d57-2952-4c60-8634-3655c79fc527",
|                                               "Value":  "BusinessScenarioData.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Read and write all data for business scenarios this app creates or owns",
|                                               "Description":  "Allows the app to fully manage all data associated with the business scenarios it owns. Data access and changes will be attributed to the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "465a38f9-76ea-45b9-9f34-9e8b0d4b0b42",
|                                               "Value":  "Calendars.Read",
|                                               "DisplayName":  "Read user calendars ",
|                                               "Description":  "Allows the app to read events in user calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2b9c4092-424d-4249-948d-b43879977640",
|                                               "Value":  "Calendars.Read.Shared",
|                                               "DisplayName":  "Read user and shared calendars",
|                                               "Description":  "Allows the app to read events in all calendars that the user can access, including delegate and shared calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "662d75ba-a364-42ad-adee-f5f880ea4878",
|                                               "Value":  "Calendars.ReadBasic",
|                                               "DisplayName":  "Read basic details of user calendars",
|                                               "Description":  "Allows the app to read events in user calendars, except for properties such as body, attachments, and extensions."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1ec239c2-d7c9-4623-a91a-a9775856bb36",
|                                               "Value":  "Calendars.ReadWrite",
|                                               "DisplayName":  "Have full access to user calendars ",
|                                               "Description":  "Allows the app to create, read, update, and delete events in user calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "12466101-c9b8-439a-8589-dd09ee67e8e9",
|                                               "Value":  "Calendars.ReadWrite.Shared",
|                                               "DisplayName":  "Read and write user and shared calendars",
|                                               "Description":  "Allows the app to create, read, update and delete events in all calendars in the organization user has permissions to access. This includes delegate and shared calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e24bdaf9-83f8-468b-a144-c681ccb6caf4",
|                                               "Value":  "CallAiInsights.Read.All",
|                                               "DisplayName":  "Read all AI Insights for calls. ",
|                                               "Description":  "Allows the app to read all AI Insights for calls, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "305b375b-00fe-48bf-81bc-e8d78954c1b6",
|                                               "Value":  "CallDelegation.Read",
|                                               "DisplayName":  "Read delegation settings",
|                                               "Description":  "Allows the app to read delegation settings of you"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "599abf67-f72b-4b5f-98a3-cb38fe646118",
|                                               "Value":  "CallDelegation.ReadWrite",
|                                               "DisplayName":  "Read and write delegation settings",
|                                               "Description":  "Allows the app to read and write delegation settings of you"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "43431c03-960e-400f-87c6-8f910321dca3",
|                                               "Value":  "CallEvents.Read",
|                                               "DisplayName":  "Read call event data",
|                                               "Description":  "Allows the app to read call event information for an organization for the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "63d31bd6-bcf5-40ca-8283-ba4130a66405",
|                                               "Value":  "CallRecordings.Read.All",
|                                               "DisplayName":  "Read all recordings of calls. ",
|                                               "Description":  "Allows the app to read all recordings of calls, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fbace248-5d8e-441c-85ca-cc19221a69a2",
|                                               "Value":  "CallTranscripts.Read.All",
|                                               "DisplayName":  "Read all transcripts of calls. ",
|                                               "Description":  "Allows the app to read all transcripts of calls, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4628dff5-c33e-4fde-b17a-b64e7acb1bed",
|                                               "Value":  "ChangeManagement.Read.All",
|                                               "DisplayName":  "Read Change Management items",
|                                               "Description":  "Allows to read all Change Management items."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "101147cf-4178-4455-9d58-02b5c164e759",
|                                               "Value":  "Channel.Create",
|                                               "DisplayName":  "Create channels",
|                                               "Description":  "Create channels in any team, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cc83893a-e232-4723-b5af-bd0b01bcfe65",
|                                               "Value":  "Channel.Delete.All",
|                                               "DisplayName":  "Delete channels",
|                                               "Description":  "Delete channels in any team, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9d8982ae-4365-4f57-95e9-d6032a4c0b87",
|                                               "Value":  "Channel.ReadBasic.All",
|                                               "DisplayName":  "Read the names and descriptions of channels",
|                                               "Description":  "Read channel names and channel descriptions, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2eadaff8-0bce-4198-a6b9-2cfc35a30075",
|                                               "Value":  "ChannelMember.Read.All",
|                                               "DisplayName":  "Read the members of channels",
|                                               "Description":  "Read the members of channels, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0c3e411a-ce45-4cd1-8f30-f99a3efa7b11",
|                                               "Value":  "ChannelMember.ReadWrite.All",
|                                               "DisplayName":  "Add and remove members from channels",
|                                               "Description":  "Add and remove members from channels, on behalf of the signed-in user. Also allows changing a member\u0027s role, for example from owner to non-owner."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2b61aa8a-6d36-4b2f-ac7b-f29867937c53",
|                                               "Value":  "ChannelMessage.Edit",
|                                               "DisplayName":  "Edit user\u0027s channel messages",
|                                               "Description":  "Allows an app to edit channel messages in Microsoft Teams, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "767156cb-16ae-4d10-8f8b-41b657c8c8c8",
|                                               "Value":  "ChannelMessage.Read.All",
|                                               "DisplayName":  "Read user channel messages",
|                                               "Description":  "Allows an app to read a channel\u0027s messages in Microsoft Teams, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5922d31f-46c8-4404-9eaf-2117e390a8a4",
|                                               "Value":  "ChannelMessage.ReadWrite",
|                                               "DisplayName":  "Read and write user channel messages",
|                                               "Description":  "Allows the app to read and write channel messages, on behalf of the signed-in user. This doesn\u0027t allow the app to edit the policyViolation of a channel message."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ebf0f66e-9fb1-49e4-a278-222f76911cf4",
|                                               "Value":  "ChannelMessage.Send",
|                                               "DisplayName":  "Send channel messages",
|                                               "Description":  "Allows an app to send channel messages in Microsoft Teams, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "233e0cf1-dd62-48bc-b65b-b38fe87fcf8e",
|                                               "Value":  "ChannelSettings.Read.All",
|                                               "DisplayName":  "Read the names, descriptions, and settings of channels",
|                                               "Description":  "Read all channel names, channel descriptions, and channel settings, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d649fb7c-72b4-4eec-b2b4-b15acf79e378",
|                                               "Value":  "ChannelSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write the names, descriptions, and settings of channels",
|                                               "Description":  "Read and write the names, descriptions, and settings of all channels, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "38826093-1258-4dea-98f0-00003be2b8d0",
|                                               "Value":  "Chat.Create",
|                                               "DisplayName":  "Create chats",
|                                               "Description":  "Allows the app to create chats on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bb64e6fc-6b6d-4752-aea0-dd922dbba588",
|                                               "Value":  "Chat.ManageDeletion.All",
|                                               "DisplayName":  "Delete and recover deleted chats",
|                                               "Description":  "Allows the app to delete and recover deleted chats, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f501c180-9344-439a-bca0-6cbf209fd270",
|                                               "Value":  "Chat.Read",
|                                               "DisplayName":  "Read user chat messages",
|                                               "Description":  "Allows an app to read 1 on 1 or group chats threads, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9547fcb5-d03f-419d-9948-5928bbf71b0f",
|                                               "Value":  "Chat.ReadBasic",
|                                               "DisplayName":  "Read names and members of user chat threads",
|                                               "Description":  "Allows an app to read the members and descriptions of one-to-one and group chat threads, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9ff7295e-131b-4d94-90e1-69fde507ac11",
|                                               "Value":  "Chat.ReadWrite",
|                                               "DisplayName":  "Read and write user chat messages",
|                                               "Description":  "Allows an app to read and write 1 on 1 or group chats threads, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7e9a077b-3711-42b9-b7cb-5fa5f3f7fea7",
|                                               "Value":  "Chat.ReadWrite.All",
|                                               "DisplayName":  "Read and write all chat messages",
|                                               "Description":  "Allows an app to read and write all one-to-one and group chats in Microsoft Teams, without a signed-in user. Does not allow sending messages."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c5a9e2b1-faf6-41d4-8875-d381aa549b24",
|                                               "Value":  "ChatMember.Read",
|                                               "DisplayName":  "Read the members of chats",
|                                               "Description":  "Read the members of chats, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dea13482-7ea6-488f-8b98-eb5bbecf033d",
|                                               "Value":  "ChatMember.ReadWrite",
|                                               "DisplayName":  "Add and remove members from chats",
|                                               "Description":  "Add and remove members from chats, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cdcdac3a-fd45-410d-83ef-554db620e5c7",
|                                               "Value":  "ChatMessage.Read",
|                                               "DisplayName":  "Read user chat messages",
|                                               "Description":  "Allows an app to read one-to-one and group chat messages, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "116b7235-7cc6-461e-b163-8e55691d839e",
|                                               "Value":  "ChatMessage.Send",
|                                               "DisplayName":  "Send user chat messages",
|                                               "Description":  "Allows an app to send one-to-one and group chat messages in Microsoft Teams, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ad46d60e-1027-4b75-af88-7c14ccf43a19",
|                                               "Value":  "CloudApp-Discovery.Read.All",
|                                               "DisplayName":  "Read discovered cloud applications data",
|                                               "Description":  "Allows the app to read details of discovered cloud apps in the organization, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5252ec4e-fd40-4d92-8c68-89dd1d3c6110",
|                                               "Value":  "CloudPC.Read.All",
|                                               "DisplayName":  "Read Cloud PCs",
|                                               "Description":  "Allows the app to read the properties of Cloud PCs on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9d77138f-f0e2-47ba-ab33-cd246c8b79d1",
|                                               "Value":  "CloudPC.ReadWrite.All",
|                                               "DisplayName":  "Read and write Cloud PCs",
|                                               "Description":  "Allows the app to read and write the properties of Cloud PCs on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "12ae2e92-14b5-47b2-babb-4e890bbedc0a",
|                                               "Value":  "Community.Read.All",
|                                               "DisplayName":  "Read all Viva Engage communities",
|                                               "Description":  "Allows the app to list Viva Engage communities, and to read their properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9e69467d-e0e2-402b-a926-3d796990197f",
|                                               "Value":  "Community.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Viva Engage communities",
|                                               "Description":  "Allows the app to create Viva Engage communities and read all community properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c645bb69-adc4-4242-b620-02e635f03bf6",
|                                               "Value":  "ConfigurationMonitoring.Read.All",
|                                               "DisplayName":  "Read all Configuration Monitoring entities",
|                                               "Description":  "Allows the app to read all Configuration Monitoring entities on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "54505ce9-e719-41f7-a7cc-dbe114e1d811",
|                                               "Value":  "ConfigurationMonitoring.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Configuration Monitoring entities",
|                                               "Description":  "Allows the app to read and write all Configuration Monitoring entities on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f2143d35-9b4b-480d-951c-d083e69eeb2c",
|                                               "Value":  "ConsentRequest.Create",
|                                               "DisplayName":  "Create consent requests",
|                                               "Description":  "Allows the app to read create consent requests on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5942b2f6-5a7b-40af-aa37-4b6ea5447506",
|                                               "Value":  "ConsentRequest.Read",
|                                               "DisplayName":  "Read consent requests created by the user",
|                                               "Description":  "Allows the app to read consent requests and approvals created by the signed-in user, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f3bfad56-966e-4590-a536-82ecf548ac1e",
|                                               "Value":  "ConsentRequest.Read.All",
|                                               "DisplayName":  "Read consent requests",
|                                               "Description":  "Allows the app to read consent requests and approvals on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e694a3a1-7878-46d8-8c29-3d195f6589f4",
|                                               "Value":  "ConsentRequest.ReadApprove.All",
|                                               "DisplayName":  "Read and approve consent requests",
|                                               "Description":  "Allows the app to read and approve consent requests on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "497d9dfa-3bd1-481a-baab-90895e54568c",
|                                               "Value":  "ConsentRequest.ReadWrite.All",
|                                               "DisplayName":  "Read and write consent requests",
|                                               "Description":  "Allows the app to read app consent requests and approvals, and deny or approve those requests on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1e4c6c41-0803-4f52-85ef-0a5d63ad8670",
|                                               "Value":  "Contacts-OnPremisesSyncBehavior.ReadWrite.All",
|                                               "DisplayName":  "Read and update the on-premises sync behavior of contacts",
|                                               "Description":  "Allows the app to read and update the on-premises sync behavior of contacts a user has permissions to, including their own and shared contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ff74d97f-43af-4b68-9f2a-b77ee6968c5d",
|                                               "Value":  "Contacts.Read",
|                                               "DisplayName":  "Read user contacts ",
|                                               "Description":  "Allows the app to read user contacts.  "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "242b9d9e-ed24-4d09-9a52-f43769beb9d4",
|                                               "Value":  "Contacts.Read.Shared",
|                                               "DisplayName":  "Read user and shared contacts",
|                                               "Description":  "Allows the app to read contacts a user has permissions to access, including their own and shared contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d56682ec-c09e-4743-aaf4-1a3aac4caa21",
|                                               "Value":  "Contacts.ReadWrite",
|                                               "DisplayName":  "Have full access to user contacts ",
|                                               "Description":  "Allows the app to create, read, update, and delete user contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "afb6c84b-06be-49af-80bb-8f3f77004eab",
|                                               "Value":  "Contacts.ReadWrite.Shared",
|                                               "DisplayName":  "Read and write user and shared contacts",
|                                               "Description":  "Allows the app to create, read, update, and delete contacts a user has permissions to, including their own and shared contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7e2467d1-f874-46bb-828e-24cb06b29d3f",
|                                               "Value":  "Content.Process.All",
|                                               "DisplayName":  "Process content for data security, governance and compliance",
|                                               "Description":  "Allows the app to process and evaluate content for data security, governance and compliance outcomes at tenant scope."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1d787a13-f750-4ad6-875a-fcbd2725596b",
|                                               "Value":  "Content.Process.User",
|                                               "DisplayName":  "Process content for data security, governance and compliance",
|                                               "Description":  "Allows the app to process and evaluate content for data security, governance and compliance outcomes for a user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "62c55b2f-a2b1-4312-8385-be57afd901b4",
|                                               "Value":  "ContentActivity.Read",
|                                               "DisplayName":  "Read contents activity audit log from the audit store.",
|                                               "Description":  "Read contents activity audit log from the audit store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "948caae6-152a-48cd-a746-4844af30e8e9",
|                                               "Value":  "ContentActivity.Write",
|                                               "DisplayName":  "Upload contents activity audit logs to the audit store.",
|                                               "Description":  "Allows the application to upload bulk contents activity audit logs to the audit store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9df4d5b0-7921-4437-9ea8-adf0c9e276dc",
|                                               "Value":  "Contracts.Read.All",
|                                               "DisplayName":  "Read contracts",
|                                               "Description":  "Allows the app to read available properties of contracts, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ed510a02-ac32-45f9-93e6-04864f7f7e47",
|                                               "Value":  "CopilotConversation.Delete",
|                                               "DisplayName":  "Delete Microsoft 365 Copilot conversations",
|                                               "Description":  "Allows the app to delete Microsoft 365 Copilot conversations on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a2dcfcb9-cbe8-4d42-812d-952e55cf7f3f",
|                                               "Value":  "CopilotPackages.Read.All",
|                                               "DisplayName":  "Read all packages information",
|                                               "Description":  "Allows the user to read the packages information"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e9c5fd18-ac15-43dd-9f5c-6f9611dd5604",
|                                               "Value":  "CopilotPackages.ReadWrite.All",
|                                               "DisplayName":  "Read and update all packages information",
|                                               "Description":  "Allows the user to read and update the packages information"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b7281c63-cd4d-40c3-b721-73aa8ee7c3a8",
|                                               "Value":  "CopilotPolicySettings.Read",
|                                               "DisplayName":  "Read Copilot policy settings",
|                                               "Description":  "Allows the app to read Copilot policy settings for the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e2edbde8-4448-4e49-8ebb-d53ba72df0f3",
|                                               "Value":  "CopilotPolicySettings.ReadWrite",
|                                               "DisplayName":  "Read and write Copilot policy settings",
|                                               "Description":  "Allows the app to read and write Copilot policy settings for the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "aeb2982d-632d-4155-b533-18756ab6fdd8",
|                                               "Value":  "CopilotSettings-LimitedMode.Read",
|                                               "DisplayName":  "Read organization-wide copilot limited mode setting",
|                                               "Description":  "Allows the app to read organization-wide copilot limited mode setting on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4704e5b2-0ada-4aa0-b18c-00ad7525bc06",
|                                               "Value":  "CopilotSettings-LimitedMode.ReadWrite",
|                                               "DisplayName":  "Read and write organization-wide copilot limited mode setting",
|                                               "Description":  "Allows the app to read and write organization-wide copilot limited mode setting on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "81594d25-e88e-49cf-ac8c-fecbff49f994",
|                                               "Value":  "CrossTenantInformation.ReadBasic.All",
|                                               "DisplayName":  "Read cross-tenant basic information",
|                                               "Description":  "Allows the application to obtain basic tenant information about another target tenant within the Azure AD ecosystem on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cb1ba48f-d22b-4325-a07f-74135a62ee41",
|                                               "Value":  "CrossTenantUserProfileSharing.Read",
|                                               "DisplayName":  "Read shared cross-tenant user profile and export data",
|                                               "Description":  "Allows the application to list and query user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export external user data (e.g. customer content or system-generated logs), associated with the current tenant on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "759dcd16-3c90-463c-937e-abf89f991c18",
|                                               "Value":  "CrossTenantUserProfileSharing.Read.All",
|                                               "DisplayName":  "Read all shared cross-tenant user profiles and export their data",
|                                               "Description":  "Allows the application to list and query any shared user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eed0129d-dc60-4f30-8641-daf337a39ffd",
|                                               "Value":  "CrossTenantUserProfileSharing.ReadWrite",
|                                               "DisplayName":  "Read shared cross-tenant user profile and export or delete data",
|                                               "Description":  "Allows the application to list and query user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), associated with the current tenant on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "64dfa325-cbf8-48e3-938d-51224a0cac01",
|                                               "Value":  "CrossTenantUserProfileSharing.ReadWrite.All",
|                                               "DisplayName":  "Read all shared cross-tenant user profiles and export or delete their data",
|                                               "Description":  "Allows the application to list and query any shared user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b2052569-c98c-4f36-a5fb-43e5c111e6d0",
|                                               "Value":  "CustomAuthenticationExtension.Read.All",
|                                               "DisplayName":  "Read your organization\u0027s custom authentication extensions",
|                                               "Description":  "Allows the app to read your organization\u0027s custom authentication extensions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8dfcf82f-15d0-43b3-bc78-a958a13a5792",
|                                               "Value":  "CustomAuthenticationExtension.ReadWrite.All",
|                                               "DisplayName":  "Read and write your organization\u0027s custom authentication extensions",
|                                               "Description":  "Allows the app to read or write your organization\u0027s custom authentication extensions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b13ff42e-f321-4d7d-a462-141c46a1b832",
|                                               "Value":  "CustomDetection.Read.All",
|                                               "DisplayName":  "Read custom detection rules",
|                                               "Description":  "Allows the app to read custom detection rules on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c34088fb-0649-4714-af0b-bcbfec155897",
|                                               "Value":  "CustomDetection.ReadWrite.All",
|                                               "DisplayName":  "Read and write custom detection rules",
|                                               "Description":  "Allows the app to read and write custom detection rules on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b46ffa80-fe3d-4822-9a1a-c200932d54d0",
|                                               "Value":  "CustomSecAttributeAssignment.Read.All",
|                                               "DisplayName":  "Read custom security attribute assignments",
|                                               "Description":  "Allows the app to read custom security attribute assignments for all principals in the tenant on behalf of a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ca46335e-8453-47cd-a001-8459884efeae",
|                                               "Value":  "CustomSecAttributeAssignment.ReadWrite.All",
|                                               "DisplayName":  "Read and write custom security attribute assignments",
|                                               "Description":  "Allows the app to read and write custom security attribute assignments for all principals in the tenant on behalf of a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1fcdeaab-b519-44dd-bffc-ed1fd15a24e0",
|                                               "Value":  "CustomSecAttributeAuditLogs.Read.All",
|                                               "DisplayName":  "Read custom security attribute audit logs",
|                                               "Description":  "Allows the app to read audit logs for events that contain information about custom security attributes, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ce026878-a0ff-4745-a728-d4fedd086c07",
|                                               "Value":  "CustomSecAttributeDefinition.Read.All",
|                                               "DisplayName":  "Read custom security attribute definitions",
|                                               "Description":  "Allows the app to read custom security attribute definitions for the tenant on behalf of a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8b0160d4-5743-482b-bb27-efc0a485ca4a",
|                                               "Value":  "CustomSecAttributeDefinition.ReadWrite.All",
|                                               "DisplayName":  "Read and write custom security attribute definitions",
|                                               "Description":  "Allows the app to read and write custom security attribute definitions for the tenant on behalf of a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9ddd870d-077c-49e7-b3e3-6b3012a8a880",
|                                               "Value":  "CustomSecAttributeProvisioning.Read.All",
|                                               "DisplayName":  "Read the provisioning configuration of all active custom security attributes",
|                                               "Description":  "Allows the app to read the provisioning configuration of all active custom security attributes on behalf of a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1140d9e4-6776-433e-a9e4-b9831adbb2e0",
|                                               "Value":  "CustomSecAttributeProvisioning.ReadWrite.All",
|                                               "DisplayName":  "Read and edit the provisioning configuration of all active custom security attributes",
|                                               "Description":  "Allows the app to read and edit the provisioning configuration of all active custom security attributes on behalf of a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "de6ea87d-10bd-467c-8682-d525a0c61b89",
|                                               "Value":  "CustomTags.Read.All",
|                                               "DisplayName":  "Read all custom tags data",
|                                               "Description":  "Read custom tags data on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2f1bbe0a-f34b-4efb-9edb-8db8dcb50eca",
|                                               "Value":  "CustomTags.ReadWrite.All",
|                                               "DisplayName":  "Read and write custom tags data",
|                                               "Description":  "Read and write custom tags data on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0c0064ea-477b-4130-82a5-4c2cc4ff68aa",
|                                               "Value":  "DelegatedAdminRelationship.Read.All",
|                                               "DisplayName":  "Read Delegated Admin relationships with customers",
|                                               "Description":  "Allows the app to read details of delegated admin relationships with customers like access details (that includes roles) and the duration as well as specific role assignments to security groups on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "885f682f-a990-4bad-a642-36736a74b0c7",
|                                               "Value":  "DelegatedAdminRelationship.ReadWrite.All",
|                                               "DisplayName":  "Manage Delegated Admin relationships with customers",
|                                               "Description":  "Allows the app to manage (create-update-terminate) Delegated Admin relationships with customers as well as role assignments to security groups for active Delegated Admin relationships on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a197cdc4-a8e8-4d49-9d35-4ca7c83887b4",
|                                               "Value":  "DelegatedPermissionGrant.Read.All",
|                                               "DisplayName":  "Read delegated permission grants",
|                                               "Description":  "Allows the app to read delegated permission grants, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "41ce6ca6-6826-4807-84f1-1c82854f7ee5",
|                                               "Value":  "DelegatedPermissionGrant.ReadWrite.All",
|                                               "DisplayName":  "Manage all delegated permission grants",
|                                               "Description":  "Allows the app to manage permission grants for delegated permissions exposed by any API (including Microsoft Graph), on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bac3b9c2-b516-4ef4-bd3b-c2ef73d8d804",
|                                               "Value":  "Device.Command",
|                                               "DisplayName":  "Communicate with user devices",
|                                               "Description":  "Allows the app to launch another app or communicate with another app on a user\u0027s device on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "edc92e89-a987-48a9-911a-a7b1967dd7b1",
|                                               "Value":  "Device.CreateFromOwnedTemplate",
|                                               "DisplayName":  "Create devices based on owned device templates",
|                                               "Description":  "Allows the app to create device objects based on device templates owned by the signed-in user, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "11d4cd79-5ba5-460f-803f-e22c8ab85ccd",
|                                               "Value":  "Device.Read",
|                                               "DisplayName":  "Read user devices",
|                                               "Description":  "Allows the app to read a user\u0027s list of devices on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "951183d1-1a61-466f-a6d1-1fde911bfd95",
|                                               "Value":  "Device.Read.All",
|                                               "DisplayName":  "Read all devices",
|                                               "Description":  "Allows the app to read your organization\u0027s devices\u0027 configuration information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "280b3b69-0437-44b1-bc20-3b2fca1ee3e9",
|                                               "Value":  "DeviceLocalCredential.Read.All",
|                                               "DisplayName":  "Read device local credential passwords",
|                                               "Description":  "Allows the app to read device local credential properties including passwords, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9917900e-410b-4d15-846e-42a357488545",
|                                               "Value":  "DeviceLocalCredential.ReadBasic.All",
|                                               "DisplayName":  "Read device local credential properties",
|                                               "Description":  "Allows the app to read device local credential properties excluding passwords, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4edf5f54-4666-44af-9de9-0144fb4b6e8c",
|                                               "Value":  "DeviceManagementApps.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune apps",
|                                               "Description":  "Allows the app to read the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7b3f05d5-f68c-4b8d-8c59-a2ecd12f24af",
|                                               "Value":  "DeviceManagementApps.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune apps",
|                                               "Description":  "Allows the app to read and write the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ac5c8443-d999-471f-9247-ce92cf5c5560",
|                                               "Value":  "DeviceManagementCloudCA.Read.All",
|                                               "DisplayName":  "Read Microsoft Cloud PKI objects",
|                                               "Description":  "Allows the app to read certification authority information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "93028c58-65aa-48db-a706-1fe4ada325ec",
|                                               "Value":  "DeviceManagementCloudCA.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Cloud PKI objects",
|                                               "Description":  "Allows the app to read and write certification authority information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f1493658-876a-4c87-8fa7-edb559b3476a",
|                                               "Value":  "DeviceManagementConfiguration.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune Device Configuration and Policies",
|                                               "Description":  "Allows the app to read properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0883f392-0a7a-443d-8c76-16a6d39c7b63",
|                                               "Value":  "DeviceManagementConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune Device Configuration and Policies",
|                                               "Description":  "Allows the app to read and write properties of Microsoft Intune-managed device configuration and device compliance policies and their assignment to groups."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3404d2bf-2b13-457e-a330-c24615765193",
|                                               "Value":  "DeviceManagementManagedDevices.PrivilegedOperations.All",
|                                               "DisplayName":  "Perform user-impacting remote actions on Microsoft Intune devices",
|                                               "Description":  "Allows the app to perform remote high impact actions such as wiping the device or resetting the passcode on devices managed by Microsoft Intune."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "314874da-47d6-4978-88dc-cf0d37f0bb82",
|                                               "Value":  "DeviceManagementManagedDevices.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune devices",
|                                               "Description":  "Allows the app to read the properties of devices managed by Microsoft Intune."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "44642bfe-8385-4adc-8fc6-fe3cb2c375c3",
|                                               "Value":  "DeviceManagementManagedDevices.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune devices",
|                                               "Description":  "Allows the app to read and write the properties of devices managed by Microsoft Intune. Does not allow high impact operations such as remote wipe and password reset on the device’s owner."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "49f0cc30-024c-4dfd-ab3e-82e137ee5431",
|                                               "Value":  "DeviceManagementRBAC.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune RBAC settings",
|                                               "Description":  "Allows the app to read the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0c5e8a55-87a6-4556-93ab-adc52c4d862d",
|                                               "Value":  "DeviceManagementRBAC.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune RBAC settings",
|                                               "Description":  "Allows the app to read and write the properties relating to the Microsoft Intune Role-Based Access Control (RBAC) settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d32381d8-ee89-4220-9c83-b672aa68d404",
|                                               "Value":  "DeviceManagementScripts.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune Scripts",
|                                               "Description":  "Allows the app to read Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8b9d79d0-ad75-4566-8619-f7500ecfcebe",
|                                               "Value":  "DeviceManagementScripts.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune Scripts",
|                                               "Description":  "Allows the app to read and write Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8696daa5-bce5-4b2e-83f9-51b6defc4e1e",
|                                               "Value":  "DeviceManagementServiceConfig.Read.All",
|                                               "DisplayName":  "Read Microsoft Intune configuration",
|                                               "Description":  "Allows the app to read Microsoft Intune service properties including device enrollment and third party service connection configuration."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "662ed50a-ac44-4eef-ad86-62eed9be2a29",
|                                               "Value":  "DeviceManagementServiceConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write Microsoft Intune configuration",
|                                               "Description":  "Allows the app to read and write Microsoft Intune service properties including device enrollment and third party service connection configuration."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0b1717ff-3e42-4a73-8c29-e6b2e1093960",
|                                               "Value":  "DeviceTemplate.Create",
|                                               "DisplayName":  "Create device templates",
|                                               "Description":  "Allows the app to create device templates on behalf of the signed in user. The user is marked as owners of the created device template. As a member of owners, the user will be allowed to manage devices created from the template."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2bcae0b0-aa93-48e4-a9e4-855482dffdcd",
|                                               "Value":  "DeviceTemplate.Read.All",
|                                               "DisplayName":  "Read all device templates",
|                                               "Description":  "Allows the app to read all device templates, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2d372e98-f1ae-406c-a157-2ea83f6f5e4a",
|                                               "Value":  "DeviceTemplate.ReadWrite.All",
|                                               "DisplayName":  "Read and write all device templates",
|                                               "Description":  "Allows the app to create, read, update and delete the device template, on behalf of the signed in user. It also allows the app to add or remove owners on any device template."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0e263e50-5827-48a4-b97c-d940288653c7",
|                                               "Value":  "Directory.AccessAsUser.All",
|                                               "DisplayName":  "Access directory as the signed in user",
|                                               "Description":  "Allows the app to have the same access to information in the directory as the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "06da0dbc-49e2-44d2-8312-53f166ab848a",
|                                               "Value":  "Directory.Read.All",
|                                               "DisplayName":  "Read directory data",
|                                               "Description":  "Allows the app to read data in your organization\u0027s directory, such as users, groups and apps."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c5366453-9fb0-48a5-a156-24f0c49a4b84",
|                                               "Value":  "Directory.ReadWrite.All",
|                                               "DisplayName":  "Read and write directory data",
|                                               "Description":  "Allows the app to read and write data in your organization\u0027s directory, such as users, and groups.  It does not allow the app to delete users or groups, or reset user passwords."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "34d3bd24-f6a6-468c-b67c-0c365c1d6410",
|                                               "Value":  "DirectoryRecommendations.Read.All",
|                                               "DisplayName":  "Read Azure AD recommendations",
|                                               "Description":  "Allows the app to read Azure AD recommendations, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f37235e8-90a0-4189-93e2-e55b53867ccd",
|                                               "Value":  "DirectoryRecommendations.ReadWrite.All",
|                                               "DisplayName":  "Read and update Azure AD recommendations",
|                                               "Description":  "Allows the app to read and update Azure AD recommendations, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "33203a2a-a761-40f0-8a7c-a7e74a9f8ac6",
|                                               "Value":  "Domain-InternalFederation.Read.All",
|                                               "DisplayName":  "Read internal federation configuration for a domain.",
|                                               "Description":  "Allows the app to read internal federation configuration for a domain."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "857bd3ea-490e-4284-88a7-a7de1893b6ee",
|                                               "Value":  "Domain-InternalFederation.ReadWrite.All",
|                                               "DisplayName":  "Create, read, update and delete internal federation configuration for a domain.",
|                                               "Description":  "Allows the app to create, read, update and delete internal federation configuration for a domain."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2f9ee017-59c1-4f1d-9472-bd5529a7b311",
|                                               "Value":  "Domain.Read.All",
|                                               "DisplayName":  "Read domains.",
|                                               "Description":  "Allows the app to read all domain properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0b5d694c-a244-4bde-86e6-eb5cd07730fe",
|                                               "Value":  "Domain.ReadWrite.All",
|                                               "DisplayName":  "Read and write domains",
|                                               "Description":  "Allows the app to read and write all domain properties on behalf of the signed-in user. Also allows the app to add, verify and remove domains."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ff91d191-45a0-43fd-b837-bd682c4a0b0f",
|                                               "Value":  "EAS.AccessAsUser.All",
|                                               "DisplayName":  "Access mailboxes via Exchange ActiveSync",
|                                               "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via Exchange ActiveSync."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "99201db3-7652-4d5a-809a-bdb94f85fe3c",
|                                               "Value":  "eDiscovery.Read.All",
|                                               "DisplayName":  "Read all eDiscovery objects",
|                                               "Description":  "Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "acb8f680-0834-4146-b69e-4ab1b39745ad",
|                                               "Value":  "eDiscovery.ReadWrite.All",
|                                               "DisplayName":  "Read and write all eDiscovery objects",
|                                               "Description":  "Allows the app to read and write eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8523895c-6081-45bf-8a5d-f062a2f12c9f",
|                                               "Value":  "EduAdministration.Read",
|                                               "DisplayName":  "Read education app settings",
|                                               "Description":  "Read the state and settings of all Microsoft education apps on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "63589852-04e3-46b4-bae9-15d5b1050748",
|                                               "Value":  "EduAdministration.ReadWrite",
|                                               "DisplayName":  "Manage education app settings",
|                                               "Description":  "Manage the state and settings of all Microsoft education apps on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "091460c9-9c4a-49b2-81ef-1f3d852acce2",
|                                               "Value":  "EduAssignments.Read",
|                                               "DisplayName":  "Read users\u0027 class assignments and their grades",
|                                               "Description":  "Allows the app to read assignments and their grades on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c0b0103b-c053-4b2e-9973-9f3a544ec9b8",
|                                               "Value":  "EduAssignments.ReadBasic",
|                                               "DisplayName":  "Read users\u0027 class assignments without grades",
|                                               "Description":  "Allows the app to read assignments without grades on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2f233e90-164b-4501-8bce-31af2559a2d3",
|                                               "Value":  "EduAssignments.ReadWrite",
|                                               "DisplayName":  "Read and write users\u0027 class assignments and their grades",
|                                               "Description":  "Allows the app to read and write assignments and their grades on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2ef770a1-622a-47c4-93ee-28d6adbed3a0",
|                                               "Value":  "EduAssignments.ReadWriteBasic",
|                                               "DisplayName":  "Read and write users\u0027 class assignments without grades",
|                                               "Description":  "Allows the app to read and write assignments without grades on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "484859e8-b9e2-4e92-b910-84db35dadd29",
|                                               "Value":  "EduCurricula.Read",
|                                               "DisplayName":  "Read the user\u0027s class modules and resources",
|                                               "Description":  "Allows the app to read the user\u0027s modules and resources on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4793c53b-df34-44fd-8d26-d15c517732f5",
|                                               "Value":  "EduCurricula.ReadWrite",
|                                               "DisplayName":  "Read and write the user\u0027s class modules and resources",
|                                               "Description":  "Allows the app to read and write user\u0027s modules and resources on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a4389601-22d9-4096-ac18-36a927199112",
|                                               "Value":  "EduRoster.Read",
|                                               "DisplayName":  "Read users\u0027 view of the roster",
|                                               "Description":  "Allows the app to read the structure of schools and classes in an organization\u0027s roster and education-specific information about users to be read on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5d186531-d1bf-4f07-8cea-7c42119e1bd9",
|                                               "Value":  "EduRoster.ReadBasic",
|                                               "DisplayName":  "Read a limited subset of users\u0027 view of the roster",
|                                               "Description":  "Allows the app to read a limited subset of the properties from the structure of schools and classes in an organization\u0027s roster and a limited subset of properties about users to be read on behalf of the user. Includes name, status, education role, email address and photo."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "359e19a6-e3fa-4d7f-bcab-d28ec592b51e",
|                                               "Value":  "EduRoster.ReadWrite",
|                                               "DisplayName":  "Read and write users\u0027 view of the roster",
|                                               "Description":  "Allows the app to read and write the structure of schools and classes in an organization\u0027s roster and education-specific information about users to be read and written on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "64a6cdd6-aab1-4aaf-94b8-3cc8405e90d0",
|                                               "Value":  "email",
|                                               "DisplayName":  "View users\u0027 email address",
|                                               "Description":  "Allows the app to read your users\u0027 primary email address"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c55541d9-2cdd-4fad-8ead-0c08fae5b0c8",
|                                               "Value":  "EngagementConversation.Read.All",
|                                               "DisplayName":  "Read all Viva Engage conversations",
|                                               "Description":  "Allows the app to read Viva Engage conversations, and to read their properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ebbfd079-1634-4640-8618-68b19ebbed1d",
|                                               "Value":  "EngagementConversation.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Viva Engage conversations",
|                                               "Description":  "Allows the app to create Viva Engage conversations and read all conversation properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "58c5819e-29bd-4400-ad52-82cd82a63fbd",
|                                               "Value":  "EngagementMeetingConversation.Read.All",
|                                               "DisplayName":  "Read all Viva Engage Teams QA conversations",
|                                               "Description":  "Allows the app to read Viva Engage Teams QA conversations, and to read their properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9f1da0fc-345c-4dfb-bab5-5215a073a417",
|                                               "Value":  "EngagementRole.Read",
|                                               "DisplayName":  "Read a user\u0027s Viva Engage roles ",
|                                               "Description":  "Allows the app to list a user\u0027s Viva Engage roles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3cad91a5-8413-4c4a-acfe-dfeb83d1366d",
|                                               "Value":  "EngagementRole.Read.All",
|                                               "DisplayName":  "Read all Viva Engage roles and role memberships",
|                                               "Description":  "Allows the app to list all Viva Engage roles and role memberships on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4905982d-6459-4ccd-949c-949fefc0a8f2",
|                                               "Value":  "EngagementRole.ReadWrite.All",
|                                               "DisplayName":  "Modify Viva Engage role membership",
|                                               "Description":  "Allows the app to assign Viva Engage role to a user, and remove a Viva Engage role from a user behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5449aa12-1393-4ea2-a7c7-d0e06c1a56b2",
|                                               "Value":  "EntitlementManagement.Read.All",
|                                               "DisplayName":  "Read all entitlement management resources",
|                                               "Description":  "Allows the app to read access packages and related entitlement management resources on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ae7a573d-81d7-432b-ad44-4ed5c9d89038",
|                                               "Value":  "EntitlementManagement.ReadWrite.All",
|                                               "DisplayName":  "Read and write entitlement management resources",
|                                               "Description":  "Allows the app to request access to and management of access packages and related entitlement management resources on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e9fdcbbb-8807-410f-b9ec-8d5468c7c2ac",
|                                               "Value":  "EntitlementMgmt-SubjectAccess.ReadWrite",
|                                               "DisplayName":  "Read and write entitlement management resources related to self-service operations",
|                                               "Description":  "Allows the app to manage self-service entitlement management resources on behalf of the signed-in user.  This includes operations such as requesting access and approving access of others."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a6ea9dd7-4dd9-4484-a80a-ac9ad981dcf1",
|                                               "Value":  "EntraBackup.Read.All",
|                                               "DisplayName":  "Read Preview jobs and snapshots",
|                                               "Description":  "Allows the app to list the all the snapshots, jobs and enumerate the changes of a specific preview job, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cef123a8-c18c-4eba-852e-d90cfbf67c91",
|                                               "Value":  "EntraBackup.ReadWrite.Preview",
|                                               "DisplayName":  "Create a preview job, read preview job and snapshots",
|                                               "Description":  "Allows the app to  list the all the snapshots, create a preview job and enumerate the changes of a specific preview job, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8269c6ff-41d7-4172-a783-b2ce38322e42",
|                                               "Value":  "EntraBackup.ReadWrite.Recovery",
|                                               "DisplayName":  "Create preview and recovery job, read recovery job and snapshots",
|                                               "Description":  "Allows the app to  list the all the snapshots, create a recovery job and enumerate the changes of a specific recovery job, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f7dd3bed-5eec-48da-bc73-1c0ef50bc9a1",
|                                               "Value":  "EventListener.Read.All",
|                                               "DisplayName":  "Read your organization\u0027s authentication event listeners",
|                                               "Description":  "Allows the app to read your organization\u0027s authentication event listeners on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d11625a6-fe21-4fc6-8d3d-063eba5525ad",
|                                               "Value":  "EventListener.ReadWrite.All",
|                                               "DisplayName":  "Read and write your organization\u0027s authentication event listeners",
|                                               "Description":  "Allows the app to read or write your organization\u0027s authentication event listeners on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9769c687-087d-48ac-9cb3-c37dde652038",
|                                               "Value":  "EWS.AccessAsUser.All",
|                                               "DisplayName":  "Access mailboxes as the signed-in user via Exchange Web Services",
|                                               "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via Exchange Web Services."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b2e7d27e-14e7-41ad-bb15-a88ceb9c3e90",
|                                               "Value":  "ExchangeMessageTrace.Read.All",
|                                               "DisplayName":  "Search the email message trace",
|                                               "Description":  "Allows the app to search the email message trace on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a38267a5-26b6-4d76-9493-935b7599116b",
|                                               "Value":  "ExternalConnection.Read.All",
|                                               "DisplayName":  "Read all external connections",
|                                               "Description":  "Allows the app to read all external connections on behalf of a signed-in user. The signed-in user must be an administrator."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bbbbd9b3-3566-4931-ac37-2b2180d9e334",
|                                               "Value":  "ExternalConnection.ReadWrite.All",
|                                               "DisplayName":  "Read and write all external connections",
|                                               "Description":  "Allows the app to read and write all external connections on behalf of a signed-in user. The signed-in user must be an administrator."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4082ad95-c812-4f02-be92-780c4c4f1830",
|                                               "Value":  "ExternalConnection.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Read and write external connections",
|                                               "Description":  "Allows the app to read and write settings of external connections on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read and write settings of connections that it is authorized to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "922f9392-b1b7-483c-a4be-0089be7704fb",
|                                               "Value":  "ExternalItem.Read.All",
|                                               "DisplayName":  "Read items in external datasets",
|                                               "Description":  "Allow the app to read external datasets and content, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b02c54f8-eb48-4c50-a9f0-a149e5a2012f",
|                                               "Value":  "ExternalItem.ReadWrite.All",
|                                               "DisplayName":  "Read and write all external items",
|                                               "Description":  "Allows the app to read and write all external items on behalf of a signed-in user. The signed-in user must be an administrator."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4367b9d7-cee7-4995-853c-a0bdfe95c1f9",
|                                               "Value":  "ExternalItem.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Read and write external items",
|                                               "Description":  "Allows the app to read and write external items on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read external items of the connection that it is authorized to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "47167bec-55a7-4caf-9ecc-8d4566e3cfb1",
|                                               "Value":  "ExternalUserProfile.Read.All",
|                                               "DisplayName":  "Read external user profiles",
|                                               "Description":  "Allows the app to read available properties of external user profiles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c6068dc7-a791-46a4-a811-b8228e6649ab",
|                                               "Value":  "ExternalUserProfile.ReadWrite.All",
|                                               "DisplayName":  "Read and write external user profiles",
|                                               "Description":  "Allows the app to read and write available properties of external user profiles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3a1e4806-a744-4c70-80fc-223bf8582c46",
|                                               "Value":  "Family.Read",
|                                               "DisplayName":  "Read your family info",
|                                               "Description":  "Allows the app to read your family information, members and their basic profile."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "10465720-29dd-4523-a11a-6a75c743c9d9",
|                                               "Value":  "Files.Read",
|                                               "DisplayName":  "Read user files",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s files."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "df85f4d6-205c-4ac5-a5ea-6bf408dba283",
|                                               "Value":  "Files.Read.All",
|                                               "DisplayName":  "Read all files that user can access",
|                                               "Description":  "Allows the app to read all files the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5447fe39-cb82-4c1a-b977-520e67e724eb",
|                                               "Value":  "Files.Read.Selected",
|                                               "DisplayName":  "Read files that the user selects (preview)",
|                                               "Description":  "(Preview) Allows the app to read files that the user selects. The app has access for several hours after the user selects a file."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5c28f0bf-8a70-41f1-8ab2-9032436ddb65",
|                                               "Value":  "Files.ReadWrite",
|                                               "DisplayName":  "Have full access to user files",
|                                               "Description":  "Allows the app to read, create, update and delete the signed-in user\u0027s files."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "863451e7-0667-486c-a5d6-d135439485f0",
|                                               "Value":  "Files.ReadWrite.All",
|                                               "DisplayName":  "Have full access to all files user can access",
|                                               "Description":  "Allows the app to read, create, update and delete all files the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8019c312-3263-48e6-825e-2b833497195b",
|                                               "Value":  "Files.ReadWrite.AppFolder",
|                                               "DisplayName":  "Have full access to the application\u0027s folder (preview)",
|                                               "Description":  "(Preview) Allows the app to read, create, update and delete files in the application\u0027s folder."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "17dde5bd-8c17-420f-a486-969730c1b827",
|                                               "Value":  "Files.ReadWrite.Selected",
|                                               "DisplayName":  "Read and write files that the user selects (preview)",
|                                               "Description":  "(Preview) Allows the app to read and write files that the user selects. The app has access for several hours after the user selects a file."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ef2779dc-ef1b-4211-8310-8a0ac2450081",
|                                               "Value":  "Files.SelectedOperations.Selected",
|                                               "DisplayName":  "Access selected Files, on behalf of the signed-in user",
|                                               "Description":  "Allow the application to access files explicitly permissioned to the application on behalf of the signed in user.  The specific files and the permissions granted will be configured in SharePoint Online or OneDrive."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "527b6d64-cdf5-4b8b-b336-4aa0b8ca2ce5",
|                                               "Value":  "FileStorageContainer.Manage.All",
|                                               "DisplayName":  "Manage all file storage containers",
|                                               "Description":  "Allows the application to utilize the file storage container administration capabilities on behalf of an administrator user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "085ca537-6565-41c2-aca7-db852babc212",
|                                               "Value":  "FileStorageContainer.Selected",
|                                               "DisplayName":  "Access selected file storage containers",
|                                               "Description":  "Allows the application to utilize the file storage container platform to manage containers on behalf of the signed in user. The specific file storage containers and the permissions granted to them will be configured in Microsoft 365 by the developer of each container type."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8e6ec84c-5fcd-4cc7-ac8a-2296efc0ed9b",
|                                               "Value":  "FileStorageContainerType.Manage.All",
|                                               "DisplayName":  "Manage file storage container types on behalf of the signed in user",
|                                               "Description":  "Allows the application to manage file storage container types on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c319a7df-930e-44c0-a43b-7e5e9c7f4f24",
|                                               "Value":  "FileStorageContainerTypeReg.Manage.All",
|                                               "DisplayName":  "Manage file storage container type registrations on behalf of the signed in user",
|                                               "Description":  "Allows the application to manage file storage container type registrations on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d1e4f63a-1569-475c-b9b2-bdc140405e38",
|                                               "Value":  "FileStorageContainerTypeReg.Selected",
|                                               "DisplayName":  "Access selected file storage container type registrations.",
|                                               "Description":  "Allows the application to manage selected file storage container type registrations on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f534bf13-55d4-45a9-8f3c-c92fe64d6131",
|                                               "Value":  "Financials.ReadWrite.All",
|                                               "DisplayName":  "Read and write financials data",
|                                               "Description":  "Allows the app to read and write financials data on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "092211d9-ca1a-427b-813e-b79c7653fe71",
|                                               "Value":  "Goals-Export.Read.All",
|                                               "DisplayName":  "Read all goals and export jobs that a user can access",
|                                               "Description":  "Allows the app to read all goals and export jobs that the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2edeb9fd-4228-480c-a26d-2ed52011cf3d",
|                                               "Value":  "Goals-Export.ReadWrite.All",
|                                               "DisplayName":  "Have full access to all goals and export jobs a user can access",
|                                               "Description":  "Allows the app to read goals, create and read export jobs that the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c92fbbc2-50e0-4842-93ef-385c3293ea3d",
|                                               "Value":  "Group-Conversation.Read.All",
|                                               "DisplayName":  "Read group conversations",
|                                               "Description":  "Allows the app to read group conversations that the signed-in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "302bcbb5-855a-4e49-ae20-94a331b0281e",
|                                               "Value":  "Group-Conversation.ReadWrite.All",
|                                               "DisplayName":  "Read and write group conversations",
|                                               "Description":  "Allows the app to read and write group conversations that the signed-in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "afc507db-8793-4d2f-999d-6e34cff02b7c",
|                                               "Value":  "Group-NestingSupport.ReadWrite.All",
|                                               "DisplayName":  "Read and write groups\u0027 disableNesting property",
|                                               "Description":  "Allows the app to read and write groups\u0027 disableNesting property on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "37e00479-5776-4659-aecf-4841ec5d590a",
|                                               "Value":  "Group-OnPremisesSyncBehavior.ReadWrite.All",
|                                               "DisplayName":  "Read and update the on-premises sync behavior of groups",
|                                               "Description":  "Allows the app to read and update the on-premises sync behavior of groups on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5f8c59db-677d-491f-a6b8-5f174b11ec1d",
|                                               "Value":  "Group.Read.All",
|                                               "DisplayName":  "Read all groups",
|                                               "Description":  "Allows the app to list groups, and to read their properties and all group memberships on behalf of the signed-in user.  Also allows the app to read calendar, conversations, files, and other group content for all groups the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4e46008b-f24c-477d-8fff-7bb4ec7aafe0",
|                                               "Value":  "Group.ReadWrite.All",
|                                               "DisplayName":  "Read and write all groups",
|                                               "Description":  "Allows the app to create groups and read all group properties and memberships on behalf of the signed-in user.  Additionally allows group owners to manage their groups and allows group members to update group content."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bc024368-1153-4739-b217-4326f2e966d0",
|                                               "Value":  "GroupMember.Read.All",
|                                               "DisplayName":  "Read group memberships",
|                                               "Description":  "Allows the app to list groups, read basic group properties and read membership of all groups the signed-in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f81125ac-d3b7-4573-a3b2-7099cc39df9e",
|                                               "Value":  "GroupMember.ReadWrite.All",
|                                               "DisplayName":  "Read and write group memberships",
|                                               "Description":  "Allows the app to list groups, read basic properties, read and update the membership of the groups the signed-in user has access to. Group properties and owners cannot be updated and groups cannot be deleted."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2eb2bc92-94ef-4c6b-b4ab-2a09bc975e0e",
|                                               "Value":  "GroupSettings.Read.All",
|                                               "DisplayName":  "Read all group settings that user can access",
|                                               "Description":  "Allows the app to read a list of tenant-level or group-specific group settings objects, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c1691a6d-99e2-4cfa-b4b5-9e4d67dc0f36",
|                                               "Value":  "GroupSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write all group settings that user can access",
|                                               "Description":  "Allows the app to create, read, update, and delete on the list of tenant-level or group-specific group settings objects that you have access to in the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "74b4ff32-4917-4536-a66d-38a4861e6220",
|                                               "Value":  "HealthMonitoringAlert.Read.All",
|                                               "DisplayName":  "Read all scenario health monitoring alerts",
|                                               "Description":  "Allows the app to read all scenario health monitoring alerts"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b7c60f27-2195-4d5f-96a7-6b98bdfd9664",
|                                               "Value":  "HealthMonitoringAlert.ReadWrite.All",
|                                               "DisplayName":  "Read and write all scenario monitoring alerts",
|                                               "Description":  "Allows the app to read and write all scenario monitoring alerts, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fb873030-8626-47e6-96ff-8a5bff3b725f",
|                                               "Value":  "HealthMonitoringAlertConfig.Read.All",
|                                               "DisplayName":  "Read all scenario health monitoring alert configurations",
|                                               "Description":  "Allows the app to read all scenario health monitoring alert configurations"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b3e5ebc6-1c23-4337-8286-3f27165addb4",
|                                               "Value":  "HealthMonitoringAlertConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write all scenario monitoring alert configurations.",
|                                               "Description":  "Allows the app to read and write all scenario monitoring alert configurations, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "43781733-b5a7-4d1b-98f4-e8edff23e1a9",
|                                               "Value":  "IdentityProvider.Read.All",
|                                               "DisplayName":  "Read identity providers",
|                                               "Description":  "Allows the app to read your organization’s identity (authentication) providers’ properties on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f13ce604-1677-429f-90bd-8a10b9f01325",
|                                               "Value":  "IdentityProvider.ReadWrite.All",
|                                               "DisplayName":  "Read and write identity providers",
|                                               "Description":  "Allows the app to read and write your organization’s identity (authentication) providers’ properties on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8f6a01e7-0391-4ee5-aa22-a3af122cef27",
|                                               "Value":  "IdentityRiskEvent.Read.All",
|                                               "DisplayName":  "Read identity risk event information",
|                                               "Description":  "Allows the app to read identity risk event information for all users in your organization on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9e4862a5-b68f-479e-848a-4e07e25c9916",
|                                               "Value":  "IdentityRiskEvent.ReadWrite.All",
|                                               "DisplayName":  "Read and write risk event information",
|                                               "Description":  "Allows the app to read and update identity risk event information for all users in your organization on behalf of the signed-in user. Update operations include confirming risk event detections. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3215c57f-3faa-4295-95c2-6f14a5bc6124",
|                                               "Value":  "IdentityRiskyAgent.Read.All",
|                                               "DisplayName":  "Read risky agents information",
|                                               "Description":  "Allows the app to read risky agents information in your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d343bdeb-db6a-4e06-97da-9dafc2d61c60",
|                                               "Value":  "IdentityRiskyAgent.ReadWrite.All",
|                                               "DisplayName":  "Read and write risky agents information",
|                                               "Description":  "Allows the app to read and update identity risky agents information for all agents in your organization on behalf of the signed-in user. Update operations include dismissing risky agents."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ea5c4ab0-5a73-4f35-8272-5d5337884e5d",
|                                               "Value":  "IdentityRiskyServicePrincipal.Read.All",
|                                               "DisplayName":  "Read all identity risky service principal information",
|                                               "Description":  "Allows the app to read all identity risky service principal information for your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bb6f654c-d7fd-4ae3-85c3-fc380934f515",
|                                               "Value":  "IdentityRiskyServicePrincipal.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity risky service principal information",
|                                               "Description":  "Allows the app to read and update identity risky service principal information for all service principals in your organization, on behalf of the signed-in user. Update operations include dismissing risky service principals."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d04bb851-cb7c-4146-97c7-ca3e71baf56c",
|                                               "Value":  "IdentityRiskyUser.Read.All",
|                                               "DisplayName":  "Read identity risky user information",
|                                               "Description":  "Allows the app to read identity risky user information for all users in your organization on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e0a7cdbb-08b0-4697-8264-0069786e9674",
|                                               "Value":  "IdentityRiskyUser.ReadWrite.All",
|                                               "DisplayName":  "Read and write risky user information",
|                                               "Description":  "Allows the app to read and update identity risky user information for all users in your organization on behalf of the signed-in user. Update operations include dismissing risky users."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2903d63d-4611-4d43-99ce-a33f3f52e343",
|                                               "Value":  "IdentityUserFlow.Read.All",
|                                               "DisplayName":  "Read all identity user flows",
|                                               "Description":  "Allows the app to read your organization\u0027s user flows, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "281892cc-4dbf-4e3a-b6cc-b21029bb4e82",
|                                               "Value":  "IdentityUserFlow.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity user flows",
|                                               "Description":  "Allows the app to read or write your organization\u0027s user flows, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "652390e4-393a-48de-9484-05f9b1212954",
|                                               "Value":  "IMAP.AccessAsUser.All",
|                                               "DisplayName":  "Read and write access to mailboxes via IMAP.",
|                                               "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via IMAP protocol."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d19c0de5-7ecb-4aba-b090-da35ebcd5425",
|                                               "Value":  "IndustryData-DataConnector.Read.All",
|                                               "DisplayName":  "View data connector definitions",
|                                               "Description":  "Allows the app to read data connectors on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5ce933ac-3997-4280-aed0-cc072e5c062a",
|                                               "Value":  "IndustryData-DataConnector.ReadWrite.All",
|                                               "DisplayName":  "Manage data connector definitions",
|                                               "Description":  "Allows the app to read and write data connectors on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fc47391d-ab2c-410f-9059-5600f7af660d",
|                                               "Value":  "IndustryData-DataConnector.Upload",
|                                               "DisplayName":  "Upload files to a data connector",
|                                               "Description":  "Allows the app to upload data files to a data connector on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cb0774da-a605-42af-959c-32f438fb38f4",
|                                               "Value":  "IndustryData-InboundFlow.Read.All",
|                                               "DisplayName":  "View inbound flow definitions",
|                                               "Description":  "Allows the app to read inbound data flows on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "97044676-2cec-40ee-bd70-38df444c9e70",
|                                               "Value":  "IndustryData-InboundFlow.ReadWrite.All",
|                                               "DisplayName":  "Manage inbound flow definitions",
|                                               "Description":  "Allows the app to read and write inbound data flows on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4741a003-8952-4be4-9217-33a0ac327122",
|                                               "Value":  "IndustryData-OutboundFlow.Read.All",
|                                               "DisplayName":  "View outbound flow definitions",
|                                               "Description":  "Allows the app to read outbound data flows on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "aeb68e0b-e562-4a1f-b6dd-3484ad0cbb4b",
|                                               "Value":  "IndustryData-OutboundFlow.ReadWrite.All",
|                                               "DisplayName":  "Manage outbound flow definitions",
|                                               "Description":  "Allows the app to read and write outbound data flows on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a3f96ffe-cb84-40a8-ac85-582d7ef97c2a",
|                                               "Value":  "IndustryData-ReferenceDefinition.Read.All",
|                                               "DisplayName":  "View reference definitions",
|                                               "Description":  "Allows the app to read reference definitions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a757d430-be6d-430f-af57-28aabe79d247",
|                                               "Value":  "IndustryData-ReferenceDefinition.ReadWrite.All",
|                                               "DisplayName":  "Manage reference definitions",
|                                               "Description":  "Allows the app to read and write reference definitions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "92685235-50c4-4702-b2c8-36043db6fa79",
|                                               "Value":  "IndustryData-Run.Read.All",
|                                               "DisplayName":  "View current and previous runs",
|                                               "Description":  "Allows the app to read current and previous IndustryData runs on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f03a6d0e-0989-460f-80b2-e57c8561763e",
|                                               "Value":  "IndustryData-Run.Start",
|                                               "DisplayName":  "View and start runs",
|                                               "Description":  "Allows the app to view and start IndustryData runs on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "49b7016c-89ae-41e7-bd6f-b7170c5490bf",
|                                               "Value":  "IndustryData-SourceSystem.Read.All",
|                                               "DisplayName":  "View source system definitions",
|                                               "Description":  "Allows the app to read source system definitions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9599f005-05d6-4ea7-b1b1-4929768af5d0",
|                                               "Value":  "IndustryData-SourceSystem.ReadWrite.All",
|                                               "DisplayName":  "Manage source system definitions",
|                                               "Description":  "Allows the app to read and write source system definitions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c9d51f28-8ccd-42b2-a836-fd8fe9ebf2ae",
|                                               "Value":  "IndustryData-TimePeriod.Read.All",
|                                               "DisplayName":  "Read time period definitions",
|                                               "Description":  "Allows the app to read time period definitions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b6d56528-3032-4f9d-830f-5a24a25e6661",
|                                               "Value":  "IndustryData-TimePeriod.ReadWrite.All",
|                                               "DisplayName":  "Manage time period definitions",
|                                               "Description":  "Allows the app to read and write time period definitions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "60382b96-1f5e-46ea-a544-0407e489e588",
|                                               "Value":  "IndustryData.ReadBasic.All",
|                                               "DisplayName":  "Read basic Industry Data service and resource definitions",
|                                               "Description":  "Allows the app to read basic Industry Data service and resource information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "12f4bffb-b598-413c-984b-db99728f8b54",
|                                               "Value":  "InformationProtectionConfig.Read",
|                                               "DisplayName":  "Read configurations for protecting organizational data applicable to the user",
|                                               "Description":  "Allows the app to read the configurations applicable to the signed-in user for protecting organizational data, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4ad84827-5578-4e18-ad7a-86530b12f884",
|                                               "Value":  "InformationProtectionPolicy.Read",
|                                               "DisplayName":  "Read user sensitivity labels and label policies.",
|                                               "Description":  "Allows an app to read information protection sensitivity labels and label policy settings, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7d249730-51a3-4180-8ec1-214f144f1bff",
|                                               "Value":  "Insights-UserMetric.Read.All",
|                                               "DisplayName":  "Read user metrics insights",
|                                               "Description":  "Allows an app to read user metrics insights, such as daily and monthly active users, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ac08cdae-e845-41db-adf9-5899a0ec9ef6",
|                                               "Value":  "LearningAssignedCourse.Read",
|                                               "DisplayName":  "Read user\u0027s assignments",
|                                               "Description":  "Allows the app to read data for the learner\u0027s assignments in the organization\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ea4c1fd9-6a9f-4432-8e5d-86e06cc0da77",
|                                               "Value":  "LearningContent.Read.All",
|                                               "DisplayName":  "Read learning content",
|                                               "Description":  "Allows the app to read learning content in the organization\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "53cec1c4-a65f-4981-9dc1-ad75dbf1c077",
|                                               "Value":  "LearningContent.ReadWrite.All",
|                                               "DisplayName":  "Manage learning content",
|                                               "Description":  "Allows the app to manage learning content in the organization\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dd8ce36f-9245-45ea-a99e-8ac398c22861",
|                                               "Value":  "LearningProvider.Read",
|                                               "DisplayName":  "Read learning provider",
|                                               "Description":  "Allows the app to read data for the learning provider in the organization\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "40c2eb57-abaf-49f5-9331-e90fd01f7130",
|                                               "Value":  "LearningProvider.ReadWrite",
|                                               "DisplayName":  "Manage learning provider",
|                                               "Description":  "Allows the app to create, update, read, and delete data for the learning provider in the organization\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f6403ef7-4a96-47be-a190-69ba274c3f11",
|                                               "Value":  "LearningSelfInitiatedCourse.Read",
|                                               "DisplayName":  "Read user\u0027s self-initiated courses",
|                                               "Description":  "Allows the app to read data for the learner\u0027s self-initiated courses in the organization\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f395577a-0960-456b-979f-7228de0c5996",
|                                               "Value":  "LicenseAssignment.Read.All",
|                                               "DisplayName":  "Read all license assignments.",
|                                               "Description":  "Allows an app to read license assignments for users and groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f55016cc-149c-447e-8f21-7cf3ec1d6350",
|                                               "Value":  "LicenseAssignment.ReadWrite.All",
|                                               "DisplayName":  "Manage all license assignments",
|                                               "Description":  "Allows an app to manage license assignments for users and groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2973a298-1d69-4f87-8d30-7025f0ec19d7",
|                                               "Value":  "LifecycleWorkflows-CustomExt.Read.All",
|                                               "DisplayName":  "Read all Lifecycle workflows custom task extensions",
|                                               "Description":  "Allows the app to read all Lifecycle workflows custom task extensions on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ef6bafb1-3019-4a22-a332-103aff92225f",
|                                               "Value":  "LifecycleWorkflows-CustomExt.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Lifecycle workflows custom task extensions",
|                                               "Description":  "Allows the app to create, update, list, read and delete all Lifecycle workflows custom task extensions on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4d3d7f81-163f-426a-8432-5638d2e82083",
|                                               "Value":  "LifecycleWorkflows-Reports.Read.All",
|                                               "DisplayName":  "Read all Lifecycle workflows reports",
|                                               "Description":  "Allows the app to read all Lifecycle workflows reports on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "df1c25b3-072c-45cd-8403-c63441e4cca1",
|                                               "Value":  "LifecycleWorkflows-Workflow.Activate",
|                                               "DisplayName":  "Run workflows on-demand in Lifecycle workflows",
|                                               "Description":  "Allows the app to run workflows on-demand on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7fabe5bd-2e47-4e61-b924-327117024e18",
|                                               "Value":  "LifecycleWorkflows-Workflow.Read.All",
|                                               "DisplayName":  "Read all workflows in Lifecycle workflows",
|                                               "Description":  "Allows the app to list and read all workflows and tasks on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "789c445d-433c-4575-a1fc-367a58a1bd4a",
|                                               "Value":  "LifecycleWorkflows-Workflow.ReadBasic.All",
|                                               "DisplayName":  "List all workflows in Lifecycle workflows",
|                                               "Description":  "Allows the app to list all workflows on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "29e49f0c-a053-4cc5-a4b1-7da0c8c1e643",
|                                               "Value":  "LifecycleWorkflows-Workflow.ReadWrite.All",
|                                               "DisplayName":  "Read and write all workflows in Lifecycle workflows",
|                                               "Description":  "Allows the app to create, update, list, read and delete all workflows and tasks in lifecycle workflows on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9bcb9916-765a-42af-bf77-02282e26b01a",
|                                               "Value":  "LifecycleWorkflows.Read.All",
|                                               "DisplayName":  "Read all lifecycle workflows resources",
|                                               "Description":  "Allows the app to list and read all workflows, tasks and related lifecycle workflows resources on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "84b9d731-7db8-4454-8c90-fd9e95350179",
|                                               "Value":  "LifecycleWorkflows.ReadWrite.All",
|                                               "DisplayName":  "Read and write all lifecycle workflows resources",
|                                               "Description":  "Allows the app to create, update, list, read and delete all workflows, tasks and related lifecycle workflows resources on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d6d361b3-211a-4191-9fa7-15f72de4aac4",
|                                               "Value":  "ListItems.SelectedOperations.Selected",
|                                               "DisplayName":  "Access selected ListItems, on behalf of the signed-in user",
|                                               "Description":  "Allow the application to access a subset of listitems on behalf of the signed in user.  The specific listitems and the permissions granted will be configured in SharePoint Online."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "033b51ee-d6fa-4add-b627-ee680c7212b5",
|                                               "Value":  "Lists.SelectedOperations.Selected",
|                                               "DisplayName":  "Access selected Lists, on behalf of the signed-in user",
|                                               "Description":  "Allow the application to access a subset of lists on behalf of the signed in user.  The specific lists and the permissions granted will be configured in SharePoint Online."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f3af82f6-18e0-4a41-8dc8-a03c11854a8d",
|                                               "Value":  "Mail-Advanced.ReadWrite",
|                                               "DisplayName":  "Read and write the user\u0027s mail, including modifying existing non-draft mails",
|                                               "Description":  "Allows the app to create, read, update, and delete email, including contents of non-draft emails in user mailboxes, on behalf of the signed-in user. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bebf0bb6-2ff3-4295-a17d-f3561da294fb",
|                                               "Value":  "Mail-Advanced.ReadWrite.Shared",
|                                               "DisplayName":  "Read and write all mail the user can access, including modifying existing non-draft mails",
|                                               "Description":  "Allows the app to create, read, update, and delete mail including contents of non-draft emails for all mails a user has permission to access, on behalf of the signed-in user. This includes their own and shared mail. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "570282fd-fa5c-430d-a7fd-fc8dc98a9dca",
|                                               "Value":  "Mail.Read",
|                                               "DisplayName":  "Read user mail ",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s mailbox."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7b9103a5-4610-446b-9670-80643382c1fa",
|                                               "Value":  "Mail.Read.Shared",
|                                               "DisplayName":  "Read user and shared mail",
|                                               "Description":  "Allows the app to read mail a user can access, including their own and shared mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a4b8392a-d8d1-4954-a029-8e668a39a170",
|                                               "Value":  "Mail.ReadBasic",
|                                               "DisplayName":  "Read user basic mail",
|                                               "Description":  "Allows the app to read email in the signed-in user\u0027s mailbox except body, previewBody, attachments and any extended properties."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b11fa0e7-fdb7-4dc9-b1f1-59facd463480",
|                                               "Value":  "Mail.ReadBasic.Shared",
|                                               "DisplayName":  "Read user and shared basic mail",
|                                               "Description":  "Allows the app to read mail the signed-in user can access, including their own and shared mail, except for body, bodyPreview, uniqueBody, attachments, extensions, and any extended properties."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "024d486e-b451-40bb-833d-3e66d98c5c73",
|                                               "Value":  "Mail.ReadWrite",
|                                               "DisplayName":  "Read and write access to user mail ",
|                                               "Description":  "Allows the app to create, read, update, and delete email in user mailboxes. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5df07973-7d5d-46ed-9847-1271055cbd51",
|                                               "Value":  "Mail.ReadWrite.Shared",
|                                               "DisplayName":  "Read and write user and shared mail",
|                                               "Description":  "Allows the app to create, read, update, and delete mail a user has permission to access, including their own and shared mail. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e383f46e-2787-4529-855e-0e479a3ffac0",
|                                               "Value":  "Mail.Send",
|                                               "DisplayName":  "Send mail as a user ",
|                                               "Description":  "Allows the app to send mail as users in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a367ab51-6b49-43bf-a716-a1fb06d2a174",
|                                               "Value":  "Mail.Send.Shared",
|                                               "DisplayName":  "Send mail on behalf of others",
|                                               "Description":  "Allows the app to send mail as the signed-in user, including sending on-behalf of others."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dce2e6fc-0f4b-40da-94e2-14b4477f3d92",
|                                               "Value":  "MailboxConfigItem.Read",
|                                               "DisplayName":  "Read user\u0027s UserConfiguration objects",
|                                               "Description":  "Allows the app to read user\u0027s UserConfiguration objects, on behalf of the the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7d461784-7715-4b09-9f90-91a6d8722652",
|                                               "Value":  "MailboxConfigItem.ReadWrite",
|                                               "DisplayName":  "Read and write user\u0027s UserConfiguration objects",
|                                               "Description":  "Allows the app to create, read, update and delete user\u0027s UserConfiguration objects, on behalf of the the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "52dc2051-4958-4636-8f2a-281d39c6981c",
|                                               "Value":  "MailboxFolder.Read",
|                                               "DisplayName":  "Read a user\u0027s mailbox folders",
|                                               "Description":  "Allows the app to read the user\u0027s mailbox folders, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "077fde41-7e0b-4c5b-bcd1-e9d743a30c80",
|                                               "Value":  "MailboxFolder.ReadWrite",
|                                               "DisplayName":  "Read and write a user\u0027s mailbox folders",
|                                               "Description":  "Allows the app to read and write the user\u0027s mailbox folders, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "58d3e7fa-3ce9-4a0c-9baa-0971f64709d9",
|                                               "Value":  "MailboxItem.Export",
|                                               "DisplayName":  "Export a user\u0027s mailbox items",
|                                               "Description":  "Allows the app to export the user\u0027s mailbox items, on behalf of the the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "df96e8a0-f4e1-4ecf-8d83-a429f822cbd6",
|                                               "Value":  "MailboxItem.ImportExport",
|                                               "DisplayName":  "Allows the app to perform backup and restore of mailbox items",
|                                               "Description":  "Allows the app to backup, restore, and modify mailbox items on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "82305458-296d-4edd-8b0b-74dd74c34526",
|                                               "Value":  "MailboxItem.Read",
|                                               "DisplayName":  "Read a user\u0027s mailbox items",
|                                               "Description":  "Allows the app to read the user\u0027s mailbox items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "87f447af-9fa4-4c32-9dfa-4a57a73d18ce",
|                                               "Value":  "MailboxSettings.Read",
|                                               "DisplayName":  "Read user mailbox settings",
|                                               "Description":  "Allows the app to the read user\u0027s mailbox settings. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "818c620a-27a9-40bd-a6a5-d96f7d610b4b",
|                                               "Value":  "MailboxSettings.ReadWrite",
|                                               "DisplayName":  "Read and write user mailbox settings",
|                                               "Description":  "Allows the app to create, read, update, and delete user\u0027s mailbox settings. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4776cae1-54bd-4dfd-823c-e5861ed49a98",
|                                               "Value":  "MailTips.ReadBasic.Shared",
|                                               "DisplayName":  "Read mail tips for mailboxes you can access",
|                                               "Description":  "Allows the app to read mail tips on behalf of the signed-in user for mailboxes they have access to. Mail tips include automatic replies, mailbox status, custom tips, and delivery information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dc34164e-6c4a-41a0-be89-3ae2fbad7cd3",
|                                               "Value":  "ManagedTenants.Read.All",
|                                               "DisplayName":  "Read all managed tenant information",
|                                               "Description":  "Allows the app to read all managed tenant information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b31fa710-c9b3-4d9e-8f5e-8036eecddab9",
|                                               "Value":  "ManagedTenants.ReadWrite.All",
|                                               "DisplayName":  "Read and write all managed tenant information",
|                                               "Description":  "Allows the app to read and write all managed tenant information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f6a3db3e-f7e8-4ed2-a414-557c8c9830be",
|                                               "Value":  "Member.Read.Hidden",
|                                               "DisplayName":  "Read hidden memberships",
|                                               "Description":  "Allows the app to read the memberships of hidden groups and administrative units on behalf of the signed-in user, for those hidden groups and administrative units that the signed-in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "526aa72a-5878-49fe-bf4e-357973af9b06",
|                                               "Value":  "MultiTenantOrganization.Read.All",
|                                               "DisplayName":  "Read multi-tenant organization details and tenants",
|                                               "Description":  "Allows the app to read multi-tenant organization details and tenants on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "225db56b-15b2-4daa-acb3-0eec2bbe4849",
|                                               "Value":  "MultiTenantOrganization.ReadBasic.All",
|                                               "DisplayName":  "Read multi-tenant organization basic details and active tenants",
|                                               "Description":  "Allows the app to read multi-tenant organization basic details and active tenants on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "77af1528-84f3-4023-8d90-d219cd433108",
|                                               "Value":  "MultiTenantOrganization.ReadWrite.All",
|                                               "DisplayName":  "Read and write multi-tenant organization details and tenants",
|                                               "Description":  "Allows the app to read and write multi-tenant organization details and tenants on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "51ae584e-e736-4718-897b-10af70f8e3cc",
|                                               "Value":  "MutualTlsOauthConfiguration.Read.All",
|                                               "DisplayName":  "Read all configurations used for mutual-TLS client authentication.",
|                                               "Description":  "Allows the app to read configuration used for OAuth 2.0 mutual-TLS client authentication, on behalf of the signed-in user. This includes reading trusted certificate authorities."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a51115bc-f64f-498f-bcee-00dcd28f4a03",
|                                               "Value":  "MutualTlsOauthConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write all configurations used for mutual-TLS client authentication.",
|                                               "Description":  "Allows the app to read and update configuration used for OAuth 2.0 mutual-TLS client authentication, on behalf of the signed-in user. This includes adding and updating trusted certificate authorities."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b0c61509-cfc3-42bd-9bd4-66d81785fee4",
|                                               "Value":  "NetworkAccess-Reports.Read.All",
|                                               "DisplayName":  "Read all network access reports",
|                                               "Description":  "Allows the app to read all network access reports on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2f7013e0-ab4e-447f-a5e1-5d419950692d",
|                                               "Value":  "NetworkAccess.Read.All",
|                                               "DisplayName":  "Read all network access information",
|                                               "Description":  "Allows the app to read all network access information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ae2df9c5-f18d-4ec4-a51b-bdeb807f177b",
|                                               "Value":  "NetworkAccess.ReadWrite.All",
|                                               "DisplayName":  "Read and write all network access information",
|                                               "Description":  "Allows the app to read and write all network access information and configuration settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4051c7fc-b429-4804-8d80-8f1f8c24a6f7",
|                                               "Value":  "NetworkAccessBranch.Read.All",
|                                               "DisplayName":  "Read properties of branches for network access",
|                                               "Description":  "Allows the app to read your organization\u0027s branches for network access on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b8a36cc2-b810-461a-baa4-a7281e50bd5c",
|                                               "Value":  "NetworkAccessBranch.ReadWrite.All",
|                                               "DisplayName":  "Read and write properties of branches for network access",
|                                               "Description":  "Allows the app to read and write your organization\u0027s branches for network access on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ba22922b-752c-446f-89d7-a2d92398fceb",
|                                               "Value":  "NetworkAccessPolicy.Read.All",
|                                               "DisplayName":  "Read security and routing policies for network access",
|                                               "Description":  "Allows the app to read your organization\u0027s security and routing network access policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b1fbad0f-ef6e-42ed-8676-bca7fa3e7291",
|                                               "Value":  "NetworkAccessPolicy.ReadWrite.All",
|                                               "DisplayName":  "Read and write security and routing policies for network access",
|                                               "Description":  "Allows the app to read and write your organization\u0027s security and routing network access policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9d822255-d64d-4b7a-afdb-833b9a97ed02",
|                                               "Value":  "Notes.Create",
|                                               "DisplayName":  "Create user OneNote notebooks",
|                                               "Description":  "Allows the app to read the titles of OneNote notebooks and sections and to create new pages, notebooks, and sections on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "371361e4-b9e2-4a3f-8315-2a301a3b0a3d",
|                                               "Value":  "Notes.Read",
|                                               "DisplayName":  "Read user OneNote notebooks",
|                                               "Description":  "Allows the app to read OneNote notebooks on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dfabfca6-ee36-4db2-8208-7a28381419b3",
|                                               "Value":  "Notes.Read.All",
|                                               "DisplayName":  "Read all OneNote notebooks that user can access",
|                                               "Description":  "Allows the app to read OneNote notebooks that the signed-in user has access to in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "615e26af-c38a-4150-ae3e-c3b0d4cb1d6a",
|                                               "Value":  "Notes.ReadWrite",
|                                               "DisplayName":  "Read and write user OneNote notebooks",
|                                               "Description":  "Allows the app to read, share, and modify OneNote notebooks on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "64ac0503-b4fa-45d9-b544-71a463f05da0",
|                                               "Value":  "Notes.ReadWrite.All",
|                                               "DisplayName":  "Read and write all OneNote notebooks that user can access",
|                                               "Description":  "Allows the app to read, share, and modify OneNote notebooks that the signed-in user has access to in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ed68249d-017c-4df5-9113-e684c7f8760b",
|                                               "Value":  "Notes.ReadWrite.CreatedByApp",
|                                               "DisplayName":  "Limited notebook access (deprecated)",
|                                               "Description":  "This is deprecated!  Do not use! This permission no longer has any effect. You can safely consent to it. No additional privileges will be granted to the app."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "89497502-6e42-46a2-8cb2-427fd3df970a",
|                                               "Value":  "Notifications.ReadWrite.CreatedByApp",
|                                               "DisplayName":  "Deliver and manage user notifications for this app",
|                                               "Description":  "Allows the app to deliver its notifications on behalf of signed-in users. Also allows the app to read, update, and delete the user\u0027s notification items for this app."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7427e0e9-2fba-42fe-b0c0-848c9e6a8182",
|                                               "Value":  "offline_access",
|                                               "DisplayName":  "Maintain access to data you have given it access to",
|                                               "Description":  "Allows the app to see and update the data you gave it access to, even when users are not currently using the app. This does not give the app any additional permissions."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "166741d6-eeb8-46fe-91f4-817d2af7bc88",
|                                               "Value":  "OnlineMeetingAiInsight.Read.All",
|                                               "DisplayName":  "Read all AI Insights for online meetings.",
|                                               "Description":  "Allows the app to read all AI Insights for online meetings, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "110e5abb-a10c-4b59-8b55-9b4daa4ef743",
|                                               "Value":  "OnlineMeetingArtifact.Read.All",
|                                               "DisplayName":  "Read user\u0027s online meeting artifacts",
|                                               "Description":  "Allows the app to read online meeting artifacts on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "190c2bb6-1fdd-4fec-9aa2-7d571b5e1fe3",
|                                               "Value":  "OnlineMeetingRecording.Read.All",
|                                               "DisplayName":  "Read all recordings of online meetings.",
|                                               "Description":  "Allows the app to read all recordings of online meetings, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9be106e1-f4e3-4df5-bdff-e4bc531cbe43",
|                                               "Value":  "OnlineMeetings.Read",
|                                               "DisplayName":  "Read user\u0027s online meetings",
|                                               "Description":  "Allows the app to read online meeting details on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a65f2972-a4f8-4f5e-afd7-69ccb046d5dc",
|                                               "Value":  "OnlineMeetings.ReadWrite",
|                                               "DisplayName":  "Read and create user\u0027s online meetings",
|                                               "Description":  "Allows the app to read and create online meetings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "30b87d18-ebb1-45db-97f8-82ccb1f0190c",
|                                               "Value":  "OnlineMeetingTranscript.Read.All",
|                                               "DisplayName":  "Read all transcripts of online meetings.",
|                                               "Description":  "Allows the app to read all transcripts of online meetings, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f6609722-4100-44eb-b747-e6ca0536989d",
|                                               "Value":  "OnPremDirectorySynchronization.Read.All",
|                                               "DisplayName":  "Read all on-premises directory synchronization information",
|                                               "Description":  "Allows the app to read all on-premises directory synchronization information for the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c2d95988-7604-4ba1-aaed-38a5f82a51c7",
|                                               "Value":  "OnPremDirectorySynchronization.ReadWrite.All",
|                                               "DisplayName":  "Read and write all on-premises directory synchronization information",
|                                               "Description":  "Allows the app to read and write all on-premises directory synchronization information for the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8c4d5184-71c2-4bf8-bb9d-bc3378c9ad42",
|                                               "Value":  "OnPremisesPublishingProfiles.ReadWrite.All",
|                                               "DisplayName":  "Manage on-premises published resources",
|                                               "Description":  "Allows the app to manage hybrid identity service configuration by creating, viewing, updating and deleting on-premises published resources, on-premises agents and agent groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "37f7f235-527c-4136-accd-4a02d197296e",
|                                               "Value":  "openid",
|                                               "DisplayName":  "Sign users in",
|                                               "Description":  "Allows users to sign in to the app with their work or school accounts and allows the app to see basic user profile information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4908d5b9-3fb2-4b1e-9336-1888b7937185",
|                                               "Value":  "Organization.Read.All",
|                                               "DisplayName":  "Read organization information",
|                                               "Description":  "Allows the app to read the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed skus and tenant branding information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "46ca0847-7e6b-426e-9775-ea810a948356",
|                                               "Value":  "Organization.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization information",
|                                               "Description":  "Allows the app to read and write the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed skus and tenant branding information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9082f138-6f02-4f3a-9f4d-5f3c2ce5c688",
|                                               "Value":  "OrganizationalBranding.Read.All",
|                                               "DisplayName":  "Read organizational branding information",
|                                               "Description":  "Allows the app to read the organizational branding information, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "15ce63de-b141-4c9a-a9a5-241bf27c6aaf",
|                                               "Value":  "OrganizationalBranding.ReadWrite.All",
|                                               "DisplayName":  "Read and write organizational branding information",
|                                               "Description":  "Allows the app to read and write the organizational branding information, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "08432d1b-5911-483c-86df-7980af5cdee0",
|                                               "Value":  "OrgContact.Read.All",
|                                               "DisplayName":  "Read organizational contacts",
|                                               "Description":  "Allows the app to read all organizational contacts on behalf of the signed-in user.  These contacts are managed by the organization and are different from a user\u0027s personal contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1e9b7a7e-4d64-44ff-acf5-2e9651c1519f",
|                                               "Value":  "OrgSettings-AppsAndServices.Read.All",
|                                               "DisplayName":  "Read organization-wide apps and services settings",
|                                               "Description":  "Allows the app to read organization-wide apps and services settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c167b0e7-47c0-48e8-9eee-9892f58018fa",
|                                               "Value":  "OrgSettings-AppsAndServices.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide apps and services settings",
|                                               "Description":  "Allows the app to read and write organization-wide apps and services settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9862d930-5aec-4a98-8d4f-7277a8db9bcb",
|                                               "Value":  "OrgSettings-DynamicsVoice.Read.All",
|                                               "DisplayName":  "Read organization-wide Dynamics customer voice settings",
|                                               "Description":  "Allows the app to read organization-wide Dynamics customer voice settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4cea26fb-6967-4234-82c4-c044414743f8",
|                                               "Value":  "OrgSettings-DynamicsVoice.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide Dynamics customer voice settings",
|                                               "Description":  "Allows the app to read and write organization-wide Dynamics customer voice settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "210051a0-1ffc-435c-ae76-02d226d05752",
|                                               "Value":  "OrgSettings-Forms.Read.All",
|                                               "DisplayName":  "Read organization-wide Microsoft Forms settings",
|                                               "Description":  "Allows the app to read organization-wide Microsoft Forms settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "346c19ff-3fb2-4e81-87a0-bac9e33990c1",
|                                               "Value":  "OrgSettings-Forms.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide Microsoft Forms settings",
|                                               "Description":  "Allows the app to read and write organization-wide Microsoft Forms settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8cbdb9f6-9c2e-451a-814d-ec606e5d0212",
|                                               "Value":  "OrgSettings-Microsoft365Install.Read.All",
|                                               "DisplayName":  "Read organization-wide Microsoft 365 apps installation settings",
|                                               "Description":  "Allows the app to read organization-wide Microsoft 365 apps installation settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1ff35e91-19eb-42d8-aa2d-cc9891127ae5",
|                                               "Value":  "OrgSettings-Microsoft365Install.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide Microsoft 365 apps installation settings",
|                                               "Description":  "Allows the app to read and write organization-wide Microsoft 365 apps installation settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7ff96f41-f022-45ba-acd8-ef3f03063d6b",
|                                               "Value":  "OrgSettings-Todo.Read.All",
|                                               "DisplayName":  "Read organization-wide Microsoft To Do settings",
|                                               "Description":  "Allows the app to read organization-wide Microsoft To Do settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "087502c2-5263-433e-abe3-8f77231a0627",
|                                               "Value":  "OrgSettings-Todo.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization-wide Microsoft To Do settings",
|                                               "Description":  "Allows the app to read and write organization-wide Microsoft To Do settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8804798e-5934-4e30-8ce3-ef88257cecd4",
|                                               "Value":  "PartnerBilling.Read.All",
|                                               "DisplayName":  "Read all billing data for your company\u0027s tenant",
|                                               "Description":  "Allows the app to read all of billing data from Microsoft for your company\u0027s tenant, on behalf of the signed-in user. This includes reading billed and unbilled Usage and Invoice reconciliation data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5567b981-0bf1-4796-9038-0648b46e116d",
|                                               "Value":  "PartnerSecurity.Read.All",
|                                               "DisplayName":  "Read security alerts of customer with CSP relationship",
|                                               "Description":  "Allows the app to read security alerts of customer with CSP relationship on behalf of the partner signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0cd2c1f6-94a1-4075-ab8c-0b1aff2e1ad5",
|                                               "Value":  "PartnerSecurity.ReadWrite.All",
|                                               "DisplayName":  "Read security alerts and update status of security alerts of customer with CSP relationship",
|                                               "Description":  "Allows the app to read security alerts and update status of alerts of customer with CSP relationship on behalf of the partner signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d88fd3fb-53d3-4c1c-8c39-787fcac2ed7a",
|                                               "Value":  "PendingExternalUserProfile.Read.All",
|                                               "DisplayName":  "Read pending external user profiles",
|                                               "Description":  "Allows the app to read available properties of pending external user profiles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "93a1fb28-c908-4826-904e-0c74ad352b73",
|                                               "Value":  "PendingExternalUserProfile.ReadWrite.All",
|                                               "DisplayName":  "Read and write pending external user profiles",
|                                               "Description":  "Allows the app to read and write available properties of pending external user profiles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ba47897c-39ec-4d83-8086-ee8256fa737d",
|                                               "Value":  "People.Read",
|                                               "DisplayName":  "Read users\u0027 relevant people lists",
|                                               "Description":  "Allows the app to read a ranked list of relevant people of the signed-in user. The list includes local contacts, contacts from social networking, your organization\u0027s directory, and people from recent communications (such as email and Skype)."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b89f9189-71a5-4e70-b041-9887f0bc7e4a",
|                                               "Value":  "People.Read.All",
|                                               "DisplayName":  "Read all users\u0027 relevant people lists",
|                                               "Description":  "Allows the app to read a scored list of relevant people of the signed-in user or other users in the signed-in user\u0027s organization. The list can include local contacts, contacts from social networking, your organization\u0027s directory, and people from recent communications (such as email and Skype)."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ec762c5f-388b-4b16-8693-ac1efbc611bc",
|                                               "Value":  "PeopleSettings.Read.All",
|                                               "DisplayName":  "Read tenant-wide people settings",
|                                               "Description":  "Allows the application to read tenant-wide people settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e67e6727-c080-415e-b521-e3f35d5248e9",
|                                               "Value":  "PeopleSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write tenant-wide people settings",
|                                               "Description":  "Allows the application to read and write tenant-wide people settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cb8f45a0-5c2e-4ea1-b803-84b870a7d7ec",
|                                               "Value":  "Place.Read.All",
|                                               "DisplayName":  "Read all company places",
|                                               "Description":  "Allows the app to read your company\u0027s places (conference rooms and room lists) for calendar events and other applications, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4c06a06a-098a-4063-868e-5dfee3827264",
|                                               "Value":  "Place.ReadWrite.All",
|                                               "DisplayName":  "Read and write organization places",
|                                               "Description":  "Allows the app to manage organization places (conference rooms and room lists) for calendar events and other applications, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4c7f93d2-6b0b-4e05-91aa-87842f0a2142",
|                                               "Value":  "PlaceDevice.Read.All",
|                                               "DisplayName":  "Read all workplace devices",
|                                               "Description":  "Allows the app to read all workplace devices, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eafd6a71-e95a-4f8a-bb6e-fb84ab7fbd9e",
|                                               "Value":  "PlaceDevice.ReadWrite.All",
|                                               "DisplayName":  "Read and write all workplace devices",
|                                               "Description":  "Allows the app to read and write all workplace devices, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "572fea84-0151-49b2-9301-11cb16974376",
|                                               "Value":  "Policy.Read.All",
|                                               "DisplayName":  "Read your organization\u0027s policies",
|                                               "Description":  "Allows the app to read your organization\u0027s policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a6ff13ac-1851-4993-8ca9-a671d70de2d5",
|                                               "Value":  "Policy.Read.AuthenticationMethod",
|                                               "DisplayName":  "Read authentication method policies",
|                                               "Description":  "Allows the app to read the authentication method policies, on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4b293250-121d-4cb4-acc7-5280438c18a6",
|                                               "Value":  "Policy.Read.B2BManagementPolicy",
|                                               "DisplayName":  "Read your organization\u0027s B2BManagement policies",
|                                               "Description":  "Allows the app to read your organization\u0027s B2BManagement policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "633e0fce-8c58-4cfb-9495-12bbd5a24f7c",
|                                               "Value":  "Policy.Read.ConditionalAccess",
|                                               "DisplayName":  "Read your organization\u0027s conditional access policies",
|                                               "Description":  "Allows the app to read your organization\u0027s conditional access policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3616a4b0-6746-49c4-a678-4c237599074d",
|                                               "Value":  "Policy.Read.DeviceConfiguration",
|                                               "DisplayName":  "Read your organization\u0027s device configuration policies",
|                                               "Description":  "Allows the app to read your organization\u0027s device configuration policies on behalf of the signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d146432f-b803-4ed4-8d42-ba74193a6ede",
|                                               "Value":  "Policy.Read.IdentityProtection",
|                                               "DisplayName":  "Read your organization’s identity protection policy",
|                                               "Description":  "Allows the app to read your organization’s identity protection policy on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "414de6ea-2d92-462f-b120-6e2a809a6d01",
|                                               "Value":  "Policy.Read.PermissionGrant",
|                                               "DisplayName":  "Read consent and permission grant policies",
|                                               "Description":  "Allows the app to read policies related to consent and permission grants for applications, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4f5bc9c8-ea54-4772-973a-9ca119cb0409",
|                                               "Value":  "Policy.ReadWrite.AccessReview",
|                                               "DisplayName":  "Read and write your organization\u0027s directory access review default policy",
|                                               "Description":  "Allows the app to read and write your organization\u0027s directory access review default policy on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b27add92-efb2-4f16-84f5-8108ba77985c",
|                                               "Value":  "Policy.ReadWrite.ApplicationConfiguration",
|                                               "DisplayName":  "Read and write your organization\u0027s application configuration policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s application configuration policies on behalf of the signed-in user.  This includes policies such as activityBasedTimeoutPolicy, claimsMappingPolicy, homeRealmDiscoveryPolicy,  tokenIssuancePolicy and tokenLifetimePolicy."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "edb72de9-4252-4d03-a925-451deef99db7",
|                                               "Value":  "Policy.ReadWrite.AuthenticationFlows",
|                                               "DisplayName":  "Read and write authentication flow policies",
|                                               "Description":  "Allows the app to read and write the authentication flow policies, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7e823077-d88e-468f-a337-e18f1f0e6c7c",
|                                               "Value":  "Policy.ReadWrite.AuthenticationMethod",
|                                               "DisplayName":  "Read and write authentication method policies",
|                                               "Description":  "Allows the app to read and write the authentication method policies, on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "edd3c878-b384-41fd-95ad-e7407dd775be",
|                                               "Value":  "Policy.ReadWrite.Authorization",
|                                               "DisplayName":  "Read and write your organization\u0027s authorization policy",
|                                               "Description":  "Allows the app to read and write your organization\u0027s authorization policy on behalf of the signed-in user.  For example, authorization policies can control some of the permissions that the out-of-the-box user role has by default."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "723c4a0c-85b0-4a02-bb2a-c9eb07959de9",
|                                               "Value":  "Policy.ReadWrite.B2BManagementPolicy",
|                                               "DisplayName":  "Read and write your organization\u0027s B2BManagement policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s B2BManagement policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ad902697-1014-4ef5-81ef-2b4301988e8c",
|                                               "Value":  "Policy.ReadWrite.ConditionalAccess",
|                                               "DisplayName":  "Read and write your organization\u0027s conditional access policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s conditional access policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4d135e65-66b8-41a8-9f8b-081452c91774",
|                                               "Value":  "Policy.ReadWrite.ConsentRequest",
|                                               "DisplayName":  "Read and write consent request policy",
|                                               "Description":  "Allows the app to read and write your organization\u0027s consent requests policy on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "014b43d0-6ed4-4fc6-84dc-4b6f7bae7d85",
|                                               "Value":  "Policy.ReadWrite.CrossTenantAccess",
|                                               "DisplayName":  "Read and write your organization\u0027s cross tenant access policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s cross-tenant access policies and configuration for automatic user consent settings to suppress consent prompts for users of the other tenant on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9ef7463f-1d39-406f-89ea-3483a4645e1c",
|                                               "Value":  "Policy.ReadWrite.CrossTenantCapability",
|                                               "DisplayName":  "Read and write your organization\u0027s M365 cross tenant access capabilities",
|                                               "Description":  "Allows the app to read and write your organization\u0027s M365 cross tenant access capabilities on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "40b534c3-9552-4550-901b-23879c90bcf9",
|                                               "Value":  "Policy.ReadWrite.DeviceConfiguration",
|                                               "DisplayName":  "Read and write your organization\u0027s device configuration policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s device configuration policies on behalf of the signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b5219784-1215-45b5-b3f1-88fe1081f9c0",
|                                               "Value":  "Policy.ReadWrite.ExternalIdentities",
|                                               "DisplayName":  "Read and write your organization\u0027s external identities policy",
|                                               "Description":  "Allows the application to read and update the organization\u0027s external identities policy on behalf of the signed-in user.  For example, external identities policy controls if users invited to access resources in your organization via B2B collaboration or B2B direct connect are allowed to self-service leave."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "92a38652-f13b-4875-bc77-6e1dbb63e1b2",
|                                               "Value":  "Policy.ReadWrite.FeatureRollout",
|                                               "DisplayName":  "Read and write your organization\u0027s feature rollout policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s feature rollout policies on behalf of the signed-in user. Includes abilities to assign and remove users and groups to rollout of a specific feature."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "be1be369-4540-4ac9-8928-79de99f70d8f",
|                                               "Value":  "Policy.ReadWrite.FedTokenValidation",
|                                               "DisplayName":  "Read and write your organization\u0027s federated token validation policy",
|                                               "Description":  "Allows the application to read and update the organization\u0027s federated token validation policy on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7256e131-3efb-4323-9854-cf41c6021770",
|                                               "Value":  "Policy.ReadWrite.IdentityProtection",
|                                               "DisplayName":  "Read and write your organization’s identity protection policy ",
|                                               "Description":  "Allows the app to read and write your organization’s identity protection policy on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a8ead177-1889-4546-9387-f25e658e2a79",
|                                               "Value":  "Policy.ReadWrite.MobilityManagement",
|                                               "DisplayName":  "Read and write your organization\u0027s mobility management policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s mobility management policies on behalf of the signed-in user.  For example, a mobility management policy can set the enrollment scope for a given mobility management application."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2672f8bb-fd5e-42e0-85e1-ec764dd2614e",
|                                               "Value":  "Policy.ReadWrite.PermissionGrant",
|                                               "DisplayName":  "Manage consent and permission grant policies",
|                                               "Description":  "Allows the app to manage policies related to consent and permission grants for applications, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0b2a744c-2abf-4f1e-ad7e-17a087e2be99",
|                                               "Value":  "Policy.ReadWrite.SecurityDefaults",
|                                               "DisplayName":  "Read and write your organization\u0027s security defaults policy",
|                                               "Description":  "Allows the app to read and write your organization\u0027s security defaults policy on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cefba324-1a70-4a6e-9c1d-fd670b7ae392",
|                                               "Value":  "Policy.ReadWrite.TrustFramework",
|                                               "DisplayName":  "Read and write your organization\u0027s trust framework policies",
|                                               "Description":  "Allows the app to read and write your organization\u0027s trust framework policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d7b7f2d9-0f45-4ea1-9d42-e50810c06991",
|                                               "Value":  "POP.AccessAsUser.All",
|                                               "DisplayName":  "Read and write access to mailboxes via POP.",
|                                               "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via POP protocol."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "76bc735e-aecd-4a1d-8b4c-2b915deabb79",
|                                               "Value":  "Presence.Read",
|                                               "DisplayName":  "Read user\u0027s presence information",
|                                               "Description":  "Allows the app to read presence information on behalf of the signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9c7a330d-35b3-4aa1-963d-cb2b9f927841",
|                                               "Value":  "Presence.Read.All",
|                                               "DisplayName":  "Read presence information of all users in your organization",
|                                               "Description":  "Allows the app to read presence information of all users in the directory on behalf of the signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8d3c54a7-cf58-4773-bf81-c0cd6ad522bb",
|                                               "Value":  "Presence.ReadWrite",
|                                               "DisplayName":  "Read and write a user\u0027s presence information",
|                                               "Description":  "Allows the app to read the presence information and write activity and availability on behalf of the signed-in user. Presence information includes activity, availability, status note, calendar out-of-office message, timezone and location."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d69c2d6d-4f72-4f99-a6b9-663e32f8cf68",
|                                               "Value":  "PrintConnector.Read.All",
|                                               "DisplayName":  "Read print connectors",
|                                               "Description":  "Allows the application to read print connectors on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "79ef9967-7d59-4213-9c64-4b10687637d8",
|                                               "Value":  "PrintConnector.ReadWrite.All",
|                                               "DisplayName":  "Read and write print connectors",
|                                               "Description":  "Allows the application to read and write print connectors on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "90c30bed-6fd1-4279-bf39-714069619721",
|                                               "Value":  "Printer.Create",
|                                               "DisplayName":  "Register printers  ",
|                                               "Description":  "Allows the application to create (register) printers on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "93dae4bd-43a1-4a23-9a1a-92957e1d9121",
|                                               "Value":  "Printer.FullControl.All",
|                                               "DisplayName":  "Register, read, update, and unregister printers",
|                                               "Description":  "Allows the application to create (register), read, update, and delete (unregister) printers on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3a736c8a-018e-460a-b60c-863b2683e8bf",
|                                               "Value":  "Printer.Read.All",
|                                               "DisplayName":  "Read printers",
|                                               "Description":  "Allows the application to read printers on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "89f66824-725f-4b8f-928e-e1c5258dc565",
|                                               "Value":  "Printer.ReadWrite.All",
|                                               "DisplayName":  "Read and update printers",
|                                               "Description":  "Allows the application to read and update printers on behalf of the signed-in user. Does not allow creating (registering) or deleting (unregistering) printers."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ed11134d-2f3f-440d-a2e1-411efada2502",
|                                               "Value":  "PrinterShare.Read.All",
|                                               "DisplayName":  "Read printer shares",
|                                               "Description":  "Allows the application to read printer shares on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5fa075e9-b951-4165-947b-c63396ff0a37",
|                                               "Value":  "PrinterShare.ReadBasic.All",
|                                               "DisplayName":  "Read basic information about printer shares",
|                                               "Description":  "Allows the application to read basic information about printer shares on behalf of the signed-in user. Does not allow reading access control information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "06ceea37-85e2-40d7-bec3-91337a46038f",
|                                               "Value":  "PrinterShare.ReadWrite.All",
|                                               "DisplayName":  "Read and write printer shares",
|                                               "Description":  "Allows the application to read and update printer shares on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "21f0d9c0-9f13-48b3-94e0-b6b231c7d320",
|                                               "Value":  "PrintJob.Create",
|                                               "DisplayName":  "Create print jobs",
|                                               "Description":  "Allows the application to create print jobs on behalf of the signed-in user and upload document content to print jobs that the signed-in user created."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "248f5528-65c0-4c88-8326-876c7236df5e",
|                                               "Value":  "PrintJob.Read",
|                                               "DisplayName":  "Read user\u0027s print jobs",
|                                               "Description":  "Allows the application to read the metadata and document content of print jobs that the signed-in user created."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "afdd6933-a0d8-40f7-bd1a-b5d778e8624b",
|                                               "Value":  "PrintJob.Read.All",
|                                               "DisplayName":  "Read print jobs",
|                                               "Description":  "Allows the application to read the metadata and document content of print jobs on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6a71a747-280f-4670-9ca0-a9cbf882b274",
|                                               "Value":  "PrintJob.ReadBasic",
|                                               "DisplayName":  "Read basic information of user\u0027s print jobs",
|                                               "Description":  "Allows the application to read the metadata of print jobs that the signed-in user created. Does not allow access to print job document content."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "04ce8d60-72ce-4867-85cf-6d82f36922f3",
|                                               "Value":  "PrintJob.ReadBasic.All",
|                                               "DisplayName":  "Read basic information of print jobs",
|                                               "Description":  "Allows the application to read the metadata of print jobs on behalf of the signed-in user. Does not allow access to print job document content."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b81dd597-8abb-4b3f-a07a-820b0316ed04",
|                                               "Value":  "PrintJob.ReadWrite",
|                                               "DisplayName":  "Read and write user\u0027s print jobs",
|                                               "Description":  "Allows the application to read and update the metadata and document content of print jobs that the signed-in user created."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "036b9544-e8c5-46ef-900a-0646cc42b271",
|                                               "Value":  "PrintJob.ReadWrite.All",
|                                               "DisplayName":  "Read and write print jobs",
|                                               "Description":  "Allows the application to read and update the metadata and document content of print jobs on behalf of the signed-in user. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6f2d22f2-1cb6-412c-a17c-3336817eaa82",
|                                               "Value":  "PrintJob.ReadWriteBasic",
|                                               "DisplayName":  "Read and write basic information of user\u0027s print jobs",
|                                               "Description":  "Allows the application to read and update the metadata of print jobs that the signed-in user created. Does not allow access to print job document content."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3a0db2f6-0d2a-4c19-971b-49109b19ad3d",
|                                               "Value":  "PrintJob.ReadWriteBasic.All",
|                                               "DisplayName":  "Read and write basic information of print jobs",
|                                               "Description":  "Allows the application to read and update the metadata of print jobs on behalf of the signed-in user. Does not allow access to print job document content."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "490f32fd-d90f-4dd7-a601-ff6cdc1a3f6c",
|                                               "Value":  "PrintSettings.Read.All",
|                                               "DisplayName":  "Read tenant-wide print settings",
|                                               "Description":  "Allows the application to read tenant-wide print settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9ccc526a-c51c-4e5c-a1fd-74726ef50b8f",
|                                               "Value":  "PrintSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write tenant-wide print settings",
|                                               "Description":  "Allows the application to read and write tenant-wide print settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bc04fe80-7e6a-4154-8b8f-d1e3465613bf",
|                                               "Value":  "PrivilegedAccess-CustomExt.Read.All",
|                                               "DisplayName":  "Read Privileged Access (PIM) custom extensions",
|                                               "Description":  "Allows the app to read Privileged Access (PIM) custom extensions for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "157efa76-20fd-4db4-876e-90c049322467",
|                                               "Value":  "PrivilegedAccess-CustomExt.ReadWrite.All",
|                                               "DisplayName":  "Read and write Privileged Access (PIM) custom extensions",
|                                               "Description":  "Allows the app to read and write Privileged Access (PIM) custom extensions for your organization, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b3a539c9-59cb-4ad5-825a-041ddbdc2bdb",
|                                               "Value":  "PrivilegedAccess.Read.AzureAD",
|                                               "DisplayName":  "Read privileged access to Azure AD",
|                                               "Description":  "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD built-in and custom administrative roles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d329c81c-20ad-4772-abf9-3f6fdb7e5988",
|                                               "Value":  "PrivilegedAccess.Read.AzureADGroup",
|                                               "DisplayName":  "Read privileged access to Azure AD groups",
|                                               "Description":  "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1d89d70c-dcac-4248-b214-903c457af83a",
|                                               "Value":  "PrivilegedAccess.Read.AzureResources",
|                                               "DisplayName":  "Read privileged access to Azure resources",
|                                               "Description":  "Allows the app to read time-based assignment and just-in-time elevation of Azure resources (like your subscriptions, resource groups, storage, compute) on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3c3c74f5-cdaa-4a97-b7e0-4e788bfcfb37",
|                                               "Value":  "PrivilegedAccess.ReadWrite.AzureAD",
|                                               "DisplayName":  "Read and write privileged access to Azure AD",
|                                               "Description":  "Allows the app to request and manage just in time elevation (including scheduled elevation) of users to Azure AD built-in administrative roles, on behalf of signed-in users."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "32531c59-1f32-461f-b8df-6f8a3b89f73b",
|                                               "Value":  "PrivilegedAccess.ReadWrite.AzureADGroup",
|                                               "DisplayName":  "Read and write privileged access to Azure AD groups",
|                                               "Description":  "Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a84a9652-ffd3-496e-a991-22ba5529156a",
|                                               "Value":  "PrivilegedAccess.ReadWrite.AzureResources",
|                                               "DisplayName":  "Read and write privileged access to Azure resources",
|                                               "Description":  "Allows the app to request and manage time-based assignment and just-in-time elevation of user privileges to manage Azure resources (like subscriptions, resource groups, storage, compute) on behalf of the signed-in users."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "02a32cc4-7ab5-4b58-879a-0586e0f7c495",
|                                               "Value":  "PrivilegedAssignmentSchedule.Read.AzureADGroup",
|                                               "DisplayName":  "Read assignment schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to read time-based assignment schedules for access to Azure AD groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d5767d44-e1c1-4fc7-8fb1-7daa58df022a",
|                                               "Value":  "PrivilegedAssignmentSchedule.Read.EntraAppRole",
|                                               "DisplayName":  "Read assignment schedules for app permission grants and app role assignments",
|                                               "Description":  "Allows the app to read time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "06dbc45d-6708-4ef0-a797-f797ee68bf4b",
|                                               "Value":  "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup",
|                                               "DisplayName":  "Read, create, and delete assignment schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to read, create, and delete time-based assignment schedules for access to Azure AD groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e07122a7-d275-4a27-a2f5-eb62349edae0",
|                                               "Value":  "PrivilegedAssignmentSchedule.ReadWrite.EntraAppRole",
|                                               "DisplayName":  "Read, create, and delete assignment schedules for app permission grants and app role assignments",
|                                               "Description":  "Allows the app to read, create, and delete time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ca5fe595-68ff-4dfd-907d-4509501a0e49",
|                                               "Value":  "PrivilegedAssignmentSchedule.Remove.AzureADGroup",
|                                               "DisplayName":  "Delete assignment schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to delete time-based assignment schedules for access to Azure AD groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8f44f93d-ecef-46ae-a9bf-338508d44d6b",
|                                               "Value":  "PrivilegedEligibilitySchedule.Read.AzureADGroup",
|                                               "DisplayName":  "Read eligibility schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to read time-based eligibility schedules for access to Azure AD groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9b9eb231-5483-4f3c-89e9-9d5048dafe9d",
|                                               "Value":  "PrivilegedEligibilitySchedule.Read.EntraAppRole",
|                                               "DisplayName":  "Read eligibility schedules for app permission grants and app role assignments",
|                                               "Description":  "Allows the app to read time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ba974594-d163-484e-ba39-c330d5897667",
|                                               "Value":  "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup",
|                                               "DisplayName":  "Read, create, and delete eligibility schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to read, create, and delete time-based eligibility schedules for access to Azure AD groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f7ff1cb0-e255-4bb3-b24a-6708c60c5418",
|                                               "Value":  "PrivilegedEligibilitySchedule.ReadWrite.EntraAppRole",
|                                               "DisplayName":  "Read, create, and delete eligibility schedules for app permission grants and app role assignments",
|                                               "Description":  "Allows the app to read, create, and delete time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c5ea9ab4-9b41-4c09-a400-53e652fb5096",
|                                               "Value":  "PrivilegedEligibilitySchedule.Remove.AzureADGroup",
|                                               "DisplayName":  "Delete eligibility schedules for access to Azure AD groups",
|                                               "Description":  "Allows the app to delete time-based eligibility schedules for access to Azure AD groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "14dad69e-099b-42c9-810b-d002981feec1",
|                                               "Value":  "profile",
|                                               "DisplayName":  "View users\u0027 basic profile",
|                                               "Description":  "Allows the app to see your users\u0027 basic profile (e.g., name, picture, user name, email address)"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "469cd065-729e-4dee-b1fa-d92e0fab6310",
|                                               "Value":  "ProfilePhoto.Read.All",
|                                               "DisplayName":  "Read profile photo of a user or group",
|                                               "Description":  "Allows the app to read all profile photos of users and groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f5b24df7-511e-48bb-ae88-643f023b55e1",
|                                               "Value":  "ProfilePhoto.ReadWrite.All",
|                                               "DisplayName":  "Read and write profile photo of a user or group",
|                                               "Description":  "Allows the app to read and write all profile photos of users and groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c492a2e1-2f8f-4caa-b076-99bbf6e40fe4",
|                                               "Value":  "ProgramControl.Read.All",
|                                               "DisplayName":  "Read all programs that user can access",
|                                               "Description":  "Allows the app to read programs and program controls that the signed-in user has access to in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "50fd364f-9d93-4ae1-b170-300e87cccf84",
|                                               "Value":  "ProgramControl.ReadWrite.All",
|                                               "DisplayName":  "Manage all programs that user can access",
|                                               "Description":  "Allows the app to read, update, delete and perform actions on programs and program controls that the signed-in user has access to in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "98f5a27a-539a-48bc-a597-f78e9e1e76bf",
|                                               "Value":  "ProtectionScopes.Compute.All",
|                                               "DisplayName":  "Compute Purview policies at tenant scope",
|                                               "Description":  "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for all users across tenant."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4fc04d16-a9fc-4c5e-8da4-79b6c33638a4",
|                                               "Value":  "ProtectionScopes.Compute.User",
|                                               "DisplayName":  "Compute Purview policies for an individual user",
|                                               "Description":  "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for an individual user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "95aec97b-cf27-4a8d-a67d-42f60b5b38ef",
|                                               "Value":  "ProvisioningLog.Read.All",
|                                               "DisplayName":  "Read provisioning log data",
|                                               "Description":  "Allows the app to read and query your provisioning log activities, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "04a4b2a2-3f26-4fc8-87ee-9c46e68db175",
|                                               "Value":  "PublicKeyInfrastructure.Read.All",
|                                               "DisplayName":  "Read certificate based authentication configurations",
|                                               "Description":  "Allows the application to read certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3591b7f3-dba8-4bad-b667-7a64bd4f2b83",
|                                               "Value":  "PublicKeyInfrastructure.ReadWrite.All",
|                                               "DisplayName":  "Read and write certificate based authentication configurations",
|                                               "Description":  "Allows the application to read  and write certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f73fa04f-b9a5-4df9-8843-993ce928925e",
|                                               "Value":  "QnA.Read.All",
|                                               "DisplayName":  "Read all Questions and Answers that the user can access.",
|                                               "Description":  "Allows an app to read all question and answer sets that the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "db5d5bae-0c9e-444e-9390-8a5fea98c253",
|                                               "Value":  "RealTimeActivityFeed.Read.All",
|                                               "DisplayName":  "Access real-time enriched data in a meeting",
|                                               "Description":  "Allows the app to get direct access to real-time enriched data in a meeting, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "07f995eb-fc67-4522-ad66-2b8ca8ea3efd",
|                                               "Value":  "RecordsManagement.Read.All",
|                                               "DisplayName":  "Read Records Management configuration, labels, and policies",
|                                               "Description":  "Allows the application to read any data from Records Management, such as configuration, labels, and policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f2833d75-a4e6-40ab-86d4-6dfe73c97605",
|                                               "Value":  "RecordsManagement.ReadWrite.All",
|                                               "DisplayName":  "Read and write Records Management configuration, labels, and policies",
|                                               "Description":  "Allow the application to create, update and delete any data from Records Management, such as configuration, labels, and policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "02e97553-ed7b-43d0-ab3c-f8bace0d040c",
|                                               "Value":  "Reports.Read.All",
|                                               "DisplayName":  "Read all usage reports",
|                                               "Description":  "Allows an app to read all service usage reports on behalf of the signed-in user.  Services that provide usage reports include Office 365 and Azure Active Directory."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "84fac5f4-33a9-4100-aa38-a20c6d29e5e7",
|                                               "Value":  "ReportSettings.Read.All",
|                                               "DisplayName":  "Read admin report settings",
|                                               "Description":  "Allows the app to read admin report settings, such as whether to display concealed information in reports, on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b955410e-7715-4a88-a940-dfd551018df3",
|                                               "Value":  "ReportSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write admin report settings",
|                                               "Description":  "Allows the app to read and update admin report settings, such as whether to display concealed information in reports, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cb530fca-534b-4e72-aa74-bca7e8bbd06f",
|                                               "Value":  "ResourceSpecificPermissionGrant.ReadForChat",
|                                               "DisplayName":  "Read resource specific permissions granted on a chat",
|                                               "Description":  "Allows the app to read the resource specific permissions granted on the chat, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eafad40c-bf7a-415a-b7f8-acdf5706b58f",
|                                               "Value":  "ResourceSpecificPermissionGrant.ReadForTeam",
|                                               "DisplayName":  "Read resource specific permissions granted on a team",
|                                               "Description":  "Allows the app to read the resource specific permissions granted on the team, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f1d91a8f-88e7-4774-8401-b668d5bca0c5",
|                                               "Value":  "ResourceSpecificPermissionGrant.ReadForUser",
|                                               "DisplayName":  "Read resource specific permissions granted on a user account",
|                                               "Description":  "Allows the app to read the resource specific permissions granted on a user account, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e197c06f-ae7b-4398-b0a2-89f76ebca159",
|                                               "Value":  "RiskPreventionProviders.Read.All",
|                                               "DisplayName":  "Read all identity risk prevention providers",
|                                               "Description":  "Allows the app to read your organization\u0027s risk prevention providers, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2a7babba-9623-4109-bc9c-79728cf3bb4f",
|                                               "Value":  "RiskPreventionProviders.ReadWrite.All",
|                                               "DisplayName":  "Read and write all identity risk prevention providers",
|                                               "Description":  "Allows the app to read and write your organization\u0027s risk prevention providers, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "344a729c-0285-42c6-9014-f12b9b8d6129",
|                                               "Value":  "RoleAssignmentSchedule.Read.Directory",
|                                               "DisplayName":  "Read all active role assignments for your company\u0027s directory",
|                                               "Description":  "Allows the app to read the active role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user. This includes reading directory role templates, and directory roles."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8c026be3-8e26-4774-9372-8d5d6f21daff",
|                                               "Value":  "RoleAssignmentSchedule.ReadWrite.Directory",
|                                               "DisplayName":  "Read, update, and delete all active role assignments for your company\u0027s directory",
|                                               "Description":  "Allows the app to read and manage the active role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user. This includes managing active directory role membership, and reading directory role templates, directory roles and active memberships."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f71cd05c-3fdb-4568-aef2-e1cf62ee20d4",
|                                               "Value":  "RoleAssignmentSchedule.Remove.Directory",
|                                               "DisplayName":  "Delete all active role assignments for your company\u0027s directory",
|                                               "Description":  "Allows the app to delete the active role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eb0788c2-6d4e-4658-8c9e-c0fb8053f03d",
|                                               "Value":  "RoleEligibilitySchedule.Read.Directory",
|                                               "DisplayName":  "Read all eligible role assignments for your company\u0027s directory",
|                                               "Description":  "Allows the app to read the eligible role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user. This includes reading directory role templates, and directory roles."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "62ade113-f8e0-4bf9-a6ba-5acb31db32fd",
|                                               "Value":  "RoleEligibilitySchedule.ReadWrite.Directory",
|                                               "DisplayName":  "Read, update, and delete  all eligible role assignments for your company\u0027s directory",
|                                               "Description":  "Allows the app to read and manage the eligible role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user. This includes managing eligible directory role membership, and reading directory role templates, directory roles and eligible memberships."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "58ac4fa2-b484-4d6e-ba97-beee2a574220",
|                                               "Value":  "RoleEligibilitySchedule.Remove.Directory",
|                                               "DisplayName":  "Delete all eligible role assignments for your company\u0027s directory",
|                                               "Description":  "Allows the app to delete the eligible role-based access control (RBAC) assignments for your company\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "48fec646-b2ba-4019-8681-8eb31435aded",
|                                               "Value":  "RoleManagement.Read.All",
|                                               "DisplayName":  "Read role management data for all RBAC providers",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) settings for all RBAC providers, on behalf of the signed-in user.  This includes reading role definitions and role assignments."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9619b88a-8a25-48a7-9571-d23be0337a79",
|                                               "Value":  "RoleManagement.Read.CloudPC",
|                                               "DisplayName":  "Read Cloud PC RBAC settings",
|                                               "Description":  "Allows the app to read the Cloud PC role-based access control (RBAC) settings, on behalf of the signed-in user.  This includes reading Cloud PC role definitions and role assignments."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dd689728-6eb8-4deb-bd38-2924a935f3de",
|                                               "Value":  "RoleManagement.Read.Defender",
|                                               "DisplayName":  "Read M365 Defender RBAC configuration",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, on behalf of the signed-in user. This includes reading M365 Defender role definitions and role assignments."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "741c54c3-0c1e-44a1-818b-3f97ab4e8c83",
|                                               "Value":  "RoleManagement.Read.Directory",
|                                               "DisplayName":  "Read directory RBAC settings",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, on behalf of the signed-in user.  This includes reading directory role templates, directory roles and memberships."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3bc15058-7858-4141-b24f-ae43b4e80b52",
|                                               "Value":  "RoleManagement.Read.Exchange",
|                                               "DisplayName":  "Read Exchange Online RBAC configuration",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) settings for your organization\u0027s Exchange Online service, on behalf of the signed-in user. This includes reading Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "501d06f8-07b8-4f18-b5c6-c191a4af7a82",
|                                               "Value":  "RoleManagement.ReadWrite.CloudPC",
|                                               "DisplayName":  "Read and write Cloud PC RBAC settings",
|                                               "Description":  "Allows the app to read and manage the Cloud PC role-based access control (RBAC) settings, on behalf of the signed-in user. This includes reading and managing Cloud PC role definitions and role assignments."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d8914f8f-9f64-4bd1-b4d3-f5a701ed8457",
|                                               "Value":  "RoleManagement.ReadWrite.Defender",
|                                               "DisplayName":  "Read M365 Defender RBAC configuration",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) settings for your company\u0027s directory, on behalf of the signed-in user. This includes reading M365 Defender role definitions and role assignments."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d01b97e9-cbc0-49fe-810a-750afd5527a3",
|                                               "Value":  "RoleManagement.ReadWrite.Directory",
|                                               "DisplayName":  "Read and write directory RBAC settings",
|                                               "Description":  "Allows the app to read and manage the role-based access control (RBAC) settings for your company\u0027s directory, on behalf of the signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c1499fe0-52b1-4b22-bed2-7a244e0e879f",
|                                               "Value":  "RoleManagement.ReadWrite.Exchange",
|                                               "DisplayName":  "Read and write Exchange Online RBAC configuration",
|                                               "Description":  "Allows the app to read and manage the role-based access control (RBAC) settings for your organization\u0027s Exchange Online service, on behalf of the signed-in user. This includes reading, creating, updating, and deleting Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cce71173-f76d-446e-97ff-efb2d82e11b1",
|                                               "Value":  "RoleManagementAlert.Read.Directory",
|                                               "DisplayName":  "Read all alert data for your company\u0027s directory",
|                                               "Description":  "Allows the app to read the role-based access control (RBAC) alerts for your company\u0027s directory, on behalf of the signed-in user. This includes reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "435644c6-a5b1-40bf-8f52-fe8e5b53e19c",
|                                               "Value":  "RoleManagementAlert.ReadWrite.Directory",
|                                               "DisplayName":  "Read all alert data, configure alerts, and take actions on all alerts for your company\u0027s directory",
|                                               "Description":  "Allows the app to read and manage the role-based access control (RBAC) alerts for your company\u0027s directory, on behalf of the signed-in user. This includes managing alert settings, initiating alert scans, dismissing alerts, remediating alert incidents, and reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7e26fdff-9cb1-4e56-bede-211fe0e420e8",
|                                               "Value":  "RoleManagementPolicy.Read.AzureADGroup",
|                                               "DisplayName":  "Read all policies in PIM for Groups",
|                                               "Description":  "Allows the app to read policies in Privileged Identity Management for Groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3de2cdbe-0ff5-47d5-bdee-7f45b4749ead",
|                                               "Value":  "RoleManagementPolicy.Read.Directory",
|                                               "DisplayName":  "Read all policies for privileged role assignments of your company\u0027s directory",
|                                               "Description":  "Allows the app to read policies for privileged role-based access control (RBAC) assignments of your company\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8b3ffd3b-178e-4aae-be39-ba87585eddb2",
|                                               "Value":  "RoleManagementPolicy.Read.EntraAppRole",
|                                               "DisplayName":  "Read all policies in PIM for App Roles",
|                                               "Description":  "Allows the app to read policies in Privileged Identity Management for App Roles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0da165c7-3f15-4236-b733-c0b0f6abe41d",
|                                               "Value":  "RoleManagementPolicy.ReadWrite.AzureADGroup",
|                                               "DisplayName":  "Read, update, and delete all policies in PIM for Groups",
|                                               "Description":  "Allows the app to read, update, and delete policies in Privileged Identity Management for Groups, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1ff1be21-34eb-448c-9ac9-ce1f506b2a68",
|                                               "Value":  "RoleManagementPolicy.ReadWrite.Directory",
|                                               "DisplayName":  "Read, update, and delete all policies for privileged role assignments of your company\u0027s directory",
|                                               "Description":  "Allows the app to read, update, and delete policies for privileged role-based access control (RBAC) assignments of your company\u0027s directory, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "652ec839-e4ac-4eb5-b545-ecc90eeceb2d",
|                                               "Value":  "RoleManagementPolicy.ReadWrite.EntraAppRole",
|                                               "DisplayName":  "Manage all policies in PIM for App Roles",
|                                               "Description":  "Allows the app to manage policies in Privileged Identity Management for App Roles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fccf6dd8-5706-49fa-811f-69e2e1b585d0",
|                                               "Value":  "Schedule.Read.All",
|                                               "DisplayName":  "Read user schedule items",
|                                               "Description":  "Allows the app to read schedule, schedule groups, shifts and associated entities in the Teams or Shifts application on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "63f27281-c9d9-4f29-94dd-6942f7f1feb0",
|                                               "Value":  "Schedule.ReadWrite.All",
|                                               "DisplayName":  "Read and write user schedule items",
|                                               "Description":  "Allows the app to manage schedule, schedule groups, shifts and associated entities in the Teams or Shifts application on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "07919803-6073-4cd8-bc55-28077db0ee10",
|                                               "Value":  "SchedulePermissions.ReadWrite.All",
|                                               "DisplayName":  "Read/Write schedule permissions for a role.",
|                                               "Description":  "Allows the app to read/write schedule permissions for a specific role in Shifts application on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7d307522-aa38-4cd0-bd60-90c6f0ac50bd",
|                                               "Value":  "SearchConfiguration.Read.All",
|                                               "DisplayName":  "Read your organization\u0027s search configuration",
|                                               "Description":  "Allows the app to read search configuration, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b1a7d408-cab0-47d2-a2a5-a74a3733600d",
|                                               "Value":  "SearchConfiguration.ReadWrite.All",
|                                               "DisplayName":  "Read and write your organization\u0027s search configuration",
|                                               "Description":  "Allows the app to read and write search configuration, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1638cddf-07a4-4de2-8645-69c96cacad73",
|                                               "Value":  "SecurityActions.Read.All",
|                                               "DisplayName":  "Read your organization\u0027s security actions",
|                                               "Description":  "Allows the app to read security actions, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dc38509c-b87d-4da0-bd92-6bec988bac4a",
|                                               "Value":  "SecurityActions.ReadWrite.All",
|                                               "DisplayName":  "Read and update your organization\u0027s security actions",
|                                               "Description":  "Allows the app to read or update security actions, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bc257fb8-46b4-4b15-8713-01e91bfbe4ea",
|                                               "Value":  "SecurityAlert.Read.All",
|                                               "DisplayName":  "Read all security alerts",
|                                               "Description":  "Allows the app to read all security alerts, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "471f2a7f-2a42-4d45-a2bf-594d0838070d",
|                                               "Value":  "SecurityAlert.ReadWrite.All",
|                                               "DisplayName":  "Read and write to all security alerts",
|                                               "Description":  "Allows the app to read and write to all security alerts, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "53e6783e-b127-4a35-ab3a-6a52d80a9077",
|                                               "Value":  "SecurityAnalyzedMessage.Read.All",
|                                               "DisplayName":  "Read metadata and detection details for emails in your organization",
|                                               "Description":  "Read email metadata and security detection details on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "48eb8c83-6e58-46e7-a6d3-8805822f5940",
|                                               "Value":  "SecurityAnalyzedMessage.ReadWrite.All",
|                                               "DisplayName":  "Read metadata, detection details, and execute remediation actions on emails in your organization",
|                                               "Description":  "Read email metadata, security detection details, and execute remediation actions like deleting an email, on behalf of the signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "84499c31-ac2e-44d3-a0cf-a6c386d4dfe8",
|                                               "Value":  "SecurityCopilotWorkspaces.Read.All",
|                                               "DisplayName":  "Read all Security Copilot resources for the signed-in user",
|                                               "Description":  "Allows the app to read all Security Copilot signed-in user\u0027s resources on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "206291b0-2167-47a7-a640-6cdc1df710ba",
|                                               "Value":  "SecurityCopilotWorkspaces.ReadWrite.All",
|                                               "DisplayName":  "Read and write individually owned Security Copilot resources of the signed-in user",
|                                               "Description":  "Allows the app to read and write Security Copilot resources owned by the signed-in user on their behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "64733abd-851e-478a-bffb-e47a14b18235",
|                                               "Value":  "SecurityEvents.Read.All",
|                                               "DisplayName":  "Read your organization’s security events",
|                                               "Description":  "Allows the app to read your organization’s security events on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6aedf524-7e1c-45a7-bd76-ded8cab8d0fc",
|                                               "Value":  "SecurityEvents.ReadWrite.All",
|                                               "DisplayName":  "Read and update your organization’s security events",
|                                               "Description":  "Allows the app to read your organization’s security events on behalf of the signed-in user. Also allows the app to update editable properties in security events on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3e9ed69a-a48e-473c-8b97-413016703a37",
|                                               "Value":  "SecurityIdentitiesAccount.Read.All",
|                                               "DisplayName":  "Read identity security available identity accounts",
|                                               "Description":  "Allows the app to read all the identity security available identity accounts"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "818229ce-20e4-47bd-92f4-bc94dbb37a56",
|                                               "Value":  "SecurityIdentitiesActions.ReadWrite.All",
|                                               "DisplayName":  "Read and perform identity security available actions",
|                                               "Description":  "Allows the app to read and write identity security available actions on behalf of the signed-in identity."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8ff90903-1ecb-4f3a-b8b2-42120374ecd6",
|                                               "Value":  "SecurityIdentitiesAutoConfig.Read.All",
|                                               "DisplayName":  "Read sensors window auditing configuration",
|                                               "Description":  "Allows the app to read the sensors window auditing configuration of the signed in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b810fdb4-8733-43bd-9b37-fddb7215c69f",
|                                               "Value":  "SecurityIdentitiesAutoConfig.ReadWrite.All",
|                                               "DisplayName":  "Read and write sensors window auditing configuration",
|                                               "Description":  "Allows the app to read and write the sensors window auditing configuration of the signed in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a0d0da43-a6df-4416-b63d-99c79991aae8",
|                                               "Value":  "SecurityIdentitiesHealth.Read.All",
|                                               "DisplayName":  "Read identity security health issues",
|                                               "Description":  "Allows the app to read all the identity security health issues of signed user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "53e51eec-2d9b-4990-97f3-c9aa5d5652c3",
|                                               "Value":  "SecurityIdentitiesHealth.ReadWrite.All",
|                                               "DisplayName":  "Read and write identity security health issues",
|                                               "Description":  "Allows the app to read and write identity security health issues on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "63595162-fcc0-4127-8b1e-bfe90b23a10e",
|                                               "Value":  "SecurityIdentitiesMigration.Read.All",
|                                               "DisplayName":  "Read identity security sensor migration",
|                                               "Description":  "Allows the app to read all the identity security sensor migration information of signed user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "741a6ef0-37e6-4b0a-9178-133d94fbc46e",
|                                               "Value":  "SecurityIdentitiesMigration.ReadWrite.All",
|                                               "DisplayName":  "Read and write identity security sensor migration",
|                                               "Description":  "Allows the app to read and write identity security sensor migration on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2c221239-7c5c-4b30-9355-d84663bfcd96",
|                                               "Value":  "SecurityIdentitiesSensors.Read.All",
|                                               "DisplayName":  "Read identity security sensors",
|                                               "Description":  "Allows the app to read all the identity security sensors of signed user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "087c3ad9-c2ca-4b82-9885-d5e25ce9e183",
|                                               "Value":  "SecurityIdentitiesSensors.ReadWrite.All",
|                                               "DisplayName":  "Read and write identity security sensors",
|                                               "Description":  "Allows the app to read and write identity security sensors on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c7d0a939-da1c-4aca-80fa-d0a6cd924801",
|                                               "Value":  "SecurityIdentitiesUserActions.Read.All",
|                                               "DisplayName":  "Read identity security available user actions",
|                                               "Description":  "Allows the app to read all the identity security available user actions of signed user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bf230e97-1957-4df6-b3f6-57f9029eacdf",
|                                               "Value":  "SecurityIdentitiesUserActions.ReadWrite.All",
|                                               "DisplayName":  "Read and perform identity security available user actions",
|                                               "Description":  "Allows the app to read and write identity security available user actions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b9abcc4f-94fc-4457-9141-d20ce80ec952",
|                                               "Value":  "SecurityIncident.Read.All",
|                                               "DisplayName":  "Read incidents",
|                                               "Description":  "Allows the app to read security incidents, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "128ca929-1a19-45e6-a3b8-435ec44a36ba",
|                                               "Value":  "SecurityIncident.ReadWrite.All",
|                                               "DisplayName":  "Read and write to incidents",
|                                               "Description":  "Allows the app to read and write security incidents, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a4633e44-d355-4474-99df-8c2de6b0e39e",
|                                               "Value":  "SensitivityLabel.Evaluate",
|                                               "DisplayName":  "Evaluate sensitivity labels",
|                                               "Description":  "Allow the app to determine if there is any sensitivity label to be applied automatically to the content or recommended to the user for manual application, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a42e3c42-b31e-4919-b699-696dca5dc9e7",
|                                               "Value":  "SensitivityLabel.Evaluate.All",
|                                               "DisplayName":  "Evaluate labels tenant scope.",
|                                               "Description":  "Allows the app to evaluate all sensitivity label."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1aeb73ce-68d7-49b7-913a-eedc80844551",
|                                               "Value":  "SensitivityLabel.Read",
|                                               "DisplayName":  "Get labels user scope.",
|                                               "Description":  "Allows the app to get sensitivity labels."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8b377c27-ea19-4863-a948-8a8588c8f2c3",
|                                               "Value":  "SensitivityLabels.Read.All",
|                                               "DisplayName":  "Get labels app scope.",
|                                               "Description":  "Allows the app to get sensitivity labels."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "df9fd94d-51ff-443d-8f31-ae4dc1b5b8d8",
|                                               "Value":  "SentimentSurvey.Export.All",
|                                               "DisplayName":  "Export all Sentiment Survey",
|                                               "Description":  "Allows the app to export all Sentiment Survey, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1fe7aa48-9373-4a47-8df3-168335e0f4c9",
|                                               "Value":  "ServiceActivity-Exchange.Read.All",
|                                               "DisplayName":  "Read all Exchange service activity",
|                                               "Description":  "Allows the app to read all Exchange service activity, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d74c75b1-d5a9-479d-902d-92f8f99182c1",
|                                               "Value":  "ServiceActivity-Microsoft365Web.Read.All",
|                                               "DisplayName":  "Read all Microsoft 365 Web service activity",
|                                               "Description":  "Allows the app to read all Microsoft 365 Web service activity, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "347e3c16-30f3-4ac7-9b52-fc3c053de9c9",
|                                               "Value":  "ServiceActivity-OneDrive.Read.All",
|                                               "DisplayName":  "Read all One Drive service activity",
|                                               "Description":  "Allows the app to read all One Drive service activity, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "404d76f0-e10e-460a-92be-ef19600c54d1",
|                                               "Value":  "ServiceActivity-Teams.Read.All",
|                                               "DisplayName":  "Read all Teams service activity",
|                                               "Description":  "Allows the app to read all Teams service activity, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "55896846-df78-47a7-aa94-8d3d4442ca7f",
|                                               "Value":  "ServiceHealth.Read.All",
|                                               "DisplayName":  "Read service health",
|                                               "Description":  "Allows the app to read your tenant\u0027s service health information on behalf of the signed-in user. Health information may include service issues or service health overviews."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eda39fa6-f8cf-4c3c-a909-432c683e4c9b",
|                                               "Value":  "ServiceMessage.Read.All",
|                                               "DisplayName":  "Read service announcement messages",
|                                               "Description":  "Allows the app to read your tenant\u0027s service announcement messages on behalf of the signed-in user. Messages may include information about new or changed features."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "636e1b0b-1cc2-4b1c-9aa9-4eeed9b9761b",
|                                               "Value":  "ServiceMessageViewpoint.Write",
|                                               "DisplayName":  "Update user status on service announcement messages",
|                                               "Description":  "Allows the app to update service announcement messages\u0027 user status on behalf of the signed-in user. The message status can be marked as read, archive, or favorite."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9f9ce928-e038-4e3b-8faf-7b59049a8ddc",
|                                               "Value":  "ServicePrincipalEndpoint.Read.All",
|                                               "DisplayName":  "Read service principal endpoints",
|                                               "Description":  "Allows the app to read service principal endpoints"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7297d82c-9546-4aed-91df-3d4f0a9b3ff0",
|                                               "Value":  "ServicePrincipalEndpoint.ReadWrite.All",
|                                               "DisplayName":  "Read and update service principal endpoints",
|                                               "Description":  "Allows the app to update service principal endpoints"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c608c170-08b5-466b-a8fe-0b4074b01613",
|                                               "Value":  "SharePointCrossTenantMigration.Manage.All",
|                                               "DisplayName":  "Read, write and manage SharePoint Cross-Tenant migration settings and tasks",
|                                               "Description":  "Allows the app to read, write and manage your tenant\u0027s SharePoint Cross-Tenant migration settings and tasks, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "00dcb678-f9af-4e73-acb1-4f1657364629",
|                                               "Value":  "SharePointCrossTenantMigration.Read.All",
|                                               "DisplayName":  "Read SharePoint Cross-Tenant migration settings and tasks",
|                                               "Description":  "Allows the app to read your tenant\u0027s SharePoint Cross-Tenant migration settings and tasks, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2ef70e10-5bfd-4ede-a5f6-67720500b258",
|                                               "Value":  "SharePointTenantSettings.Read.All",
|                                               "DisplayName":  "Read SharePoint and OneDrive tenant settings",
|                                               "Description":  "Allows the application to read the tenant-level settings in SharePoint and OneDrive on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "aa07f155-3612-49b8-a147-6c590df35536",
|                                               "Value":  "SharePointTenantSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and change SharePoint and OneDrive tenant settings",
|                                               "Description":  "Allows the application to read and change the tenant-level settings of SharePoint and OneDrive on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "50f66e47-eb56-45b7-aaa2-75057d9afe08",
|                                               "Value":  "ShortNotes.Read",
|                                               "DisplayName":  "Read short notes of the signed-in user",
|                                               "Description":  "Allows the app to read all the short notes a sign-in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "328438b7-4c01-4c07-a840-e625a749bb89",
|                                               "Value":  "ShortNotes.ReadWrite",
|                                               "DisplayName":  "Read, create, edit, and delete short notes of the signed-in user",
|                                               "Description":  "Allows the app to read, create, edit, and delete short notes of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "458e1edc-1e75-438c-8c7b-c32115c9d373",
|                                               "Value":  "SignInIdentifier.Read.All",
|                                               "DisplayName":  "Read SignInIdentifiers",
|                                               "Description":  "Allows the app to read your organization\u0027s sign-in identifiers, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b4673c3c-7b5a-4012-9826-7c7e3c8db6af",
|                                               "Value":  "SignInIdentifier.ReadWrite.All",
|                                               "DisplayName":  "Read and write all sign-in identifiers",
|                                               "Description":  "Allows the app to read and write your organization\u0027s sign-in identifiers, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0e2e68e1-3f32-4e10-9281-f749e097fcbe",
|                                               "Value":  "Sites.Create.All",
|                                               "DisplayName":  "Create Site Collections, on behalf of the signed-in user",
|                                               "Description":  "Allow the application to create site collections on behalf of the signed in user. Upon creation the application will be granted Sites.Selected(delegated) + FullControl to the newly created site."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5a54b8b3-347c-476d-8f8e-42d5c7424d29",
|                                               "Value":  "Sites.FullControl.All",
|                                               "DisplayName":  "Have full control of all site collections",
|                                               "Description":  "Allows the application to have full control of all site collections on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "65e50fdc-43b7-4915-933e-e8138f11f40a",
|                                               "Value":  "Sites.Manage.All",
|                                               "DisplayName":  "Create, edit, and delete items and lists in all site collections",
|                                               "Description":  "Allows the application to create or delete document libraries and lists in all site collections on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "205e70e5-aba6-4c52-a976-6d2d46c48043",
|                                               "Value":  "Sites.Read.All",
|                                               "DisplayName":  "Read items in all site collections",
|                                               "Description":  "Allows the application to read documents and list  items in all site collections on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "89fe6a52-be36-487e-b7d8-d061c450a026",
|                                               "Value":  "Sites.ReadWrite.All",
|                                               "DisplayName":  "Edit or delete items in all site collections",
|                                               "Description":  "Allows the application to edit or delete documents and list items in all site collections on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f89c84ef-20d0-4b54-87e9-02e856d66d53",
|                                               "Value":  "Sites.Selected",
|                                               "DisplayName":  "Access selected Sites, on behalf of the signed-in user",
|                                               "Description":  "Allow the application to access a subset of site collections on behalf of the signed-in user.  The specific site collections and the permissions granted will be configured in SharePoint Online."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "258f6531-6087-4cc4-bb90-092c5fb3ed3f",
|                                               "Value":  "SMTP.Send",
|                                               "DisplayName":  "Send emails from mailboxes using SMTP AUTH.",
|                                               "Description":  "Allows the app to be able to send emails from the user’s mailbox using the SMTP AUTH client submission protocol."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9b4aa4b1-aaf3-41b7-b743-698b27e77ff6",
|                                               "Value":  "SpiffeTrustDomain.Read.All",
|                                               "DisplayName":  "Read SPIFFE trust domains and child resources",
|                                               "Description":  "Allows the app to read your organization\u0027s SPIFFE trust domains and child resources on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8ba47079-8c47-4bfe-b2ce-13f28ef37247",
|                                               "Value":  "SpiffeTrustDomain.ReadWrite.All",
|                                               "DisplayName":  "Read and write SPIFFE trust domains and child resources",
|                                               "Description":  "Allows the app to read and write your organization\u0027s SPIFFE trust domains and child resources on behalf of the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fd1d61cb-4e4b-4d15-a6d2-161348681d84",
|                                               "Value":  "Storyline.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Viva Engage storylines",
|                                               "Description":  "Allows the app to modify the Viva Engage storyline and read all storyline properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9c3af74c-fd0f-4db4-b17a-71939e2a9d77",
|                                               "Value":  "SubjectRightsRequest.Read.All",
|                                               "DisplayName":  "Read subject rights requests",
|                                               "Description":  "Allows the app to read subject rights requests on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2b8fcc74-bce1-4ae3-a0e8-60c53739299d",
|                                               "Value":  "SubjectRightsRequest.ReadWrite.All",
|                                               "DisplayName":  "Read and write subject rights requests",
|                                               "Description":  "Allows the app to read and write subject rights requests on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5f88184c-80bb-4d52-9ff2-757288b2e9b7",
|                                               "Value":  "Subscription.Read.All",
|                                               "DisplayName":  "Read all webhook subscriptions ",
|                                               "Description":  "Allows the app to read all webhook subscriptions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7aa02aeb-824f-4fbe-a3f7-611f751f5b55",
|                                               "Value":  "Synchronization.Read.All",
|                                               "DisplayName":  "Read all Azure AD synchronization data",
|                                               "Description":  "Allows the app to read Azure AD synchronization information, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7bb27fa3-ea8f-4d67-a916-87715b6188bd",
|                                               "Value":  "Synchronization.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Azure AD synchronization data",
|                                               "Description":  "Allows the app to configure the Azure AD synchronization service, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1a2e7420-4e92-4d2b-94cb-fb2952e9ddf7",
|                                               "Value":  "SynchronizationData-User.Upload",
|                                               "DisplayName":  "Upload user data to the identity synchronization service",
|                                               "Description":  "Allows the app to upload bulk user data to the identity synchronization service, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f45671fb-e0fe-4b4b-be20-3d3ce43f1bcb",
|                                               "Value":  "Tasks.Read",
|                                               "DisplayName":  "Read user\u0027s tasks and task lists",
|                                               "Description":  "Allows the app to read the signed-in user’s tasks and task lists, including any shared with the user. Doesn\u0027t include permission to create, delete, or update anything."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "88d21fd4-8e5a-4c32-b5e2-4a1c95f34f72",
|                                               "Value":  "Tasks.Read.Shared",
|                                               "DisplayName":  "Read user and shared tasks",
|                                               "Description":  "Allows the app to read tasks a user has permissions to access, including their own and shared tasks."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2219042f-cab5-40cc-b0d2-16b1540b4c5f",
|                                               "Value":  "Tasks.ReadWrite",
|                                               "DisplayName":  "Create, read, update, and delete user’s tasks and task lists",
|                                               "Description":  "Allows the app to create, read, update, and delete the signed-in user\u0027s tasks and task lists, including any shared with the user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c5ddf11b-c114-4886-8558-8a4e557cd52b",
|                                               "Value":  "Tasks.ReadWrite.Shared",
|                                               "DisplayName":  "Read and write user and shared tasks",
|                                               "Description":  "Allows the app to create, read, update, and delete tasks a user has permissions to, including their own and shared tasks."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7825d5d6-6049-4ce7-bdf6-3b8d53f4bcd0",
|                                               "Value":  "Team.Create",
|                                               "DisplayName":  "Create teams",
|                                               "Description":  "Allows the app to create teams on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "485be79e-c497-4b35-9400-0e3fa7f2a5d4",
|                                               "Value":  "Team.ReadBasic.All",
|                                               "DisplayName":  "Read the names and descriptions of teams",
|                                               "Description":  "Read the names and  descriptions of teams, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2497278c-d82d-46a2-b1ce-39d4cdde5570",
|                                               "Value":  "TeamMember.Read.All",
|                                               "DisplayName":  "Read the members of teams",
|                                               "Description":  "Read the members of teams, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4a06efd2-f825-4e34-813e-82a57b03d1ee",
|                                               "Value":  "TeamMember.ReadWrite.All",
|                                               "DisplayName":  "Add and remove members from teams",
|                                               "Description":  "Add and remove members from teams, on behalf of the signed-in user. Also allows changing a member\u0027s role, for example from owner to non-owner."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2104a4db-3a2f-4ea0-9dba-143d457dc666",
|                                               "Value":  "TeamMember.ReadWriteNonOwnerRole.All",
|                                               "DisplayName":  "Add and remove members with non-owner role for all teams",
|                                               "Description":  "Add and remove members from all teams, on behalf of the signed-in user. Does not allow adding or removing a member with the owner role. Additionally, does not allow the app to elevate an existing member to the owner role."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0e755559-83fb-4b44-91d0-4cc721b9323e",
|                                               "Value":  "TeamsActivity.Read",
|                                               "DisplayName":  "Read user\u0027s teamwork activity feed",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s teamwork activity feed."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7ab1d787-bae7-4d5d-8db6-37ea32df9186",
|                                               "Value":  "TeamsActivity.Send",
|                                               "DisplayName":  "Send a teamwork activity as the user",
|                                               "Description":  "Allows the app to create new notifications in users\u0027 teamwork activity feeds on behalf of the signed in user. These notifications may not be discoverable or be held or governed by compliance policies."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d1ba22c6-3f02-4c91-addb-bc3399bcca88",
|                                               "Value":  "TeamsAppInstallation.ManageSelectedForChat",
|                                               "DisplayName":  "Manage installation and permission grants of selected Teams apps in chats",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in chats the signed-in user can access. Gives the ability to manage permission grants for accessing those specific chats\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c67b2d7e-6b80-4218-938a-05e73058e42d",
|                                               "Value":  "TeamsAppInstallation.ManageSelectedForTeam",
|                                               "DisplayName":  "Manage installation and permission grants of selected Teams apps in teams",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Gives the ability to manage permission grants for accessing those specific teams\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "830c2bd9-c335-4caf-bf83-c07fa8a23ef1",
|                                               "Value":  "TeamsAppInstallation.ManageSelectedForUser",
|                                               "DisplayName":  "Manage installation and permission grants of selected Teams apps in users\u0027 personal scope",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall seleected Teams apps in user accounts, on behalf of the signed-in user. Gives the ability to manage permission grants for accessing those specific users\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bf3fbf03-f35f-4e93-963e-47e4d874c37a",
|                                               "Value":  "TeamsAppInstallation.ReadForChat",
|                                               "DisplayName":  "Read installed Teams apps in chats",
|                                               "Description":  "Allows the app to read the Teams apps that are installed in chats the signed-in user can access. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5248dcb1-f83b-4ec3-9f4d-a4428a961a72",
|                                               "Value":  "TeamsAppInstallation.ReadForTeam",
|                                               "DisplayName":  "Read installed Teams apps in teams",
|                                               "Description":  "Allows the app to read the Teams apps that are installed in teams the signed-in user can access. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c395395c-ff9a-4dba-bc1f-8372ba9dca84",
|                                               "Value":  "TeamsAppInstallation.ReadForUser",
|                                               "DisplayName":  "Read user\u0027s installed Teams apps",
|                                               "Description":  "Allows the app to read the Teams apps that are installed for the signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0f3420c2-c6ec-46de-ab72-fd51267087d5",
|                                               "Value":  "TeamsAppInstallation.ReadSelectedForChat",
|                                               "DisplayName":  "Read selected installed Teams apps in chats",
|                                               "Description":  "Allows the app to read the selected Teams apps that are installed in chats the signed-in user can access. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b55df1c0-db20-435b-aef2-afe6ed487e16",
|                                               "Value":  "TeamsAppInstallation.ReadSelectedForTeam",
|                                               "DisplayName":  "Read selected installed Teams apps in teams",
|                                               "Description":  "Allows the app to read the selected Teams apps that are installed in teams the signed-in user can access. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fe2e4e1d-101f-4fb2-9cb1-9d6659db45d4",
|                                               "Value":  "TeamsAppInstallation.ReadSelectedForUser",
|                                               "DisplayName":  "Read user\u0027s selected installed Teams apps",
|                                               "Description":  "Allows the app to read the selected Teams apps that are installed for the signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e1408a66-8f82-451b-a2f3-3c3e38f7413f",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentForChat",
|                                               "DisplayName":  "Manage installed Teams apps in chats",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in chats the signed-in user can access. Gives the ability to manage permission grants for accessing those specific chats\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "946349d5-2a9d-4535-abc0-7beeacaedd1d",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentForTeam",
|                                               "DisplayName":  "Manage installed Teams apps in teams",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Gives the ability to manage permission grants for accessing those specific teams\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2da62c49-dfbd-40df-ba16-fef3529d391c",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentForUser",
|                                               "DisplayName":  "Manage installation and permission grants of Teams apps in users\u0027 personal scope",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in user accounts, on behalf of the signed-in user. Gives the ability to manage permission grants for accessing those specific users\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a0e0e18b-8fb2-458f-8130-da2d7cab9c75",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForChat",
|                                               "DisplayName":  "Allow the Teams app to manage itself and its permission grants in chats",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in chats the signed-in user can access, and manage its permission grants for accessing those specific chats\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4a6bbf29-a0e1-4a4d-a7d1-cef17f772975",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForTeam",
|                                               "DisplayName":  "Allow the Teams app to manage itself and its permission grants in teams",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in teams the signed-in user can access, and manage its permission grants for accessing those specific teams\u0027 data."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7a349935-c54d-44ab-ab66-1b460d315be7",
|                                               "Value":  "TeamsAppInstallation.ReadWriteAndConsentSelfForUser",
|                                               "DisplayName":  "Allow the Teams app to manage itself and its permission grants in user accounts",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in user accounts, and manage its permission grants for accessing those specific users\u0027 data, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "aa85bf13-d771-4d5d-a9e6-bca04ce44edf",
|                                               "Value":  "TeamsAppInstallation.ReadWriteForChat",
|                                               "DisplayName":  "Manage installed Teams apps in chats",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in chats the signed-in user can access. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2e25a044-2580-450d-8859-42eeb6e996c0",
|                                               "Value":  "TeamsAppInstallation.ReadWriteForTeam",
|                                               "DisplayName":  "Manage installed Teams apps in teams",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "093f8818-d05f-49b8-95bc-9d2a73e9a43c",
|                                               "Value":  "TeamsAppInstallation.ReadWriteForUser",
|                                               "DisplayName":  "Manage user\u0027s installed Teams apps",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall Teams apps installed for the signed-in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "690aa3b6-4b71-41c2-a990-77a8c4768d2b",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelectedForChat",
|                                               "DisplayName":  "Manage selected Teams apps installed in chats",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in chats the signed-in user can access. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9131c833-9a49-4c54-b38f-615ecfc4fc69",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelectedForTeam",
|                                               "DisplayName":  "Manage selected Teams apps installed in teams",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps in teams the signed-in user can access. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ea819e27-c92a-4118-b83b-4540b125d744",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelectedForUser",
|                                               "DisplayName":  "Manage selected Teams apps installed for a user",
|                                               "Description":  "Allows the app to read, install, upgrade, and uninstall selected Teams apps installed for the signed in user. Does not give the ability to read application-specific settings."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0ce33576-30e8-43b7-99e5-62f8569a4002",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelfForChat",
|                                               "DisplayName":  "Allow the Teams app to manage itself in chats",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself in chats the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0f4595f7-64b1-4e13-81bc-11a249df07a9",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelfForTeam",
|                                               "DisplayName":  "Allow the app to manage itself in teams",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself to teams the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "207e0cb1-3ce7-4922-b991-5a760c346ebc",
|                                               "Value":  "TeamsAppInstallation.ReadWriteSelfForUser",
|                                               "DisplayName":  "Allow the Teams app to manage itself for a user",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall itself for the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "48638b3c-ad68-4383-8ac4-e6880ee6ca57",
|                                               "Value":  "TeamSettings.Read.All",
|                                               "DisplayName":  "Read teams\u0027 settings",
|                                               "Description":  "Read all teams\u0027 settings, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "39d65650-9d3e-4223-80db-a335590d027e",
|                                               "Value":  "TeamSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and change teams\u0027 settings",
|                                               "Description":  "Read and change all teams\u0027 settings, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6997c35c-a586-440c-8a0b-4ffe5d118dc0",
|                                               "Value":  "TeamsPolicyUserAssign.ReadWrite.All",
|                                               "DisplayName":  "Read and Write Teams policy user assignment and unassigment for all policy types.",
|                                               "Description":  "Allow the app to read or write/update the policy assignment and unassigment for Teams users for all policy type categories."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ea2cbd09-253c-4f69-a0e6-07383c5f07cc",
|                                               "Value":  "TeamsResourceAccount.Read.All",
|                                               "DisplayName":  "Read Teams resource accounts",
|                                               "Description":  "Allows the app to read your tenant\u0027s resource accounts on behalf of the signed-in admin user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a9ff19c2-f369-4a95-9a25-ba9d460efc8e",
|                                               "Value":  "TeamsTab.Create",
|                                               "DisplayName":  "Create tabs in Microsoft Teams.",
|                                               "Description":  "Allows the app to create tabs in any team in Microsoft Teams, on behalf of the signed-in user. This does not grant the ability to read, modify or delete tabs after they are created, or give access to the content inside the tabs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "59dacb05-e88d-4c13-a684-59f1afc8cc98",
|                                               "Value":  "TeamsTab.Read.All",
|                                               "DisplayName":  "Read tabs in Microsoft Teams.",
|                                               "Description":  "Read the names and settings of tabs inside any team in Microsoft Teams, on behalf of the signed-in user. This does not give access to the content inside the tabs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b98bfd41-87c6-45cc-b104-e2de4f0dafb9",
|                                               "Value":  "TeamsTab.ReadWrite.All",
|                                               "DisplayName":  "Read and write tabs in Microsoft Teams.",
|                                               "Description":  "Read and write tabs in any team in Microsoft Teams, on behalf of the signed-in user. This does not give access to the content inside the tabs."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ee928332-e9c2-4747-b4a0-f8c164b68de6",
|                                               "Value":  "TeamsTab.ReadWriteForChat",
|                                               "DisplayName":  "Allow the Teams app to manage all tabs in chats",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs in chats the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c975dd04-a06e-4fbb-9704-62daad77bb49",
|                                               "Value":  "TeamsTab.ReadWriteForTeam",
|                                               "DisplayName":  "Allow the Teams app to manage all tabs in teams",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs to teams the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c37c9b61-7762-4bff-a156-afc0005847a0",
|                                               "Value":  "TeamsTab.ReadWriteForUser",
|                                               "DisplayName":  "Allow the Teams app to manage all tabs for a user",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall all tabs for the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0c219d04-3abf-47f7-912d-5cca239e90e6",
|                                               "Value":  "TeamsTab.ReadWriteSelfForChat",
|                                               "DisplayName":  "Allow the Teams app to manage only its own tabs in chats",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs in chats the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f266662f-120a-4314-b26a-99b08617c7ef",
|                                               "Value":  "TeamsTab.ReadWriteSelfForTeam",
|                                               "DisplayName":  "Allow the Teams app to manage only its own tabs in teams",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs to teams the signed-in user can access."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "395dfec1-a0b9-465f-a783-8250a430cb8c",
|                                               "Value":  "TeamsTab.ReadWriteSelfForUser",
|                                               "DisplayName":  "Allow the Teams app to manage only its own tabs for a user",
|                                               "Description":  "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1bc6eab1-058d-4557-b011-d4c41cec88b7",
|                                               "Value":  "TeamsTelephoneNumber.Read.All",
|                                               "DisplayName":  "Read Tenant-Acquired Telephone Number Details",
|                                               "Description":  "Allows the app to read your tenant\u0027s acquired telephone number details on behalf of the signed-in admin user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "424b07a8-1209-4d17-9fe4-9018a93a1024",
|                                               "Value":  "TeamsTelephoneNumber.ReadWrite.All",
|                                               "DisplayName":  "Read and Modify Tenant-Acquired Telephone Number Details",
|                                               "Description":  "Allows the app to read and modify your tenant\u0027s acquired telephone number details on behalf of the signed-in admin user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5c469ce4-dab5-4afd-b9de-14f1ba4004a7",
|                                               "Value":  "TeamsUserConfiguration.Read.All",
|                                               "DisplayName":  "Read Teams user configurations",
|                                               "Description":  "Allows the app to read your tenant\u0027s user configurations on behalf of the signed-in admin user. User configuration may include attributes related to user, such as telephone number, assigned policies, etc."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cd87405c-5792-4f15-92f7-debc0db6d1d6",
|                                               "Value":  "TeamTemplates.Read",
|                                               "DisplayName":  "Read available Teams templates",
|                                               "Description":  "Allows the app to read the available Teams templates, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "594f4bb6-c083-4cf9-8aa8-213823bdf351",
|                                               "Value":  "Teamwork.Read.All",
|                                               "DisplayName":  "Read organizational teamwork settings",
|                                               "Description":  "Allows the app to read the teamwork settings of the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "44e060c4-bbdc-4256-a0b9-dcc0396db368",
|                                               "Value":  "TeamworkAppSettings.Read.All",
|                                               "DisplayName":  "Read Teams app settings",
|                                               "Description":  "Allows the app to read the Teams app settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "87c556f0-2bd9-4eed-bd74-5dd8af6eaf7e",
|                                               "Value":  "TeamworkAppSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write Teams app settings",
|                                               "Description":  "Allows the app to read and write the Teams app settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b659488b-9d28-4208-b2be-1c6652b3c970",
|                                               "Value":  "TeamworkDevice.Read.All",
|                                               "DisplayName":  "Read Teams devices",
|                                               "Description":  "Allow the app to read the management data for Teams devices on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ddd97ecb-5c31-43db-a235-0ee20e635c40",
|                                               "Value":  "TeamworkDevice.ReadWrite.All",
|                                               "DisplayName":  "Read and write Teams devices",
|                                               "Description":  "Allow the app to read and write the management data for Teams devices on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "87a3258d-8c34-49e2-ab91-9b8bdbd79177",
|                                               "Value":  "TeamworkSection.Read",
|                                               "DisplayName":  "Read your sections",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s sections (folders) for organizing chats and channels in Teams."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "70dbe5e8-39b9-40f3-8c65-3ec7b00ad804",
|                                               "Value":  "TeamworkSection.ReadWrite",
|                                               "DisplayName":  "Read and write your sections",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s sections (folders) for organizing chats and channels in Teams."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "57587d0b-8399-45be-b207-8050cec54575",
|                                               "Value":  "TeamworkTag.Read",
|                                               "DisplayName":  "Read tags in Teams",
|                                               "Description":  "Allows the app to read tags in Teams, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "539dabd7-b5b6-4117-b164-d60cd15a8671",
|                                               "Value":  "TeamworkTag.ReadWrite",
|                                               "DisplayName":  "Read and write tags in Teams",
|                                               "Description":  "Allows the app to read and write tags in Teams, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "162354de-2885-4e5a-94fb-2f03019a65a8",
|                                               "Value":  "TeamworkTargetedMessage.ReadWrite",
|                                               "DisplayName":  "Update targeted messages belonging to the user",
|                                               "Description":  "Allows the user to update group chat or channel targeted messages in Microsoft Teams."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b4d26916-07e0-4daf-9096-9f6d9174aa96",
|                                               "Value":  "TeamworkUserInteraction.Read.All",
|                                               "DisplayName":  "Read all of the possible Teams interactions between the user and other users",
|                                               "Description":  "Allows the app to read all of the possible Teams interactions between the signed-in user and other users"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fda068e8-0524-485e-8d7f-b5bc29b0dae9",
|                                               "Value":  "TenantGovernance-Invitation.Read.All",
|                                               "DisplayName":  "Read Tenant Governance invitations",
|                                               "Description":  "Allows the application to list and read all Tenant Governance invitations on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "42b91635-3803-4af2-a2d5-e91127f9c488",
|                                               "Value":  "TenantGovernance-Invitation.ReadWrite.All",
|                                               "DisplayName":  "Read and write Tenant Governance invitations",
|                                               "Description":  "Allows the application to list, read, create, and delete Tenant Governance invitations on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ad222a15-813d-46b8-8f8d-1976a69a74f3",
|                                               "Value":  "TenantGovernance-PolicyTemplate.Read.All",
|                                               "DisplayName":  "Read Tenant Governance policy templates",
|                                               "Description":  "Allows the application to list and read all Tenant Governance policy templates on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7cd0bd21-45fe-4c8e-a549-3c95bd27d185",
|                                               "Value":  "TenantGovernance-PolicyTemplate.ReadWrite.All",
|                                               "DisplayName":  "Read and write Tenant Governance policy templates",
|                                               "Description":  "Allows the application to list, read, create, update, and delete Tenant Governance policy templates on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9caaca93-f090-4b9a-b4bb-17de251354d4",
|                                               "Value":  "TenantGovernance-RelatedTenant.Read.All",
|                                               "DisplayName":  "Read related tenants",
|                                               "Description":  "Allows the application to list and read related tenants information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e61db2de-de55-461e-942d-52a028ed1076",
|                                               "Value":  "TenantGovernance-RelatedTenant.ReadWrite.All",
|                                               "DisplayName":  "Read and write related tenants",
|                                               "Description":  "Allows the application to list, read, and refresh related tenants information on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0b1c2458-4845-477b-a704-3cce8b06bf28",
|                                               "Value":  "TenantGovernance-Relationship.Read.All",
|                                               "DisplayName":  "Read Tenant Governance relationships",
|                                               "Description":  "Allows the application to list and read all Tenant Governance relationships on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3fbcd6a3-a9a5-4d69-8a78-acc7d7195180",
|                                               "Value":  "TenantGovernance-Relationship.ReadWrite.All",
|                                               "DisplayName":  "Read and write Tenant Governance relationships",
|                                               "Description":  "Allows the application to list, read, and update Tenant Governance relationships on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a924b9f1-7af0-4982-aecf-b6e0e10b2830",
|                                               "Value":  "TenantGovernance-Request.Read.All",
|                                               "DisplayName":  "Read Tenant Governance requests",
|                                               "Description":  "Allows the application to list and read all Tenant Governance requests on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3c7a434e-4e5d-413f-be82-b77ea4ba5a4d",
|                                               "Value":  "TenantGovernance-Request.ReadWrite.All",
|                                               "DisplayName":  "Read and write Tenant Governance requests",
|                                               "Description":  "Allows the application to list, read, create, and update Tenant Governance requests on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4ad3e05f-2467-49d9-baa2-8e4de7bcee9b",
|                                               "Value":  "TenantGovernance-Setting.Read.All",
|                                               "DisplayName":  "Read Tenant Governance settings",
|                                               "Description":  "Allows the application to read Tenant Governance settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "135f3533-12fc-4608-97ac-5c5cea64baf0",
|                                               "Value":  "TenantGovernance-Setting.ReadWrite.All",
|                                               "DisplayName":  "Read and write Tenant Governance settings",
|                                               "Description":  "Allows the application to read Tenant Governance settings and update them on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "297f747b-0005-475b-8fef-c890f5152b38",
|                                               "Value":  "TermStore.Read.All",
|                                               "DisplayName":  "Read term store data",
|                                               "Description":  "Allows the app to read the term store data that the signed-in user has access to. This includes all sets, groups and terms in the term store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6c37c71d-f50f-4bff-8fd3-8a41da390140",
|                                               "Value":  "TermStore.ReadWrite.All",
|                                               "DisplayName":  "Read and write term store data",
|                                               "Description":  "Allows the app to read or modify data that the signed-in user has access to. This includes all sets, groups and terms in the term store."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cac97e40-6730-457d-ad8d-4852fddab7ad",
|                                               "Value":  "ThreatAssessment.ReadWrite.All",
|                                               "DisplayName":  "Read and write threat assessment requests",
|                                               "Description":  "Allows an app to read your organization\u0027s threat assessment requests on behalf of the signed-in user. Also allows the app to create new requests to assess threats received by your organization on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b152eca8-ea73-4a48-8c98-1a6742673d99",
|                                               "Value":  "ThreatHunting.Read.All",
|                                               "DisplayName":  "Run hunting queries",
|                                               "Description":  "Allows the app to run hunting queries, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9cc427b4-2004-41c5-aa22-757b755e9796",
|                                               "Value":  "ThreatIndicators.Read.All",
|                                               "DisplayName":  "Read all threat indicators",
|                                               "Description":  "Allows the app to read all the indicators for your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "91e7d36d-022a-490f-a748-f8e011357b42",
|                                               "Value":  "ThreatIndicators.ReadWrite.OwnedBy",
|                                               "DisplayName":  "Manage threat indicators this app creates or owns",
|                                               "Description":  "Allows the app to create threat indicators, and fully manage those threat indicators (read, update and delete), on behalf of the signed-in user.  It cannot update any threat indicators it does not own."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f266d9c0-ccb9-4fb8-a228-01ac0d8d6627",
|                                               "Value":  "ThreatIntelligence.Read.All",
|                                               "DisplayName":  "Read all threat intelligence information",
|                                               "Description":  "Allows the app to read threat intelligence information, such as indicators, observations, and articles, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fd5353c6-26dd-449f-a565-c4e16b9fce78",
|                                               "Value":  "ThreatSubmission.Read",
|                                               "DisplayName":  "Read threat submissions",
|                                               "Description":  "Allows the app to read the threat submissions and threat submission policies owned by the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7083913a-4966-44b6-9886-c5822a5fd910",
|                                               "Value":  "ThreatSubmission.Read.All",
|                                               "DisplayName":  "Read all threat submissions",
|                                               "Description":  "Allows the app to read your organization\u0027s threat submissions and threat submission policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "68a3156e-46c9-443c-b85c-921397f082b5",
|                                               "Value":  "ThreatSubmission.ReadWrite",
|                                               "DisplayName":  "Read and write threat submissions",
|                                               "Description":  "Allows the app to read the threat submissions and threat submission policies owned by the signed-in user. Also allows the app to create new threat submissions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8458e264-4eb9-4922-abe9-768d58f13c7f",
|                                               "Value":  "ThreatSubmission.ReadWrite.All",
|                                               "DisplayName":  "Read and write all threat submissions",
|                                               "Description":  "Allows the app to read your organization\u0027s threat submissions and threat submission policies on behalf of the signed-in user. Also allows the app to create new threat submissions on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "059e5840-5353-4c68-b1da-666a033fc5e8",
|                                               "Value":  "ThreatSubmissionPolicy.ReadWrite.All",
|                                               "DisplayName":  "Read and write all threat submission policies",
|                                               "Description":  "Allows the app to read your organization\u0027s threat submission policies on behalf of the signed-in user. Also allows the app to create new threat submission policies on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "79c4c76f-409a-4f98-884d-e2c09291ec26",
|                                               "Value":  "Topic.Read.All",
|                                               "DisplayName":  "Read topic items",
|                                               "Description":  "Allows the app to read topics data on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7ad34336-f5b1-44ce-8682-31d7dfcd9ab9",
|                                               "Value":  "TrustFrameworkKeySet.Read.All",
|                                               "DisplayName":  "Read trust framework key sets",
|                                               "Description":  "Allows the app to read trust framework key set properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "39244520-1e7d-4b4a-aee0-57c65826e427",
|                                               "Value":  "TrustFrameworkKeySet.ReadWrite.All",
|                                               "DisplayName":  "Read and write trust framework key sets",
|                                               "Description":  "Allows the app to read and write trust framework key set properties on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "73e75199-7c3e-41bb-9357-167164dbb415",
|                                               "Value":  "UnifiedGroupMember.Read.AsGuest",
|                                               "DisplayName":  "Read unified group memberships as guest",
|                                               "Description":  "Allows the app to read basic unified group properties, memberships and owners of the group the signed-in guest is a member of."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "550e695c-7511-40f4-ac79-e8fb9c82552d",
|                                               "Value":  "User-ConvertToInternal.ReadWrite.All",
|                                               "DisplayName":  "Convert an external user to internal memeber user",
|                                               "Description":  "Allow the app to convert an external user to an internal member user, on behalf of signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ed8d2a04-0374-41f1-aefe-da8ac87ccc87",
|                                               "Value":  "User-LifeCycleInfo.Read.All",
|                                               "DisplayName":  "Read all users\u0027 lifecycle information",
|                                               "Description":  "Allows the app to read the lifecycle information like employeeLeaveDateTime of users in your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7ee7473e-bd4b-4c9f-987c-bd58481f5fa2",
|                                               "Value":  "User-LifeCycleInfo.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 lifecycle information",
|                                               "Description":  "Allows the app to read and write the lifecycle information like employeeLeaveDateTime of users in your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6166886a-9576-433b-8544-658177bdef1d",
|                                               "Value":  "User-Mail.ReadWrite.All",
|                                               "DisplayName":  "Read and write secondary mail addresses for users",
|                                               "Description":  "Allows the app to read and write secondary mail addresses for all users, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7ff9afdd-0cdb-439d-a61c-fea3e9339e89",
|                                               "Value":  "User-OnPremisesSyncBehavior.ReadWrite.All",
|                                               "DisplayName":  "Read and update the on-premises sync behavior of users",
|                                               "Description":  "Allows the app to read and update the on-premises sync behavior of users on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "56760768-b641-451f-8906-e1b8ab31bca7",
|                                               "Value":  "User-PasswordProfile.ReadWrite.All",
|                                               "DisplayName":  "Read and write password profiles and reset user passwords",
|                                               "Description":  "Allows the app to read and write password profiles and reset passwords for all users, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e29d5979-5b06-4a7f-ae24-6a9348d2e1ff",
|                                               "Value":  "User-Phone.ReadWrite.All",
|                                               "DisplayName":  "Read and write user mobile phone and business phones",
|                                               "Description":  "Allows the app to read and write the mobile phone and business phones for all users, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4bb440cd-2cf2-4f90-8004-aa2acd2537c5",
|                                               "Value":  "User.DeleteRestore.All",
|                                               "DisplayName":  "Delete and restore users",
|                                               "Description":  "Allows the app to delete and restore all users, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f92e74e7-2563-467f-9dd0-902688cb5863",
|                                               "Value":  "User.EnableDisableAccount.All",
|                                               "DisplayName":  "Enable and disable user accounts",
|                                               "Description":  "Allows the app to enable and disable users\u0027 accounts, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "405a51b5-8d8d-430b-9842-8be4b0e9f324",
|                                               "Value":  "User.Export.All",
|                                               "DisplayName":  "Export user\u0027s data",
|                                               "Description":  "Allows the app to export data (e.g. customer content or system-generated logs), associated with any user in your company, when the app is used by a privileged user (e.g. a Company Administrator)."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "63dd7cd9-b489-4adf-a28c-ac38b9a0f962",
|                                               "Value":  "User.Invite.All",
|                                               "DisplayName":  "Invite guest users to the organization",
|                                               "Description":  "Allows the app to invite guest users to the organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "637d7bec-b31e-4deb-acc9-24275642a2c9",
|                                               "Value":  "User.ManageIdentities.All",
|                                               "DisplayName":  "Manage  user identities",
|                                               "Description":  "Allows the app to read, update and delete identities that are associated with a user\u0027s account that the signed-in user has access to. This controls the identities users can sign-in with."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e1fe6dd8-ba31-4d61-89e7-88639da4683d",
|                                               "Value":  "User.Read",
|                                               "DisplayName":  "Sign in and read user profile",
|                                               "Description":  "Allows users to sign-in to the app, and allows the app to read the profile of signed-in users. It also allows the app to read basic company information of signed-in users."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a154be20-db9c-4678-8ab7-66f6cc099a59",
|                                               "Value":  "User.Read.All",
|                                               "DisplayName":  "Read all users\u0027 full profiles",
|                                               "Description":  "Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b340eb25-3456-403f-be2f-af7a0d370277",
|                                               "Value":  "User.ReadBasic.All",
|                                               "DisplayName":  "Read all users\u0027 basic profiles",
|                                               "Description":  "Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address and photo."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b4e74841-8e56-480b-be8b-910348b18b4c",
|                                               "Value":  "User.ReadWrite",
|                                               "DisplayName":  "Read and write access to user profile",
|                                               "Description":  "Allows the app to read your profile. It also allows the app to update your profile information on your behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "204e0828-b5ca-4ad8-b9f3-f32a958e7cc4",
|                                               "Value":  "User.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 full profiles",
|                                               "Description":  "Allows the app to read and write the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fc30e98b-8810-4501-81f5-c20a3196387b",
|                                               "Value":  "User.RevokeSessions.All",
|                                               "DisplayName":  "Revoke all sign in sessions for a user",
|                                               "Description":  "Allow the app to revoke all sign in sessions for a user, on behalf of a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "47607519-5fb1-47d9-99c7-da4b48f369b1",
|                                               "Value":  "UserActivity.ReadWrite.CreatedByApp",
|                                               "DisplayName":  "Read and write app activity to users\u0027 activity feed",
|                                               "Description":  "Allows the app to read and report the signed-in user\u0027s activity in the app."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1f6b61c5-2f65-4135-9c9f-31c0f8d32b52",
|                                               "Value":  "UserAuthenticationMethod.Read",
|                                               "DisplayName":  "Read user authentication methods.",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s authentication methods, including phone numbers and Authenticator app settings. This does not allow the app to see secret information like the signed-in user\u0027s passwords, or to sign-in  or otherwise use the signed-in user\u0027s authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "aec28ec7-4d02-4e8c-b864-50163aea77eb",
|                                               "Value":  "UserAuthenticationMethod.Read.All",
|                                               "DisplayName":  "Read all users\u0027 authentication methods",
|                                               "Description":  "Allows the app to read authentication methods of all users in your organization that the signed-in user has access to. Authentication methods include things like a user’s phone numbers and Authenticator app settings. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "48971fc1-70d7-4245-af77-0beb29b53ee2",
|                                               "Value":  "UserAuthenticationMethod.ReadWrite",
|                                               "DisplayName":  "Read and write user authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s authentication methods, including phone numbers and Authenticator app settings.                       This does not allow the app to see secret information like the signed-in user\u0027s passwords, or                      to sign-in or otherwise use the signed-in user\u0027s authentication methods.  "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b7887744-6746-4312-813d-72daeaee7e2d",
|                                               "Value":  "UserAuthenticationMethod.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 authentication methods.",
|                                               "Description":  " Allows the app to read and write authentication methods of all users in your organization that the signed-in user has access to.                       Authentication methods include things like a user’s phone numbers and Authenticator app settings. This                      does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "12b23cea-90c1-4873-9094-f45c5f290f86",
|                                               "Value":  "UserAuthMethod-Email.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s email authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s email authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "76caaf3a-ebdb-40a3-9299-4196e636f290",
|                                               "Value":  "UserAuthMethod-Email.Read.All",
|                                               "DisplayName":  "Read all users\u0027 email methods",
|                                               "Description":  "Allows the app to read email methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "696aa421-62dc-4c99-be16-015b23444089",
|                                               "Value":  "UserAuthMethod-Email.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s email authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s email authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "074f680f-c89e-45be-880e-5d0642860a1c",
|                                               "Value":  "UserAuthMethod-Email.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 email methods.",
|                                               "Description":  "Allows the app to read and write email methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d1739827-146b-4f7f-b52c-1c509253aa57",
|                                               "Value":  "UserAuthMethod-External.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s external authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s external authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cbca9646-4c34-4cea-8e54-9a7088018820",
|                                               "Value":  "UserAuthMethod-External.Read.All",
|                                               "DisplayName":  "Read all users\u0027 external authentication methods",
|                                               "Description":  "Allows the app to read external authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "28c2e8f9-828a-4691-a090-f2f0b7fc07b3",
|                                               "Value":  "UserAuthMethod-External.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s external authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s external authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9d91805d-0f53-43e3-a0f3-303ad4f3056f",
|                                               "Value":  "UserAuthMethod-External.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 external methods.",
|                                               "Description":  "Allows the app to read and write external authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ccd2eb40-8874-44e6-8f96-335908b3cfdb",
|                                               "Value":  "UserAuthMethod-HardwareOATH.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s HardwareOATH authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s HardwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "acd68c26-c283-4bf4-8b5c-200fc179bdd5",
|                                               "Value":  "UserAuthMethod-HardwareOATH.Read.All",
|                                               "DisplayName":  "Read all users\u0027 HardwareOATH authentication methods",
|                                               "Description":  "Allows the app to read HardwareOATH authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "147ca97b-6686-4849-b37e-09d9b5ad45fc",
|                                               "Value":  "UserAuthMethod-HardwareOATH.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s HardwareOATH authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s HardwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "480643f2-a162-43c5-a670-dc1494fc911b",
|                                               "Value":  "UserAuthMethod-HardwareOATH.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 HardwareOATH methods.",
|                                               "Description":  "Allows the app to read and write HardwareOATH authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f14a567b-3280-4124-95a0-eca86006967e",
|                                               "Value":  "UserAuthMethod-MicrosoftAuthApp.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s Microsoft Authenticator authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s Microsoft Authenticator authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7b627679-e2fd-4bfd-990e-989e2914d4e6",
|                                               "Value":  "UserAuthMethod-MicrosoftAuthApp.Read.All",
|                                               "DisplayName":  "Read all users\u0027 Microsoft authentication methods",
|                                               "Description":  "Allows the app to read Microsoft authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9f7dfa0c-eb40-42be-8d45-8af4a9219c6f",
|                                               "Value":  "UserAuthMethod-MicrosoftAuthApp.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s Microsoft Authenticator authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s Microsoft Authenticator authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1b7322b2-5cb3-4f13-928f-d7ca97c5fba9",
|                                               "Value":  "UserAuthMethod-MicrosoftAuthApp.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 Microsoft Authentication methods.",
|                                               "Description":  "Allows the app to read and write Microsoft Authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "828fcbda-0d26-431d-8bfb-83f217224621",
|                                               "Value":  "UserAuthMethod-Passkey.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s passkey authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s passkey authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "14195339-1fe4-48a7-a0d3-a39eb9fd8958",
|                                               "Value":  "UserAuthMethod-Passkey.Read.All",
|                                               "DisplayName":  "Read all users\u0027 passkey authentication methods",
|                                               "Description":  "Allows the app to read passkey authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b2de7db9-10f7-4800-b04c-b5b91e4891d6",
|                                               "Value":  "UserAuthMethod-Passkey.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s passkey authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s passkey authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "64930478-d0ea-4671-ad72-fe0d9821df09",
|                                               "Value":  "UserAuthMethod-Passkey.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 passkey methods.",
|                                               "Description":  "Allows the app to read and write passkey authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7f0f82c3-de19-4ddc-810d-a2206d7637fd",
|                                               "Value":  "UserAuthMethod-Password.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s password authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s password authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4f69a4e2-2aa0-43a7-ad6b-98b4cda1f23f",
|                                               "Value":  "UserAuthMethod-Password.Read.All",
|                                               "DisplayName":  "Read all users\u0027 password authentication methods",
|                                               "Description":  "Allows the app to read password authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "60cce20d-d41e-4594-b391-84bbf8cc31f3",
|                                               "Value":  "UserAuthMethod-Password.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s password authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s password authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7f5b683d-df96-4690-a88d-6e336ed6dc7c",
|                                               "Value":  "UserAuthMethod-Password.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 password methods.",
|                                               "Description":  "Allows the app to read and write password authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "43dab3b9-e8b4-424d-8e13-6a2ad2a625fa",
|                                               "Value":  "UserAuthMethod-Phone.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s phone authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s phone authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "20cf4ae1-09b9-4d29-a6f8-43e1820ce60c",
|                                               "Value":  "UserAuthMethod-Phone.Read.All",
|                                               "DisplayName":  "Read all users\u0027 phone authentication methods",
|                                               "Description":  "Allows the app to read phone authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6c4aad61-f76b-46ad-a22c-57d4d3d962af",
|                                               "Value":  "UserAuthMethod-Phone.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s phone authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s phone authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "48c99302-9a24-4f27-a8a7-acef4debba14",
|                                               "Value":  "UserAuthMethod-Phone.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 phone methods.",
|                                               "Description":  "Allows the app to read and write Phone methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9c694582-e8f2-40e2-8353-fb43e2e0f12a",
|                                               "Value":  "UserAuthMethod-PlatformCred.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s platform credential authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s platform credential authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5936156c-f89b-4850-997d-026c4e6ce529",
|                                               "Value":  "UserAuthMethod-PlatformCred.Read.All",
|                                               "DisplayName":  "Read all users\u0027 platform credentials methods",
|                                               "Description":  "Allows the app to read platform credentials methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "70327f81-b953-43c9-92d3-131c74e4beb8",
|                                               "Value":  "UserAuthMethod-PlatformCred.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s platform credential authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s platform credential authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cb11bf8c-dde1-4504-b6a5-31e1562b0749",
|                                               "Value":  "UserAuthMethod-PlatformCred.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 platform credentials methods.",
|                                               "Description":  "Allows the app to read and write platform credentials methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d6893c31-9187-405c-8dfc-f700c8fc161a",
|                                               "Value":  "UserAuthMethod-QR.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s QR authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s QR authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e4900dfb-ad17-410d-8ddb-7aebd8a6af1a",
|                                               "Value":  "UserAuthMethod-QR.Read.All",
|                                               "DisplayName":  "Read all users\u0027 QR methods",
|                                               "Description":  "Allows the app to read QR authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "651210da-18ce-4e42-b7db-302ff88e9326",
|                                               "Value":  "UserAuthMethod-QR.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s QR authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s QR authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "db39086a-da7d-4cbd-9ac0-6816f9a80c95",
|                                               "Value":  "UserAuthMethod-QR.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 QR methods.",
|                                               "Description":  "Allows the app to read and write QR authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "247f2733-6e3d-46ff-a904-f5fd58eb0d97",
|                                               "Value":  "UserAuthMethod-SoftwareOATH.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s SoftwareOATH authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s SoftwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3e366fa0-3097-4eb6-8294-3028f77eea6f",
|                                               "Value":  "UserAuthMethod-SoftwareOATH.Read.All",
|                                               "DisplayName":  "Read all users\u0027 SoftwareOATH methods",
|                                               "Description":  "Allows the app to read SoftwareOATH authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "16721eb3-4493-4ae1-9542-264d9ffe3ce9",
|                                               "Value":  "UserAuthMethod-SoftwareOATH.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s SoftwareOATH authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s SoftwareOATH authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5b34c8b5-2396-4b35-b284-83fb6a3e73ce",
|                                               "Value":  "UserAuthMethod-SoftwareOATH.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 SoftwareOATH methods.",
|                                               "Description":  "Allows the app to read and write SoftwareOATH authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "84ded88f-26ba-49d6-b776-efec398de692",
|                                               "Value":  "UserAuthMethod-TAP.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s Temporary Access Pass authentication methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s Temporary Access Pass authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6976c635-c9c2-41e6-a21d-e6913a155273",
|                                               "Value":  "UserAuthMethod-TAP.Read.All",
|                                               "DisplayName":  "Read all users\u0027 Temporary Access Pass methods",
|                                               "Description":  "Allows the app to read Temporary Access Pass authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2424436d-902f-4651-a1c7-b3b93147c960",
|                                               "Value":  "UserAuthMethod-TAP.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s Temporary Access Pass authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s Temporary Access Pass authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "05de4a66-e51a-4312-842a-30c8094698d2",
|                                               "Value":  "UserAuthMethod-TAP.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 Temporary Access Pass methods.",
|                                               "Description":  "Allows the app to read and write Temporary Access Pass authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "efe2b5aa-3a8e-486c-b0be-cc4d185c1b40",
|                                               "Value":  "UserAuthMethod-WindowsHello.Read",
|                                               "DisplayName":  "Read the signed-in user\u0027s Windows Hello methods",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s Windows Hello authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ff37d46d-b88a-4e0c-85ee-7e26c37b18eb",
|                                               "Value":  "UserAuthMethod-WindowsHello.Read.All",
|                                               "DisplayName":  "Read all users\u0027 Windows Hello methods",
|                                               "Description":  "Allows the app to read Windows Hello authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f11e1db9-d419-4a24-b677-792723ffd727",
|                                               "Value":  "UserAuthMethod-WindowsHello.ReadWrite",
|                                               "DisplayName":  "Read and write the signed-in user\u0027s Windows Hello authentication methods",
|                                               "Description":  "Allows the app to read and write the signed-in user\u0027s Windows Hello authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "13eae17d-aaa4-47b8-aaee-0eb33c6e2450",
|                                               "Value":  "UserAuthMethod-WindowsHello.ReadWrite.All",
|                                               "DisplayName":  "Read and write all users\u0027 Windows Hello methods.",
|                                               "Description":  "Allows the app to read and write Windows Hello authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "61e8a09a-087f-4e36-8c8c-1c77c5228017",
|                                               "Value":  "UserCloudClipboard.Read",
|                                               "DisplayName":  "Read cloud clipboard items",
|                                               "Description":  "Allows the app to read cloud clipboard data on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "26e2f3e8-b2a1-47fc-9620-89bb5b042024",
|                                               "Value":  "UserNotification.ReadWrite.CreatedByApp",
|                                               "DisplayName":  "Deliver and manage user\u0027s notifications",
|                                               "Description":  "Allows the app to send, read, update and delete user’s notifications."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "834bcc1c-762f-41b0-bb91-1cdc323ee4bf",
|                                               "Value":  "UserTeamwork.Read",
|                                               "DisplayName":  "Read user teamwork settings",
|                                               "Description":  "Allows the app to read the teamwork settings of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "367492fc-594d-4972-a9b5-0d58c622c91c",
|                                               "Value":  "UserTimelineActivity.Write.CreatedByApp",
|                                               "DisplayName":  "Write app activity to users\u0027 timeline",
|                                               "Description":  "Allows the app to report the signed-in user\u0027s app activity information to Microsoft Timeline."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "77e07bab-1b34-40a5-bb6c-4b197b3f6027",
|                                               "Value":  "UserWindowsSettings.Read.All",
|                                               "DisplayName":  "Read windows settings for all devices",
|                                               "Description":  "Allows the app to read a user\u0027s windows settings which are stored in cloud and their values on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dcb1026d-b7e1-4d31-9f61-6724d5140bf9",
|                                               "Value":  "UserWindowsSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write windows settings for all devices",
|                                               "Description":  "Allows the app to read and write a user\u0027s windows settings which are stored in cloud and their values on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "604b2056-41ed-4c56-aad5-1241d4ef7333",
|                                               "Value":  "VerifiedId-Profile.Read.All",
|                                               "DisplayName":  "Read Verified Id profiles",
|                                               "Description":  "This role can read Verified Id profiles in a tenant."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e4a9cb5e-4767-48f8-9029-decf26a54456",
|                                               "Value":  "VerifiedId-Profile.ReadWrite.All",
|                                               "DisplayName":  "Read and write Verified Id profiles",
|                                               "Description":  "This role can read and write Verified Id profiles in a tenant."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "27470298-d3b8-4b9c-aad4-6334312a3eac",
|                                               "Value":  "VirtualAppointment.Read",
|                                               "DisplayName":  "Read a user\u0027s virtual appointments",
|                                               "Description":  "Allows an application to read virtual appointments for the signed-in user. Only an organizer or participant user can read their virtual appointments.  "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2ccc2926-a528-4b17-b8bb-860eed29d64c",
|                                               "Value":  "VirtualAppointment.ReadWrite",
|                                               "DisplayName":  "Read and write a user\u0027s virtual appointments  ",
|                                               "Description":  "Allows an application to read and write virtual appointments for the signed-in user. Only an organizer or participant user can read and write their virtual appointments. "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "20d02fff-a0ef-49e7-a46e-019d4a6523b7",
|                                               "Value":  "VirtualAppointmentNotification.Send",
|                                               "DisplayName":  "Send notification regarding virtual appointments for the signed-in user",
|                                               "Description":  "Allows an application to send notifications for virtual appointments for the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6b616635-ae58-433a-a918-8c45e4f304dc",
|                                               "Value":  "VirtualEvent.Read",
|                                               "DisplayName":  "Read your virtual events",
|                                               "Description":  "Allows the app to read virtual events created by you"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d38d189c-e29b-4344-8b3b-829bfa81380b",
|                                               "Value":  "VirtualEvent.ReadWrite",
|                                               "DisplayName":  "Read and write your virtual events",
|                                               "Description":  "Allows the app to read and write virtual events for you"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e09fef2d-bf5e-4439-affa-7c48d23bb1c2",
|                                               "Value":  "WindowsUpdates.Read.All",
|                                               "DisplayName":  "Read all Windows update deployment settings",
|                                               "Description":  "Allows the app to read all Windows update deployment settings for the organization on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "11776c0c-6138-4db3-a668-ee621bea2555",
|                                               "Value":  "WindowsUpdates.ReadWrite.All",
|                                               "DisplayName":  "Read and write all Windows update deployment settings",
|                                               "Description":  "Allows the app to read and write all Windows update deployment settings for the organization on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f1ccd5a7-6383-466a-8db8-1a656f7d06fa",
|                                               "Value":  "WorkforceIntegration.Read.All",
|                                               "DisplayName":  "Read workforce integrations",
|                                               "Description":  "Allows the app to read workforce integrations, to synchronize data from Microsoft Teams Shifts, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Graph",
|                                               "AppId":  "00000003-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "08c4b377-0d23-4a8b-be2a-23c1c1d88545",
|                                               "Value":  "WorkforceIntegration.ReadWrite.All",
|                                               "DisplayName":  "Read and write workforce integrations",
|                                               "Description":  "Allows the app to manage workforce integrations, to synchronize data from Microsoft Teams Shifts, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ea3d980d-ebc7-4be4-8298-a167e5b8797c",
|                                               "Value":  "Exchange.ManageAsAppV2",
|                                               "DisplayName":  "Manage Exchange as application v2",
|                                               "Description":  "Allows the app to manage a limited set of Exchange Online configuration objects without user interaction, for specific scenarios supported by the adminapi/v2.0 endpoint. To enable management actions an admin must also assign the appropriate Exchange RBAC roles directly to the app."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dc50a0fb-09a3-484d-be87-e023b12c6440",
|                                               "Value":  "Exchange.ManageAsApp",
|                                               "DisplayName":  "Manage Exchange As Application",
|                                               "Description":  "Allows the app to manage the organization\u0027s Exchange environment without any user interaction. This includes mailboxes, groups, and other configuration objects. To enable management actions, an admin must assign the appropriate roles directly to the app."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4830e04b-48ac-4de5-bbd9-8aceb58e506b",
|                                               "Value":  "Place.Read.All",
|                                               "DisplayName":  "Read all company places",
|                                               "Description":  "Allows the app to read company places (conference rooms and room lists) for calendar events and other applications, without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2dfdc6dc-2fa7-4a2c-a922-dbd4f85d17be",
|                                               "Value":  "Calendars.Read.All",
|                                               "DisplayName":  "Read calendars in all mailboxes",
|                                               "Description":  "Allows the app to read events of all R without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ef54d2bf-783f-4e0f-bca1-3210c0444d99",
|                                               "Value":  "Calendars.ReadWrite.All",
|                                               "DisplayName":  "Read and write calendars in all mailboxes",
|                                               "Description":  "Allows the app to create, read, update, and delete events of all calendars without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2c6a42ca-0d4d-49ad-bc0e-21222c449a65",
|                                               "Value":  "Tasks.ReadWrite",
|                                               "DisplayName":  "Read and write tasks in all mailboxes",
|                                               "Description":  "Allows the app to create, read, update, and delete tasks in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c1b0de0a-1de9-455d-919f-eca451053141",
|                                               "Value":  "Tasks.Read",
|                                               "DisplayName":  "Read user tasks in all mailboxes",
|                                               "Description":  "Allows the app to read user tasks in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f9156939-25cd-4ba8-abfe-7fabcf003749",
|                                               "Value":  "MailboxSettings.ReadWrite",
|                                               "DisplayName":  "Read and write all user mailbox settings",
|                                               "Description":  "Allows the app to create, read, update, and delete user\u0027s mailbox settings without a signed-in user. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6918b873-d17a-4dc1-b314-35f528134491",
|                                               "Value":  "Contacts.ReadWrite",
|                                               "DisplayName":  "Read and write contacts in all mailboxes",
|                                               "Description":  "Allows the app to create, read, update, and delete all contacts in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e2a3a72e-5f79-4c64-b1b1-878b674786c9",
|                                               "Value":  "Mail.ReadWrite",
|                                               "DisplayName":  "Read and write mail in all mailboxes",
|                                               "Description":  "Allows the app to create, read, update, and delete mail in all mailboxes without a signed-in user. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "810c84a8-4a9e-49e6-bf7d-12d183f40d01",
|                                               "Value":  "Mail.Read",
|                                               "DisplayName":  "Read mail in all mailboxes",
|                                               "Description":  "Allows the app to read mail in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "089fe4d0-434a-44c5-8827-41ba8a0b17f5",
|                                               "Value":  "Contacts.Read",
|                                               "DisplayName":  "Read contacts in all mailboxes",
|                                               "Description":  "Allows the app to read all contacts in all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "798ee544-9d2d-430c-a058-570e29e34338",
|                                               "Value":  "Calendars.Read",
|                                               "DisplayName":  "Read calendars in all mailboxes",
|                                               "Description":  "Allows the app to read events of all calendars without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b633e1c5-b582-4048-a93e-9f11b44c7e96",
|                                               "Value":  "Mail.Send",
|                                               "DisplayName":  "Send mail as any user",
|                                               "Description":  "Allows the app to send mail as any user without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dc890d15-9560-4a4c-9b7f-a736ec74ec40",
|                                               "Value":  "full_access_as_app",
|                                               "DisplayName":  "Use Exchange Web Services with full access to all mailboxes",
|                                               "Description":  "Allows the app to have full access via Exchange Web Services to all mailboxes without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d45fa9f8-36e5-4cd2-b601-b063c7cf9ac2",
|                                               "Value":  "MailboxSettings.Read",
|                                               "DisplayName":  "Read all user mailbox settings",
|                                               "Description":  "Allows the app to read user\u0027s mailbox settings without a signed-in user. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "77e65b5a-ceae-48b3-9490-50a86a038a48",
|                                               "Value":  "User.ReadBasic.All",
|                                               "DisplayName":  "Read all users\u0027 basic profiles",
|                                               "Description":  "Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address and photo."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bf24470f-10c1-436d-8d53-7b997eb473be",
|                                               "Value":  "User.Read.All",
|                                               "DisplayName":  "Read all users\u0027 full profiles",
|                                               "Description":  "Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f7264778-fba9-422d-8e9e-2675a2c4b513",
|                                               "Value":  "Mailbox.Migration",
|                                               "DisplayName":  "Move mailboxes between organizations",
|                                               "Description":  "Application permission grants permission to move mailboxes between Office365 organizations"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "15f260d6-f874-4366-8672-6b3658c5a09b",
|                                               "Value":  "Organization.Read.All",
|                                               "DisplayName":  "Organization.Read.All",
|                                               "Description":  "Allows the app to read the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed SKUs and tenant branding information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5e5addcd-3e8d-4e90-baf5-964efab2b20a",
|                                               "Value":  "IMAP.AccessAsApp",
|                                               "DisplayName":  "IMAP.AccessAsApp",
|                                               "Description":  "Allow application to access user’s mailbox via IMAP protocol"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cb842b43-da6e-4506-86fe-bb12199c656d",
|                                               "Value":  "POP.AccessAsApp",
|                                               "DisplayName":  "POP.AccessAsApp",
|                                               "Description":  "Allow application to access user’s mailbox via POP protocol"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c976971c-a54d-4835-a240-2479e3dac74a",
|                                               "Value":  "Organization.ReadWrite.All",
|                                               "DisplayName":  "Organization.ReadWrite.All",
|                                               "Description":  "Allows the app to read and write the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed SKUs and tenant branding information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b4d5a5c7-c085-487f-b922-ef0d6ebde6b1",
|                                               "Value":  "ReportingWebService.Read.All",
|                                               "DisplayName":  "ReportingWebService.Read.All",
|                                               "Description":  "Download all reports via the Office 365 reporting web service"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7146a1f0-8703-45b3-9eae-527a64c00995",
|                                               "Value":  "SMTP.SendAsApp",
|                                               "DisplayName":  "Application access for sending emails via SMTP AUTH",
|                                               "Description":  "Allows the app to have send access to all mailboxes"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "789ef6b5-4ecc-4f61-b6b3-66ef3109173c",
|                                               "Value":  "PeopleSettings.Read.All",
|                                               "DisplayName":  "Read all tenant-wide people settings",
|                                               "Description":  "Allows the application to read tenant-wide people settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "98ed40ef-611a-4479-bd35-eaa7863e946a",
|                                               "Value":  "PeopleSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write all tenant-wide people settings",
|                                               "Description":  "Allows the application to read and write tenant-wide people settings without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "44d6b5f2-d42b-4fa7-b999-1c5fcab98e4d",
|                                               "Value":  "Exchange.ManageV2",
|                                               "DisplayName":  "Manage Exchange configuration v2",
|                                               "Description":  "Allows the app to manage a limited set of Exchange Online configuration objects via the adminapi/v2.0 endpoint. This permission is intended for specific scenarios and requires appropriate Exchange RBAC role assignments."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d056cee4-aed2-4aa4-b2a9-292fe18b06d2",
|                                               "Value":  "OPX.MyDay.All",
|                                               "DisplayName":  "OPX.MyDay.All",
|                                               "Description":  "This allows application to host MyDay Owa powered experience for both user and shared mailbox and calendar"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "405782ba-4062-4ea3-bd33-f7c731841e3b",
|                                               "Value":  "OPX.MyDay.Shared",
|                                               "DisplayName":  "OPX.MyDay.Shared",
|                                               "Description":  "This allows application to host MyDay Owa powered experience for shared mailbox and calendar"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8cac6046-ce43-4348-855c-efd9d956b7bf",
|                                               "Value":  "OPX.MyDay",
|                                               "DisplayName":  "OPX.MyDay",
|                                               "Description":  "This allows the application to host MyDay Owa powered experience"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "43ed0a33-2264-4716-b3bd-c5d8e248eebf",
|                                               "Value":  "Place.Read.All",
|                                               "DisplayName":  "Read all company places",
|                                               "Description":  "Allows the app to read your company\u0027s places (conference rooms and room lists) for calendar events and other applications, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "266d2589-20b5-4f91-9a03-89247d1be8da",
|                                               "Value":  "EAS.AccessAsUser.All",
|                                               "DisplayName":  "Access mailboxes via Exchange ActiveSync",
|                                               "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via Exchange ActiveSync."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ad13ac2e-ad46-4dc0-b7da-249c94395a6d",
|                                               "Value":  "Mail.Read.All",
|                                               "DisplayName":  "Read user and shared mail ",
|                                               "Description":  "Allows the app to read mail a user can access, including their own and shared mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "140e747e-90d3-4de0-8618-85a0cc7a1129",
|                                               "Value":  "Mail.ReadWrite.All",
|                                               "DisplayName":  "Read and write user and shared mail ",
|                                               "Description":  "Allows the app to create, read, update, and delete mail a user has permission to access, including their own and shared mail. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e843bc88-e493-446d-a73c-0ded7ff1913f",
|                                               "Value":  "Mail.Send.All",
|                                               "DisplayName":  "Send mail on behalf of others",
|                                               "Description":  "Allows the app to send mail as the signed-in user, including sending on-behalf of others."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "da710fc9-1e83-407b-8c5c-09d225031769",
|                                               "Value":  "Calendars.Read.All",
|                                               "DisplayName":  "Read user and shared calendars ",
|                                               "Description":  "Allows the app to read events in all calendars that the user can access, including delegate and shared calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bbd1ca91-75e0-4814-ad94-9c5dbbae3415",
|                                               "Value":  "Calendars.ReadWrite.All",
|                                               "DisplayName":  "Read and write user and shared calendars ",
|                                               "Description":  "Allows the app to create, read, update and delete events in all calendars in the organization user has permissions to access. This includes delegate and shared calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d660a04c-7b62-4b4c-bea3-89226df00142",
|                                               "Value":  "Contacts.Read.All",
|                                               "DisplayName":  "Read user and shared contacts ",
|                                               "Description":  "Allows the app to read contacts a user has permissions to access, including their own and shared contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "44882612-f346-430a-b938-4f00ee1c77a7",
|                                               "Value":  "Contacts.ReadWrite.All",
|                                               "DisplayName":  "Read and write user and shared  contacts ",
|                                               "Description":  "Allows the app to create, read, update, and delete contacts a user has permissions to, including their own and shared contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2e83d72d-8895-4b66-9eea-abb43449ab8b",
|                                               "Value":  "MailboxSettings.ReadWrite",
|                                               "DisplayName":  "Read and write user mailbox settings",
|                                               "Description":  "Allows the app to create, read, update, and delete user\u0027s mailbox settings. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6b49b74d-642f-4417-a6b4-820576845707",
|                                               "Value":  "Tasks.ReadWrite",
|                                               "DisplayName":  "Create, read, update and delete user tasks ",
|                                               "Description":  "Allows the app to create, read, update and delete user tasks "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8af8046f-5694-470f-91e4-d47ad05eda18",
|                                               "Value":  "Tasks.Read",
|                                               "DisplayName":  "Read user tasks",
|                                               "Description":  "Allows the app to read user tasks"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ab4f2b77-0b06-4fc1-a9de-02113fc2ab7c",
|                                               "Value":  "Exchange.Manage",
|                                               "DisplayName":  "Manage Exchange configuration",
|                                               "Description":  "Allows the app to manage the organization\u0027s Exchange environment, such as mailboxes, groups, and other configuration objects. To enable management actions, an admin must assign the appropriate roles to the app user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a88daf86-d44d-4077-8258-54131dd44e5d",
|                                               "Value":  "People.ReadWrite",
|                                               "DisplayName":  "Read and write users\u0027 relevant people lists (preview)",
|                                               "Description":  "Allows the app to create, read and write to the ranked list of relevant people of the signed-in user. The list includes local contacts, contacts from social networking, your organization\u0027s directory, and people from recent communications (such as email and Skype)."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9478ac54-3753-4543-b95a-4fad24978902",
|                                               "Value":  "People.Read",
|                                               "DisplayName":  "Read users\u0027 relevant people lists (preview)",
|                                               "Description":  "Allows the app to read a ranked list of relevant people of the signed-in user. The list includes local contacts, contacts from social networking, your organization\u0027s directory, and people from recent communications (such as email and Skype)."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6222dbab-a24c-4210-9d91-2f47cf565614",
|                                               "Value":  "User.ReadBasic.All",
|                                               "DisplayName":  "Read all users\u0027 basic profiles",
|                                               "Description":  "Allows the app to read a basic set of profile properties of users in your company or school on behalf of the signed-in user. Includes display name, photo, and email address."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f9408c03-bd3d-48c4-8bee-17a72d20bd9c",
|                                               "Value":  "User.ReadWrite",
|                                               "DisplayName":  "Read and write user profiles",
|                                               "Description":  "Allows the app to create, read, and write a set of the current user\u0027s profile properties in your company or school. Includes display name, photo, and email address."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6223a6d3-53ef-4f8f-982a-895b39483c61",
|                                               "Value":  "User.Read",
|                                               "DisplayName":  "Read user profiles",
|                                               "Description":  "Allows the app to read a set of the current user\u0027s profile properties in your company or school. Includes display name, photo, and email address."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "27235839-268c-4d68-a668-351401ff623a",
|                                               "Value":  "Group.ReadWrite.All",
|                                               "DisplayName":  "Read and write all groups (preview)",
|                                               "Description":  "Allows the app to read group properties. Additionally allows the app to update group properties for groups the signed-in user owns. Also allows the app to read and write group calendar and conversations on public groups and groups the signed-in user is a member of."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b5c79e22-9bf2-42d7-b60d-1b95c11ebc66",
|                                               "Value":  "Group.Read.All",
|                                               "DisplayName":  "Read all groups (preview)",
|                                               "Description":  "Allows the app to read group properties on behalf of the signed-in user, and read group calendar and conversations on public groups and groups the signed in user is a member of."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "32253599-e142-4cf0-810d-4827eedd1cfa",
|                                               "Value":  "Contacts.ReadWrite",
|                                               "DisplayName":  "Read and write user contacts",
|                                               "Description":  "Allows the app to create, read, update, and delete user contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "181aac24-028a-486e-a649-b3742c74ec71",
|                                               "Value":  "Contacts.Read",
|                                               "DisplayName":  "Read user contacts",
|                                               "Description":  "Allows the app to read user contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "765f423e-b55d-412e-97e3-13a800c3a537",
|                                               "Value":  "Calendars.ReadWrite",
|                                               "DisplayName":  "Read and write user calendars",
|                                               "Description":  "Allows the app to create, read, update, and delete events in user calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5b9be81f-2977-4d27-8faf-bb43af8fc705",
|                                               "Value":  "Calendars.Read",
|                                               "DisplayName":  "Read user calendars",
|                                               "Description":  "Allows the app to read events in user calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5eb43c10-865a-4259-960a-83946678f8dd",
|                                               "Value":  "Mail.Send",
|                                               "DisplayName":  "Send mail as a user",
|                                               "Description":  "Allows the app to send mail as users in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "75767999-c7a8-481e-a6b4-19458e0b30a5",
|                                               "Value":  "Mail.ReadWrite",
|                                               "DisplayName":  "Read and write user mail",
|                                               "Description":  "Allows the app to create, read, update, and delete email in user mailboxes. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "185758ba-798d-4b72-9e54-429a413a2510",
|                                               "Value":  "Mail.Read",
|                                               "DisplayName":  "Read user mail",
|                                               "Description":  "Allows the app to read email in user mailboxes."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2915e980-bca5-4194-9a3f-71c4ccdbd77b",
|                                               "Value":  "Tasks.ReadWrite.Shared",
|                                               "DisplayName":  "Create, read, update and delete all tasks a user has access to",
|                                               "Description":  "Allows the app to create, read, update and delete all tasks a user has access to"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3d5e9942-27d3-4e96-80b1-696c7a3369c1",
|                                               "Value":  "Tasks.Read.Shared",
|                                               "DisplayName":  "Read all tasks a user has access to",
|                                               "Description":  "Allows the app to read all tasks a user has access to"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d6aa6fa9-3360-416a-b8db-021249d58e86",
|                                               "Value":  "Contacts.Read.Shared",
|                                               "DisplayName":  "Read user and shared contacts ",
|                                               "Description":  "Allows the app to read contacts a user has permissions to access, including their own and shared contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c54cba4f-60fe-4332-b0de-b5990fd1999e",
|                                               "Value":  "Contacts.ReadWrite.Shared",
|                                               "DisplayName":  "Read and write user and shared  contacts ",
|                                               "Description":  "Allows the app to create, read, update, and delete contacts a user has permissions to, including their own and shared contacts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1d894596-c906-42b1-8422-9360440c1c0c",
|                                               "Value":  "Mail.Read.Shared",
|                                               "DisplayName":  "Read user and shared mail ",
|                                               "Description":  "Allows the app to read mail a user can access, including their own and shared mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b09ec548-3f99-4d0a-859c-c9b7ff53b7a9",
|                                               "Value":  "Mail.ReadWrite.Shared",
|                                               "DisplayName":  "Read and write user and shared mail ",
|                                               "Description":  "Allows the app to create, read, update, and delete mail a user has permission to access, including their own and shared mail. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "16572339-6149-452b-b084-280b01354687",
|                                               "Value":  "Mail.Send.Shared",
|                                               "DisplayName":  "Send mail on behalf of others",
|                                               "Description":  "Allows the app to send mail as the signed-in user, including sending on-behalf of others."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4585ecca-5b47-432f-ac70-e1391e4951ed",
|                                               "Value":  "Calendars.ReadWrite.Shared",
|                                               "DisplayName":  "Read and write user and shared calendars",
|                                               "Description":  "Allows the app to create, read, update and delete events in all calendars in the organization user has permissions to access. This includes delegate and shared calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c21d8660-9de1-4404-85b6-59695921bd8d",
|                                               "Value":  "Calendars.Read.Shared",
|                                               "DisplayName":  "Read user and shared calendars ",
|                                               "Description":  "Allows the app to read events in all calendars that the user can access, including delegate and shared calendars."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d36ad51d-15a2-458d-9b3a-16dbe4c51c30",
|                                               "Value":  "MailboxSettings.Read",
|                                               "DisplayName":  "Read user mailbox settings ",
|                                               "Description":  "Allows the app to read user\u0027s mailbox settings. Does not include permission to send mail."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9b005f11-86f0-45f7-8c27-4fff5d849916",
|                                               "Value":  "User.ReadBasic.All",
|                                               "DisplayName":  "Read all users\u0027 basic profiles",
|                                               "Description":  "Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address and photo."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eb665d05-7f76-4d1b-b176-1cfc814e668d",
|                                               "Value":  "User.Read.All",
|                                               "DisplayName":  "Read all users\u0027 full profiles",
|                                               "Description":  "Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3b5f3d61-589b-4a3c-a359-5dd4b5ee5bd5",
|                                               "Value":  "EWS.AccessAsUser.All",
|                                               "DisplayName":  "Access mailboxes as the signed-in user via Exchange Web Services",
|                                               "Description":  "Allows the app to have the same access to mailboxes as the signed-in user via Exchange Web Services."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1b69a6c3-108d-42d0-a3ec-fafcd610e80b",
|                                               "Value":  "Notes.ReadWrite",
|                                               "DisplayName":  "Create, read, update and delete user notes",
|                                               "Description":  "Allows the app to create, read, update and delete user notes"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "505d82a7-24f3-4632-bffc-4d21625b31de",
|                                               "Value":  "Notes.Read",
|                                               "DisplayName":  "Read user notes",
|                                               "Description":  "Allows the app to read user notes"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dab085de-3e14-432f-a47f-84b6457059c4",
|                                               "Value":  "Mail.ReadBasic",
|                                               "DisplayName":  "Read user basic mail",
|                                               "Description":  "Allows the app to read the signed-in user\u0027s mailbox except body, previewBody, attachments and any extended properties."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1d490c92-d2ca-4a30-b52e-6edf5f279f4d",
|                                               "Value":  "Organization.Read.All",
|                                               "DisplayName":  "Organization.Read.All",
|                                               "Description":  "Allows the app to read the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed SKUs and tenant branding information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "17f07f5d-fb80-4278-ba37-70ae04d476a3",
|                                               "Value":  "Organization.ReadWrite.All",
|                                               "DisplayName":  "Organization.ReadWrite.All",
|                                               "Description":  "Allows the app to read and write the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed SKUs and tenant branding information."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bbbcc29c-7bd7-48f0-8c8b-ef5f9865b626",
|                                               "Value":  "ReportingWebService.Read",
|                                               "DisplayName":  "ReportingWebService.Read",
|                                               "Description":  "Download reports via the Office 365 reporting web service"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5430838e-68e7-4b12-b353-06478ace39c3",
|                                               "Value":  "PeopleSettings.ReadWrite.All",
|                                               "DisplayName":  "Read and write tenant-wide people settings",
|                                               "Description":  "Allows the application to read and write tenant-wide people settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Exchange Online",
|                                               "AppId":  "00000002-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e1eeeffa-b5a5-4b80-ae8f-ccb93d4b75eb",
|                                               "Value":  "PeopleSettings.Read.All",
|                                               "DisplayName":  "Read tenant-wide people settings",
|                                               "Description":  "Allows the application to read tenant-wide people settings on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "806d1b36-e37b-4f02-9c9e-a1269982b2aa",
|                                               "Value":  "SharePointCrossTenantMigration.Manage.All",
|                                               "DisplayName":  "Read, write and manage Cross-Tenant migration settings and tasks",
|                                               "Description":  "Read, write and manage Cross-Tenant migration settings and tasks, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "8cfb5122-1118-41e2-b9f2-8ab21a06c030",
|                                               "Value":  "SharePointCrossTenantMigration.Read.All",
|                                               "DisplayName":  "Read Cross-Tenant migration settings and tasks",
|                                               "Description":  "Read Cross-Tenant migration settings and tasks, without a signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dfe5a59c-77fe-436b-9a47-375a284cf302",
|                                               "Value":  "Migration.ReadWrite.All",
|                                               "DisplayName":  "Read and write access to migration data on the SharePoint admin site",
|                                               "Description":  "Allows the app to read and write migration data via the SharePoint admin site without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b7155856-e8b7-4ba1-bf43-8c9912353676",
|                                               "Value":  "Migration.Read.All",
|                                               "DisplayName":  "Read access to migration data on the SharePoint admin site",
|                                               "Description":  "Allows the app to read migration data via the SharePoint admin site without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e512dd2e-d13a-4816-9202-d3ef0357c7b1",
|                                               "Value":  "TenantReports.ReadWrite.All",
|                                               "DisplayName":  "Read and write access to tenant report data on the SharePoint admin site",
|                                               "Description":  "Allows the app to read and write tenant reports via the SharePoint admin site without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3cc23ca2-bb9d-42cd-9802-f792b98bac3b",
|                                               "Value":  "TenantReports.Read.All",
|                                               "DisplayName":  "Read access to tenant report data on the SharePoint admin site",
|                                               "Description":  "Allows the app to read tenant reports via the SharePoint admin site without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6d004c19-cc42-41ea-8888-cce2fc5bd2c5",
|                                               "Value":  "SitesMetadataAdmin.ReadWrite.All",
|                                               "DisplayName":  "Read and write access to site collection metadata on the SharePoint admin site",
|                                               "Description":  "Allows the app to read and write site collection metadata without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "1ee80186-f376-4677-b0be-fbad73a4a9ea",
|                                               "Value":  "SitesMetadataAdmin.Read.All",
|                                               "DisplayName":  "Read access to site collection metadata on the SharePoint admin site",
|                                               "Description":  "Allows the app to read site collection metadata without a signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "fbcd29d2-fcca-4405-aded-518d457caae4",
|                                               "Value":  "Sites.ReadWrite.All",
|                                               "DisplayName":  "Read and write items in all site collections",
|                                               "Description":  "Allows the app to create, read, update, and delete documents and list items in all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d13f72ca-a275-4b96-b789-48ebcc4da984",
|                                               "Value":  "Sites.Read.All",
|                                               "DisplayName":  "Read items in all site collections",
|                                               "Description":  "Allows the app to read documents and list items in all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "678536fe-1083-478a-9c59-b99265e6b0d3",
|                                               "Value":  "Sites.FullControl.All",
|                                               "DisplayName":  "Have full control of all site collections",
|                                               "Description":  "Allows the app to have full control of all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9bff6588-13f2-4c48-bbf2-ddab62256b36",
|                                               "Value":  "Sites.Manage.All",
|                                               "DisplayName":  "Read and write items and lists in all site collections",
|                                               "Description":  "Allows the app to read, create, update, and delete document libraries and lists in all site collections without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "2a8d57a5-4090-4a41-bf1c-3c621d2ccad3",
|                                               "Value":  "TermStore.Read.All",
|                                               "DisplayName":  "Read managed metadata",
|                                               "Description":  "Allows the app to read enterprise managed metadata and to read basic site info without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "c8e3537c-ec53-43b9-bed3-b2bd3617ae97",
|                                               "Value":  "TermStore.ReadWrite.All",
|                                               "DisplayName":  "Read and write managed metadata",
|                                               "Description":  "Allows the app to write enterprise managed metadata and to read basic site info without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "741f803b-c850-494e-b5df-cde7c675a1ca",
|                                               "Value":  "User.ReadWrite.All",
|                                               "DisplayName":  "Read and write user profiles",
|                                               "Description":  "Allows the app to read and update user profiles and to read basic site info without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "df021288-bdef-4463-88db-98f22de89214",
|                                               "Value":  "User.Read.All",
|                                               "DisplayName":  "Read user profiles",
|                                               "Description":  "Allows the app to read user profiles without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "20d37865-089c-4dee-8c41-6967602d4ac8",
|                                               "Value":  "Sites.Selected",
|                                               "DisplayName":  "Access selected site collections",
|                                               "Description":  "Allow the application to access a subset of site collections without a signed in user. The specific site collections and the permissions granted will be configured in SharePoint Online."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ee5c91f0-be0b-463e-85c9-57f0514c3d29",
|                                               "Value":  "SitesMetadataAdmin.Read.All",
|                                               "DisplayName":  "Can view site collection metadata from the admin site",
|                                               "Description":  "Allows the app to read site collection metadata using the SharePoint admin site, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9aaa3660-6678-4cb8-b4b5-be92b6f4fbf0",
|                                               "Value":  "SitesMetadataAdmin.ReadWrite.All",
|                                               "DisplayName":  "Can view and edit site collection metadata from the admin site",
|                                               "Description":  "Allows the app to read and write site collection metadata using the SharePoint admin site, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "97533022-c395-42ce-bcf7-7d554ac912fc",
|                                               "Value":  "TenantReports.Read.All",
|                                               "DisplayName":  "Can view tenant reports from the admin site",
|                                               "Description":  "Allows the app to read tenant reports via the SharePoint admin site, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fb471c34-3a48-412f-969b-e2b9bc071042",
|                                               "Value":  "TenantReports.ReadWrite.All",
|                                               "DisplayName":  "Can view and edit tenant reports from the admin site",
|                                               "Description":  "Allows the app to read and write tenant reports via the SharePoint admin site, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f569098d-1005-4cc6-a812-3bdccdcfbb98",
|                                               "Value":  "Migration.Read.All",
|                                               "DisplayName":  "Can view migration data from the admin site",
|                                               "Description":  "Allows the app to read migration data using the SharePoint admin site, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1a50df37-8278-4139-9af3-3b60d57dd007",
|                                               "Value":  "Migration.ReadWrite.All",
|                                               "DisplayName":  "Can view and edit migration data from the admin site",
|                                               "Description":  "Allows the app to read and write migration data using the SharePoint admin site, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9ac4404a-0323-446d-b334-b4ae4d18b38a",
|                                               "Value":  "Sites.Selected",
|                                               "DisplayName":  "Access selected site collections",
|                                               "Description":  "Allows the app to access a subset of site collections with a signed-in user. The specific site collections and the permissions granted will be configured in SharePoint Online."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2cfdc887-d7b4-4798-9b33-3d98d6b95dd2",
|                                               "Value":  "MyFiles.Write",
|                                               "DisplayName":  "Read and write user files",
|                                               "Description":  "Allows the app to read, create, update, and delete the current user\u0027s files."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dd2c8d78-58e1-46d7-82dd-34d411282686",
|                                               "Value":  "MyFiles.Read",
|                                               "DisplayName":  "Read user files",
|                                               "Description":  "Allows the app to read the current user\u0027s files."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "56680e0d-d2a3-4ae1-80d8-3c4f2100e3d0",
|                                               "Value":  "AllSites.FullControl",
|                                               "DisplayName":  "Have full control of all site collections",
|                                               "Description":  "Allows the app to have full control of all site collections on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b3f70a70-8a4b-4f95-9573-d71c496a53f4",
|                                               "Value":  "AllSites.Manage",
|                                               "DisplayName":  "Read and write items and lists in all site collections",
|                                               "Description":  "Allows the app to read, create, update, and delete document libraries and lists in all site collections on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "640ddd16-e5b7-4d71-9690-3f4022699ee7",
|                                               "Value":  "AllSites.Write",
|                                               "DisplayName":  "Read and write items in all site collections",
|                                               "Description":  "Allows the app to create, read, update, and delete documents and list items in all site collections on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4e0d77b0-96ba-4398-af14-3baa780278f4",
|                                               "Value":  "AllSites.Read",
|                                               "DisplayName":  "Read items in all site collections",
|                                               "Description":  "Allows the app to read documents and list items in all site collections on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1002502a-9a71-4426-8551-69ab83452fab",
|                                               "Value":  "Sites.Search.All",
|                                               "DisplayName":  "Run search queries as a user",
|                                               "Description":  "Allows the app to run search queries and to read basic site info on behalf of the current signed-in user. Search results are based on the user\u0027s permissions instead of the app\u0027s permissions."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "59a198b5-0420-45a8-ae59-6da1cb640505",
|                                               "Value":  "TermStore.ReadWrite.All",
|                                               "DisplayName":  "Read and write managed metadata",
|                                               "Description":  "Allows the app to read, create, update, and delete managed metadata and to read basic site info on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a468ea40-458c-4cc2-80c4-51781af71e41",
|                                               "Value":  "TermStore.Read.All",
|                                               "DisplayName":  "Read managed metadata",
|                                               "Description":  "Allows the app to read managed metadata and to read basic site info on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5b625b3d-65b6-4fb0-85d9-8a5aa26bdf36",
|                                               "Value":  "SharePointCrossTenantMigration.Manage.All",
|                                               "DisplayName":  "Read, write and manage Cross-Tenant migration settings and tasks",
|                                               "Description":  "Read, write and manage Cross-Tenant migration settings and tasks, on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8d11884e-6820-4673-a5d6-64d2a68b311e",
|                                               "Value":  "SharePointCrossTenantMigration.Read.All",
|                                               "DisplayName":  "Read Cross-Tenant migration settings and tasks",
|                                               "Description":  "Read Cross-Tenant migration settings and tasks, on behalf of the signed-in user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a4c14cd7-8bd6-4337-8e87-78623dfc023b",
|                                               "Value":  "ProjectWebAppReporting.Read",
|                                               "DisplayName":  "Read ProjectWebApp OData reporting data",
|                                               "Description":  "Allows the app to read all OData reporting data from all ProjectWebApp site collections for the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c4258712-0efb-41f1-b6bc-be58e4e32f3f",
|                                               "Value":  "TaskStatus.Submit",
|                                               "DisplayName":  "Submit project task status updates",
|                                               "Description":  "Allows the app to submit project task status updates the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2511a087-5795-4cae-9123-d5b7d6ec4844",
|                                               "Value":  "EnterpriseResource.Write",
|                                               "DisplayName":  "Read and write user project enterprise resources",
|                                               "Description":  "Allows the app to read, create, update, and delete the current user’s enterprise resources."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b8341dab-4143-49da-8eb9-3d8c073f9e77",
|                                               "Value":  "EnterpriseResource.Read",
|                                               "DisplayName":  "Read user project enterprise resources",
|                                               "Description":  "Allows the app to read the current user\u0027s enterprise resources."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d75a7b17-f04e-40d9-8e35-79b949bdb891",
|                                               "Value":  "Project.Write",
|                                               "DisplayName":  "Read and write user projects",
|                                               "Description":  "Allows the app to read, create, update, and delete the current users’ projects."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2beb830c-70d1-4f5b-a983-79cbdb0c6c6a",
|                                               "Value":  "Project.Read",
|                                               "DisplayName":  "Read user projects",
|                                               "Description":  "Allows the app to read the current user\u0027s projects."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e7e732bd-932b-45c4-8ce5-40d60a7daad9",
|                                               "Value":  "ProjectWebApp.FullControl",
|                                               "DisplayName":  "Have full control of all ProjectWebApp site collections",
|                                               "Description":  "Allows the app to have full control of all ProjectWebApp site collections the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "82866913-39a9-4be7-8091-f4fa781088ae",
|                                               "Value":  "User.ReadWrite.All",
|                                               "DisplayName":  "Read and write user profiles",
|                                               "Description":  "Allows the app to read and update user profiles and to read basic site info on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 SharePoint Online",
|                                               "AppId":  "00000003-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0cea5a30-f6f8-42b5-87a0-84cc26822e02",
|                                               "Value":  "User.Read.All",
|                                               "DisplayName":  "Read user profiles",
|                                               "Description":  "Allows the app to read user profiles and to read basic site info on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Skype for Business Online",
|                                               "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "b783bde8-ffc2-4f0c-96ce-6e2900b7aa4e",
|                                               "Value":  "Anonymous",
|                                               "DisplayName":  "Guest user join services (preview)",
|                                               "Description":  "Allows the app create an on-demand Skype meeting and join guest users into Skype for Business services"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Skype for Business Online",
|                                               "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e821ef97-a9f6-4c9e-bb6a-29fa0d8f6101",
|                                               "Value":  "Meetings.JoinManage",
|                                               "DisplayName":  "Join and Manage Skype Meetings (preview)",
|                                               "Description":  "Allows the app to join and manage Skype meetings"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Skype for Business Online",
|                                               "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f7a521bb-ae17-42df-8096-97ebcc8b4edb",
|                                               "Value":  "Conversations.Chat",
|                                               "DisplayName":  "Send/Receive Instant Messages (preview)",
|                                               "Description":  "Allows the app to send and receive instant messages; and manage instant messaging service scenarios"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Skype for Business Online",
|                                               "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "30a91c70-863f-4a08-b01c-6c1d78685414",
|                                               "Value":  "Conversations.PSTN",
|                                               "DisplayName":  "Send/Receive PSTN (preview)",
|                                               "Description":  "Allows the app to send and receive voice calls; and manage PSTN service scenarios"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Skype for Business Online",
|                                               "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "05a4e3e8-cfa6-4934-bb91-b6fc4ce6f340",
|                                               "Value":  "Conversations.AudioVideo",
|                                               "DisplayName":  "Send/Receive Audio and Video (preview)",
|                                               "Description":  "Allows the app to send and receive audio and video; and manage audio/video service scenarios"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Skype for Business Online",
|                                               "AppId":  "00000004-0000-0ff1-ce00-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "189125ec-ea35-4135-b00a-e51472464beb",
|                                               "Value":  "Meetings.ScheduleOnDemand",
|                                               "DisplayName":  "Create on-demand Skype meetings (preview)",
|                                               "Description":  "Allows the app to create on-demand Skype meetings (short term expiry)"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Dataverse",
|                                               "AppId":  "00000007-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a4c5bee6-25ff-4bb5-b926-b7eb8062ae7a",
|                                               "Value":  "mcp.tools",
|                                               "DisplayName":  "Access Dataverse MCP tools as organization users",
|                                               "Description":  "Allows the application to access Dataverse MCP tools as organization users"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Dataverse",
|                                               "AppId":  "00000007-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "78ce3f0f-a1ce-49c2-8cde-64b5c0896db4",
|                                               "Value":  "user_impersonation",
|                                               "DisplayName":  "Access Common Data Service as organization users",
|                                               "Description":  "Allows the application to access Common Data Service acting as users in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Azure Resource Manager",
|                                               "AppId":  "797f4846-ba00-4fd7-ba43-dac1f8f63013",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "41094075-9dad-400e-a0bd-54e686782033",
|                                               "Value":  "user_impersonation",
|                                               "DisplayName":  "Access Azure Resource Manager as organization users",
|                                               "Description":  "Allows the application to access Azure Resource Manager acting as users in the organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Intune",
|                                               "AppId":  "0000000a-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e323f13a-1fcc-49cc-883f-c6da13ae0542",
|                                               "Value":  "MicrosoftTunnelGatewayEnrollment",
|                                               "DisplayName":  "MicrosoftTunnelGatewayEnrollment",
|                                               "Description":  "Allows Intune Admins to enroll a Microsoft Tunnel Gateway Agent"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "654b31ae-d941-4e22-8798-7add8fdf049f",
|                                               "Value":  "Tenant.Read.All",
|                                               "DisplayName":  "View all content in tenant",
|                                               "Description":  "The app can view all content in the tenant without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "28379fa9-8596-4fd9-869e-cb60a93b5d84",
|                                               "Value":  "Tenant.ReadWrite.All",
|                                               "DisplayName":  "Read and write all content in tenant",
|                                               "Description":  "The app can create, edit, view, and delete all content in the tenant without a signed in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "debb9ba3-fb14-491a-884c-b4406ac079f5",
|                                               "Value":  "CatalogMirroring.Read.All",
|                                               "DisplayName":  "Read Iceberg and Delta table catalog metadata from the provider",
|                                               "Description":  "Allows reading Iceberg and Delta table catalog metadata from the external provider on the users behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "04994edc-428b-482b-af95-ee1575dde39b",
|                                               "Value":  "Fabric.Embed",
|                                               "DisplayName":  "Embed Fabric items, retrieve user identifiers and restricted metadata",
|                                               "Description":  "Allows retrieving item definitions, user identifiers, and other restricted metadata required for embedding Fabric items on the user’s behalf. To embed, the app must also be granted the appropriate contextual scope(s), such as Item.Read.All, Notebook.Read.All, or Workspace.Read.All."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c595891f-110c-4524-abce-fa7b97bc7c65",
|                                               "Value":  "Catalog.Read.All",
|                                               "DisplayName":  "Read catalog",
|                                               "Description":  "Allows reading catalog on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6213ab68-aad6-4ec9-836a-306b14f6fee6",
|                                               "Value":  "Item.Audit.All",
|                                               "DisplayName":  "Make API calls that require audit permissions on all items",
|                                               "Description":  "Allows the app to make API calls that require audit permissions on all items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6cadaf62-a218-4d72-a641-0f85c813ece3",
|                                               "Value":  "DatabricksCatalog.Read.All",
|                                               "DisplayName":  "Read Databricks workspaces catalog metadata.",
|                                               "Description":  "Allows reading Databricks workspaces catalog metadata on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1318ed2f-75ad-4748-b33a-d49044214bdb",
|                                               "Value":  "Eventhouse.Reshare.All",
|                                               "DisplayName":  "Eventhouse.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0a5f551e-003b-482b-b5fb-7124a9510ba1",
|                                               "Value":  "Eventhouse.Execute.All",
|                                               "DisplayName":  "Eventhouse.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b13393d0-9253-4ca8-be5a-be145f337ea3",
|                                               "Value":  "Eventhouse.ReadWrite.All",
|                                               "DisplayName":  "Read and write eventhouses",
|                                               "Description":  "Allows modifying eventhouses on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cd1718e4-3e09-4381-a6e1-183e245f8613",
|                                               "Value":  "Eventhouse.Read.All",
|                                               "DisplayName":  "Read eventhouses",
|                                               "Description":  "Allows reading eventhouses on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d95f0afe-0ace-431b-9741-b29d7a02e19b",
|                                               "Value":  "RetailDataManager.Reshare.All",
|                                               "DisplayName":  "RetailDataManager.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5793b2af-bc3b-4f1d-bbb1-9a3e359dd8e1",
|                                               "Value":  "RetailDataManager.Execute.All",
|                                               "DisplayName":  "RetailDataManager.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e87305de-874c-4fb9-a7c1-fff664dc5d6e",
|                                               "Value":  "RetailDataManager.ReadWrite.All",
|                                               "DisplayName":  "Read and write retail data manager items",
|                                               "Description":  "Allows modifying retail data manager items on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1ddcbaa9-c4cf-4684-9048-e04a12739a8c",
|                                               "Value":  "RetailDataManager.Read.All",
|                                               "DisplayName":  "Read retail data manager items",
|                                               "Description":  "Allows reading retail data manager items on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bcd38192-b0a2-4c40-bc0e-5728ec6ee69d",
|                                               "Value":  "Dashboard.Execute.All",
|                                               "DisplayName":  "Dashboard.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e5c15c39-f5e8-45b2-b858-edba09abc583",
|                                               "Value":  "SQLEndpoint.ReadWrite.All",
|                                               "DisplayName":  "Read and write SQL endpoints",
|                                               "Description":  "Allows modifying SQL endpoints on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9afd59c7-4e4d-4a5d-b2aa-2777debb5cd9",
|                                               "Value":  "DataPipeline.Reshare.All",
|                                               "DisplayName":  "DataPipeline.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d7629fc2-75c0-412f-9c11-052513f055ae",
|                                               "Value":  "Warehouse.Reshare.All",
|                                               "DisplayName":  "Warehouse.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "15a808d7-2065-4357-8b76-47f701df3575",
|                                               "Value":  "SQLEndpoint.Reshare.All",
|                                               "DisplayName":  "SQLEndpoint.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "868c9b47-9e35-4c69-bac3-042213ef72a3",
|                                               "Value":  "SemanticModel.Reshare.All",
|                                               "DisplayName":  "SemanticModel.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "62816fca-afaa-44af-abd6-9e8f604d8dbb",
|                                               "Value":  "Scorecard.Reshare.All",
|                                               "DisplayName":  "Scorecard.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b510092a-d399-45f3-b1d5-4e2d34c87997",
|                                               "Value":  "PaginatedReport.Reshare.All",
|                                               "DisplayName":  "PaginatedReport.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "49dd4a50-f26f-4cc8-b895-227eb620861d",
|                                               "Value":  "SparkJobDefinition.Reshare.All",
|                                               "DisplayName":  "SparkJobDefinition.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "54f4913d-63d6-4256-a270-f16a6222e625",
|                                               "Value":  "Report.Reshare.All",
|                                               "DisplayName":  "Report.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9ff20ed3-e70b-486e-9686-006be349a5d6",
|                                               "Value":  "Notebook.Reshare.All",
|                                               "DisplayName":  "Notebook.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5a93e9d0-4312-4fad-bbb5-44c74a75083a",
|                                               "Value":  "MLModel.Reshare.All",
|                                               "DisplayName":  "Reshare ML models",
|                                               "Description":  "Allows resharing ML models on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2d3aa07c-d364-4ce0-acbc-b7e151ee161d",
|                                               "Value":  "KQLQueryset.Reshare.All",
|                                               "DisplayName":  "KQLQueryset.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7504609f-c495-4c64-8542-686125a5a36f",
|                                               "Value":  "Report.ReadWrite.All",
|                                               "DisplayName":  "Read and write reports",
|                                               "Description":  "Allows modifying reports on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4ae1bf56-f562-4747-b7bc-2fa0874ed46f",
|                                               "Value":  "Report.Read.All",
|                                               "DisplayName":  "Read reports",
|                                               "Description":  "Allows reading reports on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b271f05e-8329-4b97-baa4-91cf15b99cf1",
|                                               "Value":  "Dashboard.ReadWrite.All",
|                                               "DisplayName":  "Read and write dashboards",
|                                               "Description":  "Allows modifying dashboards on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ddd37690-e119-40c5-a821-3746ea6125c4",
|                                               "Value":  "Dataflow.ReadWrite.All",
|                                               "DisplayName":  "Read and write dataflows",
|                                               "Description":  "Allows modifying dataflows on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f9759906-80a4-4f4a-b010-24b832bc6a30",
|                                               "Value":  "Dataflow.Read.All",
|                                               "DisplayName":  "Read dataflows",
|                                               "Description":  "Allows reading dataflows on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0a25ca24-b130-4a32-affd-29d640b63f14",
|                                               "Value":  "Notebook.Read.All",
|                                               "DisplayName":  "Read notebooks",
|                                               "Description":  "Allows reading notebooks on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "13060bfd-9305-4ec6-8388-8916580f4fa9",
|                                               "Value":  "Lakehouse.Read.All",
|                                               "DisplayName":  "Read lakehouses",
|                                               "Description":  "Allows reading lakehouses on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eee83281-2212-467d-b9e3-2aadfb170f33",
|                                               "Value":  "Lakehouse.ReadWrite.All",
|                                               "DisplayName":  "Read and write lakehouses",
|                                               "Description":  "Allows modifying lakehouses on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ec20a3e3-8c0b-4d75-8d1b-a9ffdbbe2519",
|                                               "Value":  "SparkJobDefinition.ReadWrite.All",
|                                               "DisplayName":  "Read and write spark job definitions",
|                                               "Description":  "Allows modifying spark job definitions on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "179809f0-8b05-4f65-bdd0-920fb4945c33",
|                                               "Value":  "MLExperiment.Read.All",
|                                               "DisplayName":  "Read ML experiments",
|                                               "Description":  "Allows reading ML experiments on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e4f65fe4-b466-4254-89ea-2fcdc8d8ac49",
|                                               "Value":  "MLExperiment.ReadWrite.All",
|                                               "DisplayName":  "Read and write ML experiments",
|                                               "Description":  "Allows modifying ML experiments on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5d9a285a-0847-4aa7-a9db-4991dedc2b53",
|                                               "Value":  "MLModel.Read.All",
|                                               "DisplayName":  "Read ML models",
|                                               "Description":  "Allows reading ML models on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2cb667b2-c449-4f2d-a1ad-e0ffa27b5d75",
|                                               "Value":  "MLModel.ReadWrite.All",
|                                               "DisplayName":  "Read and write ML models",
|                                               "Description":  "Allows modifying ML models on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b02aa3b5-6fb3-48b8-803a-57bdef45d20c",
|                                               "Value":  "Notebook.ReadWrite.All",
|                                               "DisplayName":  "Read and write notebooks",
|                                               "Description":  "Allows modifying notebooks on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8191607d-cbe5-49c6-b480-1aae71f3dce6",
|                                               "Value":  "KQLDataConnection.Reshare.All",
|                                               "DisplayName":  "KQLDataConnection.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "83a35b59-6a34-40f4-ac4e-5bf5a6ff9a5d",
|                                               "Value":  "KQLDatabase.Reshare.All",
|                                               "DisplayName":  "KQLDatabase.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ff4d87c4-a161-49a8-a886-fe14bf6a2203",
|                                               "Value":  "Eventstream.Reshare.All",
|                                               "DisplayName":  "Eventstream.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "44abf802-73c1-42f4-a26f-915b4c27fa8f",
|                                               "Value":  "Datamart.Reshare.All",
|                                               "DisplayName":  "Datamart.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "27296d33-1a83-44d6-9665-63f4902781f9",
|                                               "Value":  "MLExperiment.Reshare.All",
|                                               "DisplayName":  "MLExperiment.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "881e9f00-4e9c-4798-bc50-832fea2cdbe6",
|                                               "Value":  "Lakehouse.Reshare.All",
|                                               "DisplayName":  "Lakehouse.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ad056abd-4839-4bb1-ba68-ffcf8194a869",
|                                               "Value":  "Dataflow.Reshare.All",
|                                               "DisplayName":  "Dataflow.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c67b16d3-b5b8-4c87-8ca0-a8e00c6d6ff3",
|                                               "Value":  "Dashboard.Reshare.All",
|                                               "DisplayName":  "Dashboard.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d17eaf78-91ce-4314-9101-868b933996fb",
|                                               "Value":  "Warehouse.Execute.All",
|                                               "DisplayName":  "Execute warehouses",
|                                               "Description":  "Allows executing warehouses on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "aa70d616-e57e-4a5a-84cd-07de4250dd2e",
|                                               "Value":  "SQLEndpoint.Execute.All",
|                                               "DisplayName":  "SQLEndpoint.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "42b94671-298c-48a0-a55d-077e48186883",
|                                               "Value":  "SemanticModel.Execute.All",
|                                               "DisplayName":  "SemanticModel.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dc75a12a-fef2-436d-8311-fed5b7e3a9d0",
|                                               "Value":  "Scorecard.Execute.All",
|                                               "DisplayName":  "Scorecard.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4aaafe5b-1b27-4403-88f2-e3ebbb8bccc5",
|                                               "Value":  "PaginatedReport.Execute.All",
|                                               "DisplayName":  "PaginatedReport.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b0a64161-0e6a-4f7c-aa14-a1f9413136f3",
|                                               "Value":  "Report.Execute.All",
|                                               "DisplayName":  "Report.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b84b0d8d-9870-4b2b-92d2-9bfa7f940db3",
|                                               "Value":  "KQLQueryset.Execute.All",
|                                               "DisplayName":  "KQLQueryset.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6872ffe8-d8d4-46f9-9a32-5537dad08dd2",
|                                               "Value":  "KQLDataConnection.Execute.All",
|                                               "DisplayName":  "KQLDataConnection.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "21b4da43-510a-43ac-afd4-580e1e2c09c8",
|                                               "Value":  "KQLDatabase.Execute.All",
|                                               "DisplayName":  "Execute KQL databases",
|                                               "Description":  "Allows executing KQL databases on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "110e2f5f-6226-4c3f-8d02-4b30b33e5fd1",
|                                               "Value":  "Eventstream.Execute.All",
|                                               "DisplayName":  "Eventstream.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "17cddc84-5ff7-4b6a-a017-632384c5e063",
|                                               "Value":  "Datamart.Execute.All",
|                                               "DisplayName":  "Datamart.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6b03f425-0a8e-4c54-ba35-df73806f1396",
|                                               "Value":  "MLModel.Execute.All",
|                                               "DisplayName":  "Execute ML models",
|                                               "Description":  "Allows executing ML models on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3101f5b2-b314-4bbd-a1f6-8a05f94f33ea",
|                                               "Value":  "MLExperiment.Execute.All",
|                                               "DisplayName":  "Execute ML experiments",
|                                               "Description":  "Allows executing ML experiments on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "529939f7-18e3-4be4-ba92-b01894a4fadf",
|                                               "Value":  "Dataflow.Execute.All",
|                                               "DisplayName":  "Execute dataflows",
|                                               "Description":  "Allows executing dataflows on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b13a1be2-e407-47b5-8429-12f4ad4f9fcd",
|                                               "Value":  "Scorecard.ReadWrite.All",
|                                               "DisplayName":  "Scorecard.ReadWrite (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e93694df-fa72-4011-aad8-f3648588c762",
|                                               "Value":  "PaginatedReport.Read.All",
|                                               "DisplayName":  "Read paginated reports",
|                                               "Description":  "Allows reading paginated reports on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8826b95a-bc76-4025-97f1-8c89c3d5f210",
|                                               "Value":  "KQLQueryset.Read.All",
|                                               "DisplayName":  "Read KQL querysets",
|                                               "Description":  "Allows reading KQL querysets on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "24367f1a-a6d6-410d-b438-378ed19cb875",
|                                               "Value":  "KQLDatabase.Read.All",
|                                               "DisplayName":  "Read KQL databases",
|                                               "Description":  "Allows reading KQL databases on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5ce2a0b7-2512-440d-bf05-d5db590cc4c7",
|                                               "Value":  "Eventstream.Read.All",
|                                               "DisplayName":  "Read eventstreams",
|                                               "Description":  "Allows reading eventstreams on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3492d2fc-251d-4a2b-8be4-97f06fd6d0d4",
|                                               "Value":  "SparkJobDefinition.Execute.All",
|                                               "DisplayName":  "Execute spark job definitions",
|                                               "Description":  "Allows executing spark job definitions on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3e801746-e22a-4fcb-a3f5-315ace8e165a",
|                                               "Value":  "Notebook.Execute.All",
|                                               "DisplayName":  "Execute notebooks",
|                                               "Description":  "Allows executing notebooks on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "565b3968-767c-4100-8771-a827146f38ce",
|                                               "Value":  "Lakehouse.Execute.All",
|                                               "DisplayName":  "Execute lakehouses",
|                                               "Description":  "Allows executing lakehouses on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6f4dd5b6-1369-4aef-a71b-8a734a9e0a20",
|                                               "Value":  "Warehouse.Read.All",
|                                               "DisplayName":  "Read warehouses",
|                                               "Description":  "Allows reading warehouses on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d2090f0b-c876-45ea-b6fa-785e7ef84788",
|                                               "Value":  "SemanticModel.Read.All",
|                                               "DisplayName":  "Read semantic models",
|                                               "Description":  "Allows reading semantic models on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "91f75836-b68c-4fff-84db-4372412a2c82",
|                                               "Value":  "Datamart.Read.All",
|                                               "DisplayName":  "Read datamarts",
|                                               "Description":  "Allows reading datamarts on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "88ba374a-d581-4944-b7c7-1181754eba74",
|                                               "Value":  "KQLQueryset.ReadWrite.All",
|                                               "DisplayName":  "Read and write KQL querysets",
|                                               "Description":  "Allows modifying KQL querysets on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dbc7f8f6-3822-41e6-aebd-5a79e2ddc72a",
|                                               "Value":  "SQLEndpoint.Read.All",
|                                               "DisplayName":  "Read SQL endpoints",
|                                               "Description":  "Allows reading SQL endpoints on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "726667b1-01a6-4be4-b04c-e95eae4023a8",
|                                               "Value":  "KQLDatabase.ReadWrite.All",
|                                               "DisplayName":  "Read and write KQL databases",
|                                               "Description":  "Allows modifying KQL databases on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bd305576-f504-4e9a-81d4-d16c7eb5334b",
|                                               "Value":  "Eventstream.ReadWrite.All",
|                                               "DisplayName":  "Read and write eventstreams",
|                                               "Description":  "Allows modifying eventstreams on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a405c0f7-5d2f-4e19-8db7-7323bae0b3c3",
|                                               "Value":  "PaginatedReport.ReadWrite.All",
|                                               "DisplayName":  "Read and write paginated reports",
|                                               "Description":  "Allows modifying paginated reports on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "35735863-502b-4a11-8f65-b0bbe7ec8e95",
|                                               "Value":  "Warehouse.ReadWrite.All",
|                                               "DisplayName":  "Read and write warehouses",
|                                               "Description":  "Allows modifying warehouses on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9e7c970c-1dc5-482d-b2a1-2a4fed211921",
|                                               "Value":  "SemanticModel.ReadWrite.All",
|                                               "DisplayName":  "Read and write semantic models",
|                                               "Description":  "Allows modifying semantic models on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6098cd04-d625-4e1c-91d6-f7888f645256",
|                                               "Value":  "Datamart.ReadWrite.All",
|                                               "DisplayName":  "Read and write datamarts",
|                                               "Description":  "Allows modifying datamarts on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2448370f-f988-42cd-909c-6528efd67c1a",
|                                               "Value":  "Dashboard.Read.All",
|                                               "DisplayName":  "Read dashboards",
|                                               "Description":  "Allows reading dashboards on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "346e63ff-7cb8-4d86-9f6b-c9212f86a719",
|                                               "Value":  "Connection.Reshare.All",
|                                               "DisplayName":  "Connection.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "80a4f621-10a7-45e5-a961-79e9b81831d0",
|                                               "Value":  "Environment.Read.All",
|                                               "DisplayName":  "Read environment items",
|                                               "Description":  "Allows reading environment items on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "995d4201-6a2d-45c6-bad2-9f2aba89298d",
|                                               "Value":  "Environment.ReadWrite.All",
|                                               "DisplayName":  "Read and write environment items",
|                                               "Description":  "Allows modifying environment items on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "72e814f5-a6b9-4316-b2ca-d07f426c178c",
|                                               "Value":  "Environment.Reshare.All",
|                                               "DisplayName":  "Environment.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7a638d43-6e2d-4bf0-bffd-477785a2c721",
|                                               "Value":  "Environment.Execute.All",
|                                               "DisplayName":  "Environment.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1cc6e528-a407-4de1-883e-e36b91e09379",
|                                               "Value":  "SQLDatabase.Read.All",
|                                               "DisplayName":  "Read SQL databases",
|                                               "Description":  "Allows reading SQL databases on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e4a4166c-b39f-4956-96ee-52ae6f1242e8",
|                                               "Value":  "SQLDatabase.ReadWrite.All",
|                                               "DisplayName":  "Read and write SQL databases",
|                                               "Description":  "Allows modifying SQL databases on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f87561dd-6f31-48ab-bcca-d3cec4564562",
|                                               "Value":  "SQLDatabase.Execute.All",
|                                               "DisplayName":  "SQLDatabase.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7cbb226f-a463-4f7e-b085-d11f68dac9ee",
|                                               "Value":  "SQLDatabase.Reshare.All",
|                                               "DisplayName":  "SQLDatabase.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "64f9ad72-16e9-49c9-b691-1cb7545560c3",
|                                               "Value":  "UserDataFunction.Read.All",
|                                               "DisplayName":  "Read user data function items",
|                                               "Description":  "Allows reading user data function items on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9a69fd02-6f0f-4945-bd56-33a4a01f887d",
|                                               "Value":  "UserDataFunction.ReadWrite.All",
|                                               "DisplayName":  "Read and write user data function items",
|                                               "Description":  "Allows modifying user data function items on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2a34e79d-bc8c-40b7-8053-22549c4f8a8d",
|                                               "Value":  "UserDataFunction.Execute.All",
|                                               "DisplayName":  "Execute user data function items",
|                                               "Description":  "Allows executing user data function items on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "beaf3087-05af-4060-a0a5-29779c902004",
|                                               "Value":  "SparkJobDefinition.Read.All",
|                                               "DisplayName":  "Read spark job definitions",
|                                               "Description":  "Allows reading spark job definitions on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "781c41ac-e316-4a17-b470-cafd75f5c010",
|                                               "Value":  "Reflex.Read.All",
|                                               "DisplayName":  "Read Reflexes",
|                                               "Description":  "Allows reading Reflexes on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "99cac2a4-5c59-45dc-83bd-5303fda5d49d",
|                                               "Value":  "Reflex.ReadWrite.All",
|                                               "DisplayName":  "Read and write Reflexes",
|                                               "Description":  "Allows modifying Reflexes on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "10051e25-9077-418c-a076-32a2d35132a2",
|                                               "Value":  "MirroredDatabase.Read.All",
|                                               "DisplayName":  "Read mirrored databases",
|                                               "Description":  "Allows reading mirrored databases on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2eb0ab4e-195e-45ec-9eb3-3b9842bea4f4",
|                                               "Value":  "MirroredDatabase.ReadWrite.All",
|                                               "DisplayName":  "Read and write mirrored databases",
|                                               "Description":  "Allows modifying mirrored databases on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "67d4aa3f-531f-4db2-a382-7db42788fd35",
|                                               "Value":  "MirroredDatabase.Execute.All",
|                                               "DisplayName":  "MirroredDatabase.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c18991d0-0a42-4567-983a-1993bc79f327",
|                                               "Value":  "MirroredDatabase.Reshare.All",
|                                               "DisplayName":  "MirroredDatabase.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ea662897-fca3-4698-84f4-6acc2fb3a7ea",
|                                               "Value":  "VariableLibrary.Read.All",
|                                               "DisplayName":  "Read variable libraries",
|                                               "Description":  "Allows reading variable libraries on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "43e2cb94-fe45-449d-aa4d-b1f473b98c53",
|                                               "Value":  "VariableLibrary.ReadWrite.All",
|                                               "DisplayName":  "Read and write variable libraries",
|                                               "Description":  "Allows modifying variable libraries on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2c1729df-8c12-449b-ae71-2e4acea26919",
|                                               "Value":  "VariableLibrary.Execute.All",
|                                               "DisplayName":  "Execute variable libraries",
|                                               "Description":  "Allows executing variable libraries on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "79649b78-0856-46fa-902e-b634299dbc3c",
|                                               "Value":  "VariableLibrary.Reshare.All",
|                                               "DisplayName":  "VariableLibrary.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dc55c1dd-468c-4d7f-877a-9414f4c79c61",
|                                               "Value":  "GraphInstance.Read.All",
|                                               "DisplayName":  "Read graph instances",
|                                               "Description":  "Allows reading graph instances on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6523f613-2a20-4d18-8b05-4d1bce5b7b07",
|                                               "Value":  "GraphInstance.ReadWrite.All",
|                                               "DisplayName":  "Read and write graph instances",
|                                               "Description":  "Allows modifying graph instances on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d7fd01f6-c485-406a-ad50-27ea1c711589",
|                                               "Value":  "GraphInstance.Execute.All",
|                                               "DisplayName":  "Execute graph instances",
|                                               "Description":  "Allows executing graph instances on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ce5cc3da-13ac-4c07-9b8d-f5c5811d91d0",
|                                               "Value":  "GraphInstance.Reshare.All",
|                                               "DisplayName":  "GraphInstance.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "deae611f-920b-422f-805e-f635080c4cfb",
|                                               "Value":  "GraphQLApi.Read.All",
|                                               "DisplayName":  "Read GraphQLApis",
|                                               "Description":  "Allows reading GraphQLApis on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "73d01b13-cb5e-466e-8752-a50feccb317e",
|                                               "Value":  "GraphQLApi.ReadWrite.All",
|                                               "DisplayName":  "Read and write GraphQLApis",
|                                               "Description":  "Allows modifying GraphQLApis on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "88cf9f59-aa53-4386-ae14-3c8263713766",
|                                               "Value":  "GraphQLApi.Reshare.All",
|                                               "DisplayName":  "GraphQLApi.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cece14a0-0fa7-4de3-b458-69bd0cfea634",
|                                               "Value":  "GraphQLApi.Execute.All",
|                                               "DisplayName":  "Execute GraphQLApis",
|                                               "Description":  "Allows executing GraphQLApis on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f4611230-1dcf-4466-92d9-59a35c81737a",
|                                               "Value":  "MetricSet.Read.All",
|                                               "DisplayName":  "Read metric sets",
|                                               "Description":  "Allows reading metric sets on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "68386d9d-5570-4b99-9211-ab8abd584145",
|                                               "Value":  "MetricSet.ReadWrite.All",
|                                               "DisplayName":  "Read and write metric sets",
|                                               "Description":  "Allows modifying metric sets on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c79ca1a6-cca1-4ef3-98e3-6abf01eb242f",
|                                               "Value":  "MetricSet.Execute.All",
|                                               "DisplayName":  "MetricSet.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f2fe8057-777e-4536-a069-90f4a2f922bf",
|                                               "Value":  "MetricSet.Reshare.All",
|                                               "DisplayName":  "MetricSet.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f19ea7d7-2f31-4c6d-9845-d5480c5d1798",
|                                               "Value":  "KQLDashboard.Read.All",
|                                               "DisplayName":  "Read KQL dashboards",
|                                               "Description":  "Allows reading KQL dashboards on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3a857d04-01aa-421a-aa42-e40b4264b6f7",
|                                               "Value":  "KQLDashboard.ReadWrite.All",
|                                               "DisplayName":  "Read and write KQL dashboards",
|                                               "Description":  "Allows modifying KQL dashboards on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6132db85-22d5-486c-b094-56eb8f746628",
|                                               "Value":  "KQLDashboard.Execute.All",
|                                               "DisplayName":  "KQLDashboard.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ed4d5569-4170-4f10-b174-16f9d1b31cec",
|                                               "Value":  "KQLDashboard.Reshare.All",
|                                               "DisplayName":  "KQLDashboard.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fe27a477-ed49-4762-9157-5a22eec929a7",
|                                               "Value":  "WarehouseSnapshot.Read.All",
|                                               "DisplayName":  "Read warehouse snapshots",
|                                               "Description":  "Allows reading warehouse snapshots on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "00a826b4-8fc8-4273-b68f-5947f7d13795",
|                                               "Value":  "WarehouseSnapshot.ReadWrite.All",
|                                               "DisplayName":  "Read and write warehouse snapshots",
|                                               "Description":  "Allows modifying warehouse snapshots on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f132046a-f99f-4e2f-af2c-bcc6690050a5",
|                                               "Value":  "WarehouseSnapshot.Execute.All",
|                                               "DisplayName":  "WarehouseSnapshot.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7e23ffe1-cea7-435d-94ce-4a7b4e8b38a0",
|                                               "Value":  "WarehouseSnapshot.Reshare.All",
|                                               "DisplayName":  "WarehouseSnapshot.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "784ff746-e33b-4449-ba4e-081158296c6c",
|                                               "Value":  "Reflex.Execute.All",
|                                               "DisplayName":  "Reflex.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "004969fb-6ad0-4ca6-aa15-246f2bc7ba3c",
|                                               "Value":  "Reflex.Reshare.All",
|                                               "DisplayName":  "Reflex.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fa6c6162-62d9-4f38-b83e-52a4a0382d00",
|                                               "Value":  "CopyJob.Read.All",
|                                               "DisplayName":  "Read copy jobs",
|                                               "Description":  "Allows reading copy jobs on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "615e36fa-c072-424a-a1f6-c098849fade9",
|                                               "Value":  "CopyJob.ReadWrite.All",
|                                               "DisplayName":  "Read and write copy jobs",
|                                               "Description":  "Allows modifying copy jobs on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "840d81d1-e227-45e2-982c-e76ce6908b43",
|                                               "Value":  "CopyJob.Reshare.All",
|                                               "DisplayName":  "CopyJob.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5de94f0e-625f-423b-a7e3-aa181fa938c7",
|                                               "Value":  "CopyJob.Execute.All",
|                                               "DisplayName":  "Execute copy jobs",
|                                               "Description":  "Allows executing copy jobs on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7aaf3c81-a937-4309-a1bc-812e1102a837",
|                                               "Value":  "MountedDataFactory.Read.All",
|                                               "DisplayName":  "Read Azure Data Factories",
|                                               "Description":  "Allows reading Azure Data Factories on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "63ec6016-8d37-4b46-bee2-39ad0ded84d6",
|                                               "Value":  "MountedDataFactory.ReadWrite.All",
|                                               "DisplayName":  "Read and write Azure Data Factories",
|                                               "Description":  "Allows modifying Azure Data Factories on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "aeae5f51-8e10-4970-97f6-8bc2664df3a1",
|                                               "Value":  "MountedDataFactory.Execute.All",
|                                               "DisplayName":  "MountedDataFactory.Execute (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "da46e639-2366-4e0a-a190-3fb3aac31e45",
|                                               "Value":  "MountedDataFactory.Reshare.All",
|                                               "DisplayName":  "MountedDataFactory.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0107b32c-22a6-4354-ad71-828b6d03598a",
|                                               "Value":  "MirroredAzureDatabricksCatalog.Read.All",
|                                               "DisplayName":  "Read mirrored azure databricks catalogs",
|                                               "Description":  "Allows reading mirrored azure databricks catalogs on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c5431154-27d8-4db7-96d0-8a201ad5d027",
|                                               "Value":  "MirroredAzureDatabricksCatalog.ReadWrite.All",
|                                               "DisplayName":  "Read and write mirrored azure databricks catalogs",
|                                               "Description":  "Allows modifying mirrored azure databricks catalogs on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e618543a-fb4e-4e95-a8f0-7af6549af7a9",
|                                               "Value":  "MirroredAzureDatabricksCatalog.Execute.All",
|                                               "DisplayName":  "Execute mirrored azure databricks catalogs",
|                                               "Description":  "Allows executing mirrored azure databricks catalogs on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ee9fd26c-e612-44ef-8985-a0c7a1b06ab1",
|                                               "Value":  "MirroredAzureDatabricksCatalog.Reshare.All",
|                                               "DisplayName":  "MirroredAzureDatabricksCatalog.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "40fa91d5-73ef-412c-a8c8-c8658670d0eb",
|                                               "Value":  "DataAgent.Read.All",
|                                               "DisplayName":  "Read data agents",
|                                               "Description":  "Allows reading data agents on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c23fda5c-561f-4890-ad72-5f57bb7496fd",
|                                               "Value":  "DataAgent.ReadWrite.All",
|                                               "DisplayName":  "Read and write data agents",
|                                               "Description":  "Allows modifying data agents on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c6756612-6853-4145-a661-90c1d045b2dc",
|                                               "Value":  "DataAgent.Execute.All",
|                                               "DisplayName":  "Execute data agents",
|                                               "Description":  "Allows executing data agents on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "82b1d51c-42df-4ba9-9aee-bbba1e3f2ab7",
|                                               "Value":  "DataAgent.Reshare.All",
|                                               "DisplayName":  "DataAgent.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d27d5544-b17d-471f-9a02-ef09d6720508",
|                                               "Value":  "OrgApp.Read.All",
|                                               "DisplayName":  "Read org apps",
|                                               "Description":  "Allows reading org apps on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "38536678-0d9f-4f82-88e5-a13a78d1d209",
|                                               "Value":  "OrgApp.ReadWrite.All",
|                                               "DisplayName":  "Read and write org apps",
|                                               "Description":  "Allows modifying org apps on the user’s behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "02d9fa8b-e936-407b-a8f2-9b8fa5bda3bc",
|                                               "Value":  "OrgApp.Reshare.All",
|                                               "DisplayName":  "OrgApp.Reshare (retired)",
|                                               "Description":  " "
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "0a7d02f8-6c5f-4f1f-91e0-0650efd2436b",
|                                               "Value":  "Fabric.Extend.IframeSandbox",
|                                               "DisplayName":  "Run partner Fabric items in iframes with relaxed sandbox protection.",
|                                               "Description":  "Allow partner Fabric items managed by this app to run in iframes with the relaxed sandbox enabling additional operations."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7da32ee4-ec68-43a4-b13a-b5385ad9770e",
|                                               "Value":  "Warehouse.Restore.All",
|                                               "DisplayName":  "Make API calls that require restore permissions on all Warehouses",
|                                               "Description":  "Allows the app to make API calls that require restore permissions on all Warehouses, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f4e8a89a-fa13-4aac-abd3-925cfe74dc66",
|                                               "Value":  "ExternalDataShare.Accept.All",
|                                               "DisplayName":  "Allows the app to accept the external data share invitation",
|                                               "Description":  "Allows the app to accept the external data share invitation on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "1d1f591a-f469-48d6-8995-a532552ae72c",
|                                               "Value":  "Lakehouse.ExternalDataShare.All",
|                                               "DisplayName":  "Allows the app to create and manage external data shares for all lakehouses",
|                                               "Description":  "Allows the app to create and manage external data shares for all lakehouses, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b102c99e-b723-4ac3-beb8-8813448ccfa7",
|                                               "Value":  "Warehouse.ExternalDataShare.All",
|                                               "DisplayName":  "Allows the app to create and manage external data shares for all warehouses",
|                                               "Description":  "Allows the app to create and manage external data shares for all warehouses, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5cf1e703-06da-4688-8f2a-29e77c25489a",
|                                               "Value":  "SemanticModel.ExternalDataShare.All",
|                                               "DisplayName":  "Allows the app to create and manage external data shares for all semantic models",
|                                               "Description":  "Allows the app to create and manage external data shares for all semantic models, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3a1af33d-ccfa-4264-998b-348c8c299db1",
|                                               "Value":  "KQLDatabase.ExternalDataShare.All",
|                                               "DisplayName":  "Allows the app to create and manage external data shares for all KQL databases",
|                                               "Description":  "Allows the app to create and manage external data shares for all KQL databases, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bae3e5e0-a78a-4b0f-b3a0-0dc52f365b9d",
|                                               "Value":  "Item.ExternalDataShare.All",
|                                               "DisplayName":  "Allows the app to create and manage external data shares for all Fabric items",
|                                               "Description":  "Allows the app to create and manage external data shares for all Fabric items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eb433b13-ec6d-487b-8411-b5fadda75072",
|                                               "Value":  "MirroredDatabase.ExternalDataShare.All",
|                                               "DisplayName":  "Allows the app to create and manage external data shares for all mirrored Databases",
|                                               "Description":  "Allows the app to create and manage external data shares for all mirrored Databases, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e90f72dc-f418-4844-82db-ea22d405cfc1",
|                                               "Value":  "SQLDatabase.ExternalDataShare.All",
|                                               "DisplayName":  "Allows the app to create and manage external data shares for all SQL Databases",
|                                               "Description":  "Allows the app to create and manage external data shares for all SQL Databases, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a1999a26-9603-41b3-abf3-45698c57f620",
|                                               "Value":  "Code.AccessSQL.All",
|                                               "DisplayName":  "Access Azure SQL database and data warehouse",
|                                               "Description":  "This is for Azure SQL database and data warehouse access"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c289c338-860d-4abf-8312-2455f47f8f33",
|                                               "Value":  "ItemMetadata.ReadWrite.All",
|                                               "DisplayName":  "Make API calls that can read and write item metadata for all Fabric items",
|                                               "Description":  "Allows the app to make API calls that can read and write the item metadata of all Fabric items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "94a31d2b-0d95-46b5-9dcd-1bf123c80327",
|                                               "Value":  "ItemMetadata.Read.All",
|                                               "DisplayName":  "Make API calls that can read item metadata for all Fabric items",
|                                               "Description":  "Allows the app to make API calls that can read the item metadata of all Fabric items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a66db2ff-fea7-40f3-8b63-2a35d6c5f753",
|                                               "Value":  "Code.AccessFabric.All",
|                                               "DisplayName":  "Allow API calls to access all Fabric resources on behalf of signed-in user",
|                                               "Description":  "Allows the app to make API calls to access all Fabric resources, on behalf of signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2049d009-d5d1-4947-85ab-8b727def2427",
|                                               "Value":  "Code.AccessAzureKeyvault.All",
|                                               "DisplayName":  "Have full access to the Azure Key Vault service",
|                                               "Description":  "Allow the application full access to the Azure Key Vault service on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c655ab60-056e-4dd8-8cd0-6b5398bf6002",
|                                               "Value":  "Code.AccessAzureDataLake.All",
|                                               "DisplayName":  "Have full access to the Azure Data Lake service",
|                                               "Description":  "Allow the application full access to the Azure Data Lake service on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "eaf7943f-ddfe-4442-96af-9419cf9522f3",
|                                               "Value":  "Code.AccessAzureDataExplorer.All",
|                                               "DisplayName":  "Access Azure Data Explorer",
|                                               "Description":  "Allow the application to access Azure Data Explorer on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3f981b02-4cb2-4226-b4d2-c378f291573c",
|                                               "Value":  "Code.AccessStorage.All",
|                                               "DisplayName":  "Access Azure Storage",
|                                               "Description":  "Allow the application to access Azure Storage on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "fc011432-d782-46d3-8143-f0328911e0a3",
|                                               "Value":  "GraphQL.Execute.All",
|                                               "DisplayName":  "Make API calls that executes requests on all API for GraphQL items",
|                                               "Description":  "Allows the app to make API calls that executes requests on all API for GraphQL items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7ba630b9-8110-4e27-8d17-81e5f2218787",
|                                               "Value":  "Fabric.Extend",
|                                               "DisplayName":  "Extend Fabric with new item types",
|                                               "Description":  "Allows the app to extend Fabric with new item types and have restricted access to Fabric items, user identifiers and other metadata, on behalf of the signed-in user. Protecting exports with sensitivity labels, enforcement of regional boundaries and some other Fabric capabilities are not available to partner items."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8eb59948-47ce-4224-8cb1-f2a1ddb35822",
|                                               "Value":  "PrincipalDetails.ReadBasic.All",
|                                               "DisplayName":  "Read Entra ID identities basic properties",
|                                               "Description":  "Allows the app to read basic properties of Entra ID identities in your organization that are known to Microsoft Fabric, on behalf of the signed-in user. This includes display names and email addresses of users, service principals and security groups."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3be8fe94-2189-4d8b-89c6-dd35c5cea6ef",
|                                               "Value":  "Connection.ReadWrite.All",
|                                               "DisplayName":  "Make API calls that require read and write permissions on all Fabric connections",
|                                               "Description":  "Allows the app to make API calls that require read and write permissions on all Fabric connections, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9ff18859-b8d5-4a89-9912-448b84dfb097",
|                                               "Value":  "Connection.Read.All",
|                                               "DisplayName":  "Make API calls that require read permissions on all Fabric connections",
|                                               "Description":  "Allows the app to make API calls that require read permissions on all Fabric connections, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b43e1ada-25ee-416f-bd5c-512976ddc74b",
|                                               "Value":  "UserState.ReadWrite.All",
|                                               "DisplayName":  "Read and write user settings and state",
|                                               "Description":  "The app can view and edit any user settings and the user-specific state associated with  content the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "76e2ebd5-0dfb-4a5b-93c7-ed89e0362834",
|                                               "Value":  "Capacity.Read.All",
|                                               "DisplayName":  "View all capacities",
|                                               "Description":  "The app can view all Power BI Premium and Power BI Embedded capacities that the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4eabc3d1-b762-40ff-9da5-0e18fdf11230",
|                                               "Value":  "Capacity.ReadWrite.All",
|                                               "DisplayName":  "Read and write all capacities",
|                                               "Description":  "The app can view and edit all Power BI Premium and Power BI Embedded capacities that the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b2f1b2fa-f35c-407c-979c-a858a808ba85",
|                                               "Value":  "Workspace.Read.All",
|                                               "DisplayName":  "View all workspaces",
|                                               "Description":  "The app can view all workspaces that the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "445002fb-a6f2-4dc1-a81e-4254a111cd29",
|                                               "Value":  "Workspace.ReadWrite.All",
|                                               "DisplayName":  "Read and write all workspaces",
|                                               "Description":  "The app can view and edit all workspaces that the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d2e42f6b-2baf-4ff4-83ef-51e66321516e",
|                                               "Value":  "Gateway.Read.All",
|                                               "DisplayName":  "View all gateways",
|                                               "Description":  "The app can view all gateways that the signed in user is an admin of."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ddb3ca45-a192-477d-acb2-46bf9dc586de",
|                                               "Value":  "Gateway.ReadWrite.All",
|                                               "DisplayName":  "Read and write all gateways",
|                                               "Description":  "The app can view and edit all gateways that the signed in user is an admin of."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d594897b-76e7-4b2b-984b-b4adff35e109",
|                                               "Value":  "Tenant.ReadWrite.All",
|                                               "DisplayName":  "Read and write all content in tenant",
|                                               "Description":  "The app can create, edit, view, and delete all content in the tenant if the signed in user is in the Global administrator or Power BI service administrator role."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "f3076109-ca66-412a-be10-d4ee1be95d47",
|                                               "Value":  "Content.Create",
|                                               "DisplayName":  "Create content",
|                                               "Description":  "App can automatically create content and datasets for a user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "322b68b2-0804-416e-86a5-d772c567b6e6",
|                                               "Value":  "Dataset.ReadWrite.All",
|                                               "DisplayName":  "Read and write all datasets",
|                                               "Description":  "The app can view and write to all datasets for the signed in user and any datasets that the user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7f33e027-4039-419b-938e-2f8ca153e68e",
|                                               "Value":  "Dataset.Read.All",
|                                               "DisplayName":  "View all datasets",
|                                               "Description":  "The app can view all datasets for the signed in user and any datasets that the user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "01944dba-21df-426f-bb8c-796488be96ad",
|                                               "Value":  "Tenant.Read.All",
|                                               "DisplayName":  "View all content in tenant",
|                                               "Description":  "The app can view all content in the tenant if the signed in user is in the Global administrator or Power BI service administrator role."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "8b01a991-5a5a-47f8-91a2-84d6bfd72c02",
|                                               "Value":  "App.Read.All",
|                                               "DisplayName":  "View all Power BI apps",
|                                               "Description":  "The app can view all Power BI apps the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "27789c5b-aca8-4cb6-94b8-bcc8964dd8ad",
|                                               "Value":  "StorageAccount.ReadWrite.All",
|                                               "DisplayName":  "Read and write all storage accounts",
|                                               "Description":  "The app can view and edit all storage accounts registered with Power BI that the signed in user is an admin of."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e677843f-76d8-44d3-bcdb-ec40dea919e7",
|                                               "Value":  "StorageAccount.Read.All",
|                                               "DisplayName":  "View all storage accounts",
|                                               "Description":  "The app can view all storage accounts registered with Power BI that the signed in user is an admin of."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "dbe6434c-63f0-42bb-be8e-122ec1bad4d2",
|                                               "Value":  "Pipeline.Read.All",
|                                               "DisplayName":  "View all pipelines",
|                                               "Description":  "The app can view all deployment pipelines that the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "199f155b-cccd-4be4-bbe6-ca9a867b24b4",
|                                               "Value":  "Pipeline.ReadWrite.All",
|                                               "DisplayName":  "Read and write all pipelines",
|                                               "Description":  "The app can view and edit all deployment pipelines that the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "652d7d02-6ff0-4cf7-9516-cf77d33a3ae4",
|                                               "Value":  "Pipeline.Deploy",
|                                               "DisplayName":  "Deploy in all pipelines",
|                                               "Description":  "The app can deploy content in all pipelines and pipeline stages in deployment pipelines, which the signed in user has access to."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7a27a256-301d-4359-b77b-c2b759d2e362",
|                                               "Value":  "Item.ReadWrite.All",
|                                               "DisplayName":  "Make API calls that require read and write permissions on all Fabric items",
|                                               "Description":  "Allows the app to make API calls that require read and write permissions on all Fabric items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "d2bc95fc-440e-4b0e-bafd-97182de7aef5",
|                                               "Value":  "Item.Read.All",
|                                               "DisplayName":  "Make API calls that require read permissions on all Fabric items",
|                                               "Description":  "Allows the app to make API calls that require read permissions on all Fabric items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "caf40b1a-f10e-4da1-86e4-5fda17eb2b07",
|                                               "Value":  "Item.Execute.All",
|                                               "DisplayName":  "Make API calls that require execute permissions on all Fabric items",
|                                               "Description":  "Allows the app to make API calls that require execute permissions on all Fabric items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "753e9303-2fd9-496e-aa7c-cf84a133f42a",
|                                               "Value":  "KQLDataConnection.ReadWrite.All",
|                                               "DisplayName":  "Make API calls that require read and write permissions on and write all KQL data connections",
|                                               "Description":  "Allows the app to make API calls that require read and write permissions on all KQL data connections, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e0c0aef0-3eab-49ca-9662-50cc7bd13bfb",
|                                               "Value":  "DataPipeline.ReadWrite.All",
|                                               "DisplayName":  "Make API calls that require read and write permissions on all data pipelines",
|                                               "Description":  "Allows the app to make API calls that require read and write permissions on all data pipelines, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "7e010a28-f5fa-4e63-b03d-2dc25cba9d2e",
|                                               "Value":  "DataPipeline.Execute.All",
|                                               "DisplayName":  "Make API calls that require execute permissions all data pipelines",
|                                               "Description":  "Allows the app to make API calls that require execute permissions on all data pipelines, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "59b5791b-482f-4b95-8498-fe078f6bd6fa",
|                                               "Value":  "KQLDataConnection.Read.All",
|                                               "DisplayName":  "Make API calls that require read permissions on all KQL data connections",
|                                               "Description":  "Allows the app to make API calls that require read permissions on all KQL data connections, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a61cf2d1-8b81-4518-b2bb-a24e0831c17a",
|                                               "Value":  "DataPipeline.Read.All",
|                                               "DisplayName":  "Make API calls that require read permissions on all data pipelines",
|                                               "Description":  "Allows the app to make API calls that require read permissions on all data pipelines, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a74298d9-12f6-45f5-808d-7907af21179c",
|                                               "Value":  "Scorecard.Read.All",
|                                               "DisplayName":  "Make API calls that require read permissions on all scorecards",
|                                               "Description":  "Allows the app to make API calls that require read permissions on all scorecards, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "02e8d710-956c-4760-b996-2e83935c2cf5",
|                                               "Value":  "Item.Reshare.All",
|                                               "DisplayName":  "Make API calls that require reshare permissions on all Fabric items",
|                                               "Description":  "Allows the app to make API calls that require reshare permissions on all Fabric items, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b23bb8c4-af74-49b0-91dd-79ffb83cddb9",
|                                               "Value":  "DevX.ReadWrite.All",
|                                               "DisplayName":  "Create and Manage Developer Experience functionality",
|                                               "Description":  "Allows the app to make API calls to register and manage 3rd party Service Fabric workloads, on your behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "a55d4405-a37a-4d41-ad6e-745665a3bbcb",
|                                               "Value":  "Workspace.GitCommit.All",
|                                               "DisplayName":  "Make API calls that commit workspace content and setting to remote git repository.",
|                                               "Description":  "Allows the app to make API calls that commit workspace content and setting to remote git repository, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "5809ab1d-9154-49e7-a105-d82760eac8cf",
|                                               "Value":  "Workspace.GitUpdate.All",
|                                               "DisplayName":  "Make API calls that update workspace content and setting from remote git repository.",
|                                               "Description":  "Allows the app to make API calls that update workspace content and setting from remote git repository, on behalf of the signed-in user."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "547211ef-7223-404f-8519-fee52fda6402",
|                                               "Value":  "OneLake.Read.All",
|                                               "DisplayName":  "Make API calls that read OneLake metadata",
|                                               "Description":  "Allows the app to make API calls that read OneLake metadata on your behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Power BI Service",
|                                               "AppId":  "00000009-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "ada1b44b-4474-40ed-b32c-e3543dccec0e",
|                                               "Value":  "OneLake.ReadWrite.All",
|                                               "DisplayName":  "Make API calls that read and write OneLake metadata",
|                                               "Description":  "Allows the app to make API calls that read and write OneLake metadata, on your behalf."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Management APIs",
|                                               "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e2cea78f-e743-4d8f-a16a-75b629a038ae",
|                                               "Value":  "ServiceHealth.Read",
|                                               "DisplayName":  "Read service health information for your organization",
|                                               "Description":  "Allows the application to read service health information for your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Management APIs",
|                                               "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                               "PermissionType":  "Application",
|                                               "Id":  "594c1fb6-4f81-4475-ae41-0c394909246c",
|                                               "Value":  "ActivityFeed.Read",
|                                               "DisplayName":  "Read activity data for your organization",
|                                               "Description":  "Allows the application to read activity data for your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Management APIs",
|                                               "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                               "PermissionType":  "Application",
|                                               "Id":  "4807a72c-ad38-4250-94c9-4eabfe26cd55",
|                                               "Value":  "ActivityFeed.ReadDlp",
|                                               "DisplayName":  "Read DLP policy events including detected sensitive data",
|                                               "Description":  "Allows the application to read DLP policy events, including detected sensitive data, for your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Management APIs",
|                                               "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "e2cea78f-e743-4d8f-a16a-75b629a038ae",
|                                               "Value":  "ServiceHealth.Read",
|                                               "DisplayName":  "Read service health information for your organization",
|                                               "Description":  "Allows the application to read service health information for your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Management APIs",
|                                               "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "594c1fb6-4f81-4475-ae41-0c394909246c",
|                                               "Value":  "ActivityFeed.Read",
|                                               "DisplayName":  "Read activity data for your organization",
|                                               "Description":  "Allows the application to read activity data for your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Management APIs",
|                                               "AppId":  "c5393580-f805-4401-95e8-94b7a6ef2fc2",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4807a72c-ad38-4250-94c9-4eabfe26cd55",
|                                               "Value":  "ActivityFeed.ReadDlp",
|                                               "DisplayName":  "Read DLP policy events including detected sensitive data",
|                                               "Description":  "Allows the application to read DLP policy events, including detected sensitive data, for your organization."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Rights Management Services",
|                                               "AppId":  "00000012-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e23bd57d-bfd5-4906-867f-89fb5ed8cd43",
|                                               "Value":  "Application.Read.All",
|                                               "DisplayName":  "Read all service configuration and log data for the Azure Information Protection service.",
|                                               "Description":  "Allows the application to get or read all service configuration and log data"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Rights Management Services",
|                                               "AppId":  "00000012-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "006e763d-a822-41fc-8df5-8d3d7fe20022",
|                                               "Value":  "Content.Writer",
|                                               "DisplayName":  "Create protected content",
|                                               "Description":  "Create protected content"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Rights Management Services",
|                                               "AppId":  "00000012-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7347eb49-7a1a-43c5-8eac-a5cd1d1c7cf0",
|                                               "Value":  "Content.SuperUser",
|                                               "DisplayName":  "Read all protected content for this tenant",
|                                               "Description":  "Read all protected content for this tenant"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Rights Management Services",
|                                               "AppId":  "00000012-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7f740376-647b-4ad7-9ff7-292af252707a",
|                                               "Value":  "Content.DelegatedReader",
|                                               "DisplayName":  "Read protected content on behalf of a user",
|                                               "Description":  "Read protected content on behalf of a user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Rights Management Services",
|                                               "AppId":  "00000012-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d13f921c-7f21-4c08-bade-db9d048bd0da",
|                                               "Value":  "Content.DelegatedWriter",
|                                               "DisplayName":  "Create protected content on behalf of a user",
|                                               "Description":  "Create protected content on behalf of a user"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Microsoft Rights Management Services",
|                                               "AppId":  "00000012-0000-0000-c000-000000000000",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "c9c9a04d-3b66-4ca8-a00c-fca953e2afd3",
|                                               "Value":  "user_impersonation",
|                                               "DisplayName":  "Create and access protected content for users",
|                                               "Description":  "Allow the application to use Azure Rights Management"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cfbd1345-3cf0-408c-8c99-1491bde7ce52",
|                                               "Value":  "EopDataInsights.AccessAsApp",
|                                               "DisplayName":  "EopDataInsights.AccessAsApp",
|                                               "Description":  "EopDataInsights.AccessAsApp"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "26872368-3756-4995-a1d0-73cfa9d8f83a",
|                                               "Value":  "M365ContentExplorer.Read.All",
|                                               "DisplayName":  "M365ContentExplorer.Read.All",
|                                               "Description":  "M365ContentExplorer.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "06ab0d31-7112-476e-a479-66394bec63d6",
|                                               "Value":  "MessageTrace.Read.All",
|                                               "DisplayName":  "MessageTrace.Read.All",
|                                               "Description":  "MessageTrace.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "3e4e080e-55db-4fa9-8d68-0d9199d4c792",
|                                               "Value":  "QuarantinedMessage.Read.All",
|                                               "DisplayName":  "QuarantinedMessage.Read.All",
|                                               "Description":  "QuarantinedMessage.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cc02f7ae-3d9b-42c9-bc91-3424d92c5547",
|                                               "Value":  "AirAdminAction.tenant.read",
|                                               "DisplayName":  "AirAdminAction.tenant.read",
|                                               "Description":  "This allows the app to read AirAdminAction alerts"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "43f2aa58-36d7-421e-8628-fbe9b129bf76",
|                                               "Value":  "AirAdminAction.tenant.write",
|                                               "DisplayName":  "AirAdminAction.tenant.write",
|                                               "Description":  "This allows apps to write the AirAdminAction alerts"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "27787a44-0423-4f0d-a417-1276c93397fb",
|                                               "Value":  "TenantLicenseStatus.Read.All",
|                                               "DisplayName":  "TenantLicenseStatus.Read.All",
|                                               "Description":  "TenantLicenseStatus.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "092afc53-fa1b-44c3-9fdf-46fcd25a5d99",
|                                               "Value":  "Relocation.ReadWrite.All",
|                                               "DisplayName":  "Relocation.ReadWrite.All",
|                                               "Description":  "Relocation.ReadWrite.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "926c05c5-5941-491b-973a-509c2a4a2542",
|                                               "Value":  "AzureActivityData.Read.All",
|                                               "DisplayName":  "AzureActivityData.Read.All",
|                                               "Description":  "AzureActivityData.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "a585dd3a-70b6-4ff4-a1b9-093b4214e7e4",
|                                               "Value":  "OcrBillingConfiguration-Internal.Write.All",
|                                               "DisplayName":  "OcrBillingConfiguration-Internal.Write.All",
|                                               "Description":  "OcrBillingConfiguration-Internal.Write.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9760b448-d4d4-478b-bebc-0ebe62c935c9",
|                                               "Value":  "AuditProvisioningData.Tenant.Read",
|                                               "DisplayName":  "AuditProvisioningData.Tenant.Read",
|                                               "Description":  "AuditProvisioningData.Tenant.Read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "67a4e76f-5125-4b64-bcd6-b42a60d47dbe",
|                                               "Value":  "Purview.DataAccess.All",
|                                               "DisplayName":  "Purview.DataAccess.All",
|                                               "Description":  "Purview.DataAccess.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "43e3dfa5-222e-4a48-8253-d36086c5558c",
|                                               "Value":  "Alert.Read.All",
|                                               "DisplayName":  "Alert.Read.All",
|                                               "Description":  "Alert.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5f124282-d2c3-47dd-87ff-106ba9aa079b",
|                                               "Value":  "MtpMailboxRuleAction.tenant.write",
|                                               "DisplayName":  "MtpMailboxRuleAction.tenant.write",
|                                               "Description":  "MtpMailboxRuleAction.tenant.write"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ca69fdfa-5ba6-4c33-9eac-013653c2c3af",
|                                               "Value":  "MtpMailboxRuleAction.tenant.read",
|                                               "DisplayName":  "MtpMailboxRuleAction.tenant.read",
|                                               "Description":  "MtpMailboxRuleAction.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "182f95e9-8c6f-4c32-8de2-e1abc1fe6ea4",
|                                               "Value":  "DataInsightsSubscription.tenant.write",
|                                               "DisplayName":  "DataInsightsSubscription.tenant.write",
|                                               "Description":  "DataInsightsSubscription.tenant.write"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "bfeb98e9-5067-42b0-a7df-9022b927a10e",
|                                               "Value":  "DataInsightsSubscription.tenant.read",
|                                               "DisplayName":  "DataInsightsSubscription.tenant.read",
|                                               "Description":  "DataInsightsSubscription.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "59c90462-e42e-4698-8a51-196ebd407166",
|                                               "Value":  "compliancestatus.tenant.read",
|                                               "DisplayName":  "compliancestatus.tenant.read",
|                                               "Description":  "compliancestatus.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "39de55cd-e81d-4d2a-880d-3872c4fb992d",
|                                               "Value":  "RecipientBatch.tenant.write",
|                                               "DisplayName":  "RecipientBatch.tenant.write",
|                                               "Description":  "RecipientBatch.tenant.write"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "0eabd45c-e771-460d-a601-2d534e78a1be",
|                                               "Value":  "DataInsightsUsersData.tenant.read",
|                                               "DisplayName":  "DataInsightsUsersData.tenant.read",
|                                               "Description":  "DataInsightsUsersData.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e0ff780c-d4f4-4ef4-b0ad-b19863ca72a2",
|                                               "Value":  "UsersAggregateByAttackSimulation.tenant.read",
|                                               "DisplayName":  "UsersAggregateByAttackSimulation.tenant.read",
|                                               "Description":  "UsersAggregateByAttackSimulation.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "81eac90b-5b5b-422f-8d2a-9bc2055c5453",
|                                               "Value":  "Recipient.tenant.read",
|                                               "DisplayName":  "Recipient.tenant.read",
|                                               "Description":  "Recipient.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "7b67f132-5c43-45cb-8cc3-e78fd80d0776",
|                                               "Value":  "Recipient.tenant.write",
|                                               "DisplayName":  "Recipient.tenant.write",
|                                               "Description":  "Recipient.tenant.write"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "06c43929-37aa-4707-ae05-68d6d967953e",
|                                               "Value":  "AttackSimulationData.tenant.read",
|                                               "DisplayName":  "AttackSimulationData.tenant.read",
|                                               "Description":  "AttackSimulationData.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "38b568f3-92e4-4c17-92b7-a49c28904247",
|                                               "Value":  "TiRemediation.ReadWrite.All",
|                                               "DisplayName":  "TiRemediation.ReadWrite.All",
|                                               "Description":  "TiRemediation.ReadWrite.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "5c6799ba-41c0-49cc-9f2d-7486a52d52a0",
|                                               "Value":  "TiRemediation.Read.All",
|                                               "DisplayName":  "TiRemediation.Read.All",
|                                               "Description":  "TiRemediation.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "dac43cb8-9b13-43b1-bc17-e7eb8fe26717",
|                                               "Value":  "RemediationEmailResult.ReadWrite.All",
|                                               "DisplayName":  "RemediationEmailResult.ReadWrite.All",
|                                               "Description":  "RemediationEmailResult.ReadWrite.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "cae0e51f-af85-4f35-870d-9f024147648d",
|                                               "Value":  "RemediationEmailResult.Read.All",
|                                               "DisplayName":  "RemediationEmailResult.Read.All",
|                                               "Description":  "RemediationEmailResult.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "ba4ca83c-e834-4e66-bfe1-df738f63b557",
|                                               "Value":  "activitydata.tenant.read",
|                                               "DisplayName":  "activitydata.tenant.read",
|                                               "Description":  "activitydata.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "57fee0bb-e97d-4e5c-a663-2b0c7ce0db37",
|                                               "Value":  "InsiderRiskData.Read.All",
|                                               "DisplayName":  "InsiderRiskData.Read.All",
|                                               "Description":  "InsiderRiskData.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f9d2daf6-8028-48d1-b4c1-b963f7ae7a73",
|                                               "Value":  "AggConsumptionBillingReport.Read.All",
|                                               "DisplayName":  "AggConsumptionBillingReport.Read.All",
|                                               "Description":  "AggConsumptionBillingReport.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "15188c9e-7879-4e83-9d63-c728da8feb0d",
|                                               "Value":  "DynamicRiskPreventionTag.Tenant.Write",
|                                               "DisplayName":  "DynamicRiskPreventionTag.Tenant.Write",
|                                               "Description":  "DynamicRiskPreventionTag.Tenant.Write"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "f63db487-96bf-49af-8a79-faa86287aee6",
|                                               "Value":  "DynamicRiskPreventionTag.Tenant.Read",
|                                               "DisplayName":  "DynamicRiskPreventionTag.Tenant.Read",
|                                               "Description":  "DynamicRiskPreventionTag.Tenant.Read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "944c8d5a-fdcd-4aac-af4d-3366942700d5",
|                                               "Value":  "ThreatSubmission.ReadWrite.All",
|                                               "DisplayName":  "ThreatSubmission.ReadWrite.All",
|                                               "Description":  "ThreatSubmission.ReadWrite.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e0ba9b2a-a247-4d95-bca6-43211b61057f",
|                                               "Value":  "CustomTag.Tenant.Read",
|                                               "DisplayName":  "CustomTag.Tenant.Read",
|                                               "Description":  "CustomTag.Tenant.Read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "92b5621e-0e43-46c9-b830-bc26b325a150",
|                                               "Value":  "CustomTag.Tenant.Write",
|                                               "DisplayName":  "CustomTag.Tenant.Write",
|                                               "Description":  "CustomTag.Tenant.Write"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "85e837d7-9e4b-4bb2-9535-08bb51aa974a",
|                                               "Value":  "MessageTraceDetail.tenant.read",
|                                               "DisplayName":  "MessageTraceDetail.tenant.read",
|                                               "Description":  "MessageTraceDetail.tenant.read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "03f3ead7-60e6-4522-847b-8a67bb9c50df",
|                                               "Value":  "OneCyberRelocationData.tenant.write",
|                                               "DisplayName":  "OneCyberRelocationData.tenant.write",
|                                               "Description":  "This allows apps to write the OneCyberRelocationData"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "9b31c028-bb6a-4d1a-8295-4514d184c061",
|                                               "Value":  "OneCyberRelocationData.tenant.read",
|                                               "DisplayName":  "OneCyberRelocationData.tenant.read",
|                                               "Description":  "This allows apps to read the OneCyberRelocationData"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "86e9643d-f798-40d2-98bb-293a7daaa2d7",
|                                               "Value":  "MtpAction.tenant.read",
|                                               "DisplayName":  "MtpAction.tenant.read",
|                                               "Description":  "This allows apps to read the MtpAction"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "e6e79fef-f4ee-4f93-aec3-3f0001087066",
|                                               "Value":  "MtpAction.tenant.write",
|                                               "DisplayName":  "MtpAction.tenant.write",
|                                               "Description":  "This allows apps to write the MtpAction"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "723c28f9-60b9-4cd4-8b04-6d344a3c4d84",
|                                               "Value":  "alert.tenant.write",
|                                               "DisplayName":  "alert.tenant.write",
|                                               "Description":  "This allows to change any Office 365 alerts belong to the tenant."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "d91202fb-0f5f-4245-8148-dfe12af913e6",
|                                               "Value":  "alert.tenant.read",
|                                               "DisplayName":  "alert.tenant.read",
|                                               "Description":  "This allows to read tenant Office 365 alerts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "74450f94-a5b1-4243-a991-9a688375883f",
|                                               "Value":  "mtpstatus.tenant.read",
|                                               "DisplayName":  "mtpstatus.tenant.read",
|                                               "Description":  "Allow o365 applications to read MTP Status"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "51aa070e-cc8b-45a9-8530-3fc96b0aa701",
|                                               "Value":  "messageeventsummary.tenant.read",
|                                               "DisplayName":  "messageeventsummary.tenant.read",
|                                               "Description":  "This scope allows Apps to read tenant\u0027s MessageEventSummary data"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "24c052b7-e297-4369-b344-e4b62baa3fca",
|                                               "Value":  "reducedrecipient.read.all",
|                                               "DisplayName":  "reducedrecipient.read.all",
|                                               "Description":  "this allows to read reducedrecipient"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "abe60d99-0a67-4250-afc0-290614d84b41",
|                                               "Value":  "RoleGroupMember.tenant.write",
|                                               "DisplayName":  "RoleGroupMember.tenant.write",
|                                               "Description":  "This allows to change RoleGroupMember to the tenant"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Application",
|                                               "Id":  "6c68db0a-4608-48d3-b0bf-4d0917b88bef",
|                                               "Value":  "PolicyStatusSummary-Internal.Write.All",
|                                               "DisplayName":  "PolicyStatusSummary-Internal.Write.All",
|                                               "Description":  "PolicyStatusSummary-Internal.Write.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b80e6cec-e423-411f-8c98-7fe5a25ca7cf",
|                                               "Value":  "M365ContentExplorer.Read.All",
|                                               "DisplayName":  "M365ContentExplorer.Read.All",
|                                               "Description":  "This allows user to read M365ContentExplorer"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "739f66f6-655e-48e4-b5bd-2bbeb6077954",
|                                               "Value":  "Purview.DataAccess.All",
|                                               "DisplayName":  "Purview.DataAccess.All",
|                                               "Description":  "Purview.DataAccess.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "384a8502-84c5-41d9-a875-7834b77c8005",
|                                               "Value":  "RbacAccessCheck.read",
|                                               "DisplayName":  "RbacAccessCheck.read",
|                                               "Description":  "This Allows User to read the Rbac Roles"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6f44fc23-ea08-4666-8329-85597e11bdcd",
|                                               "Value":  "mtproleinfo.read",
|                                               "DisplayName":  "mtproleinfo.read",
|                                               "Description":  "This allows user to read MtpRoleInfo"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "6b300195-82d7-4a39-a7bc-0510371998cc",
|                                               "Value":  "alert.read",
|                                               "DisplayName":  "alert.read",
|                                               "Description":  "This allows user to read Office 365 alerts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "bcc2bc0d-d08c-412a-b24d-f6f78d714bdc",
|                                               "Value":  "alert.write",
|                                               "DisplayName":  "alert.write",
|                                               "Description":  "This allows user to change Office 365 alerts."
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "edfd2d1c-b4b5-4b83-b5e8-c38594e49c26",
|                                               "Value":  "RbacTenantStatus.Read",
|                                               "DisplayName":  "RbacTenantStatus.Read",
|                                               "Description":  "RbacTenantStatus.Read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "4e26c42d-fab0-4daa-9ea6-d860a28aa7d0",
|                                               "Value":  "RbacTenantStatus.Write",
|                                               "DisplayName":  "RbacTenantStatus.Write",
|                                               "Description":  "RbacTenantStatus.Write"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "06ab0d31-7112-476e-a479-66394bec63d6",
|                                               "Value":  "MessageTrace.Read.All",
|                                               "DisplayName":  "MessageTrace.Read.All",
|                                               "Description":  "MessageTrace.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "3e4e080e-55db-4fa9-8d68-0d9199d4c792",
|                                               "Value":  "QuarantinedMessage.Read.All",
|                                               "DisplayName":  "QuarantinedMessage.Read.All",
|                                               "Description":  "QuarantinedMessage.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "cc02f7ae-3d9b-42c9-bc91-3424d92c5547",
|                                               "Value":  "AirAdminAction.tenant.read",
|                                               "DisplayName":  "AirAdminAction.tenant.read",
|                                               "Description":  "This allows the app to read AirAdminAction alerts"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "43f2aa58-36d7-421e-8628-fbe9b129bf76",
|                                               "Value":  "AirAdminAction.tenant.write",
|                                               "DisplayName":  "AirAdminAction.tenant.write",
|                                               "Description":  "This allows apps to write the AirAdminAction alerts"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "27787a44-0423-4f0d-a417-1276c93397fb",
|                                               "Value":  "TenantLicenseStatus.Read.All",
|                                               "DisplayName":  "TenantLicenseStatus.Read.All",
|                                               "Description":  "TenantLicenseStatus.Read.All"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "b87cb2cc-0570-4e76-9606-3528d5fb44e7",
|                                               "Value":  "AtpStandardPolicy.Tenant.Read",
|                                               "DisplayName":  "AtpStandardPolicy.Tenant.Read",
|                                               "Description":  "AtpStandardPolicy.Tenant.Read"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "9945d5be-d9cb-45d0-b347-3f827c0d374d",
|                                               "Value":  "AtpStandardPolicy.Tenant.Write",
|                                               "DisplayName":  "AtpStandardPolicy.Tenant.Write",
|                                               "Description":  "AtpStandardPolicy.Tenant.Write"
|                                           },
|                                           {
|                                               "ServicePrincipal":  "Office 365 Information Protection",
|                                               "AppId":  "2f3f02c9-5679-4a5c-a605-0de55b07d135",
|                                               "PermissionType":  "Delegated",
|                                               "Id":  "2da9421b-01d5-43ec-9c8e-b1bfa4a8b2bb",
|                                               "Value":  "LabelAnalyticsActivityData.Read.All",
|                                               "DisplayName":  "LabelAnalyticsActivityData.Read.All",
|                                               "Description":  "LabelAnalyticsActivityData.Read.All"
|                                           }
|                                       ],
|    "Azure_BuiltInRoles_Tier0":  [
|                                     {
|                                         "Id":  "8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
|                                         "Name":  "Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  0,
|                                         "Reason":  "Full access including ability to assign roles in Azure RBAC, enabling immediate full tenant compromise.",
|                                         "Actions":  [
|                                                         "*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "18d7d88d-d35e-4fb5-a5c3-7773c20a72d9",
|                                         "Name":  "User Access Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  0,
|                                         "Reason":  "Can manage user access to Azure resources including role assignments, enabling direct identity plane control.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.Authorization/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f58310d9-a9f6-439a-9e8d-f62e7b41a168",
|                                         "Name":  "Role Based Access Control Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  0,
|                                         "Reason":  "Can assign and delete role assignments, enabling immediate full control over Azure RBAC and tenant identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "*/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     }
|                                 ],
|    "Azure_BuiltInRoles_Tier1":  [
|                                     {
|                                         "Id":  "a7ffa36f-339b-4b5c-8bdf-e2c188b2c0eb",
|                                         "Name":  "Azure Kubernetes Service RBAC Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Access to secrets and ability to run pods as any ServiceAccount enables privilege escalation to cluster admin.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/managedClusters/apps/daemonsets/*",
|                                                             "Microsoft.ContainerService/managedClusters/apps/deployments/*",
|                                                             "Microsoft.ContainerService/managedClusters/apps/replicasets/*",
|                                                             "Microsoft.ContainerService/managedClusters/apps/statefulsets/*",
|                                                             "Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/*",
|                                                             "Microsoft.ContainerService/managedClusters/batch/cronjobs/*",
|                                                             "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/read",
|                                                             "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/write",
|                                                             "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/delete",
|                                                             "Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read",
|                                                             "Microsoft.ContainerService/managedClusters/batch/jobs/*",
|                                                             "Microsoft.ContainerService/managedClusters/configmaps/*",
|                                                             "Microsoft.ContainerService/managedClusters/endpoints/*",
|                                                             "Microsoft.ContainerService/managedClusters/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/managedClusters/events/*",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/daemonsets/*",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/deployments/*",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/ingresses/*",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/networkpolicies/*",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/replicasets/*",
|                                                             "Microsoft.ContainerService/managedClusters/limitranges/read",
|                                                             "Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read",
|                                                             "Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read",
|                                                             "Microsoft.ContainerService/managedClusters/namespaces/read",
|                                                             "Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/*",
|                                                             "Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/*",
|                                                             "Microsoft.ContainerService/managedClusters/persistentvolumeclaims/*",
|                                                             "Microsoft.ContainerService/managedClusters/pods/*",
|                                                             "Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/*",
|                                                             "Microsoft.ContainerService/managedClusters/replicationcontrollers/*",
|                                                             "Microsoft.ContainerService/managedClusters/resourcequotas/read",
|                                                             "Microsoft.ContainerService/managedClusters/secrets/*",
|                                                             "Microsoft.ContainerService/managedClusters/serviceaccounts/*",
|                                                             "Microsoft.ContainerService/managedClusters/services/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fb1c8493-542b-48eb-b624-b4c8fea62acd",
|                                         "Name":  "Security Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can manage security policies and alerts, enabling reliable escalation to identity plane control via policy manipulation.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Authorization/policyAssignments/*",
|                                                         "Microsoft.Authorization/policyDefinitions/*",
|                                                         "Microsoft.Authorization/policyExemptions/*",
|                                                         "Microsoft.Authorization/policySetDefinitions/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.operationalInsights/workspaces/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Security/*",
|                                                         "Microsoft.IoTSecurity/*",
|                                                         "Microsoft.IoTFirmwareDefense/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8b54135c-b56d-4d72-a534-26097cfdc8d8",
|                                         "Name":  "Key Vault Data Access Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can manage role assignments for Key Vault roles, enabling a reliable path to elevate privileges and control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.KeyVault/vaults/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "66f75aeb-eabe-4b70-9f1e-c350c4c9ad04",
|                                         "Name":  "Virtual Machine Data Access Administrator (preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can manage role assignments for VM Administrator and User Login roles, enabling a reliable privilege escalation path.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Compute/virtualMachines/*/read",
|                                                         "Microsoft.HybridCompute/machines/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0f641de8-0b88-4198-bdef-bd8b45ceba96",
|                                         "Name":  "Defender for Storage Scanner Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Includes roleAssignments write/delete permissions allowing potential role assignment escalation.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Security/defenderforstoragesettings/read",
|                                                         "Microsoft.Security/defenderforstoragesettings/write",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Security/datascanners/read",
|                                                         "Microsoft.Security/datascanners/write",
|                                                         "Microsoft.Security/dataScanners/delete",
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.EventGrid/topics/read",
|                                                         "Microsoft.EventGrid/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/eventSubscriptions/write",
|                                                         "Microsoft.EventGrid/eventSubscriptions/delete",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ef318e2a-8334-4a05-9e4a-295a196c6a6e",
|                                         "Name":  "Azure Red Hat OpenShift Federated Credential",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can create, update, and delete federated credentials on managed identities, enabling trust relationships that can be leveraged to escalate to tenant-wide access.",
|                                         "Actions":  [
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/read",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7e559ce2-48d7-4b27-9128-fa1b247f1308",
|                                         "Name":  "Managed Identity Federated Identity Credential Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can create, update, and delete federated identity credentials on managed identities, enabling privilege escalation via identity plane manipulation.",
|                                         "Actions":  [
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/read",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "eadc314b-1a2d-4efa-be10-5d325db5065e",
|                                         "Name":  "Azure AI Project Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can create and delete role assignments limited to Cognitive Service User role, enabling a reliable pivot to elevate privileges.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "Microsoft.CognitiveServices/accounts/*/read",
|                                                         "Microsoft.CognitiveServices/accounts/projects/*",
|                                                         "Microsoft.CognitiveServices/locations/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e47c6f54-e4a2-4754-9501-8e0985b135e1",
|                                         "Name":  "Azure AI Account Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Full access to manage AI projects and accounts including role assignments, enabling privilege escalation.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "Microsoft.CognitiveServices/*",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/providers/features/register/action",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/diagnosticSettings/*",
|                                                         "Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.Insights/metricdefinitions/read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4c6569b6-f23e-4295-9b90-bd4cc4ff3292",
|                                         "Name":  "DevCenter Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can manage DevCenter resources and role assignments for DevCenter roles, enabling privilege escalation.",
|                                         "Actions":  [
|                                                         "Microsoft.DevCenter/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7b7c71ed-33fa-4ed2-a91a-e56d5da260b5",
|                                         "Name":  "Azure IoT Operations Onboarding",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can write role assignments and manage deployments, enabling a reliable path to privilege escalation.",
|                                         "Actions":  [
|                                                         "Microsoft.IoTOperations/*",
|                                                         "Microsoft.DeviceRegistry/register/action",
|                                                         "Microsoft.DeviceRegistry/schemaRegistries/read",
|                                                         "Microsoft.DeviceRegistry/schemaRegistries/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Edge/sites/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0a7c2fa1-6f28-41a4-86b8-e74937c63222",
|                                         "Name":  "Tenant Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Can create and manage Entra ID tenants, including write permissions to directories and tenants, enabling near-direct path to tenant takeover.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureActiveDirectory/directories/write",
|                                                         "Microsoft.AzureActiveDirectory/directories/read",
|                                                         "Microsoft.AzureActiveDirectory/entraTenants/write",
|                                                         "Microsoft.AzureActiveDirectory/entraTenants/read",
|                                                         "Microsoft.AzureActiveDirectory/entraTenants/delete",
|                                                         "Microsoft.AzureActiveDirectory/register/action",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5a2ec2f1-2375-4950-9906-59ec1d979249",
|                                         "Name":  "Azure Resilience Management Drills Assets Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Has Microsoft.Authorization/roleAssignments/write allowing role assignment management, enabling a reliable path to elevate privileges.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/delete",
|                                                         "Microsoft.Automation/automationAccounts/read",
|                                                         "Microsoft.Automation/automationAccounts/write",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/delete",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/write",
|                                                         "Microsoft.Chaos/experiments/delete",
|                                                         "Microsoft.Chaos/experiments/read",
|                                                         "Microsoft.Chaos/experiments/write",
|                                                         "Microsoft.Chaos/locations/operationResults/read",
|                                                         "Microsoft.Chaos/locations/operationStatuses/read",
|                                                         "Microsoft.Chaos/workspaces/delete",
|                                                         "Microsoft.Chaos/workspaces/read",
|                                                         "Microsoft.Chaos/workspaces/write",
|                                                         "Microsoft.Chaos/workspaces/refreshRecommendations/action",
|                                                         "Microsoft.Chaos/workspaces/discoveredResources/read",
|                                                         "Microsoft.Chaos/workspaces/scenarios/delete",
|                                                         "Microsoft.Chaos/workspaces/scenarios/read",
|                                                         "Microsoft.Chaos/workspaces/scenarios/write",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/delete",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/read",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/write",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/cancel/action",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/execute/action",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/validate/action",
|                                                         "Microsoft.Chaos/workspaces/scenarios/runs/read",
|                                                         "Microsoft.Insights/dataCollectionEndpoints/read",
|                                                         "Microsoft.Insights/dataCollectionEndpoints/write",
|                                                         "Microsoft.Insights/dataCollectionRules/read",
|                                                         "Microsoft.Insights/dataCollectionRules/write",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedKeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/tables/read",
|                                                         "Microsoft.OperationalInsights/workspaces/tables/write",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.OperationalInsights/workspaces/write",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e4c7f620-39b8-4688-bba2-70dd82ef367b",
|                                         "Name":  "Azure Resilience Management Drills Target Resource Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  1,
|                                         "Reason":  "Includes Microsoft.Authorization/roleAssignments/write enabling role assignment management, a direct path to privilege escalation.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Chaos/locations/targetTypes/capabilityTypes/read",
|                                                         "Microsoft.Chaos/locations/targetTypes/read",
|                                                         "Microsoft.Chaos/targets/capabilities/delete",
|                                                         "Microsoft.Chaos/targets/capabilities/read",
|                                                         "Microsoft.Chaos/targets/capabilities/write",
|                                                         "Microsoft.Chaos/targets/delete",
|                                                         "Microsoft.Chaos/targets/read",
|                                                         "Microsoft.Chaos/targets/write",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/virtualNetworks/read ",
|                                                         "Microsoft.Sql/managedInstances/read",
|                                                         "Microsoft.Web/serverfarms/read",
|                                                         "Microsoft.Web/sites/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     }
|                                 ],
|    "Azure_BuiltInRoles_Tier2":  [
|                                     {
|                                         "Id":  "b24988ac-6180-42a0-ab88-20f7382dd24c",
|                                         "Name":  "Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full resource management but cannot assign roles or modify identity plane objects; no direct path to tenant takeover.",
|                                         "Actions":  [
|                                                         "*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.Authorization/*/Delete",
|                                                            "Microsoft.Authorization/*/Write",
|                                                            "Microsoft.Authorization/elevateAccess/Action",
|                                                            "Microsoft.Blueprint/blueprintAssignments/write",
|                                                            "Microsoft.Blueprint/blueprintAssignments/delete",
|                                                            "Microsoft.Compute/galleries/share/action",
|                                                            "Microsoft.Purview/consents/write",
|                                                            "Microsoft.Purview/consents/delete",
|                                                            "Microsoft.Resources/deploymentStacks/manageDenySetting/action",
|                                                            "Microsoft.Subscription/cancel/action",
|                                                            "Microsoft.Subscription/enable/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8d8d5a11-05d3-4bda-a417-a08778121c7c",
|                                         "Name":  "HDInsight Domain Services Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can modify domain services related to HDInsight but no direct identity plane control or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AAD/*/read",
|                                                         "Microsoft.AAD/domainServices/*/read",
|                                                         "Microsoft.AAD/domainServices/oucontainer/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f25e0fa2-a7c8-4377-a976-54943a77a395",
|                                         "Name":  "Key Vault Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can manage key vaults but not access secrets or modify identity plane controls directly.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.KeyVault/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.KeyVault/locations/deletedVaults/purge/action",
|                                                            "Microsoft.KeyVault/hsmPools/*",
|                                                            "Microsoft.KeyVault/managedHsms/*"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "92aaf0da-9dab-42b6-94a3-d43ce8d16293",
|                                         "Name":  "Log Analytics Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can modify monitoring settings and add VM extensions but no direct identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.ClassicCompute/virtualMachines/extensions/*",
|                                                         "Microsoft.ClassicStorage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Compute/virtualMachines/extensions/*",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/diagnosticSettings/*",
|                                                         "Microsoft.OperationalInsights/*",
|                                                         "Microsoft.OperationsManagement/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f1a07417-d97a-45cb-824c-7a7467783830",
|                                         "Name":  "Managed Identity Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can assign user-assigned managed identities but lacks permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/*/read",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e40ec5ca-96e0-45a2-b4ff-59039f2c2b59",
|                                         "Name":  "Managed Identity Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full CRUD on managed identities but no direct ability to assign roles or modify authentication policies.",
|                                         "Actions":  [
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/read",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/write",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/delete",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/revokeTokens/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d58bcaf-24a5-4b20-bdb6-eed9f69fbe4c",
|                                         "Name":  "Management Group Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can modify management groups but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Management/managementGroups/delete",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Management/managementGroups/subscriptions/delete",
|                                                         "Microsoft.Management/managementGroups/subscriptions/write",
|                                                         "Microsoft.Management/managementGroups/write",
|                                                         "Microsoft.Management/managementGroups/subscriptions/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c12c1c16-33a1-487b-954d-41c89c60f349",
|                                         "Name":  "Reader and Data Access",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Access to storage account keys enables data exfiltration but no direct identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Storage/storageAccounts/ListAccountSas/action",
|                                                         "Microsoft.Storage/storageAccounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "36243c78-bf99-498c-9df9-86d9f8d28608",
|                                         "Name":  "Resource Policy Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can create and modify resource policies but lacks direct permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.Authorization/policyassignments/*",
|                                                         "Microsoft.Authorization/policydefinitions/*",
|                                                         "Microsoft.Authorization/policyexemptions/*",
|                                                         "Microsoft.Authorization/policyenrollments/*",
|                                                         "Microsoft.Authorization/policysetdefinitions/*",
|                                                         "Microsoft.PolicyInsights/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "17d1049b-9a84-46fb-8f53-869881c3d3ab",
|                                         "Name":  "Storage Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can manage storage accounts including access to keys, enabling data exfiltration but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/diagnosticSettings/*",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "81a9662b-bebf-436f-a333-f67b29880f12",
|                                         "Name":  "Storage Account Key Operator Service Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can list and regenerate storage account keys, enabling data exfiltration but no direct identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                         "Microsoft.Storage/storageAccounts/regeneratekey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
|                                         "Name":  "Storage Blob Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to blob containers and data enabling data exfiltration but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b7e6dc6d-f1e8-4753-8033-0f276bb0955b",
|                                         "Name":  "Storage Blob Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to blob containers and data including POSIX ACL assignment but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/*",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
|                                         "Name":  "Storage Blob Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read access to blob containers and data enabling data exfiltration but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "974c5e8b-45b9-4653-ba55-5f855dd0fb88",
|                                         "Name":  "Storage Queue Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read, write, and delete access to storage queues enabling data exfiltration but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/queueServices/queues/delete",
|                                                         "Microsoft.Storage/storageAccounts/queueServices/queues/read",
|                                                         "Microsoft.Storage/storageAccounts/queueServices/queues/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/queueServices/queues/messages/delete",
|                                                             "Microsoft.Storage/storageAccounts/queueServices/queues/messages/read",
|                                                             "Microsoft.Storage/storageAccounts/queueServices/queues/messages/write",
|                                                             "Microsoft.Storage/storageAccounts/queueServices/queues/messages/process/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8a0f0c08-91a1-4084-bc3d-661d67233fed",
|                                         "Name":  "Storage Queue Data Message Processor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can peek, receive, and delete queue messages enabling data exfiltration but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/queueServices/queues/messages/read",
|                                                             "Microsoft.Storage/storageAccounts/queueServices/queues/messages/process/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c6a89b2d-59bc-44d0-9896-0f6e12d7b80a",
|                                         "Name":  "Storage Queue Data Message Sender",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can send queue messages but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/queueServices/queues/messages/add/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "19e7f393-937e-4f77-808e-94535e297925",
|                                         "Name":  "Storage Queue Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read access to storage queues and messages enabling data exfiltration but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/queueServices/queues/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/queueServices/queues/messages/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "090c5cfd-751d-490a-894a-3ce6f1109419",
|                                         "Name":  "Azure Service Bus Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to Service Bus data plane enables data exfiltration but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ServiceBus/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ServiceBus/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f526a384-b230-433a-b45c-95f59c4a2dec",
|                                         "Name":  "Azure Event Hubs Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to Event Hubs data plane enables data exfiltration but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.EventHub/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventHub/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a638d3c7-ab3a-418d-83e6-5f17a39d4fde",
|                                         "Name":  "Azure Event Hubs Data Receiver",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Receive access to Event Hubs data plane enables data exfiltration but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.EventHub/*/eventhubs/consumergroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventHub/*/receive/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2b629674-e913-4c01-ae53-ef4638d8f975",
|                                         "Name":  "Azure Event Hubs Data Sender",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Send access to Event Hubs data plane enables data manipulation but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.EventHub/*/eventhubs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventHub/*/send/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4f6d3b9b-027b-4f4c-9142-0e5a2a2247e0",
|                                         "Name":  "Azure Service Bus Data Receiver",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Receive access to Service Bus data plane enables data exfiltration but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ServiceBus/*/queues/read",
|                                                         "Microsoft.ServiceBus/*/topics/read",
|                                                         "Microsoft.ServiceBus/*/topics/subscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ServiceBus/*/receive/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "69a216fc-b8fb-44d8-bc22-1f3c2cd27a39",
|                                         "Name":  "Azure Service Bus Data Sender",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Send access to Service Bus data plane enables data manipulation but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ServiceBus/*/queues/read",
|                                                         "Microsoft.ServiceBus/*/topics/read",
|                                                         "Microsoft.ServiceBus/*/topics/subscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ServiceBus/*/send/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "aba4ae5f-2193-4029-9191-0cb91df5e314",
|                                         "Name":  "Storage File Data SMB Share Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read access to file shares enables data exfiltration but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb",
|                                         "Name":  "Storage File Data SMB Share Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read/write/delete access to file shares enables data manipulation but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "db58b8e5-c6ad-4a2a-8342-4190687cbf4a",
|                                         "Name":  "Storage Blob Delegator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can generate user delegation keys for SAS tokens enabling data access but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a7264617-510b-434b-a828-9731dc254ea7",
|                                         "Name":  "Storage File Data SMB Share Elevated Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access including NTFS permissions on file shares enables data manipulation but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5ae67dd6-50cb-40e7-96ff-dc2bfa4b606b",
|                                         "Name":  "App Configuration Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to App Configuration data enables data manipulation but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppConfiguration/configurationStores/*/read",
|                                                             "Microsoft.AppConfiguration/configurationStores/*/write",
|                                                             "Microsoft.AppConfiguration/configurationStores/*/delete",
|                                                             "Microsoft.AppConfiguration/configurationStores/*/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "516239f1-63e1-4d78-a4de-a74fb236a071",
|                                         "Name":  "App Configuration Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read access to App Configuration data enables data exfiltration but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppConfiguration/configurationStores/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d57506d4-4c8d-48b1-8587-93c323f6a5a3",
|                                         "Name":  "Azure Digital Twins Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read-only access to Digital Twins data plane; no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DigitalTwins/digitaltwins/read",
|                                                             "Microsoft.DigitalTwins/digitaltwins/relationships/read",
|                                                             "Microsoft.DigitalTwins/eventroutes/read",
|                                                             "Microsoft.DigitalTwins/jobs/import/read",
|                                                             "Microsoft.DigitalTwins/jobs/imports/read",
|                                                             "Microsoft.DigitalTwins/jobs/deletions/read",
|                                                             "Microsoft.DigitalTwins/models/read",
|                                                             "Microsoft.DigitalTwins/query/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bcd981a7-7f74-457b-83e1-cceb9e632ffe",
|                                         "Name":  "Azure Digital Twins Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to Digital Twins data plane; no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DigitalTwins/digitaltwins/*",
|                                                             "Microsoft.DigitalTwins/digitaltwins/commands/*",
|                                                             "Microsoft.DigitalTwins/digitaltwins/relationships/*",
|                                                             "Microsoft.DigitalTwins/eventroutes/*",
|                                                             "Microsoft.DigitalTwins/jobs/*",
|                                                             "Microsoft.DigitalTwins/models/*",
|                                                             "Microsoft.DigitalTwins/query/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5a1fc7df-4bf1-4951-a576-89034ee01acd",
|                                         "Name":  "FHIR Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to FHIR data enables significant data exfiltration but no direct identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/*",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3db33094-8700-4567-8da5-1501d4e7e843",
|                                         "Name":  "FHIR Data Exporter",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read and export FHIR data allows mass data exfiltration but no path to identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/export/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/export/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4c8d0bbc-75d3-4935-991f-5f3c56d81508",
|                                         "Name":  "FHIR Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read-only access to FHIR data enables data exfiltration but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3f88fce4-5892-4214-ae73-ba5294559913",
|                                         "Name":  "FHIR Data Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read and write access to FHIR data allows data manipulation but no direct identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/write",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/delete",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/export/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/resourceValidate/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/reindex/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/convertData/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/editProfileDefinitions/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/import/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/write",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/delete",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/export/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/resourceValidate/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/reindex/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/convertData/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/editProfileDefinitions/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/import/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4dd61c23-6743-42fe-a388-d8bdd41cb745",
|                                         "Name":  "Object Understanding Account Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Ingestion capabilities for Azure Object Understanding allow data manipulation but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/ObjectUnderstandingAccounts/ingest/action",
|                                                             "Microsoft.MixedReality/ObjectUnderstandingAccounts/ingest/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8f5e0ce6-4f7b-4dcf-bddf-e6f48634a204",
|                                         "Name":  "Azure Maps Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read, write, and delete access to map data enables data manipulation but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Maps/accounts/*/read",
|                                                             "Microsoft.Maps/accounts/*/write",
|                                                             "Microsoft.Maps/accounts/*/delete",
|                                                             "Microsoft.Maps/accounts/*/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c1ff6cc2-c111-46fe-8896-e0ef812ad9f3",
|                                         "Name":  "Cognitive Services Custom Vision Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full project access allows data and model manipulation but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5c4089e1-6d96-4d2f-b296-c1bc7137275f",
|                                         "Name":  "Cognitive Services Custom Vision Deployment",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Publish and export models but no ability to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/predictions/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/iterations/publish/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/iterations/export/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/quicktest/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/classify/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/detect/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "88424f51-ebe7-446f-bc41-7fa16989e96c",
|                                         "Name":  "Cognitive Services Custom Vision Labeler",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Modify training images and tags but no identity plane control or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/predictions/query/action",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/images/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/tags/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/images/suggested/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/tagsandregions/suggestions/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0a5ae4ab-0d65-4eeb-be61-29fc9b54394b",
|                                         "Name":  "Cognitive Services Custom Vision Trainer",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Train and publish models but no ability to escalate to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "00482a5a-887f-4fb3-b363-3b7fe8e74483",
|                                         "Name":  "Key Vault Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full data plane control over key vault contents but cannot manage role assignments or permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.KeyVault/checkNameAvailability/read",
|                                                         "Microsoft.KeyVault/deletedVaults/read",
|                                                         "Microsoft.KeyVault/locations/*/read",
|                                                         "Microsoft.KeyVault/vaults/*/read",
|                                                         "Microsoft.KeyVault/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "12338af0-0e69-4776-bea7-57ae8d297424",
|                                         "Name":  "Key Vault Crypto User",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Perform cryptographic operations but no ability to escalate privileges or modify roles.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/keys/read",
|                                                             "Microsoft.KeyVault/vaults/keys/update/action",
|                                                             "Microsoft.KeyVault/vaults/keys/backup/action",
|                                                             "Microsoft.KeyVault/vaults/keys/encrypt/action",
|                                                             "Microsoft.KeyVault/vaults/keys/decrypt/action",
|                                                             "Microsoft.KeyVault/vaults/keys/wrap/action",
|                                                             "Microsoft.KeyVault/vaults/keys/unwrap/action",
|                                                             "Microsoft.KeyVault/vaults/keys/sign/action",
|                                                             "Microsoft.KeyVault/vaults/keys/verify/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b86a8fe4-44ce-4948-aee5-eccb2c155cd7",
|                                         "Name":  "Key Vault Secrets Officer",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage secrets but cannot manage permissions or role assignments, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.KeyVault/checkNameAvailability/read",
|                                                         "Microsoft.KeyVault/deletedVaults/read",
|                                                         "Microsoft.KeyVault/locations/*/read",
|                                                         "Microsoft.KeyVault/vaults/*/read",
|                                                         "Microsoft.KeyVault/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/secrets/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4633458b-17de-408a-b874-0445c86b69e6",
|                                         "Name":  "Key Vault Secrets User",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read secret contents enables data exfiltration but no direct identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/secrets/getSecret/action",
|                                                             "Microsoft.KeyVault/vaults/secrets/readMetadata/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a4417e6f-fecd-4de8-b567-7b0420556985",
|                                         "Name":  "Key Vault Certificates Officer",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage certificates but no permission to modify roles or escalate privileges.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.KeyVault/checkNameAvailability/read",
|                                                         "Microsoft.KeyVault/deletedVaults/read",
|                                                         "Microsoft.KeyVault/locations/*/read",
|                                                         "Microsoft.KeyVault/vaults/*/read",
|                                                         "Microsoft.KeyVault/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/certificatecas/*",
|                                                             "Microsoft.KeyVault/vaults/certificates/*",
|                                                             "Microsoft.KeyVault/vaults/certificatecontacts/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e147488a-f6f5-4113-8e2d-b22465e65bf6",
|                                         "Name":  "Key Vault Crypto Service Encryption User",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Perform wrap/unwrap operations but no ability to escalate privileges or modify roles.",
|                                         "Actions":  [
|                                                         "Microsoft.EventGrid/eventSubscriptions/write",
|                                                         "Microsoft.EventGrid/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/eventSubscriptions/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/keys/read",
|                                                             "Microsoft.KeyVault/vaults/keys/wrap/action",
|                                                             "Microsoft.KeyVault/vaults/keys/unwrap/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "63f0a09d-1495-4db4-a681-037d84835eb4",
|                                         "Name":  "Azure Arc Kubernetes Viewer",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "View cluster resources except secrets, no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/deployments/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/replicasets/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/batch/jobs/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/configmaps/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/endpoints/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/events/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/deployments/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/limitranges/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/namespaces/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/pods/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/serviceaccounts/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/services/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5b999177-9696-4545-85c7-50de3797e5a1",
|                                         "Name":  "Azure Arc Kubernetes Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Update cluster resources except roles and bindings, no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/configmaps/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/endpoints/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/events/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/limitranges/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/namespaces/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/pods/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/secrets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/services/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8393591c-06b9-48a2-a542-1bd6b377f6a2",
|                                         "Name":  "Azure Arc Kubernetes Cluster Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage all cluster resources but no direct identity plane control or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Kubernetes/connectedClusters/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dffb1e0c-446f-4dde-a09f-99eb5cc68b96",
|                                         "Name":  "Azure Arc Kubernetes Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage cluster resources except quotas and namespaces, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/authorization.k8s.io/localsubjectaccessreviews/write",
|                                                             "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/configmaps/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/endpoints/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/events/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/limitranges/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/namespaces/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/pods/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/rolebindings/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/roles/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
|                                                             "Microsoft.Kubernetes/connectedClusters/secrets/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",
|                                                             "Microsoft.Kubernetes/connectedClusters/services/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b",
|                                         "Name":  "Azure Kubernetes Service RBAC Cluster Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage all cluster resources but no direct identity plane control or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/managedClusters/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3498e952-d568-435e-9b2c-8d77e338d7f7",
|                                         "Name":  "Azure Kubernetes Service RBAC Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage cluster resources except quotas and namespaces, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/managedClusters/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7f6c6a51-bcf8-42ba-9220-52d62157d7db",
|                                         "Name":  "Azure Kubernetes Service RBAC Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read-only access to most namespace objects, no access to roles or secrets, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/managedClusters/apps/daemonsets/read",
|                                                             "Microsoft.ContainerService/managedClusters/apps/deployments/read",
|                                                             "Microsoft.ContainerService/managedClusters/apps/replicasets/read",
|                                                             "Microsoft.ContainerService/managedClusters/apps/statefulsets/read",
|                                                             "Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/read",
|                                                             "Microsoft.ContainerService/managedClusters/batch/cronjobs/read",
|                                                             "Microsoft.ContainerService/managedClusters/batch/jobs/read",
|                                                             "Microsoft.ContainerService/managedClusters/configmaps/read",
|                                                             "Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read",
|                                                             "Microsoft.ContainerService/managedClusters/endpoints/read",
|                                                             "Microsoft.ContainerService/managedClusters/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/managedClusters/events/read",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/daemonsets/read",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/deployments/read",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/ingresses/read",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/networkpolicies/read",
|                                                             "Microsoft.ContainerService/managedClusters/extensions/replicasets/read",
|                                                             "Microsoft.ContainerService/managedClusters/limitranges/read",
|                                                             "Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read",
|                                                             "Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read",
|                                                             "Microsoft.ContainerService/managedClusters/namespaces/read",
|                                                             "Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/read",
|                                                             "Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/read",
|                                                             "Microsoft.ContainerService/managedClusters/persistentvolumeclaims/read",
|                                                             "Microsoft.ContainerService/managedClusters/pods/read",
|                                                             "Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/read",
|                                                             "Microsoft.ContainerService/managedClusters/replicationcontrollers/read",
|                                                             "Microsoft.ContainerService/managedClusters/resourcequotas/read",
|                                                             "Microsoft.ContainerService/managedClusters/serviceaccounts/read",
|                                                             "Microsoft.ContainerService/managedClusters/services/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fd53cd77-2268-407a-8f46-7e7863d0f521",
|                                         "Name":  "SignalR REST API Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to SignalR REST APIs allows data manipulation but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SignalRService/SignalR/auth/clientToken/action",
|                                                             "Microsoft.SignalRService/SignalR/hub/*",
|                                                             "Microsoft.SignalRService/SignalR/group/*",
|                                                             "Microsoft.SignalRService/SignalR/clientConnection/*",
|                                                             "Microsoft.SignalRService/SignalR/user/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "daa9e50b-21df-454c-94a6-a8050adab352",
|                                         "Name":  "Collaborative Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage data packages in collaborative environment but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.IndustryDataLifecycle/custodianCollaboratives/*/read",
|                                                         "Microsoft.IndustryDataLifecycle/memberCollaboratives/*/read",
|                                                         "Microsoft.IndustryDataLifecycle/locations/dataPackages/*",
|                                                         "Microsoft.IndustryDataLifecycle/custodianCollaboratives/receivedDataPackages/*",
|                                                         "Microsoft.IndustryDataLifecycle/custodianCollaboratives/rejectDataPackage/action",
|                                                         "Microsoft.IndustryDataLifecycle/memberCollaboratives/sharedDataPackages/*",
|                                                         "Microsoft.IndustryDataLifecycle/custodianCollaboratives/dataModels/*",
|                                                         "Microsoft.IndustryDataLifecycle/custodianCollaboratives/auditLogs/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "02ca0879-e8e4-47a5-a61e-5c618b76e64a",
|                                         "Name":  "Device Update Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management access to device update operations but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.DeviceUpdate/accounts/read",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/read",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/write",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/delete",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/management/read",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/management/write",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/management/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0378884a-3af5-44ab-8323-f5b22f9f3c98",
|                                         "Name":  "Device Update Content Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to content operations but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.DeviceUpdate/accounts/read",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/read",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/write",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cb43c632-a144-4ec5-977c-e80c4affc34a",
|                                         "Name":  "Cognitive Services Metrics Advisor Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to metrics project including system configuration but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/MetricsAdvisor/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5dffeca3-4936-4216-b2bc-10343a5abb25",
|                                         "Name":  "Schema Registry Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read, write, and delete schema registry groups and schemas but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.EventHub/namespaces/schemagroups/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventHub/namespaces/schemas/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8508508a-4469-4e45-963b-2518ee0bb728",
|                                         "Name":  "AgFood Platform Service Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Contribute access to AgFood Platform Service but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/*/action",
|                                                             "Microsoft.AgFoodPlatform/*/read",
|                                                             "Microsoft.AgFoodPlatform/*/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f8da80de-1ff9-4747-ad80-a19b7f6079e3",
|                                         "Name":  "AgFood Platform Service Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Admin access to AgFood Platform Service but no identity plane control or role assignment.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "18500a29-7fe2-46b2-a342-b16a415e101d",
|                                         "Name":  "Managed HSM contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage managed HSM pools but no access to keys or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.KeyVault/managedHSMs/*",
|                                                         "Microsoft.KeyVault/deletedManagedHsms/read",
|                                                         "Microsoft.KeyVault/locations/deletedManagedHsms/read",
|                                                         "Microsoft.KeyVault/locations/deletedManagedHsms/purge/action",
|                                                         "Microsoft.KeyVault/locations/managedHsmOperationResults/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7e4f1700-ea5a-4f59-8f37-079cfe29dce3",
|                                         "Name":  "SignalR Service Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to SignalR Service REST APIs but no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SignalRService/SignalR/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "635dd51f-9968-44d3-b7fb-6d9a6bd613ae",
|                                         "Name":  "AzureML Metrics Writer (preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Write metrics to AzureML workspace but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/metrics/*/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1",
|                                         "Name":  "Storage Account Backup Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Perform backup and restore on storage account but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Authorization/locks/read",
|                                                         "Microsoft.Authorization/locks/write",
|                                                         "Microsoft.Authorization/locks/delete",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/operations/read",
|                                                         "Microsoft.Storage/storageAccounts/objectReplicationPolicies/delete",
|                                                         "Microsoft.Storage/storageAccounts/objectReplicationPolicies/read",
|                                                         "Microsoft.Storage/storageAccounts/objectReplicationPolicies/write",
|                                                         "Microsoft.Storage/storageAccounts/objectReplicationPolicies/restorePointMarkers/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/write",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/restoreBlobRanges/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6188b7c9-7d01-4f99-a59f-c88b630326c0",
|                                         "Name":  "Experimentation Metric Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Create and write metrics but no identity plane control or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/read",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/metricwrite/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/metricwrite/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "00c29273-979b-4161-815c-10b084fb9324",
|                                         "Name":  "Backup Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can manage backup services but lacks direct identity plane control; potential for data impact.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/backup/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationsStatus/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/provisionInstantItemRecovery/action",
|                                                         "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/accessToken/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/restore/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/revokeInstantItemRecovery/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/write",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/refreshContainers/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupJobs/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupJobsExport/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupOperationResults/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectableItems/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectedItems/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectionContainers/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupUsageSummaries/read",
|                                                         "Microsoft.RecoveryServices/Vaults/certificates/write",
|                                                         "Microsoft.RecoveryServices/Vaults/extendedInformation/read",
|                                                         "Microsoft.RecoveryServices/Vaults/extendedInformation/write",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/read",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/*",
|                                                         "Microsoft.RecoveryServices/Vaults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/write",
|                                                         "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupstorageconfig/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupValidateOperation/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupTriggerValidateOperation/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupValidateOperationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupValidateOperationsStatuses/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupOperations/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/operations/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/write",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/inquire/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupEngines/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/write",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectableContainers/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/items/read",
|                                                         "Microsoft.RecoveryServices/locations/backupStatus/action",
|                                                         "Microsoft.RecoveryServices/locations/backupPreValidateProtection/action",
|                                                         "Microsoft.RecoveryServices/locations/backupValidateFeatures/action",
|                                                         "Microsoft.RecoveryServices/locations/backupAadProperties/read",
|                                                         "Microsoft.RecoveryServices/locations/backupCrrJobs/action",
|                                                         "Microsoft.RecoveryServices/locations/backupCrrJob/action",
|                                                         "Microsoft.RecoveryServices/locations/backupCrossRegionRestore/action",
|                                                         "Microsoft.RecoveryServices/locations/backupCrrOperationResults/read",
|                                                         "Microsoft.RecoveryServices/locations/backupCrrOperationsStatus/read",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/write",
|                                                         "Microsoft.RecoveryServices/operations/read",
|                                                         "Microsoft.RecoveryServices/locations/operationStatus/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/write",
|                                                         "Microsoft.DataProtection/backupVaults/deletedBackupInstances/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/action",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/backupVaults/operationResults/read",
|                                                         "Microsoft.DataProtection/backupVaults/operationStatus/read",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/locations/operationStatus/read",
|                                                         "Microsoft.DataProtection/locations/operationResults/read",
|                                                         "Microsoft.DataProtection/operations/read",
|                                                         "Microsoft.DataProtection/backupVaults/validateForBackup/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/backup/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/validateRestore/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/restore/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/crossRegionRestore/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/validateCrossRegionRestore/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJobs/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJob/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchSecondaryRecoveryPoints/action",
|                                                         "Microsoft.DataProtection/locations/checkFeatureSupport/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/delete",
|                                                         "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/unlockDelete/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/write",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/write",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/delete",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/unlockDelete/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/validateForModifyBackup/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "14b46e9e-c2b7-41b4-b07b-48a6ebf60603",
|                                         "Name":  "Key Vault Crypto Officer",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can perform cryptographic operations on keys but cannot manage permissions; no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.KeyVault/checkNameAvailability/read",
|                                                         "Microsoft.KeyVault/deletedVaults/read",
|                                                         "Microsoft.KeyVault/locations/*/read",
|                                                         "Microsoft.KeyVault/vaults/*/read",
|                                                         "Microsoft.KeyVault/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/keys/*",
|                                                             "Microsoft.KeyVault/vaults/keyrotationpolicies/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "76cc9ee4-d5d3-4a45-a930-26add3d73475",
|                                         "Name":  "Access Review Operator Service Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can delete role assignments related to access reviews; enables limited identity plane impact but not direct takeover.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "Microsoft.Management/getEntities/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2ccf8795-8983-4912-8036-1c45212c95e8",
|                                         "Name":  "ToolchainOrchestrator Admin Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Grants full management of Toolchain orchestrator resources but does not include identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ToolchainOrchestrator/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0847e196-2fd2-4c2f-a48c-fca6fd030f44",
|                                         "Name":  "HDInsight Cluster Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full control over HDInsight clusters but no direct identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/APPLICATIONS/DELETE",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/APPLICATIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/APPLICATIONS/WRITE",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/AZUREASYNCOPERATIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/CONFIGURATIONS/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/CONFIGURATIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/DELETE",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/EXECUTESCRIPTACTIONS/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/EXTENSIONS/DELETE",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/EXTENSIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/EXTENSIONS/WRITE",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/GETGATEWAYSETTINGS/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/LISTHOSTS/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/OPERATIONRESULTS/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/PRIVATEENDPOINTCONNECTIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/PRIVATELINKRESOURCES/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/RESOLVEPRIVATELINKSERVICEID/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/RESTARTHOSTS/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/ROLES/AUTOSCALE/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/ROLES/RESIZE/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/SCRIPTACTIONS/DELETE",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/SCRIPTACTIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/SCRIPTEXECUTIONHISTORY/PROMOTE/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/SCRIPTEXECUTIONHISTORY/READ",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/UPDATEGATEWAYSETTINGS/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/CLUSTERS/WRITE",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/AVAILABLECLUSTERVERSIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/AZUREASYNCOPERATIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/BILLINGSPECS/READ",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/CAPABILITIES/READ",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/CHECKNAMEAVAILABILITY/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/OPERATIONRESULTS/READ",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/OPERATIONSTATUSES/READ",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/OPERATIONSTATUSES/WRITE",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/USAGES/READ",
|                                                         "MICROSOFT.HDINSIGHT/LOCATIONS/VALIDATECREATEREQUEST/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/OPERATIONS/READ",
|                                                         "MICROSOFT.HDINSIGHT/REGISTER/ACTION",
|                                                         "MICROSOFT.HDINSIGHT/RESOURCETYPES/READ",
|                                                         "MICROSOFT.HDINSIGHT/UNREGISTER/ACTION",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d977122-f97e-4b4d-a52f-6b43003ddb4d",
|                                         "Name":  "Azure Container Instances Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of container groups but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerInstance/containerGroups/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8ad4d0ee-9bfb-49e8-93fc-01abb8db6240",
|                                         "Name":  "Transparency Logs Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of Transparency Log resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Sovereign/transparencyLogs/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "136d308c-0937-4a49-9bd7-edfb42adbffc",
|                                         "Name":  "Disk Encryption Set Operator for Managed Disks",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can manage disk encryption sets but lacks identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/diskEncryptionSets/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9295f069-25d0-4f44-bb6a-3da70d11aa00",
|                                         "Name":  "Azure Edge Hardware Center Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to edge order administration but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.EdgeOrder/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b78c5d69-af96-48a3-bf8d-a8b4d589de94",
|                                         "Name":  "Azure AI Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full control over Azure AI resources but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.CognitiveServices/*",
|                                                         "Microsoft.ContainerRegistry/registries/*",
|                                                         "Microsoft.DocumentDb/databaseAccounts/*",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/providers/features/register/action",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/components/*",
|                                                         "Microsoft.Insights/diagnosticSettings/*",
|                                                         "Microsoft.Insights/generateLiveToken/read",
|                                                         "Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.Insights/metricAlerts/*",
|                                                         "Microsoft.Insights/metricdefinitions/read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/scheduledqueryrules/*",
|                                                         "Microsoft.Insights/topology/read",
|                                                         "Microsoft.Insights/transactions/read",
|                                                         "Microsoft.Insights/webtests/*",
|                                                         "Microsoft.KeyVault/*",
|                                                         "Microsoft.MachineLearningServices/workspaces/*",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Storage/storageAccounts/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Search/searchServices/write",
|                                                         "Microsoft.Search/searchServices/read",
|                                                         "Microsoft.Search/searchServices/delete",
|                                                         "Microsoft.Search/searchServices/indexes/*",
|                                                         "Microsoft.Search/searchServices/listAdminKeys/action",
|                                                         "Microsoft.Search/searchServices/privateEndpointConnections/*",
|                                                         "Microsoft.DataFactory/factories/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "358470bc-b998-42bd-ab17-a7e34c199c0f",
|                                         "Name":  "Container Apps Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of Container Apps but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/containerApps/*/read",
|                                                         "Microsoft.App/containerApps/*/write",
|                                                         "Microsoft.App/containerApps/*/delete",
|                                                         "Microsoft.App/containerApps/*/action",
|                                                         "Microsoft.App/managedEnvironments/read",
|                                                         "Microsoft.App/managedEnvironments/*/read",
|                                                         "Microsoft.App/managedEnvironments/join/action",
|                                                         "Microsoft.App/managedEnvironments/checknameavailability/action",
|                                                         "Microsoft.App/connectedEnvironments/read",
|                                                         "Microsoft.App/connectedEnvironments/*/read",
|                                                         "Microsoft.App/connectedEnvironments/join/action",
|                                                         "Microsoft.App/connectedEnvironments/checknameavailability/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f7669afb-68b2-44b4-9c5f-6d2a47fddda0",
|                                         "Name":  "Container Apps SessionPools Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of Container Apps SessionPools but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/sessionPools/*/read",
|                                                         "Microsoft.App/sessionPools/*/write",
|                                                         "Microsoft.App/sessionPools/*/delete",
|                                                         "Microsoft.App/sessionPools/*/action",
|                                                         "microsoft.App/managedEnvironments/read",
|                                                         "Microsoft.App/managedEnvironments/*/read",
|                                                         "Microsoft.App/managedEnvironments/join/action",
|                                                         "Microsoft.App/managedEnvironments/checknameavailability/action",
|                                                         "microsoft.App/connectedEnvironments/read",
|                                                         "Microsoft.App/connectedEnvironments/*/read",
|                                                         "Microsoft.App/connectedEnvironments/join/action",
|                                                         "Microsoft.App/connectedEnvironments/checknameavailability/action",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.App/sessionPools/fetchMcpServerCredentials/action",
|                                                            "Microsoft.App/sessionPools/rotateMcpServerCredentials/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "57cc5028-e6a7-4284-868d-0611c5923f8d",
|                                         "Name":  "Container Apps ManagedEnvironments Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of Container Apps ManagedEnvironments but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/managedEnvironments/*/read",
|                                                         "Microsoft.App/managedEnvironments/*/write",
|                                                         "Microsoft.App/managedEnvironments/*/delete",
|                                                         "Microsoft.App/managedEnvironments/*/action",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4e3d2b60-56ae-4dc6-a233-09c8e5a82e68",
|                                         "Name":  "Container Apps Jobs Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of Container Apps jobs but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "microsoft.app/jobs/read",
|                                                         "Microsoft.App/jobs/*/read",
|                                                         "Microsoft.App/jobs/*/action",
|                                                         "Microsoft.App/jobs/write",
|                                                         "Microsoft.App/jobs/delete",
|                                                         "Microsoft.app/managedenvironments/read",
|                                                         "Microsoft.App/managedenvironments/*/read",
|                                                         "Microsoft.App/managedenvironments/join/action",
|                                                         "Microsoft.App/managedenvironments/checknameavailability/action",
|                                                         "Microsoft.app/connectedEnvironments/read",
|                                                         "Microsoft.App/connectedEnvironments/*/read",
|                                                         "Microsoft.App/connectedEnvironments/join/action",
|                                                         "Microsoft.App/connectedEnvironments/checknameavailability/action",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1a5682fc-4f12-4b25-927e-e8cfed0c539e",
|                                         "Name":  "KubernetesRuntime Load Balancer Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage load balancers in Kubernetes clusters but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.KubernetesRuntime/loadBalancers/read",
|                                                         "Microsoft.KubernetesRuntime/loadBalancers/write",
|                                                         "Microsoft.KubernetesRuntime/loadBalancers/delete",
|                                                         "Microsoft.KubernetesRuntime/bgpPeers/read",
|                                                         "Microsoft.KubernetesRuntime/bgpPeers/write",
|                                                         "Microsoft.KubernetesRuntime/bgpPeers/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.KubernetesRuntime/locations/operationStatuses/write",
|                                                         "Microsoft.KubernetesRuntime/services/write",
|                                                         "Microsoft.KubernetesRuntime/services/delete",
|                                                         "Microsoft.KubernetesRuntime/bfdProfiles/write",
|                                                         "Microsoft.KubernetesRuntime/bfdProfiles/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d715fb95-a0f0-4f1c-8be6-5ad2d2767f67",
|                                         "Name":  "AVS Orchestrator Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manages AVS private cloud resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/operationStatuses/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Network/virtualHubs/delete",
|                                                         "Microsoft.Network/publicIPAddresses/delete",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/delete",
|                                                         "Microsoft.Network/virtualNetworks/subnets/delete",
|                                                         "Microsoft.Network/networkIntentPolicies/read",
|                                                         "Microsoft.Network/networkIntentPolicies/delete",
|                                                         "Microsoft.Network/networkIntentPolicies/write",
|                                                         "Microsoft.Network/networkSecurityGroups/delete",
|                                                         "Microsoft.Network/networkSecurityGroups/write",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/write",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/delete",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/delete",
|                                                         "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action",
|                                                         "Microsoft.Network/virtualHubs/write",
|                                                         "Microsoft.Network/publicIPAddresses/write",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/virtualHubs/ipConfigurations/write",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                         "Microsoft.Network/virtualHubs/ipConfigurations/read",
|                                                         "Microsoft.Network/virtualHubs/bgpConnections/write",
|                                                         "Microsoft.Network/virtualHubs/bgpConnections/read",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete",
|                                                         "Microsoft.Network/virtualNetworks/peer/action",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Network/locations/operationResults/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/routeTables/read",
|                                                         "Microsoft.Network/routeTables/write",
|                                                         "Microsoft.Network/routeTables/delete",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/routeTables/routes/read",
|                                                         "Microsoft.Network/routeTables/routes/write",
|                                                         "Microsoft.Network/routeTables/routes/delete",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "db7003cd-07a9-490c-bfa5-23e40314f8d7",
|                                         "Name":  "Service Connector Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can manage Service Connector resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ServiceLinker/linkers/read",
|                                                         "Microsoft.ServiceLinker/linkers/delete",
|                                                         "Microsoft.ServiceLinker/linkers/write",
|                                                         "Microsoft.ServiceLinker/linkers/listConfigurations/action",
|                                                         "Microsoft.ServiceLinker/linkers/validateLinker/action",
|                                                         "Microsoft.ServiceLinker/dryruns/delete",
|                                                         "Microsoft.ServiceLinker/dryruns/write",
|                                                         "Microsoft.ServiceLinker/linkers/generateConfigurations/action",
|                                                         "Microsoft.ServiceLinker/locations/connectors/delete",
|                                                         "Microsoft.ServiceLinker/locations/connectors/generateConfigurations/action",
|                                                         "Microsoft.ServiceLinker/locations/connectors/validate/action",
|                                                         "Microsoft.ServiceLinker/locations/connectors/write",
|                                                         "Microsoft.ServiceLinker/locations/dryruns/delete",
|                                                         "Microsoft.ServiceLinker/locations/dryruns/write",
|                                                         "Microsoft.ServiceLinker/locations/operationStatuses/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a68e7c17-0ab2-4c09-9a58-125dae29748c",
|                                         "Name":  "Key Vault Purge Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can permanently delete soft-deleted vaults but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.KeyVault/deletedVaults/read",
|                                                         "Microsoft.KeyVault/locations/deletedVaults/read",
|                                                         "Microsoft.KeyVault/locations/deletedVaults/purge/action",
|                                                         "Microsoft.KeyVault/locations/operationResults/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b9a307c4-5aa3-4b52-ba60-2b17c136cd7b",
|                                         "Name":  "Container Apps Jobs Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can read, start, and stop Container Apps jobs but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "microsoft.app/jobs/read",
|                                                         "Microsoft.App/jobs/*/read",
|                                                         "Microsoft.App/jobs/*/action",
|                                                         "Microsoft.app/managedenvironments/read",
|                                                         "Microsoft.App/managedenvironments/*/read",
|                                                         "Microsoft.App/managedenvironments/join/action",
|                                                         "Microsoft.App/managedenvironments/checknameavailability/action",
|                                                         "Microsoft.app/connectedEnvironments/read",
|                                                         "Microsoft.App/connectedEnvironments/*/read",
|                                                         "Microsoft.App/connectedEnvironments/join/action",
|                                                         "Microsoft.App/connectedEnvironments/checknameavailability/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.App/jobs/logstream/action",
|                                                             "Microsoft.App/jobs/exec/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "77be276d-fb44-4f3b-beb5-9bf03c4cd2d3",
|                                         "Name":  "Operator Nexus Owner (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to Operator Nexus Network Cloud resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.NetworkCloud/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4e9d0bd4-5aab-4f91-92df-9def33fe287c",
|                                         "Name":  "CloudTest Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of CloudTest resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.CloudTest/*/read",
|                                                         "Microsoft.CloudTest/hostedpools/write",
|                                                         "Microsoft.CloudTest/hostedpools/delete",
|                                                         "Microsoft.CloudTest/images/write",
|                                                         "Microsoft.CloudTest/images/delete",
|                                                         "Microsoft.CloudTest/images/cancel/action",
|                                                         "Microsoft.CloudTest/images/refresh/action",
|                                                         "Microsoft.CloudTest/pools/write",
|                                                         "Microsoft.CloudTest/pools/delete",
|                                                         "Microsoft.CloudTest/accounts/write",
|                                                         "Microsoft.CloudTest/accounts/delete",
|                                                         "Microsoft.CloudTest/buildcaches/write",
|                                                         "Microsoft.CloudTest/buildcaches/delete",
|                                                         "Microsoft.CloudTest/pools/leases/action",
|                                                         "Microsoft.CloudTest/pools/leases/complete/action",
|                                                         "Microsoft.CloudTest/pools/leases/extend/action",
|                                                         "Microsoft.CloudTest/hostedpools/leases/action",
|                                                         "Microsoft.CloudTest/hostedpools/leases/complete/action",
|                                                         "Microsoft.CloudTest/hostedpools/leases/extend/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8d6517c1-e434-405c-9f3f-e0ae65085d76",
|                                         "Name":  "Azure Automanage Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of Automanage resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Automanage/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9fc6112f-f48e-4e27-8b09-72a5c94e4ae9",
|                                         "Name":  "Azure Bot Service Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of Bot Service resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.BotService/listAuthServiceProviders/action",
|                                                         "Microsoft.BotService/listauthserviceproviders/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.BotService/botServices/read",
|                                                         "Microsoft.BotService/botServices/write",
|                                                         "Microsoft.BotService/botServices/delete",
|                                                         "Microsoft.BotService/botServices/channels/write",
|                                                         "Microsoft.BotService/botServices/channels/read",
|                                                         "Microsoft.BotService/botServices/channels/listchannelwithkeys/action",
|                                                         "Microsoft.BotService/botServices/channels/delete",
|                                                         "Microsoft.BotService/botServices/channels/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.BotService/botServices/connections/read",
|                                                         "Microsoft.BotService/botServices/connections/write",
|                                                         "Microsoft.BotService/botServices/connections/delete",
|                                                         "Microsoft.BotService/botServices/connections/listwithsecrets/write",
|                                                         "Microsoft.BotService/botServices/connections/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.BotService/botServices/createemailsigninurl/action",
|                                                         "Microsoft.BotService/botServices/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.BotService/botServices/joinPerimeter/action",
|                                                         "Microsoft.BotService/botServices/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.BotService/checknameavailability/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.BotService/hostsettings/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.BotService/botServices/privateEndpointConnectionProxies/write",
|                                                         "Microsoft.BotService/botServices/privateEndpointConnectionProxies/delete",
|                                                         "Microsoft.BotService/botServices/privateEndpointConnectionProxies/validate/action",
|                                                         "Microsoft.BotService/botServices/privateEndpointConnections/write",
|                                                         "Microsoft.BotService/botServices/privateEndpointConnections/delete",
|                                                         "Microsoft.BotService/listqnamakerendpointkeys/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.BotService/botServices/networkSecurityPerimeterConfigurations/reconcile/action",
|                                                         "Microsoft.BotService/botServices/networkSecurityPerimeterAssociationProxies/write",
|                                                         "Microsoft.BotService/botServices/networkSecurityPerimeterAssociationProxies/delete",
|                                                         "Microsoft.BotService/locations/notifyNetworkSecurityPerimeterUpdatesAvailable/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.BotService/botServices/channels/regeneratekeys/action",
|                                                         "Microsoft.BotService/botServices/Connections/listWithSecrets/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fe86443c-f201-4fc4-9d2a-ac61149fbda0",
|                                         "Name":  "App Configuration Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of App Configuration resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AppConfiguration/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.AppConfiguration/locations/deletedConfigurationStores/purge/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "83f80186-3729-438c-ad2d-39e94d718838",
|                                         "Name":  "Service Fabric Managed Cluster Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage Service Fabric managed clusters but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ServiceFabric/managedclusters/*",
|                                                         "Microsoft.ServiceFabric/operations/read",
|                                                         "Microsoft.ServiceFabric/locations/clusterVersions/read",
|                                                         "Microsoft.ServiceFabric/locations/environments/clusterVersions/read",
|                                                         "Microsoft.ServiceFabric/locations/operationresults/read",
|                                                         "Microsoft.ServiceFabric/locations/operations/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a35466a1-cfd6-450a-b35e-683fcdf30363",
|                                         "Name":  "Azure Batch Service Orchestration Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manages Azure Batch compute resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Security/assessments/read",
|                                                         "Microsoft.AzureFleet/fleets/write",
|                                                         "Microsoft.AzureFleet/fleets/read",
|                                                         "Microsoft.AzureFleet/fleets/delete",
|                                                         "Microsoft.Compute/locations/DiskOperations/read",
|                                                         "Microsoft.Compute/locations/operations/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/approveRollingUpgrade/action",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/deallocate/action",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/delete",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/delete/action",
|                                                         "Microsoft.Compute/VirtualMachineScaleSets/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/reimage/action",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/reimageall/action",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/restart/action",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/start/action",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/write",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/extensions/read",
|                                                         "microsoft.Compute/virtualMachineScaleSets/networkInterfaces/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/virtualmachines/restart/action",
|                                                         "Microsoft.Compute/diskEncryptionSets/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/dataCollectionRuleAssociations/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Insights/diagnosticSettings/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/resources/read",
|                                                         "Microsoft.Network/networkWatchers/read",
|                                                         "Microsoft.Network/virtualNetworks/delete",
|                                                         "Microsoft.Network/virtualNetworks/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8c87871d-6201-42da-abb1-1c0c985ff71c",
|                                         "Name":  "Microsoft PowerBI Tenant Operations Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manages PowerBI tenant operations but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.PowerBI/tenants/workspaces/read",
|                                                         "Microsoft.PowerBI/tenants/workspaces/delete",
|                                                         "Microsoft.PowerBI/tenants/read",
|                                                         "Microsoft.PowerBI/tenants/delete",
|                                                         "Microsoft.PowerBI/tenants/write",
|                                                         "Microsoft.PowerBI/tenants/workspaces/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b6efc156-f0da-4e90-a50a-8c000140b017",
|                                         "Name":  "Service Fabric Cluster Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage Service Fabric clusters but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ServiceFabric/clusters/*",
|                                                         "Microsoft.ServiceFabric/operations/read",
|                                                         "Microsoft.ServiceFabric/locations/clusterVersions/read",
|                                                         "Microsoft.ServiceFabric/locations/environments/clusterVersions/read",
|                                                         "Microsoft.ServiceFabric/locations/operationresults/read",
|                                                         "Microsoft.ServiceFabric/locations/operations/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6e0c8711-85a0-4490-8365-8ec13c4560b4",
|                                         "Name":  "Stream Analytics Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Contributor access to Stream Analytics resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.StreamAnalytics/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "21bffb94-04c0-4ed0-b676-68bb926e832b",
|                                         "Name":  "Microsoft.Windows365.CloudPcDelegatedMsis Writer User",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Write operations on CloudPcDelegatedMsis resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Windows365/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bf2b6809-e9a5-4aea-a6e1-40a9dc8c43a7",
|                                         "Name":  "Landing Zone Account Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage Landing Zone Accounts and configurations but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Sovereign/landingZoneAccounts/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0b6ca2e8-2cdc-4bd6-b896-aa3d8c21fc35",
|                                         "Name":  "Defender Sensitive Data Discovery",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can read and write security and storage settings, enabling data plane impact but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Security/defenderforstoragesettings/read",
|                                                         "Microsoft.Security/defenderforstoragesettings/write",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Security/securityOperators/read",
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "29fe4964-1e60-436b-bd3a-77fd4c178b3c",
|                                         "Name":  "Azure Batch Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of batch resources but no permissions to assign roles or modify identity plane objects.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Batch/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Batch/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6aaa78f1-f7de-44ca-8722-c64a23943cae",
|                                         "Name":  "Azure Batch Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage batch pools and jobs but no ability to modify accounts or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Batch/batchAccounts/read",
|                                                         "Microsoft.Batch/batchAccounts/applications/*",
|                                                         "Microsoft.Batch/batchAccounts/certificates/*",
|                                                         "Microsoft.Batch/batchAccounts/certificateOperationResults/*",
|                                                         "Microsoft.Batch/batchAccounts/pools/*",
|                                                         "Microsoft.Batch/batchAccounts/poolOperationResults/*",
|                                                         "Microsoft.Batch/locations/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Batch/batchAccounts/jobSchedules/*",
|                                                             "Microsoft.Batch/batchAccounts/jobs/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1dc4cd5a-de51-4ee4-bc8e-b40e9c17e320",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Cluster Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Read/write access to cluster resources but no direct role assignment or identity plane permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/fleets/read",
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/apiextensions.k8s.io/customresourcedefinitions/read",
|                                                             "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/fleets/apps/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/apps/daemonsets/write",
|                                                             "Microsoft.ContainerService/fleets/apps/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/apps/deployments/write",
|                                                             "Microsoft.ContainerService/fleets/apps/statefulsets/read",
|                                                             "Microsoft.ContainerService/fleets/apps/statefulsets/write",
|                                                             "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
|                                                             "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/write",
|                                                             "Microsoft.ContainerService/fleets/batch/cronjobs/read",
|                                                             "Microsoft.ContainerService/fleets/batch/cronjobs/write",
|                                                             "Microsoft.ContainerService/fleets/batch/jobs/read",
|                                                             "Microsoft.ContainerService/fleets/batch/jobs/write",
|                                                             "Microsoft.ContainerService/fleets/configmaps/read",
|                                                             "Microsoft.ContainerService/fleets/configmaps/write",
|                                                             "Microsoft.ContainerService/fleets/endpoints/read",
|                                                             "Microsoft.ContainerService/fleets/endpoints/write",
|                                                             "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/fleets/events/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/daemonsets/write",
|                                                             "Microsoft.ContainerService/fleets/extensions/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/deployments/write",
|                                                             "Microsoft.ContainerService/fleets/extensions/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/ingresses/write",
|                                                             "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/networkpolicies/write",
|                                                             "Microsoft.ContainerService/fleets/limitranges/read",
|                                                             "Microsoft.ContainerService/fleets/namespaces/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/write",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/write",
|                                                             "Microsoft.ContainerService/fleets/nodes/read",
|                                                             "Microsoft.ContainerService/fleets/nodes/write",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumes/read",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumes/write",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumeclaims/write",
|                                                             "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
|                                                             "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/write",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/write",
|                                                             "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                             "Microsoft.ContainerService/fleets/secrets/read",
|                                                             "Microsoft.ContainerService/fleets/secrets/write",
|                                                             "Microsoft.ContainerService/fleets/serviceaccounts/read",
|                                                             "Microsoft.ContainerService/fleets/serviceaccounts/write",
|                                                             "Microsoft.ContainerService/fleets/services/read",
|                                                             "Microsoft.ContainerService/fleets/services/write",
|                                                             "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/memberclusters/read",
|                                                             "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/memberclusters/write",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceplacements/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceplacements/write",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourcebindings/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourcesnapshots/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterschedulingpolicysnapshots/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverrides/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverrides/write",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverridesnapshots/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7c2e40b7-25eb-482a-82cb-78ba06cb46d5",
|                                         "Name":  "Chaos Studio Experiment Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can create and manage experiments but lacks permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Chaos/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6f4fe6fc-f04f-4d97-8528-8bc18c848dca",
|                                         "Name":  "Container Apps ConnectedEnvironments Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of connected environments but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/connectedEnvironments/*",
|                                                         "Microsoft.App/connectedEnvironments/*/read",
|                                                         "Microsoft.App/connectedEnvironments/*/write",
|                                                         "Microsoft.App/connectedEnvironments/*/delete",
|                                                         "Microsoft.App/connectedEnvironments/*/action",
|                                                         "Microsoft.App/connectedEnvironments/daprComponents/listSecrets/action",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ff478a4e-8633-416e-91bc-ec33ce7c9516",
|                                         "Name":  "Azure Messaging Connectors Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to messaging connectors but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.MessagingConnectors/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MessagingConnectors/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3bc748fc-213d-45c1-8d91-9da5725539b9",
|                                         "Name":  "Container Registry Contributor and Data Access Configuration Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage container registries and data access configurations but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerRegistry/registries/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/read",
|                                                         "Microsoft.ContainerRegistry/registries/write",
|                                                         "Microsoft.ContainerRegistry/registries/delete",
|                                                         "Microsoft.ContainerRegistry/registries/listCredentials/action",
|                                                         "Microsoft.ContainerRegistry/registries/regenerateCredential/action",
|                                                         "Microsoft.ContainerRegistry/registries/generateCredentials/action",
|                                                         "Microsoft.ContainerRegistry/registries/replications/read",
|                                                         "Microsoft.ContainerRegistry/registries/replications/write",
|                                                         "Microsoft.ContainerRegistry/registries/replications/delete",
|                                                         "Microsoft.ContainerRegistry/registries/replications/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnections/read",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnections/write",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnections/delete",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnections/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/tokens/read",
|                                                         "Microsoft.ContainerRegistry/registries/tokens/write",
|                                                         "Microsoft.ContainerRegistry/registries/tokens/delete",
|                                                         "Microsoft.ContainerRegistry/registries/tokens/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/scopeMaps/read",
|                                                         "Microsoft.ContainerRegistry/registries/scopeMaps/write",
|                                                         "Microsoft.ContainerRegistry/registries/scopeMaps/delete",
|                                                         "Microsoft.ContainerRegistry/registries/scopeMaps/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/read",
|                                                         "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ContainerRegistry/registries/connectedRegistries/read",
|                                                         "Microsoft.ContainerRegistry/registries/connectedRegistries/write",
|                                                         "Microsoft.ContainerRegistry/registries/connectedRegistries/delete",
|                                                         "Microsoft.ContainerRegistry/registries/connectedRegistries/deactivate/action",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/read",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/write",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/delete",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/getCallbackConfig/action",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/ping/action",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/listEvents/action",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/operationStatuses/read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.ContainerRegistry/locations/operationResults/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/privateEndpoints/privateLinkServiceProxies/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bf94e731-3a51-4a7c-8c54-a1ab9971dfc1",
|                                         "Name":  "Container Registry Transfer Pipeline Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage transfer pipelines but no permissions to assign roles or modify identity plane objects.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/exportPipelines/read",
|                                                         "Microsoft.ContainerRegistry/registries/exportPipelines/write",
|                                                         "Microsoft.ContainerRegistry/registries/exportPipelines/delete",
|                                                         "Microsoft.ContainerRegistry/registries/importPipelines/read",
|                                                         "Microsoft.ContainerRegistry/registries/importPipelines/write",
|                                                         "Microsoft.ContainerRegistry/registries/importPipelines/delete",
|                                                         "Microsoft.ContainerRegistry/registries/pipelineRuns/read",
|                                                         "Microsoft.ContainerRegistry/registries/pipelineRuns/write",
|                                                         "Microsoft.ContainerRegistry/registries/pipelineRuns/delete",
|                                                         "Microsoft.ContainerRegistry/registries/pipelineRuns/operationStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "97dfb3ce-e936-462c-9425-9cdb67e66d45",
|                                         "Name":  "Desktop Virtualization App Attach Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage app attach resources but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.DesktopVirtualization/appattachpackages/read",
|                                                         "Microsoft.DesktopVirtualization/appattachpackages/write",
|                                                         "Microsoft.DesktopVirtualization/appattachpackages/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8ea85a25-eb16-4e29-ab4d-6f2a26c711a2",
|                                         "Name":  "App Service Environment Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage App Service Environments but no permissions to modify identity plane or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Web/hostingEnvironments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ada52afe-776a-4b4d-a8f2-55670d3d8178",
|                                         "Name":  "Kubernetes Agent Subscription Level Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Subscription level permissions for Defender for Cloud containers plan; no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.OperationalInsights/workspaces/write",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.OperationalInsights/workspaces/listKeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedkeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedkeys/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c1410b24-3e69-4857-8f86-4d0a2e603250",
|                                         "Name":  "Quantum Workspace Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage quantum workspace data but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Quantum/Workspaces/read",
|                                                         "Microsoft.Quantum/locations/offerings/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Quantum/Workspaces/jobs/read",
|                                                             "Microsoft.Quantum/Workspaces/jobs/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "09976791-48a7-449e-bb21-39d1a415f350",
|                                         "Name":  "Communication and Email Service Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of communication services but no direct identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Communication/CheckNameAvailability/action",
|                                                         "Microsoft.Communication/Locations/OperationStatuses/read",
|                                                         "Microsoft.Communication/Locations/OperationStatuses/write",
|                                                         "Microsoft.Communication/Operations/read",
|                                                         "Microsoft.Communication/CommunicationServices/read",
|                                                         "Microsoft.Communication/CommunicationServices/write",
|                                                         "Microsoft.Communication/CommunicationServices/delete",
|                                                         "Microsoft.Communication/CommunicationServices/ListKeys/action",
|                                                         "Microsoft.Communication/CommunicationServices/RegenerateKey/action",
|                                                         "Microsoft.Communication/CommunicationServices/LinkNotificationHub/action",
|                                                         "Microsoft.Communication/CommunicationServices/EventGridFilters/read",
|                                                         "Microsoft.Communication/CommunicationServices/EventGridFilters/write",
|                                                         "Microsoft.Communication/CommunicationServices/EventGridFilters/delete",
|                                                         "Microsoft.Communication/EmailServices/read",
|                                                         "Microsoft.Communication/EmailServices/write",
|                                                         "Microsoft.Communication/EmailServices/delete",
|                                                         "Microsoft.Communication/EmailServices/Domains/read",
|                                                         "Microsoft.Communication/EmailServices/Domains/write",
|                                                         "Microsoft.Communication/EmailServices/Domains/delete",
|                                                         "Microsoft.Communication/EmailServices/Domains/SenderUsernames/read",
|                                                         "Microsoft.Communication/EmailServices/Domains/SenderUsernames/write",
|                                                         "Microsoft.Communication/EmailServices/Domains/SenderUsernames/delete",
|                                                         "Microsoft.Communication/EmailServices/Domains/SuppressionLists/read",
|                                                         "Microsoft.Communication/EmailServices/Domains/SuppressionLists/write",
|                                                         "Microsoft.Communication/EmailServices/Domains/SuppressionLists/delete",
|                                                         "Microsoft.Communication/EmailServices/Domains/SuppressionLists/SuppressionListAddresses/read",
|                                                         "Microsoft.Communication/EmailServices/Domains/SuppressionLists/SuppressionListAddresses/write",
|                                                         "Microsoft.Communication/EmailServices/Domains/SuppressionLists/SuppressionListAddresses/delete",
|                                                         "Microsoft.Communication/EmailServices/Domains/InitiateVerification/action",
|                                                         "Microsoft.Communication/EmailServices/Domains/CancelVerification/action",
|                                                         "Microsoft.Communication/EmailServices/Domains/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "59c05558-2358-462d-ba19-afbd7118936d",
|                                         "Name":  "Oracle.Database Autonomous Database Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of autonomous database resources; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Oracle.Database/autonomousDatabases/*/read",
|                                                         "Oracle.Database/autonomousDatabases/*/write",
|                                                         "Oracle.Database/autonomousDatabases/*/delete",
|                                                         "Oracle.Database/autonomousDatabases/*/action",
|                                                         "Oracle.Database/Locations/*/read",
|                                                         "Oracle.Database/Locations/*/write",
|                                                         "Oracle.Database/Operations/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/action",
|                                                         "Oracle.Database/resourceAnchors/*",
|                                                         "Oracle.Database/networkAnchors/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/locations/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fb382eab-e894-4461-af04-94435c366c3f",
|                                         "Name":  "Container Registry Tasks Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage container registry tasks with potential data plane impact but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/agentpools/read",
|                                                         "Microsoft.ContainerRegistry/registries/agentpools/write",
|                                                         "Microsoft.ContainerRegistry/registries/agentpools/delete",
|                                                         "Microsoft.ContainerRegistry/registries/agentpools/listQueueStatus/action",
|                                                         "Microsoft.ContainerRegistry/registries/agentpools/operationResults/status/read",
|                                                         "Microsoft.ContainerRegistry/registries/agentpools/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/tasks/read",
|                                                         "Microsoft.ContainerRegistry/registries/tasks/write",
|                                                         "Microsoft.ContainerRegistry/registries/tasks/delete",
|                                                         "Microsoft.ContainerRegistry/registries/tasks/listDetails/action",
|                                                         "Microsoft.ContainerRegistry/registries/scheduleRun/action",
|                                                         "Microsoft.ContainerRegistry/registries/listBuildSourceUploadUrl/action",
|                                                         "Microsoft.ContainerRegistry/registries/runs/read",
|                                                         "Microsoft.ContainerRegistry/registries/runs/write",
|                                                         "Microsoft.ContainerRegistry/registries/runs/listLogSasUrl/action",
|                                                         "Microsoft.ContainerRegistry/registries/runs/cancel/action",
|                                                         "Microsoft.ContainerRegistry/registries/taskruns/read",
|                                                         "Microsoft.ContainerRegistry/registries/taskruns/write",
|                                                         "Microsoft.ContainerRegistry/registries/taskruns/delete",
|                                                         "Microsoft.ContainerRegistry/registries/taskruns/listDetails/action",
|                                                         "Microsoft.ContainerRegistry/registries/taskruns/operationStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerRegistry/registries/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "afc680e2-a938-412d-b213-9a49efa7fb83",
|                                         "Name":  "Azure Backup Snapshot Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage backup snapshots but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/restorePointCollections/read",
|                                                         "Microsoft.Compute/restorePointCollections/write",
|                                                         "Microsoft.Compute/restorePointCollections/restorePoints/write",
|                                                         "Microsoft.Compute/restorePointCollections/restorePoints/read",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "49fc33c1-886f-4b21-a00e-1d9993234734",
|                                         "Name":  "AVS on Fleet VIS Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Critical for AVS private cloud operation; manages network and peering but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/write",
|                                                         "Microsoft.Network/virtualNetworks/peer/action",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                         "Microsoft.Network/natGateways/join/action",
|                                                         "Microsoft.Network/networkIntentPolicies/join/action",
|                                                         "Microsoft.Network/ddosProtectionPlans/join/action",
|                                                         "Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action",
|                                                         "Microsoft.BareMetal/peeringSettings/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1a6f9009-515c-4455-b170-143e4c9ce229",
|                                         "Name":  "Azure Stack HCI Edge Machine Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage Azure Stack HCI Edge Machines and related resources; no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStackHCI/EdgeMachines/*",
|                                                         "Microsoft.AzureStackHCI/locations/ValidateOwnershipVouchers/action",
|                                                         "Microsoft.Edge/Sites/read",
|                                                         "Microsoft.Edge/Sites/write",
|                                                         "Microsoft.Edge/configurationReferences/read",
|                                                         "Microsoft.Edge/configurationReferences/write",
|                                                         "Microsoft.Edge/Configurations/*/read",
|                                                         "Microsoft.Edge/Configurations/*/write",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "53747cdd-e97c-477a-948c-b587d0e514b2",
|                                         "Name":  "Online Experimentation Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full access to experimentation data but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.OnlineExperimentation/workspaces/read",
|                                                             "Microsoft.OnlineExperimentation/workspaces/write",
|                                                             "Microsoft.OnlineExperimentation/workspaces/delete",
|                                                             "Microsoft.OnlineExperimentation/workspaces/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "59a618e3-3c9a-406e-9f03-1a20dd1c55f1",
|                                         "Name":  "Chaos Studio Target Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage chaos studio targets and capabilities but cannot create or run experiments or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Chaos/targets/write",
|                                                         "Microsoft.Chaos/targets/delete",
|                                                         "Microsoft.Chaos/targets/read",
|                                                         "Microsoft.Chaos/targets/capabilities/write",
|                                                         "Microsoft.Chaos/targets/capabilities/delete",
|                                                         "Microsoft.Chaos/targets/capabilities/read",
|                                                         "Microsoft.Chaos/locations/targetTypes/read",
|                                                         "Microsoft.Chaos/locations/targetTypes/capabilityTypes/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a8d01690-9418-4783-8ca2-9f0f1791783d",
|                                         "Name":  "Auto Actions Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage auto actions resources but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ComputeSchedule/locations/OperationStatuses/write",
|                                                         "Microsoft.ComputeSchedule/autoActions/write",
|                                                         "Microsoft.ComputeSchedule/autoActions/delete",
|                                                         "Microsoft.ComputeSchedule/autoActions/attachResources/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/cancelNextOccurrence/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/detachResources/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/disable/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/enable/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/listResources/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/patchResources/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/triggerManualOccurrence/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/occurrences/cancel/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/occurrences/delay/action",
|                                                         "Microsoft.ComputeSchedule/autoActions/occurrences/listResources/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a227fb39-f479-404b-96fd-0176f5d88ab4",
|                                         "Name":  "Azure Device Onboarding Discovery Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage device onboarding discovery services; no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DeviceOnboarding/discoveryServices/*",
|                                                         "Microsoft.DeviceOnboarding/locations/operationStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fc6e3395-6a8c-4527-bb4c-d0abd41e8e74",
|                                         "Name":  "SSH PublicKeys Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can create and delete SSH public keys but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/sshpublickeys/read",
|                                                         "Microsoft.Compute/sshpublickeys/write",
|                                                         "Microsoft.Compute/sshpublickeys/delete",
|                                                         "Microsoft.Compute/sshpublickeys/generatekeypair/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1b7f3653-4324-473a-9165-bc55e4d04ba8",
|                                         "Name":  "Azure Kubernetes Service Agent Pool Manager Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage AKS agent pools but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/managedClusters/agentPools/read",
|                                                         "Microsoft.ContainerService/managedClusters/agentPools/write",
|                                                         "Microsoft.ContainerService/managedClusters/agentPools/delete",
|                                                         "Microsoft.ContainerService/managedClusters/agentPools/upgradeNodeImageVersion/action",
|                                                         "Microsoft.ContainerService/managedClusters/agentPools/abort/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "96ebd254-ecc7-4590-aff5-e9af3ff5f3b3",
|                                         "Name":  "Dedicated Host Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage dedicated hosts but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/hostGroups/read",
|                                                         "Microsoft.Compute/hostGroups/write",
|                                                         "Microsoft.Compute/hostGroups/delete",
|                                                         "Microsoft.Compute/hostGroups/hosts/read",
|                                                         "Microsoft.Compute/hostGroups/hosts/write",
|                                                         "Microsoft.Compute/hostGroups/hosts/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2bed379c-9fba-455b-99e4-6b911073bcf2",
|                                         "Name":  "Compute Fleet Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage compute fleet resources but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureFleet/fleets/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "92b92042-07d9-4307-87f7-36a593fc5850",
|                                         "Name":  "Azure File Sync Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Full management of Azure File Sync resources including role assignments but no direct identity plane control over tenant roles.",
|                                         "Actions":  [
|                                                         "Microsoft.StorageSync/register/action",
|                                                         "Microsoft.StorageSync/unregister/action",
|                                                         "Microsoft.StorageSync/locations/*",
|                                                         "Microsoft.StorageSync/deployments/preflight/action",
|                                                         "Microsoft.StorageSync/storageSyncServices/*",
|                                                         "Microsoft.StorageSync/operations/read",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Insights/AlertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "88366f10-ed47-4cc0-9fab-c8a06148393e",
|                                         "Name":  "Azure Red Hat OpenShift Hosted Control Planes Cluster API Provider",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manage OpenShift cluster nodes and disks but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/diskEncryptionSets/read",
|                                                         "Microsoft.Compute/availabilitySets/delete",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/availabilitySets/write",
|                                                         "Microsoft.Compute/virtualMachines/delete",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "50346970-0998-40f2-b47d-f3b8809840f8",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Writer for Member Clusters",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Can access secrets and run pods as any service account in namespace, enabling potential privilege escalation but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/members/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/fleets/members/apps/daemonsets/*",
|                                                             "Microsoft.ContainerService/fleets/members/apps/deployments/*",
|                                                             "Microsoft.ContainerService/fleets/members/apps/replicasets/*",
|                                                             "Microsoft.ContainerService/fleets/members/apps/statefulsets/*",
|                                                             "Microsoft.ContainerService/fleets/members/autoscaling/horizontalpodautoscalers/*",
|                                                             "Microsoft.ContainerService/fleets/members/batch/cronjobs/*",
|                                                             "Microsoft.ContainerService/fleets/members/coordination.k8s.io/leases/read",
|                                                             "Microsoft.ContainerService/fleets/members/coordination.k8s.io/leases/write",
|                                                             "Microsoft.ContainerService/fleets/members/coordination.k8s.io/leases/delete",
|                                                             "Microsoft.ContainerService/fleets/members/discovery.k8s.io/endpointslices/read",
|                                                             "Microsoft.ContainerService/fleets/members/batch/jobs/*",
|                                                             "Microsoft.ContainerService/fleets/members/configmaps/*",
|                                                             "Microsoft.ContainerService/fleets/members/endpoints/*",
|                                                             "Microsoft.ContainerService/fleets/members/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/fleets/members/events/*",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/daemonsets/*",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/deployments/*",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/ingresses/*",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/networkpolicies/*",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/replicasets/*",
|                                                             "Microsoft.ContainerService/fleets/members/limitranges/read",
|                                                             "Microsoft.ContainerService/fleets/members/metrics.k8s.io/pods/read",
|                                                             "Microsoft.ContainerService/fleets/members/metrics.k8s.io/nodes/read",
|                                                             "Microsoft.ContainerService/fleets/members/namespaces/read",
|                                                             "Microsoft.ContainerService/fleets/members/networking.k8s.io/ingresses/*",
|                                                             "Microsoft.ContainerService/fleets/members/networking.k8s.io/networkpolicies/*",
|                                                             "Microsoft.ContainerService/fleets/members/persistentvolumeclaims/*",
|                                                             "Microsoft.ContainerService/fleets/members/pods/*",
|                                                             "Microsoft.ContainerService/fleets/members/policy/poddisruptionbudgets/*",
|                                                             "Microsoft.ContainerService/fleets/members/replicationcontrollers/*",
|                                                             "Microsoft.ContainerService/fleets/members/resourcequotas/read",
|                                                             "Microsoft.ContainerService/fleets/members/secrets/*",
|                                                             "Microsoft.ContainerService/fleets/members/serviceaccounts/*",
|                                                             "Microsoft.ContainerService/fleets/members/services/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "79a36d98-eb96-4a76-ae1d-481dc98d2c23",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Cluster Admin for Member Clusters",
|                                         "IsCustom":  false,
|                                         "Tier":  2,
|                                         "Reason":  "Manages all resources in member clusters but lacks direct permissions to assign Azure AD roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/members/*"
|                                                         ]
|                                     }
|                                 ],
|    "Azure_BuiltInRoles_Tier3":  [
|                                     {
|                                         "Id":  "8311e382-0749-4cb8-b61a-304f252e45ec",
|                                         "Name":  "AcrPush",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permissions limited to container registry push and pull; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/pull/read",
|                                                         "Microsoft.ContainerRegistry/registries/push/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "312a565d-c81f-4fd8-895a-4e21e48d571c",
|                                         "Name":  "API Management Service Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage API services but lacks permissions to assign roles or modify identity plane objects.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7f951dda-4ed3-4680-a7ca-43fe172d538d",
|                                         "Name":  "AcrPull",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only pull access to container registry; no path to tenant takeover.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/pull/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6cef56e8-d556-48e5-a04f-b8e64114680f",
|                                         "Name":  "AcrImageSigner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permission to sign content in container registry; no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/sign/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/trustedCollections/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c2f4ef07-c644-48eb-af81-4b1b4947fb11",
|                                         "Name":  "AcrDelete",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can delete container registry artifacts; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/artifacts/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cdda3590-29a3-44f6-95f2-9f980659eb04",
|                                         "Name":  "AcrQuarantineReader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to quarantine data only; no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/quarantine/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c8d4ff99-41c3-41a8-9f60-21dfdad59608",
|                                         "Name":  "AcrQuarantineWriter",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to quarantine data; no path to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/quarantine/read",
|                                                         "Microsoft.ContainerRegistry/registries/quarantine/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read",
|                                                             "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e022efe7-f5ba-4159-bbe4-b44f577e9b61",
|                                         "Name":  "API Management Service Operator Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage service but not APIs or role assignments; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/*/read",
|                                                         "Microsoft.ApiManagement/service/backup/action",
|                                                         "Microsoft.ApiManagement/service/delete",
|                                                         "Microsoft.ApiManagement/service/managedeployments/action",
|                                                         "Microsoft.ApiManagement/service/read",
|                                                         "Microsoft.ApiManagement/service/restore/action",
|                                                         "Microsoft.ApiManagement/service/updatecertificate/action",
|                                                         "Microsoft.ApiManagement/service/updatehostname/action",
|                                                         "Microsoft.ApiManagement/service/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.ApiManagement/service/users/keys/read"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "71522526-b88f-4d52-b57f-d31fc3546d0d",
|                                         "Name":  "API Management Service Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to API management service; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/*/read",
|                                                         "Microsoft.ApiManagement/service/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.ApiManagement/service/users/keys/read"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ae349356-3a1b-4a5e-921d-050484c6347e",
|                                         "Name":  "Application Insights Component Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Application Insights components; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/generateLiveToken/read",
|                                                         "Microsoft.Insights/metricAlerts/*",
|                                                         "Microsoft.Insights/components/*",
|                                                         "Microsoft.Insights/scheduledqueryrules/*",
|                                                         "Microsoft.Insights/topology/read",
|                                                         "Microsoft.Insights/transactions/read",
|                                                         "Microsoft.Insights/webtests/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "08954f03-6346-4c2e-81c0-ec3a5cfae23b",
|                                         "Name":  "Application Insights Snapshot Debugger",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and debug Application Insights snapshots; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/components/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/snapshots/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fd1bd22b-8476-40bc-a0bc-69b95687b9f3",
|                                         "Name":  "Attestation Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to attestation providers; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Attestation/attestationProviders/attestation/read",
|                                                         "Microsoft.Attestation/attestationProviders/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4fe576fe-1146-4730-92eb-48519fa6bf9f",
|                                         "Name":  "Automation Job Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage automation jobs; no permissions to assign roles or modify identity plane objects.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/read",
|                                                         "Microsoft.Automation/automationAccounts/jobs/read",
|                                                         "Microsoft.Automation/automationAccounts/jobs/resume/action",
|                                                         "Microsoft.Automation/automationAccounts/jobs/stop/action",
|                                                         "Microsoft.Automation/automationAccounts/jobs/streams/read",
|                                                         "Microsoft.Automation/automationAccounts/jobs/suspend/action",
|                                                         "Microsoft.Automation/automationAccounts/jobs/write",
|                                                         "Microsoft.Automation/automationAccounts/jobs/output/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5fb5aef8-1081-4b8e-bb16-9d5d0385bab5",
|                                         "Name":  "Automation Runbook Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read runbook properties and create jobs; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d3881f73-407a-4167-8283-e981cbba0404",
|                                         "Name":  "Automation Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Start, stop, suspend automation jobs; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/read",
|                                                         "Microsoft.Automation/automationAccounts/jobs/read",
|                                                         "Microsoft.Automation/automationAccounts/jobs/resume/action",
|                                                         "Microsoft.Automation/automationAccounts/jobs/stop/action",
|                                                         "Microsoft.Automation/automationAccounts/jobs/streams/read",
|                                                         "Microsoft.Automation/automationAccounts/jobs/suspend/action",
|                                                         "Microsoft.Automation/automationAccounts/jobs/write",
|                                                         "Microsoft.Automation/automationAccounts/jobSchedules/read",
|                                                         "Microsoft.Automation/automationAccounts/jobSchedules/write",
|                                                         "Microsoft.Automation/automationAccounts/linkedWorkspace/read",
|                                                         "Microsoft.Automation/automationAccounts/read",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                         "Microsoft.Automation/automationAccounts/schedules/read",
|                                                         "Microsoft.Automation/automationAccounts/schedules/write",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Automation/automationAccounts/jobs/output/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4f8fab4f-1852-4a58-a46a-8eaf358af14a",
|                                         "Name":  "Avere Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Avere vFXT cluster; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Compute/*/read",
|                                                         "Microsoft.Compute/availabilitySets/*",
|                                                         "Microsoft.Compute/proximityPlacementGroups/*",
|                                                         "Microsoft.Compute/virtualMachines/*",
|                                                         "Microsoft.Compute/disks/*",
|                                                         "Microsoft.Network/*/read",
|                                                         "Microsoft.Network/networkInterfaces/*",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/*/read",
|                                                         "Microsoft.Storage/storageAccounts/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/resources/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c025889f-8102-4ebf-b32c-fc0c6f0c6bd9",
|                                         "Name":  "Avere Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage cluster network interfaces and VMs; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8",
|                                         "Name":  "Azure Kubernetes Service Cluster Admin Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "List cluster admin credentials and run commands; no Azure AD role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action",
|                                                         "Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action",
|                                                         "Microsoft.ContainerService/managedClusters/read",
|                                                         "Microsoft.ContainerService/managedClusters/runcommand/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4abbcc35-e782-43d8-92c5-2d3f1bd2253f",
|                                         "Name":  "Azure Kubernetes Service Cluster User Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "List cluster user credentials; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
|                                                         "Microsoft.ContainerService/managedClusters/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "423170ca-a8f6-4b0f-8487-9e4eb8f49bfa",
|                                         "Name":  "Azure Maps Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Azure Maps data; no identity plane or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Maps/accounts/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6f12a6df-dd06-4f3e-bcb1-ce8be600526a",
|                                         "Name":  "Azure Stack Registration Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Azure Stack registrations; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStack/edgeSubscriptions/read",
|                                                         "Microsoft.AzureStack/registrations/products/*/action",
|                                                         "Microsoft.AzureStack/registrations/products/read",
|                                                         "Microsoft.AzureStack/registrations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5e467623-bb1f-42f4-a55d-6e525e11384b",
|                                         "Name":  "Backup Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage backups but cannot assign roles or modify identity plane objects.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.RecoveryServices/locations/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/refreshContainers/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupJobs/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupJobsExport/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupOperationResults/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectableItems/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectedItems/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectionContainers/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupSecurityPIN/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupUsageSummaries/read",
|                                                         "Microsoft.RecoveryServices/Vaults/certificates/*",
|                                                         "Microsoft.RecoveryServices/Vaults/extendedInformation/*",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/read",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/*",
|                                                         "Microsoft.RecoveryServices/Vaults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/*",
|                                                         "Microsoft.RecoveryServices/Vaults/usages/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupstorageconfig/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupconfig/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupValidateOperation/action",
|                                                         "Microsoft.RecoveryServices/Vaults/write",
|                                                         "Microsoft.RecoveryServices/Vaults/backupOperations/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupEngines/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectableContainers/read",
|                                                         "Microsoft.RecoveryServices/vaults/operationStatus/read",
|                                                         "Microsoft.RecoveryServices/vaults/operationResults/read",
|                                                         "Microsoft.RecoveryServices/locations/backupStatus/action",
|                                                         "Microsoft.RecoveryServices/locations/backupPreValidateProtection/action",
|                                                         "Microsoft.RecoveryServices/locations/backupValidateFeatures/action",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/write",
|                                                         "Microsoft.RecoveryServices/operations/read",
|                                                         "Microsoft.RecoveryServices/locations/operationStatus/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.DataProtection/locations/getBackupStatus/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/write",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/delete",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                         "Microsoft.DataProtection/backupVaults/deletedBackupInstances/read",
|                                                         "Microsoft.DataProtection/backupVaults/deletedBackupInstances/undelete/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/backup/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/validateRestore/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/restore/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/crossRegionRestore/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/validateCrossRegionRestore/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJobs/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJob/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchSecondaryRecoveryPoints/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupPolicies/write",
|                                                         "Microsoft.DataProtection/backupVaults/backupPolicies/delete",
|                                                         "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read",
|                                                         "Microsoft.DataProtection/backupVaults/write",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/backupVaults/operationResults/read",
|                                                         "Microsoft.DataProtection/backupVaults/operationStatus/read",
|                                                         "Microsoft.DataProtection/locations/checkNameAvailability/action",
|                                                         "Microsoft.DataProtection/locations/checkFeatureSupport/action",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/locations/operationStatus/read",
|                                                         "Microsoft.DataProtection/locations/operationResults/read",
|                                                         "Microsoft.DataProtection/backupVaults/validateForBackup/action",
|                                                         "Microsoft.DataProtection/operations/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/delete",
|                                                         "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/unlockDelete/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/write",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/write",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/delete",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/unlockDelete/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/validateForModifyBackup/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/SuspendBackups/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/resumeProtection/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fa23ad8b-c56e-40d8-ac0c-ce449e1d2c64",
|                                         "Name":  "Billing Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to billing data; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Billing/*/read",
|                                                         "Microsoft.Commerce/*/read",
|                                                         "Microsoft.Consumption/*/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.CostManagement/*/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a795c7a0-d4a2-40c1-ae25-d81f01202912",
|                                         "Name":  "Backup Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to backup services; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.RecoveryServices/locations/allocatedStamp/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/operationsStatus/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationsStatus/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupJobs/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupJobs/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupJobsExport/action",
|                                                         "Microsoft.RecoveryServices/Vaults/backupOperationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectedItems/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectionContainers/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupUsageSummaries/read",
|                                                         "Microsoft.RecoveryServices/Vaults/extendedInformation/read",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/read",
|                                                         "Microsoft.RecoveryServices/Vaults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupstorageconfig/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupconfig/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupOperations/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/operations/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupEngines/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/items/read",
|                                                         "Microsoft.RecoveryServices/locations/backupStatus/action",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/*",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/write",
|                                                         "Microsoft.RecoveryServices/operations/read",
|                                                         "Microsoft.RecoveryServices/locations/operationStatus/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read",
|                                                         "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                         "Microsoft.RecoveryServices/locations/backupValidateFeatures/action",
|                                                         "Microsoft.RecoveryServices/locations/backupCrrJobs/action",
|                                                         "Microsoft.RecoveryServices/locations/backupCrrJob/action",
|                                                         "Microsoft.RecoveryServices/locations/backupCrrOperationResults/read",
|                                                         "Microsoft.RecoveryServices/locations/backupCrrOperationsStatus/read",
|                                                         "Microsoft.DataProtection/locations/getBackupStatus/action",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                         "Microsoft.DataProtection/backupVaults/deletedBackupInstances/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/action",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/backupVaults/operationResults/read",
|                                                         "Microsoft.DataProtection/backupVaults/operationStatus/read",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/backupVaults/read",
|                                                         "Microsoft.DataProtection/locations/operationStatus/read",
|                                                         "Microsoft.DataProtection/locations/operationResults/read",
|                                                         "Microsoft.DataProtection/operations/read",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJobs/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJob/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchSecondaryRecoveryPoints/action",
|                                                         "Microsoft.DataProtection/locations/checkFeatureSupport/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "31a002a1-acaf-453e-8a5b-297c9ca1ea24",
|                                         "Name":  "Blockchain Member Node Access (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to blockchain member nodes; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Blockchain/blockchainMembers/transactionNodes/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Blockchain/blockchainMembers/transactionNodes/connect/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5e3c6656-6cfa-4708-81fe-0de47ac73342",
|                                         "Name":  "BizTalk Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage BizTalk services but no access to identity plane or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.BizTalkServices/BizTalk/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "426e0c7f-0c7e-4658-b36f-ff54d6c29b45",
|                                         "Name":  "CDN Endpoint Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage CDN endpoints but cannot assign roles or modify identity plane objects.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Cdn/edgenodes/read",
|                                                         "Microsoft.Cdn/operationresults/*",
|                                                         "Microsoft.Cdn/profiles/endpoints/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ec156ff8-a8d1-4d15-830c-5b80698ca432",
|                                         "Name":  "CDN Profile Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage CDN profiles and endpoints but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Cdn/edgenodes/read",
|                                                         "Microsoft.Cdn/operationresults/*",
|                                                         "Microsoft.Cdn/profiles/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8f96442b-4075-438f-813d-ad51ab4019af",
|                                         "Name":  "CDN Profile Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to CDN profiles and endpoints; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Cdn/edgenodes/read",
|                                                         "Microsoft.Cdn/operationresults/*",
|                                                         "Microsoft.Cdn/profiles/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Cdn/profiles/afdendpoints/validateCustomDomain/action",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Cdn/profiles/CheckResourceUsage/action",
|                                                         "Microsoft.Cdn/profiles/endpoints/CheckResourceUsage/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b34d265f-36f7-4a0d-a4d4-e158ca92e90f",
|                                         "Name":  "Classic Network Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage classic networks but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ClassicNetwork/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "86e8f5dc-a6e9-4c67-9d15-de283e8eac25",
|                                         "Name":  "Classic Storage Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage classic storage accounts but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ClassicStorage/storageAccounts/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "985d6b00-f706-48f5-a6fe-d0ca12fb668d",
|                                         "Name":  "Classic Storage Account Key Operator Service Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "List and regenerate keys on classic storage accounts; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.ClassicStorage/storageAccounts/listkeys/action",
|                                                         "Microsoft.ClassicStorage/storageAccounts/regeneratekey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9106cda0-8a86-4e81-b686-29a22c54effe",
|                                         "Name":  "ClearDB MySQL DB Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage ClearDB MySQL databases but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "successbricks.cleardb/databases/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d73bb868-a0df-4d4d-bd69-98a00b01fccb",
|                                         "Name":  "Classic Virtual Machine Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage classic VMs but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ClassicCompute/domainNames/*",
|                                                         "Microsoft.ClassicCompute/virtualMachines/*",
|                                                         "Microsoft.ClassicNetwork/networkSecurityGroups/join/action",
|                                                         "Microsoft.ClassicNetwork/reservedIps/link/action",
|                                                         "Microsoft.ClassicNetwork/reservedIps/read",
|                                                         "Microsoft.ClassicNetwork/virtualNetworks/join/action",
|                                                         "Microsoft.ClassicNetwork/virtualNetworks/read",
|                                                         "Microsoft.ClassicStorage/storageAccounts/disks/read",
|                                                         "Microsoft.ClassicStorage/storageAccounts/images/read",
|                                                         "Microsoft.ClassicStorage/storageAccounts/listKeys/action",
|                                                         "Microsoft.ClassicStorage/storageAccounts/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a97b65f3-24c7-4388-baec-2e87135dc908",
|                                         "Name":  "Cognitive Services User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and list keys of Cognitive Services; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.CognitiveServices/accounts/listkeys/action",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Insights/diagnosticSettings/read",
|                                                         "Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.Insights/metricdefinitions/read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b59867f0-fa02-499b-be73-45a86b5b3e1c",
|                                         "Name":  "Cognitive Services Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Cognitive Services data; no identity plane or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68",
|                                         "Name":  "Cognitive Services Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Cognitive Services including keys; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.CognitiveServices/*",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/providers/features/register/action",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/diagnosticSettings/*",
|                                                         "Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.Insights/metricdefinitions/read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.CognitiveServices/raiPolicy/write",
|                                                            "Microsoft.CognitiveServices/raiPolicy/delete",
|                                                            "Microsoft.CognitiveServices/raiExternalSafetyProviders/write",
|                                                            "Microsoft.CognitiveServices/raiExternalSafetyProviders/delete"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "db7b14f2-5adf-42da-9f96-f2ee17bab5cb",
|                                         "Name":  "CosmosBackupOperator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Submit restore requests for Cosmos DB; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.DocumentDB/databaseAccounts/backup/action",
|                                                         "Microsoft.DocumentDB/databaseAccounts/restore/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fbdf93bf-df7d-467e-a4d2-9458aa1360c8",
|                                         "Name":  "Cosmos DB Account Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Cosmos DB accounts; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.DocumentDB/*/read",
|                                                         "Microsoft.DocumentDB/databaseAccounts/readonlykeys/action",
|                                                         "Microsoft.Insights/MetricDefinitions/read",
|                                                         "Microsoft.Insights/Metrics/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "434105ed-43f6-45c7-a02f-909b2ba83430",
|                                         "Name":  "Cost Management Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage cost configurations; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Consumption/*",
|                                                         "Microsoft.CostManagement/*",
|                                                         "Microsoft.Billing/billingPeriods/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Advisor/configurations/read",
|                                                         "Microsoft.Advisor/recommendations/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Billing/billingProperty/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "72fafb9e-0641-4937-9268-a91bfd8191a3",
|                                         "Name":  "Cost Management Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to cost data; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Consumption/*/read",
|                                                         "Microsoft.CostManagement/*/read",
|                                                         "Microsoft.Billing/billingPeriods/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Advisor/configurations/read",
|                                                         "Microsoft.Advisor/recommendations/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Billing/billingProperty/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "add466c9-e687-43fc-8d98-dfcf8d720be5",
|                                         "Name":  "Data Box Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Data Box service except access control; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Databox/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "028f4ed7-e2a9-465e-a8f4-9c0ffdfdc027",
|                                         "Name":  "Data Box Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Data Box service; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Databox/*/read",
|                                                         "Microsoft.Databox/jobs/listsecrets/action",
|                                                         "Microsoft.Databox/jobs/listcredentials/action",
|                                                         "Microsoft.Databox/locations/availableSkus/action",
|                                                         "Microsoft.Databox/locations/validateInputs/action",
|                                                         "Microsoft.Databox/locations/regionConfiguration/action",
|                                                         "Microsoft.Databox/locations/validateAddress/action",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "673868aa-7521-48a0-acc6-0f60742d39f5",
|                                         "Name":  "Data Factory Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage data factories but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.DataFactory/dataFactories/*",
|                                                         "Microsoft.DataFactory/factories/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.EventGrid/eventSubscriptions/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "150f5e0c-0603-4f03-8c7f-cf70034c4e90",
|                                         "Name":  "Data Purger",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can purge analytics data; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Insights/components/*/read",
|                                                         "Microsoft.Insights/components/purge/action",
|                                                         "Microsoft.OperationalInsights/workspaces/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/purge/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "47b7735b-770e-4598-a7da-8b91488b4c88",
|                                         "Name":  "Data Lake Analytics Developer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Submit and manage jobs; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.BigAnalytics/accounts/*",
|                                                         "Microsoft.DataLakeAnalytics/accounts/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.BigAnalytics/accounts/Delete",
|                                                            "Microsoft.BigAnalytics/accounts/TakeOwnership/action",
|                                                            "Microsoft.BigAnalytics/accounts/Write",
|                                                            "Microsoft.DataLakeAnalytics/accounts/Delete",
|                                                            "Microsoft.DataLakeAnalytics/accounts/TakeOwnership/action",
|                                                            "Microsoft.DataLakeAnalytics/accounts/Write",
|                                                            "Microsoft.DataLakeAnalytics/accounts/dataLakeStoreAccounts/Write",
|                                                            "Microsoft.DataLakeAnalytics/accounts/dataLakeStoreAccounts/Delete",
|                                                            "Microsoft.DataLakeAnalytics/accounts/storageAccounts/Write",
|                                                            "Microsoft.DataLakeAnalytics/accounts/storageAccounts/Delete",
|                                                            "Microsoft.DataLakeAnalytics/accounts/firewallRules/Write",
|                                                            "Microsoft.DataLakeAnalytics/accounts/firewallRules/Delete",
|                                                            "Microsoft.DataLakeAnalytics/accounts/computePolicies/Write",
|                                                            "Microsoft.DataLakeAnalytics/accounts/computePolicies/Delete"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "76283e04-6283-4c54-8f91-bcf1374a3c64",
|                                         "Name":  "DevTest Labs User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage own VMs in DevTest Labs; no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/virtualMachines/*/read",
|                                                         "Microsoft.Compute/virtualMachines/deallocate/action",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/restart/action",
|                                                         "Microsoft.Compute/virtualMachines/start/action",
|                                                         "Microsoft.DevTestLab/*/read",
|                                                         "Microsoft.DevTestLab/labs/claimAnyVm/action",
|                                                         "Microsoft.DevTestLab/labs/createEnvironment/action",
|                                                         "Microsoft.DevTestLab/labs/ensureCurrentUserProfile/action",
|                                                         "Microsoft.DevTestLab/labs/formulas/delete",
|                                                         "Microsoft.DevTestLab/labs/formulas/read",
|                                                         "Microsoft.DevTestLab/labs/formulas/write",
|                                                         "Microsoft.DevTestLab/labs/policySets/evaluatePolicies/action",
|                                                         "Microsoft.DevTestLab/labs/virtualMachines/claim/action",
|                                                         "Microsoft.DevTestLab/labs/virtualmachines/listApplicableSchedules/action",
|                                                         "Microsoft.DevTestLab/labs/virtualMachines/getRdpFileContents/action",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
|                                                         "Microsoft.Network/networkInterfaces/*/read",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/publicIPAddresses/*/read",
|                                                         "Microsoft.Network/publicIPAddresses/join/action",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.Compute/virtualMachines/vmSizes/read"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5bd9cd88-fe45-4216-938b-f97437e15450",
|                                         "Name":  "DocumentDB Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage DocumentDB accounts but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.DocumentDb/databaseAccounts/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "befefa01-2a29-4197-83a8-272ff33ce314",
|                                         "Name":  "DNS Zone Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage DNS zones and records but cannot assign roles or modify identity plane objects.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Network/dnsZones/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "428e0ff0-5e57-4d9c-a221-2c70d0e0a443",
|                                         "Name":  "EventGrid EventSubscription Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages EventGrid subscriptions but has no direct or near-direct path to identity plane control or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.EventGrid/eventSubscriptions/*",
|                                                         "Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/locations/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2414bbcf-6497-4faf-8c65-045460748405",
|                                         "Name":  "EventGrid EventSubscription Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to EventGrid subscriptions with no ability to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.EventGrid/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/locations/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b60367af-1334-4454-b71e-769d9a4f83d9",
|                                         "Name":  "Graph Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Enterprise Graph data but does not have permissions to modify roles or authentication policies.",
|                                         "Actions":  [
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/conflation/read",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/conflation/write",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/sourceschema/read",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/sourceschema/write",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/knowledge/read",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/knowledge/write",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/intentclassification/read",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/intentclassification/write",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/ingestion/read",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/ingestion/write",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/ontology/read",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/ontology/write",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/delete",
|                                                         "Microsoft.EnterpriseKnowledgeGraph/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "03a6d094-3444-4b3d-88af-7477090a9e5e",
|                                         "Name":  "Intelligent Systems Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Intelligent Systems accounts but cannot access or modify identity plane or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.IntelligentSystems/accounts/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ee361c5d-f7b5-4119-b4b6-892157c8f64c",
|                                         "Name":  "Knowledge Consumer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Enterprise Graph knowledge with no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.EnterpriseKnowledgeGraph/services/knowledge/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b97fb8bc-a8b2-4522-a38b-dd33c7e65ead",
|                                         "Name":  "Lab Creator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create labs but lacks permissions to modify identity plane or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.LabServices/labAccounts/*/read",
|                                                         "Microsoft.LabServices/labAccounts/createLab/action",
|                                                         "Microsoft.LabServices/labAccounts/getPricingAndAvailability/action",
|                                                         "Microsoft.LabServices/labAccounts/getRestrictionsAndUsage/action",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.LabServices/labPlans/images/read",
|                                                         "Microsoft.LabServices/labPlans/read",
|                                                         "Microsoft.LabServices/labPlans/saveImage/action",
|                                                         "Microsoft.LabServices/labs/read",
|                                                         "Microsoft.LabServices/labs/schedules/read",
|                                                         "Microsoft.LabServices/labs/users/read",
|                                                         "Microsoft.LabServices/labs/virtualMachines/read",
|                                                         "Microsoft.LabServices/locations/usages/read",
|                                                         "Microsoft.LabServices/skus/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.LabServices/labPlans/createLab/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "73c42c96-874c-492b-b04d-ab87d138a893",
|                                         "Name":  "Log Analytics Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to monitoring data without ability to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                         "Microsoft.OperationalInsights/workspaces/search/action",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.OperationalInsights/workspaces/sharedKeys/read"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "515c2055-d9d4-4321-b1b9-bd0c9a0f79fe",
|                                         "Name":  "Logic App Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and enable/disable logic apps but no permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*/read",
|                                                         "Microsoft.Insights/metricAlerts/*/read",
|                                                         "Microsoft.Insights/diagnosticSettings/*/read",
|                                                         "Microsoft.Insights/metricDefinitions/*/read",
|                                                         "Microsoft.Logic/*/read",
|                                                         "Microsoft.Logic/workflows/disable/action",
|                                                         "Microsoft.Logic/workflows/enable/action",
|                                                         "Microsoft.Logic/workflows/validate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Web/connectionGateways/*/read",
|                                                         "Microsoft.Web/connections/*/read",
|                                                         "Microsoft.Web/customApis/*/read",
|                                                         "Microsoft.Web/serverFarms/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "87a39d53-fc1b-424a-814c-f7e04687dc9e",
|                                         "Name":  "Logic App Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages logic apps but cannot access identity plane or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ClassicStorage/storageAccounts/listKeys/action",
|                                                         "Microsoft.ClassicStorage/storageAccounts/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/metricAlerts/*",
|                                                         "Microsoft.Insights/diagnosticSettings/*",
|                                                         "Microsoft.Insights/logdefinitions/*",
|                                                         "Microsoft.Insights/metricDefinitions/*",
|                                                         "Microsoft.Logic/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Web/connectionGateways/*",
|                                                         "Microsoft.Web/connections/*",
|                                                         "Microsoft.Web/customApis/*",
|                                                         "Microsoft.Web/serverFarms/join/action",
|                                                         "Microsoft.Web/serverFarms/read",
|                                                         "Microsoft.Web/sites/functions/listSecrets/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c7393b34-138c-406f-901b-d8cf2b17e6ae",
|                                         "Name":  "Managed Application Operator Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can perform actions on managed applications but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.Solutions/applications/read",
|                                                         "Microsoft.Solutions/*/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b9331d33-8a36-4f8c-b097-4f54124fdb44",
|                                         "Name":  "Managed Application Publisher Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Limited to reading managed application resources and requesting JIT access; no direct identity plane control.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Solutions/jitRequests/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ac63b705-f282-497d-ac71-919bf39d939d",
|                                         "Name":  "Management Group Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to management groups without identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Management/managementGroups/subscriptions/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "43d0d8ad-25c7-4714-9337-8ba259a9fe05",
|                                         "Name":  "Monitoring Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to monitoring data with no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/search/action",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4d97b98b-1d4f-4787-a291-c67834d212e7",
|                                         "Name":  "Network Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages network resources but cannot assign roles or modify identity plane controls.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Network/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d28c62d-5b37-4476-8438-e587778df237",
|                                         "Name":  "New Relic APM Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages New Relic APM accounts but no access to identity plane or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "NewRelic.APM/accounts/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "acdd72a7-3385-48ef-bd42-f606fba81ae7",
|                                         "Name":  "Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to resources without any ability to modify identity plane or assign roles.",
|                                         "Actions":  [
|                                                         "*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e0f68234-74aa-48ed-b826-c38b57376e17",
|                                         "Name":  "Redis Cache Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Redis caches but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Cache/register/action",
|                                                         "Microsoft.Cache/redis/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "188a0f2f-5c9e-469b-ae67-2aa5ce574b94",
|                                         "Name":  "Scheduler Job Collections Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages scheduler job collections but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Scheduler/jobcollections/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7ca78c08-252a-4471-8644-bb5ff32d4ba0",
|                                         "Name":  "Search Service Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages search services but cannot assign roles or modify identity plane controls.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Search/searchServices/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e3d13bf0-dd5a-482e-ba6b-9b8433878d10",
|                                         "Name":  "Security Manager (Legacy)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Legacy role with read and write on compute and network but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ClassicCompute/*/read",
|                                                         "Microsoft.ClassicCompute/virtualMachines/*/write",
|                                                         "Microsoft.ClassicNetwork/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Security/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "39bc4728-0917-49c7-9d2c-d95423bc2eb4",
|                                         "Name":  "Security Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to security data without ability to modify identity plane or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.operationalInsights/workspaces/*/read",
|                                                         "Microsoft.Resources/deployments/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Security/*/read",
|                                                         "Microsoft.IoTSecurity/*/read",
|                                                         "Microsoft.Support/*/read",
|                                                         "Microsoft.Security/iotDefenderSettings/packageDownloads/action",
|                                                         "Microsoft.Security/iotDefenderSettings/downloadManagerActivation/action",
|                                                         "Microsoft.Security/iotSensors/downloadResetPassword/action",
|                                                         "Microsoft.IoTSecurity/defenderSettings/packageDownloads/action",
|                                                         "Microsoft.IoTSecurity/defenderSettings/downloadManagerActivation/action",
|                                                         "Microsoft.Management/managementGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8bbe83f1-e2a6-4df7-8cb4-4e04d4e5c827",
|                                         "Name":  "Spatial Anchors Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages spatial anchors but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/create/action",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/discovery/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/properties/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/query/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/submitdiag/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6670b86e-a3f7-4917-ac9b-5d6ab1be4567",
|                                         "Name":  "Site Recovery Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Site Recovery except vault creation and role assignment; no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.RecoveryServices/locations/allocatedStamp/read",
|                                                         "Microsoft.RecoveryServices/locations/allocateStamp/action",
|                                                         "Microsoft.RecoveryServices/Vaults/certificates/write",
|                                                         "Microsoft.RecoveryServices/Vaults/extendedInformation/*",
|                                                         "Microsoft.RecoveryServices/Vaults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/refreshContainers/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/*",
|                                                         "Microsoft.RecoveryServices/vaults/replicationAlertSettings/*",
|                                                         "Microsoft.RecoveryServices/vaults/replicationEvents/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/*",
|                                                         "Microsoft.RecoveryServices/vaults/replicationJobs/*",
|                                                         "Microsoft.RecoveryServices/vaults/replicationPolicies/*",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/*",
|                                                         "Microsoft.RecoveryServices/vaults/replicationVaultSettings/*",
|                                                         "Microsoft.RecoveryServices/Vaults/storageConfig/*",
|                                                         "Microsoft.RecoveryServices/Vaults/tokenInfo/read",
|                                                         "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                         "Microsoft.RecoveryServices/Vaults/vaultTokens/read",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/*",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/notificationConfiguration/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationOperationStatus/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "494ae006-db33-4328-bf46-533a6560a3ca",
|                                         "Name":  "Site Recovery Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can perform failover/failback but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.RecoveryServices/locations/allocatedStamp/read",
|                                                         "Microsoft.RecoveryServices/locations/allocateStamp/action",
|                                                         "Microsoft.RecoveryServices/Vaults/extendedInformation/read",
|                                                         "Microsoft.RecoveryServices/Vaults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/refreshContainers/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationAlertSettings/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationEvents/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/checkConsistency/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/reassociateGateway/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/renewcertificate/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/replicationNetworkMappings/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectableItems/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/applyRecoveryPoint/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/failoverCommit/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/plannedFailover/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/recoveryPoints/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/repairReplication/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/reProtect/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/switchprotection/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/testFailover/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/testFailoverCleanup/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/unplannedFailover/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/updateMobilityService/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectionContainerMappings/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationRecoveryServicesProviders/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationRecoveryServicesProviders/refreshProvider/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/replicationStorageClassificationMappings/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationvCenters/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationJobs/*",
|                                                         "Microsoft.RecoveryServices/vaults/replicationPolicies/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/failoverCommit/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/plannedFailover/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/reProtect/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/testFailover/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/testFailoverCleanup/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/unplannedFailover/action",
|                                                         "Microsoft.RecoveryServices/vaults/replicationVaultSettings/read",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/*",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/notificationConfiguration/read",
|                                                         "Microsoft.RecoveryServices/Vaults/storageConfig/read",
|                                                         "Microsoft.RecoveryServices/Vaults/tokenInfo/read",
|                                                         "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                         "Microsoft.RecoveryServices/Vaults/vaultTokens/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d51204f-eb77-4b1c-b86a-2ec626c49413",
|                                         "Name":  "Spatial Anchors Account Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to spatial anchors with no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/discovery/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/properties/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/query/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/submitdiag/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dbaa88c4-0c30-4179-9fb3-46319faa6149",
|                                         "Name":  "Site Recovery Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Site Recovery status without ability to modify identity plane or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.RecoveryServices/locations/allocatedStamp/read",
|                                                         "Microsoft.RecoveryServices/Vaults/extendedInformation/read",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringAlerts/read",
|                                                         "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/notificationConfiguration/read",
|                                                         "Microsoft.RecoveryServices/Vaults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/refreshContainers/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/registeredIdentities/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationAlertSettings/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationEvents/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/replicationNetworkMappings/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectableItems/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/recoveryPoints/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectionContainerMappings/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationRecoveryServicesProviders/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/replicationStorageClassificationMappings/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationvCenters/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationJobs/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationPolicies/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationVaultSettings/read",
|                                                         "Microsoft.RecoveryServices/Vaults/storageConfig/read",
|                                                         "Microsoft.RecoveryServices/Vaults/tokenInfo/read",
|                                                         "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                         "Microsoft.RecoveryServices/Vaults/vaultTokens/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "70bbe301-9835-447d-afdd-19eb3167307c",
|                                         "Name":  "Spatial Anchors Account Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages spatial anchors including deletion but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/create/action",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/delete",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/discovery/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/properties/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/query/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/submitdiag/read",
|                                                             "Microsoft.MixedReality/SpatialAnchorsAccounts/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4939a1f6-9ae0-4e48-a1e0-f2cbe897382d",
|                                         "Name":  "SQL Managed Instance Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages SQL Managed Instances and network config but cannot assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/*",
|                                                         "Microsoft.Network/routeTables/*",
|                                                         "Microsoft.Sql/locations/*/read",
|                                                         "Microsoft.Sql/locations/instanceFailoverGroups/*",
|                                                         "Microsoft.Sql/managedInstances/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Network/virtualNetworks/subnets/*",
|                                                         "Microsoft.Network/virtualNetworks/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/metricDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.Sql/managedInstances/azureADOnlyAuthentications/delete",
|                                                            "Microsoft.Sql/managedInstances/azureADOnlyAuthentications/write"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9b7fa17d-e63e-47b0-bb0a-15c516ac86ec",
|                                         "Name":  "SQL DB Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages SQL databases but no access to security policies or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Sql/locations/*/read",
|                                                         "Microsoft.Sql/servers/databases/*",
|                                                         "Microsoft.Sql/servers/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/metricDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.Sql/servers/databases/ledgerDigestUploads/write",
|                                                            "Microsoft.Sql/servers/databases/ledgerDigestUploads/disable/action",
|                                                            "Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*",
|                                                            "Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*",
|                                                            "Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                            "Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*",
|                                                            "Microsoft.Sql/managedInstances/databases/sensitivityLabels/*",
|                                                            "Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*",
|                                                            "Microsoft.Sql/managedInstances/securityAlertPolicies/*",
|                                                            "Microsoft.Sql/managedInstances/vulnerabilityAssessments/*",
|                                                            "Microsoft.Sql/servers/databases/auditingSettings/*",
|                                                            "Microsoft.Sql/servers/databases/auditRecords/read",
|                                                            "Microsoft.Sql/servers/databases/currentSensitivityLabels/*",
|                                                            "Microsoft.Sql/servers/databases/dataMaskingPolicies/*",
|                                                            "Microsoft.Sql/servers/databases/extendedAuditingSettings/*",
|                                                            "Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*",
|                                                            "Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                            "Microsoft.Sql/servers/databases/securityAlertPolicies/*",
|                                                            "Microsoft.Sql/servers/databases/securityMetrics/*",
|                                                            "Microsoft.Sql/servers/databases/sensitivityLabels/*",
|                                                            "Microsoft.Sql/servers/databases/vulnerabilityAssessments/*",
|                                                            "Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*",
|                                                            "Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*",
|                                                            "Microsoft.Sql/servers/vulnerabilityAssessments/*"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "056cd41c-7e88-42e1-933e-88ba6a50c9c3",
|                                         "Name":  "SQL Security Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages security policies of SQL servers/databases but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Sql/locations/administratorAzureAsyncOperation/read",
|                                                         "Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*",
|                                                         "Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*",
|                                                         "Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                         "Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*",
|                                                         "Microsoft.Sql/managedInstances/databases/sensitivityLabels/*",
|                                                         "Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*",
|                                                         "Microsoft.Sql/servers/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Sql/servers/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Sql/managedInstances/securityAlertPolicies/*",
|                                                         "Microsoft.Sql/managedInstances/databases/transparentDataEncryption/*",
|                                                         "Microsoft.Sql/managedInstances/vulnerabilityAssessments/*",
|                                                         "Microsoft.Sql/managedInstances/serverConfigurationOptions/read",
|                                                         "Microsoft.Sql/managedInstances/serverConfigurationOptions/write",
|                                                         "Microsoft.Sql/locations/serverConfigurationOptionAzureAsyncOperation/read",
|                                                         "Microsoft.Sql/servers/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Sql/servers/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Sql/servers/auditingSettings/*",
|                                                         "Microsoft.Sql/servers/extendedAuditingSettings/*",
|                                                         "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Sql/servers/databases/auditingSettings/*",
|                                                         "Microsoft.Sql/servers/databases/auditRecords/read",
|                                                         "Microsoft.Sql/servers/databases/currentSensitivityLabels/*",
|                                                         "Microsoft.Sql/servers/databases/dataMaskingPolicies/*",
|                                                         "Microsoft.Sql/servers/databases/extendedAuditingSettings/read",
|                                                         "Microsoft.Sql/servers/databases/read",
|                                                         "Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*",
|                                                         "Microsoft.Sql/servers/databases/schemas/read",
|                                                         "Microsoft.Sql/servers/databases/schemas/tables/columns/read",
|                                                         "Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                         "Microsoft.Sql/servers/databases/schemas/tables/read",
|                                                         "Microsoft.Sql/servers/databases/securityAlertPolicies/*",
|                                                         "Microsoft.Sql/servers/databases/securityMetrics/*",
|                                                         "Microsoft.Sql/servers/databases/sensitivityLabels/*",
|                                                         "Microsoft.Sql/servers/databases/transparentDataEncryption/*",
|                                                         "Microsoft.Sql/servers/databases/sqlvulnerabilityAssessments/*",
|                                                         "Microsoft.Sql/servers/databases/vulnerabilityAssessments/*",
|                                                         "Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*",
|                                                         "Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*",
|                                                         "Microsoft.Sql/servers/devOpsAuditingSettings/*",
|                                                         "Microsoft.Sql/servers/firewallRules/*",
|                                                         "Microsoft.Sql/servers/read",
|                                                         "Microsoft.Sql/servers/securityAlertPolicies/*",
|                                                         "Microsoft.Sql/servers/sqlvulnerabilityAssessments/*",
|                                                         "Microsoft.Sql/servers/vulnerabilityAssessments/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Sql/servers/azureADOnlyAuthentications/*",
|                                                         "Microsoft.Sql/managedInstances/read",
|                                                         "Microsoft.Sql/managedInstances/azureADOnlyAuthentications/*",
|                                                         "Microsoft.Security/sqlVulnerabilityAssessments/*",
|                                                         "Microsoft.Sql/managedInstances/administrators/read",
|                                                         "Microsoft.Sql/servers/administrators/read",
|                                                         "Microsoft.Sql/servers/databases/ledgerDigestUploads/*",
|                                                         "Microsoft.Sql/locations/ledgerDigestUploadsAzureAsyncOperation/read",
|                                                         "Microsoft.Sql/locations/ledgerDigestUploadsOperationResults/read",
|                                                         "Microsoft.Sql/servers/externalPolicyBasedAuthorizations/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6d8ee4ec-f05a-4a1d-8b00-a9b17e38b437",
|                                         "Name":  "SQL Server Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages SQL servers and databases but no access to security policies or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Sql/locations/*/read",
|                                                         "Microsoft.Sql/servers/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/metricDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*",
|                                                            "Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*",
|                                                            "Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                            "Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*",
|                                                            "Microsoft.Sql/managedInstances/databases/sensitivityLabels/*",
|                                                            "Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*",
|                                                            "Microsoft.Sql/managedInstances/securityAlertPolicies/*",
|                                                            "Microsoft.Sql/managedInstances/vulnerabilityAssessments/*",
|                                                            "Microsoft.Sql/servers/auditingSettings/*",
|                                                            "Microsoft.Sql/servers/databases/auditingSettings/*",
|                                                            "Microsoft.Sql/servers/databases/auditRecords/read",
|                                                            "Microsoft.Sql/servers/databases/currentSensitivityLabels/*",
|                                                            "Microsoft.Sql/servers/databases/dataMaskingPolicies/*",
|                                                            "Microsoft.Sql/servers/databases/extendedAuditingSettings/*",
|                                                            "Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*",
|                                                            "Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                            "Microsoft.Sql/servers/databases/securityAlertPolicies/*",
|                                                            "Microsoft.Sql/servers/databases/securityMetrics/*",
|                                                            "Microsoft.Sql/servers/databases/sensitivityLabels/*",
|                                                            "Microsoft.Sql/servers/databases/vulnerabilityAssessments/*",
|                                                            "Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*",
|                                                            "Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*",
|                                                            "Microsoft.Sql/servers/devOpsAuditingSettings/*",
|                                                            "Microsoft.Sql/servers/extendedAuditingSettings/*",
|                                                            "Microsoft.Sql/servers/securityAlertPolicies/*",
|                                                            "Microsoft.Sql/servers/vulnerabilityAssessments/*",
|                                                            "Microsoft.Sql/servers/azureADOnlyAuthentications/delete",
|                                                            "Microsoft.Sql/servers/azureADOnlyAuthentications/write",
|                                                            "Microsoft.Sql/servers/externalPolicyBasedAuthorizations/delete",
|                                                            "Microsoft.Sql/servers/externalPolicyBasedAuthorizations/write"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cfd33db0-3dd1-45e3-aa9d-cdbdf3b6f24e",
|                                         "Name":  "Support Request Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and manage support requests but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a4b10055-b0c7-44c2-b00f-c7b5b3550cf7",
|                                         "Name":  "Traffic Manager Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Traffic Manager profiles but cannot control access or assign roles; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Network/trafficManagerProfiles/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9980e02c-c2be-4d73-94e8-173b1dc7cf3c",
|                                         "Name":  "Virtual Machine Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages virtual machines but cannot control access or assign roles; no path to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Compute/availabilitySets/*",
|                                                         "Microsoft.Compute/locations/*",
|                                                         "Microsoft.Compute/virtualMachines/*",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/*",
|                                                         "Microsoft.Compute/cloudServices/*",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/hostgroups/write",
|                                                         "Microsoft.Compute/hostgroups/hosts/write",
|                                                         "Microsoft.DevTestLab/schedules/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Network/applicationGateways/backendAddressPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/inboundNatPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
|                                                         "Microsoft.Network/loadBalancers/probes/join/action",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/locations/*",
|                                                         "Microsoft.Network/networkInterfaces/*",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/publicIPAddresses/join/action",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.RecoveryServices/locations/*",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/write",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/*/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/write",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/read",
|                                                         "Microsoft.RecoveryServices/Vaults/backupPolicies/write",
|                                                         "Microsoft.RecoveryServices/Vaults/read",
|                                                         "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                         "Microsoft.RecoveryServices/Vaults/write",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.SerialConsole/serialPorts/connect/action",
|                                                         "Microsoft.SqlVirtualMachine/*",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b",
|                                         "Name":  "Web Plan Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages web plans but cannot control access or assign roles; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Web/serverFarms/*",
|                                                         "Microsoft.Web/hostingEnvironments/Join/Action",
|                                                         "Microsoft.Insights/autoscalesettings/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "de139f84-1756-47ae-9be6-808fbbe84772",
|                                         "Name":  "Website Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages websites but cannot control access or assign roles; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/components/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Web/certificates/*",
|                                                         "Microsoft.Web/listSitesAssignedToHostName/read",
|                                                         "Microsoft.Web/register/action",
|                                                         "Microsoft.Web/serverFarms/join/action",
|                                                         "Microsoft.Web/serverFarms/read",
|                                                         "Microsoft.Web/sites/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bbf86eb8-f7b4-4cce-96e4-18cddf81d86e",
|                                         "Name":  "Attestation Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage attestation providers but no direct or near-direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Attestation/attestationProviders/attestation/read",
|                                                         "Microsoft.Attestation/attestationProviders/attestation/write",
|                                                         "Microsoft.Attestation/attestationProviders/attestation/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "61ed4efc-fab3-44fd-b111-e24485cc132a",
|                                         "Name":  "HDInsight Cluster Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can modify HDInsight cluster configurations but no path to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.HDInsight/*/read",
|                                                         "Microsoft.HDInsight/clusters/getGatewaySettings/action",
|                                                         "Microsoft.HDInsight/clusters/updateGatewaySettings/action",
|                                                         "Microsoft.HDInsight/clusters/configurations/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "230815da-be43-4aae-9cb4-875f7bd000aa",
|                                         "Name":  "Cosmos DB Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Cosmos DB accounts without access to keys or connection strings; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DocumentDb/databaseAccounts/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.DocumentDB/databaseAccounts/copyJobs/*",
|                                                            "Microsoft.DocumentDB/databaseAccounts/dataTransferJobs/*",
|                                                            "Microsoft.DocumentDB/databaseAccounts/readonlyKeys/*",
|                                                            "Microsoft.DocumentDB/databaseAccounts/regenerateKey/*",
|                                                            "Microsoft.DocumentDB/databaseAccounts/listKeys/*",
|                                                            "Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/*",
|                                                            "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions/write",
|                                                            "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions/delete",
|                                                            "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/write",
|                                                            "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/delete",
|                                                            "Microsoft.DocumentDB/databaseAccounts/mongodbRoleDefinitions/write",
|                                                            "Microsoft.DocumentDB/databaseAccounts/mongodbRoleDefinitions/delete",
|                                                            "Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/write",
|                                                            "Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/delete"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "48b40c6e-82e0-4eb3-90d5-19e40f49b624",
|                                         "Name":  "Hybrid Server Resource Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Hybrid servers but no direct identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/machines/*",
|                                                         "Microsoft.HybridCompute/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d1e5ee4-7c68-4a71-ac8b-0739630a3dfb",
|                                         "Name":  "Hybrid Server Onboarding",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can onboard Hybrid servers but no identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b12aa53e-6015-4669-85d0-8515ebb3ae7f",
|                                         "Name":  "Private DNS Zone Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages private DNS zones but cannot modify virtual networks or assign roles; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Network/privateDnsZones/*",
|                                                         "Microsoft.Network/privateDnsOperationResults/*",
|                                                         "Microsoft.Network/privateDnsOperationStatuses/*",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1d18fff3-a72a-46b5-b4a9-0b38a3cd7e63",
|                                         "Name":  "Desktop Virtualization User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows use of applications only; no identity plane control or role assignment capability.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DesktopVirtualization/applicationGroups/useApplications/action",
|                                                             "Microsoft.DesktopVirtualization/appAttachPackages/useApplications/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "41077137-e803-4205-871c-5a86e6a753b4",
|                                         "Name":  "Blueprint Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage blueprint definitions but cannot assign them; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Blueprint/blueprints/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "437d2ced-4a38-4302-8479-ed2bcb43d090",
|                                         "Name":  "Blueprint Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can assign blueprints only with managed identity; no direct identity plane control or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Blueprint/blueprintAssignments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ab8e14d6-4a74-4a29-9ba8-549422addade",
|                                         "Name":  "Microsoft Sentinel Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Sentinel resources but no direct identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.SecurityInsights/*",
|                                                         "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                         "Microsoft.OperationalInsights/workspaces/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/*",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.OperationalInsights/querypacks/*/read",
|                                                         "Microsoft.Insights/workbooks/*",
|                                                         "Microsoft.Insights/myworkbooks/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                            "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3e150937-b8fe-4cfb-8069-0eaf05ecd056",
|                                         "Name":  "Microsoft Sentinel Responder",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can respond to incidents but no direct identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.SecurityInsights/*/read",
|                                                         "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                         "Microsoft.SecurityInsights/automationRules/*",
|                                                         "Microsoft.SecurityInsights/cases/*",
|                                                         "Microsoft.SecurityInsights/incidents/*",
|                                                         "Microsoft.SecurityInsights/entities/runPlaybook/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/bulkTag/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/replaceTags/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/systems/undoAction/action",
|                                                         "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                         "Microsoft.OperationalInsights/workspaces/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.OperationalInsights/querypacks/*/read",
|                                                         "Microsoft.Insights/workbooks/read",
|                                                         "Microsoft.Insights/myworkbooks/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.SecurityInsights/cases/*/Delete",
|                                                            "Microsoft.SecurityInsights/incidents/*/Delete",
|                                                            "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                            "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8d289c81-5878-46d4-8554-54e1e3d8b5cb",
|                                         "Name":  "Microsoft Sentinel Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Sentinel data; no identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.SecurityInsights/*/read",
|                                                         "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                         "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                         "Microsoft.OperationalInsights/workspaces/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/LinkedServices/read",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                         "Microsoft.OperationalInsights/querypacks/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.Insights/workbooks/read",
|                                                         "Microsoft.Insights/myworkbooks/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/templateSpecs/*/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                            "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "66bb4e9e-b016-4a94-8249-4c0511c2be84",
|                                         "Name":  "Policy Insights Data Writer (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can write to policy events but cannot modify role assignments or authentication policies.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/policyassignments/read",
|                                                         "Microsoft.Authorization/policydefinitions/read",
|                                                         "Microsoft.Authorization/policyexemptions/read",
|                                                         "Microsoft.Authorization/policysetdefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.PolicyInsights/checkDataPolicyCompliance/action",
|                                                             "Microsoft.PolicyInsights/policyEvents/logDataEvents/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "04165923-9d83-45d5-8227-78b77b0a687e",
|                                         "Name":  "SignalR AccessKey Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to SignalR keys only; no identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.SignalRService/*/read",
|                                                         "Microsoft.SignalRService/SignalR/listkeys/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8cf5e20a-e4b2-4e9d-b3a1-5ceb692c2761",
|                                         "Name":  "SignalR/Web PubSub Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages SignalR resources but no identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.SignalRService/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b64e21ea-ac4e-4cdf-9dc9-5b892992bee7",
|                                         "Name":  "Azure Connected Machine Onboarding",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can onboard machines but no direct identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/settings/read",
|                                                         "Microsoft.HybridCompute/settings/write",
|                                                         "Microsoft.HybridCompute/gateways/read",
|                                                         "Microsoft.HybridCompute/privateLinkScopes/read",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                         "Microsoft.Insights/dataCollectionRuleAssociations/write",
|                                                         "Microsoft.Insights/dataCollectionRuleAssociations/delete",
|                                                         "Microsoft.Insights/dataCollectionRuleAssociations/read",
|                                                         "Microsoft.HybridCompute/machines/addExtensions/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "91c1777a-f3dc-4fae-b103-61d183457e46",
|                                         "Name":  "Managed Services Registration assignment Delete Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can delete registration assignments but no direct identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.ManagedServices/registrationAssignments/read",
|                                                         "Microsoft.ManagedServices/registrationAssignments/delete",
|                                                         "Microsoft.ManagedServices/operationStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "34e09817-6cbe-4d01-b1a2-e0eac5743d41",
|                                         "Name":  "Kubernetes Cluster - Azure Arc Onboarding",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create connectedClusters resource but no direct identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Kubernetes/connectedClusters/Write",
|                                                         "Microsoft.Kubernetes/connectedClusters/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7f646f1b-fa08-80eb-a22b-edd6ce5c915c",
|                                         "Name":  "Experimentation Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to resource groups and experiment workspaces only; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/read",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/write",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/delete",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/experiment/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/emergencystop/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/read",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/write",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "466ccd10-b268-4a11-b098-b4849f024126",
|                                         "Name":  "Cognitive Services QnA Maker Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and test KB only; no identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/download/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/generateanswer/action",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/alterations/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/endpointkeys/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/endpointsettings/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/download/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/generateanswer/action",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/alterations/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointkeys/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointsettings/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/download/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/generateanswer/action",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/alterations/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointkeys/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointsettings/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f4cc2bf9-21be-47a1-bdf1-5c5804381025",
|                                         "Name":  "Cognitive Services QnA Maker Editor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and edit KB but cannot publish or delete; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/download/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/create/write",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/write",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/generateanswer/action",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/train/action",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/alterations/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/alterations/write",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/endpointkeys/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/endpointkeys/refreshkeys/action",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/endpointsettings/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/endpointsettings/write",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker/operations/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/download/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/create/write",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/write",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/generateanswer/action",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/train/action",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/alterations/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/alterations/write",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointkeys/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointkeys/refreshkeys/action",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointsettings/read",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointsettings/write",
|                                                             "Microsoft.CognitiveServices/accounts/QnAMaker.v2/operations/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/download/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/create/write",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/write",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/generateanswer/action",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/train/action",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/alterations/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/alterations/write",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointkeys/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointkeys/refreshkeys/action",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointsettings/read",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointsettings/write",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/operations/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7f646f1b-fa08-80eb-a33b-edd6ce5c915c",
|                                         "Name":  "Experimentation Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to resource groups and experiment workspaces only; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/admin/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/read",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/write",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/delete",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/experimentadmin/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/experiment/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/emergencystop/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/read",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/write",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/delete",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/admin/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/metricwrite/action",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/metricwrite/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3df8b902-2a6f-47c7-8cc5-360e9b272a7e",
|                                         "Name":  "Remote Rendering Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages rendering sessions and diagnostics but no identity plane control or role assignment capability.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/convert/action",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/convert/read",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/convert/delete",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/read",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/action",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/delete",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/render/read",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/diagnostic/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d39065c4-c120-43c9-ab0a-63eed9795f0a",
|                                         "Name":  "Remote Rendering Client",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages rendering sessions and diagnostics but no identity plane control or role assignment capability.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/read",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/action",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/delete",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/render/read",
|                                                             "Microsoft.MixedReality/RemoteRenderingAccounts/diagnostic/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "641177b8-a67a-45b9-a033-47bc880bb21e",
|                                         "Name":  "Managed Application Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create managed application resources but no role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.Solutions/applications/*",
|                                                         "Microsoft.Solutions/register/action",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/*",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "612c2aa1-cb24-443b-ac28-3ab7272de6f5",
|                                         "Name":  "Security Assessment Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can push security assessments but cannot modify roles or authentication policies.",
|                                         "Actions":  [
|                                                         "Microsoft.Security/assessments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4a9ae827-6dc8-4573-8ac7-8239d42aa03f",
|                                         "Name":  "Tag Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages tags only without access to underlying resources or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/resources/read",
|                                                         "Microsoft.Resources/subscriptions/resources/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Resources/tags/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c7aa55d3-1abb-444a-a5ca-5e51e485d6ec",
|                                         "Name":  "Integration Service Environment Developer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and update workflows but no identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Logic/integrationServiceEnvironments/read",
|                                                         "Microsoft.Logic/integrationServiceEnvironments/*/join/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a41e2c5b-bd99-4a07-88f4-9bf657a760b8",
|                                         "Name":  "Integration Service Environment Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages integration service environments but no identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Logic/integrationServiceEnvironments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8",
|                                         "Name":  "Azure Kubernetes Service Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage AKS clusters but no direct identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ContainerService/locations/*",
|                                                         "Microsoft.ContainerService/managedClusters/*",
|                                                         "Microsoft.ContainerService/managedclustersnapshots/*",
|                                                         "Microsoft.ContainerService/snapshots/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/deploymentSafeguards/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "350f8d15-c687-4448-8ae1-157740a3936d",
|                                         "Name":  "Hierarchy Settings Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can edit and delete management group settings but no role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Management/managementGroups/settings/write",
|                                                         "Microsoft.Management/managementGroups/settings/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "49632ef5-d9ac-41f4-b8e7-bbe587fa74a1",
|                                         "Name":  "Experimentation Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to experimentation workspaces with no identity plane impact or escalation path.",
|                                         "Actions":  [
|                                                         "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Experimentation/experimentWorkspaces/read",
|                                                             "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "93586559-c37d-4a6b-ba08-b9f0940c2d73",
|                                         "Name":  "Cognitive Services Custom Vision Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only project access with no path to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVision/projects/predictions/query/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "21090545-7ca7-4776-b22c-e363652d74d2",
|                                         "Name":  "Key Vault Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read metadata only, no access to sensitive values or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.KeyVault/checkNameAvailability/read",
|                                                         "Microsoft.KeyVault/deletedVaults/read",
|                                                         "Microsoft.KeyVault/locations/*/read",
|                                                         "Microsoft.KeyVault/vaults/*/read",
|                                                         "Microsoft.KeyVault/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/*/read",
|                                                             "Microsoft.KeyVault/vaults/secrets/readMetadata/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "82200a5b-e217-47a5-b665-6d8765ee745b",
|                                         "Name":  "Services Hub Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Services Hub connectors only, no path to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.ServicesHub/connectors/write",
|                                                         "Microsoft.ServicesHub/connectors/read",
|                                                         "Microsoft.ServicesHub/connectors/delete",
|                                                         "Microsoft.ServicesHub/connectors/checkAssessmentEntitlement/action",
|                                                         "Microsoft.ServicesHub/connectors/*",
|                                                         "Microsoft.ServicesHub/*",
|                                                         "Microsoft.ServicesHub/supportOfferingEntitlement/read",
|                                                         "Microsoft.ServicesHub/workspaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d18777c0-1514-4662-8490-608db7d334b6",
|                                         "Name":  "Object Understanding Account Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to ingestion jobs with no identity plane impact.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/ObjectUnderstandingAccounts/ingest/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e9dba6fb-3d52-4cf0-bce3-f06ce71b9e0f",
|                                         "Name":  "Device Update Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to device update management and content, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.DeviceUpdate/accounts/read",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/read",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/management/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d1ee9a80-8b14-47f0-bdc2-f4a351625a7b",
|                                         "Name":  "Device Update Content Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to content operations, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.DeviceUpdate/accounts/read",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3b20f47b-3825-43cb-8114-4bd2201156a8",
|                                         "Name":  "Cognitive Services Metrics Advisor User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access to metrics project only, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/MetricsAdvisor/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2c56ea50-c6b3-40a6-83c0-9d98858bc7d2",
|                                         "Name":  "Schema Registry Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to schema registry groups and schemas, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.EventHub/namespaces/schemagroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventHub/namespaces/schemas/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7ec7ccdc-f61e-41fe-9aaf-980df0a44eba",
|                                         "Name":  "AgFood Platform Service Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to AgFood Platform Service, no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/*/list/action",
|                                                             "Microsoft.AgFoodPlatform/*/read",
|                                                             "Microsoft.AgFoodPlatform/*/search/action",
|                                                             "Microsoft.AgFoodPlatform/*/download/action",
|                                                             "Microsoft.AgFoodPlatform/*/overlap/action",
|                                                             "Microsoft.AgFoodPlatform/*/checkConsent/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0b555d9b-b4a7-4f43-b330-627f0e5be8f0",
|                                         "Name":  "Security Detonation Chamber Submitter",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allowed to create submissions only, no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/delete",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/write",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/read",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/files/read",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/accesskeyview/read",
|                                                             "Microsoft.SecurityDetonation/chambers/platforms/metadata/read",
|                                                             "Microsoft.SecurityDetonation/chambers/workflows/metadata/read",
|                                                             "Microsoft.SecurityDetonation/chambers/toolsets/metadata/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ddde6b66-c0df-4114-a159-3618637b3035",
|                                         "Name":  "SignalR REST API Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to SignalR REST APIs, no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SignalRService/SignalR/group/read",
|                                                             "Microsoft.SignalRService/SignalR/clientConnection/read",
|                                                             "Microsoft.SignalRService/SignalR/user/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f7b75c60-3036-4b75-91c3-6b41c27c1689",
|                                         "Name":  "Reservation Purchaser",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can purchase reservations but no identity plane control or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Capacity/catalogs/read",
|                                                         "Microsoft.Capacity/register/action",
|                                                         "Microsoft.Compute/register/action",
|                                                         "Microsoft.Consumption/register/action",
|                                                         "Microsoft.Consumption/reservationRecommendationDetails/read",
|                                                         "Microsoft.Consumption/reservationRecommendations/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.SQL/register/action",
|                                                         "Microsoft.Support/supporttickets/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9ef4ef9c-a049-46b0-82ab-dd8ac094c889",
|                                         "Name":  "Project Babylon Data Curator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and modify catalog data objects only; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ProjectBabylon/accounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ProjectBabylon/accounts/data/read",
|                                                             "Microsoft.ProjectBabylon/accounts/data/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c8d896ba-346d-4f50-bc1d-7d1c84130446",
|                                         "Name":  "Project Babylon Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to catalog data objects; no path to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ProjectBabylon/accounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ProjectBabylon/accounts/data/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "05b7651b-dc44-475e-b74d-df3db49fae0f",
|                                         "Name":  "Project Babylon Data Source Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage data sources and scans without identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ProjectBabylon/accounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ProjectBabylon/accounts/scan/read",
|                                                             "Microsoft.ProjectBabylon/accounts/scan/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ca6382a4-1721-4bcf-a114-ff0c70227b6b",
|                                         "Name":  "Application Group Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage application groups and related resources without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/applicationgroups/*",
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                         "Microsoft.DesktopVirtualization/workspaces/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "49a72310-ab8d-41df-bbb0-79b649203868",
|                                         "Name":  "Desktop Virtualization Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to desktop virtualization resources; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "082f0a83-3be5-4ba1-904c-961cca79b387",
|                                         "Name":  "Desktop Virtualization Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to desktop virtualization resources without identity or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "21efdde3-836f-432b-bf3d-3e8e734d4b2b",
|                                         "Name":  "Desktop Virtualization Workspace Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage desktop virtualization workspace resources without identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/workspaces/*",
|                                                         "Microsoft.DesktopVirtualization/applicationgroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ea4bfff8-7fb4-485a-aadd-d4129a0ffaa6",
|                                         "Name":  "Desktop Virtualization User Session Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage user sessions but no permissions to escalate to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2ad6aaab-ead9-4eaa-8ac5-da422f562408",
|                                         "Name":  "Desktop Virtualization Session Host Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage session hosts without identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ceadfde2-b300-400a-ab7b-6143895aa822",
|                                         "Name":  "Desktop Virtualization Host Pool Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to host pools; no path to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/hostpools/*/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e307426c-f9b6-4e81-87de-d99efb3c32bc",
|                                         "Name":  "Desktop Virtualization Host Pool Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to host pools without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/hostpools/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "aebf23d0-b568-4e86-b8f9-fe83a2c6ab55",
|                                         "Name":  "Desktop Virtualization Application Group Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to application groups; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/applicationgroups/*/read",
|                                                         "Microsoft.DesktopVirtualization/applicationgroups/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "86240b0e-9422-4c43-887b-b61143f32ba8",
|                                         "Name":  "Desktop Virtualization Application Group Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to application groups without identity or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/applicationgroups/*",
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0fa44ee9-7a7d-466b-9bb2-2bf446b1204d",
|                                         "Name":  "Desktop Virtualization Workspace Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to desktop virtualization workspace; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/workspaces/read",
|                                                         "Microsoft.DesktopVirtualization/applicationgroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3e5e47e6-65f7-47ef-90b5-e5dd4d455f24",
|                                         "Name":  "Disk Backup Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to disks and backup actions; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b50d9833-a0cb-478e-945f-707fcc997c13",
|                                         "Name":  "Disk Restore Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Write access to disks for restore operations; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action",
|                                                         "Microsoft.Compute/disks/endGetAccess/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7efff54f-a5b4-42b5-a1c5-5411624893ce",
|                                         "Name":  "Disk Snapshot Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage disk snapshots without identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Compute/snapshots/delete",
|                                                         "Microsoft.Compute/snapshots/write",
|                                                         "Microsoft.Compute/snapshots/read",
|                                                         "Microsoft.Compute/snapshots/beginGetAccess/action",
|                                                         "Microsoft.Compute/snapshots/endGetAccess/action",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action",
|                                                         "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5548b2cf-c94c-4228-90ba-30851930a12f",
|                                         "Name":  "Microsoft.Kubernetes connected cluster role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Kubernetes connected clusters without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Kubernetes/connectedClusters/read",
|                                                         "Microsoft.Kubernetes/connectedClusters/write",
|                                                         "Microsoft.Kubernetes/connectedClusters/delete",
|                                                         "Microsoft.Kubernetes/registeredSubscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a37b566d-3efa-4beb-a2f2-698963fa42ce",
|                                         "Name":  "Security Detonation Chamber Submission Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage submissions without identity or role assignment rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/delete",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/write",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/read",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/files/read",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/accesskeyview/read",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/adminview/read",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/analystview/read",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/publicview/read",
|                                                             "Microsoft.SecurityDetonation/chambers/platforms/metadata/read",
|                                                             "Microsoft.SecurityDetonation/chambers/workflows/metadata/read",
|                                                             "Microsoft.SecurityDetonation/chambers/toolsets/metadata/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "352470b3-6a9c-4686-b503-35deb827e500",
|                                         "Name":  "Security Detonation Chamber Publisher",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Publish and modify platforms without identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SecurityDetonation/chambers/platforms/read",
|                                                             "Microsoft.SecurityDetonation/chambers/platforms/write",
|                                                             "Microsoft.SecurityDetonation/chambers/platforms/delete",
|                                                             "Microsoft.SecurityDetonation/chambers/platforms/metadata/read",
|                                                             "Microsoft.SecurityDetonation/chambers/workflows/read",
|                                                             "Microsoft.SecurityDetonation/chambers/workflows/write",
|                                                             "Microsoft.SecurityDetonation/chambers/workflows/delete",
|                                                             "Microsoft.SecurityDetonation/chambers/workflows/metadata/read",
|                                                             "Microsoft.SecurityDetonation/chambers/toolsets/read",
|                                                             "Microsoft.SecurityDetonation/chambers/toolsets/write",
|                                                             "Microsoft.SecurityDetonation/chambers/toolsets/delete",
|                                                             "Microsoft.SecurityDetonation/chambers/toolsets/metadata/read",
|                                                             "Microsoft.SecurityDetonation/chambers/publishRequests/read",
|                                                             "Microsoft.SecurityDetonation/chambers/publishRequests/cancel/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7a6f0e70-c033-4fb1-828c-08514e5f4102",
|                                         "Name":  "Collaborative Runtime Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage runtime resources without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.IndustryDataLifecycle/derivedModels/*",
|                                                         "Microsoft.IndustryDataLifecycle/pipelineSets/*",
|                                                         "Microsoft.IndustryDataLifecycle/modelMappings/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5432c526-bc82-444a-b7ba-57c5b0b5b34f",
|                                         "Name":  "CosmosRestoreOperator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Perform restore actions on Cosmos DB without identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DocumentDB/locations/restorableDatabaseAccounts/restore/action",
|                                                         "Microsoft.DocumentDB/locations/restorableDatabaseAccounts/*/read",
|                                                         "Microsoft.DocumentDB/locations/restorableDatabaseAccounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a1705bd2-3a8f-45a5-8683-466fcfd5cc24",
|                                         "Name":  "FHIR Data Converter",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Convert data formats without identity or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/convertData/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/convertData/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0e5f05e5-9ab9-446b-b98d-1e2157c94125",
|                                         "Name":  "Quota Request Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and create quota requests without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Capacity/resourceProviders/locations/serviceLimits/read",
|                                                         "Microsoft.Capacity/resourceProviders/locations/serviceLimits/write",
|                                                         "Microsoft.Capacity/resourceProviders/locations/serviceLimitsRequests/read",
|                                                         "Microsoft.Capacity/register/action",
|                                                         "Microsoft.Quota/usages/read",
|                                                         "Microsoft.Quota/quotas/read",
|                                                         "Microsoft.Quota/quotas/write",
|                                                         "Microsoft.Quota/quotaRequests/read",
|                                                         "Microsoft.Quota/register/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1e241071-0855-49ea-94dc-649edcd759de",
|                                         "Name":  "EventGrid Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage EventGrid operations without identity or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.EventGrid/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "28241645-39f8-410b-ad48-87863e2951d5",
|                                         "Name":  "Security Detonation Chamber Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to submission info; no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/read",
|                                                             "Microsoft.SecurityDetonation/chambers/submissions/files/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4a167cdf-cb95-4554-9203-2347fe489bd9",
|                                         "Name":  "Object Anchors Account Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read ingestion jobs without identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/ObjectAnchorsAccounts/ingest/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ca0835dd-bacc-42dd-8ed2-ed5e7230d15b",
|                                         "Name":  "Object Anchors Account Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Ingestion capabilities only; no identity or role assignment rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/ObjectAnchorsAccounts/ingest/action",
|                                                             "Microsoft.MixedReality/ObjectAnchorsAccounts/ingest/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d17ce0a2-0697-43bc-aac5-9113337ab61c",
|                                         "Name":  "WorkloadBuilder Migration Agent Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write migration agents without identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.WorkloadBuilder/migrationAgents/Read",
|                                                         "Microsoft.WorkloadBuilder/migrationAgents/Write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b5537268-8956-4941-a8f0-646150406f0c",
|                                         "Name":  "Azure Spring Cloud Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Azure Spring Cloud data; no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0e75ca1e-0464-4b4d-8b93-68208a576181",
|                                         "Name":  "Cognitive Services Speech Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage speech projects without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVoice/*",
|                                                             "Microsoft.CognitiveServices/accounts/AudioContentCreation/*",
|                                                             "Microsoft.CognitiveServices/accounts/TTSPlayer/*",
|                                                             "Microsoft.CognitiveServices/accounts/VideoTranslation/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomAvatar/*",
|                                                             "Microsoft.CognitiveServices/accounts/BatchAvatar/*",
|                                                             "Microsoft.CognitiveServices/accounts/BatchTextToSpeech/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9894cab4-e18a-44aa-828b-cb588cd6f2d7",
|                                         "Name":  "Cognitive Services Face Recognizer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Perform inferencing operations only; no identity or role assignment rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/Face/detect/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/verify/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/identify/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/group/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/findsimilars/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/detectliveness/multimodal/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/detectliveness/singlemodal/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/detectlivenesswithverify/singlemodal/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/*/sessions/action",
|                                                             "Microsoft.CognitiveServices/accounts/Face/*/sessions/delete",
|                                                             "Microsoft.CognitiveServices/accounts/Face/*/sessions/read",
|                                                             "Microsoft.CognitiveServices/accounts/Face/*/sessions/audit/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1ec5b3c1-b17e-4e25-8312-2acb3c3c5abf",
|                                         "Name":  "Stream Analytics Query Tester",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Perform query testing without creating jobs or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.StreamAnalytics/locations/TestQuery/action",
|                                                         "Microsoft.StreamAnalytics/locations/OperationResults/read",
|                                                         "Microsoft.StreamAnalytics/locations/SampleInput/action",
|                                                         "Microsoft.StreamAnalytics/locations/CompileQuery/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a2138dac-4907-4679-a376-736901ed8ad8",
|                                         "Name":  "AnyBuild Builder",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Basic user role for build execution; no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AnyBuild/clusters/build/write",
|                                                             "Microsoft.AnyBuild/clusters/build/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b447c946-2db7-41ec-983d-d8bf3b1c77e3",
|                                         "Name":  "IoT Hub Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to IoT Hub data plane; no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Devices/IotHubs/*/read",
|                                                             "Microsoft.Devices/IotHubs/fileUpload/notifications/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "494bdba2-168f-4f31-a0a1-191d2f7c028c",
|                                         "Name":  "IoT Hub Twin Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to device twins without identity or role assignment rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Devices/IotHubs/twins/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4ea46cd5-c1b2-4a8e-910b-273211f9ce47",
|                                         "Name":  "IoT Hub Registry Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to device registry without identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Devices/IotHubs/devices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4fc6c259-987e-4a07-842e-c321cc9d413f",
|                                         "Name":  "IoT Hub Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full data plane access without identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Devices/IotHubs/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "15e0f5a1-3450-4248-8e25-e2afe88a9e85",
|                                         "Name":  "Test Base Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "View and download test packages; no identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.TestBase/testBaseAccounts/packages/testResults/getDownloadUrl/action",
|                                                         "Microsoft.TestBase/testBaseAccounts/packages/testResults/getVideoDownloadUrl/action",
|                                                         "Microsoft.TestBase/testBaseAccounts/packages/getDownloadUrl/action",
|                                                         "Microsoft.TestBase/*/read",
|                                                         "Microsoft.TestBase/testBaseAccounts/customerEvents/write",
|                                                         "Microsoft.TestBase/testBaseAccounts/customerEvents/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1407120a-92aa-4202-b7e9-c0e197c71c8f",
|                                         "Name":  "Search Index Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to search index data; no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Search/searchServices/indexes/documents/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8ebe5a00-799e-43f5-93ac-243d3dce84a7",
|                                         "Name":  "Search Index Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to search index data without identity or role assignment rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Search/searchServices/indexes/documents/*",
|                                                             "Microsoft.Search/searchServices/indexes/contentSecurity/elevatedOperations/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "76199698-9eea-4c19-bc75-cec21354c6b6",
|                                         "Name":  "Storage Table Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to storage tables; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/tableServices/tables/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/tableServices/tables/entities/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3",
|                                         "Name":  "Storage Table Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read, write, delete storage tables without identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/tableServices/tables/read",
|                                                         "Microsoft.Storage/storageAccounts/tableServices/tables/write",
|                                                         "Microsoft.Storage/storageAccounts/tableServices/tables/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/tableServices/tables/entities/read",
|                                                             "Microsoft.Storage/storageAccounts/tableServices/tables/entities/write",
|                                                             "Microsoft.Storage/storageAccounts/tableServices/tables/entities/delete",
|                                                             "Microsoft.Storage/storageAccounts/tableServices/tables/entities/add/action",
|                                                             "Microsoft.Storage/storageAccounts/tableServices/tables/entities/update/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e89c7a3c-2f64-4fa1-a847-3e4c9ba4283a",
|                                         "Name":  "DICOM Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and search DICOM data; no identity or role assignment rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/workspaces/dicomservices/resources/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "58a3b984-7adf-4c20-983a-32417c86fbc8",
|                                         "Name":  "DICOM Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to DICOM data without identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/workspaces/dicomservices/resources/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d5a91429-5739-47e2-a06b-3470a27159e7",
|                                         "Name":  "EventGrid Data Sender",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Send access to EventGrid events; no identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.EventGrid/topics/read",
|                                                         "Microsoft.EventGrid/domains/read",
|                                                         "Microsoft.EventGrid/partnerNamespaces/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.EventGrid/namespaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventGrid/events/send/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "60fc6e62-5479-42d4-8bf4-67625fcc2840",
|                                         "Name":  "Disk Pool Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage disks in disk pool without identity or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f6c7c914-8db3-469d-8ca1-694a8f32e121",
|                                         "Name":  "AzureML Data Scientist",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage ML workspace resources except compute and workspace settings; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/*/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/*/action",
|                                                         "Microsoft.MachineLearningServices/workspaces/*/delete",
|                                                         "Microsoft.MachineLearningServices/workspaces/*/write"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.MachineLearningServices/workspaces/delete",
|                                                            "Microsoft.MachineLearningServices/workspaces/write",
|                                                            "Microsoft.MachineLearningServices/workspaces/computes/*/write",
|                                                            "Microsoft.MachineLearningServices/workspaces/computes/*/delete",
|                                                            "Microsoft.MachineLearningServices/workspaces/computes/listKeys/action",
|                                                            "Microsoft.MachineLearningServices/workspaces/listKeys/action",
|                                                            "Microsoft.MachineLearningServices/workspaces/hubs/write",
|                                                            "Microsoft.MachineLearningServices/workspaces/hubs/delete",
|                                                            "Microsoft.MachineLearningServices/workspaces/featurestores/write",
|                                                            "Microsoft.MachineLearningServices/workspaces/featurestores/delete"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "22926164-76b3-42b3-bc55-97df8dab3e41",
|                                         "Name":  "Grafana Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Grafana server settings and access; no Azure identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Dashboard/grafana/ActAsGrafanaAdmin/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e8113dce-c529-4d33-91fa-e9b972617508",
|                                         "Name":  "Azure Connected SQL Server Onboarding",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to Azure Arc SQL Server instances; no identity or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureArcData/sqlServerInstances/read",
|                                                         "Microsoft.AzureArcData/sqlServerInstances/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "26baccc8-eea7-41f1-98f4-1762cc7f685d",
|                                         "Name":  "Azure Relay Sender",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Send access to Azure Relay resources does not provide any identity plane control or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Relay/*/wcfRelays/read",
|                                                         "Microsoft.Relay/*/hybridConnections/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Relay/*/send/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2787bf04-f1f5-4bfe-8383-c8a24483ee38",
|                                         "Name":  "Azure Relay Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Azure Relay resources is limited to data plane and resource management, no direct identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Relay/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Relay/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "26e0b698-aa6d-4085-9386-aadae190014d",
|                                         "Name":  "Azure Relay Listener",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Listen access to Azure Relay resources is read-only and does not enable identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Relay/*/wcfRelays/read",
|                                                         "Microsoft.Relay/*/hybridConnections/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Relay/*/listen/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "60921a7e-fef1-4a43-9b16-a26c52ad4769",
|                                         "Name":  "Grafana Viewer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "View-only access to dashboards and data sources with no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Dashboard/grafana/ActAsGrafanaViewer/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a79a5197-3a5c-4973-a920-486035ffd60f",
|                                         "Name":  "Grafana Editor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and edit dashboards but lacks permissions to affect identity or role assignments.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Dashboard/grafana/ActAsGrafanaEditor/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f353d9bd-d4a6-484e-a77a-8050b599b867",
|                                         "Name":  "Automation Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages automation resources but lacks permissions to assign roles or modify identity plane settings.",
|                                         "Actions":  [
|                                                         "Microsoft.Automation/automationAccounts/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/ActionGroups/*",
|                                                         "Microsoft.Insights/ActivityLogAlerts/*",
|                                                         "Microsoft.Insights/MetricAlerts/*",
|                                                         "Microsoft.Insights/ScheduledQueryRules/*",
|                                                         "Microsoft.Insights/diagnosticSettings/*",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedKeys/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "85cb6faf-e071-4c9b-8136-154b5a04f717",
|                                         "Name":  "Kubernetes Extension Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage Kubernetes extensions but no permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.KubernetesConfiguration/register/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "10745317-c249-44a1-a5ce-3a4353c0bbd8",
|                                         "Name":  "Device Provisioning Service Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to device provisioning data with no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Devices/provisioningServices/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dfce44e4-17b7-4bd1-a6d1-04996ec95633",
|                                         "Name":  "Device Provisioning Service Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full data-plane operations on device provisioning service but no identity or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Devices/provisioningServices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2837e146-70d7-4cfd-ad55-7efa6464f958",
|                                         "Name":  "Artifact Signing Certificate Profile Signer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can sign files but lacks permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.CodeSigning/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CodeSigning/certificateProfiles/Sign/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cff1b556-2399-4e7e-856d-a8f754be7b65",
|                                         "Name":  "Azure Spring Cloud Service Registry Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to service registry with no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/eurekaService/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f5880b48-c26d-48be-b172-7927bfa1c8f1",
|                                         "Name":  "Azure Spring Cloud Service Registry Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read/write/delete access to service registry but no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/eurekaService/read",
|                                                             "Microsoft.AppPlatform/Spring/eurekaService/write",
|                                                             "Microsoft.AppPlatform/Spring/eurekaService/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d04c6db6-4947-4782-9e91-30a88feb7be7",
|                                         "Name":  "Azure Spring Cloud Config Server Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to config server with no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/configService/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a06f5c24-21a7-4e1a-aa2b-f19eb6684f5b",
|                                         "Name":  "Azure Spring Cloud Config Server Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read/write/delete access to config server but no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/configService/read",
|                                                             "Microsoft.AppPlatform/Spring/configService/write",
|                                                             "Microsoft.AppPlatform/Spring/configService/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6ae96244-5829-4925-a7d3-5975537d91dd",
|                                         "Name":  "Azure VM Managed identities restore Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only authorization permissions without ability to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6be48352-4f82-47c9-ad5e-0acacefdb005",
|                                         "Name":  "Azure Maps Search and Render Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Limited data API access with no identity or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Maps/accounts/services/render/read",
|                                                             "Microsoft.Maps/accounts/services/search/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dba33070-676a-4fb0-87fa-064dc56ff7fb",
|                                         "Name":  "Azure Maps Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Resource management permissions without identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Maps/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b748a06d-6150-4f8a-aaa9-ce3940cd96cb",
|                                         "Name":  "Azure Arc VMware VM Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full VM actions but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ConnectedVMwarevSphere/virtualmachines/*",
|                                                         "Microsoft.ConnectedVMwarevSphere/virtualmachineinstances/*",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                         "Microsoft.HybridCompute/machines/installPatches/action",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.HybridCompute/locations/operationresults/read",
|                                                         "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                         "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/write",
|                                                         "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                         "Microsoft.HybridCompute/licenses/read",
|                                                         "Microsoft.HybridCompute/licenses/write",
|                                                         "Microsoft.HybridCompute/licenses/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ce551c02-7c42-47e0-9deb-e3b6fc3a9a83",
|                                         "Name":  "Azure Arc VMware Private Cloud User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permissions to deploy VMs but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ConnectedVMwarevSphere/virtualnetworks/join/action",
|                                                         "Microsoft.ConnectedVMwarevSphere/virtualnetworks/Read",
|                                                         "Microsoft.ConnectedVMwarevSphere/virtualmachinetemplates/clone/action",
|                                                         "Microsoft.ConnectedVMwarevSphere/virtualmachinetemplates/Read",
|                                                         "Microsoft.ConnectedVMwarevSphere/resourcepools/deploy/action",
|                                                         "Microsoft.ConnectedVMwarevSphere/resourcepools/Read",
|                                                         "Microsoft.ConnectedVMwarevSphere/hosts/deploy/action",
|                                                         "Microsoft.ConnectedVMwarevSphere/hosts/Read",
|                                                         "Microsoft.ConnectedVMwarevSphere/clusters/deploy/action",
|                                                         "Microsoft.ConnectedVMwarevSphere/clusters/Read",
|                                                         "Microsoft.ConnectedVMwarevSphere/datastores/allocateSpace/action",
|                                                         "Microsoft.ConnectedVMwarevSphere/datastores/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ddc140ed-e463-4246-9145-7c664192013f",
|                                         "Name":  "Azure Arc VMware Administrator role ",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full VMwarevSphere actions but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ConnectedVMwarevSphere/*",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                         "Microsoft.HybridCompute/machines/installPatches/action",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.HybridCompute/locations/operationresults/read",
|                                                         "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                         "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/write",
|                                                         "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                         "Microsoft.HybridCompute/licenses/read",
|                                                         "Microsoft.HybridCompute/licenses/write",
|                                                         "Microsoft.HybridCompute/licenses/delete",
|                                                         "Microsoft.ExtendedLocation/customLocations/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f72c8140-2111-481c-87ff-72b910f6e3f8",
|                                         "Name":  "Cognitive Services LUIS Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to LUIS functions but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.CognitiveServices/accounts/listkeys/action",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/LUIS/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7628b7b8-a8b2-4cdc-b46f-e9b35248918e",
|                                         "Name":  "Cognitive Services Language Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and test functions only, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/LanguageAuthoring/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/projects/export/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/Language/*/projects/export/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/query-text/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/query-dataverse/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/analyze-text/jobs/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/analyze-text/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/analyze-text/jobscancel/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/analyze-conversations/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/analyze-conversations/jobscancel/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/analyze-conversations/jobs/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/query-knowledgebases/action",
|                                                             "Microsoft.CognitiveServices/accounts/Language/generate/action",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f2310ca1-dc64-4889-bb49-c8e0fa3d47a8",
|                                         "Name":  "Cognitive Services Language Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write functions without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/LanguageAuthoring/*",
|                                                             "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/*",
|                                                             "Microsoft.CognitiveServices/accounts/Language/*",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f07febfe-79bc-46b1-8b37-790e26e6e498",
|                                         "Name":  "Cognitive Services Language Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full Language portal access but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.CognitiveServices/accounts/listkeys/action",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/LanguageAuthoring/*",
|                                                             "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/*",
|                                                             "Microsoft.CognitiveServices/accounts/Language/*",
|                                                             "Microsoft.CognitiveServices/accounts/TextAnalytics/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "18e81cdc-4e98-4e29-a639-e7d10c5a6226",
|                                         "Name":  "Cognitive Services LUIS Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and test functions only, no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/LUIS/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/LUIS/apps/testdatasets/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6322a993-d5c9-4bed-b113-e49bbea25b27",
|                                         "Name":  "Cognitive Services LUIS Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write functions without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/LUIS/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a9a19cc5-31f4-447c-901f-56c0bb18fcaf",
|                                         "Name":  "PlayFab Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to PlayFab resources with no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.PlayFab/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "749a398d-560b-491b-bb21-08924219302e",
|                                         "Name":  "Load Test Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage load tests but lacks permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.LoadTestService/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.LoadTestService/PlaywrightWorkspaces/*",
|                                                            "Microsoft.LoadTestService/locations/PlaywrightQuotas/*"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.LoadTestService/loadtests/*",
|                                                             "Microsoft.LoadTestService/testProfiles/*",
|                                                             "Microsoft.LoadTestService/testProfileRuns/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "45bb0b16-2f0c-4e78-afaa-a07599b003f6",
|                                         "Name":  "Load Test Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full load test resource control but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.LoadTestService/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.LoadTestService/PlaywrightWorkspaces/*",
|                                                            "Microsoft.LoadTestService/locations/PlaywrightQuotas/*"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.LoadTestService/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0c8b84dc-067c-4039-9615-fa1a4b77c726",
|                                         "Name":  "PlayFab Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor access to PlayFab resources without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.PlayFab/*/read",
|                                                         "Microsoft.PlayFab/*/write",
|                                                         "Microsoft.PlayFab/*/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3ae3fb29-0000-4ccd-bf80-542e7b26e081",
|                                         "Name":  "Load Test Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to load test resources with no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.LoadTestService/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.LoadTestService/PlaywrightWorkspaces/*",
|                                                            "Microsoft.LoadTestService/locations/PlaywrightQuotas/*"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.LoadTestService/loadtests/readTest/action",
|                                                             "Microsoft.LoadTestService/testProfiles/read",
|                                                             "Microsoft.LoadTestService/testProfileRuns/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b2de6794-95db-4659-8781-7e080d3f2b9d",
|                                         "Name":  "Cognitive Services Immersive Reader User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access to create sessions and call APIs without identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/ImmersiveReader/getcontentmodelforreader/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f69b8690-cc87-41d6-b77a-a4bc3c0a966f",
|                                         "Name":  "Lab Services Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage lab services but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.LabServices/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.LabServices/labPlans/createLab/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2a5c394f-5eb7-4d4f-9c8e-e8eae39faebc",
|                                         "Name":  "Lab Services Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to lab services with no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.LabServices/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ce40b423-cede-4313-a93f-9b28290b72e1",
|                                         "Name":  "Lab Assistant",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only and invite actions without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.LabServices/labPlans/images/read",
|                                                         "Microsoft.LabServices/labPlans/read",
|                                                         "Microsoft.LabServices/labs/read",
|                                                         "Microsoft.LabServices/labs/schedules/read",
|                                                         "Microsoft.LabServices/labs/users/read",
|                                                         "Microsoft.LabServices/labs/users/invite/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/read",
|                                                         "Microsoft.LabServices/labs/virtualMachines/start/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/stop/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/reimage/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/redeploy/action",
|                                                         "Microsoft.LabServices/locations/usages/read",
|                                                         "Microsoft.LabServices/skus/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a36e6959-b6be-4b12-8e9f-ef4b474d304d",
|                                         "Name":  "Lab Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can publish and save images but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.LabServices/labPlans/images/read",
|                                                         "Microsoft.LabServices/labPlans/read",
|                                                         "Microsoft.LabServices/labPlans/saveImage/action",
|                                                         "Microsoft.LabServices/labs/publish/action",
|                                                         "Microsoft.LabServices/labs/read",
|                                                         "Microsoft.LabServices/labs/schedules/read",
|                                                         "Microsoft.LabServices/labs/schedules/write",
|                                                         "Microsoft.LabServices/labs/schedules/delete",
|                                                         "Microsoft.LabServices/labs/users/read",
|                                                         "Microsoft.LabServices/labs/users/write",
|                                                         "Microsoft.LabServices/labs/users/delete",
|                                                         "Microsoft.LabServices/labs/users/invite/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/read",
|                                                         "Microsoft.LabServices/labs/virtualMachines/start/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/stop/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/reimage/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/redeploy/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/resetPassword/action",
|                                                         "Microsoft.LabServices/locations/usages/read",
|                                                         "Microsoft.LabServices/skus/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5daaa2af-1fe8-407c-9122-bba179798270",
|                                         "Name":  "Lab Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Write and delete lab resources but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.LabServices/labPlans/images/read",
|                                                         "Microsoft.LabServices/labPlans/read",
|                                                         "Microsoft.LabServices/labPlans/saveImage/action",
|                                                         "Microsoft.LabServices/labs/read",
|                                                         "Microsoft.LabServices/labs/write",
|                                                         "Microsoft.LabServices/labs/delete",
|                                                         "Microsoft.LabServices/labs/publish/action",
|                                                         "Microsoft.LabServices/labs/syncGroup/action",
|                                                         "Microsoft.LabServices/labs/schedules/read",
|                                                         "Microsoft.LabServices/labs/schedules/write",
|                                                         "Microsoft.LabServices/labs/schedules/delete",
|                                                         "Microsoft.LabServices/labs/users/read",
|                                                         "Microsoft.LabServices/labs/users/write",
|                                                         "Microsoft.LabServices/labs/users/delete",
|                                                         "Microsoft.LabServices/labs/users/invite/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/read",
|                                                         "Microsoft.LabServices/labs/virtualMachines/start/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/stop/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/reimage/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/redeploy/action",
|                                                         "Microsoft.LabServices/labs/virtualMachines/resetPassword/action",
|                                                         "Microsoft.LabServices/locations/usages/read",
|                                                         "Microsoft.LabServices/skus/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.LabServices/labPlans/createLab/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "12cf5a90-567b-43ae-8102-96cf46c7d9b4",
|                                         "Name":  "Web PubSub Service Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Web PubSub APIs but no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SignalRService/WebPubSub/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bfb1c7d2-fb1a-466b-b2ba-aee63b92deaf",
|                                         "Name":  "Web PubSub Service Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Web PubSub APIs with no identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SignalRService/WebPubSub/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "420fcaa2-552c-430f-98ca-3264be4806c7",
|                                         "Name":  "SignalR App Server",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "App server access with AAD auth options but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.SignalRService/SignalR/auth/accessKey/action",
|                                                             "Microsoft.SignalRService/SignalR/serverConnection/write",
|                                                             "Microsoft.SignalRService/SignalR/clientConnection/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fb879df8-f326-4884-b1cf-06f3ad86be52",
|                                         "Name":  "Virtual Machine User Login",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can view and login as regular user but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Compute/virtualMachines/*/read",
|                                                         "Microsoft.HybridCompute/machines/*/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Compute/virtualMachines/login/action",
|                                                             "Microsoft.HybridCompute/machines/login/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1c0163c0-47e6-4577-8991-ea5c82e286e4",
|                                         "Name":  "Virtual Machine Administrator Login",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can login as administrator but lacks permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Compute/virtualMachines/*/read",
|                                                         "Microsoft.HybridCompute/machines/*/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Compute/virtualMachines/login/action",
|                                                             "Microsoft.Compute/virtualMachines/loginAsAdmin/action",
|                                                             "Microsoft.HybridCompute/machines/login/action",
|                                                             "Microsoft.HybridCompute/machines/loginAsAdmin/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cd570a14-e51a-42ad-bac8-bafd67325302",
|                                         "Name":  "Azure Connected Machine Resource Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage connected machines but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/machines/*",
|                                                         "Microsoft.HybridCompute/machines/extensions/*",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/*",
|                                                         "Microsoft.HybridCompute/machines/runCommands/*",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/settings/*",
|                                                         "Microsoft.HybridCompute/gateways/*",
|                                                         "Microsoft.HybridCompute/privateLinkScopes/*",
|                                                         "Microsoft.HybridCompute/licenses/*",
|                                                         "Microsoft.HybridCompute/locations/*",
|                                                         "Microsoft.HybridCompute/*/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e8ddcd69-c73f-4f9f-9844-4100522f16ad",
|                                         "Name":  "Workbook Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can save workbooks but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Insights/workbooks/write",
|                                                         "Microsoft.Insights/workbooks/delete",
|                                                         "Microsoft.Insights/workbooks/read",
|                                                         "Microsoft.Insights/workbooks/revisions/read",
|                                                         "Microsoft.Insights/workbooktemplates/write",
|                                                         "Microsoft.Insights/workbooktemplates/delete",
|                                                         "Microsoft.Insights/workbooktemplates/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b279062a-9be3-42a0-92ae-8b3cf002ec4d",
|                                         "Name":  "Workbook Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to workbooks with no identity plane control.",
|                                         "Actions":  [
|                                                         "microsoft.insights/workbooks/read",
|                                                         "microsoft.insights/workbooks/revisions/read",
|                                                         "microsoft.insights/workbooktemplates/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "749f88d5-cbae-40b8-bcfc-e573ddc772fa",
|                                         "Name":  "Monitoring Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and update monitoring settings but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.AlertsManagement/alerts/*",
|                                                         "Microsoft.AlertsManagement/alertsSummary/*",
|                                                         "Microsoft.AlertsManagement/issues/*",
|                                                         "Microsoft.Insights/actiongroups/*",
|                                                         "Microsoft.Insights/activityLogAlerts/*",
|                                                         "Microsoft.Insights/AlertRules/*",
|                                                         "Microsoft.Insights/components/*",
|                                                         "Microsoft.Insights/createNotifications/*",
|                                                         "Microsoft.Insights/dataCollectionEndpoints/*",
|                                                         "Microsoft.Insights/dataCollectionRules/*",
|                                                         "Microsoft.Insights/dataCollectionRuleAssociations/*",
|                                                         "Microsoft.Insights/DiagnosticSettings/*",
|                                                         "Microsoft.Insights/eventtypes/*",
|                                                         "Microsoft.Insights/LogDefinitions/*",
|                                                         "Microsoft.Insights/metricalerts/*",
|                                                         "Microsoft.Insights/MetricDefinitions/*",
|                                                         "Microsoft.Insights/Metrics/*",
|                                                         "Microsoft.Insights/notificationStatus/*",
|                                                         "Microsoft.Insights/Register/Action",
|                                                         "Microsoft.Insights/scheduledqueryrules/*",
|                                                         "Microsoft.Insights/webtests/*",
|                                                         "Microsoft.Insights/workbooks/*",
|                                                         "Microsoft.Insights/workbooktemplates/*",
|                                                         "Microsoft.Insights/privateLinkScopes/*",
|                                                         "Microsoft.Insights/privateLinkScopeOperationStatuses/*",
|                                                         "Microsoft.Monitor/accounts/*",
|                                                         "Microsoft.Monitor/settings/*",
|                                                         "Microsoft.OperationalInsights/workspaces/write",
|                                                         "Microsoft.OperationalInsights/workspaces/intelligencepacks/*",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/*",
|                                                         "Microsoft.OperationalInsights/workspaces/search/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedKeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedKeys/read",
|                                                         "Microsoft.OperationalInsights/workspaces/storageinsightconfigs/*",
|                                                         "Microsoft.OperationalInsights/locations/workspaces/failover/action",
|                                                         "Microsoft.OperationalInsights/workspaces/failback/action",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.AlertsManagement/smartDetectorAlertRules/*",
|                                                         "Microsoft.AlertsManagement/actionRules/*",
|                                                         "Microsoft.AlertsManagement/smartGroups/*",
|                                                         "Microsoft.AlertsManagement/migrateFromSmartDetection/*",
|                                                         "Microsoft.AlertsManagement/investigations/*",
|                                                         "Microsoft.AlertsManagement/prometheusRuleGroups/*",
|                                                         "Microsoft.Monitor/investigations/*",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3913510d-42f4-4e42-8a64-420c390055eb",
|                                         "Name":  "Monitoring Metrics Publisher",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can publish metrics but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Insights/Register/Action",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Insights/Metrics/Write",
|                                                             "Microsoft.Insights/Telemetry/Write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8a3c2885-9b38-4fd2-9d99-91af537c1347",
|                                         "Name":  "Purview role 1 (Deprecated)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Purview accounts with no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Purview/accounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Purview/accounts/data/read",
|                                                             "Microsoft.Purview/accounts/data/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "200bba9e-f0c8-430f-892b-6f0794863803",
|                                         "Name":  "Purview role 2 (Deprecated)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Purview accounts; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Purview/accounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Purview/accounts/scan/read",
|                                                             "Microsoft.Purview/accounts/scan/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ff100721-1b9d-43d8-af52-42b69c1272db",
|                                         "Name":  "Purview role 3 (Deprecated)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Purview accounts; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Purview/accounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Purview/accounts/data/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b8b15564-4fa6-4a59-ab12-03e1d9594795",
|                                         "Name":  "Autonomous Development Platform Data Contributor (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to platform data and resource groups; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.AutonomousDevelopmentPlatform/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AutonomousDevelopmentPlatform/accounts/dataPools/discoveries/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/accounts/dataPools/uploads/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/accounts/dataPools/measurements/states/new/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/accounts/dataPools/measurementCollections/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/accounts/measurementCollections/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/workspaces/read",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/workspaces/discoveries/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/workspaces/uploads/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/workspaces/measurements/states/new/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/workspaces/measurements/classifications/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/workspaces/measurements/dataStreams/classifications/*",
|                                                             "Microsoft.AutonomousDevelopmentPlatform/workspaces/measurementCollections/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "27f8b550-c507-4db9-86f2-f4b8e816d59d",
|                                         "Name":  "Autonomous Development Platform Data Owner (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to platform data but no identity or role assignment permissions; no direct path to tenant takeover.",
|                                         "Actions":  [
|                                                         "Microsoft.AutonomousDevelopmentPlatform/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AutonomousDevelopmentPlatform/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d63b75f7-47ea-4f27-92ac-e0d173aaf093",
|                                         "Name":  "Autonomous Development Platform Data Reader (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to platform data; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AutonomousDevelopmentPlatform/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AutonomousDevelopmentPlatform/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "49e2f5d2-7741-4835-8efa-19e1fe35e47f",
|                                         "Name":  "Device Update Deployments Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to device update management operations; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.DeviceUpdate/accounts/read",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DeviceUpdate/accounts/instances/management/read",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e4237640-0e3d-4a46-8fda-70bc94856432",
|                                         "Name":  "Device Update Deployments Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to device update management but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.DeviceUpdate/accounts/read",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DeviceUpdate/accounts/instances/management/read",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/management/write",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/management/delete",
|                                                             "Microsoft.DeviceUpdate/accounts/instances/updates/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "67d33e57-3129-45e6-bb0b-7cc522f762fa",
|                                         "Name":  "Azure Arc VMware Private Clouds Onboarding",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permissions to provision resources for vCenter onboarding; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ConnectedVMwarevSphere/vcenters/Write",
|                                                         "Microsoft.ConnectedVMwarevSphere/vcenters/Read",
|                                                         "Microsoft.ConnectedVMwarevSphere/vcenters/Delete",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/Write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/Read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/Delete",
|                                                         "Microsoft.KubernetesConfiguration/operations/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/Write",
|                                                         "Microsoft.ExtendedLocation/customLocations/Delete",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.ResourceConnector/appliances/Read",
|                                                         "Microsoft.ResourceConnector/appliances/Write",
|                                                         "Microsoft.ResourceConnector/appliances/Delete",
|                                                         "Microsoft.ResourceConnector/appliances/listClusterUserCredential/action",
|                                                         "Microsoft.BackupSolutions/vmwareapplications/write",
|                                                         "Microsoft.BackupSolutions/vmwareapplications/delete",
|                                                         "Microsoft.BackupSolutions/vmwareapplications/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f4c81013-99ee-4d62-a7ee-b3f1f648599a",
|                                         "Name":  "Microsoft Sentinel Automation Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to workflows and triggers; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Logic/workflows/triggers/read",
|                                                         "Microsoft.Logic/workflows/triggers/listCallbackUrl/action",
|                                                         "Microsoft.Logic/workflows/runs/read",
|                                                         "Microsoft.Web/sites/hostruntime/webhooks/api/workflows/triggers/read",
|                                                         "Microsoft.Web/sites/hostruntime/webhooks/api/workflows/triggers/listCallbackUrl/action",
|                                                         "Microsoft.Web/sites/hostruntime/webhooks/api/workflows/runs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "871e35f6-b5c1-49cc-a043-bde969a0f2cd",
|                                         "Name":  "CDN Endpoint Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to CDN endpoints; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Cdn/edgenodes/read",
|                                                         "Microsoft.Cdn/operationresults/*",
|                                                         "Microsoft.Cdn/profiles/endpoints/*/read",
|                                                         "Microsoft.Cdn/profiles/afdendpoints/validateCustomDomain/action",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f2dc8367-1007-4938-bd23-fe263f013447",
|                                         "Name":  "Cognitive Services Speech User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to speech services and role definitions; no write or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/read",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/write",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/delete",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/action",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/*/frontend/action",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/text-dependent/*/action",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/text-independent/*/action",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/voiceagent/realtime/*",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/voicelive/realtime/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVoice/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVoice/evaluations/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomVoice/longaudiosynthesis/*",
|                                                             "Microsoft.CognitiveServices/accounts/AudioContentCreation/*",
|                                                             "Microsoft.CognitiveServices/accounts/TTSPlayer/*",
|                                                             "Microsoft.CognitiveServices/accounts/VideoTranslation/*",
|                                                             "Microsoft.CognitiveServices/accounts/CustomAvatar/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/BatchAvatar/*",
|                                                             "Microsoft.CognitiveServices/accounts/BatchTextToSpeech/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a6333a3e-0164-44c3-b281-7a577aff287f",
|                                         "Name":  "Windows Admin Center Administrator Login",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage OS of resources but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/machines/*/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/*",
|                                                         "Microsoft.HybridCompute/machines/upgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read",
|                                                         "Microsoft.Network/networkWatchers/securityGroupView/action",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/write",
|                                                         "Microsoft.HybridConnectivity/endpoints/write",
|                                                         "Microsoft.HybridConnectivity/endpoints/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/write",
|                                                         "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/listManagedProxyDetails/action",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/patchAssessmentResults/latest/read",
|                                                         "Microsoft.Compute/virtualMachines/patchAssessmentResults/latest/softwarePatches/read",
|                                                         "Microsoft.Compute/virtualMachines/patchInstallationResults/read",
|                                                         "Microsoft.Compute/virtualMachines/patchInstallationResults/softwarePatches/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                         "Microsoft.Compute/virtualMachines/runCommands/read",
|                                                         "Microsoft.Compute/virtualMachines/vmSizes/read",
|                                                         "Microsoft.Compute/locations/publishers/artifacttypes/types/read",
|                                                         "Microsoft.Compute/locations/publishers/artifacttypes/types/versions/read",
|                                                         "Microsoft.Compute/diskAccesses/read",
|                                                         "Microsoft.Compute/galleries/images/read",
|                                                         "Microsoft.Compute/images/read",
|                                                         "Microsoft.AzureStackHCI/Clusters/Read",
|                                                         "Microsoft.AzureStackHCI/Clusters/ArcSettings/Read",
|                                                         "Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Read",
|                                                         "Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Write",
|                                                         "Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Delete",
|                                                         "Microsoft.AzureStackHCI/Operations/Read",
|                                                         "Microsoft.ConnectedVMwarevSphere/VirtualMachines/Read",
|                                                         "Microsoft.ConnectedVMwarevSphere/VirtualMachines/Extensions/Write",
|                                                         "Microsoft.ConnectedVMwarevSphere/VirtualMachines/Extensions/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HybridCompute/machines/WACLoginAsAdmin/action",
|                                                             "Microsoft.Compute/virtualMachines/WACloginAsAdmin/action",
|                                                             "Microsoft.AzureStackHCI/Clusters/WACloginAsAdmin/Action",
|                                                             "Microsoft.ConnectedVMwarevSphere/virtualmachines/WACloginAsAdmin/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "18ed5180-3e48-46fd-8541-4ea054d57064",
|                                         "Name":  "Azure Kubernetes Service Policy Add-on Deployment",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Deploy policy add-on and modify network resources; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/publicIPPrefixes/join/action",
|                                                         "Microsoft.Network/publicIPAddresses/join/action",
|                                                         "Microsoft.Compute/diskEncryptionSets/read",
|                                                         "Microsoft.Compute/proximityPlacementGroups/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "088ab73d-1256-47ae-bea9-9de8e7131f31",
|                                         "Name":  "Guest Configuration Resource Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read/write guest configuration assignments; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/write",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/*/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "361898ef-9ed1-48c2-849c-a832951106bb",
|                                         "Name":  "Domain Services Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Azure AD Domain Services and related configurations; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Insights/Logs/Read",
|                                                         "Microsoft.Insights/Metrics/read",
|                                                         "Microsoft.Insights/DiagnosticSettings/read",
|                                                         "Microsoft.Insights/DiagnosticSettingsCategories/Read",
|                                                         "Microsoft.AAD/domainServices/*/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
|                                                         "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/read",
|                                                         "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/azureFirewalls/read",
|                                                         "Microsoft.Network/ddosProtectionPlans/read",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/loadBalancers/*/read",
|                                                         "Microsoft.Network/natGateways/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                         "Microsoft.Network/routeTables/read",
|                                                         "Microsoft.Network/routeTables/routes/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "eeaeda52-9324-47f6-8069-5d5bade478b2",
|                                         "Name":  "Domain Services Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Azure AD Domain Services resources but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Insights/Logs/Read",
|                                                         "Microsoft.Insights/Metrics/Read",
|                                                         "Microsoft.Insights/DiagnosticSettings/*",
|                                                         "Microsoft.Insights/DiagnosticSettingsCategories/Read",
|                                                         "Microsoft.AAD/register/action",
|                                                         "Microsoft.AAD/unregister/action",
|                                                         "Microsoft.AAD/domainServices/*",
|                                                         "Microsoft.Network/register/action",
|                                                         "Microsoft.Network/unregister/action",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/write",
|                                                         "Microsoft.Network/virtualNetworks/delete",
|                                                         "Microsoft.Network/virtualNetworks/peer/action",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/delete",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
|                                                         "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete",
|                                                         "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/read",
|                                                         "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/azureFirewalls/read",
|                                                         "Microsoft.Network/ddosProtectionPlans/read",
|                                                         "Microsoft.Network/ddosProtectionPlans/join/action",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/loadBalancers/delete",
|                                                         "Microsoft.Network/loadBalancers/*/read",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
|                                                         "Microsoft.Network/natGateways/join/action",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/write",
|                                                         "Microsoft.Network/networkSecurityGroups/delete",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/write",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/delete",
|                                                         "Microsoft.Network/routeTables/read",
|                                                         "Microsoft.Network/routeTables/write",
|                                                         "Microsoft.Network/routeTables/delete",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/routeTables/routes/read",
|                                                         "Microsoft.Network/routeTables/routes/write",
|                                                         "Microsoft.Network/routeTables/routes/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d",
|                                         "Name":  "DNS Resolver Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage DNS resolver resources; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/dnsResolvers/read",
|                                                         "Microsoft.Network/dnsResolvers/write",
|                                                         "Microsoft.Network/dnsResolvers/delete",
|                                                         "Microsoft.Network/dnsResolvers/join/action",
|                                                         "Microsoft.Network/dnsResolvers/inboundEndpoints/read",
|                                                         "Microsoft.Network/dnsResolvers/inboundEndpoints/write",
|                                                         "Microsoft.Network/dnsResolvers/inboundEndpoints/delete",
|                                                         "Microsoft.Network/dnsResolvers/inboundEndpoints/join/action",
|                                                         "Microsoft.Network/dnsResolvers/outboundEndpoints/read",
|                                                         "Microsoft.Network/dnsResolvers/outboundEndpoints/write",
|                                                         "Microsoft.Network/dnsResolvers/outboundEndpoints/delete",
|                                                         "Microsoft.Network/dnsResolvers/outboundEndpoints/join/action",
|                                                         "Microsoft.Network/dnsForwardingRulesets/read",
|                                                         "Microsoft.Network/dnsForwardingRulesets/write",
|                                                         "Microsoft.Network/dnsForwardingRulesets/delete",
|                                                         "Microsoft.Network/dnsForwardingRulesets/join/action",
|                                                         "Microsoft.Network/dnsForwardingRulesets/forwardingRules/read",
|                                                         "Microsoft.Network/dnsForwardingRulesets/forwardingRules/write",
|                                                         "Microsoft.Network/dnsForwardingRulesets/forwardingRules/delete",
|                                                         "Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks/read",
|                                                         "Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks/write",
|                                                         "Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks/delete",
|                                                         "Microsoft.Network/locations/dnsResolverOperationResults/read",
|                                                         "Microsoft.Network/locations/dnsResolverOperationStatuses/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Network/virtualNetworks/joinLoadBalancer/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinLoadBalancer/action",
|                                                         "Microsoft.Network/natGateways/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "00493d72-78f6-4148-b6c5-d3ce8e4799dd",
|                                         "Name":  "Azure Arc Enabled Kubernetes Cluster User Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "List cluster user credentials and read resources; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Kubernetes/connectedClusters/listClusterUserCredentials/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "959f8984-c045-4866-89c7-12bf9737be2e",
|                                         "Name":  "Data Operator for Managed Disks",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Upload and read data on managed disks; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Compute/disks/download/action",
|                                                             "Microsoft.Compute/disks/upload/action",
|                                                             "Microsoft.Compute/snapshots/download/action",
|                                                             "Microsoft.Compute/snapshots/upload/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6b77f0a0-0d89-41cc-acd1-579c22c17a67",
|                                         "Name":  "AgFood Platform Sensor Partner Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contribute access to sensor entities; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/sensorPartnerScope/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1ef6a3be-d0ac-425d-8c01-acb62866290b",
|                                         "Name":  "Compute Gallery Sharing Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can share compute galleries but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/galleries/share/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cd08ab90-6b14-449c-ad9a-8f8e549482c6",
|                                         "Name":  "Scheduled Patching Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage maintenance configurations; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Maintenance/maintenanceConfigurations/read",
|                                                         "Microsoft.Maintenance/maintenanceConfigurations/write",
|                                                         "Microsoft.Maintenance/maintenanceConfigurations/delete",
|                                                         "Microsoft.Maintenance/configurationAssignments/read",
|                                                         "Microsoft.Maintenance/configurationAssignments/write",
|                                                         "Microsoft.Maintenance/configurationAssignments/delete",
|                                                         "Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/read",
|                                                         "Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/write",
|                                                         "Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/delete",
|                                                         "Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/read",
|                                                         "Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/write",
|                                                         "Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/delete",
|                                                         "Microsoft.Maintenance/applyUpdates/read",
|                                                         "Microsoft.Maintenance/updates/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "45d50f46-0b78-4001-a660-4198cbe8cd05",
|                                         "Name":  "DevCenter Dev Box User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage dev boxes with read access to projects; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DevCenter/projects/read",
|                                                         "Microsoft.DevCenter/projects/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userStop/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userStart/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userGetRemoteConnection/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userRead/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userWrite/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userDelete/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userUpcomingActionRead/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userUpcomingActionManage/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userActionRead/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userActionManage/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userCustomize/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "331c37c6-af14-46d9-b9f4-e1909e1b95a0",
|                                         "Name":  "DevCenter Project Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage project resources but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.DevCenter/projects/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.DevCenter/projects/write",
|                                                            "Microsoft.DevCenter/projects/delete"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DevCenter/projects/users/devboxes/adminStart/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/adminStop/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/adminRead/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/adminWrite/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/adminDelete/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/adminAlign/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/adminActionRead/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/adminActionManage/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userStop/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userStart/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userGetRemoteConnection/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userRead/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userWrite/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userDelete/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userActionRead/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userActionManage/action",
|                                                             "Microsoft.DevCenter/projects/users/devboxes/userCustomize/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminRead/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/userWrite/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminWrite/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/userDelete/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminDelete/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminAction/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminActionRead/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminActionManage/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminOutputsRead/action",
|                                                             "Microsoft.DevCenter/projects/pools/align/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "602da2ba-a5c2-41da-b01d-5360126ab525",
|                                         "Name":  "Virtual Machine Local User Login",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Login as local user on VMs; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/machines/*/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c0781e91-8102-4553-8951-97c6d4243cda",
|                                         "Name":  "Azure Arc ScVmm Private Cloud User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Use ScVmm resources to deploy VMs; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "microsoft.scvmm/virtualnetworks/join/action",
|                                                         "microsoft.scvmm/virtualnetworks/Read",
|                                                         "microsoft.scvmm/virtualmachinetemplates/clone/action",
|                                                         "microsoft.scvmm/virtualmachinetemplates/Read",
|                                                         "microsoft.scvmm/clouds/deploy/action",
|                                                         "microsoft.scvmm/clouds/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/enabledresourcetypes/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e582369a-e17b-42a5-b10c-874c387c530b",
|                                         "Name":  "Azure Arc ScVmm VM Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Perform VM actions in ScVmm; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "microsoft.scvmm/virtualmachines/*",
|                                                         "microsoft.scvmm/virtualMachineInstances/*",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                         "Microsoft.HybridCompute/machines/installPatches/action",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.HybridCompute/locations/operationresults/read",
|                                                         "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                         "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/write",
|                                                         "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                         "Microsoft.HybridCompute/licenses/read",
|                                                         "Microsoft.HybridCompute/licenses/write",
|                                                         "Microsoft.HybridCompute/licenses/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6aac74c4-6311-40d2-bbdd-7d01e7c6e3a9",
|                                         "Name":  "Azure Arc ScVmm Private Clouds Onboarding",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Provision resources for ScVmm onboarding; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "microsoft.scvmm/vmmservers/Read",
|                                                         "microsoft.scvmm/vmmservers/Write",
|                                                         "microsoft.scvmm/vmmservers/Delete",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a92dfd61-77f9-4aec-a531-19858b406c87",
|                                         "Name":  "Azure Arc ScVmm Administrator role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Perform all ScVmm actions but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ScVmm/*",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                         "Microsoft.HybridCompute/machines/installPatches/action",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.HybridCompute/locations/operationresults/read",
|                                                         "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                         "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/write",
|                                                         "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                         "Microsoft.HybridCompute/licenses/read",
|                                                         "Microsoft.HybridCompute/licenses/write",
|                                                         "Microsoft.HybridCompute/licenses/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fd036e6b-1266-47a0-b0bb-a05d04831731",
|                                         "Name":  "HDInsight on AKS Cluster Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage HDInsight clusters and run jobs; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/write",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/delete",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/resize/action",
|                                                         "Microsoft.HDInsight/clusterpools/clusters/instanceviews/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/jobs/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/runjob/action",
|                                                         "Microsoft.HDInsight/clusterpools/clusters/serviceconfigs/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/availableupgrades/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/upgrade/action",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/rollback/action",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/upgradehistories/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/libraries/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/managelibraries/action",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/*/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/logs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7656b436-37d4-490a-a4ab-d39f838f0042",
|                                         "Name":  "HDInsight on AKS Cluster Pool Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage cluster pools and clusters; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/write",
|                                                         "Microsoft.HDInsight/clusterPools/delete",
|                                                         "Microsoft.HDInsight/clusterPools/read",
|                                                         "Microsoft.HDInsight/clusterPools/write",
|                                                         "Microsoft.HDInsight/clusterpools/availableupgrades/read",
|                                                         "Microsoft.HDInsight/clusterpools/upgrade/action",
|                                                         "Microsoft.HDInsight/clusterPools/upgradehistories/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/*/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/logs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4465e953-8ced-4406-a58e-0f6e3f3b530b",
|                                         "Name":  "FHIR Data Importer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and import FHIR data; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/import/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bcf28286-af25-4c81-bb6f-351fcab5dbe9",
|                                         "Name":  "HDInsight on AKS Cluster Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and manage cluster operations; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.HDInsight/clusterPools/read",
|                                                         "Microsoft.Hdinsight/clusterpools/clusters/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/resize/action",
|                                                         "Microsoft.HDInsight/clusterpools/clusters/instanceviews/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/jobs/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/runjob/action",
|                                                         "Microsoft.HDInsight/clusterpools/clusters/serviceconfigs/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/availableupgrades/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/upgradehistories/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/libraries/read",
|                                                         "Microsoft.HDInsight/clusterPools/clusters/managelibraries/action",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/logs/read",
|                                                         "Microsoft.Insights/diagnosticSettings/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c031e6a8-4391-4de0-8d69-4706a7ed3729",
|                                         "Name":  "API Management Developer Portal Content Editor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Edit developer portal content; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/portalRevisions/read",
|                                                         "Microsoft.ApiManagement/service/portalRevisions/write",
|                                                         "Microsoft.ApiManagement/service/contentTypes/read",
|                                                         "Microsoft.ApiManagement/service/contentTypes/delete",
|                                                         "Microsoft.ApiManagement/service/contentTypes/write",
|                                                         "Microsoft.ApiManagement/service/contentTypes/contentItems/read",
|                                                         "Microsoft.ApiManagement/service/contentTypes/contentItems/write",
|                                                         "Microsoft.ApiManagement/service/contentTypes/contentItems/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d24ecba3-c1f4-40fa-a7bb-4588a071e8fd",
|                                         "Name":  "Defender Agentless VM Scan",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access VM disks for security analysis; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action",
|                                                         "Microsoft.Compute/diskEncryptionSets/read",
|                                                         "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/instanceView/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "80dcbedb-47ef-405d-95bd-188a1b4ac406",
|                                         "Name":  "Elastic SAN Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Elastic SAN resources; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ElasticSan/elasticSans/*",
|                                                         "Microsoft.ElasticSan/locations/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "af6a70f8-3c9f-4105-acf1-d719e9fca4ca",
|                                         "Name":  "Elastic SAN Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Elastic SAN control path; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ElasticSan/elasticSans/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "489581de-a3bd-480d-9518-53dea7416b33",
|                                         "Name":  "Desktop Virtualization Power On Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Start virtual machines; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/virtualMachines/start/action",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.HybridCompute/locations/operationresults/read",
|                                                         "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                         "Microsoft.AzureStackHCI/virtualMachineInstances/read",
|                                                         "Microsoft.AzureStackHCI/virtualMachineInstances/start/action",
|                                                         "Microsoft.AzureStackHCI/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a959dbd1-f747-45e3-8ba6-dd80f235f97c",
|                                         "Name":  "Desktop Virtualization Virtual Machine Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage virtual machines in desktop virtualization; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/write",
|                                                         "Microsoft.DesktopVirtualization/hostpools/retrieveRegistrationToken/action",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/write",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/delete",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/disconnect/action",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/sendMessage/action",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionHostConfigurations/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/doNotUseInternalAPI/action",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/retryprovisioning/action",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/availabilitySets/write",
|                                                         "Microsoft.Compute/availabilitySets/vmSizes/read",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/galleries/read",
|                                                         "Microsoft.Compute/galleries/images/read",
|                                                         "Microsoft.Compute/galleries/images/versions/read",
|                                                         "Microsoft.Compute/images/read",
|                                                         "Microsoft.Compute/locations/usages/read",
|                                                         "Microsoft.Compute/locations/vmSizes/read",
|                                                         "Microsoft.Compute/operations/read",
|                                                         "Microsoft.Compute/skus/read",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachines/delete",
|                                                         "Microsoft.Compute/virtualMachines/start/action",
|                                                         "Microsoft.Compute/virtualMachines/powerOff/action",
|                                                         "Microsoft.Compute/virtualMachines/restart/action",
|                                                         "Microsoft.Compute/virtualMachines/deallocate/action",
|                                                         "Microsoft.Compute/virtualMachines/runCommand/action",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/write",
|                                                         "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                         "Microsoft.Compute/virtualMachines/runCommands/read",
|                                                         "Microsoft.Compute/virtualMachines/runCommands/write",
|                                                         "Microsoft.Compute/virtualMachines/vmSizes/read",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/usages/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Marketplace/offerTypes/publishers/offers/plans/agreements/read",
|                                                         "Microsoft.KeyVault/vaults/deploy/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.DesktopVirtualization/scalingPlans/read",
|                                                         "Microsoft.DesktopVirtualization/scalingPlans/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "40c5ff49-9181-41f8-ae61-143b0e78555e",
|                                         "Name":  "Desktop Virtualization Power On Off Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Start and stop virtual machines; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.AzureStackHCI/operations/read",
|                                                         "Microsoft.AzureStackHCI/virtualMachineInstances/read",
|                                                         "Microsoft.AzureStackHCI/virtualMachineInstances/restart/action",
|                                                         "Microsoft.AzureStackHCI/virtualMachineInstances/start/action",
|                                                         "Microsoft.AzureStackHCI/virtualMachineInstances/stop/action",
|                                                         "Microsoft.Compute/virtualMachines/deallocate/action",
|                                                         "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                         "Microsoft.Compute/virtualMachines/powerOff/action",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/restart/action",
|                                                         "Microsoft.Compute/virtualMachines/start/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesCancelOperations/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteDeallocate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteHibernate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteStart/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationErrors/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationStatus/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitDeallocate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitHibernate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitStart/action",
|                                                         "Microsoft.ComputeSchedule/register/action",
|                                                         "Microsoft.DesktopVirtualization/hostpools/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/delete",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/read",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/sendMessage/action",
|                                                         "Microsoft.DesktopVirtualization/hostpools/sessionhosts/write",
|                                                         "Microsoft.DesktopVirtualization/hostpools/write",
|                                                         "Microsoft.HybridCompute/locations/operationresults/read",
|                                                         "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/eventtypes/values/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a8281131-f312-4f34-8d98-ae12be9f0d23",
|                                         "Name":  "Elastic SAN Volume Group Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to volume group resources; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/*",
|                                                         "Microsoft.ElasticSan/locations/asyncoperations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4339b7cf-9826-4e41-b4ed-c7f4505dac08",
|                                         "Name":  "Artifact Signing Identity Verifier",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage identity verification requests; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.CodeSigning/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CodeSigning/IdentityVerification/Read",
|                                                             "Microsoft.CodeSigning/IdentityVerification/Write",
|                                                             "Microsoft.CodeSigning/IdentityVerification/Delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a2c4a527-7dc0-4ee3-897b-403ade70fafb",
|                                         "Name":  "Video Indexer Restricted Viewer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to video insights; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.VideoIndexer/*/read",
|                                                         "Microsoft.VideoIndexer/accounts/*/action"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.VideoIndexer/*/write",
|                                                            "Microsoft.VideoIndexer/*/delete",
|                                                            "Microsoft.VideoIndexer/accounts/generateAccessToken/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b0d8363b-8ddd-447d-831f-62ca05bff136",
|                                         "Name":  "Monitoring Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to monitoring data; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Monitor/accounts/data/metrics/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "30b27cfc-9c84-438e-b0ce-70e35255df80",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Kubernetes resources; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/fleets/read",
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/fleets/apps/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/apps/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/apps/statefulsets/read",
|                                                             "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
|                                                             "Microsoft.ContainerService/fleets/batch/cronjobs/read",
|                                                             "Microsoft.ContainerService/fleets/batch/jobs/read",
|                                                             "Microsoft.ContainerService/fleets/configmaps/read",
|                                                             "Microsoft.ContainerService/fleets/endpoints/read",
|                                                             "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/fleets/events/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/limitranges/read",
|                                                             "Microsoft.ContainerService/fleets/namespaces/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
|                                                             "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                             "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                             "Microsoft.ContainerService/fleets/serviceaccounts/read",
|                                                             "Microsoft.ContainerService/fleets/services/read",
|                                                             "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/internalmemberclusters/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverridesnapshots/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/works/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "18ab4d3d-a1bf-4477-8ad9-8359bc988f69",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Cluster Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read/write access to Kubernetes resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/fleets/read",
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "434fb43a-c01c-447e-9f67-c3ad923cfaba",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read/write access to Kubernetes namespace resources; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/fleets/read",
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/fleets/apps/daemonsets/*",
|                                                             "Microsoft.ContainerService/fleets/apps/deployments/*",
|                                                             "Microsoft.ContainerService/fleets/apps/statefulsets/*",
|                                                             "Microsoft.ContainerService/fleets/authorization.k8s.io/localsubjectaccessreviews/write",
|                                                             "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*",
|                                                             "Microsoft.ContainerService/fleets/batch/cronjobs/*",
|                                                             "Microsoft.ContainerService/fleets/batch/jobs/*",
|                                                             "Microsoft.ContainerService/fleets/configmaps/*",
|                                                             "Microsoft.ContainerService/fleets/endpoints/*",
|                                                             "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/fleets/events/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/daemonsets/*",
|                                                             "Microsoft.ContainerService/fleets/extensions/deployments/*",
|                                                             "Microsoft.ContainerService/fleets/extensions/ingresses/*",
|                                                             "Microsoft.ContainerService/fleets/extensions/networkpolicies/*",
|                                                             "Microsoft.ContainerService/fleets/limitranges/read",
|                                                             "Microsoft.ContainerService/fleets/namespaces/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumeclaims/*",
|                                                             "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*",
|                                                             "Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/rolebindings/*",
|                                                             "Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/roles/*",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/*",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/*",
|                                                             "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                             "Microsoft.ContainerService/fleets/secrets/*",
|                                                             "Microsoft.ContainerService/fleets/serviceaccounts/*",
|                                                             "Microsoft.ContainerService/fleets/services/*",
|                                                             "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/internalmemberclusters/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/*",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverridesnapshots/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/works/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5af6afb3-c06c-4fa4-8848-71a8aee05683",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read/write access to Kubernetes namespace resources including Secrets; no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/fleets/read",
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/fleets/apps/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/apps/daemonsets/write",
|                                                             "Microsoft.ContainerService/fleets/apps/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/apps/deployments/write",
|                                                             "Microsoft.ContainerService/fleets/apps/statefulsets/read",
|                                                             "Microsoft.ContainerService/fleets/apps/statefulsets/write",
|                                                             "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
|                                                             "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/write",
|                                                             "Microsoft.ContainerService/fleets/batch/cronjobs/read",
|                                                             "Microsoft.ContainerService/fleets/batch/cronjobs/write",
|                                                             "Microsoft.ContainerService/fleets/batch/jobs/read",
|                                                             "Microsoft.ContainerService/fleets/batch/jobs/write",
|                                                             "Microsoft.ContainerService/fleets/configmaps/read",
|                                                             "Microsoft.ContainerService/fleets/configmaps/write",
|                                                             "Microsoft.ContainerService/fleets/endpoints/read",
|                                                             "Microsoft.ContainerService/fleets/endpoints/write",
|                                                             "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/fleets/events/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/daemonsets/write",
|                                                             "Microsoft.ContainerService/fleets/extensions/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/deployments/write",
|                                                             "Microsoft.ContainerService/fleets/extensions/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/ingresses/write",
|                                                             "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/networkpolicies/write",
|                                                             "Microsoft.ContainerService/fleets/limitranges/read",
|                                                             "Microsoft.ContainerService/fleets/namespaces/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/write",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/write",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumeclaims/write",
|                                                             "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
|                                                             "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/write",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/write",
|                                                             "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                             "Microsoft.ContainerService/fleets/secrets/read",
|                                                             "Microsoft.ContainerService/fleets/secrets/write",
|                                                             "Microsoft.ContainerService/fleets/serviceaccounts/read",
|                                                             "Microsoft.ContainerService/fleets/serviceaccounts/write",
|                                                             "Microsoft.ContainerService/fleets/services/read",
|                                                             "Microsoft.ContainerService/fleets/services/write",
|                                                             "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/internalmemberclusters/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/write",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverridesnapshots/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/works/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "63bb64ad-9799-4770-b5c3-24ed299a07bf",
|                                         "Name":  "Azure Kubernetes Fleet Manager Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows management of Azure Kubernetes Fleet resources but does not provide identity plane control or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/fleets/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.ContainerService/fleetMemberships/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ba79058c-0414-4a34-9e42-c3399d80cd5a",
|                                         "Name":  "Kubernetes Namespace User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows reading namespaces and retrieving kubeconfig but no direct or near-direct path to tenant takeover.",
|                                         "Actions":  [
|                                                         "Microsoft.KubernetesConfiguration/namespaces/read",
|                                                         "Microsoft.KubernetesConfiguration/namespaces/listUserCredential/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c6decf44-fd0a-444c-a844-d653c394e7ab",
|                                         "Name":  "Data Labeling - Labeler",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can label data but lacks permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/experiments/runs/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/labeling/projects/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/labeling/projects/summary/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/labeling/labels/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/labeling/labels/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "392ae280-861d-42bd-9ea5-08ee6d83b80e",
|                                         "Name":  "Template Spec Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to template specs with no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/templateSpecs/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1c9b6475-caf0-4164-b5a1-2142a7116f4b",
|                                         "Name":  "Template Spec Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to template specs but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/templateSpecs/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "51d6186e-6489-4900-b93f-92e23144cca5",
|                                         "Name":  "Microsoft Sentinel Playbook Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and trigger workflows but no direct or near-direct path to identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Logic/workflows/read",
|                                                         "Microsoft.Logic/workflows/triggers/listCallbackUrl/action",
|                                                         "Microsoft.Web/sites/hostruntime/webhooks/api/workflows/triggers/listCallbackUrl/action",
|                                                         "Microsoft.Web/sites/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "18e40d4e-8d2e-438d-97e1-9528336e149c",
|                                         "Name":  "Deployment Environments User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage environment resources but lacks permissions to modify roles or identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.DevCenter/projects/read",
|                                                         "Microsoft.DevCenter/projects/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.DevCenter/projects/pools/read",
|                                                            "Microsoft.DevCenter/projects/pools/schedules/read"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DevCenter/projects/users/environments/userRead/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/userWrite/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/userDelete/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/userActionManage/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/userOutputsRead/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "80558df3-64f9-4c0f-b32d-e5094b036b0b",
|                                         "Name":  "Azure Spring Apps Connect Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/apps/deployments/connect/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a99b0159-1064-4c22-a57b-c9b3caa1c054",
|                                         "Name":  "Azure Spring Apps Remote Debugging Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/apps/deployments/remotedebugging/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1823dd4f-9b8c-4ab6-ab4e-7397a3684615",
|                                         "Name":  "AzureML Registry User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage ML registry assets but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/registries/read",
|                                                         "Microsoft.MachineLearningServices/registries/assets/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e503ece1-11d0-4e8e-8e2c-7a6c3bf38815",
|                                         "Name":  "AzureML Compute Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage compute resources but no direct or near-direct path to identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/computes/*",
|                                                         "Microsoft.MachineLearningServices/workspaces/notebooks/vm/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "05352d14-a920-4328-a0de-4cbe7430e26b",
|                                         "Name":  "Azure Center for SAP solutions reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to SAP solution resources without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Advisor/configurations/read",
|                                                         "Microsoft.Advisor/recommendations/read",
|                                                         "Microsoft.Workloads/sapvirtualInstances/*/read",
|                                                         "Microsoft.Workloads/Locations/*/read",
|                                                         "Microsoft.Workloads/Operations/read",
|                                                         "Microsoft.Workloads/Locations/OperationStatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/virtualMachines/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/ipconfigurations/read",
|                                                         "Microsoft.Network/networkInterfaces/loadBalancers/read",
|                                                         "Microsoft.Network/networkInterfaces/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                         "Microsoft.Network/loadBalancers/frontendIPConfigurations/read",
|                                                         "Microsoft.Network/loadBalancers/loadBalancingRules/read",
|                                                         "Microsoft.Network/loadBalancers/inboundNatRules/read",
|                                                         "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.Network/loadBalancers/networkInterfaces/read",
|                                                         "Microsoft.Network/loadBalancers/outboundRules/read",
|                                                         "Microsoft.Network/loadBalancers/virtualMachines/read",
|                                                         "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/privateEndpoints/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/disks/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "aabbc5dd-1af0-458b-a942-81af88f9c138",
|                                         "Name":  "Azure Center for SAP solutions service role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can deploy and manage SAP systems but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/loadBalancers/write",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/write",
|                                                         "Microsoft.Network/loadBalancers/frontendIPConfigurations/read",
|                                                         "Microsoft.Network/loadBalancers/loadBalancingRules/read",
|                                                         "Microsoft.Network/loadBalancers/inboundNatRules/read",
|                                                         "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.Network/loadBalancers/networkInterfaces/read",
|                                                         "Microsoft.Network/loadBalancers/outboundRules/read",
|                                                         "Microsoft.Network/loadBalancers/virtualMachines/read",
|                                                         "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkInterfaces/ipconfigurations/read",
|                                                         "Microsoft.Network/networkInterfaces/loadBalancers/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/checkIpAddressAvailability/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/virtualMachines/read",
|                                                         "Microsoft.Network/virtualNetworks/virtualMachines/read",
|                                                         "Microsoft.Network/networkInterfaces/ipconfigurations/join/action",
|                                                         "Microsoft.Network/privateEndpoints/read",
|                                                         "Microsoft.Network/privateEndpoints/write",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/frontendIPConfigurations/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/joinLoadBalancer/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/write",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/write",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/availabilitySets/write",
|                                                         "Microsoft.Compute/skus/read",
|                                                         "Microsoft.Compute/sshPublicKeys/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/write",
|                                                         "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7b0c7e81-271f-4c71-90bf-e30bdfdbc2f7",
|                                         "Name":  "Azure Center for SAP solutions administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to SAP solutions but no direct or near-direct path to identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Advisor/configurations/read",
|                                                         "Microsoft.Advisor/recommendations/read",
|                                                         "Microsoft.Workloads/sapvirtualInstances/*/read",
|                                                         "Microsoft.Workloads/sapVirtualInstances/*/write",
|                                                         "Microsoft.Workloads/sapVirtualInstances/*/delete",
|                                                         "Microsoft.Workloads/Locations/*/action",
|                                                         "Microsoft.Workloads/Locations/*/read",
|                                                         "Microsoft.Workloads/sapVirtualInstances/*/start/action",
|                                                         "Microsoft.Workloads/sapVirtualInstances/*/stop/action",
|                                                         "Microsoft.Workloads/connectors/*/read",
|                                                         "Microsoft.Workloads/connectors/*/write",
|                                                         "Microsoft.Workloads/connectors/*/delete",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/virtualMachines/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/ipconfigurations/read",
|                                                         "Microsoft.Network/networkInterfaces/loadBalancers/read",
|                                                         "Microsoft.Network/networkInterfaces/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                         "Microsoft.Network/loadBalancers/frontendIPConfigurations/read",
|                                                         "Microsoft.Network/loadBalancers/loadBalancingRules/read",
|                                                         "Microsoft.Network/loadBalancers/inboundNatRules/read",
|                                                         "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.Network/loadBalancers/networkInterfaces/read",
|                                                         "Microsoft.Network/loadBalancers/outboundRules/read",
|                                                         "Microsoft.Network/loadBalancers/virtualMachines/read",
|                                                         "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Network/privateEndpoints/read",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/sshPublicKeys/read",
|                                                         "Microsoft.Compute/sshPublicKeys/write",
|                                                         "Microsoft.Compute/sshPublicKeys/*/generateKeyPair/action",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                         "Microsoft.Compute/disks/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fbc52c3f-28ad-4303-a892-8a056630b8f1",
|                                         "Name":  "AppGw for Containers Configuration Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can configure Application Gateway for Containers but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ServiceNetworking/trafficControllers/read",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/write",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/delete",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/frontends/read",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/frontends/write",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/frontends/delete",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/associations/read",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/associations/write",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/associations/delete",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/*/read",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/*/write",
|                                                         "Microsoft.ServiceNetworking/trafficControllers/*/delete",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ServiceNetworking/trafficControllers/serviceRoutingConfigurations/read",
|                                                             "Microsoft.ServiceNetworking/trafficControllers/serviceRoutingConfigurations/write",
|                                                             "Microsoft.ServiceNetworking/trafficControllers/serviceRoutingConfigurations/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4ba50f17-9666-485c-a643-ff00808643f0",
|                                         "Name":  "FHIR SMART User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/readById/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/search/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/smart/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/readById/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/search/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/smart/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a001fd3d-188f-4b5d-821b-7da978bf7442",
|                                         "Name":  "Cognitive Services OpenAI Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage OpenAI deployments but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.CognitiveServices/accounts/deployments/write",
|                                                         "Microsoft.CognitiveServices/accounts/deployments/delete",
|                                                         "Microsoft.CognitiveServices/accounts/raiPolicies/read",
|                                                         "Microsoft.CognitiveServices/accounts/raiPolicies/write",
|                                                         "Microsoft.CognitiveServices/accounts/raiPolicies/delete",
|                                                         "Microsoft.CognitiveServices/accounts/commitmentplans/read",
|                                                         "Microsoft.CognitiveServices/accounts/commitmentplans/write",
|                                                         "Microsoft.CognitiveServices/accounts/commitmentplans/delete",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5e0bd9bd-7b93-4f28-af87-19fc36ad61bd",
|                                         "Name":  "Cognitive Services OpenAI User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access and inference capabilities without role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/*/read",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/engines/completions/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/engines/search/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/engines/generate/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/deployments/audio/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/deployments/search/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/deployments/completions/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/deployments/chat/completions/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/deployments/realtime/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/deployments/extensions/chat/completions/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/deployments/embeddings/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/images/generations/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/video/generations/*/action",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/video/generations/*/delete",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/assistants/*",
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/responses/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "36e80216-a7e8-4f42-a7e1-f12c98cbaf8a",
|                                         "Name":  "Azure impact Reporter role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Write access to impact data but no permissions to modify roles or identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Impact/WorkloadImpacts/*",
|                                                         "Microsoft.Impact/ImpactCategories/read",
|                                                         "Microsoft.Impact/TopologyImpacts/*",
|                                                         "Microsoft.Impact/getUploadToken/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "68ff5d27-c7f5-4fa9-a21c-785d0df7bd9e",
|                                         "Name":  "Impact Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to impact data with no identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Impact/WorkloadImpacts/read",
|                                                         "Microsoft.Impact/ImpactCategories/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ad2dd5fb-cd4b-4fd4-a9b6-4fed3630980b",
|                                         "Name":  "ContainerApp Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to container app resources without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.App/containerApps/*/read",
|                                                         "Microsoft.App/containerApps/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1afdec4b-e479-420e-99e7-f82237c7c5e6",
|                                         "Name":  "Azure Kubernetes Service Cluster Monitoring User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can list monitoring credentials but no direct or near-direct path to identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action",
|                                                         "Microsoft.ContainerService/managedClusters/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f5819b54-e033-4d82-ac66-4fec3cbf3f4c",
|                                         "Name":  "Azure Connected Machine Resource Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage hybrid compute machines but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/*/read",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/write",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/*/read",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridConnectivity/endpoints/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/write",
|                                                         "Microsoft.HybridConnectivity/endpoints/write",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.EdgeMarketplace/locations/operationStatuses/read",
|                                                         "Microsoft.EdgeMarketPlace/offers/getAccessToken/action",
|                                                         "Microsoft.EdgeMarketPlace/offers/generateAccessToken/action",
|                                                         "Microsoft.EdgeMarketplace/publishers/read",
|                                                         "Microsoft.EdgeMarketplace/offers/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/read",
|                                                         "Microsoft.Attestation/attestationProviders/write",
|                                                         "Microsoft.Attestation/attestationProviders/read",
|                                                         "Microsoft.Attestation/attestationProviders/delete",
|                                                         "Microsoft.Attestation/attestationProviders/attestation/read",
|                                                         "Microsoft.Attestation/attestationProviders/attestation/write",
|                                                         "Microsoft.Attestation/attestationProviders/attestation/delete",
|                                                         "Microsoft.HybridCompute/settings/read",
|                                                         "Microsoft.HybridCompute/settings/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "189207d4-bb67-4208-a635-b06afe8b2c57",
|                                         "Name":  "SqlDb Migration Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage SQL DB migration but no direct or near-direct path to identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Sql/servers/read",
|                                                         "Microsoft.Sql/servers/write",
|                                                         "Microsoft.Sql/servers/databases/read",
|                                                         "Microsoft.Sql/servers/databases/write",
|                                                         "Microsoft.Sql/servers/databases/delete",
|                                                         "Microsoft.DataMigration/locations/operationResults/read",
|                                                         "Microsoft.DataMigration/locations/operationStatuses/read",
|                                                         "Microsoft.DataMigration/locations/sqlMigrationServiceOperationResults/read",
|                                                         "Microsoft.DataMigration/databaseMigrations/write",
|                                                         "Microsoft.DataMigration/databaseMigrations/read",
|                                                         "Microsoft.DataMigration/databaseMigrations/delete",
|                                                         "Microsoft.DataMigration/databaseMigrations/cancel/action",
|                                                         "Microsoft.DataMigration/databaseMigrations/cutover/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/write",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/delete",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/read",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listAuthKeys/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/regenerateAuthKeys/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/deleteNode/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listMonitoringData/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listMigrations/read",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/MonitoringData/read",
|                                                         "Microsoft.DataMigration/register/action",
|                                                         "Microsoft.DataMigration/operations/read",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/validateIR/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c4bc862a-3b64-4a35-a021-a380c159b042",
|                                         "Name":  "Bayer Ag Powered Services GDU Solution",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/farms/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ef29765d-0d37-4119-a4f8-f9f9902c9588",
|                                         "Name":  "Bayer Ag Powered Services Imagery Solution",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/farms/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/farms/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/ingestionJobs/satelliteDataIngestionJobs/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/scenes/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0105a6b0-4bb9-43d2-982a-12806f9faddb",
|                                         "Name":  "Azure Center for SAP solutions Service role for management",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6d949e1d-41e2-46e3-8920-c6e4f31a8310",
|                                         "Name":  "Azure Center for SAP solutions Management role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d5a2ae44-610b-4500-93be-660a0c5f5ca6",
|                                         "Name":  "Defender Kubernetes API Access",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Grants Defender access to AKS but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/write",
|                                                         "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read",
|                                                         "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/delete",
|                                                         "Microsoft.ContainerService/managedClusters/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/providers/features/register/action",
|                                                         "Microsoft.Security/pricings/securityoperators/read",
|                                                         "Microsoft.Security/securityOperators/read",
|                                                         "Microsoft.Authorization/policyAssignments/read",
|                                                         "Microsoft.Authorization/policySetDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f0310ce6-e953-4cf8-b892-fb1c87eaf7f6",
|                                         "Name":  "Azure Usage Billing Data Sender",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.UsageBilling/accounts/inputs/send/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "96062cf7-95ca-4f89-9b9d-2a2aa47356af",
|                                         "Name":  "Defender Registry Access",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Grants Defender access to container registry for security assessment without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/pull/read",
|                                                         "Microsoft.ContainerRegistry/registries/push/write",
|                                                         "Microsoft.ContainerRegistry/registries/artifacts/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/write",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/write",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/delete",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1d335eef-eee1-47fe-a9e0-53214eba8872",
|                                         "Name":  "SqlMI Migration Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage SQL Managed Instance migration but no direct or near-direct path to identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.Sql/managedInstances/read",
|                                                         "Microsoft.Sql/managedInstances/write",
|                                                         "Microsoft.Sql/managedInstances/databases/read",
|                                                         "Microsoft.Sql/managedInstances/databases/write",
|                                                         "Microsoft.Sql/managedInstances/databases/delete",
|                                                         "Microsoft.Sql/managedInstances/metrics/read",
|                                                         "Microsoft.DataMigration/locations/operationResults/read",
|                                                         "Microsoft.DataMigration/locations/operationStatuses/read",
|                                                         "Microsoft.DataMigration/locations/sqlMigrationServiceOperationResults/read",
|                                                         "Microsoft.DataMigration/databaseMigrations/write",
|                                                         "Microsoft.DataMigration/databaseMigrations/read",
|                                                         "Microsoft.DataMigration/databaseMigrations/delete",
|                                                         "Microsoft.DataMigration/databaseMigrations/cancel/action",
|                                                         "Microsoft.DataMigration/databaseMigrations/cutover/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/write",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/delete",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/read",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listAuthKeys/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/regenerateAuthKeys/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/deleteNode/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listMonitoringData/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listMigrations/read",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/MonitoringData/read",
|                                                         "Microsoft.DataMigration/register/action",
|                                                         "Microsoft.DataMigration/operations/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/validateIR/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ae8036db-e102-405b-a1b9-bae082ea436d",
|                                         "Name":  "SqlVM Migration Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage SQL VM migration but no direct or near-direct path to identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.DataMigration/locations/operationResults/read",
|                                                         "Microsoft.DataMigration/locations/operationStatuses/read",
|                                                         "Microsoft.DataMigration/locations/sqlMigrationServiceOperationResults/read",
|                                                         "Microsoft.DataMigration/databaseMigrations/write",
|                                                         "Microsoft.DataMigration/databaseMigrations/read",
|                                                         "Microsoft.DataMigration/databaseMigrations/delete",
|                                                         "Microsoft.DataMigration/databaseMigrations/cancel/action",
|                                                         "Microsoft.DataMigration/databaseMigrations/cutover/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/write",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/delete",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/read",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listAuthKeys/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/regenerateAuthKeys/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/deleteNode/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listMonitoringData/action",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/listMigrations/read",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/MonitoringData/read",
|                                                         "Microsoft.DataMigration/register/action",
|                                                         "Microsoft.DataMigration/operations/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.SqlVirtualMachine/sqlVirtualMachines/read",
|                                                         "Microsoft.SqlVirtualMachine/sqlVirtualMachines/write",
|                                                         "Microsoft.DataMigration/sqlMigrationServices/validateIR/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a9b99099-ead7-47db-8fcf-072597a61dfa",
|                                         "Name":  "Bayer Ag Powered Services CWUM Solution",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/farms/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/farms/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/ingestionJobs/satelliteDataIngestionJobs/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/scenes/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0ab34830-df19-4f8c-b84e-aa85b8afa6e8",
|                                         "Name":  "Azure Front Door Domain Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage Front Door domains but cannot assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Cdn/operationresults/profileresults/customdomainresults/read",
|                                                         "Microsoft.Cdn/profiles/customdomains/read",
|                                                         "Microsoft.Cdn/profiles/customdomains/write",
|                                                         "Microsoft.Cdn/profiles/customdomains/delete",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3f2eb865-5811-4578-b90a-6fc6fa0df8e5",
|                                         "Name":  "Azure Front Door Secret Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage Front Door secrets but cannot assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Cdn/operationresults/profileresults/secretresults/read",
|                                                         "Microsoft.Cdn/profiles/secrets/read",
|                                                         "Microsoft.Cdn/profiles/secrets/write",
|                                                         "Microsoft.Cdn/profiles/secrets/delete",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0f99d363-226e-4dca-9920-b807cf8e1a5f",
|                                         "Name":  "Azure Front Door Domain Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Front Door domains without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Cdn/operationresults/profileresults/customdomainresults/read",
|                                                         "Microsoft.Cdn/profiles/customdomains/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0db238c4-885e-4c4f-a933-aa2cef684fca",
|                                         "Name":  "Azure Front Door Secret Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Front Door secrets without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Cdn/operationresults/profileresults/secretresults/read",
|                                                         "Microsoft.Cdn/profiles/secrets/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d18ad5f3-1baf-4119-b49b-d944edb1f9d0",
|                                         "Name":  "MySQL Backup And Export Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage MySQL backup and export but no direct or near-direct path to identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.DBforMySQL/flexibleServers/validateBackup/action",
|                                                         "Microsoft.DBforMySQL/flexibleServers/backupAndExport/action",
|                                                         "Microsoft.DBforMySQL/locations/operationResults/read",
|                                                         "Microsoft.DBforMySQL/locations/azureAsyncOperation/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a8835c7d-b5cb-47fa-b6f0-65ea10ce07a2",
|                                         "Name":  "LocalNGFirewallAdministrator role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage NGFirewalls but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "PaloAltoNetworks.Cloudngfw/firewalls/*",
|                                                         "PaloAltoNetworks.Cloudngfw/localRulestacks/read",
|                                                         "PaloAltoNetworks.Cloudngfw/globalRulestacks/read",
|                                                         "PaloAltoNetworks.Cloudngfw/Locations/operationStatuses/read",
|                                                         "Microsoft.OperationalInsights/workspaces/write",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedKeys/read",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/publicIPAddresses/write",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/publicIPAddresses/join/action",
|                                                         "Microsoft.Network/networkVirtualAppliances/read",
|                                                         "Microsoft.Network/networkVirtualAppliances/write",
|                                                         "Microsoft.Network/networkVirtualAppliances/delete",
|                                                         "Microsoft.Network/virtualHubs/read",
|                                                         "Microsoft.Network/virtualWans/read",
|                                                         "Microsoft.Network/virtualWans/virtualHubs/read",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "PaloAltoNetworks.Cloudngfw/localRulestacks/fqdnlists/read",
|                                                         "PaloAltoNetworks.Cloudngfw/localRulestacks/localRules/read",
|                                                         "PaloAltoNetworks.Cloudngfw/localRulestacks/listFirewalls/action",
|                                                         "PaloAltoNetworks.Cloudngfw/createProductSerialNumber/action",
|                                                         "PaloAltoNetworks.Cloudngfw/listCloudManagerTenants/action",
|                                                         "PaloAltoNetworks.Cloudngfw/listProductSerialNumberStatus/action",
|                                                         "PaloAltoNetworks.Cloudngfw/listSupportInfo/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bda0d508-adf1-4af0-9c28-88919fc3ae06",
|                                         "Name":  "Azure Stack HCI Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Azure Stack HCI cluster but no direct or near-direct path to tenant-wide identity or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStackHCI/register/action",
|                                                         "Microsoft.AzureStackHCI/Unregister/Action",
|                                                         "Microsoft.AzureStackHCI/clusters/*",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/Read",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Read",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/Write",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Write",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/Delete",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Delete",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/join/action",
|                                                         "Microsoft.HybridCompute/register/action",
|                                                         "Microsoft.GuestConfiguration/register/action",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                         "Microsoft.HybridConnectivity/register/action",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.AzureStackHCI/*",
|                                                         "Microsoft.AzureStackHCI/EdgeMachines/*",
|                                                         "Microsoft.AzureStackHCI/DevicePools/*",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                         "Microsoft.HybridCompute/machines/installPatches/action",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.HybridCompute/locations/operationresults/read",
|                                                         "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                         "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/write",
|                                                         "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                         "Microsoft.HybridCompute/licenses/read",
|                                                         "Microsoft.HybridCompute/licenses/write",
|                                                         "Microsoft.HybridCompute/licenses/delete",
|                                                         "Microsoft.ResourceConnector/register/action",
|                                                         "Microsoft.ResourceConnector/appliances/read",
|                                                         "Microsoft.ResourceConnector/appliances/write",
|                                                         "Microsoft.ResourceConnector/appliances/delete",
|                                                         "Microsoft.ResourceConnector/locations/operationresults/read",
|                                                         "Microsoft.ResourceConnector/locations/operationsstatus/read",
|                                                         "Microsoft.ResourceConnector/appliances/listClusterUserCredential/action",
|                                                         "Microsoft.ResourceConnector/appliances/listKeys/action",
|                                                         "Microsoft.ResourceConnector/operations/read",
|                                                         "Microsoft.ExtendedLocation/register/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/write",
|                                                         "Microsoft.ExtendedLocation/customLocations/delete",
|                                                         "Microsoft.EdgeMarketplace/offers/read",
|                                                         "Microsoft.EdgeMarketplace/publishers/read",
|                                                         "Microsoft.Kubernetes/register/action",
|                                                         "Microsoft.KubernetesConfiguration/register/action",
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.KubernetesConfiguration/namespaces/read",
|                                                         "Microsoft.KubernetesConfiguration/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/Write",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/Read",
|                                                         "Microsoft.HybridContainerService/register/action",
|                                                         "Microsoft.HybridCompute/settings/write",
|                                                         "Microsoft.HybridCompute/settings/read",
|                                                         "Microsoft.HybridCompute/gateways/read",
|                                                         "Microsoft.HybridCompute/gateways/write",
|                                                         "Microsoft.HybridCompute/gateways/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bfc3b73d-c6ff-45eb-9a5f-40298295bf20",
|                                         "Name":  "LocalRulestacksAdministrator role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage local rulestacks but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "PaloAltoNetworks.Cloudngfw/localRulestacks/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Support/*",
|                                                         "PaloAltoNetworks.Cloudngfw/firewalls/read",
|                                                         "PaloAltoNetworks.Cloudngfw/createProductSerialNumber/action",
|                                                         "PaloAltoNetworks.Cloudngfw/listProductSerialNumberStatus/action",
|                                                         "PaloAltoNetworks.Cloudngfw/listSupportInfo/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7392c568-9289-4bde-aaaa-b7131215889d",
|                                         "Name":  "Azure Extension for SQL Server Deployment",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can deploy Azure Extension for SQL Server but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d6470a16-71bd-43ab-86b3-6f3a73f4e787",
|                                         "Name":  "Azure Maps Data Read and Batch Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Maps/accounts/services/*/read",
|                                                             "Microsoft.Maps/accounts/services/batch/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ef1c2c96-4a77-49e8-b9a4-6179fe1d2fd2",
|                                         "Name":  "API Management Workspace Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to API Management workspace entities without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/workspaces/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/diagnosticSettings/*/read",
|                                                         "Microsoft.insights/logs/read",
|                                                         "Microsoft.insights/logs/ApiManagementGatewayLogs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "73c2c328-d004-4c5e-938c-35c6f5679a1f",
|                                         "Name":  "API Management Workspace API Product Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to API publishing entities but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/workspaces/*/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/products/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/subscriptions/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/groups/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/tags/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/notifications/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/diagnosticSettings/*/read",
|                                                         "Microsoft.insights/logs/read",
|                                                         "Microsoft.insights/logs/ApiManagementGatewayLogs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "56328988-075d-4c6a-8766-d93edd6725b6",
|                                         "Name":  "API Management Workspace API Developer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to API editing entities but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/workspaces/*/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/apis/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/apiVersionSets/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/policies/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/schemas/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/products/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/policyFragments/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/namedValues/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/tags/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/backends/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/certificates/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/diagnostics/*",
|                                                         "Microsoft.ApiManagement/service/workspaces/loggers/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/diagnosticSettings/*/read",
|                                                         "Microsoft.insights/logs/read",
|                                                         "Microsoft.insights/logs/ApiManagementGatewayLogs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d59a3e9c-6d52-4a5a-aeed-6bf3cf0e31da",
|                                         "Name":  "API Management Service Workspace API Product Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to API Management service entities but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/users/read",
|                                                         "Microsoft.ApiManagement/service/tags/read",
|                                                         "Microsoft.ApiManagement/service/tags/apiLinks/*",
|                                                         "Microsoft.ApiManagement/service/tags/operationLinks/*",
|                                                         "Microsoft.ApiManagement/service/tags/productLinks/*",
|                                                         "Microsoft.ApiManagement/service/products/read",
|                                                         "Microsoft.ApiManagement/service/products/apiLinks/*",
|                                                         "Microsoft.ApiManagement/service/groups/read",
|                                                         "Microsoft.ApiManagement/service/groups/users/*",
|                                                         "Microsoft.ApiManagement/service/read",
|                                                         "Microsoft.ApiManagement/service/authorizationServers/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9565a273-41b9-4368-97d2-aeb0c976a9b3",
|                                         "Name":  "API Management Service Workspace API Developer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to API Management service tags and products but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/tags/read",
|                                                         "Microsoft.ApiManagement/service/tags/apiLinks/*",
|                                                         "Microsoft.ApiManagement/service/tags/operationLinks/*",
|                                                         "Microsoft.ApiManagement/service/tags/productLinks/*",
|                                                         "Microsoft.ApiManagement/service/products/read",
|                                                         "Microsoft.ApiManagement/service/products/apiLinks/*",
|                                                         "Microsoft.ApiManagement/service/read",
|                                                         "Microsoft.ApiManagement/service/authorizationServers/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0c34c906-8d99-4cb7-8bb7-33f5b0a1a799",
|                                         "Name":  "API Management Workspace Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage workspace resources but lacks permissions to assign roles or modify identity plane controls.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/workspaces/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/diagnosticSettings/*/read",
|                                                         "Microsoft.insights/logs/read",
|                                                         "Microsoft.insights/logs/ApiManagementGatewayLogs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b8eda974-7b85-4f76-af95-65846b26df6d",
|                                         "Name":  "Storage File Data Privileged Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to storage file shares only; no path to identity or role assignment.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "69566ab7-960f-475b-8e7c-b3118f30c6bd",
|                                         "Name":  "Storage File Data Privileged Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Write and modify NTFS permissions on storage files but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7eabc9a4-85f7-4f71-b8ab-75daaccc1033",
|                                         "Name":  "Windows 365 Network User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and join virtual networks but cannot assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/usages/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1f135831-5bbe-4924-9016-264044c00788",
|                                         "Name":  "Windows 365 Network Interface Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can provision network resources but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Network/locations/operationResults/read",
|                                                         "Microsoft.Network/locations/usages/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action",
|                                                         "Microsoft.Network/networkInterfaces/effectiveRouteTable/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3d55a8f6-4133-418d-8051-facdb1735758",
|                                         "Name":  "Windows365SubscriptionReader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to subscriptions and resources; no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0f37683f-2463-46b6-9ce7-9b788b988ba2",
|                                         "Name":  "App Compliance Automation Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages compliance automation tool and storage but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AppComplianceAutomation/*",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/write",
|                                                         "Microsoft.Storage/storageAccounts/fileservices/write",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.PolicyInsights/policyStates/queryResults/action",
|                                                         "Microsoft.PolicyInsights/policyStates/triggerEvaluation/action",
|                                                         "Microsoft.Resources/resources/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/resources/read",
|                                                         "Microsoft.Resources/subscriptions/resources/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/tags/read",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Security/automations/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Security/automations/delete",
|                                                         "Microsoft.Security/automations/write",
|                                                         "Microsoft.Security/register/action",
|                                                         "Microsoft.Security/unregister/action",
|                                                         "*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ffc6bbe0-e443-4c3b-bf54-26581bb2f78e",
|                                         "Name":  "App Compliance Automation Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to compliance automation tool; no identity plane control.",
|                                         "Actions":  [
|                                                         "*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8b9dfcab-4b77-4632-a6df-94bd07820648",
|                                         "Name":  "Azure Sphere Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to Azure Sphere resources without identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureSphere/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Insights/DiagnosticSettings/*",
|                                                         "Microsoft.Insights/DiagnosticSettingsCategories/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e9b8712a-cbcf-4ea7-b0f7-e71b803401e6",
|                                         "Name":  "SaaS Hub Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages SaaS Hub resources but cannot assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.SaaSHub/cloudservices/read",
|                                                         "Microsoft.SaaSHub/cloudservices/write",
|                                                         "Microsoft.SaaSHub/cloudservices/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c8ae6279-5a0b-4cb2-b3f0-d4d62845742c",
|                                         "Name":  "Azure Sphere Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Azure Sphere resources; no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureSphere/*/read",
|                                                         "Microsoft.AzureSphere/catalogs/countDevices/action",
|                                                         "Microsoft.AzureSphere/catalogs/listDeviceGroups/action",
|                                                         "Microsoft.AzureSphere/catalogs/listDeviceInsights/action",
|                                                         "Microsoft.AzureSphere/catalogs/listDevices/action",
|                                                         "Microsoft.AzureSphere/catalogs/listDeployments/action",
|                                                         "Microsoft.AzureSphere/catalogs/products/countDevices/action",
|                                                         "Microsoft.AzureSphere/catalogs/products/deviceGroups/countDevices/action",
|                                                         "Microsoft.AzureSphere/catalogs/certificates/retrieveCertChain/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/DiagnosticSettings/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6d994134-994b-4a59-9974-f479f0b227fb",
|                                         "Name":  "Azure Sphere Publisher",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can upload images and read Azure Sphere resources but lacks identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureSphere/*/read",
|                                                         "Microsoft.AzureSphere/catalogs/countDevices/action",
|                                                         "Microsoft.AzureSphere/catalogs/listDeviceGroups/action",
|                                                         "Microsoft.AzureSphere/catalogs/listDeviceInsights/action",
|                                                         "Microsoft.AzureSphere/catalogs/listDevices/action",
|                                                         "Microsoft.AzureSphere/catalogs/products/countDevices/action",
|                                                         "Microsoft.AzureSphere/catalogs/products/deviceGroups/countDevices/action",
|                                                         "Microsoft.AzureSphere/catalogs/certificates/retrieveProofOfPossessionNonce/action",
|                                                         "Microsoft.AzureSphere/catalogs/certificates/retrieveCertChain/action",
|                                                         "Microsoft.AzureSphere/catalogs/images/write",
|                                                         "Microsoft.AzureSphere/catalogs/uploadImage/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/DiagnosticSettings/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "be1a1ac2-09d3-4261-9e57-a73a6e227f53",
|                                         "Name":  "Procurement Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages procurement of products and services without identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.SaaSHub/cloudservices/read",
|                                                         "Microsoft.SaaSHub/cloudservices/write",
|                                                         "Microsoft.SaaSHub/cloudservices/delete",
|                                                         "Microsoft.SaaSHub/register/action",
|                                                         "Microsoft.SaaS/resources/read",
|                                                         "Microsoft.SaaS/resources/write",
|                                                         "Microsoft.SaaS/resources/delete",
|                                                         "Microsoft.SaaS/register/action",
|                                                         "Microsoft.ProfessionalService/resources/read",
|                                                         "Microsoft.ProfessionalService/resources/write",
|                                                         "Microsoft.ProfessionalService/resources/delete",
|                                                         "Microsoft.ProfessionalService/register/action",
|                                                         "Microsoft.BillingBenefits/register/action",
|                                                         "Microsoft.BillingBenefits/maccs/read",
|                                                         "Microsoft.BillingBenefits/maccs/write",
|                                                         "Microsoft.BillingBenefits/maccs/delete",
|                                                         "Microsoft.BillingBenefits/maccs/cancel/action",
|                                                         "Microsoft.BillingBenefits/maccs/chargeShortfall/action",
|                                                         "Microsoft.BillingBenefits/maccs/writeOff/action",
|                                                         "Microsoft.BillingBenefits/maccs/contributors/read",
|                                                         "Microsoft.BillingBenefits/credits/read",
|                                                         "Microsoft.BillingBenefits/credits/write",
|                                                         "Microsoft.BillingBenefits/credits/cancel/action",
|                                                         "Microsoft.BillingBenefits/credits/sources/read",
|                                                         "Microsoft.BillingBenefits/credits/sources/write",
|                                                         "Microsoft.BillingBenefits/credits/sources/delete",
|                                                         "Microsoft.BillingBenefits/discounts/read",
|                                                         "Microsoft.BillingBenefits/discounts/write",
|                                                         "Microsoft.BillingBenefits/discounts/delete",
|                                                         "Microsoft.BillingBenefits/discounts/cancel/action",
|                                                         "Microsoft.BillingBenefits/conditionalCredits/read",
|                                                         "Microsoft.BillingBenefits/conditionalCredits/write",
|                                                         "Microsoft.BillingBenefits/conditionalCredits/delete",
|                                                         "Microsoft.BillingBenefits/conditionalCredits/cancel/action",
|                                                         "Microsoft.BillingBenefits/conditionalCredits/contributors/read",
|                                                         "Microsoft.EnterpriseSupport/enterpriseSupports/read",
|                                                         "Microsoft.EnterpriseSupport/enterpriseSupports/write",
|                                                         "Microsoft.EnterpriseSupport/enterpriseSupports/delete",
|                                                         "Microsoft.EnterpriseSupport/register/action",
|                                                         "Microsoft.SoftwarePlan/register/action",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/read",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/write",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/delete",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/cancel/action",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/listKeys/action",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/refreshFulfillment/action",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/productKeys/read",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/productKeys/showFullKey/action",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/productDownloadOptions/read",
|                                                         "Microsoft.SoftwarePlan/softwareSubscriptions/productDownloadOptions/generateDownloadLinks/action",
|                                                         "Microsoft.SoftwarePlan/validateSoftwareSubscriptionCreate/action",
|                                                         "Microsoft.SoftwarePlan/softwareLicenses/read",
|                                                         "Microsoft.SoftwarePlan/softwareLicenses/write",
|                                                         "Microsoft.SoftwarePlan/softwareLicenses/productKeys/read",
|                                                         "Microsoft.SoftwarePlan/softwareLicenses/productKeys/showFullKey/action",
|                                                         "Microsoft.SoftwarePlan/softwareLicenses/productDownloadOptions/read",
|                                                         "Microsoft.SoftwarePlan/softwareLicenses/productDownloadOptions/generateDownloadLinks/action",
|                                                         "Microsoft.SoftwarePlan/validateSoftwareLicenseCreate/action",
|                                                         "Microsoft.Hardware/register/action",
|                                                         "Microsoft.Hardware/orderPreview/action",
|                                                         "Microsoft.Hardware/orders/read",
|                                                         "Microsoft.Hardware/orders/write",
|                                                         "Microsoft.Hardware/orders/delete",
|                                                         "Microsoft.Hardware/returnPreview/action",
|                                                         "Microsoft.Hardware/returns/read",
|                                                         "Microsoft.Hardware/returns/write",
|                                                         "Microsoft.Hardware/returns/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ea01e6af-a1c1-4350-9563-ad00f8c72ec5",
|                                         "Name":  "Azure Machine Learning Workspace Connection Secrets Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can list workspace connection secrets but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/connections/listsecrets/action",
|                                                         "Microsoft.MachineLearningServices/workspaces/metadata/secrets/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "79b01272-bf9f-4f4c-9517-5506269cf524",
|                                         "Name":  "Cognitive Search Serverless Data Reader (Deprecated)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Deprecated role with no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveSearch/indexes/schema/read",
|                                                             "Microsoft.CognitiveSearch/indexes/documents/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7ac06ca7-21ca-47e3-a67b-cbd6e6223baf",
|                                         "Name":  "Cognitive Search Serverless Data Contributor (Deprecated)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Deprecated role with no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveSearch/indexes/schema/*",
|                                                             "Microsoft.CognitiveSearch/indexes/documents/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5e28a61e-8040-49db-b175-bb5b88af6239",
|                                         "Name":  "Community Owner Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages community resources but lacks identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Mission/register/action",
|                                                         "Microsoft.Mission/unregister/action",
|                                                         "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                         "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                         "Microsoft.Mission/Operations/read",
|                                                         "Microsoft.Mission/communities/read",
|                                                         "Microsoft.Mission/communities/write",
|                                                         "Microsoft.Mission/communities/delete",
|                                                         "Microsoft.Mission/communities/setMaintenanceMode/action",
|                                                         "Microsoft.Mission/communities/communityendpoints/connect/action",
|                                                         "Microsoft.Mission/communities/dedicatedHubs/connect/action",
|                                                         "Microsoft.Mission/virtualEnclaves/read",
|                                                         "Microsoft.Mission/virtualEnclaves/write",
|                                                         "Microsoft.Mission/virtualEnclaves/delete",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/write",
|                                                         "Microsoft.Mission/communities/communityEndpoints/delete",
|                                                         "Microsoft.Mission/communities/transitHubs/read",
|                                                         "Microsoft.Mission/communities/transitHubs/write",
|                                                         "Microsoft.Mission/communities/transitHubs/delete",
|                                                         "Microsoft.Mission/communities/dedicatedHubs/read",
|                                                         "Microsoft.Mission/communities/dedicatedHubs/write",
|                                                         "Microsoft.Mission/communities/dedicatedHubs/delete",
|                                                         "Microsoft.Mission/enclaveConnections/read",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                         "Microsoft.Mission/approvals/read",
|                                                         "Microsoft.Mission/approvals/write",
|                                                         "Microsoft.Mission/approvals/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9c1607d1-791d-4c68-885d-c7b7aaff7c8a",
|                                         "Name":  "Firmware Analysis Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can upload and configure firmware but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.IoTFirmwareDefense/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1e7ca9b1-60d1-4db8-a914-f2ca1ff27c40",
|                                         "Name":  "Defender for Storage Data Scanner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to storage blobs and files for scanning; no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "df2711a6-406d-41cf-b366-b0250bff9ad1",
|                                         "Name":  "Compute Diagnostics Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permissions to execute diagnostics only; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action",
|                                                         "Microsoft.Compute/virtualmachinescalesets/disks/beginGetAccess/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fa6cecf6-5db3-4c43-8470-c540bcb4eafa",
|                                         "Name":  "Elastic SAN Network Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage SAN private endpoints and read SAN resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ElasticSan/elasticSans/*/read",
|                                                         "Microsoft.ElasticSan/elasticSans/PrivateEndpointConnectionsApproval/action",
|                                                         "Microsoft.ElasticSan/elasticSans/privateEndpointConnections/write",
|                                                         "Microsoft.ElasticSan/elasticSans/privateEndpointConnections/delete",
|                                                         "Microsoft.ElasticSan/locations/asyncoperations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bba48692-92b0-4667-a9ad-c31c7b334ac2",
|                                         "Name":  "Cognitive Services Usages Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Minimal read access to usage data; no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/locations/usages/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c088a766-074b-43ba-90d4-1fb21feae531",
|                                         "Name":  "PostgreSQL Flexible Server Long Term Retention Backup Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Backup-related permissions without identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/ltrBackup/action",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/ltrBackupAccess/action",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/ltrBackupOperations/read",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/ltrBackupPreCheck/action",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/ltrPreBackup/action",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/ltrRestoreFinalize/action",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/ltrRestoreInitialize/action",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/ltrRestorePreCheck/action",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/read",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/startLtrBackup/action",
|                                                         "Microsoft.DBforPostgreSQL/locations/azureAsyncOperation/read",
|                                                         "Microsoft.DBforPostgreSQL/locations/operationResults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a02f7c31-354d-4106-865a-deedf37fa038",
|                                         "Name":  "Search Parameter Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can update search parameters but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/reindex/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/write",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/searchparameter/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4accf36b-2c05-432f-91c8-5c532dff4c73",
|                                         "Name":  "Logic Apps Standard Reader (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to logic app resources; no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Web/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "523776ba-4eb2-4600-a3c8-f2dc93da4bdb",
|                                         "Name":  "Logic Apps Standard Developer (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and edit workflows but cannot assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Web/*/read",
|                                                         "Microsoft.Web/connections/*",
|                                                         "Microsoft.Web/customApis/*",
|                                                         "Microsoft.Web/sites/config/list/Action",
|                                                         "microsoft.web/sites/config/Write",
|                                                         "microsoft.web/sites/config/web/appsettings/delete",
|                                                         "microsoft.web/sites/config/web/appsettings/write",
|                                                         "microsoft.web/sites/deployWorkflowArtifacts/action",
|                                                         "microsoft.web/sites/hostruntime/*",
|                                                         "microsoft.web/sites/listworkflowsconnections/action",
|                                                         "Microsoft.Web/sites/publish/Action",
|                                                         "microsoft.web/sites/slots/config/appsettings/write",
|                                                         "Microsoft.Web/sites/slots/config/list/Action",
|                                                         "microsoft.web/sites/slots/config/web/appsettings/delete",
|                                                         "microsoft.web/sites/slots/deployWorkflowArtifacts/action",
|                                                         "microsoft.web/sites/slots/listworkflowsconnections/action",
|                                                         "Microsoft.Web/sites/slots/publish/Action",
|                                                         "microsoft.web/sites/workflows/*",
|                                                         "microsoft.web/sites/workflowsconfiguration/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ad710c24-b039-4e85-a019-deb4a06e8570",
|                                         "Name":  "Logic Apps Standard Contributor (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage logic app workflows but no role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Web/*/read",
|                                                         "Microsoft.Web/certificates/*",
|                                                         "Microsoft.Web/connectionGateways/*",
|                                                         "Microsoft.Web/connections/*",
|                                                         "Microsoft.Web/customApis/*",
|                                                         "Microsoft.Web/serverFarms/*",
|                                                         "Microsoft.Web/sites/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b70c96e9-66fe-4c09-b6e7-c98e69c98555",
|                                         "Name":  "Logic Apps Standard Operator (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can enable/disable logic apps and create connections but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Web/*/read",
|                                                         "Microsoft.Web/sites/applySlotConfig/Action",
|                                                         "microsoft.web/sites/hostruntime/*",
|                                                         "Microsoft.Web/sites/restart/Action",
|                                                         "Microsoft.Web/sites/slots/restart/Action",
|                                                         "Microsoft.Web/sites/slots/slotsswap/Action",
|                                                         "Microsoft.Web/sites/slots/start/Action",
|                                                         "Microsoft.Web/sites/slots/stop/Action",
|                                                         "Microsoft.Web/sites/slotsdiffs/Action",
|                                                         "Microsoft.Web/sites/slotsswap/Action",
|                                                         "Microsoft.Web/sites/start/Action",
|                                                         "Microsoft.Web/sites/stop/Action",
|                                                         "Microsoft.Web/sites/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7b3e853f-ad5d-4fb5-a7b8-56a3581c7037",
|                                         "Name":  "IPAM Pool User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and modify IPAM pools but lacks identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/networkManagers/ipamPools/*/read",
|                                                         "Microsoft.Network/networkManagers/ipamPools/*/action",
|                                                         "Microsoft.Network/networkManagers/ipamPools/*/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e9c9ed2b-2a99-4071-b2ff-5b113ebf73a1",
|                                         "Name":  "SpatialMapsAccounts Account Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages data in account but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MixedReality/spatialMapsAccounts/read",
|                                                             "Microsoft.MixedReality/spatialMapsAccounts/delete",
|                                                             "Microsoft.MixedReality/spatialMapsAccounts/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0b962ed2-6d56-471c-bd5f-3477d83a7ba4",
|                                         "Name":  "Azure Resource Notifications System Topics Subscriber",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create system topics and event subscriptions but no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.ResourceNotifications/systemTopics/subscribeToResources/action",
|                                                         "Microsoft.ResourceNotifications/systemTopics/subscribeToHealthResources/action",
|                                                         "Microsoft.ResourceNotifications/systemTopics/subscribeToMaintenanceResources/action",
|                                                         "Microsoft.ResourceNotifications/systemTopics/subscribeToComputeResources/action",
|                                                         "Microsoft.ResourceNotifications/systemTopics/subscribeToComputeScheduleResources/action",
|                                                         "Microsoft.ResourceNotifications/systemTopics/subscribeToContainerServiceEventResources/action",
|                                                         "Microsoft.ResourceNotifications/systemTopics/subscribeToImpactReportingResources/action",
|                                                         "Microsoft.ResourceNotifications/systemTopics/subscribeToAksResources/action",
|                                                         "Microsoft.EventGrid/eventSubscriptions/write",
|                                                         "Microsoft.EventGrid/systemTopics/eventSubscriptions/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1c4770c0-34f7-4110-a1ea-a5855cc7a939",
|                                         "Name":  "Elastic SAN Snapshot Exporter",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and export snapshots but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ElasticSan/elasticSans/*/read",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/snapshots/write",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/snapshots/delete",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/snapshots/beginGetAccess/action",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/preBackup/action",
|                                                         "Microsoft.ElasticSan/locations/*",
|                                                         "Microsoft.Compute/locations/*",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/snapshots/read",
|                                                         "Microsoft.Compute/snapshots/write",
|                                                         "Microsoft.Compute/snapshots/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "90e8b822-3e73-47b5-868a-787dc80c008f",
|                                         "Name":  "Elastic SAN Volume Importer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can import volumes but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/*/read",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/write",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/delete",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/preRestore/action",
|                                                         "Microsoft.ElasticSan/locations/*",
|                                                         "Microsoft.Compute/locations/*",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action",
|                                                         "Microsoft.Compute/disks/endGetAccess/action",
|                                                         "Microsoft.Compute/snapshots/read",
|                                                         "Microsoft.Compute/snapshots/beginGetAccess/action",
|                                                         "Microsoft.Compute/snapshots/endGetAccess/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "49435da6-99fe-48a5-a235-fc668b9dc04a",
|                                         "Name":  "Community Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can access and modify community resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Mission/register/action",
|                                                         "Microsoft.Mission/unregister/action",
|                                                         "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                         "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                         "Microsoft.Mission/Operations/read",
|                                                         "Microsoft.Mission/communities/read",
|                                                         "Microsoft.Mission/communities/write",
|                                                         "Microsoft.Mission/virtualEnclaves/read",
|                                                         "Microsoft.Mission/virtualEnclaves/write",
|                                                         "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                         "Microsoft.Mission/virtualEnclaves/endpoints/write",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/write",
|                                                         "Microsoft.Mission/communities/transitHubs/read",
|                                                         "Microsoft.Mission/communities/transitHubs/write",
|                                                         "Microsoft.Mission/enclaveConnections/read",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                         "Microsoft.Mission/approvals/read",
|                                                         "Microsoft.Mission/approvals/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4b0f2fd7-60b4-4eca-896f-4435034f8bf5",
|                                         "Name":  "EventGrid TopicSpaces Subscriber",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can subscribe to messages but no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.EventGrid/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventGrid/topicSpaces/subscribe/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a12b0b94-b317-4dcd-84a8-502ce99884c6",
|                                         "Name":  "EventGrid TopicSpaces Publisher",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can publish messages but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.EventGrid/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventGrid/topicSpaces/publish/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d1a38570-4b05-4d70-b8e4-1100bcf76d12",
|                                         "Name":  "Data Boundary Tenant Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages data boundaries but lacks direct identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/dataBoundaries/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8a90fa6b-6997-4a07-8a95-30633a7c97b9",
|                                         "Name":  "DeID Batch Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages DeID batch jobs but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthDataAIServices/DeidServices/Batch/write",
|                                                             "Microsoft.HealthDataAIServices/DeidServices/Batch/delete",
|                                                             "Microsoft.HealthDataAIServices/DeidServices/Batch/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b73a14ee-91f5-41b7-bd81-920e12466be9",
|                                         "Name":  "DeID Batch Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to DeID batch jobs; no identity plane or role assignment rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthDataAIServices/DeidServices/Batch/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bb6577c4-ea0a-40b2-8962-ea18cb8ecd4e",
|                                         "Name":  "DeID Realtime Data User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can execute requests against DeID realtime endpoint but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthDataAIServices/DeidServices/Realtime/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fa0d39e6-28e5-40cf-8521-1eb320653a4c",
|                                         "Name":  "Carbon Optimization Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to carbon optimization data; no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Carbon/carbonEmissionReports/action",
|                                                         "Microsoft.Carbon/carbonEmissionReports/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "38863829-c2a4-4f8d-b1d2-2e325973ebc7",
|                                         "Name":  "Landing Zone Management Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can review and modify landing zone configurations but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Sovereign/landingZoneConfigurations/*",
|                                                         "Microsoft.Sovereign/landingZoneRegistrations/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8fe6e843-6d9e-417b-9073-106b048f50bb",
|                                         "Name":  "Landing Zone Management Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to landing zone configurations; no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Sovereign/landingZoneConfigurations/read",
|                                                         "Microsoft.Sovereign/landingZoneRegistrations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "865ae368-6a45-4bd1-8fbf-0d5151f56fc1",
|                                         "Name":  "Azure Stack HCI Device Management Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Azure Stack HCI devices but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStackHCI/Clusters/*",
|                                                         "Microsoft.AzureStackHCI/EdgeDevices/*",
|                                                         "Microsoft.AzureStackHCI/DevicePools/*/read",
|                                                         "Microsoft.AzureStackHCI/EdgeMachines/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.HybridContainerService/register/action",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/read",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/write",
|                                                         "Microsoft.HybridContainerService/skus/read",
|                                                         "Microsoft.HybridContainerService/skus/write",
|                                                         "Microsoft.Authorization/roleassignments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/Write",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/Read",
|                                                         "Microsoft.AzureStackHCI/LogicalNetworks/Read",
|                                                         "Microsoft.AzureStackHCI/LogicalNetworks/Write",
|                                                         "Microsoft.AzureStackHCI/Register/Action",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.KubernetesConfiguration/namespaces/read",
|                                                         "Microsoft.KubernetesConfiguration/operations/read",
|                                                         "Microsoft.ResourceConnector/appliances/read",
|                                                         "Microsoft.ResourceConnector/appliances/write",
|                                                         "Microsoft.ResourceConnector/appliances/delete",
|                                                         "Microsoft.ResourceConnector/locations/operationresults/read",
|                                                         "Microsoft.ResourceConnector/locations/operationsstatus/read",
|                                                         "Microsoft.ResourceConnector/appliances/listClusterUserCredential/action",
|                                                         "Microsoft.ResourceConnector/appliances/listKeys/action",
|                                                         "Microsoft.ResourceConnector/appliances/upgradeGraphs/read",
|                                                         "Microsoft.ResourceConnector/telemetryconfig/read",
|                                                         "Microsoft.ResourceConnector/operations/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/write",
|                                                         "Microsoft.ExtendedLocation/customLocations/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4dae6930-7baf-46f5-909e-0383bc931c46",
|                                         "Name":  "Azure Customer Lockbox Approver for Subscription",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can approve support requests but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.CustomerLockbox/requests/UpdateApproval/action",
|                                                         "Microsoft.CustomerLockbox/requests/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/eventtypes/values/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7b1f81f9-4196-4058-8aae-762e593270df",
|                                         "Name":  "Azure Resource Bridge Deployment Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages resource bridge deployments but no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleassignments/read",
|                                                         "Microsoft.AzureStackHCI/Register/Action",
|                                                         "Microsoft.ResourceConnector/register/action",
|                                                         "Microsoft.ResourceConnector/appliances/read",
|                                                         "Microsoft.ResourceConnector/appliances/write",
|                                                         "Microsoft.ResourceConnector/appliances/delete",
|                                                         "Microsoft.ResourceConnector/locations/operationresults/read",
|                                                         "Microsoft.ResourceConnector/locations/operationsstatus/read",
|                                                         "Microsoft.ResourceConnector/appliances/listClusterUserCredential/action",
|                                                         "Microsoft.ResourceConnector/appliances/listKeys/action",
|                                                         "Microsoft.ResourceConnector/appliances/upgradeGraphs/read",
|                                                         "Microsoft.ResourceConnector/telemetryconfig/read",
|                                                         "Microsoft.ResourceConnector/operations/read",
|                                                         "Microsoft.ExtendedLocation/register/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/write",
|                                                         "Microsoft.ExtendedLocation/customLocations/delete",
|                                                         "Microsoft.HybridConnectivity/register/action",
|                                                         "Microsoft.Kubernetes/register/action",
|                                                         "Microsoft.KubernetesConfiguration/register/action",
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.KubernetesConfiguration/namespaces/read",
|                                                         "Microsoft.KubernetesConfiguration/operations/read",
|                                                         "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                         "Microsoft.HybridContainerService/register/action",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/read",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/write",
|                                                         "Microsoft.HybridContainerService/skus/read",
|                                                         "Microsoft.HybridContainerService/skus/write",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/Write",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "874d1c73-6003-4e60-a13a-cb31ea190a85",
|                                         "Name":  "Azure Stack HCI VM Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can perform VM actions but lacks identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStackHCI/VirtualMachines/*",
|                                                         "Microsoft.AzureStackHCI/virtualMachineInstances/*",
|                                                         "Microsoft.AzureStackHCI/NetworkInterfaces/*",
|                                                         "Microsoft.AzureStackHCI/VirtualHardDisks/*",
|                                                         "Microsoft.AzureStackHCI/VirtualNetworks/Read",
|                                                         "Microsoft.AzureStackHCI/VirtualNetworks/join/action",
|                                                         "Microsoft.AzureStackHCI/LogicalNetworks/Read",
|                                                         "Microsoft.AzureStackHCI/LogicalNetworks/join/action",
|                                                         "Microsoft.AzureStackHCI/GalleryImages/Read",
|                                                         "Microsoft.AzureStackHCI/GalleryImages/deploy/action",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/Read",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/deploy/action",
|                                                         "Microsoft.AzureStackHCI/MarketplaceGalleryImages/Read",
|                                                         "Microsoft.AzureStackHCI/MarketPlaceGalleryImages/deploy/action",
|                                                         "Microsoft.AzureStackHCI/Clusters/Read",
|                                                         "Microsoft.AzureStackHCI/Clusters/ArcSettings/Read",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/Read",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                         "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                         "Microsoft.HybridCompute/machines/installPatches/action",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/operations/read",
|                                                         "Microsoft.HybridCompute/locations/operationresults/read",
|                                                         "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                         "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                         "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/read",
|                                                         "Microsoft.HybridCompute/machines/runcommands/write",
|                                                         "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                         "Microsoft.HybridCompute/licenses/read",
|                                                         "Microsoft.HybridCompute/licenses/write",
|                                                         "Microsoft.HybridCompute/licenses/delete",
|                                                         "Microsoft.ExtendedLocation/customLocations/Read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4b3fe76c-f777-4d24-a2d7-b027b0f7b273",
|                                         "Name":  "Azure Stack HCI VM Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to VMs; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStackHCI/VirtualMachines/Read",
|                                                         "Microsoft.AzureStackHCI/virtualMachineInstances/Read",
|                                                         "Microsoft.AzureStackHCI/VirtualMachines/Extensions/Read",
|                                                         "Microsoft.AzureStackHCI/VirtualNetworks/Read",
|                                                         "Microsoft.AzureStackHCI/LogicalNetworks/Read",
|                                                         "Microsoft.AzureStackHCI/NetworkInterfaces/Read",
|                                                         "Microsoft.AzureStackHCI/VirtualHardDisks/Read",
|                                                         "Microsoft.AzureStackHCI/StorageContainers/Read",
|                                                         "Microsoft.AzureStackHCI/GalleryImages/Read",
|                                                         "Microsoft.AzureStackHCI/MarketplaceGalleryImages/Read",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/Read",
|                                                         "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Read",
|                                                         "Microsoft.HybridCompute/licenses/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                         "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/privateLinkScopes/networkSecurityPerimeterConfigurations/read",
|                                                         "Microsoft.HybridCompute/privateLinkScopes/privateEndpointConnections/read",
|                                                         "Microsoft.HybridCompute/privateLinkScopes/read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "64702f94-c441-49e6-a78b-ef80e0188fee",
|                                         "Name":  "Azure AI Developer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage Azure AI resources but lacks permissions to assign roles or modify identity plane controls.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/*/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/*/action",
|                                                         "Microsoft.MachineLearningServices/workspaces/*/delete",
|                                                         "Microsoft.MachineLearningServices/workspaces/*/write",
|                                                         "Microsoft.MachineLearningServices/locations/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.MachineLearningServices/workspaces/delete",
|                                                            "Microsoft.MachineLearningServices/workspaces/write",
|                                                            "Microsoft.MachineLearningServices/workspaces/listKeys/action",
|                                                            "Microsoft.MachineLearningServices/workspaces/hubs/write",
|                                                            "Microsoft.MachineLearningServices/workspaces/hubs/delete",
|                                                            "Microsoft.MachineLearningServices/workspaces/featurestores/write",
|                                                            "Microsoft.MachineLearningServices/workspaces/featurestores/delete",
|                                                            "Microsoft.MachineLearningServices/workspaces/evaluations/results/labels/read",
|                                                            "Microsoft.MachineLearningServices/workspaces/evaluations/results/reasonings/read",
|                                                            "Microsoft.MachineLearningServices/workspaces/simulations/results/images/read"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/OpenAI/*",
|                                                             "Microsoft.CognitiveServices/accounts/SpeechServices/*",
|                                                             "Microsoft.CognitiveServices/accounts/ContentSafety/*",
|                                                             "Microsoft.CognitiveServices/accounts/MaaS/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "eb960402-bf75-4cc3-8d68-35b34f960f72",
|                                         "Name":  "Deployment Environments Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to environment resources with no ability to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.DevCenter/projects/read",
|                                                         "Microsoft.DevCenter/projects/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.DevCenter/projects/pools/read",
|                                                            "Microsoft.DevCenter/projects/pools/schedules/read"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DevCenter/projects/users/environments/adminRead/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminActionRead/action",
|                                                             "Microsoft.DevCenter/projects/users/environments/adminOutputsRead/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1d8c3fe3-8864-474b-8749-01e3783e8157",
|                                         "Name":  "EventGrid Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can send and receive event grid events but cannot modify identity plane or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.EventGrid/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/locations/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.EventGrid/topics/read",
|                                                         "Microsoft.EventGrid/domains/read",
|                                                         "Microsoft.EventGrid/partnerNamespaces/read",
|                                                         "Microsoft.EventGrid/namespaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventGrid/events/send/action",
|                                                             "Microsoft.EventGrid/events/receive/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "78cbd9e7-9798-4e2e-9b5a-547d9ebb31fb",
|                                         "Name":  "EventGrid Data Receiver",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Receive-only access to event grid events with no path to identity or role control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.EventGrid/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/locations/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.EventGrid/namespaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.EventGrid/events/receive/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3afb7f49-54cb-416e-8c09-6dc049efa503",
|                                         "Name":  "Azure AI Inference Deployment Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create resource deployments but lacks permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Insights/AutoscaleSettings/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "65a14201-8f6c-4c28-bec4-12619c5a9aaa",
|                                         "Name":  "Connected Cluster Managed Identity CheckAccess Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to checkAccess API with no ability to escalate privileges or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c64499e0-74c3-47ad-921c-13865957895c",
|                                         "Name":  "Advisor Reviews Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to advisor reviews and recommendations without identity or role modification rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Advisor/resiliencyReviews/read",
|                                                         "Microsoft.Advisor/triageRecommendations/read",
|                                                         "Microsoft.Advisor/triageResources/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8aac15f0-d885-4138-8afa-bfb5872f7d13",
|                                         "Name":  "Advisor Reviews Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can triage recommendations but cannot assign roles or modify identity plane controls.",
|                                         "Actions":  [
|                                                         "Microsoft.Advisor/resiliencyReviews/read",
|                                                         "Microsoft.Advisor/triageRecommendations/read",
|                                                         "Microsoft.Advisor/triageRecommendations/approve/action",
|                                                         "Microsoft.Advisor/triageRecommendations/reject/action",
|                                                         "Microsoft.Advisor/triageRecommendations/reset/action",
|                                                         "Microsoft.Advisor/triageResources/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a8d4b70f-0fb9-4f72-b267-b87b2f990aec",
|                                         "Name":  "AgFood Platform Dataset Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access limited to dataset APIs with no identity or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/datasets/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/datasetRecords/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "662802e2-50f6-46b0-aed2-e834bacc6d12",
|                                         "Name":  "Azure Front Door Profile Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Azure Front Door profiles with no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Cdn/edgenodes/read",
|                                                         "Microsoft.Cdn/operationresults/*",
|                                                         "Microsoft.Cdn/profiles/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Cdn/operationresults/profileresults/afdendpointresults/CheckCustomDomainDNSMappingStatus/action",
|                                                         "Microsoft.Cdn/profiles/queryloganalyticsmetrics/action",
|                                                         "Microsoft.Cdn/profiles/queryloganalyticsrankings/action",
|                                                         "Microsoft.Cdn/profiles/querywafloganalyticsmetrics/action",
|                                                         "Microsoft.Cdn/profiles/querywafloganalyticsrankings/action",
|                                                         "Microsoft.Cdn/profiles/afdendpoints/CheckCustomDomainDNSMappingStatus/action",
|                                                         "Microsoft.Cdn/profiles/Usages/action",
|                                                         "Microsoft.Cdn/profiles/afdendpoints/Usages/action",
|                                                         "Microsoft.Cdn/profiles/origingroups/Usages/action",
|                                                         "Microsoft.Cdn/profiles/rulesets/Usages/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "86fede04-b259-4277-8c3e-e26b9865abd8",
|                                         "Name":  "Enclave Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to enclave resources without ability to modify roles or identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Mission/Operations/read",
|                                                         "Microsoft.Mission/communities/read",
|                                                         "Microsoft.Mission/virtualEnclaves/read",
|                                                         "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/read",
|                                                         "Microsoft.Mission/communities/transitHubs/read",
|                                                         "Microsoft.Mission/enclaveConnections/read",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                         "Microsoft.Mission/approvals/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b5092dac-c796-4349-8681-1a322a31c3f9",
|                                         "Name":  "Azure Kubernetes Service Hybrid Cluster Admin Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can list cluster admin credentials but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/listAdminKubeconfig/action",
|                                                         "Microsoft.Kubernetes/connectedClusters/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fc3f91a1-40bf-4439-8c46-45edbd83563a",
|                                         "Name":  "Azure Kubernetes Service Hybrid Cluster User Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can list user cluster credentials but lacks role assignment or identity plane modification rights.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/listUserKubeconfig/action",
|                                                         "Microsoft.Kubernetes/connectedClusters/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e7037d40-443a-4434-a3fb-8cd202011e1d",
|                                         "Name":  "Azure Kubernetes Service Hybrid Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read/write hybrid clusters but no direct path to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridContainerService/Locations/operationStatuses/read",
|                                                         "Microsoft.HybridContainerService/Operations/read",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/read",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/write",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/delete",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/write",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/delete",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/write",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/delete",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/upgradeProfiles/read",
|                                                         "Microsoft.HybridContainerService/skus/read",
|                                                         "Microsoft.HybridContainerService/skus/write",
|                                                         "Microsoft.HybridContainerService/skus/delete",
|                                                         "Microsoft.HybridContainerService/virtualNetworks/read",
|                                                         "Microsoft.HybridContainerService/virtualNetworks/write",
|                                                         "Microsoft.HybridContainerService/virtualNetworks/delete",
|                                                         "Microsoft.Kubernetes/connectedClusters/Read",
|                                                         "Microsoft.Kubernetes/connectedClusters/Write",
|                                                         "Microsoft.Kubernetes/connectedClusters/Delete",
|                                                         "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3d5f3eff-eb94-473d-91e3-7aac74d6c0bb",
|                                         "Name":  "Enclave Owner Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage enclave resources but lacks permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                         "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                         "Microsoft.Mission/Operations/read",
|                                                         "Microsoft.Mission/virtualEnclaves/read",
|                                                         "Microsoft.Mission/virtualEnclaves/write",
|                                                         "Microsoft.Mission/virtualEnclaves/delete",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/delete",
|                                                         "Microsoft.Mission/communities/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/read",
|                                                         "Microsoft.Mission/communities/transitHubs/read",
|                                                         "Microsoft.Mission/enclaveConnections/read",
|                                                         "Microsoft.Mission/enclaveConnections/write",
|                                                         "Microsoft.Mission/enclaveConnections/delete",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/write",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/delete",
|                                                         "Microsoft.Mission/approvals/read",
|                                                         "Microsoft.Mission/approvals/write",
|                                                         "Microsoft.Mission/approvals/delete",
|                                                         "Microsoft.Mission/virtualEnclaves/setWorkloadRoleAssignments/action",
|                                                         "Microsoft.Mission/virtualEnclaves/setEnclaveRoleAssignments/action",
|                                                         "Microsoft.Mission/virtualenclaves/setMaintenanceMode/action",
|                                                         "Microsoft.Mission/virtualEnclaves/setSubnetConfiguration/action",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/connect/action",
|                                                         "Microsoft.Mission/enclaveConnections/setSourceCidr/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e6aadb6b-e64f-41c0-9392-d2bba3bc3ebc",
|                                         "Name":  "Community Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to community resources without role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                         "Microsoft.Mission/Operations/read",
|                                                         "Microsoft.Mission/communities/read",
|                                                         "Microsoft.Mission/virtualEnclaves/read",
|                                                         "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/read",
|                                                         "Microsoft.Mission/communities/transitHubs/read",
|                                                         "Microsoft.Mission/enclaveConnections/read",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                         "Microsoft.Mission/approvals/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "19feefae-eacc-4106-81fd-ac34c0671f14",
|                                         "Name":  "Enclave Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can contribute to enclave resources but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Mission/register/action",
|                                                         "Microsoft.Mission/unregister/action",
|                                                         "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                         "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                         "Microsoft.Mission/Operations/read",
|                                                         "Microsoft.Mission/communities/read",
|                                                         "Microsoft.Mission/virtualEnclaves/read",
|                                                         "Microsoft.Mission/virtualEnclaves/write",
|                                                         "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                         "Microsoft.Mission/virtualEnclaves/endpoints/write",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/read",
|                                                         "Microsoft.Mission/communities/transitHubs/read",
|                                                         "Microsoft.Mission/enclaveConnections/read",
|                                                         "Microsoft.Mission/enclaveConnections/write",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/write",
|                                                         "Microsoft.Mission/approvals/read",
|                                                         "Microsoft.Mission/approvals/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "44f0a1a8-6fea-4b35-980a-8ff50c487c97",
|                                         "Name":  "Operator Nexus Key Vault Writer Service Role (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Key Vault vaults with no role assignment or identity plane permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.KeyVault/vaults/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/secrets/setSecret/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a316ed6d-1efe-48ac-ac08-f7995a9c26fb",
|                                         "Name":  "Storage Account Encryption Scope Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage encryption scopes but lacks permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/encryptionScopes/read",
|                                                         "Microsoft.Storage/storageAccounts/encryptionScopes/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "08bbd89e-9f13-488c-ac41-acfcb10c90ab",
|                                         "Name":  "Key Vault Crypto Service Release User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Key release permissions limited to key vault data plane; no identity or role assignment rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/keys/release/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0cd9749a-3aaf-4ae5-8803-bd217705bf3b",
|                                         "Name":  "Kubernetes Runtime Storage Class Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage Kubernetes storage classes but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.KubernetesRuntime/storageClasses/read",
|                                                         "Microsoft.KubernetesRuntime/storageClasses/write",
|                                                         "Microsoft.KubernetesRuntime/storageClasses/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "609c0c20-e0a0-4a71-b99f-e7e755ac493d",
|                                         "Name":  "Azure Programmable Connectivity Gateway User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access to gateway dataplane APIs without role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "db79e9a7-68ee-4b58-9aeb-b90e7c24fcba",
|                                         "Name":  "Key Vault Certificate User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to certificates with no ability to assign roles or modify identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.KeyVault/vaults/certificates/read",
|                                                             "Microsoft.KeyVault/vaults/secrets/getSecret/action",
|                                                             "Microsoft.KeyVault/vaults/secrets/readMetadata/action",
|                                                             "Microsoft.KeyVault/vaults/keys/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4301dc2a-25a9-44b0-ae63-3636cf7f2bd2",
|                                         "Name":  "Azure Spring Apps Spring Cloud Gateway Log Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to logs with no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.AppPlatform/Spring/read",
|                                                         "Microsoft.AppPlatform/Spring/gateways/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/SpringCloudGateway/logstream/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "52fd16bd-6ed5-46af-9c40-29cbd7952a29",
|                                         "Name":  "Azure Spring Apps Managed Components Log Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to managed components logs without role assignment or identity plane rights.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/managedComponents/logstream/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6593e776-2a30-40f9-8a32-4fe28b77655d",
|                                         "Name":  "Azure Spring Apps Application Configuration Service Log Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to application configuration logs with no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AppPlatform/Spring/read",
|                                                         "Microsoft.AppPlatform/Spring/configurationServices/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/ApplicationConfigurationService/logstream/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "207bcc4b-86a6-4487-9141-d6c1f4c238aa",
|                                         "Name":  "Azure Edge On-Site Deployment Engineer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access to order items read-only with no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.EdgeOrder/orderItems/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c7244dfb-f447-457d-b2ba-3999044d1706",
|                                         "Name":  "Azure API Center Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to API Center data with no role assignment or identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ApiCenter/services/*/read",
|                                                             "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/exportSpecification/action",
|                                                             "Microsoft.ApiCenter/services/workspaces/search/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dfb2f09d-25f8-4558-8986-497084006d7a",
|                                         "Name":  "Azure impact-insight reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to impact insight data without permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Impact/WorkloadImpacts/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8bb6f106-b146-4ee6-a3f9-b9c5a96e0ae5",
|                                         "Name":  "Defender Kubernetes Agent Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can provision Kubernetes defender agent but lacks role assignment or identity plane modification rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.Kubernetes/connectedClusters/Write",
|                                                         "Microsoft.Kubernetes/connectedClusters/read",
|                                                         "Microsoft.OperationalInsights/workspaces/write",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.OperationalInsights/workspaces/listKeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedkeys/action",
|                                                         "Microsoft.Kubernetes/register/action",
|                                                         "Microsoft.KubernetesConfiguration/register/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5b7237c5-45e1-49d6-bc18-a1f62f400748",
|                                         "Name":  "Azure Red Hat OpenShift Disk Storage Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage storage drivers and snapshots but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/read",
|                                                         "Microsoft.Compute/snapshots/write",
|                                                         "Microsoft.Compute/snapshots/read",
|                                                         "Microsoft.Compute/snapshots/delete",
|                                                         "Microsoft.Compute/locations/operations/read",
|                                                         "Microsoft.Compute/locations/DiskOperations/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action",
|                                                         "Microsoft.Compute/diskEncryptionSets/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4436bae4-7702-4c84-919b-c4069ff25ee2",
|                                         "Name":  "Azure Red Hat OpenShift Service Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage network and monitoring features without role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/natGateways/join/action",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                         "Microsoft.Network/networkIntentPolicies/join/action",
|                                                         "Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Storage/storageAccounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0d7aedc0-15fd-4a67-a412-efad370c947e",
|                                         "Name":  "Azure Red Hat OpenShift File Storage Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage file storage and keys but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/delete",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/delete",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/write",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/natGateways/join/action",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/privateEndpoints/write",
|                                                         "Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action",
|                                                         "Microsoft.Network/networkIntentPolicies/join/action",
|                                                         "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Network/privateDnsOperationStatuses/read",
|                                                         "Microsoft.Network/privateDnsZones/read",
|                                                         "Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
|                                                         "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                         "Microsoft.Network/privateDnsZones/write",
|                                                         "Microsoft.Network/privateDnsZones/join/action",
|                                                         "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
|                                                         "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
|                                                         "Microsoft.Network/privateEndpoints/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8b32b316-c2f5-4ddf-b05b-83dacd2d08b5",
|                                         "Name":  "Azure Red Hat OpenShift Image Registry Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage image registry storage and containers without role assignment or identity plane rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/delete",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Resources/tags/write",
|                                                         "Microsoft.Network/privateEndpoints/write",
|                                                         "Microsoft.Network/privateEndpoints/read",
|                                                         "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
|                                                         "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
|                                                         "Microsoft.Network/privateDnsZones/read",
|                                                         "Microsoft.Network/privateDnsZones/write",
|                                                         "Microsoft.Network/privateDnsZones/join/action",
|                                                         "Microsoft.Network/privateDnsZones/A/write",
|                                                         "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                         "Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/join/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "be7a6435-15ae-4171-8f30-4a343eff9e8f",
|                                         "Name":  "Azure Red Hat OpenShift Network Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage networking components with no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                         "Microsoft.Compute/virtualMachines/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a1f96423-95ce-4224-ab27-4e3dc72facd4",
|                                         "Name":  "Azure Red Hat OpenShift Cloud Controller Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage cloud controller components without role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/loadBalancers/write",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/write",
|                                                         "Microsoft.Network/publicIPAddresses/join/action",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/publicIPAddresses/write",
|                                                         "Microsoft.Network/publicIPAddresses/delete",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/publicIPPrefixes/join/action",
|                                                         "Microsoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/privatelinkservices/write",
|                                                         "Microsoft.Network/privatelinkservices/read",
|                                                         "Microsoft.Network/privatelinkservices/delete",
|                                                         "Microsoft.Network/loadBalancers/loadBalancingRules/read",
|                                                         "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                         "Microsoft.Network/natGateways/join/action",
|                                                         "Microsoft.Network/networkIntentPolicies/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0358943c-7e01-48ba-8889-02cc51d78637",
|                                         "Name":  "Azure Red Hat OpenShift Machine API Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage machine lifecycle but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/availabilitySets/delete",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/availabilitySets/write",
|                                                         "Microsoft.Compute/diskEncryptionSets/read",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/galleries/images/versions/read",
|                                                         "Microsoft.Compute/skus/read",
|                                                         "Microsoft.Compute/virtualMachines/delete",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/capacityReservationGroups/deploy/action",
|                                                         "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action",
|                                                         "Microsoft.Network/applicationSecurityGroups/read",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/loadBalancers/write",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/networkInterfaces/loadBalancers/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/write",
|                                                         "Microsoft.Network/publicIPAddresses/delete",
|                                                         "Microsoft.Network/publicIPAddresses/join/action",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/publicIPAddresses/write",
|                                                         "Microsoft.Network/routeTables/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/action",
|                                                         "Microsoft.Network/loadBalancers/frontendIPConfigurations/join/action",
|                                                         "Microsoft.Network/loadBalancers/inboundNATRules/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0336e1d3-7a87-462b-b6db-342b63f7802c",
|                                         "Name":  "Azure Red Hat OpenShift Cluster Ingress Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage OpenShift router configuration without role assignment or identity plane rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/dnsZones/A/delete",
|                                                         "Microsoft.Network/dnsZones/A/write",
|                                                         "Microsoft.Network/privateDnsZones/A/delete",
|                                                         "Microsoft.Network/privateDnsZones/A/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5a382001-fe36-41ff-bba4-8bf06bd54da9",
|                                         "Name":  "Azure Sphere Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Azure Sphere resources and RBAC configuration but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureSphere/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Insights/DiagnosticSettings/*",
|                                                         "Microsoft.Insights/DiagnosticSettingsCategories/Read",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e2217c0e-04bb-4724-9580-91cf9871bc01",
|                                         "Name":  "GroupQuota Request Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and read quota requests but lacks permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "MICROSOFT.QUOTA/QUOTAS/WRITE",
|                                                         "MICROSOFT.QUOTA/QUOTAS/READ",
|                                                         "MICROSOFT.QUOTA/USAGES/READ",
|                                                         "MICROSOFT.QUOTA/QUOTAREQUESTS/READ",
|                                                         "MICROSOFT.QUOTA/REGISTER/ACTION",
|                                                         "Microsoft.Quota/GROUPQUOTAS/*/READ",
|                                                         "Microsoft.Quota/GROUPQUOTAS/*/WRITE",
|                                                         "Microsoft.Quota/GROUPQUOTAS/*/DELETE"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d0f495dc-44ef-4140-aeb0-b89110e6a7c1",
|                                         "Name":  "GroupQuota Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to quota requests with no role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "MICROSOFT.QUOTA/QUOTAS/READ",
|                                                         "MICROSOFT.QUOTA/USAGES/READ",
|                                                         "MICROSOFT.QUOTA/QUOTAREQUESTS/READ",
|                                                         "MICROSOFT.QUOTA/REGISTER/ACTION",
|                                                         "Microsoft.Quota/GROUPQUOTAS/READ",
|                                                         "Microsoft.Quota/GROUPQUOTAS/subscriptions/READ",
|                                                         "Microsoft.Quota/GROUPQUOTAS/groupQuotaLimits/READ",
|                                                         "Microsoft.Quota/GROUPQUOTAS/quotaAllocations/READ"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "539283cd-c185-4a9a-9503-d35217a1db7b",
|                                         "Name":  "Bayer Ag Powered Services Smart Boundary Solution User Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access limited to Smart Boundary Solution with no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/ingestionJobs/satelliteDataIngestionJobs/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/scenes/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8480c0f0-4509-4229-9339-7c10018cb8c4",
|                                         "Name":  "Defender CSPM Storage Scanner Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can enable and configure Defender CSPM features but lacks role assignment or identity plane modification rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Security/datascanners/read",
|                                                         "Microsoft.Security/datascanners/write",
|                                                         "Microsoft.Security/dataScanners/delete",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6b534d80-e337-47c4-864f-140f5c7f593d",
|                                         "Name":  "Advisor Recommendations Contributor (Assessments and Reviews)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage advisor recommendations lifecycle without permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Advisor/recommendations/read",
|                                                         "Microsoft.Advisor/recommendations/write",
|                                                         "Microsoft.Advisor/recommendations/available/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c9c97b9c-105d-4bb5-a2a7-7d15666c2484",
|                                         "Name":  "GeoCatalog Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of GeoCatalogs but no ability to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Orbital/operations/read",
|                                                         "Microsoft.Orbital/geoCatalogs/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b7b8f583-43d0-40ae-b147-6b46f53661c1",
|                                         "Name":  "GeoCatalog Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to GeoCatalogs with no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Orbital/operations/read",
|                                                         "Microsoft.Orbital/geoCatalogs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "eb5a76d5-50e7-4c33-a449-070e7c9c4cf2",
|                                         "Name":  "Healthcare Agent Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to bot resources without permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthBot/healthBots/ResourceData/Read",
|                                                             "Microsoft.HealthBot/healthBots/Metadata/Read",
|                                                             "Microsoft.HealthBot/healthBots/CopilotStudioSolution/RestoreBuiltinTemplate/Read",
|                                                             "Microsoft.HealthBot/healthBots/Feedback/Read",
|                                                             "Microsoft.HealthBot/healthBots/Users/Read",
|                                                             "Microsoft.HealthBot/healthBots/AuditTrails/Read",
|                                                             "Microsoft.HealthBot/healthBots/AnalyticReport/Read",
|                                                             "Microsoft.HealthBot/healthBots/ExposedSkill/Read",
|                                                             "Microsoft.HealthBot/healthBots/RegisteredSkills/Read",
|                                                             "Microsoft.HealthBot/healthBots/Configuration/Read",
|                                                             "Microsoft.HealthBot/healthBots/Localization/Read",
|                                                             "Microsoft.HealthBot/healthBots/AuthenticationProviders/Read",
|                                                             "Microsoft.HealthBot/healthBots/DataConnections/Read",
|                                                             "Microsoft.HealthBot/healthBots/OpenAPIPlugins/Read",
|                                                             "Microsoft.HealthBot/healthBots/Scenarios/*/Read",
|                                                             "Microsoft.HealthBot/healthBots/LanguageModels/Read",
|                                                             "Microsoft.HealthBot/healthBots/Resources/Files/Read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "af854a69-80ce-4ff7-8447-f1118a2e0ca8",
|                                         "Name":  "Healthcare Agent Editor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Edit bot resources except keys and secrets; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthBot/healthBots/ResourceData/Read",
|                                                             "Microsoft.HealthBot/healthBots/Metadata/Read",
|                                                             "Microsoft.HealthBot/healthBots/CopilotStudioSolution/*",
|                                                             "Microsoft.HealthBot/healthBots/Feedback/Read",
|                                                             "Microsoft.HealthBot/healthBots/Users/Read",
|                                                             "Microsoft.HealthBot/healthBots/AuditTrails/Read",
|                                                             "Microsoft.HealthBot/healthBots/AnalyticReport/Read",
|                                                             "Microsoft.HealthBot/healthBots/ExposedSkill/Read",
|                                                             "Microsoft.HealthBot/healthBots/RegisteredSkills/Read",
|                                                             "Microsoft.HealthBot/healthBots/Configuration/*",
|                                                             "Microsoft.HealthBot/healthBots/Localization/*",
|                                                             "Microsoft.HealthBot/healthBots/AuthenticationProviders/*",
|                                                             "Microsoft.HealthBot/healthBots/Channels/*",
|                                                             "Microsoft.HealthBot/healthBots/DataConnections/*",
|                                                             "Microsoft.HealthBot/healthBots/OpenAPIPlugins/*",
|                                                             "Microsoft.HealthBot/healthBots/Scenarios/*",
|                                                             "Microsoft.HealthBot/healthBots/LanguageModels/*",
|                                                             "Microsoft.HealthBot/healthBots/Resources/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f1082fec-a70f-419f-9230-885d2550fb38",
|                                         "Name":  "Healthcare Agent Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to bot resources including keys and secrets but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthBot/healthBots/ResourceData/Read",
|                                                             "Microsoft.HealthBot/healthBots/Metadata/Read",
|                                                             "Microsoft.HealthBot/healthBots/CopilotStudioSolution/*",
|                                                             "Microsoft.HealthBot/healthBots/Feedback/Read",
|                                                             "Microsoft.HealthBot/healthBots/Users/Read",
|                                                             "Microsoft.HealthBot/healthBots/AuditTrails/Read",
|                                                             "Microsoft.HealthBot/healthBots/AnalyticReport/Read",
|                                                             "Microsoft.HealthBot/healthBots/ExposedSkill/Read",
|                                                             "Microsoft.HealthBot/healthBots/RegisteredSkills/Read",
|                                                             "Microsoft.HealthBot/healthBots/Configuration/*",
|                                                             "Microsoft.HealthBot/healthBots/Localization/*",
|                                                             "Microsoft.HealthBot/healthBots/AuthenticationProviders/*",
|                                                             "Microsoft.HealthBot/healthBots/Channels/*",
|                                                             "Microsoft.HealthBot/healthBots/DataConnections/*",
|                                                             "Microsoft.HealthBot/healthBots/OpenAPIPlugins/*",
|                                                             "Microsoft.HealthBot/healthBots/Scenarios/*",
|                                                             "Microsoft.HealthBot/healthBots/LanguageModels/*",
|                                                             "Microsoft.HealthBot/healthBots/Resources/*",
|                                                             "Microsoft.HealthBot/healthBots/Admin/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c20923c5-b089-47a5-bf67-fd89569c4ad9",
|                                         "Name":  "Azure Programmable Connectivity Gateway Dataplane User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and limited write access to resource health and deployments; no identity plane control or role assignment capability.",
|                                         "Actions":  [
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ProgrammableConnectivity/Gateways/NetworkAPIAccess"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b556d68e-0be0-4f35-a333-ad7ee1ce17ea",
|                                         "Name":  "Azure AI Enterprise Network Connection Approver",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can approve private endpoint connections but lacks permissions to escalate to identity plane or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiManagement/service/privateEndpointConnections/read",
|                                                         "Microsoft.ApiManagement/service/privateEndpointConnections/write",
|                                                         "Microsoft.ApiManagement/service/privateLinkResources/read",
|                                                         "Microsoft.ApiManagement/service/read",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnections/read",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnections/write",
|                                                         "Microsoft.Cache/redis/read",
|                                                         "Microsoft.Cache/redis/privateEndpointConnections/read",
|                                                         "Microsoft.Cache/redis/privateEndpointConnections/write",
|                                                         "Microsoft.Cache/redis/privateLinkResources/read",
|                                                         "Microsoft.Cache/redis/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Cache/redisEnterprise/read",
|                                                         "Microsoft.Cache/redisEnterprise/privateEndpointConnections/read",
|                                                         "Microsoft.Cache/redisEnterprise/privateEndpointConnections/write",
|                                                         "Microsoft.Cache/redisEnterprise/privateLinkResources/read",
|                                                         "Microsoft.Cache/redisEnterprise/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.CognitiveServices/accounts/read",
|                                                         "Microsoft.CognitiveServices/accounts/privateEndpointConnections/read",
|                                                         "Microsoft.CognitiveServices/accounts/privateEndpointConnections/write",
|                                                         "Microsoft.CognitiveServices/accounts/privateLinkResources/read",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/read",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/write",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/privateLinkResources/read",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/read",
|                                                         "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/read",
|                                                         "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/write",
|                                                         "Microsoft.DBforPostgreSQL/serverGroupsv2/privateLinkResources/read",
|                                                         "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/read",
|                                                         "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/write",
|                                                         "Microsoft.DBforMySQL/flexibleServers/privateLinkResources/read",
|                                                         "Microsoft.DBforMySQL/flexibleServers/read",
|                                                         "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/operationResults/read",
|                                                         "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/read",
|                                                         "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write",
|                                                         "Microsoft.DocumentDB/databaseAccounts/privateLinkResources/read",
|                                                         "Microsoft.DocumentDB/databaseAccounts/read",
|                                                         "Microsoft.KeyVault/vaults/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.KeyVault/vaults/privateEndpointConnections/read",
|                                                         "Microsoft.KeyVault/vaults/privateEndpointConnections/write",
|                                                         "Microsoft.KeyVault/vaults/privateLinkResources/read",
|                                                         "Microsoft.KeyVault/vaults/read",
|                                                         "Microsoft.MachineLearningServices/registries/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.MachineLearningServices/registries/privateEndpointConnections/read",
|                                                         "Microsoft.MachineLearningServices/registries/privateEndpointConnections/write",
|                                                         "Microsoft.MachineLearningServices/registries/privateLinkResources/read",
|                                                         "Microsoft.MachineLearningServices/registries/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/write",
|                                                         "Microsoft.MachineLearningServices/workspaces/privateLinkResources/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/read",
|                                                         "Microsoft.Storage/storageAccounts/privateEndpointConnections/read",
|                                                         "Microsoft.Storage/storageAccounts/privateEndpointConnections/write",
|                                                         "Microsoft.Storage/storageAccounts/privateLinkResources/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Sql/servers/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Sql/servers/privateEndpointConnections/read",
|                                                         "Microsoft.Sql/servers/privateEndpointConnections/write",
|                                                         "Microsoft.Sql/servers/privateLinkResources/read",
|                                                         "Microsoft.Sql/servers/read",
|                                                         "Microsoft.EventHub/namespaces/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.EventHub/namespaces/privateEndpointConnections/read",
|                                                         "Microsoft.EventHub/namespaces/privateEndpointConnections/write",
|                                                         "Microsoft.EventHub/namespaces/privateLinkResources/read",
|                                                         "Microsoft.EventHub/namespaces/read",
|                                                         "Microsoft.Search/searchServices/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Search/searchServices/privateEndpointConnections/read",
|                                                         "Microsoft.Search/searchServices/privateEndpointConnections/write",
|                                                         "Microsoft.Search/searchServices/sharedPrivateLinkResources/read",
|                                                         "Microsoft.Search/searchServices/read",
|                                                         "Microsoft.Insights/privatelinkscopes/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Insights/privatelinkscopes/privateEndpointConnections/read",
|                                                         "Microsoft.Insights/privatelinkscopes/privateEndpointConnections/write",
|                                                         "Microsoft.Insights/privatelinkscopes/privateLinkResources/read",
|                                                         "Microsoft.Insights/privatelinkscopes/read",
|                                                         "Microsoft.Network/privateLinkServices/privateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Network/privateLinkServices/privateEndpointConnections/read",
|                                                         "Microsoft.Network/privateLinkServices/privateEndpointConnections/write",
|                                                         "Microsoft.Network/privateLinkServices/read",
|                                                         "Microsoft.Network/applicationGateways/privateEndpointConnections/read",
|                                                         "Microsoft.Network/applicationGateways/privateEndpointConnections/write",
|                                                         "Microsoft.Network/applicationGateways/privateLinkResources/read",
|                                                         "Microsoft.Network/applicationGateways/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "08d4c71a-cc63-4ce4-a9c8-5dd251b4d619",
|                                         "Name":  "Azure Container Storage Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages container storage network and virtual network settings but no direct identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ElasticSan/elasticSans/*",
|                                                         "Microsoft.ElasticSan/locations/asyncoperations/read",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/virtualNetworks/write",
|                                                         "Microsoft.Network/virtualNetworks/delete",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/read",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/write",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
|                                                         "Microsoft.Resources/subscriptions/providers/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Network/virtualNetworks/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "95dd08a6-00bd-4661-84bf-f6726f83a4d0",
|                                         "Name":  "Azure Container Storage Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage container storage extensions and read authorizations but no path to identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "95de85bd-744d-4664-9dde-11430bc34793",
|                                         "Name":  "Azure Container Storage Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to container storage resources but no permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.ElasticSan/elasticSans/*",
|                                                         "Microsoft.ElasticSan/locations/*",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/*",
|                                                         "Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/*",
|                                                         "Microsoft.ElasticSan/locations/asyncoperations/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                         "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Management/managementGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d3f1697-4507-4d08-bb4a-477695db5f82",
|                                         "Name":  "Azure Kubernetes Service Arc Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read/write access to hybrid Kubernetes clusters without identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridContainerService/Locations/operationStatuses/read",
|                                                         "Microsoft.HybridContainerService/Locations/operationStatuses/write",
|                                                         "Microsoft.HybridContainerService/Operations/read",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/read",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/write",
|                                                         "Microsoft.HybridContainerService/kubernetesVersions/delete",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/write",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/delete",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/write",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/delete",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/upgradeProfiles/read",
|                                                         "Microsoft.HybridContainerService/skus/read",
|                                                         "Microsoft.HybridContainerService/skus/write",
|                                                         "Microsoft.HybridContainerService/skus/delete",
|                                                         "Microsoft.HybridContainerService/virtualNetworks/read",
|                                                         "Microsoft.HybridContainerService/virtualNetworks/write",
|                                                         "Microsoft.HybridContainerService/virtualNetworks/delete",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/read",
|                                                         "Microsoft.Kubernetes/connectedClusters/Read",
|                                                         "Microsoft.Kubernetes/connectedClusters/Write",
|                                                         "Microsoft.Kubernetes/connectedClusters/Delete",
|                                                         "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action",
|                                                         "Microsoft.AzureStackHCI/clusters/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/hybridIdentityMetadata/delete",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/hybridIdentityMetadata/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "233ca253-b031-42ff-9fba-87ef12d6b55f",
|                                         "Name":  "Azure Kubernetes Service Arc Cluster User Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can list cluster user credentials but no permissions to escalate or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/listUserKubeconfig/action",
|                                                         "Microsoft.Kubernetes/connectedClusters/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b29efa5f-7782-4dc3-9537-4d5bc70a5e9f",
|                                         "Name":  "Azure Kubernetes Service Arc Cluster Admin Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can list cluster admin credentials but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                         "Microsoft.HybridContainerService/provisionedClusterInstances/listAdminKubeconfig/action",
|                                                         "Microsoft.Kubernetes/connectedClusters/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c2a970b4-16a7-4a51-8c84-8a8ea6ee0bb8",
|                                         "Name":  "Backup MUA Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create/delete ResourceGuards but no direct identity plane control or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.DataProtection/*/read",
|                                                         "Microsoft.DataProtection/*/resourceGuards/write",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/write",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/delete",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/read",
|                                                         "Microsoft.DataProtection/locations/operationResults/read",
|                                                         "Microsoft.DataProtection/locations/operationStatus/read",
|                                                         "Microsoft.DataProtection/locations/getBackupStatus/action",
|                                                         "Microsoft.DataProtection/locations/checkFeatureSupport/action",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/operationStatus/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/read",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/write",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/delete",
|                                                         "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/unlockDelete/action",
|                                                         "Microsoft.DataProtection/subscriptions/providers/resourceGuards/read",
|                                                         "Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/{operationName}/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f54b6d04-23c6-443e-b462-9c16ab7b4a52",
|                                         "Name":  "Backup MUA Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can perform critical backup operations but no path to identity plane or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.DataProtection/*/action",
|                                                         "Microsoft.DataProtection/*/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3d24a3a0-c154-4f6f-a5ed-adc8e01ddb74",
|                                         "Name":  "Savings plan Purchaser",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can purchase savings plans but no permissions to modify roles or identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Capacity/register/action",
|                                                         "Microsoft.Capacity/catalogs/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.BillingBenefits/savingsPlanOrders/write",
|                                                         "Microsoft.BIllingBenefits/register/action",
|                                                         "Microsoft.Support/supporttickets/write",
|                                                         "Microsoft.Billing/billingProperty/read",
|                                                         "Microsoft.CostManagement/benefitRecommendations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "399c3b2b-64c2-4ff1-af34-571db925b068",
|                                         "Name":  "CrossConnectionManager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to ExpressRoute CrossConnections but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ClassicNetwork/expressRouteCrossConnections/*",
|                                                         "Microsoft.Network/expressRouteCrossConnections/*",
|                                                         "Microsoft.Features/providers/features/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.Network/expressRouteCrossConnections/delete"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b6ee44de-fe58-4ddc-b5c2-ab174eb23f05",
|                                         "Name":  "CrossConnectionReader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to ExpressRoute CrossConnections; no identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ClassicNetwork/expressRouteCrossConnections/*/read",
|                                                         "Microsoft.Network/expressRouteCrossConnections/*/read",
|                                                         "Microsoft.Features/providers/features/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5e93ba01-8f92-4c7a-b12a-801e3df23824",
|                                         "Name":  "Defender Containers Sensor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to Kubernetes clusters and alert rules; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.ContainerService/managedClusters/read",
|                                                         "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/delete",
|                                                         "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read",
|                                                         "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/write",
|                                                         "Microsoft.ContainerService/managedClusters/write",
|                                                         "Microsoft.Security/pricings/securityoperators/read",
|                                                         "Microsoft.Security/securityOperators/read",
|                                                         "Microsoft.OperationalInsights/workspaces/write",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.OperationalInsights/workspaces/listKeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedkeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedkeys/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ede9aaa3-4627-494e-be13-4aa7c256148d",
|                                         "Name":  "Azure API Center Compliance Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage API compliance but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiCenter/services/*/read",
|                                                         "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/updateAnalysisState/action",
|                                                         "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/exportSpecification/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6cba8790-29c5-48e5-bab1-c7541b01cb04",
|                                         "Name":  "Azure API Center Service Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to API Center service; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiCenter/services/*/read",
|                                                         "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/exportSpecification/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dd24193f-ef65-44e5-8a7e-6fa6e03f7713",
|                                         "Name":  "Azure API Center Service Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage API Center service but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ApiCenter/services/*",
|                                                         "Microsoft.ApiCenter/deletedServices/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/updateAnalysisState/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b5b192c1-773c-4543-bfb0-6c59254b74a9",
|                                         "Name":  "Bayer Ag Powered Services Historical Weather Data Solution User Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No permissions specified; assumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/farms/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/farms/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4caf51ec-f9f5-413f-8a94-b9f5fddba66b",
|                                         "Name":  "Oracle Subscriptions Manager Built-in Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Oracle subscription resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Oracle.Database/oracleSubscriptions/*/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/write",
|                                                         "Oracle.Database/oracleSubscriptions/*/delete",
|                                                         "Oracle.Database/oracleSubscriptions/*/action",
|                                                         "Oracle.Database/Locations/*/read",
|                                                         "Oracle.Database/Locations/*/write",
|                                                         "Oracle.Database/Operations/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4562aac9-b209-4bd7-a144-6d7f3bb516f4",
|                                         "Name":  "Oracle.Database Owner Built-in Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of Oracle database resources without identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Oracle.Database/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Compute/sshPublicKeys/read",
|                                                         "Microsoft.Compute/sshPublicKeys/write",
|                                                         "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d623d097-b882-4e1e-a26f-ac60e31065a1",
|                                         "Name":  "Oracle.Database Reader Built-in Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Oracle database resources; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Oracle.Database/Locations/*/read",
|                                                         "Oracle.Database/Operations/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/read",
|                                                         "Oracle.Database/cloudExadataInfrastructures/*/read",
|                                                         "Oracle.Database/cloudVmClusters/*/read",
|                                                         "Oracle.Database/cloudVmClusters/listPrivateIpAddresses/action",
|                                                         "Oracle.Database/oracleSubscriptions/listCloudAccountDetails/action",
|                                                         "Oracle.Database/exascaleDbStorageVaults/read",
|                                                         "Oracle.Database/exadbVmClusters/*/read",
|                                                         "Oracle.Database/resourceAnchors/read",
|                                                         "Oracle.Database/networkAnchors/read",
|                                                         "Oracle.Database/autonomousDatabases/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/locations/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e9ce8739-6fa2-4123-a0a2-0ef41a67806f",
|                                         "Name":  "Oracle.Database VmCluster Administrator Built-in Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of VmCluster resources but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Oracle.Database/cloudVmClusters/*/read",
|                                                         "Oracle.Database/cloudVmClusters/*/write",
|                                                         "Oracle.Database/cloudVmClusters/*/delete",
|                                                         "Oracle.Database/cloudExadataInfrastructures/write",
|                                                         "Oracle.Database/cloudExadataInfrastructures/*/read",
|                                                         "Oracle.Database/Locations/*/read",
|                                                         "Oracle.Database/Locations/*/write",
|                                                         "Oracle.Database/Operations/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/read",
|                                                         "Oracle.Database/resourceAnchors/*",
|                                                         "Oracle.Database/networkAnchors/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Compute/sshPublicKeys/read",
|                                                         "Microsoft.Compute/sshPublicKeys/write",
|                                                         "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4cfdd23b-aece-4fd1-b614-ad3a06c53453",
|                                         "Name":  "Oracle.Database Exadata Infrastructure Administrator Built-in Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of Exadata infrastructure resources without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Oracle.Database/cloudExadataInfrastructures/*/read",
|                                                         "Oracle.Database/cloudExadataInfrastructures/*/write",
|                                                         "Oracle.Database/cloudExadataInfrastructures/*/delete",
|                                                         "Oracle.Database/cloudVmClusters/*/read",
|                                                         "Oracle.Database/cloudVmClusters/*/write",
|                                                         "Oracle.Database/cloudVmClusters/*/delete",
|                                                         "Oracle.Database/cloudVmClusters/*/action",
|                                                         "Oracle.Database/Locations/*/read",
|                                                         "Oracle.Database/Locations/*/write",
|                                                         "Oracle.Database/Operations/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/read",
|                                                         "Oracle.Database/oracleSubscriptions/listCloudAccountDetails/action",
|                                                         "Oracle.Database/resourceAnchors/*",
|                                                         "Oracle.Database/networkAnchors/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Compute/sshPublicKeys/read",
|                                                         "Microsoft.Compute/sshPublicKeys/write",
|                                                         "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "25211fc6-dc78-40b6-b205-e4ac934fd9fd",
|                                         "Name":  "Azure Spring Apps Application Configuration Service Config File Pattern Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to configuration files only; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.AppPlatform/Spring/read",
|                                                         "Microsoft.AppPlatform/Spring/configurationServices/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/ApplicationConfigurationService/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f27b7598-bc64-41f7-8a44-855ff16326c2",
|                                         "Name":  "Azure Messaging Catalog Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to messaging catalog resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.MessagingCatalog/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.MessagingCatalog/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d9c6a55-fc0e-4e21-ae6f-f7b095497342",
|                                         "Name":  "Azure Hybrid Database Administrator - Read Only Service Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to hybrid database services; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureArcData/*/read",
|                                                         "Microsoft.AzureArcData/sqlServerInstances/getTelemetry/action",
|                                                         "Microsoft.AzureArcData/sqlServerInstances/availabilityGroups/getDetailView/action",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c18f9900-27b8-47c7-a8f0-5b3b3d4c2bc2",
|                                         "Name":  "Microsoft Sentinel Business Applications Agent Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and update business application agents but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/read",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/write",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/systems/read",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/systems/write",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/systems/listActions/action",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/systems/reportActionStatus/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0fb8eba5-a2bb-4abe-b1c1-49dfad359bb0",
|                                         "Name":  "Azure ContainerApps Session Executor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and execute sessions but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/sessionPools/*/read",
|                                                         "Microsoft.App/sessionPools/sessions/generatesessions/action",
|                                                         "Microsoft.App/sessionPools/fetchMcpServerCredentials/action",
|                                                         "Microsoft.App/sessionPools/rotateMcpServerCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.App/sessionPools/*/read",
|                                                             "Microsoft.App/sessionPools/interpreters/execute/action",
|                                                             "Microsoft.App/sessionPools/interpreters/read",
|                                                             "Microsoft.App/sessionPools/executions/*",
|                                                             "Microsoft.App/sessionPools/files/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "83ee7727-862c-4213-8ed8-2ce6c5d69a40",
|                                         "Name":  "Microsoft.Edge Winfields federated subscription read access role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to federated subscriptions; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "39138f76-04e6-41f0-ba6b-c411b59081a9",
|                                         "Name":  "Bayer Ag Powered Services Crop Id Solution User Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No permissions specified; assumed no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/ingestionJobs/satelliteDataIngestionJobs/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/scenes/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b67fe603-310e-4889-b9ee-8257d09d353d",
|                                         "Name":  "Scheduled Events Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can acknowledge scheduled events and read VM info but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Maintenance/scheduledevents/acknowledge/action",
|                                                         "Microsoft.Compute/VirtualMachines/read",
|                                                         "Microsoft.Compute/VirtualMachineScaleSets/read",
|                                                         "Microsoft.Compute/AvailabilitySets/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e82342c9-ac7f-422b-af64-e426d2e12b2d",
|                                         "Name":  "Compute Recommendations Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can generate placement scores but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/locations/placementScores/generate/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b459aa1d-e3c8-436f-ae21-c0531140f43e",
|                                         "Name":  "Azure Spring Apps Job Log Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to job logs only; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AppPlatform/Spring/read",
|                                                         "Microsoft.AppPlatform/Spring/jobs/read",
|                                                         "Microsoft.AppPlatform/Spring/jobs/executions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/jobs/executions/logstream/action",
|                                                             "Microsoft.AppPlatform/Spring/jobs/executions/listInstances/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "91422e52-bb88-4415-bb4a-90f5b71f6dcb",
|                                         "Name":  "Azure Spring Apps Job Execution Instance List Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can list job execution instances but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/jobs/executions/listInstances/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a5eb8433-97a5-4a06-80b2-a877e1622c31",
|                                         "Name":  "Nexus Network Fabric Service Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-write access to network fabric service but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ManagedNetworkFabric/*/read",
|                                                         "Microsoft.ManagedNetworkFabric/*/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "05fdd44c-adc6-4aff-981c-61041f0c929a",
|                                         "Name":  "Nexus Network Fabric Service Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to network fabric service; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ManagedNetworkFabric/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationStatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "adb29209-aa1d-457b-a786-c913953d2891",
|                                         "Name":  "Azure Deployment Stack Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage deployment stacks including deny assignments but no direct identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deploymentStacks/*",
|                                                         "Microsoft.Resources/deploymentStacksWhatIfResults/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bf7f8882-3383-422a-806a-6526c631a88a",
|                                         "Name":  "Azure Deployment Stack Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage deployment stacks without deny assignment creation; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deploymentStacks/write",
|                                                         "Microsoft.Resources/deploymentStacks/read",
|                                                         "Microsoft.Resources/deploymentStacks/validate/action",
|                                                         "Microsoft.Resources/deploymentStacks/exportTemplate/action",
|                                                         "Microsoft.Resources/deploymentStacksWhatIfResults/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "74252426-c508-480e-9345-4607bbebead4",
|                                         "Name":  "Azure Spring Apps Spring Cloud Config Server Log Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to config server logs only; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AppPlatform/Spring/read",
|                                                         "Microsoft.AppPlatform/Spring/configServers/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/Spring/configService/logstream/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bfdb9389-c9a5-478a-bb2f-ba9ca092c3c7",
|                                         "Name":  "Container Registry Repository Catalog Lister",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can list container registry repositories but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/catalog/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2efddaa5-3f1f-4df3-97df-af3f13818f4c",
|                                         "Name":  "Container Registry Repository Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read, write, and delete access to container registry repositories but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/write",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/write",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/delete",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b93aa761-3e63-49ed-ac28-beffa264f7ac",
|                                         "Name":  "Container Registry Repository Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to container registry repositories only; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2a1e307c-b015-4ebd-883e-5b7698a07328",
|                                         "Name":  "Container Registry Repository Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to container registry repositories but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/write",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "78e4b983-1a0b-472e-8b7d-8d770f7c5890",
|                                         "Name":  "DeID Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to DeID data but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthDataAIServices/DeidServices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "28bf596f-4eb7-45ce-b5bc-6cf482fec137",
|                                         "Name":  "Locks Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage resource locks but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/locks/read",
|                                                         "Microsoft.Authorization/locks/write",
|                                                         "Microsoft.Authorization/locks/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b1e6a0dd-ea0f-4108-8925-7047693f2cfe",
|                                         "Name":  "CloudTest Leased VM Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can view leased VM credentials but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.CloudTest/pools/leases/action",
|                                                         "Microsoft.CloudTest/pools/leases/complete/action",
|                                                         "Microsoft.CloudTest/pools/leases/extend/action",
|                                                         "Microsoft.CloudTest/hostedpools/leases/action",
|                                                         "Microsoft.CloudTest/hostedpools/leases/complete/action",
|                                                         "Microsoft.CloudTest/hostedpools/leases/extend/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "39fcb0de-8844-4706-b050-c28ddbe3ff83",
|                                         "Name":  "Standby Container Group Pool Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage standby container group pool resources but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.ContainerInstance/containerGroupProfiles/read",
|                                                         "Microsoft.ContainerInstance/containerGroupProfiles/revisions/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.StandbyPool/Locations/OperationStatuses/read",
|                                                         "Microsoft.StandbyPool/Operations/read",
|                                                         "Microsoft.StandbyPool/standbyContainerGroupPools/delete",
|                                                         "Microsoft.StandbyPool/standbyContainerGroupPools/read",
|                                                         "Microsoft.StandbyPool/standbyContainerGroupPools/runtimeViews/read",
|                                                         "Microsoft.StandbyPool/standbyContainerGroupPools/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "85a2d0d9-2eba-4c9c-b355-11c2cc0788ab",
|                                         "Name":  "Compute Gallery Artifacts Publisher",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Publish gallery artifacts but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/galleries/*",
|                                                         "Microsoft.Compute/locations/capsOperations/read",
|                                                         "Microsoft.Compute/locations/communityGalleries/*",
|                                                         "Microsoft.Compute/locations/sharedGalleries/*",
|                                                         "Microsoft.Compute/images/*",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.Compute/galleries/share/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c5826735-177b-4a0d-a9a3-d0e4b4bda107",
|                                         "Name":  "ToolchainOrchestrator Viewer Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to toolchain orchestrator resources; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ToolchainOrchestrator/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a3ab03bc-5350-42ff-b0d5-00207672db55",
|                                         "Name":  "ProviderHub Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows management of ProviderHub resources but explicitly does not allow role assignments or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ProviderHub/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4d8c6f2e-3fd6-4d40-826e-93e3dc4c3fc1",
|                                         "Name":  "ProviderHub Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to ProviderHub resources with no ability to modify or escalate privileges.",
|                                         "Actions":  [
|                                                         "Microsoft.ProviderHub/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c99c945f-8bd1-4fb1-a903-01460aae6068",
|                                         "Name":  "Azure Stack HCI Connected InfraVMs",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Azure Stack HCI VMs but lacks permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/*/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/machines/UpgradeExtensions/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dfce8971-25e3-42e3-ba33-6055438e3080",
|                                         "Name":  "VM Restore Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and delete VM restore resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/disks/beginGetAccess/action",
|                                                         "Microsoft.Compute/disks/endGetAccess/action",
|                                                         "Microsoft.Compute/locations/diskOperations/read",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachines/delete",
|                                                         "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/write",
|                                                         "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Network/locations/operationResults/read",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Network/locations/usages/read",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/networkInterfaces/ipconfigurations/read",
|                                                         "Microsoft.Network/networkInterfaces/join/action",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                         "Microsoft.Network/publicIPAddresses/delete",
|                                                         "Microsoft.Network/publicIPAddresses/join/action",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/publicIPAddresses/write",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/checkNameAvailability/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4aa368ec-fba9-4e93-81ed-396b3d461cc5",
|                                         "Name":  "Operator Nexus Compute Contributor Role (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to authorization and diagnostic settings without role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/classicAdministrators/operationstatuses/read",
|                                                         "Microsoft.Authorization/classicAdministrators/read",
|                                                         "Microsoft.Authorization/denyAssignments/read",
|                                                         "Microsoft.Authorization/diagnosticSettings/read",
|                                                         "Microsoft.Authorization/diagnosticSettingsCategories/read",
|                                                         "Microsoft.Authorization/locks/read",
|                                                         "Microsoft.Authorization/operations/read",
|                                                         "Microsoft.Authorization/permissions/read",
|                                                         "Microsoft.Authorization/policyAssignments/read",
|                                                         "Microsoft.Authorization/policyAssignments/privateLinkAssociations/read",
|                                                         "Microsoft.Authorization/policyAssignments/resourceManagementPrivateLinks/read",
|                                                         "Microsoft.Authorization/policyAssignments/resourceManagementPrivateLinks/privateEndpointConnectionProxies/read",
|                                                         "Microsoft.Authorization/policyAssignments/resourceManagementPrivateLinks/privateEndpointConnections/read",
|                                                         "Microsoft.Authorization/policyDefinitions/read",
|                                                         "Microsoft.Authorization/policyExemptions/read",
|                                                         "Microsoft.Authorization/policySetDefinitions/read",
|                                                         "Microsoft.Authorization/providerOperations/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleAssignmentScheduleInstances/read",
|                                                         "Microsoft.Authorization/roleAssignmentScheduleRequests/read",
|                                                         "Microsoft.Authorization/roleAssignmentSchedules/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read",
|                                                         "Microsoft.Authorization/roleEligibilityScheduleInstances/read",
|                                                         "Microsoft.Authorization/roleEligibilityScheduleRequests/read",
|                                                         "Microsoft.Authorization/roleEligibilitySchedules/read",
|                                                         "Microsoft.Authorization/roleManagementPolicies/read",
|                                                         "Microsoft.Authorization/roleManagementPolicyAssignments/read",
|                                                         "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                         "Microsoft.ExtendedLocation/customLocations/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.Insights/alertRules/activated/action",
|                                                         "Microsoft.Insights/alertRules/delete",
|                                                         "Microsoft.Insights/alertRules/incidents/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Insights/alertRules/resolved/action",
|                                                         "Microsoft.Insights/alertRules/throttled/action",
|                                                         "Microsoft.Insights/alertRules/write",
|                                                         "Microsoft.Kubernetes/connectedClusters/read",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read",
|                                                         "Microsoft.ManagedNetworkFabric/networkFabricControllers/join/action",
|                                                         "Microsoft.ManagedNetworkFabric/networkFabrics/join/action",
|                                                         "Microsoft.ManagedNetworkFabric/networkRacks/join/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/cordon/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/delete",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/powerOff/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/read",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/reimage/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/replace/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/restart/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/runDataExtracts/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/runReadCommands/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/start/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/uncordon/action",
|                                                         "Microsoft.NetworkCloud/bareMetalMachines/write",
|                                                         "Microsoft.NetworkCloud/clusterManagers/delete",
|                                                         "Microsoft.NetworkCloud/clusterManagers/read",
|                                                         "Microsoft.NetworkCloud/clusterManagers/write",
|                                                         "Microsoft.NetworkCloud/clusters/bareMetalMachineKeySets/read",
|                                                         "Microsoft.NetworkCloud/clusters/bmcKeySets/read",
|                                                         "Microsoft.NetworkCloud/clusters/continueUpdateVersion/action",
|                                                         "Microsoft.NetworkCloud/clusters/delete",
|                                                         "Microsoft.NetworkCloud/clusters/deploy/action",
|                                                         "Microsoft.NetworkCloud/clusters/metricsConfigurations/delete",
|                                                         "Microsoft.NetworkCloud/clusters/metricsConfigurations/read",
|                                                         "Microsoft.NetworkCloud/clusters/metricsConfigurations/write",
|                                                         "Microsoft.NetworkCloud/clusters/read",
|                                                         "Microsoft.NetworkCloud/clusters/scanRuntime/action",
|                                                         "Microsoft.NetworkCloud/clusters/updateVersion/action",
|                                                         "Microsoft.NetworkCloud/clusters/write",
|                                                         "Microsoft.NetworkCloud/locations/operationStatuses/read",
|                                                         "Microsoft.NetworkCloud/operations/read",
|                                                         "Microsoft.NetworkCloud/rackSkus/read",
|                                                         "Microsoft.NetworkCloud/racks/delete",
|                                                         "Microsoft.NetworkCloud/racks/join/action",
|                                                         "Microsoft.NetworkCloud/racks/read",
|                                                         "Microsoft.NetworkCloud/racks/write",
|                                                         "Microsoft.NetworkCloud/register/action",
|                                                         "Microsoft.NetworkCloud/registeredSubscriptions/read",
|                                                         "Microsoft.NetworkCloud/storageAppliances/read",
|                                                         "Microsoft.NetworkCloud/unregister/action",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6cdbb904-5ff3-429d-8169-7d7818b91bd8",
|                                         "Name":  "Connector Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to connectors and related resources with no privilege escalation path.",
|                                         "Actions":  [
|                                                         "Microsoft.Impact/Connectors/Read",
|                                                         "Microsoft.Impact/WorkloadImpacts/Read",
|                                                         "Microsoft.Impact/WorkloadImpacts/Insights/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "41e04612-9dac-4699-a02b-c82ff2cc3fb5",
|                                         "Name":  "Grafana Limited Viewer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "View-only access to Grafana home page with no privilege escalation capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Dashboard/grafana/ActAsGrafanaLimitedViewer/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1af232de-e806-426f-8ca1-c36142449755",
|                                         "Name":  "Bayer Ag Powered Services Field Imagery Solution Service Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed limited to data plane with no identity or role assignment access.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*",
|                                                             "Microsoft.AgFoodPlatform/farmBeats/scenes/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cf7c76d2-98a3-4358-a134-615aa78bf44d",
|                                         "Name":  "Compute Gallery Image Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to gallery images with no privilege escalation path.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/galleries/images/read",
|                                                         "Microsoft.Compute/galleries/images/versions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "edd66693-d32a-450b-997d-0158c03976b0",
|                                         "Name":  "Container Apps Jobs Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Container Apps jobs with no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "microsoft.app/jobs/read",
|                                                         "Microsoft.App/jobs/*/read",
|                                                         "Microsoft.App/managedenvironments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f3bd1b5c-91fa-40e7-afe7-0c11d331232c",
|                                         "Name":  "Container Apps Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and exec access to Container Apps without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/containerApps/*/read",
|                                                         "Microsoft.App/containerApps/*/action",
|                                                         "Microsoft.App/managedEnvironments/read",
|                                                         "Microsoft.App/managedEnvironments/*/read",
|                                                         "Microsoft.App/managedEnvironments/join/action",
|                                                         "Microsoft.App/managedEnvironments/checknameavailability/action",
|                                                         "Microsoft.App/connectedEnvironments/read",
|                                                         "Microsoft.App/connectedEnvironments/*/read",
|                                                         "Microsoft.App/connectedEnvironments/join/action",
|                                                         "Microsoft.App/connectedEnvironments/checknameavailability/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.App/containerApps/logstream/action",
|                                                             "Microsoft.App/containerApps/exec/action",
|                                                             "Microsoft.App/containerApps/debug/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "af61e8fc-2633-4b95-bed3-421ad6826515",
|                                         "Name":  "Container Apps SessionPools Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Container Apps session pools with no privilege escalation path.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/sessionPools/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1b32c00b-7eff-4c22-93e6-93d11d72d2d8",
|                                         "Name":  "Container Apps ManagedEnvironments Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Container Apps ManagedEnvironments with no privilege escalation path.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/managedEnvironments/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0ad04412-c4d5-4796-b79c-f76d14c8d402",
|                                         "Name":  "Durable Task Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed data access only with no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DurableTask/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2a740172-0fc2-4039-972c-b31864cd47d6",
|                                         "Name":  "Azure Device Update Agent",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed limited to device update operations without identity plane access.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DeviceUpdate/updateAccounts/agents/requestUpdate/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2142ea27-02ad-4094-bfea-2dbac6d24934",
|                                         "Name":  "Enclave Approver Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and approve enclave requests but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Mission/Operations/read",
|                                                         "Microsoft.Mission/communities/read",
|                                                         "Microsoft.Mission/virtualEnclaves/read",
|                                                         "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Features/providers/features/read",
|                                                         "Microsoft.Features/features/read",
|                                                         "Microsoft.Mission/communities/communityEndpoints/read",
|                                                         "Microsoft.Mission/communities/transitHubs/read",
|                                                         "Microsoft.Mission/enclaveConnections/read",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                         "Microsoft.Mission/approvals/read",
|                                                         "Microsoft.Mission/approvals/write",
|                                                         "Microsoft.Mission/enclaveConnections/approvalCallback/action",
|                                                         "Microsoft.Mission/virtualEnclaves/approvalCallback/action",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/approvalCallback/action",
|                                                         "Microsoft.Mission/communities/communityEndpoints/approvalCallback/action",
|                                                         "Microsoft.Mission/approvals/initiatorCallback/action",
|                                                         "Microsoft.Mission/communities/setMaintenanceMode/action",
|                                                         "Microsoft.Mission/communities/communityendpoints/connect/action",
|                                                         "Microsoft.Mission/virtualEnclaves/setWorkloadRoleAssignments/action",
|                                                         "Microsoft.Mission/virtualEnclaves/setEnclaveRoleAssignments/action",
|                                                         "Microsoft.Mission/virtualEnclaves/setSubnetConfiguration/action",
|                                                         "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/connect/action",
|                                                         "Microsoft.Mission/enclaveConnections/setSourceCidr/action",
|                                                         "Microsoft.Mission/virtualenclaves/setMaintenanceMode/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b5b0c71d-aca9-4081-aee2-9b1bb335fc1a",
|                                         "Name":  "Cognitive Services Face Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Face APIs but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.Authorization/roleDefinitions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/Face/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "175b81b9-6e0d-490a-85e4-0d422273c10c",
|                                         "Name":  "App Configuration Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to App Configuration management plane without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AppConfiguration/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "577a9874-89fd-4f24-9dbd-b5034d0ad23a",
|                                         "Name":  "Container Registry Data Importer and Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can import and read container registry data but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/importImage/action",
|                                                         "Microsoft.ContainerRegistry/registries/read",
|                                                         "Microsoft.ContainerRegistry/registries/pull/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                             "Microsoft.ContainerRegistry/registries/catalog/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1dfc38e8-6ce7-447f-807c-029c65262c5f",
|                                         "Name":  "Stream Analytics Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Stream Analytics resources with no privilege escalation path.",
|                                         "Actions":  [
|                                                         "Microsoft.StreamAnalytics/streamingjobs/Read",
|                                                         "Microsoft.StreamAnalytics/streamingjobs/*/Read",
|                                                         "Microsoft.StreamAnalytics/clusters/Read",
|                                                         "Microsoft.StreamAnalytics/clusters/*/Read",
|                                                         "Microsoft.StreamAnalytics/clusters/ListStreamingJobs/action",
|                                                         "Microsoft.StreamAnalytics/locations/*/Read",
|                                                         "Microsoft.StreamAnalytics/operations/Read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "80d0d6b0-f522-40a4-8886-a5a11720c375",
|                                         "Name":  "Durable Task Worker",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed limited to worker operations without identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DurableTask/schedulers/taskhubs/orchestrations/execute/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "78eacb5e-e318-4560-85a9-e6a724ca60c9",
|                                         "Name":  "Portal Dashboard Writer Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can write portal dashboards but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Portal/dashboards/read",
|                                                         "Microsoft.Portal/dashboards/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2718b1f7-eb07-424e-8868-0137541392a1",
|                                         "Name":  "Landing Zone Account Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to landing zone accounts and policies; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Sovereign/landingZoneAccounts/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "11076f67-66f6-4be0-8f6b-f0609fd05cc9",
|                                         "Name":  "Azure Batch Account Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to batch account resources; no permissions to modify roles or credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Batch/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Batch/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "48e5e92e-a480-4e71-aa9c-2778f4c13781",
|                                         "Name":  "Azure Batch Job Submitter",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can submit and manage jobs but lacks permissions to escalate privileges or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Batch/batchAccounts/applications/read",
|                                                         "Microsoft.Batch/batchAccounts/applications/versions/read",
|                                                         "Microsoft.Batch/batchAccounts/pools/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Batch/batchAccounts/jobSchedules/*",
|                                                             "Microsoft.Batch/batchAccounts/jobs/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5c2d7e57-b7c2-4d8a-be4f-82afa42c6e95",
|                                         "Name":  "Azure Managed Grafana Workspace Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Grafana resources without access to workspaces or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Dashboard/grafana/write",
|                                                         "Microsoft.Dashboard/grafana/delete",
|                                                         "Microsoft.Dashboard/grafana/PrivateEndpointConnectionsApproval/action",
|                                                         "Microsoft.Dashboard/grafana/managedPrivateEndpoints/action",
|                                                         "Microsoft.Dashboard/locations/operationStatuses/write",
|                                                         "Microsoft.Dashboard/grafana/privateEndpointConnectionProxies/validate/action",
|                                                         "Microsoft.Dashboard/grafana/privateEndpointConnectionProxies/write",
|                                                         "Microsoft.Dashboard/grafana/privateEndpointConnectionProxies/delete",
|                                                         "Microsoft.Dashboard/grafana/privateEndpointConnections/write",
|                                                         "Microsoft.Dashboard/grafana/privateEndpointConnections/delete",
|                                                         "Microsoft.Dashboard/grafana/managedPrivateEndpoints/write",
|                                                         "Microsoft.Dashboard/grafana/managedPrivateEndpoints/delete",
|                                                         "Microsoft.Dashboard/grafana/integrationFabrics/write",
|                                                         "Microsoft.Dashboard/grafana/integrationFabrics/delete",
|                                                         "Microsoft.Dashboard/grafana/grafanaDefinitions/read",
|                                                         "Microsoft.Dashboard/grafana/grafanaDefinitions/write",
|                                                         "Microsoft.Dashboard/grafana/grafanaDefinitions/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/deployments/operationstatuses/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d5adeb5b-107f-4aca-99ea-4e3f4fc008d5",
|                                         "Name":  "Container Apps ConnectedEnvironments Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to connected environments; no role assignment or credential modification.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.App/connectedEnvironments/read",
|                                                         "Microsoft.App/connectedEnvironments/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "19c28022-e58e-450d-a464-0b2a53034789",
|                                         "Name":  "Cognitive Services Data Contributor (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Data plane API access only; no control plane or identity plane permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bd80684d-2f5f-4130-892a-0955546282de",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Cluster Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Kubernetes cluster-scoped resources; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/fleets/read",
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/apiextensions.k8s.io/customresourcedefinitions/read",
|                                                             "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/fleets/apps/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/apps/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/apps/statefulsets/read",
|                                                             "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
|                                                             "Microsoft.ContainerService/fleets/batch/cronjobs/read",
|                                                             "Microsoft.ContainerService/fleets/batch/jobs/read",
|                                                             "Microsoft.ContainerService/fleets/configmaps/read",
|                                                             "Microsoft.ContainerService/fleets/endpoints/read",
|                                                             "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/fleets/events/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/limitranges/read",
|                                                             "Microsoft.ContainerService/fleets/namespaces/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/nodes/read",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumes/read",
|                                                             "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
|                                                             "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
|                                                             "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                             "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                             "Microsoft.ContainerService/fleets/serviceaccounts/read",
|                                                             "Microsoft.ContainerService/fleets/services/read",
|                                                             "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/memberclusters/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceplacements/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourcebindings/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourcesnapshots/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterschedulingpolicysnapshots/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverrides/read",
|                                                             "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverridesnapshots/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1a40e87e-6645-48e0-b27a-0b115d849a20",
|                                         "Name":  "Chaos Studio Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can run and view experiments but cannot create or manage identity plane relevant resources.",
|                                         "Actions":  [
|                                                         "Microsoft.Chaos/*/read",
|                                                         "Microsoft.Chaos/experiments/start/action",
|                                                         "Microsoft.Chaos/experiments/cancel/action",
|                                                         "Microsoft.Chaos/experiments/executions/getExecutionDetails/action",
|                                                         "Microsoft.Chaos/locations/operationResults/read",
|                                                         "Microsoft.Chaos/locations/operationStatuses/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "29e2da8a-229c-4157-8ae8-cc72fc506b74",
|                                         "Name":  "Chaos Studio Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to chaos studio resources; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Chaos/*/read",
|                                                         "Microsoft.Chaos/experiments/executions/getExecutionDetails/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "566f0da3-e2a5-4393-9089-763f8bab8fb6",
|                                         "Name":  "Health Safeguards Data User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Data processing permissions only; no identity plane or role assignment access.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalAnchoring/Process/Action",
|                                                             "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalCodesValidation/Process/Action",
|                                                             "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalConflictDetection/Process/Action",
|                                                             "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalEvidenceVerification/Process/Action",
|                                                             "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalProvenance/Process/Action",
|                                                             "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalSemanticValidation/Process/Action",
|                                                             "Microsoft.HealthBot/healthBots/HealthSafeguards/DetectHallucinationsAndOmissions/Process/Action",
|                                                             "Microsoft.HealthBot/healthBots/HealthSafeguards/HealthAdaptedFiltering/Process/Action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "69b07be0-09bf-439a-b9a6-e73de851bd59",
|                                         "Name":  "Container Registry Configuration Reader and Data Access Configuration Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to registry configurations and data access settings; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/read",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnections/read",
|                                                         "Microsoft.ContainerRegistry/registries/privateEndpointConnections/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/listCredentials/action",
|                                                         "Microsoft.ContainerRegistry/registries/tokens/read",
|                                                         "Microsoft.ContainerRegistry/registries/tokens/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/scopeMaps/read",
|                                                         "Microsoft.ContainerRegistry/registries/scopeMaps/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/read",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/getCallbackConfig/action",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/listEvents/action",
|                                                         "Microsoft.ContainerRegistry/registries/webhooks/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/replications/read",
|                                                         "Microsoft.ContainerRegistry/registries/replications/operationStatuses/read",
|                                                         "Microsoft.ContainerRegistry/registries/connectedRegistries/read",
|                                                         "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/read",
|                                                         "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/metricDefinitions/read",
|                                                         "Microsoft.Insights/AlertRules/Write",
|                                                         "Microsoft.Insights/AlertRules/Delete",
|                                                         "Microsoft.Insights/AlertRules/Read",
|                                                         "Microsoft.Insights/AlertRules/Activated/Action",
|                                                         "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                         "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                         "Microsoft.Insights/AlertRules/Incidents/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e9701b4d-e6e7-4657-91cd-360a0881d224",
|                                         "Name":  "HybridCompute Machine ListAccessDetails Action In-Built Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permission to list access details only; no role assignment or identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/machines/listAccessDetails/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "11102f94-c441-49e6-a78b-ef80e0188abc",
|                                         "Name":  "Azure AI Safety Evaluator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can perform actions on workspace evaluations and simulations; no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/evaluations/*",
|                                                         "Microsoft.MachineLearningServices/workspaces/simulations/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "53e48117-a530-4075-bcbe-d91913e3bdb8",
|                                         "Name":  "Edge Management Copilot User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access to Edge Management Copilot actions only; no role assignment or identity plane permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.EdgeManagement/locations/chat/action",
|                                                         "Microsoft.EdgeManagement/troubleshoot/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d6a5505f-6ebb-45a4-896e-ac8274cfc0ac",
|                                         "Name":  "Durable Task Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Durable Task Scheduler data; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DurableTask/schedulers/taskhubs/orchestrations/read",
|                                                             "Microsoft.DurableTask/schedulers/taskhubs/orchestrations/metadata/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1363e94d-546f-4fe9-8434-b0eefb292d59",
|                                         "Name":  "Online Experimentation Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to experimentation data; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.OnlineExperimentation/workspaces/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "31ef6312-5b0c-4ce9-8c5d-587a91344fe7",
|                                         "Name":  "SSH PublicKeys Reader Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to SSH public keys; no permissions to write or assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/sshpublickeys/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "68ac31b4-936a-4046-a6d2-ba6f8a757bf6",
|                                         "Name":  "Defender Serverless Scanner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access to serverless resource data plane only; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "microsoft.web/sites/publish/action",
|                                                         "Microsoft.Web/sites/sitecontainers/read",
|                                                         "microsoft.web/sites/slots/publish/action",
|                                                         "microsoft.web/sites/config/list/action",
|                                                         "microsoft.web/sites/slots/config/list/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1df7cd83-1d3f-41df-95b0-53b30d963369",
|                                         "Name":  "Azure API Center Credential Access Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to API Center credentials only; no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ApiCenter/services/workspaces/apis/versions/securityRequirements/read",
|                                                             "Microsoft.ApiCenter/services/workspaces/apis/versions/securityRequirements/getCredentials/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "754c1a27-40dc-4708-8ad4-2bffdeee09e8",
|                                         "Name":  "Azure File Sync Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Azure File Sync service; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.StorageSync/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a00ed373-f085-4b75-a950-53eacdc52ac0",
|                                         "Name":  "Oracle.Database Exascale Storage Vault Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Exascale Storage Vaults but lacks permissions to modify identity or role assignments, no direct path to tenant takeover.",
|                                         "Actions":  [
|                                                         "Oracle.Database/exascaleDbStorageVaults/read",
|                                                         "Oracle.Database/exascaleDbStorageVaults/write",
|                                                         "Oracle.Database/exascaleDbStorageVaults/delete",
|                                                         "Oracle.Database/Locations/*/read",
|                                                         "Oracle.Database/Locations/*/write",
|                                                         "Oracle.Database/Operations/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/read",
|                                                         "Oracle.Database/resourceAnchors/*",
|                                                         "Oracle.Database/networkAnchors/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "58b80de8-4b34-424c-9e47-23faf0f7cfe2",
|                                         "Name":  "Online Experimentation Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Online Experimentation resources with no identity plane control or privilege escalation capability.",
|                                         "Actions":  [
|                                                         "Microsoft.OnlineExperimentation/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2c7a01fe-5518-4a42-93c2-658e45441691",
|                                         "Name":  "Online Experimentation Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of Online Experimentation resources but no permissions to assign roles or modify authentication, no direct tenant takeover path.",
|                                         "Actions":  [
|                                                         "Microsoft.OnlineExperimentation/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "61eb6405-5f4a-440b-ad03-fe06c5c85e44",
|                                         "Name":  "Flux Configurations Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage Flux Configurations but lacks permissions to assign roles or modify identity plane objects.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.KubernetesConfiguration/fluxConfigurations/write",
|                                                         "Microsoft.KubernetesConfiguration/fluxConfigurations/read",
|                                                         "Microsoft.KubernetesConfiguration/fluxConfigurations/delete",
|                                                         "Microsoft.KubernetesConfiguration/fluxConfigurations/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f094fb07-0703-4400-ad6a-e16dd8000e14",
|                                         "Name":  "Container Registry Credential Set Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages credential sets in Container Registry but does not grant access to identity plane or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/credentialSets/read",
|                                                         "Microsoft.ContainerRegistry/registries/credentialSets/write",
|                                                         "Microsoft.ContainerRegistry/registries/credentialSets/delete",
|                                                         "Microsoft.ContainerRegistry/registries/credentialSets/operationStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c357b964-0002-4b64-a50d-7a28f02edc52",
|                                         "Name":  "Container Registry Cache Rule Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Cache Rules with no ability to escalate privileges or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/cacheRules/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "29093635-9924-4f2c-913b-650a12949526",
|                                         "Name":  "Container Registry Credential Set Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Credential Sets without permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/credentialSets/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0869d06d-e3d1-4472-8764-1bb71b2bdaf7",
|                                         "Name":  "Oracle.Database Exascale VmCluster Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of VmClusters but no permissions to assign roles or modify authentication policies.",
|                                         "Actions":  [
|                                                         "Oracle.Database/exascaleDbStorageVaults/read",
|                                                         "Oracle.Database/exadbVmClusters/*/read",
|                                                         "Oracle.Database/exadbVmClusters/*/write",
|                                                         "Oracle.Database/exadbVmClusters/*/delete",
|                                                         "Oracle.Database/exadbVmClusters/*/action",
|                                                         "Oracle.Database/Locations/*/read",
|                                                         "Oracle.Database/Locations/*/write",
|                                                         "Oracle.Database/Operations/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/read",
|                                                         "Oracle.Database/resourceAnchors/*",
|                                                         "Oracle.Database/networkAnchors/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Compute/sshPublicKeys/read",
|                                                         "Microsoft.Compute/sshPublicKeys/write",
|                                                         "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8d7ecc5c-f27b-43cf-883f-46409d445502",
|                                         "Name":  "Issue Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and update issue data but lacks permissions to modify roles or authentication settings.",
|                                         "Actions":  [
|                                                         "Microsoft.AlertsManagement/Issues/*",
|                                                         "microsoft.monitor/accounts/issues/*",
|                                                         "Microsoft.AlertsManagement/alerts/*",
|                                                         "Microsoft.Insights/components/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "df87f177-bb12-4db1-9793-a413691eff94",
|                                         "Name":  "Container Registry Cache Rule Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Cache Rules but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/cacheRules/read",
|                                                         "Microsoft.ContainerRegistry/registries/cacheRules/write",
|                                                         "Microsoft.ContainerRegistry/registries/cacheRules/delete",
|                                                         "Microsoft.ContainerRegistry/registries/cacheRules/operationStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2593f4c7-8bf4-4fff-9804-2ee069b41902",
|                                         "Name":  "Power Platform Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Power Platform Account resources but no permissions to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.PowerPlatform/accounts/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "babe7770-cdbc-4f46-9bd7-b90b34842946",
|                                         "Name":  "Power Platform Enterprise Policy Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Power Platform Enterprise Policies without access to identity plane or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.PowerPlatform/enterprisePolicies/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "33cdeeac-0940-4f85-9317-7e2432c17289",
|                                         "Name":  "Usage Billing Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor access to billing accounts without permissions to modify roles or authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.UsageBilling/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "db9875ba-bd2b-4e98-934d-0daa549a07f0",
|                                         "Name":  "Workload Orchestration Solution External Validator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and update external validation status but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Edge/targets/read",
|                                                         "Microsoft.Edge/solutionTemplates/read",
|                                                         "Microsoft.Edge/solutionTemplates/versions/read",
|                                                         "Microsoft.Edge/targets/solutions/versions/read",
|                                                         "Microsoft.Edge/targets/updateExternalValidationStatus/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0618ae3d-2930-4bb7-aa00-718db34ee9f9",
|                                         "Name":  "Azure Monitor Dashboards with Grafana Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages dashboards but lacks permissions to assign roles or modify authentication policies.",
|                                         "Actions":  [
|                                                         "Microsoft.Dashboard/dashboards/read",
|                                                         "Microsoft.Dashboard/dashboards/write",
|                                                         "Microsoft.Dashboard/dashboards/delete",
|                                                         "Microsoft.Dashboard/dashboards/dashboardDefinitions/read",
|                                                         "Microsoft.Dashboard/dashboards/dashboardDefinitions/write",
|                                                         "Microsoft.Dashboard/dashboards/dashboardDefinitions/delete",
|                                                         "Microsoft.Dashboard/locations/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/deployments/write",
|                                                         "Microsoft.Resources/deployments/delete",
|                                                         "Microsoft.Resources/deployments/cancel/action",
|                                                         "Microsoft.Resources/deployments/validate/action",
|                                                         "Microsoft.Resources/deployments/whatIf/action",
|                                                         "Microsoft.Resources/deployments/exportTemplate/action",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5c227a58-cff3-4b51-9fa3-51bdafb6ca55",
|                                         "Name":  "Secrets Store Extension Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages secretsync and secretproviderclass objects but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.SecretSyncController/register/action",
|                                                         "Microsoft.SecretSyncController/unregister/action",
|                                                         "Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/read",
|                                                         "Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/write",
|                                                         "Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/delete",
|                                                         "Microsoft.SecretSyncController/locations/operationStatuses/read",
|                                                         "Microsoft.SecretSyncController/locations/operationStatuses/write",
|                                                         "Microsoft.SecretSyncController/operations/read",
|                                                         "Microsoft.SecretSyncController/secretSyncs/read",
|                                                         "Microsoft.SecretSyncController/secretSyncs/write",
|                                                         "Microsoft.SecretSyncController/secretSyncs/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "53ca6127-db72-4b80-b1b0-d745d6d5456d",
|                                         "Name":  "Azure AI User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to AI projects and accounts with no ability to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.CognitiveServices/*/read",
|                                                         "Microsoft.CognitiveServices/accounts/listkeys/action",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Insights/diagnosticSettings/read",
|                                                         "Microsoft.Insights/logDefinitions/read",
|                                                         "Microsoft.Insights/metricdefinitions/read",
|                                                         "Microsoft.Insights/metrics/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c0ff367d-66d8-445e-917c-583feb0ef0d4",
|                                         "Name":  "Azure Red Hat OpenShift Hosted Control Planes Service Managed Identity",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Has network resource read and join permissions but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/routeTables/read",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/natGateways/read",
|                                                         "Microsoft.Network/natGateways/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                         "Microsoft.Network/loadBalancers/backendAddressPools/write",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/loadBalancers/write",
|                                                         "Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
|                                                         "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Network/virtualNetworks/joinLoadBalancer/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fc0c873f-45e9-4d0d-a7d1-585aab30c6ed",
|                                         "Name":  "Azure Red Hat OpenShift Hosted Control Planes Control Plane Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to necessary resources for OpenShift cluster control plane with no privilege escalation path.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/networkSecurityGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "de2b316d-7a2c-4143-b4cd-c148f6a355a1",
|                                         "Name":  "Azure Kubernetes Fleet Manager Hub Agent Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages traffic manager profiles and endpoints but lacks identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/trafficManagerProfiles/read",
|                                                         "Microsoft.Network/trafficManagerProfiles/write",
|                                                         "Microsoft.Network/trafficManagerProfiles/delete",
|                                                         "Microsoft.Network/trafficManagerProfiles/azureEndpoints/read",
|                                                         "Microsoft.Network/trafficManagerProfiles/azureEndpoints/write",
|                                                         "Microsoft.Network/trafficManagerProfiles/azureEndpoints/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "63304235-eaf4-4c15-8e93-46c483611231",
|                                         "Name":  "Workload Orchestration IT Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages event grid filters but no permissions to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.Edge/contexts/eventGridFilters/delete",
|                                                         "Microsoft.Edge/contexts/eventGridFilters/read",
|                                                         "Microsoft.Edge/contexts/eventGridFilters/write",
|                                                         "Microsoft.Edge/contexts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f6e92014-8af2-414d-9948-9b1abf559285",
|                                         "Name":  "Arc Gateway Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Arc Gateway resources without permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridCompute/settings/write",
|                                                         "Microsoft.HybridCompute/settings/read",
|                                                         "Microsoft.HybridCompute/gateways/read",
|                                                         "Microsoft.HybridCompute/gateways/write",
|                                                         "Microsoft.HybridCompute/gateways/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8e253927-1f29-4d89-baa2-c3a549eff423",
|                                         "Name":  "Azure Kubernetes Service Machine Manager Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages cluster machines but lacks permissions to assign roles or modify authentication policies.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/managedClusters/agentPools/deleteMachines/action",
|                                                         "Microsoft.ContainerService/managedClusters/agentPools/machines/read",
|                                                         "Microsoft.ContainerService/managedClusters/agentPools/machines/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5f569efd-4da5-4123-99cd-d42fbb2a836e",
|                                         "Name":  "Microsoft.AzureStackHCI EdgeMachine Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to EdgeMachines and jobs with no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStackHCI/EdgeMachines/Read/*",
|                                                         "Microsoft.AzureStackHCI/EdgeMachines/Jobs/Read/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "adc3c795-c41e-4a89-a478-0b321783324c",
|                                         "Name":  "Microsoft.AzureStackHCI Device Pool Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages device pools but no permissions to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStackHCI/DevicePools/read",
|                                                         "Microsoft.AzureStackHCI/DevicePools/ClaimDevices/action",
|                                                         "Microsoft.AzureStackHCI/DevicePools/ReleaseDevices/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "47be4a87-7950-4631-9daf-b664a405f074",
|                                         "Name":  "Monitoring Policy Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and update monitoring data and alert policies but lacks identity plane control or role assignment permissions.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.AlertsManagement/alerts/*",
|                                                         "Microsoft.AlertsManagement/alertsSummary/*",
|                                                         "Microsoft.AlertsManagement/issues/*",
|                                                         "Microsoft.Insights/actiongroups/*",
|                                                         "Microsoft.Insights/activityLogAlerts/*",
|                                                         "Microsoft.Insights/AlertRules/*",
|                                                         "Microsoft.Insights/components/*",
|                                                         "Microsoft.Insights/createNotifications/*",
|                                                         "Microsoft.Insights/dataCollectionEndpoints/*",
|                                                         "Microsoft.Insights/dataCollectionRules/*",
|                                                         "Microsoft.Insights/dataCollectionRuleAssociations/*",
|                                                         "Microsoft.Insights/DiagnosticSettings/*",
|                                                         "Microsoft.Insights/eventtypes/*",
|                                                         "Microsoft.Insights/LogDefinitions/*",
|                                                         "Microsoft.Insights/metricalerts/*",
|                                                         "Microsoft.Insights/MetricDefinitions/*",
|                                                         "Microsoft.Insights/Metrics/*",
|                                                         "Microsoft.Insights/notificationStatus/*",
|                                                         "Microsoft.Insights/Register/Action",
|                                                         "Microsoft.Insights/scheduledqueryrules/*",
|                                                         "Microsoft.Insights/webtests/*",
|                                                         "Microsoft.Insights/workbooks/*",
|                                                         "Microsoft.Insights/workbooktemplates/*",
|                                                         "Microsoft.Insights/privateLinkScopes/*",
|                                                         "Microsoft.Insights/privateLinkScopeOperationStatuses/*",
|                                                         "Microsoft.Monitor/accounts/*",
|                                                         "Microsoft.OperationalInsights/workspaces/write",
|                                                         "Microsoft.OperationalInsights/workspaces/intelligencepacks/*",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/*",
|                                                         "Microsoft.OperationalInsights/workspaces/search/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedKeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedKeys/read",
|                                                         "Microsoft.OperationalInsights/workspaces/storageinsightconfigs/*",
|                                                         "Microsoft.OperationalInsights/locations/workspaces/failover/action",
|                                                         "Microsoft.OperationalInsights/workspaces/failback/action",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.AlertsManagement/smartDetectorAlertRules/*",
|                                                         "Microsoft.AlertsManagement/actionRules/*",
|                                                         "Microsoft.AlertsManagement/smartGroups/*",
|                                                         "Microsoft.AlertsManagement/migrateFromSmartDetection/*",
|                                                         "Microsoft.AlertsManagement/investigations/*",
|                                                         "Microsoft.AlertsManagement/prometheusRuleGroups/*",
|                                                         "Microsoft.Monitor/investigations/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.PolicyInsights/remediations/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "765a04e0-5de8-4bb2-9bf6-b2a30bc03e91",
|                                         "Name":  "Storage File Delegator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can generate user delegation keys for storage files but no path to identity plane or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/fileServices/generateUserDelegationKey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "965033a5-c8eb-4f35-b82f-fef460a3606d",
|                                         "Name":  "Storage Table Delegator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can generate user delegation keys for storage tables but no permissions to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/tableServices/generateUserDelegationKey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7ee386e9-84f0-448e-80a6-f185f6533131",
|                                         "Name":  "Storage Queue Delegator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can generate user delegation keys for storage queues but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/queueServices/generateUserDelegationKey/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6fbca9a8-3561-41fd-8b20-6576043c1076",
|                                         "Name":  "Scheduled Actions Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can perform scheduled actions on VMs but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesCancelOperations/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteDeallocate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteHibernate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteStart/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteCreate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteDelete/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationErrors/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationStatus/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitDeallocate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitHibernate/action",
|                                                         "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitStart/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/write",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/delete",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/attachResources/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/cancelNextOccurrence/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/detachResources/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/disable/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/enable/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/listResources/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/patchResources/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/triggerManualOccurrence/action",
|                                                         "Microsoft.ComputeSchedule/register/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b6d9c0f6-d69f-472b-91b4-7a6838c6d1cb",
|                                         "Name":  "Microsoft.AzureStackHCI Device Pool Machine Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages endpoints and machines but no permissions to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridConnectivity/endpoints/write",
|                                                         "Microsoft.HybridConnectivity/endpoints/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/delete",
|                                                         "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/write",
|                                                         "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/read",
|                                                         "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/delete",
|                                                         "Microsoft.HybridConnectivity/endpoints/listCredentials/action",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8b9beb50-e28c-4879-8472-24c9d328085f",
|                                         "Name":  "AI Model Scanner Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to AI models and registries with no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/models/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/models/versions/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/datastores/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/metadata/artifacts/read",
|                                                         "Microsoft.MachineLearningServices/registries/read",
|                                                         "Microsoft.MachineLearningServices/registries/assets/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c9f76ca8-b262-4b10-8ed2-09cf0948aa35",
|                                         "Name":  "Azure Kubernetes Service Namespace User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to AKS namespaces without permissions to assign roles or escalate privileges.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/managedClusters/managedNamespaces/read",
|                                                         "Microsoft.ContainerService/managedClusters/managedNamespaces/listCredential/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "289d8817-ee69-43f1-a0af-43a45505b488",
|                                         "Name":  "Azure Kubernetes Service Namespace Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage AKS namespaces but lacks permissions to assign roles or modify authentication policies.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/managedClusters/managedNamespaces/*",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "76153a9e-0edb-49bc-8e01-93c47e6b5180",
|                                         "Name":  "DevOps Infrastructure Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages DevOps infrastructure pools but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.DevOpsInfrastructure/register/action",
|                                                         "Microsoft.DevOpsInfrastructure/unregister/action",
|                                                         "Microsoft.DevOpsInfrastructure/*/read",
|                                                         "Microsoft.DevOpsInfrastructure/Locations/OperationStatuses/write",
|                                                         "Microsoft.DevOpsInfrastructure/pools/write",
|                                                         "Microsoft.DevOpsInfrastructure/pools/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "32c34659-0f83-4a4c-80f2-63a244f8ae0b",
|                                         "Name":  "Service Health Billing Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to billing information in service health events with no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.ResourceHealth/events/action",
|                                                         "Microsoft.ResourceHealth/AvailabilityStatuses/read",
|                                                         "Microsoft.ResourceHealth/AvailabilityStatuses/current/read",
|                                                         "Microsoft.ResourceHealth/Operations/read",
|                                                         "Microsoft.ResourceHealth/emergingissues/read",
|                                                         "Microsoft.ResourceHealth/events/read",
|                                                         "Microsoft.ResourceHealth/events/fetchBillingCommunicationDetails/action",
|                                                         "Microsoft.ResourceHealth/events/impactedResources/read",
|                                                         "Microsoft.ResourceHealth/metadata/read",
|                                                         "Microsoft.ResourceHealth/potentialoutages/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.ResourceHealth/events/fetchEventDetails/action",
|                                                            "Microsoft.ResourceHealth/events/listSecurityAdvisoryImpactedResources/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1a928ab0-1fee-43cf-9266-f9d8c22a8ddb",
|                                         "Name":  "Service Health Security Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to security information in service health events without permissions to assign roles.",
|                                         "Actions":  [
|                                                         "Microsoft.ResourceHealth/events/action",
|                                                         "Microsoft.ResourceHealth/AvailabilityStatuses/read",
|                                                         "Microsoft.ResourceHealth/AvailabilityStatuses/current/read",
|                                                         "Microsoft.ResourceHealth/Operations/read",
|                                                         "Microsoft.ResourceHealth/emergingissues/read",
|                                                         "Microsoft.ResourceHealth/events/read",
|                                                         "Microsoft.ResourceHealth/events/fetchEventDetails/action",
|                                                         "Microsoft.ResourceHealth/events/listSecurityAdvisoryImpactedResources/action",
|                                                         "Microsoft.ResourceHealth/events/impactedResources/read",
|                                                         "Microsoft.ResourceHealth/metadata/read",
|                                                         "Microsoft.ResourceHealth/potentialoutages/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.ResourceHealth/events/fetchBillingCommunicationDetails/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "12b8206a-0216-4469-908d-a3e2025fe085",
|                                         "Name":  "Azure Stack Edge Operations Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Azure Stack Edge operations but lacks permissions to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/bandwidthSchedules/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/bandwidthSchedules/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/deviceCapacityCheck/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/downloadUpdates/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/generateCertificate/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/getExtendedInformation/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/installUpdates/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/orders/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/orders/listDCAccessCode/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/orders/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/publishers/offers/skus/versions/generatesastoken/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/addons/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/addons/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/migrate/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/monitoringConfig/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/monitoringConfig/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/scanForUpdates/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/securitySettings/update/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/shares/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/shares/refresh/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/shares/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccountCredentials/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccountCredentials/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/containers/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/containers/refresh/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/containers/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/triggers/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/triggers/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/triggerSupportPackage/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/updateExtendedInformation/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/uploadCertificate/action",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/users/delete",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/users/write",
|                                                         "Microsoft.DataBoxEdge/dataBoxEdgeDevices/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2016c9ed-c18d-4120-93d7-178e583efe92",
|                                         "Name":  "Grounding with Bing User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Enables approved apps to connect to Bing with no permissions affecting identity or role assignments.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Bing/accounts/useGrounding/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "69a41f41-6dce-4ea7-8a34-8e095ddba55c",
|                                         "Name":  "Azure Advisor Service Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages advisor suppressions and configurations but no permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Advisor/suppressions/write",
|                                                         "Microsoft.Advisor/suppressions/delete",
|                                                         "Microsoft.Advisor/recommendations/suppressions/write",
|                                                         "Microsoft.Advisor/recommendations/suppressions/delete",
|                                                         "Microsoft.Advisor/assessments/write",
|                                                         "Microsoft.Advisor/configurations/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "548d7e7c-65ee-412b-ae37-2dbb419d4207",
|                                         "Name":  "Experimentation Resource Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of experimentation resources without permissions to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.Experimentation/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "804db8d3-32c7-4ad4-a975-3f6f90d5f5f5",
|                                         "Name":  "FHIR Data Bulk Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Performs bulk operations but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/write",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/delete",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/export/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/reindex/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/import/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/hardDelete/action",
|                                                             "Microsoft.HealthcareApis/services/fhir/resources/bulkOperator/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/write",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/delete",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/export/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/reindex/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/import/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/hardDelete/action",
|                                                             "Microsoft.HealthcareApis/workspaces/fhirservices/resources/bulkOperator/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3bb7c424-af4e-436b-bfcc-8779c8934c31",
|                                         "Name":  "Microsoft Discovery Platform Reader (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Discovery platform resources with no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Discovery/*/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Discovery/*/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7a2b6e6c-472e-4b39-8878-a26eb63d75c6",
|                                         "Name":  "Microsoft Discovery Platform Administrator (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of Discovery platform resources but no permissions to assign roles or modify authentication policies.",
|                                         "Actions":  [
|                                                         "Microsoft.Discovery/locations/operationStatuses/read",
|                                                         "Microsoft.Discovery/checkNameAvailability/action",
|                                                         "Microsoft.Discovery/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Discovery/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "01288891-85ee-45a7-b367-9db3b752fc65",
|                                         "Name":  "Microsoft Discovery Platform Contributor (Preview)",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can operate on most Discovery platform resources but lacks permissions to assign roles or control identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Discovery/locations/operationStatuses/read",
|                                                         "Microsoft.Discovery/operations/read",
|                                                         "Microsoft.Discovery/workspaces/read",
|                                                         "Microsoft.Discovery/supercomputers/read",
|                                                         "Microsoft.Discovery/storages/read",
|                                                         "Microsoft.Discovery/agents/*",
|                                                         "Microsoft.Discovery/bookshelves/read",
|                                                         "Microsoft.Discovery/dataContainers/*",
|                                                         "Microsoft.Discovery/dataContainers/dataAssets/*",
|                                                         "Microsoft.Discovery/storageContainers/*",
|                                                         "Microsoft.Discovery/storageContainers/storageAssets/*",
|                                                         "Microsoft.Discovery/models/*",
|                                                         "Microsoft.Discovery/supercomputers/nodePools/read",
|                                                         "Microsoft.Discovery/tools/*",
|                                                         "Microsoft.Discovery/workflows/*",
|                                                         "Microsoft.Discovery/workspaces/chatModelDeployments/read",
|                                                         "Microsoft.Discovery/workspaces/projects/read",
|                                                         "Microsoft.Discovery/operations/read",
|                                                         "Microsoft.Insights/AlertRules/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.Discovery/workspaces/write",
|                                                            "Microsoft.Discovery/workspaces/delete",
|                                                            "Microsoft.Discovery/supercomputers/write",
|                                                            "Microsoft.Discovery/supercomputers/delete",
|                                                            "Microsoft.Discovery/storages/write",
|                                                            "Microsoft.Discovery/storages/delete",
|                                                            "Microsoft.Discovery/bookshelves/write",
|                                                            "Microsoft.Discovery/bookshelves/delete",
|                                                            "Microsoft.Discovery/supercomputers/nodePools/write",
|                                                            "Microsoft.Discovery/supercomputers/nodePools/delete",
|                                                            "Microsoft.Discovery/workspaces/chatModelDeployments/write",
|                                                            "Microsoft.Discovery/workspaces/chatModelDeployments/delete",
|                                                            "Microsoft.Discovery/workspaces/projects/write",
|                                                            "Microsoft.Discovery/workspaces/projects/delete"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Discovery/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5bc02df6-6cd5-43fe-ad3d-4c93cf56cc16",
|                                         "Name":  "Azure IoT Operations Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages IoT operations and resources but no permissions to assign roles or modify authentication.",
|                                         "Actions":  [
|                                                         "Microsoft.IoTOperations/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.DeviceRegistry/Assets/*",
|                                                         "Microsoft.DeviceRegistry/AssetEndpointProfiles/*",
|                                                         "Microsoft.DeviceRegistry/Namespaces/Assets/*",
|                                                         "Microsoft.DeviceRegistry/Namespaces/Devices/*",
|                                                         "Microsoft.DeviceRegistry/Namespaces/DiscoveredAssets/*",
|                                                         "Microsoft.DeviceRegistry/Namespaces/DiscoveredDevices/*",
|                                                         "Microsoft.DeviceRegistry/SchemaRegistries/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Edge/sites/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c459b115-f629-486b-b359-35feb5568b83",
|                                         "Name":  "Connector Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can write connectors and read basic resources but lacks permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Impact/Connectors/Write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1abf4029-2200-4343-800c-e4c4c01eddbd",
|                                         "Name":  "Virtual Enclave Owner Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages virtual enclave resources but has no direct or near-direct control over identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                         "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                         "Microsoft.Mission/Operations/read",
|                                                         "Microsoft.Mission/virtualEnclaves/read",
|                                                         "Microsoft.Mission/virtualEnclaves/write",
|                                                         "Microsoft.Mission/virtualEnclaves/delete",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                         "Microsoft.Mission/virtualEnclaves/workloads/delete",
|                                                         "Microsoft.Mission/communities/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "61aed14c-6c9a-4ed5-aa44-49fc5e96a167",
|                                         "Name":  "NginxPlus Contributor service role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Provides control plane operations for NginxPlus but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "NGINX.NGINXPLUS/register/action",
|                                                         "NGINX.NGINXPLUS/unregister/action",
|                                                         "NGINX.NGINXPLUS/locations/read",
|                                                         "NGINX.NGINXPLUS/locations/operationStatuses/read",
|                                                         "NGINX.NGINXPLUS/locations/operationStatuses/write",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/Read",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/Write",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/Delete",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/apiKeys/Read",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/apiKeys/Write",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/apiKeys/Delete",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/certificates/Read",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/certificates/Write",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/certificates/Delete",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/configurations/Read",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/configurations/Write",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/configurations/Delete",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/wafPolicies/Read",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/wafPolicies/Write",
|                                                         "NGINX.NGINXPLUS/nginxDeployments/wafPolicies/Delete",
|                                                         "NGINX.NGINXPLUS/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "35ffec73-9cb8-4593-8718-40d5bc4b7f6f",
|                                         "Name":  "CosmosDB Fleet Operator Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages CosmosDB Fleets but does not have permissions to affect identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.DocumentDB/fleets/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "29f61507-bdfb-4987-b629-20033be2d6c3",
|                                         "Name":  "Healthcare Apis contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to healthcare API resources but no path to identity plane or role assignment.",
|                                         "Actions":  [
|                                                         "Microsoft.HealthcareApis/services/*",
|                                                         "Microsoft.HealthcareApis/workspaces/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "81b67e46-ef5b-4404-bddd-090985bb4a28",
|                                         "Name":  "Liftr Datadog Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Control plane access to Datadog resources without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Datadog/register/action",
|                                                         "Microsoft.Datadog/unregister/action",
|                                                         "Microsoft.Datadog/agreements/read",
|                                                         "Microsoft.Datadog/agreements/write",
|                                                         "Microsoft.Datadog/locations/read",
|                                                         "Microsoft.Datadog/locations/operationStatuses/read",
|                                                         "Microsoft.Datadog/locations/operationStatuses/write",
|                                                         "Microsoft.Datadog/monitors/read",
|                                                         "Microsoft.Datadog/monitors/write",
|                                                         "Microsoft.Datadog/monitors/delete",
|                                                         "Microsoft.Datadog/monitors/listApiKeys/action",
|                                                         "Microsoft.Datadog/monitors/getDefaultKey/action",
|                                                         "Microsoft.Datadog/monitors/setDefaultKey/action",
|                                                         "Microsoft.Datadog/monitors/refreshSetPasswordLink/action",
|                                                         "Microsoft.Datadog/monitors/listLinkedResources/action",
|                                                         "Microsoft.Datadog/monitors/listHosts/read",
|                                                         "Microsoft.Datadog/monitors/listLinkedResources/read",
|                                                         "Microsoft.Datadog/monitors/listMonitoredResources/read",
|                                                         "Microsoft.Datadog/monitors/monitoredSubscriptions/read",
|                                                         "Microsoft.Datadog/monitors/monitoredSubscriptions/write",
|                                                         "Microsoft.Datadog/monitors/singleSignOnConfigurations/write",
|                                                         "Microsoft.Datadog/monitors/singleSignOnConfigurations/read",
|                                                         "Microsoft.Datadog/monitors/tagRules/read",
|                                                         "Microsoft.Datadog/monitors/tagRules/write",
|                                                         "Microsoft.Datadog/registeredSubscriptions/read",
|                                                         "Microsoft.Datadog/subscriptionStatuses/read",
|                                                         "Microsoft.Datadog/operations/read",
|                                                         "Microsoft.Datadog/monitors/getDefaultApplicationKey/action",
|                                                         "Microsoft.Datadog/monitors/manageSreAgentConnectors/action",
|                                                         "Microsoft.Datadog/monitors/latestLinkedSaaS/action",
|                                                         "Microsoft.Datadog/monitors/linkSaaS/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d68eeb8d-afae-4932-a331-203b7957e509",
|                                         "Name":  "Liftr Elastic Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Elastic control plane operations only; no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Elastic/getOrganizationApiKey/action",
|                                                         "Microsoft.Elastic/checkNameAvailability/action",
|                                                         "Microsoft.Elastic/register/action",
|                                                         "Microsoft.Elastic/locations/read",
|                                                         "Microsoft.Elastic/locations/operationStatuses/read",
|                                                         "Microsoft.Elastic/locations/operationStatuses/write",
|                                                         "Microsoft.Elastic/monitors/read",
|                                                         "Microsoft.Elastic/monitors/write",
|                                                         "Microsoft.Elastic/monitors/delete",
|                                                         "Microsoft.Elastic/monitors/listMonitoredResources/action",
|                                                         "Microsoft.Elastic/monitors/listVMHost/action",
|                                                         "Microsoft.Elastic/monitors/createOrUpdateExternalUser/action",
|                                                         "Microsoft.Elastic/monitors/listAllTrafficFilters/action",
|                                                         "Microsoft.Elastic/monitors/listAssociatedTrafficFilters/action",
|                                                         "Microsoft.Elastic/monitors/createAndAssociateIPFilter/action",
|                                                         "Microsoft.Elastic/monitors/createAndAssociatePLFilter/action",
|                                                         "Microsoft.Elastic/monitors/associateTrafficFilter/action",
|                                                         "Microsoft.Elastic/monitors/detachAndDeleteTrafficFilter/action",
|                                                         "Microsoft.Elastic/monitors/detachTrafficFilter/action",
|                                                         "Microsoft.Elastic/monitors/deleteTrafficFilter/action",
|                                                         "Microsoft.Elastic/monitors/listUpgradableVersions/action",
|                                                         "Microsoft.Elastic/monitors/getBillingInfo/action",
|                                                         "Microsoft.Elastic/monitors/listConnectedPartnerResources/action",
|                                                         "Microsoft.Elastic/monitors/upgrade/action",
|                                                         "Microsoft.Elastic/monitors/vmIngestionDetails/action",
|                                                         "Microsoft.Elastic/monitors/vmCollectionUpdate/action",
|                                                         "Microsoft.Elastic/monitors/listDeploymentInfo/action",
|                                                         "Microsoft.Elastic/monitors/resubscribe/action",
|                                                         "Microsoft.Elastic/monitors/monitoredSubscriptions/read",
|                                                         "Microsoft.Elastic/monitors/monitoredSubscriptions/write",
|                                                         "Microsoft.Elastic/monitors/openAIIntegrations/read",
|                                                         "Microsoft.Elastic/monitors/openAIIntegrations/write",
|                                                         "Microsoft.Elastic/monitors/openAIIntegrations/getStatus/action",
|                                                         "Microsoft.Elastic/monitors/tagRules/read",
|                                                         "Microsoft.Elastic/monitors/tagRules/write",
|                                                         "Microsoft.Elastic/registeredSubscriptions/read",
|                                                         "Microsoft.Elastic/elasticVersions/read",
|                                                         "Microsoft.Elastic/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "225efd4d-4ca0-42a1-ae53-5f233ba23c73",
|                                         "Name":  "Liftr Elastic Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of Elastic resources but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Elastic/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a60da355-bdec-443f-8d42-a03f0422f04d",
|                                         "Name":  "Liftr Newrelic Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Newrelic control plane access without identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "NewRelic.Observability/register/action",
|                                                         "NewRelic.Observability/unregister/action",
|                                                         "NewRelic.Observability/accounts/read",
|                                                         "NewRelic.Observability/plans/read",
|                                                         "NewRelic.Observability/organizations/read",
|                                                         "NewRelic.Observability/locations/read",
|                                                         "NewRelic.Observability/locations/operationStatuses/read",
|                                                         "NewRelic.Observability/locations/operationStatuses/write",
|                                                         "NewRelic.Observability/monitors/read",
|                                                         "NewRelic.Observability/monitors/write",
|                                                         "NewRelic.Observability/monitors/delete",
|                                                         "NewRelic.Observability/monitors/monitoredResources/action",
|                                                         "NewRelic.Observability/monitors/vmHostPayloads/action",
|                                                         "NewRelic.Observability/monitors/listAppServices/action",
|                                                         "NewRelic.Observability/monitors/listHosts/action",
|                                                         "NewRelic.Observability/monitors/refreshIngestionKey/action",
|                                                         "NewRelic.Observability/monitors/getMetricRules/action",
|                                                         "NewRelic.Observability/monitors/getMetricStatus/action",
|                                                         "NewRelic.Observability/monitors/switchBilling/action",
|                                                         "NewRelic.Observability/monitors/latestLinkedSaaS/action",
|                                                         "NewRelic.Observability/monitors/linkSaaS/action",
|                                                         "NewRelic.Observability/monitors/resubscribe/action",
|                                                         "NewRelic.Observability/monitors/getBillingInfo/action",
|                                                         "NewRelic.Observability/monitors/listConnectedPartnerResources/action",
|                                                         "NewRelic.Observability/monitors/listLinkedResources/action",
|                                                         "NewRelic.Observability/monitors/monitoredSubscriptions/read",
|                                                         "NewRelic.Observability/monitors/monitoredSubscriptions/write",
|                                                         "NewRelic.Observability/monitors/tagRules/read",
|                                                         "NewRelic.Observability/monitors/tagRules/write",
|                                                         "NewRelic.Observability/registeredSubscriptions/read",
|                                                         "NewRelic.Observability/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "285ce6d6-fa11-43bd-94ef-42a9b3740bfd",
|                                         "Name":  "Policy Enrollments Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can create and modify policy enrollments but lacks permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/policyenrollments/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.PolicyInsights/*",
|                                                         "Microsoft.Resources/deployments/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fa96a588-3fac-4adb-bfb2-f8404ece07e0",
|                                         "Name":  "Liftr Dynatrace Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Dynatrace control plane operations only; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Dynatrace.Observability/checkNameAvailability/action",
|                                                         "Dynatrace.Observability/register/action",
|                                                         "Dynatrace.Observability/unregister/action",
|                                                         "Dynatrace.Observability/getMarketplaceSaaSResourceDetails/action",
|                                                         "Dynatrace.Observability/locations/read",
|                                                         "Dynatrace.Observability/locations/operationStatuses/read",
|                                                         "Dynatrace.Observability/locations/operationStatuses/write",
|                                                         "Dynatrace.Observability/monitors/read",
|                                                         "Dynatrace.Observability/monitors/write",
|                                                         "Dynatrace.Observability/monitors/delete",
|                                                         "Dynatrace.Observability/monitors/listMonitoredResources/action",
|                                                         "Dynatrace.Observability/monitors/getVMHostPayload/action",
|                                                         "Dynatrace.Observability/monitors/listHosts/action",
|                                                         "Dynatrace.Observability/monitors/listAppServices/action",
|                                                         "Dynatrace.Observability/monitors/getSSODetails/action",
|                                                         "Dynatrace.Observability/monitors/listLinkableEnvironments/action",
|                                                         "Dynatrace.Observability/monitors/getMetricStatus/action",
|                                                         "Dynatrace.Observability/monitors/manageAgentInstallation/action",
|                                                         "Dynatrace.Observability/monitors/monitoredSubscriptions/read",
|                                                         "Dynatrace.Observability/monitors/monitoredSubscriptions/write",
|                                                         "Dynatrace.Observability/monitors/singleSignOnConfigurations/write",
|                                                         "Dynatrace.Observability/monitors/singleSignOnConfigurations/read",
|                                                         "Dynatrace.Observability/monitors/tagRules/read",
|                                                         "Dynatrace.Observability/monitors/tagRules/write",
|                                                         "Dynatrace.Observability/registeredSubscriptions/read",
|                                                         "Dynatrace.Observability/operations/read",
|                                                         "Dynatrace.Observability/monitors/manageSreAgentConnectors/action",
|                                                         "Dynatrace.Observability/monitors/latestLinkedSaaS/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "79732128-7761-4733-aebf-35590da9f29b",
|                                         "Name":  "Microsoft.OffAzureSpringBoot Service Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to service APIs but no direct or near-direct identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.OffAzureSpringBoot/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "46c70067-0f50-457f-8137-2449c90de518",
|                                         "Name":  "Nexus Network Fabric Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Owner access to network fabric resources without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ManagedNetworkFabric/*/read",
|                                                         "Microsoft.ManagedNetworkFabric/*/write",
|                                                         "Microsoft.ManagedNetworkFabric/*/action",
|                                                         "Microsoft.ManagedNetworkFabric/*/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "374a1cc6-96cb-4946-8d8b-a41054c8ae97",
|                                         "Name":  "Nexus Identity Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Owner access to nexus identity resources but no direct control over tenant-wide role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.NexusIdentity/*/read",
|                                                         "Microsoft.NexusIdentity/*/write",
|                                                         "Microsoft.NexusIdentity/*/action",
|                                                         "Microsoft.NexusIdentity/*/delete",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b3eb788f-5426-48bd-821d-561701ede368",
|                                         "Name":  "Conversation Session User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows messaging via API only; no permissions to modify identity or roles.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthBot/healthBots/ConversationSession/Action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "eded264d-1796-4e25-8500-a78427f8a316",
|                                         "Name":  "Azure Data Transfer Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of data transfer resources but no identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureDataTransfer/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bf41e52e-617f-4981-8b7a-47431bd4e011",
|                                         "Name":  "CosmosDB Fleet Analytics Storage Data Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can write telemetry data to storage but no permissions to affect identity or roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3f99eaab-6f59-4877-adf5-1cacd22e20b0",
|                                         "Name":  "Video Indexer Account Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages video indexer accounts and tokens but lacks identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.VideoIndexer/checknameavailability/action",
|                                                         "Microsoft.VideoIndexer/accounts/generateAccessToken/action",
|                                                         "Microsoft.VideoIndexer/accounts/generateRestrictedViewerAccessToken/action",
|                                                         "Microsoft.VideoIndexer/accounts/generateExtensionAccessToken/action",
|                                                         "Microsoft.VideoIndexer/accounts/generateExtensionRestrictedViewerAccessToken/action",
|                                                         "Microsoft.VideoIndexer/accounts/read",
|                                                         "Microsoft.VideoIndexer/accounts/write",
|                                                         "Microsoft.VideoIndexer/accounts/delete",
|                                                         "Microsoft.VideoIndexer/accounts/PrivateEndpointConnectionsApproval/action",
|                                                         "Microsoft.VideoIndexer/accounts/privateEndpointConnections/read",
|                                                         "Microsoft.VideoIndexer/accounts/privateEndpointConnections/write",
|                                                         "Microsoft.VideoIndexer/accounts/privateEndpointConnections/delete",
|                                                         "Microsoft.VideoIndexer/accounts/privateLinkResources/read",
|                                                         "Microsoft.VideoIndexer/locations/operationstatuses/read",
|                                                         "Microsoft.VideoIndexer/locations/operationstatuses/write",
|                                                         "Microsoft.VideoIndexer/operations/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f4eb044f-76b9-47af-92f9-1d95c4c14ab5",
|                                         "Name":  "Azure Business Continuity DUPI Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to deleted protected items; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleDefinitions/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.AzureBusinessContinuity/deletedUnifiedProtectedItems/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "59f98be6-0817-488b-831e-36a353c8000b",
|                                         "Name":  "Sites Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to sites resources without ability to modify identity or roles.",
|                                         "Actions":  [
|                                                         "Microsoft.Edge/sites/read",
|                                                         "Microsoft.Edge/configurations/read",
|                                                         "Microsoft.Edge/configurations/networkConfigurations/read",
|                                                         "Microsoft.Edge/configurations/securityConfigurations/read",
|                                                         "Microsoft.Edge/configurations/timeServerConfigurations/read",
|                                                         "Microsoft.Edge/configurations/connectivityConfigurations/read",
|                                                         "Microsoft.Edge/configurations/provisioningConfigurations/read",
|                                                         "Microsoft.Edge/configurations/arcGatewayConfigurations/read",
|                                                         "Microsoft.Edge/configurationReferences/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1cd7e4da-2789-457f-adbe-3e9e84037a93",
|                                         "Name":  "Sites Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of sites resources but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Edge/sites/read",
|                                                         "Microsoft.Edge/sites/write",
|                                                         "Microsoft.Edge/sites/delete",
|                                                         "Microsoft.Edge/configurations/read",
|                                                         "Microsoft.Edge/configurations/write",
|                                                         "Microsoft.Edge/configurations/delete",
|                                                         "Microsoft.Edge/configurations/networkConfigurations/read",
|                                                         "Microsoft.Edge/configurations/networkConfigurations/write",
|                                                         "Microsoft.Edge/configurations/networkConfigurations/delete",
|                                                         "Microsoft.Edge/configurations/securityConfigurations/read",
|                                                         "Microsoft.Edge/configurations/securityConfigurations/write",
|                                                         "Microsoft.Edge/configurations/securityConfigurations/delete",
|                                                         "Microsoft.Edge/configurations/timeServerConfigurations/read",
|                                                         "Microsoft.Edge/configurations/timeServerConfigurations/write",
|                                                         "Microsoft.Edge/configurations/timeServerConfigurations/delete",
|                                                         "Microsoft.Edge/configurations/connectivityConfigurations/read",
|                                                         "Microsoft.Edge/configurations/connectivityConfigurations/write",
|                                                         "Microsoft.Edge/configurations/connectivityConfigurations/delete",
|                                                         "Microsoft.Edge/configurations/provisioningConfigurations/read",
|                                                         "Microsoft.Edge/configurations/provisioningConfigurations/write",
|                                                         "Microsoft.Edge/configurations/provisioningConfigurations/delete",
|                                                         "Microsoft.Edge/configurations/arcGatewayConfigurations/read",
|                                                         "Microsoft.Edge/configurations/arcGatewayConfigurations/write",
|                                                         "Microsoft.Edge/configurations/arcGatewayConfigurations/delete",
|                                                         "Microsoft.Edge/configurationReferences/read",
|                                                         "Microsoft.Edge/configurationReferences/write",
|                                                         "Microsoft.Edge/configurationReferences/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "85546f1f-f28b-4cb3-b852-73e422a96897",
|                                         "Name":  "Liftr PureStorage Owner role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to PureStorage operations without identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "PureStorage.Block/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d683b71b-2b91-4fc1-a43e-b53b3d85bed9",
|                                         "Name":  "Liftr Dell Owner role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Dell storage operations but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Dell.Storage/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6d6f52ba-a7de-4c56-a58f-522154514fba",
|                                         "Name":  "SupportPlan Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to support plan resources without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.EnterpriseSupport/services/delete",
|                                                         "Microsoft.EnterpriseSupport/services/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4037dd68-1cc7-4a64-8765-3a79963a9940",
|                                         "Name":  "Azure Spring Apps Service Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Azure Spring Apps APIs but no direct identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AppPlatform/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.AppPlatform/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "25cabde7-1a6c-4350-8877-cb6fe59f1399",
|                                         "Name":  "Azure AI Enterprise Networking Outbound Rules Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage networking outbound rules but lacks identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.MachineLearningServices/workspaces/managedNetworks/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/managedNetworks/write",
|                                                         "Microsoft.MachineLearningServices/workspaces/managedNetworks/outboundRules/read",
|                                                         "Microsoft.MachineLearningServices/workspaces/managedNetworks/outboundRules/write",
|                                                         "Microsoft.MachineLearningServices/workspaces/managedNetworks/outboundRules/delete",
|                                                         "Microsoft.MachineLearningServices/workspaces/managedNetworks/batchOutboundRules/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3b5a0aa9-eccd-48dc-9011-f2fd03b5e5f9",
|                                         "Name":  "Azure Business Continuity UPI Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to unified protected items; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleDefinitions/read",
|                                                         "Microsoft.Authorization/roleAssignments/read",
|                                                         "Microsoft.AzureBusinessContinuity/unifiedProtectedItems/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dd799a69-ffc8-4aa8-9701-b51f686857d9",
|                                         "Name":  "Pinecone.VectorDb Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to Pinecone VectorDb resources without identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Pinecone.VectorDb/checkNameAvailability/action",
|                                                         "Pinecone.VectorDb/register/action",
|                                                         "Pinecone.VectorDb/unregister/action",
|                                                         "Pinecone.VectorDb/locations/operationStatuses/read",
|                                                         "Pinecone.VectorDb/locations/operationStatuses/write",
|                                                         "Pinecone.VectorDb/operations/read",
|                                                         "Pinecone.VectorDb/organizations/read",
|                                                         "Pinecone.VectorDb/organizations/write",
|                                                         "Pinecone.VectorDb/organizations/delete",
|                                                         "Pinecone.VectorDb/registeredSubscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "246fffca-69ee-4945-bbf1-2a867dce4fda",
|                                         "Name":  "Microsoft.WeightsAndBiases Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to WeightsAndBiases resources but no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.WeightsAndBiases/checkNameAvailability/action",
|                                                         "Microsoft.WeightsAndBiases/register/action",
|                                                         "Microsoft.WeightsAndBiases/unregister/action",
|                                                         "Microsoft.WeightsAndBiases/instances/read",
|                                                         "Microsoft.WeightsAndBiases/instances/write",
|                                                         "Microsoft.WeightsAndBiases/instances/delete",
|                                                         "Microsoft.WeightsAndBiases/locations/operationStatuses/read",
|                                                         "Microsoft.WeightsAndBiases/locations/operationStatuses/write",
|                                                         "Microsoft.WeightsAndBiases/operations/read",
|                                                         "Microsoft.WeightsAndBiases/registeredSubscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "44a00263-b2a0-45d5-a618-5d8d11709349",
|                                         "Name":  "LambdaTest.HyperExecute Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to HyperExecute resources without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "LambdaTest.HyperExecute/checkNameAvailability/action",
|                                                         "LambdaTest.HyperExecute/register/action",
|                                                         "LambdaTest.HyperExecute/unregister/action",
|                                                         "LambdaTest.HyperExecute/locations/operationStatuses/read",
|                                                         "LambdaTest.HyperExecute/locations/operationStatuses/write",
|                                                         "LambdaTest.HyperExecute/operations/read",
|                                                         "LambdaTest.HyperExecute/organizations/read",
|                                                         "LambdaTest.HyperExecute/organizations/write",
|                                                         "LambdaTest.HyperExecute/organizations/delete",
|                                                         "LambdaTest.HyperExecute/registeredSubscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dca88c6f-5090-44cd-a0ff-a88f337b12a5",
|                                         "Name":  "ArizeAi.ObservabilityEval Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to ObservabilityEval resources but no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "ArizeAi.ObservabilityEval/checkNameAvailability/action",
|                                                         "ArizeAi.ObservabilityEval/register/action",
|                                                         "ArizeAi.ObservabilityEval/unregister/action",
|                                                         "ArizeAi.ObservabilityEval/locations/operationStatuses/read",
|                                                         "ArizeAi.ObservabilityEval/locations/operationStatuses/write",
|                                                         "ArizeAi.ObservabilityEval/operations/read",
|                                                         "ArizeAi.ObservabilityEval/organizations/read",
|                                                         "ArizeAi.ObservabilityEval/organizations/write",
|                                                         "ArizeAi.ObservabilityEval/organizations/delete",
|                                                         "ArizeAi.ObservabilityEval/registeredSubscriptions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "376d0802-aca8-4c2d-83a5-c88630f396fe",
|                                         "Name":  "Recurring Scheduled Actions Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage scheduled actions but lacks permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.ComputeSchedule/scheduledActions/write",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/delete",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/attachResources/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/cancelNextOccurrence/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/detachResources/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/disable/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/enable/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/listResources/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/patchResources/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/triggerManualOccurrence/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/occurrences/cancel/action",
|                                                         "Microsoft.ComputeSchedule/scheduledActions/occurrences/delay/action",
|                                                         "Microsoft.ComputeSchedule/register/action",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ff09793b-be48-49f6-ad96-70d32039c0b9",
|                                         "Name":  "Azure Resilience Management Drills Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Operator role for resilience drills without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/action",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/write",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                         "Microsoft.Insights/alertRules/",
|                                                         "Microsoft.Monitor/accounts/read",
|                                                         "Microsoft.Monitor/slis/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e131102b-11a5-4ff4-8508-ed922132b74c",
|                                         "Name":  "Azure Resilience Management Drills Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor to resilience drills but no direct or near-direct identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/action",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/delete",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/write",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/delete",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c914561b-1575-4601-af9c-a1356bf59818",
|                                         "Name":  "Azure Resilience Management Drills Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Administrator of resilience drills but lacks permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/action",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/delete",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/*/write",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/delete",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d2e8fe82-9212-490f-af3e-34bb52d87d3d",
|                                         "Name":  "Azure Resilience Management Drills Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to resilience drills; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/",
|                                                         "Microsoft.Resources/deployments/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/drillResources/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/drillRuns/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/drillRuns/drillRunChildJobs/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/drillRuns/drillRunResources/read",
|                                                         "Microsoft.AzureResilienceManagement/drills/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f24a559b-c2fc-4409-b96e-9af4b0c28ad6",
|                                         "Name":  "Edge Order Partner Inventory Manager Service Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages inventory metadata and links but no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.EdgeOrderPartner/locations/productFamilies/inventories/manageLink/action",
|                                                         "Microsoft.EdgeOrderPartner/locations/productFamilies/inventories/manageInventoryMetadata/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c5c82243-e78e-43f9-8428-793bba85b28e",
|                                         "Name":  "Defender For Container Registries Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access for Defender to container registries; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerRegistry/registries/pull/read",
|                                                         "Microsoft.ContainerRegistry/registries/metadata/read",
|                                                         "Microsoft.ContainerRegistry/registries/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                             "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                             "Microsoft.ContainerRegistry/registries/catalog/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fdb3df26-8dd6-49ff-9a74-e95dbfadcad3",
|                                         "Name":  "Change Safety Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages change safety resources but lacks identity or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.ChangeSafety/changeStates/read",
|                                                         "Microsoft.ChangeSafety/changeStates/write",
|                                                         "Microsoft.ChangeSafety/changeStates/delete",
|                                                         "Microsoft.ChangeSafety/changeRecords/read",
|                                                         "Microsoft.ChangeSafety/changeRecords/write",
|                                                         "Microsoft.ChangeSafety/changeRecords/delete",
|                                                         "Microsoft.ChangeSafety/changeStates/stageProgressions/read",
|                                                         "Microsoft.ChangeSafety/changeStates/stageProgressions/write",
|                                                         "Microsoft.ChangeSafety/changeStates/stageProgressions/delete",
|                                                         "Microsoft.ChangeSafety/changeRecords/stageProgressions/read",
|                                                         "Microsoft.ChangeSafety/changeRecords/stageProgressions/write",
|                                                         "Microsoft.ChangeSafety/changeRecords/stageProgressions/delete",
|                                                         "Microsoft.ChangeSafety/locations/operationstatuses/read",
|                                                         "Microsoft.ChangeSafety/locations/operationstatuses/write",
|                                                         "Microsoft.ChangeSafety/safeRollouts/read",
|                                                         "Microsoft.ChangeSafety/safeRollouts/write",
|                                                         "Microsoft.ChangeSafety/safeRollouts/delete",
|                                                         "Microsoft.ChangeSafety/safeRollouts/steps/read",
|                                                         "Microsoft.ChangeSafety/stageMaps/read",
|                                                         "Microsoft.ChangeSafety/stageMaps/write",
|                                                         "Microsoft.ChangeSafety/stageMaps/delete",
|                                                         "Microsoft.ChangeSafety/validations/read",
|                                                         "Microsoft.ChangeSafety/validations/write",
|                                                         "Microsoft.ChangeSafety/validations/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d0a94e7a-d791-4571-b2e0-8bdd8f867544",
|                                         "Name":  "Clinical Coder Data User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows processing of health data only; no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthBot/healthBots/AIActions/ClinicalCoder/Process/Action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "40ead2a5-466e-4039-8a80-325542d9d2dd",
|                                         "Name":  "Defender Unified RBAC Data Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Managed role for Defender RBAC data; no direct identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.operationalinsights/workspaces/read",
|                                                         "Microsoft.operationalinsights/workspaces/write",
|                                                         "Microsoft.operationalinsights/workspaces/query/read",
|                                                         "Microsoft.operationalinsights/workspaces/tables/write",
|                                                         "Microsoft.operationalinsights/workspaces/tables/delete",
|                                                         "Microsoft.operationalinsights/workspaces/sharedkeys/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "478d20ba-a53e-4946-b33c-8078a92f2d0a",
|                                         "Name":  "Azure Local Disconnected Operations Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages disconnected operations but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Edge/disconnectedOperations/*/read",
|                                                         "Microsoft.Edge/disconnectedOperations/*/write",
|                                                         "Microsoft.Edge/disconnectedOperations/*/delete",
|                                                         "Microsoft.Edge/winfields/*/read",
|                                                         "Microsoft.Edge/winfields/*/write",
|                                                         "Microsoft.Edge/winfields/*/delete",
|                                                         "Microsoft.Edge/winfields/*/action",
|                                                         "Microsoft.Edge/disconnectedOperations/*/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cbb820e9-e561-45bb-84c2-ef45d0a13f7d",
|                                         "Name":  "Workload Orchestration Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages workload orchestration resources without identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Edge/contexts/*",
|                                                         "Microsoft.Edge/configTemplates/*",
|                                                         "Microsoft.Edge/solutionTemplates/*",
|                                                         "Microsoft.Edge/configurations/*",
|                                                         "Microsoft.Edge/configurationreferences/*",
|                                                         "Microsoft.Edge/schemas/*",
|                                                         "Microsoft.Edge/schemaReferences/*",
|                                                         "Microsoft.Edge/targets/*",
|                                                         "Microsoft.Edge/jobs/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2a94a2fd-3c4f-45d1-847d-6585ba88af94",
|                                         "Name":  "Firmware Analysis Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to firmware images; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.IoTFirmwareDefense/*/read",
|                                                         "Microsoft.IoTFirmwareDefense/workspaces/firmwares/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.IoTFirmwareDefense/firmwareGroups/*",
|                                                            "Microsoft.IoTFirmwareDefense/workspaces/firmwares/write",
|                                                            "Microsoft.IoTFirmwareDefense/workspaces/firmwares/delete"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "04f6c337-ffae-414c-b00f-3e80c9ab8a2c",
|                                         "Name":  "Garnet Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full data access to Garnet resource but no identity or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1694e55a-2496-4d07-b005-7259aa3fcbe8",
|                                         "Name":  "Garnet Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to Garnet keys only; no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/append/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/bzmpop/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/bzpopmax/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/bzpopmin/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/decr/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/decrby/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/del/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/exists/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/expire/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/get/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/getdel/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/getex/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/getrange/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/getset/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hdel/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hexists/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hexpire/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hexpireat/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hexpiretime/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hgetall/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hincrby/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hincrbyfloat/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/histogram/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hkeys/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hlen/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hmget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hmset/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hpersist/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hpexpire/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hpexpireat/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hpexpiretime/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hpttl/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hrandfield/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hscan/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hset/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hsetnx/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hstrlen/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/httl/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hvals/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/incr/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/incrby/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/incrbyfloat/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/lcs/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/mget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/mset/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/msetnx/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/psetex/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/readonly/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/readwrite/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sadd/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/scard/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sdiff/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sdiffstore/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/set/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/setex/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/setnx/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/setrange/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sinter/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sintercard/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sinterstore/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sismember/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/slots/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/smembers/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/smismember/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/smove/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/spop/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/srandmember/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/srem/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sscan/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/strlen/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/substr/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sunion/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sunionstore/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/unlink/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zadd/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zcard/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zcount/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zdiff/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zdiffstore/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zincrby/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zinter/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zintercard/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zinterstore/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zlexcount/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zmpop/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zmscore/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zpopmax/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zpopmin/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrandmember/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrange/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrangebylex/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrangebyscore/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrangestore/write",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrank/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrem/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zremrangebylex/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zremrangebyrank/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zremrangebyscore/delete",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrevrange/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrevrangebylex/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrevrangebyscore/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrevrank/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zscan/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zscore/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zunion/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zunionstore/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d9cd91b9-dada-4fa9-9406-454c4659c137",
|                                         "Name":  "Garnet Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Garnet keys; no identity or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/exists/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/get/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/getex/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/getrange/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hexists/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hexpiretime/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hgetall/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/histogram/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hkeys/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hlen/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hmget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hpexpiretime/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hpttl/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hrandfield/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hscan/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hstrlen/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/httl/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/hvals/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/lcs/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/mget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/readonly/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/scard/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sdiff/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sinter/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sintercard/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sismember/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/slots/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/smembers/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/smismember/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/srandmember/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sscan/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/strlen/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/substr/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/sunion/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zcard/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zcount/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zdiff/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zinter/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zintercard/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zlexcount/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zmscore/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrandmember/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrange/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrangebylex/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrangebyscore/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrank/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrevrange/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrevrangebylex/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrevrangebyscore/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zrevrank/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zscan/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zscore/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/zunion/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7021ea36-e168-4bc0-af53-88de51d20665",
|                                         "Name":  "Garnet Script Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can execute and manage scripts on Garnet resource but no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/scripteval/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/scriptevalsha/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/scriptexists/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/scriptflush/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/scriptload/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/slots/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1fd5d8bf-9037-4ede-89bf-680f798e2765",
|                                         "Name":  "Defender Unified RBAC Authorization Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Managed role for Defender RBAC authorization; no direct identity or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "78b7345a-1e1b-483a-ac62-62228c6ea89d",
|                                         "Name":  "Defender Unified RBAC Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Defender RBAC data; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.SecurityInsights/*/read",
|                                                         "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                         "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                         "Microsoft.OperationalInsights/workspaces/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/LinkedServices/read",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                         "Microsoft.OperationalInsights/querypacks/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.Insights/workbooks/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                            "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.OperationalInsights/workspaces/tables/data/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "625a1cea-653b-4a19-bd3a-df1d66ab6637",
|                                         "Name":  "Defender Unified RBAC Contributor and Responder",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Provides read and limited write access to Defender resources but no identity plane control or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.OperationalInsights/querypacks/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/read",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/*",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.SecurityInsights/*",
|                                                         "Microsoft.SecurityInsights/*/read",
|                                                         "Microsoft.SecurityInsights/automationRules/*",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/systems/undoAction/action",
|                                                         "Microsoft.SecurityInsights/cases/*",
|                                                         "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                         "Microsoft.SecurityInsights/entities/runPlaybook/action",
|                                                         "Microsoft.SecurityInsights/incidents/*",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/bulkTag/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/replaceTags/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                         "Microsoft.Insights/workbooks/*",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.SecurityInsights/cases/*/Delete",
|                                                            "Microsoft.SecurityInsights/incidents/*/Delete",
|                                                            "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                            "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ca62263b-07d5-4b48-b437-088803f5c2ff",
|                                         "Name":  "Defender Unified RBAC Authorization Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Defender RBAC authorization data without any write or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1bacae94-6c0f-4d2d-8dfa-408d5a28e6ec",
|                                         "Name":  "Defender Unified RBAC Responder",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and respond to security insights but lacks permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.SecurityInsights/*/read",
|                                                         "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                         "Microsoft.SecurityInsights/automationRules/*",
|                                                         "Microsoft.SecurityInsights/cases/*",
|                                                         "Microsoft.SecurityInsights/incidents/*",
|                                                         "Microsoft.SecurityInsights/entities/runPlaybook/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/bulkTag/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/replaceTags/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                         "Microsoft.SecurityInsights/businessApplicationAgents/systems/undoAction/action",
|                                                         "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                         "Microsoft.OperationalInsights/workspaces/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.OperationalInsights/querypacks/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/workbooks/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.SecurityInsights/cases/*/Delete",
|                                                            "Microsoft.SecurityInsights/incidents/*/Delete",
|                                                            "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                            "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "679dc20a-52e8-4ac0-a23c-3b557dfb1e24",
|                                         "Name":  "Azure Monitor Pipeline Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages monitoring pipeline resources without permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Monitor/pipelineGroups/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2d50f159-7b96-4f1e-8fc7-fee6957ab7cc",
|                                         "Name":  "Azure Monitor Pipeline Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to monitoring pipeline resources with no identity plane impact.",
|                                         "Actions":  [
|                                                         "Microsoft.Monitor/pipelineGroups/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fd8ea4d5-6509-4db0-bada-356ab233b4fa",
|                                         "Name":  "Azure Migrate Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Azure Migrate projects but does not have permissions to assign high privilege roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/locations/read",
|                                                         "Microsoft.Resources/checkResourceName/action",
|                                                         "Microsoft.Resources/deploymentScripts/write",
|                                                         "Microsoft.Resources/deploymentScripts/read",
|                                                         "Microsoft.Resources/links/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Authorization/locks/write",
|                                                         "Microsoft.Authorization/locks/delete",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Migrate/*",
|                                                         "Microsoft.ApplicationMigration/*",
|                                                         "Microsoft.OffAzure/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.MySQLDiscovery/*",
|                                                         "Microsoft.DependencyMap/*",
|                                                         "Microsoft.KeyVault/vaults/*",
|                                                         "Microsoft.KeyVault/checkNameAvailability/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/register/action",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Network/privateEndpoints/read",
|                                                         "Microsoft.Network/privateEndpoints/write",
|                                                         "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
|                                                         "Microsoft.Network/privateDnsZones/write",
|                                                         "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                         "Microsoft.Network/privateDnsZones/join/action",
|                                                         "Microsoft.Network/privateDnsZones/A/write",
|                                                         "Microsoft.Network/register/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/*",
|                                                         "Microsoft.GuestConfiguration/register/action",
|                                                         "Microsoft.Compute/register/action",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/availabilitySets/vmSizes/read",
|                                                         "Microsoft.Compute/diskEncryptionSets/read",
|                                                         "Microsoft.Compute/skus/read",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachines/delete",
|                                                         "Microsoft.HybridConnectivity/register/action",
|                                                         "Microsoft.RecoveryServices/vaults/*",
|                                                         "Microsoft.RecoveryServices/register/action",
|                                                         "Microsoft.RecoveryServices/operations/read",
|                                                         "Microsoft.DataReplication/*/read",
|                                                         "Microsoft.DataReplication/register/action",
|                                                         "Microsoft.DataReplication/replicationVaults/write",
|                                                         "Microsoft.KeyVault/register/action",
|                                                         "Microsoft.AzureArcData/register/action",
|                                                         "Microsoft.Resources/links/read",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7859c0b0-0bb9-4994-bd12-cd529af7d646",
|                                         "Name":  "Azure Migrate Decide and Plan Expert",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Restricted to planning operations with no identity plane control or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/locations/read",
|                                                         "Microsoft.Resources/checkResourceName/action",
|                                                         "Microsoft.Resources/deploymentScripts/write",
|                                                         "Microsoft.Resources/deploymentScripts/read",
|                                                         "Microsoft.Resources/links/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Authorization/locks/write",
|                                                         "Microsoft.Authorization/locks/delete",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Migrate/*",
|                                                         "Microsoft.ApplicationMigration/*",
|                                                         "Microsoft.OffAzure/*",
|                                                         "Microsoft.MySQLDiscovery/*",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.DependencyMap/*",
|                                                         "Microsoft.KeyVault/vaults/*",
|                                                         "Microsoft.KeyVault/checkNameAvailability/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/write",
|                                                         "Microsoft.HybridCompute/machines/delete",
|                                                         "Microsoft.HybridCompute/register/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/virtualNetworks/join/action",
|                                                         "Microsoft.Network/privateEndpoints/read",
|                                                         "Microsoft.Network/privateEndpoints/write",
|                                                         "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
|                                                         "Microsoft.Network/privateDnsZones/write",
|                                                         "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                         "Microsoft.Network/privateDnsZones/join/action",
|                                                         "Microsoft.Network/privateDnsZones/A/write",
|                                                         "Microsoft.Network/register/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/*/read",
|                                                         "Microsoft.Storage/storageAccounts/*/write",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.GuestConfiguration/register/action",
|                                                         "Microsoft.HybridConnectivity/register/action",
|                                                         "Microsoft.DataReplication/*/read",
|                                                         "Microsoft.DataReplication/register/action",
|                                                         "Microsoft.DataReplication/replicationVaults/write",
|                                                         "Microsoft.RecoveryServices/vaults/*",
|                                                         "Microsoft.RecoveryServices/register/action",
|                                                         "Microsoft.KeyVault/register/action",
|                                                         "Microsoft.AzureArcData/register/action",
|                                                         "Microsoft.Resources/links/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ba480ccd-6499-4709-b581-8f38bb215c63",
|                                         "Name":  "Azure Migrate Service Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to Azure Migrate service data without permissions to modify roles or credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.ApplicationMigration/*/read",
|                                                         "Microsoft.Migrate/*/read",
|                                                         "Microsoft.OffAzure/*/read",
|                                                         "Microsoft.MySQLDiscovery/*/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectableItems/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/read",
|                                                         "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationMigrationItems/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1cfa4eac-9a23-481c-a793-bfb6958e836b",
|                                         "Name":  "Azure Migrate Execute Expert",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Performs migration operations but lacks permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                         "Microsoft.Resources/subscriptions/locations/read",
|                                                         "Microsoft.Resources/checkResourceName/action",
|                                                         "Microsoft.Resources/deploymentScripts/write",
|                                                         "Microsoft.Resources/deploymentScripts/read",
|                                                         "Microsoft.Resources/links/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Authorization/locks/write",
|                                                         "Microsoft.Authorization/locks/delete",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Migrate/*/read",
|                                                         "Microsoft.ApplicationMigration/*/read",
|                                                         "Microsoft.OffAzure/*/read",
|                                                         "Microsoft.MySQLDiscovery/*/read",
|                                                         "Microsoft.Support/*",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/networkInterfaces/write",
|                                                         "Microsoft.Network/networkInterfaces/delete",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Storage/storageAccounts/*/read",
|                                                         "Microsoft.Storage/storageAccounts/*/write",
|                                                         "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                         "Microsoft.Compute/register/action",
|                                                         "Microsoft.Compute/availabilitySets/read",
|                                                         "Microsoft.Compute/availabilitySets/vmSizes/read",
|                                                         "Microsoft.Compute/diskEncryptionSets/read",
|                                                         "Microsoft.Compute/skus/read",
|                                                         "Microsoft.Compute/disks/read",
|                                                         "Microsoft.Compute/disks/write",
|                                                         "Microsoft.Compute/disks/delete",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Compute/virtualMachines/write",
|                                                         "Microsoft.Compute/virtualMachines/delete",
|                                                         "Microsoft.RecoveryServices/vaults/*",
|                                                         "Microsoft.RecoveryServices/register/action",
|                                                         "Microsoft.RecoveryServices/operations/read",
|                                                         "Microsoft.Resources/links/read",
|                                                         "Microsoft.DependencyMap/*/read",
|                                                         "Microsoft.DependencyMap/maps/*/action",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.OffAzure/hypervSites/machines/inventoryinsights/pendingupdates/*",
|                                                            "Microsoft.OffAzure/hypervSites/machines/inventoryinsights/vulnerabilities/*",
|                                                            "Microsoft.OffAzure/serverSites/machines/inventoryinsights/pendingupdates/*",
|                                                            "Microsoft.OffAzure/serverSites/machines/inventoryinsights/vulnerabilities/*",
|                                                            "Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/vulnerabilities/*",
|                                                            "Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/pendingupdates/*"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "98c206fe-ea1b-4578-93f8-83a99a5628fc",
|                                         "Name":  "Aws Connector contributor role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages AWS connector resources without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AwsConnector/accessAnalyzerAnalyzers/delete",
|                                                         "Microsoft.AwsConnector/accessAnalyzerAnalyzers/write",
|                                                         "Microsoft.AwsConnector/acmCertificateSummaries/delete",
|                                                         "Microsoft.AwsConnector/acmCertificateSummaries/write",
|                                                         "Microsoft.AwsConnector/apiGatewayRestApis/delete",
|                                                         "Microsoft.AwsConnector/apiGatewayRestApis/write",
|                                                         "Microsoft.AwsConnector/apiGatewayStages/delete",
|                                                         "Microsoft.AwsConnector/apiGatewayStages/write",
|                                                         "Microsoft.AwsConnector/applicationAutoScalingScalableTargets/delete",
|                                                         "Microsoft.AwsConnector/applicationAutoScalingScalableTargets/write",
|                                                         "Microsoft.AwsConnector/appSyncGraphqlApis/delete",
|                                                         "Microsoft.AwsConnector/appSyncGraphqlApis/write",
|                                                         "Microsoft.AwsConnector/autoScalingAutoScalingGroups/delete",
|                                                         "Microsoft.AwsConnector/autoScalingAutoScalingGroups/write",
|                                                         "Microsoft.AwsConnector/bedrockAgentAliases/delete",
|                                                         "Microsoft.AwsConnector/bedrockAgentAliases/write",
|                                                         "Microsoft.AwsConnector/bedrockAgents/delete",
|                                                         "Microsoft.AwsConnector/bedrockAgents/write",
|                                                         "Microsoft.AwsConnector/bedrockApplicationInferenceProfiles/delete",
|                                                         "Microsoft.AwsConnector/bedrockApplicationInferenceProfiles/write",
|                                                         "Microsoft.AwsConnector/bedrockBlueprints/delete",
|                                                         "Microsoft.AwsConnector/bedrockBlueprints/write",
|                                                         "Microsoft.AwsConnector/bedrockDataAutomationProjects/delete",
|                                                         "Microsoft.AwsConnector/bedrockDataAutomationProjects/write",
|                                                         "Microsoft.AwsConnector/bedrockDataSources/delete",
|                                                         "Microsoft.AwsConnector/bedrockDataSources/write",
|                                                         "Microsoft.AwsConnector/bedrockFlowAliases/delete",
|                                                         "Microsoft.AwsConnector/bedrockFlowAliases/write",
|                                                         "Microsoft.AwsConnector/bedrockGuardrails/delete",
|                                                         "Microsoft.AwsConnector/bedrockGuardrails/write",
|                                                         "Microsoft.AwsConnector/bedrockKnowledgeBases/delete",
|                                                         "Microsoft.AwsConnector/bedrockKnowledgeBases/write",
|                                                         "Microsoft.AwsConnector/bedrockPrompts/delete",
|                                                         "Microsoft.AwsConnector/bedrockPrompts/write",
|                                                         "Microsoft.AwsConnector/cloudFormationStacks/delete",
|                                                         "Microsoft.AwsConnector/cloudFormationStacks/write",
|                                                         "Microsoft.AwsConnector/cloudFormationStackSets/delete",
|                                                         "Microsoft.AwsConnector/cloudFormationStackSets/write",
|                                                         "Microsoft.AwsConnector/cloudFrontDistributions/delete",
|                                                         "Microsoft.AwsConnector/cloudFrontDistributions/write",
|                                                         "Microsoft.AwsConnector/cloudTrailTrails/delete",
|                                                         "Microsoft.AwsConnector/cloudTrailTrails/write",
|                                                         "Microsoft.AwsConnector/cloudWatchAlarms/delete",
|                                                         "Microsoft.AwsConnector/cloudWatchAlarms/write",
|                                                         "Microsoft.AwsConnector/codeBuildProjects/delete",
|                                                         "Microsoft.AwsConnector/codeBuildProjects/write",
|                                                         "Microsoft.AwsConnector/codeBuildSourceCredentialsInfos/delete",
|                                                         "Microsoft.AwsConnector/codeBuildSourceCredentialsInfos/write",
|                                                         "Microsoft.AwsConnector/configServiceConfigurationRecorders/delete",
|                                                         "Microsoft.AwsConnector/configServiceConfigurationRecorders/write",
|                                                         "Microsoft.AwsConnector/configServiceConfigurationRecorderStatuses/delete",
|                                                         "Microsoft.AwsConnector/configServiceConfigurationRecorderStatuses/write",
|                                                         "Microsoft.AwsConnector/configServiceDeliveryChannels/delete",
|                                                         "Microsoft.AwsConnector/configServiceDeliveryChannels/write",
|                                                         "Microsoft.AwsConnector/databaseMigrationServiceReplicationInstances/delete",
|                                                         "Microsoft.AwsConnector/databaseMigrationServiceReplicationInstances/write",
|                                                         "Microsoft.AwsConnector/daxClusters/delete",
|                                                         "Microsoft.AwsConnector/daxClusters/write",
|                                                         "Microsoft.AwsConnector/dynamoDBContinuousBackupsDescriptions/delete",
|                                                         "Microsoft.AwsConnector/dynamoDBContinuousBackupsDescriptions/write",
|                                                         "Microsoft.AwsConnector/dynamoDBTables/delete",
|                                                         "Microsoft.AwsConnector/dynamoDBTables/write",
|                                                         "Microsoft.AwsConnector/ec2AccountAttributes/delete",
|                                                         "Microsoft.AwsConnector/ec2AccountAttributes/write",
|                                                         "Microsoft.AwsConnector/ec2Addresses/delete",
|                                                         "Microsoft.AwsConnector/ec2Addresses/write",
|                                                         "Microsoft.AwsConnector/ec2FlowLogs/delete",
|                                                         "Microsoft.AwsConnector/ec2FlowLogs/write",
|                                                         "Microsoft.AwsConnector/ec2Images/delete",
|                                                         "Microsoft.AwsConnector/ec2Images/write",
|                                                         "Microsoft.AwsConnector/ec2Instances/delete",
|                                                         "Microsoft.AwsConnector/ec2Instances/start/action",
|                                                         "Microsoft.AwsConnector/ec2Instances/stop/action",
|                                                         "Microsoft.AwsConnector/ec2Instances/write",
|                                                         "Microsoft.AwsConnector/ec2InstanceStatuses/delete",
|                                                         "Microsoft.AwsConnector/ec2InstanceStatuses/write",
|                                                         "Microsoft.AwsConnector/ec2Ipams/delete",
|                                                         "Microsoft.AwsConnector/ec2Ipams/write",
|                                                         "Microsoft.AwsConnector/ec2KeyPairs/delete",
|                                                         "Microsoft.AwsConnector/ec2KeyPairs/write",
|                                                         "Microsoft.AwsConnector/ec2NetworkAcls/delete",
|                                                         "Microsoft.AwsConnector/ec2NetworkAcls/write",
|                                                         "Microsoft.AwsConnector/ec2NetworkInterfaces/delete",
|                                                         "Microsoft.AwsConnector/ec2NetworkInterfaces/write",
|                                                         "Microsoft.AwsConnector/ec2RouteTables/delete",
|                                                         "Microsoft.AwsConnector/ec2RouteTables/write",
|                                                         "Microsoft.AwsConnector/ec2SecurityGroups/delete",
|                                                         "Microsoft.AwsConnector/ec2SecurityGroups/write",
|                                                         "Microsoft.AwsConnector/ec2Snapshots/delete",
|                                                         "Microsoft.AwsConnector/ec2Snapshots/write",
|                                                         "Microsoft.AwsConnector/ec2Subnets/delete",
|                                                         "Microsoft.AwsConnector/ec2Subnets/write",
|                                                         "Microsoft.AwsConnector/ec2Volumes/delete",
|                                                         "Microsoft.AwsConnector/ec2Volumes/write",
|                                                         "Microsoft.AwsConnector/ec2VPCEndpoints/delete",
|                                                         "Microsoft.AwsConnector/ec2VPCEndpoints/write",
|                                                         "Microsoft.AwsConnector/ec2VPCPeeringConnections/delete",
|                                                         "Microsoft.AwsConnector/ec2VPCPeeringConnections/write",
|                                                         "Microsoft.AwsConnector/ec2Vpcs/delete",
|                                                         "Microsoft.AwsConnector/ec2Vpcs/write",
|                                                         "Microsoft.AwsConnector/ecrImageDetails/delete",
|                                                         "Microsoft.AwsConnector/ecrImageDetails/write",
|                                                         "Microsoft.AwsConnector/ecrRepositories/delete",
|                                                         "Microsoft.AwsConnector/ecrRepositories/write",
|                                                         "Microsoft.AwsConnector/ecsClusters/delete",
|                                                         "Microsoft.AwsConnector/ecsClusters/write",
|                                                         "Microsoft.AwsConnector/ecsServices/delete",
|                                                         "Microsoft.AwsConnector/ecsServices/write",
|                                                         "Microsoft.AwsConnector/ecsTaskDefinitions/delete",
|                                                         "Microsoft.AwsConnector/ecsTaskDefinitions/write",
|                                                         "Microsoft.AwsConnector/efsFileSystems/delete",
|                                                         "Microsoft.AwsConnector/efsFileSystems/write",
|                                                         "Microsoft.AwsConnector/efsMountTargets/delete",
|                                                         "Microsoft.AwsConnector/efsMountTargets/write",
|                                                         "Microsoft.AwsConnector/eksClusters/delete",
|                                                         "Microsoft.AwsConnector/eksClusters/write",
|                                                         "Microsoft.AwsConnector/eksNodegroups/delete",
|                                                         "Microsoft.AwsConnector/eksNodegroups/write",
|                                                         "Microsoft.AwsConnector/elasticBeanstalkApplications/delete",
|                                                         "Microsoft.AwsConnector/elasticBeanstalkApplications/write",
|                                                         "Microsoft.AwsConnector/elasticBeanstalkConfigurationTemplates/delete",
|                                                         "Microsoft.AwsConnector/elasticBeanstalkConfigurationTemplates/write",
|                                                         "Microsoft.AwsConnector/elasticBeanstalkEnvironments/delete",
|                                                         "Microsoft.AwsConnector/elasticBeanstalkEnvironments/write",
|                                                         "Microsoft.AwsConnector/elasticLoadBalancingV2Listeners/delete",
|                                                         "Microsoft.AwsConnector/elasticLoadBalancingV2Listeners/write",
|                                                         "Microsoft.AwsConnector/elasticLoadBalancingV2LoadBalancers/delete",
|                                                         "Microsoft.AwsConnector/elasticLoadBalancingV2LoadBalancers/write",
|                                                         "Microsoft.AwsConnector/elasticLoadBalancingV2TargetGroups/delete",
|                                                         "Microsoft.AwsConnector/elasticLoadBalancingV2TargetGroups/write",
|                                                         "Microsoft.AwsConnector/elasticLoadBalancingV2TargetHealthDescriptions/delete",
|                                                         "Microsoft.AwsConnector/elasticLoadBalancingV2TargetHealthDescriptions/write",
|                                                         "Microsoft.AwsConnector/elasticsearchDomains/delete",
|                                                         "Microsoft.AwsConnector/elasticsearchDomains/write",
|                                                         "Microsoft.AwsConnector/emrClusters/delete",
|                                                         "Microsoft.AwsConnector/emrClusters/write",
|                                                         "Microsoft.AwsConnector/guardDutyDetectors/delete",
|                                                         "Microsoft.AwsConnector/guardDutyDetectors/write",
|                                                         "Microsoft.AwsConnector/iamAccessKeyLastUseds/delete",
|                                                         "Microsoft.AwsConnector/iamAccessKeyLastUseds/write",
|                                                         "Microsoft.AwsConnector/iamAccessKeyMetadata/delete",
|                                                         "Microsoft.AwsConnector/iamAccessKeyMetadata/write",
|                                                         "Microsoft.AwsConnector/iamGroups/delete",
|                                                         "Microsoft.AwsConnector/iamGroups/write",
|                                                         "Microsoft.AwsConnector/iamInstanceProfiles/delete",
|                                                         "Microsoft.AwsConnector/iamInstanceProfiles/write",
|                                                         "Microsoft.AwsConnector/iamManagedPolicies/delete",
|                                                         "Microsoft.AwsConnector/iamManagedPolicies/write",
|                                                         "Microsoft.AwsConnector/iamMFADevices/delete",
|                                                         "Microsoft.AwsConnector/iamMFADevices/write",
|                                                         "Microsoft.AwsConnector/iamPasswordPolicies/delete",
|                                                         "Microsoft.AwsConnector/iamPasswordPolicies/write",
|                                                         "Microsoft.AwsConnector/iamPolicyVersions/delete",
|                                                         "Microsoft.AwsConnector/iamPolicyVersions/write",
|                                                         "Microsoft.AwsConnector/iamRoles/delete",
|                                                         "Microsoft.AwsConnector/iamRoles/write",
|                                                         "Microsoft.AwsConnector/iamServerCertificates/delete",
|                                                         "Microsoft.AwsConnector/iamServerCertificates/write",
|                                                         "Microsoft.AwsConnector/iamUserPolicies/delete",
|                                                         "Microsoft.AwsConnector/iamUserPolicies/write",
|                                                         "Microsoft.AwsConnector/iamVirtualMFADevices/delete",
|                                                         "Microsoft.AwsConnector/iamVirtualMFADevices/write",
|                                                         "Microsoft.AwsConnector/kmsAliases/delete",
|                                                         "Microsoft.AwsConnector/kmsAliases/write",
|                                                         "Microsoft.AwsConnector/kmsKeys/delete",
|                                                         "Microsoft.AwsConnector/kmsKeys/write",
|                                                         "Microsoft.AwsConnector/lambdaFunctionCodeLocations/delete",
|                                                         "Microsoft.AwsConnector/lambdaFunctionCodeLocations/write",
|                                                         "Microsoft.AwsConnector/lambdaFunctionConfigurations/delete",
|                                                         "Microsoft.AwsConnector/lambdaFunctionConfigurations/write",
|                                                         "Microsoft.AwsConnector/lambdaFunctions/delete",
|                                                         "Microsoft.AwsConnector/lambdaFunctions/write",
|                                                         "Microsoft.AwsConnector/licenseManagerLicenses/delete",
|                                                         "Microsoft.AwsConnector/licenseManagerLicenses/write",
|                                                         "Microsoft.AwsConnector/lightsailBuckets/delete",
|                                                         "Microsoft.AwsConnector/lightsailBuckets/write",
|                                                         "Microsoft.AwsConnector/lightsailInstances/delete",
|                                                         "Microsoft.AwsConnector/lightsailInstances/write",
|                                                         "Microsoft.AwsConnector/Locations/OperationStatuses/write",
|                                                         "Microsoft.AwsConnector/logsLogGroups/delete",
|                                                         "Microsoft.AwsConnector/logsLogGroups/write",
|                                                         "Microsoft.AwsConnector/logsLogStreams/delete",
|                                                         "Microsoft.AwsConnector/logsLogStreams/write",
|                                                         "Microsoft.AwsConnector/logsMetricFilters/delete",
|                                                         "Microsoft.AwsConnector/logsMetricFilters/write",
|                                                         "Microsoft.AwsConnector/logsSubscriptionFilters/delete",
|                                                         "Microsoft.AwsConnector/logsSubscriptionFilters/write",
|                                                         "Microsoft.AwsConnector/macie2JobSummaries/delete",
|                                                         "Microsoft.AwsConnector/macie2JobSummaries/write",
|                                                         "Microsoft.AwsConnector/macieAllowLists/delete",
|                                                         "Microsoft.AwsConnector/macieAllowLists/write",
|                                                         "Microsoft.AwsConnector/networkFirewallFirewallPolicies/delete",
|                                                         "Microsoft.AwsConnector/networkFirewallFirewallPolicies/write",
|                                                         "Microsoft.AwsConnector/networkFirewallFirewalls/delete",
|                                                         "Microsoft.AwsConnector/networkFirewallFirewalls/write",
|                                                         "Microsoft.AwsConnector/networkFirewallRuleGroups/delete",
|                                                         "Microsoft.AwsConnector/networkFirewallRuleGroups/write",
|                                                         "Microsoft.AwsConnector/openSearchDomainStatuses/delete",
|                                                         "Microsoft.AwsConnector/openSearchDomainStatuses/write",
|                                                         "Microsoft.AwsConnector/openSearchServiceDomains/delete",
|                                                         "Microsoft.AwsConnector/openSearchServiceDomains/write",
|                                                         "Microsoft.AwsConnector/organizationsAccounts/delete",
|                                                         "Microsoft.AwsConnector/organizationsAccounts/write",
|                                                         "Microsoft.AwsConnector/organizationsOrganizations/delete",
|                                                         "Microsoft.AwsConnector/organizationsOrganizations/write",
|                                                         "Microsoft.AwsConnector/rdsDBClusters/delete",
|                                                         "Microsoft.AwsConnector/rdsDBClusters/write",
|                                                         "Microsoft.AwsConnector/rdsDBInstances/delete",
|                                                         "Microsoft.AwsConnector/rdsDBInstances/write",
|                                                         "Microsoft.AwsConnector/rdsDBSnapshotAttributesResults/delete",
|                                                         "Microsoft.AwsConnector/rdsDBSnapshotAttributesResults/write",
|                                                         "Microsoft.AwsConnector/rdsDBSnapshots/delete",
|                                                         "Microsoft.AwsConnector/rdsDBSnapshots/write",
|                                                         "Microsoft.AwsConnector/rdsEventSubscriptions/delete",
|                                                         "Microsoft.AwsConnector/rdsEventSubscriptions/write",
|                                                         "Microsoft.AwsConnector/rdsExportTasks/delete",
|                                                         "Microsoft.AwsConnector/rdsExportTasks/write",
|                                                         "Microsoft.AwsConnector/redshiftClusterParameterGroups/delete",
|                                                         "Microsoft.AwsConnector/redshiftClusterParameterGroups/write",
|                                                         "Microsoft.AwsConnector/redshiftClusters/delete",
|                                                         "Microsoft.AwsConnector/redshiftClusters/write",
|                                                         "Microsoft.AwsConnector/route53DomainsDomainSummaries/delete",
|                                                         "Microsoft.AwsConnector/route53DomainsDomainSummaries/write",
|                                                         "Microsoft.AwsConnector/route53HostedZones/delete",
|                                                         "Microsoft.AwsConnector/route53HostedZones/write",
|                                                         "Microsoft.AwsConnector/route53ResourceRecordSets/delete",
|                                                         "Microsoft.AwsConnector/route53ResourceRecordSets/write",
|                                                         "Microsoft.AwsConnector/s3AccessControlPolicies/delete",
|                                                         "Microsoft.AwsConnector/s3AccessControlPolicies/write",
|                                                         "Microsoft.AwsConnector/s3AccessPoints/delete",
|                                                         "Microsoft.AwsConnector/s3AccessPoints/write",
|                                                         "Microsoft.AwsConnector/s3BucketPolicies/delete",
|                                                         "Microsoft.AwsConnector/s3BucketPolicies/write",
|                                                         "Microsoft.AwsConnector/s3Buckets/delete",
|                                                         "Microsoft.AwsConnector/s3Buckets/write",
|                                                         "Microsoft.AwsConnector/s3ControlMultiRegionAccessPointPolicyDocuments/delete",
|                                                         "Microsoft.AwsConnector/s3ControlMultiRegionAccessPointPolicyDocuments/write",
|                                                         "Microsoft.AwsConnector/sageMakerApps/delete",
|                                                         "Microsoft.AwsConnector/sageMakerApps/write",
|                                                         "Microsoft.AwsConnector/sageMakerDevices/delete",
|                                                         "Microsoft.AwsConnector/sageMakerDevices/write",
|                                                         "Microsoft.AwsConnector/sageMakerImages/delete",
|                                                         "Microsoft.AwsConnector/sageMakerImages/write",
|                                                         "Microsoft.AwsConnector/sageMakerNotebookInstanceSummaries/delete",
|                                                         "Microsoft.AwsConnector/sageMakerNotebookInstanceSummaries/write",
|                                                         "Microsoft.AwsConnector/secretsManagerResourcePolicies/delete",
|                                                         "Microsoft.AwsConnector/secretsManagerResourcePolicies/write",
|                                                         "Microsoft.AwsConnector/secretsManagerSecrets/delete",
|                                                         "Microsoft.AwsConnector/secretsManagerSecrets/write",
|                                                         "Microsoft.AwsConnector/snsSubscriptions/delete",
|                                                         "Microsoft.AwsConnector/snsSubscriptions/write",
|                                                         "Microsoft.AwsConnector/snsTopics/delete",
|                                                         "Microsoft.AwsConnector/snsTopics/write",
|                                                         "Microsoft.AwsConnector/sqsQueues/delete",
|                                                         "Microsoft.AwsConnector/sqsQueues/write",
|                                                         "Microsoft.AwsConnector/ssmInstanceInformations/delete",
|                                                         "Microsoft.AwsConnector/ssmInstanceInformations/write",
|                                                         "Microsoft.AwsConnector/ssmParameters/delete",
|                                                         "Microsoft.AwsConnector/ssmParameters/write",
|                                                         "Microsoft.AwsConnector/ssmResourceComplianceSummaryItems/delete",
|                                                         "Microsoft.AwsConnector/ssmResourceComplianceSummaryItems/write",
|                                                         "Microsoft.AwsConnector/wafv2IPSets/delete",
|                                                         "Microsoft.AwsConnector/wafv2IPSets/write",
|                                                         "Microsoft.AwsConnector/wafv2LoggingConfigurations/delete",
|                                                         "Microsoft.AwsConnector/wafv2LoggingConfigurations/write",
|                                                         "Microsoft.AwsConnector/wafv2WebACLAssociations/delete",
|                                                         "Microsoft.AwsConnector/wafv2WebACLAssociations/write",
|                                                         "Microsoft.AwsConnector/wafWebACLSummaries/delete",
|                                                         "Microsoft.AwsConnector/wafWebACLSummaries/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a4b156ac-253f-4a1a-9851-96d62b71b047",
|                                         "Name":  "SRE Agent Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to SRE Agent data with no ability to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/agents/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.App/agents/threads/read",
|                                                             "Microsoft.App/agents/graph/read",
|                                                             "Microsoft.App/agents/memory/read",
|                                                             "Microsoft.App/agents/incidentManagement/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f0f57965-de58-41bc-ba76-2aaab4d09f30",
|                                         "Name":  "Hybrid Connectivity contributor role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages hybrid connectivity resources but lacks permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridConnectivity/endpoints/listIngressGatewayCredentials/action",
|                                                         "Microsoft.HybridConnectivity/Locations/OperationStatuses/write",
|                                                         "Microsoft.HybridConnectivity/publicCloudConnectors/delete",
|                                                         "Microsoft.HybridConnectivity/publicCloudConnectors/read",
|                                                         "Microsoft.HybridConnectivity/publicCloudConnectors/testPermissions/action",
|                                                         "Microsoft.HybridConnectivity/publicCloudConnectors/write",
|                                                         "Microsoft.HybridConnectivity/solutionConfigurations/delete",
|                                                         "Microsoft.HybridConnectivity/solutionConfigurations/read",
|                                                         "Microsoft.HybridConnectivity/solutionConfigurations/syncNow/action",
|                                                         "Microsoft.HybridConnectivity/solutionConfigurations/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a235d3ee-5935-4cfb-8cc5-a3303ad5995e",
|                                         "Name":  "Storage File Data SMB MI Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Admin access to files/directories for managed identities but no identity plane or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/takeOwnership/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/runAsBuiltInFileAdministrator/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b256d512-9a3a-4a96-9366-9f54f900e58b",
|                                         "Name":  "Common Edge Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages edge connectivity and updates without permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Edge/connectivityStatuses/delete",
|                                                         "Microsoft.Edge/connectivityStatuses/write",
|                                                         "Microsoft.Edge/locations/operationStatuses/write",
|                                                         "Microsoft.Edge/updates/delete",
|                                                         "Microsoft.Edge/updates/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "53b2724d-1e51-44fa-b586-bcace0c82609",
|                                         "Name":  "Firmware Analysis User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can upload and analyze firmware images but has no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.IoTFirmwareDefense/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/deployments/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.IoTFirmwareDefense/firmwareGroups/*",
|                                                            "Microsoft.IoTFirmwareDefense/register/action",
|                                                            "Microsoft.IoTFirmwareDefense/unregister/action",
|                                                            "Microsoft.IoTFirmwareDefense/workspaces/write",
|                                                            "Microsoft.IoTFirmwareDefense/workspaces/delete"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e79298df-d852-4c6d-84f9-5d13249d1e55",
|                                         "Name":  "SRE Agent Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full control of SRE Agent but no permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/agents/read",
|                                                         "Microsoft.App/agents/*/read",
|                                                         "Microsoft.App/agents/write",
|                                                         "Microsoft.App/agents/*/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.App/agents/*/read",
|                                                             "Microsoft.App/agents/*/write",
|                                                             "Microsoft.App/agents/*/delete",
|                                                             "Microsoft.App/agents/threads/approve/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2d84a65a-63b2-4343-bbb6-31105d857bc1",
|                                         "Name":  "SRE Agent Standard User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Limited interaction with SRE Agent without identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/agents/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.App/agents/threads/read",
|                                                             "Microsoft.App/agents/graph/read",
|                                                             "Microsoft.App/agents/memory/read",
|                                                             "Microsoft.App/agents/incidentManagement/read",
|                                                             "Microsoft.App/agents/threads/write",
|                                                             "Microsoft.App/agents/graph/write",
|                                                             "Microsoft.App/agents/memory/write",
|                                                             "Microsoft.App/agents/scheduledtasks/read",
|                                                             "Microsoft.App/agents/scheduledtasks/write",
|                                                             "Microsoft.App/agents/scheduledtasks/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "850c5848-fc51-4a9a-8823-f220370626e3",
|                                         "Name":  "Azure Kubernetes Fleet Manager Hub Cluster User Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to Kubernetes fleet and config files but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action",
|                                                         "Microsoft.ContainerService/fleets/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3b03c2da-16b3-4a49-8834-0f8130efdd3b",
|                                         "Name":  "Log Analytics Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can query logs but lacks permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.OperationalInsights/workspaces/query/read",
|                                                         "Microsoft.OperationalInsights/workspaces/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.OperationalInsights/workspaces/tables/data/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "89f7a3ec-e9d0-40eb-9b96-c016a5c2a53f",
|                                         "Name":  "Dynamics 365 Customer Insights Service Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages diagnostic logging for Customer Insights without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.D365CustomerInsights/instances/write",
|                                                         "Microsoft.D365CustomerInsights/instances/providers/Microsoft.Insights/diagnosticSettings/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "77789c21-1643-48a2-8f27-47f858540b51",
|                                         "Name":  "Storage Actions Task Assignment Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Creates task assignments on storage accounts but cannot assign high privilege roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/reports/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/storageTaskAssignments/read",
|                                                         "Microsoft.Storage/storageAccounts/storageTaskAssignments/write",
|                                                         "Microsoft.Storage/storageAccounts/storageTaskAssignments/delete",
|                                                         "Microsoft.Storage/storageAccounts/storageTaskAssignments/reports/read",
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/roleAssignments/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4bad4d9e-2a13-4888-94bb-c8432f6f3040",
|                                         "Name":  "Storage Actions Blob Data Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Performs blob operations without permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/runAsSuperUser/action",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/immutableStorage/runAsSuperUser/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "55077723-1b30-4603-a70b-68de134cfa20",
|                                         "Name":  "Azure Native Dynatrace Agent Management Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Dynatrace Agent on compute resources without identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.KubernetesConfiguration/extensions/write",
|                                                         "Microsoft.KubernetesConfiguration/extensions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bd8acdb0-202c-4493-a7fe-ef98eefbfbc4",
|                                         "Name":  "Storage Actions Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages storage actions but lacks permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.StorageActions/storageTasks/read",
|                                                         "Microsoft.StorageActions/storageTasks/write",
|                                                         "Microsoft.StorageActions/storageTasks/delete",
|                                                         "Microsoft.StorageActions/storageTasks/storageTaskAssignments/read",
|                                                         "Microsoft.StorageActions/storageTasks/reports/read",
|                                                         "Microsoft.StorageActions/locations/previewActions/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "34013b0a-565b-43aa-8755-1b7c286f6cf7",
|                                         "Name":  "Essential Machine Management Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages machine management resources without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Insights/dataCollectionRules/read",
|                                                         "Microsoft.Insights/dataCollectionRules/write",
|                                                         "Microsoft.Monitor/accounts/write",
|                                                         "Microsoft.Monitor/accounts/read",
|                                                         "Microsoft.ManagedOps/managedOps/read",
|                                                         "Microsoft.ManagedOps/managedOps/write",
|                                                         "Microsoft.ManagedOps/managedOps/delete",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.OperationsManagement/solutions/write",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedkeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedkeys/read",
|                                                         "Microsoft.OperationalInsights/workspaces/listKeys/action",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/metricAlerts/write",
|                                                         "Microsoft.Insights/metricAlerts/read",
|                                                         "Microsoft.Security/pricings/write",
|                                                         "Microsoft.Security/pricings/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "56e95fdc-3337-468d-b964-30d07f2a2018",
|                                         "Name":  "Garnet PubSub Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to Garnet channels but no identity plane or role assignment control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/slots/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/channels/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/numsub/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/numpat/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/psubscribe/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/publish/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/punsubscribe/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/subscribe/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/unsubscribe/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "da9adf61-39cd-41d5-87a0-30b21f7270d8",
|                                         "Name":  "Garnet PubSub Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Garnet channels without identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/slots/read",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/channels/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/psubscribe/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/punsubscribe/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/subscribe/action",
|                                                             "Microsoft.DocumentDB/garnetClusters/acl/unsubscribe/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "bbf004e3-0e4b-4f86-ae4f-1f8fb47b357b",
|                                         "Name":  "Storage File Data SMB Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Admin access to storage files over SMB but no permissions to modify identity or role assignments.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/takeOwnership/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "68899692-f960-4247-af28-82f55b357997",
|                                         "Name":  "Supercomputer Infrastructure Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages supercomputer infrastructure resources without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.SupercomputerInfrastructure/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "13d06eae-ec82-4345-bcd6-c38625ddffbc",
|                                         "Name":  "Healthcare Agent Contributer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages healthcare agent resources without permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.HealthBot/healthBots/Read",
|                                                         "Microsoft.HealthBot/healthBots/Write",
|                                                         "Microsoft.HealthBot/healthBots/Delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4c7fd853-7345-4453-babd-e9481e9b460b",
|                                         "Name":  "Azure Resilience Management Recovery Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages recovery plans but lacks permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/delete",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/write",
|                                                         "Microsoft.Insights/alertRules/",
|                                                         "Microsoft.Management/ServiceGroups/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/write",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "481d9636-d9f0-468b-b93d-6056318e6f36",
|                                         "Name":  "Azure Resilience Management Recovery Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Administrator of recovery service without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/delete",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/write",
|                                                         "Microsoft.Insights/alertRules/",
|                                                         "Microsoft.Management/ServiceGroups/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/write",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8210e6a3-4e4c-4e1a-bd83-ef8bac788a45",
|                                         "Name":  "Azure Resilience Management Recovery Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to recovery plans and related resources without identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                         "Microsoft.Insights/alertRules/",
|                                                         "Microsoft.Management/ServiceGroups/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/read",
|                                                         "Microsoft.Resources/deployments/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "517781b0-5ad4-4418-94d5-f2421834b586",
|                                         "Name":  "Azure Resilience Management Recovery Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Operator role with action permissions on recovery plans but no role assignment or credential reset capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                         "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                         "Microsoft.Insights/alertRules/",
|                                                         "Microsoft.Management/ServiceGroups/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a5c3590a-3a1a-4cd4-9648-ea0a32b15137",
|                                         "Name":  "Azure Device Registry Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to IoT devices but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "microsoft.deviceregistry/namespaces/read",
|                                                         "microsoft.deviceregistry/namespaces/devices/*",
|                                                         "microsoft.deviceregistry/namespaces/discovereddevices/*",
|                                                         "microsoft.deviceregistry/namespaces/credentials/read",
|                                                         "microsoft.deviceregistry/namespaces/credentials/policies/read",
|                                                         "microsoft.devices/iothubs/certificates/*",
|                                                         "microsoft.devices/iothubs/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "microsoft.deviceregistry/namespaces/credentials/policies/issueCertificate/action",
|                                                             "microsoft.devices/iothubs/devices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "09267e11-2e06-40b5-8fe4-68cea20794c9",
|                                         "Name":  "Azure Device Registry Credentials Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages credentials and policies for device registry without identity plane control.",
|                                         "Actions":  [
|                                                         "microsoft.deviceregistry/namespaces/credentials/*",
|                                                         "microsoft.deviceregistry/namespaces/credentials/policies/*",
|                                                         "microsoft.deviceregistry/namespaces/devices/revoke/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d5dddae-e124-4753-972d-aae60b37deb4",
|                                         "Name":  "Migrate Arc Discovery Reader - Preview",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Azure Arc resources without permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.AzureArcData/sqlServerInstances/read",
|                                                         "Microsoft.AzureArcData/sqlServerInstances/databases/read",
|                                                         "Microsoft.AzureArcData/sqlServerInstances/availabilityGroups/read",
|                                                         "Microsoft.AzureArcData/sqlServerInstances/getTelemetry/action",
|                                                         "Microsoft.AzureArcData/sqlServerInstances/availabilityGroups/getDetailView/action",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "547f7f0a-69c0-4807-bd9e-0321dfb66a84",
|                                         "Name":  "Azure Device Registry Onboarding",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to device registry namespace and certificate provisioning without identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.DeviceRegistry/namespaces/read",
|                                                         "Microsoft.DeviceRegistry/namespaces/write",
|                                                         "Microsoft.DeviceRegistry/namespaces/delete",
|                                                         "Microsoft.DeviceRegistry/namespaces/credentials/*",
|                                                         "Microsoft.DeviceRegistry/namespaces/credentials/policies/*",
|                                                         "Microsoft.Devices/iothubs/*",
|                                                         "Microsoft.Devices/provisioningServices/*",
|                                                         "microsoft.deviceregistry/namespaces/devices/revoke/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Devices/provisioningServices/enrollments/*",
|                                                             "Microsoft.Devices/provisioningServices/enrollmentGroups/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9d3ef640-3c86-4e0a-8907-8d361559c012",
|                                         "Name":  "Hybrid Network Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Owner access to hybrid network resources but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.HybridNetwork/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a2b7cc47-30ec-462f-a2f4-9ac6e1c266af",
|                                         "Name":  "Azure Resilience Management Goals Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages resiliency goals and assignments but lacks permissions to assign high privilege roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/roleAssignments/write",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Management/ServiceGroups/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/read",
|                                                         "Microsoft.AzureResilienceManagement/goalTemplates/delete",
|                                                         "Microsoft.AzureResilienceManagement/goalTemplates/read",
|                                                         "Microsoft.AzureResilienceManagement/goalTemplates/write",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/delete",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/read",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/write",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/goalResources/read",
|                                                         "Microsoft.AzureResilienceManagement/locations/operationStatuses/read",
|                                                         "Microsoft.AzureResilienceManagement/operations/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3910633d-19d0-4d31-b5e6-4f3101b137b9",
|                                         "Name":  "Azure Resilience Management Goals Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can view and modify resiliency goals but no identity plane or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Management/ServiceGroups/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/read",
|                                                         "Microsoft.AzureResilienceManagement/goalTemplates/delete",
|                                                         "Microsoft.AzureResilienceManagement/goalTemplates/read",
|                                                         "Microsoft.AzureResilienceManagement/goalTemplates/write",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/delete",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/read",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/write",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/goalResources/read",
|                                                         "Microsoft.AzureResilienceManagement/locations/operationStatuses/read",
|                                                         "Microsoft.AzureResilienceManagement/operations/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "39ea2c4e-798a-4469-b81d-65dc7c54cbdb",
|                                         "Name":  "Azure Resilience Management Goals Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to resiliency goals without permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.AzureResilienceManagement/goalTemplates/read",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/read",
|                                                         "Microsoft.AzureResilienceManagement/goalAssignments/goalResources/read",
|                                                         "Microsoft.AzureResilienceManagement/locations/operationStatuses/read",
|                                                         "Microsoft.AzureResilienceManagement/operations/read",
|                                                         "Microsoft.Management/ServiceGroups/read",
|                                                         "Microsoft.Relationships/ServiceGroupMember/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "852e55ca-96ce-48b0-abca-2cd74d9042ca",
|                                         "Name":  "Azure Kubernetes Application Network Contributor Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Kubernetes application network resources without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AppLink/AppLinks/read",
|                                                         "Microsoft.AppLink/AppLinks/write",
|                                                         "Microsoft.AppLink/AppLinks/delete",
|                                                         "Microsoft.AppLink/AppLinks/AppLinkMembers/read",
|                                                         "Microsoft.AppLink/AppLinks/AppLinkMembers/write",
|                                                         "Microsoft.AppLink/AppLinks/AppLinkMembers/delete",
|                                                         "Microsoft.AppLink/locations/operationStatuses/read",
|                                                         "Microsoft.AppLink/Locations/OperationStatuses/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "463ad26c-fcce-4469-9c7f-5653d8acbab5",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Reader for Member Clusters",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Kubernetes namespace objects without ability to view or modify roles or role bindings.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/members/apps/controllerrevisions/read",
|                                                             "Microsoft.ContainerService/fleets/members/apps/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/members/apps/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/members/apps/replicasets/read",
|                                                             "Microsoft.ContainerService/fleets/members/apps/statefulsets/read",
|                                                             "Microsoft.ContainerService/fleets/members/autoscaling/horizontalpodautoscalers/read",
|                                                             "Microsoft.ContainerService/fleets/members/batch/cronjobs/read",
|                                                             "Microsoft.ContainerService/fleets/members/batch/jobs/read",
|                                                             "Microsoft.ContainerService/fleets/members/configmaps/read",
|                                                             "Microsoft.ContainerService/fleets/members/discovery.k8s.io/endpointslices/read",
|                                                             "Microsoft.ContainerService/fleets/members/endpoints/read",
|                                                             "Microsoft.ContainerService/fleets/members/events.k8s.io/events/read",
|                                                             "Microsoft.ContainerService/fleets/members/events/read",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/daemonsets/read",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/deployments/read",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/members/extensions/replicasets/read",
|                                                             "Microsoft.ContainerService/fleets/members/limitranges/read",
|                                                             "Microsoft.ContainerService/fleets/members/metrics.k8s.io/pods/read",
|                                                             "Microsoft.ContainerService/fleets/members/metrics.k8s.io/nodes/read",
|                                                             "Microsoft.ContainerService/fleets/members/namespaces/read",
|                                                             "Microsoft.ContainerService/fleets/members/networking.k8s.io/ingresses/read",
|                                                             "Microsoft.ContainerService/fleets/members/networking.k8s.io/networkpolicies/read",
|                                                             "Microsoft.ContainerService/fleets/members/persistentvolumeclaims/read",
|                                                             "Microsoft.ContainerService/fleets/members/pods/read",
|                                                             "Microsoft.ContainerService/fleets/members/policy/poddisruptionbudgets/read",
|                                                             "Microsoft.ContainerService/fleets/members/replicationcontrollers/read",
|                                                             "Microsoft.ContainerService/fleets/members/resourcequotas/read",
|                                                             "Microsoft.ContainerService/fleets/members/serviceaccounts/read",
|                                                             "Microsoft.ContainerService/fleets/members/services/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d1f699ed-700a-4c77-a22f-29890ac7b115",
|                                         "Name":  "Azure Kubernetes Fleet Manager RBAC Admin for Member Clusters",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Admin access to most namespace objects but no permissions to modify roles or role bindings.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/members/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5eaf7b81-a48f-45ed-b6b4-c64bfe86d523",
|                                         "Name":  "Relationship Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to relationship types without identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Relationships/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b54df9c1-53dc-45cc-a86d-7a83cced2ed0",
|                                         "Name":  "Relationship Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read, write, and delete access to relationship types but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Relationships/*/read",
|                                                         "Microsoft.Relationships/*/write",
|                                                         "Microsoft.Relationships/*/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "05b1aaf9-00c9-477b-b0e8-2da660b78c51",
|                                         "Name":  "Service Group Member Relationship Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows read/write/delete of service group member relationships but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Relationships/serviceGroupMember/read",
|                                                         "Microsoft.Relationships/serviceGroupMember/write",
|                                                         "Microsoft.Relationships/serviceGroupMember/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "eb64ab4c-23eb-4f63-a9c2-27da365f04e7",
|                                         "Name":  "SRE Agent Author",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows read access to authorization and alert rules and adding features to SRE Agent but no direct identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.App/agents/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.App/agents/threads/read",
|                                                             "Microsoft.App/agents/incidentManagement/read",
|                                                             "Microsoft.App/agents/incidentManagement/write",
|                                                             "Microsoft.App/agents/incidentManagement/delete",
|                                                             "Microsoft.App/agents/extendedAgents/read",
|                                                             "Microsoft.App/agents/extendedAgents/write",
|                                                             "Microsoft.App/agents/extendedAgents/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5052f0f9-7e27-4570-bc13-9ee1cf442526",
|                                         "Name":  "Microsoft Confluent Contributor role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Confluent organizations and resources but lacks permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.Confluent/agreements/write",
|                                                         "Microsoft.Confluent/locations/OperationStatuses/write",
|                                                         "Microsoft.Confluent/organizations/access/createInvitation/action",
|                                                         "Microsoft.Confluent/organizations/access/deleteRoleBinding/delete",
|                                                         "Microsoft.Confluent/organizations/access/listClusters/action",
|                                                         "Microsoft.Confluent/organizations/access/listEnvironments/action",
|                                                         "Microsoft.Confluent/organizations/access/listInvitations/action",
|                                                         "Microsoft.Confluent/organizations/access/listRoleBindings/action",
|                                                         "Microsoft.Confluent/organizations/access/listServiceAccounts/action",
|                                                         "Microsoft.Confluent/organizations/access/listUsers/action",
|                                                         "Microsoft.Confluent/organizations/apiKeys/delete",
|                                                         "Microsoft.Confluent/organizations/delete",
|                                                         "Microsoft.Confluent/organizations/environments/clusters/connectors/delete",
|                                                         "Microsoft.Confluent/organizations/environments/clusters/connectors/write",
|                                                         "Microsoft.Confluent/organizations/environments/clusters/createAPIKey/action",
|                                                         "Microsoft.Confluent/organizations/environments/clusters/delete",
|                                                         "Microsoft.Confluent/organizations/environments/clusters/topics/delete",
|                                                         "Microsoft.Confluent/organizations/environments/clusters/topics/write",
|                                                         "Microsoft.Confluent/organizations/environments/clusters/write",
|                                                         "Microsoft.Confluent/organizations/environments/delete",
|                                                         "Microsoft.Confluent/organizations/environments/write",
|                                                         "Microsoft.Confluent/organizations/listRegions/action",
|                                                         "Microsoft.Confluent/organizations/write",
|                                                         "Microsoft.Confluent/validations/orgvalidate/action",
|                                                         "Microsoft.Confluent/validations/orgvalidateV2/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "2e481b5d-5af3-463b-8b01-f9c948aaf0c5",
|                                         "Name":  "Informatica DataManagement Contributor role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Informatica DataManagement organizations and resources without access to identity plane or role assignments.",
|                                         "Actions":  [
|                                                         "Informatica.DataManagement/locations/operationStatuses/write",
|                                                         "Informatica.DataManagement/organizations/delete",
|                                                         "Informatica.DataManagement/organizations/getServerlessMetadata/action",
|                                                         "Informatica.DataManagement/organizations/serverlessRuntimes/delete",
|                                                         "Informatica.DataManagement/organizations/serverlessRuntimes/write",
|                                                         "Informatica.DataManagement/organizations/singleSignOnConfigurations/delete",
|                                                         "Informatica.DataManagement/organizations/singleSignOnConfigurations/write",
|                                                         "Informatica.DataManagement/organizations/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "512ef07a-840c-48d2-9be4-9a30a75a5c70",
|                                         "Name":  "Defender Cloud Secrets Posture",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read access to keys and connection strings for Defender posture but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DocumentDB/databaseAccounts/listKeys/action",
|                                                         "Microsoft.documentdb/mongoClusters/read",
|                                                         "Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action",
|                                                         "Microsoft.CognitiveServices/accounts/listKeys/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "344b740c-5e7c-4d32-89b2-ee3b51cb89bc",
|                                         "Name":  "Azure Resilience Management Drills Assets Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No role assignment write permission; manages automation accounts and chaos experiments but no identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Automation/automationAccounts/delete",
|                                                         "Microsoft.Automation/automationAccounts/read",
|                                                         "Microsoft.Automation/automationAccounts/write",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/delete",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                         "Microsoft.Automation/automationAccounts/runbooks/write",
|                                                         "Microsoft.Chaos/experiments/delete",
|                                                         "Microsoft.Chaos/experiments/read",
|                                                         "Microsoft.Chaos/experiments/write",
|                                                         "Microsoft.Chaos/workspaces/delete",
|                                                         "Microsoft.Chaos/workspaces/read",
|                                                         "Microsoft.Chaos/workspaces/write",
|                                                         "Microsoft.Chaos/workspaces/refreshRecommendations/action",
|                                                         "Microsoft.Chaos/workspaces/discoveredResources/read",
|                                                         "Microsoft.Chaos/workspaces/scenarios/delete",
|                                                         "Microsoft.Chaos/workspaces/scenarios/read",
|                                                         "Microsoft.Chaos/workspaces/scenarios/write",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/delete",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/read",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/write",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/cancel/action",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/execute/action",
|                                                         "Microsoft.Chaos/workspaces/scenarios/configurations/validate/action",
|                                                         "Microsoft.Chaos/workspaces/scenarios/runs/read",
|                                                         "Microsoft.Chaos/locations/operationResults/read",
|                                                         "Microsoft.Chaos/locations/operationStatuses/read",
|                                                         "Microsoft.Insights/dataCollectionEndpoints/read",
|                                                         "Microsoft.Insights/dataCollectionEndpoints/write",
|                                                         "Microsoft.Insights/dataCollectionRules/read",
|                                                         "Microsoft.Insights/dataCollectionRules/write",
|                                                         "Microsoft.OperationalInsights/workspaces/sharedKeys/action",
|                                                         "Microsoft.OperationalInsights/workspaces/tables/read",
|                                                         "Microsoft.OperationalInsights/workspaces/tables/write",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.OperationalInsights/workspaces/write",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "82c6a823-ae9c-4b90-b5c5-bff581c45896",
|                                         "Name":  "Azure Resilience Management Drills Target Resource Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No role assignment write permission; manages chaos targets but no direct identity or role assignment control.",
|                                         "Actions":  [
|                                                         "*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Chaos/locations/targetTypes/capabilityTypes/read",
|                                                         "Microsoft.Chaos/locations/targetTypes/read",
|                                                         "Microsoft.Chaos/targets/capabilities/delete",
|                                                         "Microsoft.Chaos/targets/capabilities/read",
|                                                         "Microsoft.Chaos/targets/capabilities/write",
|                                                         "Microsoft.Chaos/targets/delete",
|                                                         "Microsoft.Chaos/targets/read",
|                                                         "Microsoft.Chaos/targets/write",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/virtualNetworks/read ",
|                                                         "Microsoft.Sql/managedInstances/read",
|                                                         "Microsoft.Web/serverfarms/read",
|                                                         "Microsoft.Web/sites/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "dc0882cc-bc27-4d21-9ea2-f821aaa10fb1",
|                                         "Name":  "ARN Service Event Grid Subscriber Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows event subscription management but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.EventGrid/EventSubscriptions/write",
|                                                         "Microsoft.EventGrid/*/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a51d5f27-deba-47d1-9ccd-8589014b2e28",
|                                         "Name":  "Gcp Connector contributor role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages GCP connector resources without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.GcpConnector/bigQueryDatasets/delete",
|                                                         "Microsoft.GcpConnector/bigQueryDatasets/write",
|                                                         "Microsoft.GcpConnector/cloudFunctions/delete",
|                                                         "Microsoft.GcpConnector/cloudFunctions/write",
|                                                         "Microsoft.GcpConnector/computeInstances/delete",
|                                                         "Microsoft.GcpConnector/computeInstances/write",
|                                                         "Microsoft.GcpConnector/containerClusters/delete",
|                                                         "Microsoft.GcpConnector/containerClusters/write",
|                                                         "Microsoft.GcpConnector/Locations/OperationStatuses/write",
|                                                         "Microsoft.GcpConnector/sqlAdminInstances/delete",
|                                                         "Microsoft.GcpConnector/sqlAdminInstances/write",
|                                                         "Microsoft.GcpConnector/storageBuckets/delete",
|                                                         "Microsoft.GcpConnector/storageBuckets/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "46023a6a-0702-4cbf-956c-d8c3ac27bc2b",
|                                         "Name":  "Defender CSPM",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No actions defined; presumed read-only or limited permissions without identity plane control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/accounts/aiservices/agents/read",
|                                                             "Microsoft.CognitiveServices/accounts/aiservices/assets/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5d9bac3f-34b2-432f-bde5-78aa8e73ce6b",
|                                         "Name":  "Storage File Data SMB Take Ownership",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows file/directory ownership assumption but no identity or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/fileServices/takeOwnership/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "35c49d44-ccc1-4b18-8267-cfb3bacdd396",
|                                         "Name":  "Storage DataShare Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages storage data shares with read and write permissions but no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/listServiceSas/action",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/locations/DataManagementRPOperationStatuses/read",
|                                                         "Microsoft.Storage/locations/DataManagementRPOperationStatuses/write",
|                                                         "Microsoft.Storage/storageAccounts/dataShares/read",
|                                                         "Microsoft.Storage/storageAccounts/dataShares/delete",
|                                                         "Microsoft.Storage/storageAccounts/dataShares/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9d819e60-1b9f-4871-b492-4e6cdee0b50a",
|                                         "Name":  "Storage Connector Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages storage connectors with read and write permissions but no identity or role assignment control.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.Storage/storageAccounts/listServiceSas/action",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                         "Microsoft.Storage/locations/DataManagementRPOperationStatuses/read",
|                                                         "Microsoft.Storage/locations/DataManagementRPOperationStatuses/write",
|                                                         "Microsoft.Storage/storageAccounts/connectors/read",
|                                                         "Microsoft.Storage/storageAccounts/connectors/delete",
|                                                         "Microsoft.Storage/storageAccounts/connectors/write",
|                                                         "Microsoft.Storage/storageAccounts/connectors/testExistingConnection/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "14f26b53-9d80-4924-8141-f664426a48f6",
|                                         "Name":  "Cognitive Services Security Integration Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Cognitive Services safety providers but lacks identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "45265627-32f7-4da4-9ab0-b1cb0e9ec70b",
|                                         "Name":  "Playwright Workspace Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full control over Playwright Workspace resources but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Loadtestservice/playwrightworkspaces/*",
|                                                         "Microsoft.Loadtestservice/locations/playwrightquotas/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "19d36063-d00b-4ea5-a1ac-a7c4926a0b78",
|                                         "Name":  "Playwright Workspace Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Playwright Workspace resources with no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Loadtestservice/playwrightworkspaces/*/read",
|                                                         "Microsoft.Loadtestservice/locations/playwrightquotas/*/read",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "78cf819f-0969-4ebe-8759-015c6efcd5bf",
|                                         "Name":  "Playwright Workspace Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can manage tokens and execute tests but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Loadtestservice/playwrightworkspaces/*/read",
|                                                         "Microsoft.Loadtestservice/locations/playwrightquotas/*",
|                                                         "Microsoft.Loadtestservice/playwrightworkspaces/AccessTokens/*",
|                                                         "Microsoft.Loadtestservice/playwrightworkspaces/TestRuns/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6f91a4f9-10ee-4b95-b8cd-96ee73c5968d",
|                                         "Name":  "Defender API Security",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to API management diagnostics but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Security/pricings/read",
|                                                         "Microsoft.Security/apiCollections/read",
|                                                         "Microsoft.ApiManagement/service/read",
|                                                         "Microsoft.ApiManagement/service/apis/read",
|                                                         "Microsoft.ApiManagement/service/apis/operations/read",
|                                                         "Microsoft.ApiManagement/service/apiVersionSets/read",
|                                                         "Microsoft.ApiManagement/service/apis/diagnostics/read",
|                                                         "Microsoft.ApiManagement/service/apis/diagnostics/write",
|                                                         "Microsoft.ApiManagement/service/apis/diagnostics/delete",
|                                                         "Microsoft.ApiManagement/service/apis/policies/read",
|                                                         "Microsoft.ApiManagement/service/backends/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/apis/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/apis/operations/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/apiVersionSets/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/apis/diagnostics/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/apis/diagnostics/write",
|                                                         "Microsoft.ApiManagement/service/workspaces/apis/diagnostics/delete",
|                                                         "Microsoft.ApiManagement/service/workspaces/apis/policies/read",
|                                                         "Microsoft.ApiManagement/service/workspaces/backends/read",
|                                                         "Microsoft.ApiManagement/gateways/configConnections/read",
|                                                         "Microsoft.ApiManagement/service/workspaceLinks/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "7d0c0268-1199-449b-a52e-75c20879f46b",
|                                         "Name":  "Defender Settings Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can read and write Defender settings but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "microsoft.security/pricings/read",
|                                                         "microsoft.security/pricings/write",
|                                                         "microsoft.security/pricings/securityoperators/read",
|                                                         "microsoft.security/securityoperators/read",
|                                                         "microsoft.security/register/action",
|                                                         "microsoft.security/settings/read",
|                                                         "microsoft.security/settings/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d56b031f-8d90-4376-9231-b5c94fce88ef",
|                                         "Name":  "Defender Unified RBAC Scoped Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to security insights and logs without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.SecurityInsights/*/read",
|                                                         "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                         "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                         "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                         "Microsoft.OperationalInsights/workspaces/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/LinkedServices/read",
|                                                         "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/read",
|                                                         "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                         "Microsoft.OperationalInsights/querypacks/*/read",
|                                                         "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.Insights/workbooks/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/templateSpecs/*/read",
|                                                         "Microsoft.Authorization/*/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                            "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*",
|                                                            "Microsoft.SecurityInsights/alertRules/read"
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.OperationalInsights/workspaces/tables/data/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a954a0e0-f57f-4606-8421-fd7bd4e54b0f",
|                                         "Name":  "Azure Device Onboarding Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages device onboarding resources but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DeviceOnboarding/onboardingServices/read",
|                                                         "Microsoft.DeviceOnboarding/onboardingServices/write",
|                                                         "Microsoft.DeviceOnboarding/onboardingServices/delete",
|                                                         "Microsoft.DeviceOnboarding/onboardingServices/policies/read",
|                                                         "Microsoft.DeviceOnboarding/onboardingServices/policies/write",
|                                                         "Microsoft.DeviceOnboarding/onboardingServices/policies/delete",
|                                                         "Microsoft.DeviceOnboarding/deviceStates/read",
|                                                         "Microsoft.DeviceOnboarding/deviceStates/write",
|                                                         "Microsoft.DeviceOnboarding/deviceStates/delete",
|                                                         "Microsoft.DeviceOnboarding/deviceStates/prepareForOnboarding/action",
|                                                         "Microsoft.DeviceOnboarding/locations/operationStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "980cf6f7-edec-4fd1-8e9e-28f70b1d5258",
|                                         "Name":  "Compute Limit Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages compute limits and alert rules but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ComputeLimit/locations/guestSubscriptions/read",
|                                                         "Microsoft.ComputeLimit/locations/guestSubscriptions/write",
|                                                         "Microsoft.ComputeLimit/locations/guestSubscriptions/delete",
|                                                         "Microsoft.ComputeLimit/locations/sharedLimits/read",
|                                                         "Microsoft.ComputeLimit/locations/sharedLimits/write",
|                                                         "Microsoft.ComputeLimit/locations/sharedLimits/delete",
|                                                         "Microsoft.ComputeLimit/register/action",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "045b6ee5-0c68-42c4-9be0-7389794309f5",
|                                         "Name":  "MongoDB Atlas Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access to MongoDB Atlas control plane operations without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "MongoDB.Atlas/checkNameAvailability/action",
|                                                         "MongoDB.Atlas/register/action",
|                                                         "MongoDB.Atlas/unregister/action",
|                                                         "MongoDB.Atlas/operations/read",
|                                                         "MongoDB.Atlas/locations/operationStatuses/read",
|                                                         "MongoDB.Atlas/locations/operationStatuses/write",
|                                                         "MongoDB.Atlas/registeredSubscriptions/read",
|                                                         "MongoDB.Atlas/organizations/read",
|                                                         "MongoDB.Atlas/organizations/write",
|                                                         "MongoDB.Atlas/organizations/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ee99642a-225b-4fe8-a771-9d9036053e87",
|                                         "Name":  "Arc Container Storage Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Arc Container Storage resources but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ArcContainerStorage/edgeStorageConfigurations/read",
|                                                         "Microsoft.ArcContainerStorage/edgeStorageConfigurations/write",
|                                                         "Microsoft.ArcContainerStorage/edgeStorageConfigurations/delete",
|                                                         "Microsoft.ArcContainerStorage/edgeVolumes/read",
|                                                         "Microsoft.ArcContainerStorage/edgeVolumes/write",
|                                                         "Microsoft.ArcContainerStorage/edgeVolumes/delete",
|                                                         "Microsoft.ArcContainerStorage/edgeVolumes/ingestSubvolumes/read",
|                                                         "Microsoft.ArcContainerStorage/edgeVolumes/ingestSubvolumes/write",
|                                                         "Microsoft.ArcContainerStorage/edgeVolumes/ingestSubvolumes/delete",
|                                                         "Microsoft.ArcContainerStorage/locations/operationStatuses/read",
|                                                         "Microsoft.ArcContainerStorage/locations/operationStatuses/write"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.ArcContainerStorage/register/action",
|                                                            "Microsoft.ArcContainerStorage/unregister/action"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c883944f-8b7b-4483-af10-35834be79c4a",
|                                         "Name":  "Azure AI Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of AI projects and accounts but no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AlertsManagement/actionRules/*",
|                                                         "Microsoft.AlertsManagement/alerts/*",
|                                                         "Microsoft.AlertsManagement/issues/*",
|                                                         "Microsoft.AlertsManagement/prometheusRuleGroups/*",
|                                                         "Microsoft.AlertsManagement/smartDetectorAlertRules/*",
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.CognitiveServices/*",
|                                                         "Microsoft.Insights/activityLogAlerts/*",
|                                                         "Microsoft.Insights/metricalerts/*",
|                                                         "Microsoft.Insights/scheduledqueryrules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/deployments/operations/read",
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Support/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.CognitiveServices/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "42f3c60f-e7b1-46d7-ba56-6de681664342",
|                                         "Name":  "Azure Red Hat OpenShift First Party Network",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Grants network permissions for ARO service principals but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/routeTables/join/action",
|                                                         "Microsoft.Network/routeTables/read",
|                                                         "Microsoft.Network/natGateways/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/join/action",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                         "Microsoft.Network/networkIntentPolicies/join/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8da79822-b118-42bc-83c9-789fdbdcd77b",
|                                         "Name":  "Elastic SAN Volume Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to Elastic SAN volumes but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.ElasticSan/elasticsans/volumeGroups/volumes/write",
|                                                         "Microsoft.ElasticSan/elasticsans/volumeGroups/volumes/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ElasticSan/elasticsans/volumeGroups/volumes/data/read",
|                                                             "Microsoft.ElasticSan/elasticsans/volumeGroups/volumes/data/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "92318126-08be-45d0-a1b2-532e6c7d52ce",
|                                         "Name":  "Microsoft Approvals Workflow Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages approval workflows but no permissions to assign roles or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Approvals/approvalSettings/read",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/read",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/write",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/delete",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/read",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/write",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/syncPolicyStatus/action",
|                                                         "Microsoft.Approvals/approvalWorkflowAssignments/read",
|                                                         "Microsoft.Approvals/approvalWorkflowAssignments/write",
|                                                         "Microsoft.Approvals/approvalWorkflowAssignments/delete",
|                                                         "Microsoft.Approvals/invokeAndFetchApprovalRequest/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "98d40527-c073-4096-943a-dd593105ca9c",
|                                         "Name":  "Microsoft Approvals Service Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Approvals service-level operations without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Approvals/approvalSettings/read",
|                                                         "Microsoft.Approvals/approvalSettings/write",
|                                                         "Microsoft.Approvals/approvalSettings/delete",
|                                                         "Microsoft.Approvals/approvalSettings/initialize/action",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/read",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/read",
|                                                         "Microsoft.Approvals/approvalWorkflowAssignments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0343f3e8-01ac-4bb8-8f93-78b1d31ba64b",
|                                         "Name":  "Microsoft Approvals Request User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Can request approval workflows but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Approvals/invokeAndFetchApprovalRequest/action",
|                                                         "Microsoft.Approvals/approvalSettings/read",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/read",
|                                                         "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/read",
|                                                         "Microsoft.Approvals/approvalWorkflowAssignments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a6a9a135-9048-45df-b559-a90bb025e92f",
|                                         "Name":  "Astronomer Astro Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Access to Astronomer Astro control plane operations without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Astronomer.Astro/register/action",
|                                                         "Astronomer.Astro/unregister/action",
|                                                         "Astronomer.Astro/operations/read",
|                                                         "Astronomer.Astro/organizations/read",
|                                                         "Astronomer.Astro/organizations/write",
|                                                         "Astronomer.Astro/organizations/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0e2ecf2a-0574-4b08-89e2-be133aa6303f",
|                                         "Name":  "Defender Databricks Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permissions for Defender on Databricks but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Databricks/workspaces/read",
|                                                         "Microsoft.Databricks/workspaces/assignWorkspaceAdmin/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4b2b8358-764b-4884-85c6-f4b7946d95ad",
|                                         "Name":  "EdgeMarketPlace role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages EdgeMarketplace operation statuses but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.EdgeMarketplace/locations/operationStatuses/write",
|                                                         "Microsoft.EdgeMarketplace/locations/operationStatuses/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "9a0e5da3-6c70-4a35-b13a-715cd5a7919a",
|                                         "Name":  "Azure Stack Hub registration role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages Azure Stack registrations without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStack/registrations/customerSubscriptions/delete",
|                                                         "Microsoft.AzureStack/registrations/customerSubscriptions/write",
|                                                         "Microsoft.AzureStack/registrations/delete",
|                                                         "Microsoft.AzureStack/registrations/enableRemoteManagement/action",
|                                                         "Microsoft.AzureStack/registrations/getActivationKey/action",
|                                                         "Microsoft.AzureStack/registrations/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "17e4de9d-139f-4531-b521-20804c310cf8",
|                                         "Name":  "Azure Stack Hub Linked Subscriptions role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages linked subscriptions in Azure Stack without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStack/linkedSubscriptions/delete",
|                                                         "Microsoft.AzureStack/linkedSubscriptions/linkedProviders/action",
|                                                         "Microsoft.AzureStack/linkedSubscriptions/linkedResourceGroups/action",
|                                                         "Microsoft.AzureStack/linkedSubscriptions/operations/action",
|                                                         "Microsoft.AzureStack/linkedSubscriptions/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d2acaa63-2a62-4c01-998a-cdbe7a00d709",
|                                         "Name":  "Defender Azure Cosmos DB",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write advanced threat protection settings but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DocumentDB/databaseAccounts/read",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "99626c15-0799-47ad-96ab-f298031f69d6",
|                                         "Name":  "Defender Open Source Relational Databases",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write advanced threat protection settings for databases but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.DBforMySQL/flexibleServers/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.DBforMySQL/flexibleServers/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.DBforMySQL/flexibleServers/read",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/read",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.DBforPostgreSQL/flexibleServers/advancedThreatProtectionSettings/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d9468a2b-1820-47e1-a40e-d2b7fba1879a",
|                                         "Name":  "Defender SQL Servers On Machines",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage VM extensions and read VM info but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/write",
|                                                         "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "a366d631-94bf-46bf-b4af-b38f28c80774",
|                                         "Name":  "Defender for Storage Threat Protection",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Defender for Storage settings but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Security/defenderForStorageSettings/read",
|                                                         "Microsoft.Security/defenderForStorageSettings/write",
|                                                         "Microsoft.Storage/storageAccounts/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "e1663658-d5f7-4383-9afb-af9fdc9c5eae",
|                                         "Name":  "Azure Kubernetes Fleet Manager ABAC Custom Resources Reader for Member Clusters",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Kubernetes custom resources without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/members/customresources/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "673366d4-9664-4020-b03b-b0093366bff9",
|                                         "Name":  "Azure Kubernetes Fleet Manager ABAC Custom Resources Writer for Member Clusters",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Write access to Kubernetes custom resources but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/members/customresources/write",
|                                                             "Microsoft.ContainerService/fleets/members/customresources/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f82fbe13-0f98-4809-af81-b82c343db82f",
|                                         "Name":  "Device Update Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Device Update accounts and instances but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.DeviceUpdate/accounts/read",
|                                                         "Microsoft.DeviceUpdate/accounts/write",
|                                                         "Microsoft.DeviceUpdate/accounts/delete",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/read",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/write",
|                                                         "Microsoft.DeviceUpdate/accounts/instances/delete",
|                                                         "Microsoft.DeviceUpdate/accounts/privateEndpointConnections/read",
|                                                         "Microsoft.DeviceUpdate/accounts/privateEndpointConnections/write",
|                                                         "Microsoft.DeviceUpdate/accounts/privateEndpointConnections/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "20cf746c-c765-402a-885e-c389c64478ce",
|                                         "Name":  "Azure Kubernetes Fleet Manager ABAC Custom Resources Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Kubernetes custom resources on fleets without identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/fleets/read",
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/customresources/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ff8eb232-5069-437e-94e5-31112ef30539",
|                                         "Name":  "Azure Kubernetes Fleet Manager ABAC Custom Resources Writer",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Write access to Kubernetes custom resources on fleets but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Resources/subscriptions/operationresults/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.ContainerService/fleets/read",
|                                                         "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ContainerService/fleets/customresources/write",
|                                                             "Microsoft.ContainerService/fleets/customresources/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "78b19ac9-582c-44d8-9e11-733ae424ad83",
|                                         "Name":  "Defender Servers P1",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write VM extensions and machine info but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "ef3729d8-2861-401e-95ae-c7d4845a6097",
|                                         "Name":  "Genome Admin",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Genome control plane operations only; no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Genome/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "1dc24dd8-b00e-4344-837c-58b193cd23c7",
|                                         "Name":  "Defender Servers P2",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write network and VM info but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/virtualMachines/read",
|                                                         "Microsoft.Network/loadBalancers/read",
|                                                         "Microsoft.Network/networkSecurityGroups/read",
|                                                         "Microsoft.Network/networkSecurityGroups/write",
|                                                         "Microsoft.Network/azureFirewalls/read",
|                                                         "Microsoft.Network/azureFirewalls/write",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/networkInterfaces/read",
|                                                         "Microsoft.Network/publicIPAddresses/read",
|                                                         "Microsoft.Network/routeTables/read",
|                                                         "Microsoft.HybridCompute/machines/read",
|                                                         "Microsoft.OperationalInsights/workspaces/read",
|                                                         "Microsoft.OperationsManagement/solutions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/write",
|                                                         "Microsoft.HybridCompute/machines/extensions/delete",
|                                                         "Microsoft.HybridCompute/machines/extensions/read",
|                                                         "Microsoft.Compute/virtualMachines/extensions/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "585db2ed-219e-4821-a06a-c6c14b602afa",
|                                         "Name":  "Healthcare Interop Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manages healthcare interop provider resources but no identity or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.HealthcareInterop/ddmsConnectors/delete",
|                                                         "Microsoft.HealthcareInterop/ddmsConnectors/write",
|                                                         "Microsoft.HealthcareInterop/ddmsFhirEventBatchChannels/delete",
|                                                         "Microsoft.HealthcareInterop/ddmsFhirEventBatchChannels/write",
|                                                         "Microsoft.HealthcareInterop/ddmsFhirFlatFileBatchChannels/delete",
|                                                         "Microsoft.HealthcareInterop/ddmsFhirFlatFileBatchChannels/write",
|                                                         "Microsoft.HealthcareInterop/dicomConnectors/delete",
|                                                         "Microsoft.HealthcareInterop/dicomConnectors/write",
|                                                         "Microsoft.HealthcareInterop/dicomDirectChannels/delete",
|                                                         "Microsoft.HealthcareInterop/dicomDirectChannels/write",
|                                                         "Microsoft.HealthcareInterop/dicomEdgeConnectors/delete",
|                                                         "Microsoft.HealthcareInterop/dicomEdgeConnectors/write",
|                                                         "Microsoft.HealthcareInterop/fhirQueryEventBatchChannels/delete",
|                                                         "Microsoft.HealthcareInterop/fhirQueryEventBatchChannels/write",
|                                                         "Microsoft.HealthcareInterop/fhirQueryFlatFileBatchChannels/delete",
|                                                         "Microsoft.HealthcareInterop/fhirQueryFlatFileBatchChannels/write",
|                                                         "Microsoft.HealthcareInterop/hl7Connectors/delete",
|                                                         "Microsoft.HealthcareInterop/hl7Connectors/write",
|                                                         "Microsoft.HealthcareInterop/hl7EdgeConnectors/delete",
|                                                         "Microsoft.HealthcareInterop/hl7EdgeConnectors/write",
|                                                         "Microsoft.HealthcareInterop/hubs/delete",
|                                                         "Microsoft.HealthcareInterop/hubs/write",
|                                                         "Microsoft.HealthcareInterop/locations/operationStatuses/write",
|                                                         "Microsoft.HealthcareInterop/oneLakeConnectors/delete",
|                                                         "Microsoft.HealthcareInterop/oneLakeConnectors/write",
|                                                         "Microsoft.HealthcareInterop/storageAccountConnectors/delete",
|                                                         "Microsoft.HealthcareInterop/storageAccountConnectors/write",
|                                                         "Microsoft.HealthcareInterop/locations/operationStatuses/read",
|                                                         "Microsoft.HealthcareInterop/operations/read",
|                                                         "Microsoft.HealthcareInterop/hl7Connectors/read",
|                                                         "Microsoft.HealthcareInterop/oneLakeConnectors/read",
|                                                         "Microsoft.HealthcareInterop/storageAccountConnectors/read",
|                                                         "Microsoft.HealthcareInterop/fhirQueryFlatFileBatchChannels/read",
|                                                         "Microsoft.HealthcareInterop/fhirQueryEventBatchChannels/read",
|                                                         "Microsoft.HealthcareInterop/hl7EdgeConnectors/read",
|                                                         "Microsoft.HealthcareInterop/hubs/read",
|                                                         "Microsoft.HealthcareInterop/dicomEdgeConnectors/read",
|                                                         "Microsoft.HealthcareInterop/dicomConnectors/read",
|                                                         "Microsoft.HealthcareInterop/dicomDirectChannels/read",
|                                                         "Microsoft.HealthcareInterop/ddmsFhirEventBatchChannels/read",
|                                                         "Microsoft.HealthcareInterop/ddmsConnectors/read",
|                                                         "Microsoft.HealthcareInterop/ddmsFhirFlatFileBatchChannels/read",
|                                                         "Microsoft.HealthcareInterop/register/action",
|                                                         "Microsoft.HealthcareInterop/unregister/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "fc896ebc-f9a8-484d-a5ff-bd6a8c36289f",
|                                         "Name":  "Cosmos DB Long Term Retention Backup Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows backup operations on Cosmos DB but does not provide identity plane control or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.DocumentDB/databaseAccounts/validateForLongTermProtection/action",
|                                                         "Microsoft.DocumentDB/databaseAccounts/enableLongTermProtection/action",
|                                                         "Microsoft.DocumentDB/databaseAccounts/disableLongTermProtection/action",
|                                                         "Microsoft.DocumentDB/databaseAccounts/preBackup/action",
|                                                         "Microsoft.DocumentDB/databaseAccounts/backup/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "955d0cb2-de4e-43ed-819a-14220e079ba7",
|                                         "Name":  "Cosmos DB Long Term Retention Restore Role",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Allows restore operations on Cosmos DB but no permissions to modify identity or role assignments.",
|                                         "Actions":  [
|                                                         "Microsoft.DocumentDB/databaseAccounts/preRestore/action",
|                                                         "Microsoft.DocumentDB/databaseAccounts/restore/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "78739afa-3ece-4d6b-90ba-762fdccd7438",
|                                         "Name":  "Azure Edge On-Site Deployment Manager",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to edge device provisioning data; no path to identity plane or tenant takeover.",
|                                         "Actions":  [
|                                                         "Microsoft.AzureStackHCI/EdgeMachines/Read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "6fe711ec-654d-4ef7-8e32-eb7de3d94774",
|                                         "Name":  "Defender AI",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write permissions limited to Defender for AI settings; no identity plane or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.CognitiveServices/accounts/read",
|                                                         "Microsoft.CognitiveServices/accounts/defenderForAISettings/read",
|                                                         "Microsoft.CognitiveServices/accounts/defenderForAISettings/write",
|                                                         "Microsoft.CognitiveServices/accounts/defenderForAISettings/delete",
|                                                         "Microsoft.CognitiveServices/raiPolicy/read",
|                                                         "Microsoft.CognitiveServices/raiPolicy/write",
|                                                         "Microsoft.Search/searchServices/knowledgeBases/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "12675fd7-7f59-493f-9201-f7944860a2f1",
|                                         "Name":  "Azure Device Registry Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full control over device registry but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.DeviceRegistry/*"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "cd50fd1f-0421-46f2-8cce-afc587dbcc77",
|                                         "Name":  "Defender Storage Malware Data Scanner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Data plane read permissions for storage scanning; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write",
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                             "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action",
|                                                             "Microsoft.EventGrid/events/send/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "d622af9a-030e-4f32-8267-419abfd54702",
|                                         "Name":  "Pro Active Coding Data User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "No permissions granted; limited to data processing with no identity or role control.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.HealthBot/healthBots/AIActions/ProActiveCoding/Process/Action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "eef9d654-743f-4e2c-ad0f-9ed243177663",
|                                         "Name":  "Defender Azure SQL Databases",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write permissions on security alert policies but no direct identity plane control.",
|                                         "Actions":  [
|                                                         "Microsoft.Sql/managedInstances/read",
|                                                         "Microsoft.Sql/managedInstances/securityAlertPolicies/read",
|                                                         "Microsoft.Sql/managedInstances/securityAlertPolicies/write",
|                                                         "Microsoft.Sql/servers/read",
|                                                         "Microsoft.Sql/servers/securityAlertPolicies/read",
|                                                         "Microsoft.Sql/servers/securityAlertPolicies/write",
|                                                         "Microsoft.Sql/servers/sqlVulnerabilityAssessments/read",
|                                                         "Microsoft.Sql/servers/sqlVulnerabilityAssessments/write",
|                                                         "Microsoft.Synapse/workspaces/read",
|                                                         "Microsoft.Synapse/workspaces/securityAlertPolicies/read",
|                                                         "Microsoft.Synapse/workspaces/securityAlertPolicies/write",
|                                                         "Microsoft.Sql/servers/vulnerabilityAssessments/read",
|                                                         "Microsoft.Synapse/workspaces/vulnerabilityAssessments/read",
|                                                         "Microsoft.Sql/managedInstances/vulnerabilityAssessments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "971cce9f-2680-4357-9678-c947847a9425",
|                                         "Name":  "Defender Storage Malware Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permissions for Defender storage malware scanning and management; no role assignment or credential reset rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Security/defenderforstoragesettings/read",
|                                                         "Microsoft.Security/defenderforstoragesettings/write",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                         "Microsoft.Security/advancedThreatProtectionSettings/write",
|                                                         "Microsoft.Security/securityOperators/read",
|                                                         "Microsoft.Storage/storageAccounts/write",
|                                                         "Microsoft.Storage/storageAccounts/read",
|                                                         "Microsoft.EventGrid/topics/read",
|                                                         "Microsoft.EventGrid/register/action",
|                                                         "Microsoft.EventGrid/eventSubscriptions/read",
|                                                         "Microsoft.EventGrid/eventSubscriptions/write",
|                                                         "Microsoft.EventGrid/eventSubscriptions/delete",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                         "Microsoft.Storage/storageAccounts/fileServices/shares/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c6c9b2d8-9a5e-4122-85e1-81612a046ab2",
|                                         "Name":  "Defender Storage Automated Malware Remediation",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permissions limited to blob service remediation actions; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                         "Microsoft.Storage/storageAccounts/blobServices/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4f1e6fca-3fde-4291-961e-642def6d5e1d",
|                                         "Name":  "Confidential Ledger Data Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to ledger transactions; no ability to modify identity or roles.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ConfidentialLedger/ledgers/transactions/read"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f1641a58-a144-402b-baf9-39d1a4c10119",
|                                         "Name":  "Confidential Ledger Data Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read and write access to ledger data but no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.ConfidentialLedger/ledgers/transactions/read",
|                                                             "Microsoft.ConfidentialLedger/ledgers/transactions/write"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "8ec773c5-7ce6-4b78-91d1-182f8faa536d",
|                                         "Name":  "Microsoft Discovery Bookshelf Index Data Reader - Preview",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Query access to knowledge bases only; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Discovery/bookshelf/knowledgeBaseVersions/query/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "63342533-d951-495d-a3c3-a459aa02362b",
|                                         "Name":  "Oracle Database DbSystems Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full management of DbSystems resources but no permissions to modify Azure AD roles or credentials.",
|                                         "Actions":  [
|                                                         "Oracle.Database/dbSystems/*/read",
|                                                         "Oracle.Database/dbSystems/*/write",
|                                                         "Oracle.Database/dbSystems/*/delete",
|                                                         "Oracle.Database/Locations/*/read",
|                                                         "Oracle.Database/Locations/*/write",
|                                                         "Oracle.Database/Operations/read",
|                                                         "Oracle.Database/oracleSubscriptions/*/read",
|                                                         "Oracle.Database/resourceAnchors/*",
|                                                         "Oracle.Database/networkAnchors/*",
|                                                         "Microsoft.Network/virtualNetworks/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/read",
|                                                         "Microsoft.Network/virtualNetworks/subnets/write",
|                                                         "Microsoft.Network/locations/operations/read",
|                                                         "Microsoft.Compute/sshPublicKeys/read",
|                                                         "Microsoft.Compute/sshPublicKeys/write",
|                                                         "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "f287ba2f-f923-4464-a5bd-721c3951d32d",
|                                         "Name":  "Azure Managed Redis Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to Redis resources; no ability to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Cache/locations/operationsStatus/read",
|                                                         "Microsoft.Cache/operations/read",
|                                                         "Microsoft.Cache/redisEnterprise/read",
|                                                         "Microsoft.Cache/redisEnterprise/*/read",
|                                                         "Microsoft.Insights/alertRules/read",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "3015e5ed-6856-4ab3-b2f0-b8492aa30ca6",
|                                         "Name":  "Azure Managed Redis Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage Redis resources but no permissions to access data or modify identity plane.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Cache/locations/operationsStatus/read",
|                                                         "Microsoft.Cache/locations/checknameavailability/action",
|                                                         "Microsoft.Cache/operations/read",
|                                                         "Microsoft.Cache/redisEnterprise/*",
|                                                         "Microsoft.Insights/alertRules/*",
|                                                         "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "c24cf47c-5077-412d-a19c-45202126392c",
|                                         "Name":  "Dev Compute SandboxGroup Data Owner",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Ownership of sandbox data only; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.App/sandboxGroups/*/read",
|                                                             "Microsoft.App/sandboxGroups/*/write",
|                                                             "Microsoft.App/sandboxGroups/*/delete",
|                                                             "Microsoft.App/sandboxGroups/*/action"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "4417a88f-3e58-4cf2-a4e9-112cf414254c",
|                                         "Name":  "Services Hub User",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read/write/delete operations on Services Hub connectors but no identity or role assignment rights.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                         "Microsoft.Resources/subscriptions/read",
|                                                         "Microsoft.Resources/deployments/*",
|                                                         "Microsoft.ServicesHub/connectors/read",
|                                                         "Microsoft.ServicesHub/connectors/*",
|                                                         "Microsoft.ServicesHub/*",
|                                                         "Microsoft.ServicesHub/workspaces/read"
|                                                     ],
|                                         "NotActions":  [
|                                                            "Microsoft.ServicesHub/connectors/write",
|                                                            "Microsoft.ServicesHub/connectors/delete"
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "0e91b552-ae32-49ea-9898-317af306aa4b",
|                                         "Name":  "Genome EndUser",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Full access to Genome data plane only; no permissions affecting identity or roles.",
|                                         "Actions":  [
|
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|                                                             "Microsoft.Genome/*"
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "64375caa-ac3e-48b3-9492-da4d60aba7bb",
|                                         "Name":  "Diagnostics Operator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Permissions to collect VM diagnostic info; no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Compute/virtualMachines/DiagnosticRunCommands/write",
|                                                         "Microsoft.Compute/virtualMachines/DiagnosticRunCommands/read",
|                                                         "Microsoft.Compute/virtualMachines/DiagnosticRunCommands/delete"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b66c1f7c-c685-40d6-b8b8-64b8230febf4",
|                                         "Name":  "Azure Resilience Management Usage Administrator",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Manage usage plans and enrollments; no permissions to assign roles or reset credentials.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "b130f7de-5374-4e3d-ada8-bae6e49114b9",
|                                         "Name":  "Azure Resilience Management Usage Reader",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Read-only access to usage plans; no identity plane or role assignment permissions.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     },
|                                     {
|                                         "Id":  "5ca51376-e049-4302-abcc-64c588049c59",
|                                         "Name":  "Azure Resilience Management Usage Contributor",
|                                         "IsCustom":  false,
|                                         "Tier":  3,
|                                         "Reason":  "Contributor rights on usage plans but no identity plane or role assignment capabilities.",
|                                         "Actions":  [
|                                                         "Microsoft.Authorization/*/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                         "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                     ],
|                                         "NotActions":  [
|
|                                                        ],
|                                         "DataActions":  [
|
|                                                         ]
|                                     }
|                                 ],
|    "Azure_CustomRoles_Tier0":  [
|
|                                ],
|    "Azure_CustomRoles_Tier1":  [
|
|                                ],
|    "Azure_CustomRoles_Tier2":  [
|
|                                ],
|    "Azure_CustomRoles_Tier3":  [
|
|                                ],
|    "Azure_Roles_Catalog":  [
|                                {
|                                    "Id":  "8311e382-0749-4cb8-b61a-304f252e45ec",
|                                    "Name":  "AcrPush",
|                                    "Description":  "acr push",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/pull/read",
|                                                    "Microsoft.ContainerRegistry/registries/push/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "312a565d-c81f-4fd8-895a-4e21e48d571c",
|                                    "Name":  "API Management Service Contributor",
|                                    "Description":  "Can manage service and the APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7f951dda-4ed3-4680-a7ca-43fe172d538d",
|                                    "Name":  "AcrPull",
|                                    "Description":  "acr pull",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/pull/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6cef56e8-d556-48e5-a04f-b8e64114680f",
|                                    "Name":  "AcrImageSigner",
|                                    "Description":  "Planned DEPRECATION on March 31, 2028. Grant the signing permission for content trust. As content trust is being deprecated and will be completely removed on March 31, 2028, this role will also be removed. Refer to https://aka.ms/acr/dctdeprecation for details and transition guidance.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/sign/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/trustedCollections/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c2f4ef07-c644-48eb-af81-4b1b4947fb11",
|                                    "Name":  "AcrDelete",
|                                    "Description":  "acr delete",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/artifacts/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cdda3590-29a3-44f6-95f2-9f980659eb04",
|                                    "Name":  "AcrQuarantineReader",
|                                    "Description":  "acr quarantine data reader",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/quarantine/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c8d4ff99-41c3-41a8-9f60-21dfdad59608",
|                                    "Name":  "AcrQuarantineWriter",
|                                    "Description":  "acr quarantine data writer",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/quarantine/read",
|                                                    "Microsoft.ContainerRegistry/registries/quarantine/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read",
|                                                        "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e022efe7-f5ba-4159-bbe4-b44f577e9b61",
|                                    "Name":  "API Management Service Operator Role",
|                                    "Description":  "Can manage service but not the APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/*/read",
|                                                    "Microsoft.ApiManagement/service/backup/action",
|                                                    "Microsoft.ApiManagement/service/delete",
|                                                    "Microsoft.ApiManagement/service/managedeployments/action",
|                                                    "Microsoft.ApiManagement/service/read",
|                                                    "Microsoft.ApiManagement/service/restore/action",
|                                                    "Microsoft.ApiManagement/service/updatecertificate/action",
|                                                    "Microsoft.ApiManagement/service/updatehostname/action",
|                                                    "Microsoft.ApiManagement/service/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.ApiManagement/service/users/keys/read"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "71522526-b88f-4d52-b57f-d31fc3546d0d",
|                                    "Name":  "API Management Service Reader Role",
|                                    "Description":  "Read-only access to service and APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/*/read",
|                                                    "Microsoft.ApiManagement/service/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.ApiManagement/service/users/keys/read"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ae349356-3a1b-4a5e-921d-050484c6347e",
|                                    "Name":  "Application Insights Component Contributor",
|                                    "Description":  "Can manage Application Insights components",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/generateLiveToken/read",
|                                                    "Microsoft.Insights/metricAlerts/*",
|                                                    "Microsoft.Insights/components/*",
|                                                    "Microsoft.Insights/scheduledqueryrules/*",
|                                                    "Microsoft.Insights/topology/read",
|                                                    "Microsoft.Insights/transactions/read",
|                                                    "Microsoft.Insights/webtests/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "08954f03-6346-4c2e-81c0-ec3a5cfae23b",
|                                    "Name":  "Application Insights Snapshot Debugger",
|                                    "Description":  "Gives user permission to use Application Insights Snapshot Debugger features",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/components/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/snapshots/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fd1bd22b-8476-40bc-a0bc-69b95687b9f3",
|                                    "Name":  "Attestation Reader",
|                                    "Description":  "Can read the attestation provider properties",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Attestation/attestationProviders/attestation/read",
|                                                    "Microsoft.Attestation/attestationProviders/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4fe576fe-1146-4730-92eb-48519fa6bf9f",
|                                    "Name":  "Automation Job Operator",
|                                    "Description":  "Create and Manage Jobs using Automation Runbooks.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/read",
|                                                    "Microsoft.Automation/automationAccounts/jobs/read",
|                                                    "Microsoft.Automation/automationAccounts/jobs/resume/action",
|                                                    "Microsoft.Automation/automationAccounts/jobs/stop/action",
|                                                    "Microsoft.Automation/automationAccounts/jobs/streams/read",
|                                                    "Microsoft.Automation/automationAccounts/jobs/suspend/action",
|                                                    "Microsoft.Automation/automationAccounts/jobs/write",
|                                                    "Microsoft.Automation/automationAccounts/jobs/output/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5fb5aef8-1081-4b8e-bb16-9d5d0385bab5",
|                                    "Name":  "Automation Runbook Operator",
|                                    "Description":  "Read Runbook properties - to be able to create Jobs of the runbook.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d3881f73-407a-4167-8283-e981cbba0404",
|                                    "Name":  "Automation Operator",
|                                    "Description":  "Automation Operators are able to start, stop, suspend, and resume jobs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/read",
|                                                    "Microsoft.Automation/automationAccounts/jobs/read",
|                                                    "Microsoft.Automation/automationAccounts/jobs/resume/action",
|                                                    "Microsoft.Automation/automationAccounts/jobs/stop/action",
|                                                    "Microsoft.Automation/automationAccounts/jobs/streams/read",
|                                                    "Microsoft.Automation/automationAccounts/jobs/suspend/action",
|                                                    "Microsoft.Automation/automationAccounts/jobs/write",
|                                                    "Microsoft.Automation/automationAccounts/jobSchedules/read",
|                                                    "Microsoft.Automation/automationAccounts/jobSchedules/write",
|                                                    "Microsoft.Automation/automationAccounts/linkedWorkspace/read",
|                                                    "Microsoft.Automation/automationAccounts/read",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                    "Microsoft.Automation/automationAccounts/schedules/read",
|                                                    "Microsoft.Automation/automationAccounts/schedules/write",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Automation/automationAccounts/jobs/output/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4f8fab4f-1852-4a58-a46a-8eaf358af14a",
|                                    "Name":  "Avere Contributor",
|                                    "Description":  "Can create and manage an Avere vFXT cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Compute/*/read",
|                                                    "Microsoft.Compute/availabilitySets/*",
|                                                    "Microsoft.Compute/proximityPlacementGroups/*",
|                                                    "Microsoft.Compute/virtualMachines/*",
|                                                    "Microsoft.Compute/disks/*",
|                                                    "Microsoft.Network/*/read",
|                                                    "Microsoft.Network/networkInterfaces/*",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/*/read",
|                                                    "Microsoft.Storage/storageAccounts/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/resources/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c025889f-8102-4ebf-b32c-fc0c6f0c6bd9",
|                                    "Name":  "Avere Operator",
|                                    "Description":  "Used by the Avere vFXT cluster to manage the cluster",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8",
|                                    "Name":  "Azure Kubernetes Service Cluster Admin Role",
|                                    "Description":  "List cluster admin credential action.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action",
|                                                    "Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action",
|                                                    "Microsoft.ContainerService/managedClusters/read",
|                                                    "Microsoft.ContainerService/managedClusters/runcommand/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4abbcc35-e782-43d8-92c5-2d3f1bd2253f",
|                                    "Name":  "Azure Kubernetes Service Cluster User Role",
|                                    "Description":  "List cluster user credential action.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
|                                                    "Microsoft.ContainerService/managedClusters/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "423170ca-a8f6-4b0f-8487-9e4eb8f49bfa",
|                                    "Name":  "Azure Maps Data Reader",
|                                    "Description":  "Grants access to read map related data from an Azure maps account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Maps/accounts/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6f12a6df-dd06-4f3e-bcb1-ce8be600526a",
|                                    "Name":  "Azure Stack Registration Owner",
|                                    "Description":  "Lets you manage Azure Stack registrations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStack/edgeSubscriptions/read",
|                                                    "Microsoft.AzureStack/registrations/products/*/action",
|                                                    "Microsoft.AzureStack/registrations/products/read",
|                                                    "Microsoft.AzureStack/registrations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5e467623-bb1f-42f4-a55d-6e525e11384b",
|                                    "Name":  "Backup Contributor",
|                                    "Description":  "Lets you manage backups, but can\u0027t delete vaults and give access to others",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.RecoveryServices/locations/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/refreshContainers/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupJobs/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupJobsExport/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupOperationResults/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectableItems/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectedItems/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectionContainers/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupSecurityPIN/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupUsageSummaries/read",
|                                                    "Microsoft.RecoveryServices/Vaults/certificates/*",
|                                                    "Microsoft.RecoveryServices/Vaults/extendedInformation/*",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/read",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/*",
|                                                    "Microsoft.RecoveryServices/Vaults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/*",
|                                                    "Microsoft.RecoveryServices/Vaults/usages/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupstorageconfig/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupconfig/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupValidateOperation/action",
|                                                    "Microsoft.RecoveryServices/Vaults/write",
|                                                    "Microsoft.RecoveryServices/Vaults/backupOperations/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupEngines/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectableContainers/read",
|                                                    "Microsoft.RecoveryServices/vaults/operationStatus/read",
|                                                    "Microsoft.RecoveryServices/vaults/operationResults/read",
|                                                    "Microsoft.RecoveryServices/locations/backupStatus/action",
|                                                    "Microsoft.RecoveryServices/locations/backupPreValidateProtection/action",
|                                                    "Microsoft.RecoveryServices/locations/backupValidateFeatures/action",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/write",
|                                                    "Microsoft.RecoveryServices/operations/read",
|                                                    "Microsoft.RecoveryServices/locations/operationStatus/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.DataProtection/locations/getBackupStatus/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/write",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/delete",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                    "Microsoft.DataProtection/backupVaults/deletedBackupInstances/read",
|                                                    "Microsoft.DataProtection/backupVaults/deletedBackupInstances/undelete/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/backup/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/validateRestore/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/restore/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/crossRegionRestore/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/validateCrossRegionRestore/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJobs/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJob/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchSecondaryRecoveryPoints/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupPolicies/write",
|                                                    "Microsoft.DataProtection/backupVaults/backupPolicies/delete",
|                                                    "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read",
|                                                    "Microsoft.DataProtection/backupVaults/write",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/backupVaults/operationResults/read",
|                                                    "Microsoft.DataProtection/backupVaults/operationStatus/read",
|                                                    "Microsoft.DataProtection/locations/checkNameAvailability/action",
|                                                    "Microsoft.DataProtection/locations/checkFeatureSupport/action",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/locations/operationStatus/read",
|                                                    "Microsoft.DataProtection/locations/operationResults/read",
|                                                    "Microsoft.DataProtection/backupVaults/validateForBackup/action",
|                                                    "Microsoft.DataProtection/operations/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/delete",
|                                                    "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/unlockDelete/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/write",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/write",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/delete",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/unlockDelete/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/validateForModifyBackup/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/SuspendBackups/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/resumeProtection/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fa23ad8b-c56e-40d8-ac0c-ce449e1d2c64",
|                                    "Name":  "Billing Reader",
|                                    "Description":  "Allows read access to billing data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Billing/*/read",
|                                                    "Microsoft.Commerce/*/read",
|                                                    "Microsoft.Consumption/*/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.CostManagement/*/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a795c7a0-d4a2-40c1-ae25-d81f01202912",
|                                    "Name":  "Backup Reader",
|                                    "Description":  "Can view backup services, but can\u0027t make changes",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.RecoveryServices/locations/allocatedStamp/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/operationsStatus/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationsStatus/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupJobs/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupJobs/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupJobsExport/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupOperationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectedItems/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectionContainers/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupUsageSummaries/read",
|                                                    "Microsoft.RecoveryServices/Vaults/extendedInformation/read",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/read",
|                                                    "Microsoft.RecoveryServices/Vaults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupstorageconfig/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupconfig/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupOperations/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/operations/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupEngines/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/items/read",
|                                                    "Microsoft.RecoveryServices/locations/backupStatus/action",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/*",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/write",
|                                                    "Microsoft.RecoveryServices/operations/read",
|                                                    "Microsoft.RecoveryServices/locations/operationStatus/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read",
|                                                    "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                    "Microsoft.RecoveryServices/locations/backupValidateFeatures/action",
|                                                    "Microsoft.RecoveryServices/locations/backupCrrJobs/action",
|                                                    "Microsoft.RecoveryServices/locations/backupCrrJob/action",
|                                                    "Microsoft.RecoveryServices/locations/backupCrrOperationResults/read",
|                                                    "Microsoft.RecoveryServices/locations/backupCrrOperationsStatus/read",
|                                                    "Microsoft.DataProtection/locations/getBackupStatus/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                    "Microsoft.DataProtection/backupVaults/deletedBackupInstances/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/action",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/backupVaults/operationResults/read",
|                                                    "Microsoft.DataProtection/backupVaults/operationStatus/read",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/locations/operationStatus/read",
|                                                    "Microsoft.DataProtection/locations/operationResults/read",
|                                                    "Microsoft.DataProtection/operations/read",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJobs/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJob/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchSecondaryRecoveryPoints/action",
|                                                    "Microsoft.DataProtection/locations/checkFeatureSupport/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "31a002a1-acaf-453e-8a5b-297c9ca1ea24",
|                                    "Name":  "Blockchain Member Node Access (Preview)",
|                                    "Description":  "Allows for access to Blockchain Member nodes",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Blockchain/blockchainMembers/transactionNodes/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Blockchain/blockchainMembers/transactionNodes/connect/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5e3c6656-6cfa-4708-81fe-0de47ac73342",
|                                    "Name":  "BizTalk Contributor",
|                                    "Description":  "Lets you manage BizTalk services, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.BizTalkServices/BizTalk/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "426e0c7f-0c7e-4658-b36f-ff54d6c29b45",
|                                    "Name":  "CDN Endpoint Contributor",
|                                    "Description":  "Can manage CDN endpoints, but can\u0027t grant access to other users.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Cdn/edgenodes/read",
|                                                    "Microsoft.Cdn/operationresults/*",
|                                                    "Microsoft.Cdn/profiles/endpoints/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ec156ff8-a8d1-4d15-830c-5b80698ca432",
|                                    "Name":  "CDN Profile Contributor",
|                                    "Description":  "Can manage CDN and Azure Front Door standard and premium profiles and their endpoints, but can\u0027t grant access to other users.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Cdn/edgenodes/read",
|                                                    "Microsoft.Cdn/operationresults/*",
|                                                    "Microsoft.Cdn/profiles/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8f96442b-4075-438f-813d-ad51ab4019af",
|                                    "Name":  "CDN Profile Reader",
|                                    "Description":  "Can view CDN profiles and their endpoints, but can\u0027t make changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Cdn/edgenodes/read",
|                                                    "Microsoft.Cdn/operationresults/*",
|                                                    "Microsoft.Cdn/profiles/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Cdn/profiles/afdendpoints/validateCustomDomain/action",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Cdn/profiles/CheckResourceUsage/action",
|                                                    "Microsoft.Cdn/profiles/endpoints/CheckResourceUsage/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b34d265f-36f7-4a0d-a4d4-e158ca92e90f",
|                                    "Name":  "Classic Network Contributor",
|                                    "Description":  "Lets you manage classic networks, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ClassicNetwork/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "86e8f5dc-a6e9-4c67-9d15-de283e8eac25",
|                                    "Name":  "Classic Storage Account Contributor",
|                                    "Description":  "Lets you manage classic storage accounts, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ClassicStorage/storageAccounts/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "985d6b00-f706-48f5-a6fe-d0ca12fb668d",
|                                    "Name":  "Classic Storage Account Key Operator Service Role",
|                                    "Description":  "Classic Storage Account Key Operators are allowed to list and regenerate keys on Classic Storage Accounts",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ClassicStorage/storageAccounts/listkeys/action",
|                                                    "Microsoft.ClassicStorage/storageAccounts/regeneratekey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9106cda0-8a86-4e81-b686-29a22c54effe",
|                                    "Name":  "ClearDB MySQL DB Contributor",
|                                    "Description":  "Lets you manage ClearDB MySQL databases, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "successbricks.cleardb/databases/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d73bb868-a0df-4d4d-bd69-98a00b01fccb",
|                                    "Name":  "Classic Virtual Machine Contributor",
|                                    "Description":  "Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they’re connected to.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ClassicCompute/domainNames/*",
|                                                    "Microsoft.ClassicCompute/virtualMachines/*",
|                                                    "Microsoft.ClassicNetwork/networkSecurityGroups/join/action",
|                                                    "Microsoft.ClassicNetwork/reservedIps/link/action",
|                                                    "Microsoft.ClassicNetwork/reservedIps/read",
|                                                    "Microsoft.ClassicNetwork/virtualNetworks/join/action",
|                                                    "Microsoft.ClassicNetwork/virtualNetworks/read",
|                                                    "Microsoft.ClassicStorage/storageAccounts/disks/read",
|                                                    "Microsoft.ClassicStorage/storageAccounts/images/read",
|                                                    "Microsoft.ClassicStorage/storageAccounts/listKeys/action",
|                                                    "Microsoft.ClassicStorage/storageAccounts/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a97b65f3-24c7-4388-baec-2e87135dc908",
|                                    "Name":  "Cognitive Services User",
|                                    "Description":  "Lets you read and list keys of Cognitive Services.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.CognitiveServices/accounts/listkeys/action",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Insights/diagnosticSettings/read",
|                                                    "Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.Insights/metricdefinitions/read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b59867f0-fa02-499b-be73-45a86b5b3e1c",
|                                    "Name":  "Cognitive Services Data Reader",
|                                    "Description":  "Lets you read Cognitive Services data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68",
|                                    "Name":  "Cognitive Services Contributor",
|                                    "Description":  "Lets you create, read, update, delete and manage keys of Cognitive Services.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.CognitiveServices/*",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/providers/features/register/action",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/diagnosticSettings/*",
|                                                    "Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.Insights/metricdefinitions/read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.CognitiveServices/raiPolicy/write",
|                                                       "Microsoft.CognitiveServices/raiPolicy/delete",
|                                                       "Microsoft.CognitiveServices/raiExternalSafetyProviders/write",
|                                                       "Microsoft.CognitiveServices/raiExternalSafetyProviders/delete"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "db7b14f2-5adf-42da-9f96-f2ee17bab5cb",
|                                    "Name":  "CosmosBackupOperator",
|                                    "Description":  "Can submit restore request for a Cosmos DB database or a container for an account",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DocumentDB/databaseAccounts/backup/action",
|                                                    "Microsoft.DocumentDB/databaseAccounts/restore/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b24988ac-6180-42a0-ab88-20f7382dd24c",
|                                    "Name":  "Contributor",
|                                    "Description":  "Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.Authorization/*/Delete",
|                                                       "Microsoft.Authorization/*/Write",
|                                                       "Microsoft.Authorization/elevateAccess/Action",
|                                                       "Microsoft.Blueprint/blueprintAssignments/write",
|                                                       "Microsoft.Blueprint/blueprintAssignments/delete",
|                                                       "Microsoft.Compute/galleries/share/action",
|                                                       "Microsoft.Purview/consents/write",
|                                                       "Microsoft.Purview/consents/delete",
|                                                       "Microsoft.Resources/deploymentStacks/manageDenySetting/action",
|                                                       "Microsoft.Subscription/cancel/action",
|                                                       "Microsoft.Subscription/enable/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fbdf93bf-df7d-467e-a4d2-9458aa1360c8",
|                                    "Name":  "Cosmos DB Account Reader Role",
|                                    "Description":  "Can read Azure Cosmos DB Accounts data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.DocumentDB/*/read",
|                                                    "Microsoft.DocumentDB/databaseAccounts/readonlykeys/action",
|                                                    "Microsoft.Insights/MetricDefinitions/read",
|                                                    "Microsoft.Insights/Metrics/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "434105ed-43f6-45c7-a02f-909b2ba83430",
|                                    "Name":  "Cost Management Contributor",
|                                    "Description":  "Can view costs and manage cost configuration (e.g. budgets, exports)",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Consumption/*",
|                                                    "Microsoft.CostManagement/*",
|                                                    "Microsoft.Billing/billingPeriods/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Advisor/configurations/read",
|                                                    "Microsoft.Advisor/recommendations/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Billing/billingProperty/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "72fafb9e-0641-4937-9268-a91bfd8191a3",
|                                    "Name":  "Cost Management Reader",
|                                    "Description":  "Can view cost data and configuration (e.g. budgets, exports)",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Consumption/*/read",
|                                                    "Microsoft.CostManagement/*/read",
|                                                    "Microsoft.Billing/billingPeriods/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Advisor/configurations/read",
|                                                    "Microsoft.Advisor/recommendations/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Billing/billingProperty/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "add466c9-e687-43fc-8d98-dfcf8d720be5",
|                                    "Name":  "Data Box Contributor",
|                                    "Description":  "Lets you manage everything under Data Box Service except giving access to others.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Databox/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "028f4ed7-e2a9-465e-a8f4-9c0ffdfdc027",
|                                    "Name":  "Data Box Reader",
|                                    "Description":  "Lets you manage Data Box Service except creating order or editing order details and giving access to others.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Databox/*/read",
|                                                    "Microsoft.Databox/jobs/listsecrets/action",
|                                                    "Microsoft.Databox/jobs/listcredentials/action",
|                                                    "Microsoft.Databox/locations/availableSkus/action",
|                                                    "Microsoft.Databox/locations/validateInputs/action",
|                                                    "Microsoft.Databox/locations/regionConfiguration/action",
|                                                    "Microsoft.Databox/locations/validateAddress/action",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "673868aa-7521-48a0-acc6-0f60742d39f5",
|                                    "Name":  "Data Factory Contributor",
|                                    "Description":  "Create and manage data factories, as well as child resources within them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.DataFactory/dataFactories/*",
|                                                    "Microsoft.DataFactory/factories/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.EventGrid/eventSubscriptions/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "150f5e0c-0603-4f03-8c7f-cf70034c4e90",
|                                    "Name":  "Data Purger",
|                                    "Description":  "Can purge analytics data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Insights/components/*/read",
|                                                    "Microsoft.Insights/components/purge/action",
|                                                    "Microsoft.OperationalInsights/workspaces/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/purge/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "47b7735b-770e-4598-a7da-8b91488b4c88",
|                                    "Name":  "Data Lake Analytics Developer",
|                                    "Description":  "Lets you submit, monitor, and manage your own jobs but not create or delete Data Lake Analytics accounts.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.BigAnalytics/accounts/*",
|                                                    "Microsoft.DataLakeAnalytics/accounts/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.BigAnalytics/accounts/Delete",
|                                                       "Microsoft.BigAnalytics/accounts/TakeOwnership/action",
|                                                       "Microsoft.BigAnalytics/accounts/Write",
|                                                       "Microsoft.DataLakeAnalytics/accounts/Delete",
|                                                       "Microsoft.DataLakeAnalytics/accounts/TakeOwnership/action",
|                                                       "Microsoft.DataLakeAnalytics/accounts/Write",
|                                                       "Microsoft.DataLakeAnalytics/accounts/dataLakeStoreAccounts/Write",
|                                                       "Microsoft.DataLakeAnalytics/accounts/dataLakeStoreAccounts/Delete",
|                                                       "Microsoft.DataLakeAnalytics/accounts/storageAccounts/Write",
|                                                       "Microsoft.DataLakeAnalytics/accounts/storageAccounts/Delete",
|                                                       "Microsoft.DataLakeAnalytics/accounts/firewallRules/Write",
|                                                       "Microsoft.DataLakeAnalytics/accounts/firewallRules/Delete",
|                                                       "Microsoft.DataLakeAnalytics/accounts/computePolicies/Write",
|                                                       "Microsoft.DataLakeAnalytics/accounts/computePolicies/Delete"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "76283e04-6283-4c54-8f91-bcf1374a3c64",
|                                    "Name":  "DevTest Labs User",
|                                    "Description":  "Lets you connect, start, restart, and shutdown your virtual machines in your Azure DevTest Labs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/virtualMachines/*/read",
|                                                    "Microsoft.Compute/virtualMachines/deallocate/action",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/restart/action",
|                                                    "Microsoft.Compute/virtualMachines/start/action",
|                                                    "Microsoft.DevTestLab/*/read",
|                                                    "Microsoft.DevTestLab/labs/claimAnyVm/action",
|                                                    "Microsoft.DevTestLab/labs/createEnvironment/action",
|                                                    "Microsoft.DevTestLab/labs/ensureCurrentUserProfile/action",
|                                                    "Microsoft.DevTestLab/labs/formulas/delete",
|                                                    "Microsoft.DevTestLab/labs/formulas/read",
|                                                    "Microsoft.DevTestLab/labs/formulas/write",
|                                                    "Microsoft.DevTestLab/labs/policySets/evaluatePolicies/action",
|                                                    "Microsoft.DevTestLab/labs/virtualMachines/claim/action",
|                                                    "Microsoft.DevTestLab/labs/virtualmachines/listApplicableSchedules/action",
|                                                    "Microsoft.DevTestLab/labs/virtualMachines/getRdpFileContents/action",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
|                                                    "Microsoft.Network/networkInterfaces/*/read",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/publicIPAddresses/*/read",
|                                                    "Microsoft.Network/publicIPAddresses/join/action",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.Compute/virtualMachines/vmSizes/read"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5bd9cd88-fe45-4216-938b-f97437e15450",
|                                    "Name":  "DocumentDB Account Contributor",
|                                    "Description":  "Lets you manage DocumentDB accounts, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.DocumentDb/databaseAccounts/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "befefa01-2a29-4197-83a8-272ff33ce314",
|                                    "Name":  "DNS Zone Contributor",
|                                    "Description":  "Lets you manage DNS zones and record sets in Azure DNS, but does not let you control who has access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Network/dnsZones/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "428e0ff0-5e57-4d9c-a221-2c70d0e0a443",
|                                    "Name":  "EventGrid EventSubscription Contributor",
|                                    "Description":  "Lets you manage EventGrid event subscription operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.EventGrid/eventSubscriptions/*",
|                                                    "Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/locations/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2414bbcf-6497-4faf-8c65-045460748405",
|                                    "Name":  "EventGrid EventSubscription Reader",
|                                    "Description":  "Lets you read EventGrid event subscriptions.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.EventGrid/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/locations/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b60367af-1334-4454-b71e-769d9a4f83d9",
|                                    "Name":  "Graph Owner",
|                                    "Description":  "Create and manage all aspects of the Enterprise Graph - Ontology, Schema mapping, Conflation and Conversational AI and Ingestions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/conflation/read",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/conflation/write",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/sourceschema/read",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/sourceschema/write",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/knowledge/read",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/knowledge/write",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/intentclassification/read",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/intentclassification/write",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/ingestion/read",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/ingestion/write",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/ontology/read",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/ontology/write",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/delete",
|                                                    "Microsoft.EnterpriseKnowledgeGraph/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8d8d5a11-05d3-4bda-a417-a08778121c7c",
|                                    "Name":  "HDInsight Domain Services Contributor",
|                                    "Description":  "Can Read, Create, Modify and Delete Domain Services related operations needed for HDInsight Enterprise Security Package",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AAD/*/read",
|                                                    "Microsoft.AAD/domainServices/*/read",
|                                                    "Microsoft.AAD/domainServices/oucontainer/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "03a6d094-3444-4b3d-88af-7477090a9e5e",
|                                    "Name":  "Intelligent Systems Account Contributor",
|                                    "Description":  "Lets you manage Intelligent Systems accounts, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.IntelligentSystems/accounts/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f25e0fa2-a7c8-4377-a976-54943a77a395",
|                                    "Name":  "Key Vault Contributor",
|                                    "Description":  "Lets you manage key vaults, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.KeyVault/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.KeyVault/locations/deletedVaults/purge/action",
|                                                       "Microsoft.KeyVault/hsmPools/*",
|                                                       "Microsoft.KeyVault/managedHsms/*"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ee361c5d-f7b5-4119-b4b6-892157c8f64c",
|                                    "Name":  "Knowledge Consumer",
|                                    "Description":  "Knowledge Read permission to consume Enterprise Graph Knowledge using entity search and graph query",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EnterpriseKnowledgeGraph/services/knowledge/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b97fb8bc-a8b2-4522-a38b-dd33c7e65ead",
|                                    "Name":  "Lab Creator",
|                                    "Description":  "Lets you create new labs under your Azure Lab Accounts.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.LabServices/labAccounts/*/read",
|                                                    "Microsoft.LabServices/labAccounts/createLab/action",
|                                                    "Microsoft.LabServices/labAccounts/getPricingAndAvailability/action",
|                                                    "Microsoft.LabServices/labAccounts/getRestrictionsAndUsage/action",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.LabServices/labPlans/images/read",
|                                                    "Microsoft.LabServices/labPlans/read",
|                                                    "Microsoft.LabServices/labPlans/saveImage/action",
|                                                    "Microsoft.LabServices/labs/read",
|                                                    "Microsoft.LabServices/labs/schedules/read",
|                                                    "Microsoft.LabServices/labs/users/read",
|                                                    "Microsoft.LabServices/labs/virtualMachines/read",
|                                                    "Microsoft.LabServices/locations/usages/read",
|                                                    "Microsoft.LabServices/skus/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.LabServices/labPlans/createLab/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "73c42c96-874c-492b-b04d-ab87d138a893",
|                                    "Name":  "Log Analytics Reader",
|                                    "Description":  "Log Analytics Reader can view and search all monitoring data as well as and view monitoring settings, including viewing the configuration of Azure diagnostics on all Azure resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                    "Microsoft.OperationalInsights/workspaces/search/action",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.OperationalInsights/workspaces/sharedKeys/read"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "92aaf0da-9dab-42b6-94a3-d43ce8d16293",
|                                    "Name":  "Log Analytics Contributor",
|                                    "Description":  "Log Analytics Contributor can read all monitoring data and edit monitoring settings. Editing monitoring settings includes adding the VM extension to VMs; reading storage account keys to be able to configure collection of logs from Azure Storage; adding solutions; and configuring Azure diagnostics on all Azure resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.ClassicCompute/virtualMachines/extensions/*",
|                                                    "Microsoft.ClassicStorage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Compute/virtualMachines/extensions/*",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/diagnosticSettings/*",
|                                                    "Microsoft.OperationalInsights/*",
|                                                    "Microsoft.OperationsManagement/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "515c2055-d9d4-4321-b1b9-bd0c9a0f79fe",
|                                    "Name":  "Logic App Operator",
|                                    "Description":  "Lets you read, enable and disable logic app.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*/read",
|                                                    "Microsoft.Insights/metricAlerts/*/read",
|                                                    "Microsoft.Insights/diagnosticSettings/*/read",
|                                                    "Microsoft.Insights/metricDefinitions/*/read",
|                                                    "Microsoft.Logic/*/read",
|                                                    "Microsoft.Logic/workflows/disable/action",
|                                                    "Microsoft.Logic/workflows/enable/action",
|                                                    "Microsoft.Logic/workflows/validate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Web/connectionGateways/*/read",
|                                                    "Microsoft.Web/connections/*/read",
|                                                    "Microsoft.Web/customApis/*/read",
|                                                    "Microsoft.Web/serverFarms/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "87a39d53-fc1b-424a-814c-f7e04687dc9e",
|                                    "Name":  "Logic App Contributor",
|                                    "Description":  "Lets you manage logic app, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ClassicStorage/storageAccounts/listKeys/action",
|                                                    "Microsoft.ClassicStorage/storageAccounts/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/metricAlerts/*",
|                                                    "Microsoft.Insights/diagnosticSettings/*",
|                                                    "Microsoft.Insights/logdefinitions/*",
|                                                    "Microsoft.Insights/metricDefinitions/*",
|                                                    "Microsoft.Logic/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Web/connectionGateways/*",
|                                                    "Microsoft.Web/connections/*",
|                                                    "Microsoft.Web/customApis/*",
|                                                    "Microsoft.Web/serverFarms/join/action",
|                                                    "Microsoft.Web/serverFarms/read",
|                                                    "Microsoft.Web/sites/functions/listSecrets/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c7393b34-138c-406f-901b-d8cf2b17e6ae",
|                                    "Name":  "Managed Application Operator Role",
|                                    "Description":  "Lets you read and perform actions on Managed Application resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.Solutions/applications/read",
|                                                    "Microsoft.Solutions/*/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b9331d33-8a36-4f8c-b097-4f54124fdb44",
|                                    "Name":  "Managed Application Publisher Operator",
|                                    "Description":  "Allows the publisher to read resources in the managed resource group for Managed Application and request JIT access for additional operations. This role is only used by the Managed Application service to provide access to publishers.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Solutions/jitRequests/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f1a07417-d97a-45cb-824c-7a7467783830",
|                                    "Name":  "Managed Identity Operator",
|                                    "Description":  "Read and Assign User Assigned Identity",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/*/read",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e40ec5ca-96e0-45a2-b4ff-59039f2c2b59",
|                                    "Name":  "Managed Identity Contributor",
|                                    "Description":  "Create, Read, Update, and Delete User Assigned Identity",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/read",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/write",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/delete",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/revokeTokens/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d58bcaf-24a5-4b20-bdb6-eed9f69fbe4c",
|                                    "Name":  "Management Group Contributor",
|                                    "Description":  "Management Group Contributor Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Management/managementGroups/delete",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Management/managementGroups/subscriptions/delete",
|                                                    "Microsoft.Management/managementGroups/subscriptions/write",
|                                                    "Microsoft.Management/managementGroups/write",
|                                                    "Microsoft.Management/managementGroups/subscriptions/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ac63b705-f282-497d-ac71-919bf39d939d",
|                                    "Name":  "Management Group Reader",
|                                    "Description":  "Management Group Reader Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Management/managementGroups/subscriptions/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "43d0d8ad-25c7-4714-9337-8ba259a9fe05",
|                                    "Name":  "Monitoring Reader",
|                                    "Description":  "Can read all monitoring data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/search/action",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4d97b98b-1d4f-4787-a291-c67834d212e7",
|                                    "Name":  "Network Contributor",
|                                    "Description":  "Lets you manage networks, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Network/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d28c62d-5b37-4476-8438-e587778df237",
|                                    "Name":  "New Relic APM Account Contributor",
|                                    "Description":  "Lets you manage New Relic Application Performance Management accounts and applications, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "NewRelic.APM/accounts/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
|                                    "Name":  "Owner",
|                                    "Description":  "Grants full access to manage all resources, including the ability to assign roles in Azure RBAC.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "acdd72a7-3385-48ef-bd42-f606fba81ae7",
|                                    "Name":  "Reader",
|                                    "Description":  "View all resources, but does not allow you to make any changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e0f68234-74aa-48ed-b826-c38b57376e17",
|                                    "Name":  "Redis Cache Contributor",
|                                    "Description":  "Lets you manage Redis caches, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Cache/register/action",
|                                                    "Microsoft.Cache/redis/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c12c1c16-33a1-487b-954d-41c89c60f349",
|                                    "Name":  "Reader and Data Access",
|                                    "Description":  "Lets you view everything but will not let you delete or create a storage account or contained resource. It will also allow read/write access to all data contained in a storage account via access to storage account keys.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Storage/storageAccounts/ListAccountSas/action",
|                                                    "Microsoft.Storage/storageAccounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "36243c78-bf99-498c-9df9-86d9f8d28608",
|                                    "Name":  "Resource Policy Contributor",
|                                    "Description":  "Users with rights to create/modify resource policy, create support ticket and read resources/hierarchy.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.Authorization/policyassignments/*",
|                                                    "Microsoft.Authorization/policydefinitions/*",
|                                                    "Microsoft.Authorization/policyexemptions/*",
|                                                    "Microsoft.Authorization/policyenrollments/*",
|                                                    "Microsoft.Authorization/policysetdefinitions/*",
|                                                    "Microsoft.PolicyInsights/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "188a0f2f-5c9e-469b-ae67-2aa5ce574b94",
|                                    "Name":  "Scheduler Job Collections Contributor",
|                                    "Description":  "Lets you manage Scheduler job collections, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Scheduler/jobcollections/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7ca78c08-252a-4471-8644-bb5ff32d4ba0",
|                                    "Name":  "Search Service Contributor",
|                                    "Description":  "Lets you manage Search services, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Search/searchServices/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e3d13bf0-dd5a-482e-ba6b-9b8433878d10",
|                                    "Name":  "Security Manager (Legacy)",
|                                    "Description":  "This is a legacy role. Please use Security Administrator instead",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ClassicCompute/*/read",
|                                                    "Microsoft.ClassicCompute/virtualMachines/*/write",
|                                                    "Microsoft.ClassicNetwork/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Security/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "39bc4728-0917-49c7-9d2c-d95423bc2eb4",
|                                    "Name":  "Security Reader",
|                                    "Description":  "Security Reader Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.operationalInsights/workspaces/*/read",
|                                                    "Microsoft.Resources/deployments/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Security/*/read",
|                                                    "Microsoft.IoTSecurity/*/read",
|                                                    "Microsoft.Support/*/read",
|                                                    "Microsoft.Security/iotDefenderSettings/packageDownloads/action",
|                                                    "Microsoft.Security/iotDefenderSettings/downloadManagerActivation/action",
|                                                    "Microsoft.Security/iotSensors/downloadResetPassword/action",
|                                                    "Microsoft.IoTSecurity/defenderSettings/packageDownloads/action",
|                                                    "Microsoft.IoTSecurity/defenderSettings/downloadManagerActivation/action",
|                                                    "Microsoft.Management/managementGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8bbe83f1-e2a6-4df7-8cb4-4e04d4e5c827",
|                                    "Name":  "Spatial Anchors Account Contributor",
|                                    "Description":  "Lets you manage spatial anchors in your account, but not delete them",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/create/action",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/discovery/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/properties/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/query/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/submitdiag/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6670b86e-a3f7-4917-ac9b-5d6ab1be4567",
|                                    "Name":  "Site Recovery Contributor",
|                                    "Description":  "Lets you manage Site Recovery service except vault creation and role assignment",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.RecoveryServices/locations/allocatedStamp/read",
|                                                    "Microsoft.RecoveryServices/locations/allocateStamp/action",
|                                                    "Microsoft.RecoveryServices/Vaults/certificates/write",
|                                                    "Microsoft.RecoveryServices/Vaults/extendedInformation/*",
|                                                    "Microsoft.RecoveryServices/Vaults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/refreshContainers/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/*",
|                                                    "Microsoft.RecoveryServices/vaults/replicationAlertSettings/*",
|                                                    "Microsoft.RecoveryServices/vaults/replicationEvents/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/*",
|                                                    "Microsoft.RecoveryServices/vaults/replicationJobs/*",
|                                                    "Microsoft.RecoveryServices/vaults/replicationPolicies/*",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/*",
|                                                    "Microsoft.RecoveryServices/vaults/replicationVaultSettings/*",
|                                                    "Microsoft.RecoveryServices/Vaults/storageConfig/*",
|                                                    "Microsoft.RecoveryServices/Vaults/tokenInfo/read",
|                                                    "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                    "Microsoft.RecoveryServices/Vaults/vaultTokens/read",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/*",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/notificationConfiguration/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationOperationStatus/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "494ae006-db33-4328-bf46-533a6560a3ca",
|                                    "Name":  "Site Recovery Operator",
|                                    "Description":  "Lets you failover and failback but not perform other Site Recovery management operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.RecoveryServices/locations/allocatedStamp/read",
|                                                    "Microsoft.RecoveryServices/locations/allocateStamp/action",
|                                                    "Microsoft.RecoveryServices/Vaults/extendedInformation/read",
|                                                    "Microsoft.RecoveryServices/Vaults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/refreshContainers/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationAlertSettings/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationEvents/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/checkConsistency/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/reassociateGateway/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/renewcertificate/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/replicationNetworkMappings/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectableItems/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/applyRecoveryPoint/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/failoverCommit/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/plannedFailover/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/recoveryPoints/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/repairReplication/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/reProtect/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/switchprotection/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/testFailover/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/testFailoverCleanup/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/unplannedFailover/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/updateMobilityService/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectionContainerMappings/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationRecoveryServicesProviders/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationRecoveryServicesProviders/refreshProvider/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/replicationStorageClassificationMappings/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationvCenters/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationJobs/*",
|                                                    "Microsoft.RecoveryServices/vaults/replicationPolicies/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/failoverCommit/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/plannedFailover/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/reProtect/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/testFailover/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/testFailoverCleanup/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/unplannedFailover/action",
|                                                    "Microsoft.RecoveryServices/vaults/replicationVaultSettings/read",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/*",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/notificationConfiguration/read",
|                                                    "Microsoft.RecoveryServices/Vaults/storageConfig/read",
|                                                    "Microsoft.RecoveryServices/Vaults/tokenInfo/read",
|                                                    "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                    "Microsoft.RecoveryServices/Vaults/vaultTokens/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d51204f-eb77-4b1c-b86a-2ec626c49413",
|                                    "Name":  "Spatial Anchors Account Reader",
|                                    "Description":  "Lets you locate and read properties of spatial anchors in your account",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/discovery/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/properties/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/query/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/submitdiag/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dbaa88c4-0c30-4179-9fb3-46319faa6149",
|                                    "Name":  "Site Recovery Reader",
|                                    "Description":  "Lets you view Site Recovery status but not perform other management operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.RecoveryServices/locations/allocatedStamp/read",
|                                                    "Microsoft.RecoveryServices/Vaults/extendedInformation/read",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/read",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/notificationConfiguration/read",
|                                                    "Microsoft.RecoveryServices/Vaults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/refreshContainers/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationAlertSettings/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationEvents/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationNetworks/replicationNetworkMappings/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectableItems/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/recoveryPoints/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectionContainerMappings/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationRecoveryServicesProviders/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationStorageClassifications/replicationStorageClassificationMappings/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationvCenters/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationJobs/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationPolicies/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationRecoveryPlans/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationVaultSettings/read",
|                                                    "Microsoft.RecoveryServices/Vaults/storageConfig/read",
|                                                    "Microsoft.RecoveryServices/Vaults/tokenInfo/read",
|                                                    "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                    "Microsoft.RecoveryServices/Vaults/vaultTokens/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "70bbe301-9835-447d-afdd-19eb3167307c",
|                                    "Name":  "Spatial Anchors Account Owner",
|                                    "Description":  "Lets you manage spatial anchors in your account, including deleting them",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/create/action",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/delete",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/discovery/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/properties/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/query/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/submitdiag/read",
|                                                        "Microsoft.MixedReality/SpatialAnchorsAccounts/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4939a1f6-9ae0-4e48-a1e0-f2cbe897382d",
|                                    "Name":  "SQL Managed Instance Contributor",
|                                    "Description":  "Lets you manage SQL Managed Instances and required network configuration, but can’t give access to others.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/*",
|                                                    "Microsoft.Network/routeTables/*",
|                                                    "Microsoft.Sql/locations/*/read",
|                                                    "Microsoft.Sql/locations/instanceFailoverGroups/*",
|                                                    "Microsoft.Sql/managedInstances/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Network/virtualNetworks/subnets/*",
|                                                    "Microsoft.Network/virtualNetworks/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/metricDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.Sql/managedInstances/azureADOnlyAuthentications/delete",
|                                                       "Microsoft.Sql/managedInstances/azureADOnlyAuthentications/write"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9b7fa17d-e63e-47b0-bb0a-15c516ac86ec",
|                                    "Name":  "SQL DB Contributor",
|                                    "Description":  "Lets you manage SQL databases, but not access to them. Also, you can\u0027t manage their security-related policies or their parent SQL servers.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Sql/locations/*/read",
|                                                    "Microsoft.Sql/servers/databases/*",
|                                                    "Microsoft.Sql/servers/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/metricDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.Sql/servers/databases/ledgerDigestUploads/write",
|                                                       "Microsoft.Sql/servers/databases/ledgerDigestUploads/disable/action",
|                                                       "Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*",
|                                                       "Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*",
|                                                       "Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                       "Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*",
|                                                       "Microsoft.Sql/managedInstances/databases/sensitivityLabels/*",
|                                                       "Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*",
|                                                       "Microsoft.Sql/managedInstances/securityAlertPolicies/*",
|                                                       "Microsoft.Sql/managedInstances/vulnerabilityAssessments/*",
|                                                       "Microsoft.Sql/servers/databases/auditingSettings/*",
|                                                       "Microsoft.Sql/servers/databases/auditRecords/read",
|                                                       "Microsoft.Sql/servers/databases/currentSensitivityLabels/*",
|                                                       "Microsoft.Sql/servers/databases/dataMaskingPolicies/*",
|                                                       "Microsoft.Sql/servers/databases/extendedAuditingSettings/*",
|                                                       "Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*",
|                                                       "Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                       "Microsoft.Sql/servers/databases/securityAlertPolicies/*",
|                                                       "Microsoft.Sql/servers/databases/securityMetrics/*",
|                                                       "Microsoft.Sql/servers/databases/sensitivityLabels/*",
|                                                       "Microsoft.Sql/servers/databases/vulnerabilityAssessments/*",
|                                                       "Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*",
|                                                       "Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*",
|                                                       "Microsoft.Sql/servers/vulnerabilityAssessments/*"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "056cd41c-7e88-42e1-933e-88ba6a50c9c3",
|                                    "Name":  "SQL Security Manager",
|                                    "Description":  "Lets you manage the security-related policies of SQL servers and databases, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Sql/locations/administratorAzureAsyncOperation/read",
|                                                    "Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Sql/managedInstances/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Sql/managedInstances/databases/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*",
|                                                    "Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*",
|                                                    "Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                    "Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*",
|                                                    "Microsoft.Sql/managedInstances/databases/sensitivityLabels/*",
|                                                    "Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*",
|                                                    "Microsoft.Sql/servers/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Sql/servers/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Sql/managedInstances/securityAlertPolicies/*",
|                                                    "Microsoft.Sql/managedInstances/databases/transparentDataEncryption/*",
|                                                    "Microsoft.Sql/managedInstances/vulnerabilityAssessments/*",
|                                                    "Microsoft.Sql/managedInstances/serverConfigurationOptions/read",
|                                                    "Microsoft.Sql/managedInstances/serverConfigurationOptions/write",
|                                                    "Microsoft.Sql/locations/serverConfigurationOptionAzureAsyncOperation/read",
|                                                    "Microsoft.Sql/servers/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Sql/servers/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Sql/servers/auditingSettings/*",
|                                                    "Microsoft.Sql/servers/extendedAuditingSettings/*",
|                                                    "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Sql/servers/databases/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Sql/servers/databases/auditingSettings/*",
|                                                    "Microsoft.Sql/servers/databases/auditRecords/read",
|                                                    "Microsoft.Sql/servers/databases/currentSensitivityLabels/*",
|                                                    "Microsoft.Sql/servers/databases/dataMaskingPolicies/*",
|                                                    "Microsoft.Sql/servers/databases/extendedAuditingSettings/read",
|                                                    "Microsoft.Sql/servers/databases/read",
|                                                    "Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*",
|                                                    "Microsoft.Sql/servers/databases/schemas/read",
|                                                    "Microsoft.Sql/servers/databases/schemas/tables/columns/read",
|                                                    "Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                    "Microsoft.Sql/servers/databases/schemas/tables/read",
|                                                    "Microsoft.Sql/servers/databases/securityAlertPolicies/*",
|                                                    "Microsoft.Sql/servers/databases/securityMetrics/*",
|                                                    "Microsoft.Sql/servers/databases/sensitivityLabels/*",
|                                                    "Microsoft.Sql/servers/databases/transparentDataEncryption/*",
|                                                    "Microsoft.Sql/servers/databases/sqlvulnerabilityAssessments/*",
|                                                    "Microsoft.Sql/servers/databases/vulnerabilityAssessments/*",
|                                                    "Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*",
|                                                    "Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*",
|                                                    "Microsoft.Sql/servers/devOpsAuditingSettings/*",
|                                                    "Microsoft.Sql/servers/firewallRules/*",
|                                                    "Microsoft.Sql/servers/read",
|                                                    "Microsoft.Sql/servers/securityAlertPolicies/*",
|                                                    "Microsoft.Sql/servers/sqlvulnerabilityAssessments/*",
|                                                    "Microsoft.Sql/servers/vulnerabilityAssessments/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Sql/servers/azureADOnlyAuthentications/*",
|                                                    "Microsoft.Sql/managedInstances/read",
|                                                    "Microsoft.Sql/managedInstances/azureADOnlyAuthentications/*",
|                                                    "Microsoft.Security/sqlVulnerabilityAssessments/*",
|                                                    "Microsoft.Sql/managedInstances/administrators/read",
|                                                    "Microsoft.Sql/servers/administrators/read",
|                                                    "Microsoft.Sql/servers/databases/ledgerDigestUploads/*",
|                                                    "Microsoft.Sql/locations/ledgerDigestUploadsAzureAsyncOperation/read",
|                                                    "Microsoft.Sql/locations/ledgerDigestUploadsOperationResults/read",
|                                                    "Microsoft.Sql/servers/externalPolicyBasedAuthorizations/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "17d1049b-9a84-46fb-8f53-869881c3d3ab",
|                                    "Name":  "Storage Account Contributor",
|                                    "Description":  "Lets you manage storage accounts, including accessing storage account keys which provide full access to storage account data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/diagnosticSettings/*",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6d8ee4ec-f05a-4a1d-8b00-a9b17e38b437",
|                                    "Name":  "SQL Server Contributor",
|                                    "Description":  "Lets you manage SQL servers and databases, but not access to them, and not their security -related policies.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Sql/locations/*/read",
|                                                    "Microsoft.Sql/servers/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/metricDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.Sql/managedInstances/databases/currentSensitivityLabels/*",
|                                                       "Microsoft.Sql/managedInstances/databases/recommendedSensitivityLabels/*",
|                                                       "Microsoft.Sql/managedInstances/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                       "Microsoft.Sql/managedInstances/databases/securityAlertPolicies/*",
|                                                       "Microsoft.Sql/managedInstances/databases/sensitivityLabels/*",
|                                                       "Microsoft.Sql/managedInstances/databases/vulnerabilityAssessments/*",
|                                                       "Microsoft.Sql/managedInstances/securityAlertPolicies/*",
|                                                       "Microsoft.Sql/managedInstances/vulnerabilityAssessments/*",
|                                                       "Microsoft.Sql/servers/auditingSettings/*",
|                                                       "Microsoft.Sql/servers/databases/auditingSettings/*",
|                                                       "Microsoft.Sql/servers/databases/auditRecords/read",
|                                                       "Microsoft.Sql/servers/databases/currentSensitivityLabels/*",
|                                                       "Microsoft.Sql/servers/databases/dataMaskingPolicies/*",
|                                                       "Microsoft.Sql/servers/databases/extendedAuditingSettings/*",
|                                                       "Microsoft.Sql/servers/databases/recommendedSensitivityLabels/*",
|                                                       "Microsoft.Sql/servers/databases/schemas/tables/columns/sensitivityLabels/*",
|                                                       "Microsoft.Sql/servers/databases/securityAlertPolicies/*",
|                                                       "Microsoft.Sql/servers/databases/securityMetrics/*",
|                                                       "Microsoft.Sql/servers/databases/sensitivityLabels/*",
|                                                       "Microsoft.Sql/servers/databases/vulnerabilityAssessments/*",
|                                                       "Microsoft.Sql/servers/databases/vulnerabilityAssessmentScans/*",
|                                                       "Microsoft.Sql/servers/databases/vulnerabilityAssessmentSettings/*",
|                                                       "Microsoft.Sql/servers/devOpsAuditingSettings/*",
|                                                       "Microsoft.Sql/servers/extendedAuditingSettings/*",
|                                                       "Microsoft.Sql/servers/securityAlertPolicies/*",
|                                                       "Microsoft.Sql/servers/vulnerabilityAssessments/*",
|                                                       "Microsoft.Sql/servers/azureADOnlyAuthentications/delete",
|                                                       "Microsoft.Sql/servers/azureADOnlyAuthentications/write",
|                                                       "Microsoft.Sql/servers/externalPolicyBasedAuthorizations/delete",
|                                                       "Microsoft.Sql/servers/externalPolicyBasedAuthorizations/write"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "81a9662b-bebf-436f-a333-f67b29880f12",
|                                    "Name":  "Storage Account Key Operator Service Role",
|                                    "Description":  "Storage Account Key Operators are allowed to list and regenerate keys on Storage Accounts",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                    "Microsoft.Storage/storageAccounts/regeneratekey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
|                                    "Name":  "Storage Blob Data Contributor",
|                                    "Description":  "Allows for read, write and delete access to Azure Storage blob containers and data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b7e6dc6d-f1e8-4753-8033-0f276bb0955b",
|                                    "Name":  "Storage Blob Data Owner",
|                                    "Description":  "Allows for full access to Azure Storage blob containers and data, including assigning POSIX access control.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/*",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
|                                    "Name":  "Storage Blob Data Reader",
|                                    "Description":  "Allows for read access to Azure Storage blob containers and data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "974c5e8b-45b9-4653-ba55-5f855dd0fb88",
|                                    "Name":  "Storage Queue Data Contributor",
|                                    "Description":  "Allows for read, write, and delete access to Azure Storage queues and queue messages",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/queueServices/queues/delete",
|                                                    "Microsoft.Storage/storageAccounts/queueServices/queues/read",
|                                                    "Microsoft.Storage/storageAccounts/queueServices/queues/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/queueServices/queues/messages/delete",
|                                                        "Microsoft.Storage/storageAccounts/queueServices/queues/messages/read",
|                                                        "Microsoft.Storage/storageAccounts/queueServices/queues/messages/write",
|                                                        "Microsoft.Storage/storageAccounts/queueServices/queues/messages/process/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8a0f0c08-91a1-4084-bc3d-661d67233fed",
|                                    "Name":  "Storage Queue Data Message Processor",
|                                    "Description":  "Allows for peek, receive, and delete access to Azure Storage queue messages",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/queueServices/queues/messages/read",
|                                                        "Microsoft.Storage/storageAccounts/queueServices/queues/messages/process/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c6a89b2d-59bc-44d0-9896-0f6e12d7b80a",
|                                    "Name":  "Storage Queue Data Message Sender",
|                                    "Description":  "Allows for sending of Azure Storage queue messages",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/queueServices/queues/messages/add/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "19e7f393-937e-4f77-808e-94535e297925",
|                                    "Name":  "Storage Queue Data Reader",
|                                    "Description":  "Allows for read access to Azure Storage queues and queue messages",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/queueServices/queues/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/queueServices/queues/messages/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cfd33db0-3dd1-45e3-aa9d-cdbdf3b6f24e",
|                                    "Name":  "Support Request Contributor",
|                                    "Description":  "Lets you create and manage Support requests",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a4b10055-b0c7-44c2-b00f-c7b5b3550cf7",
|                                    "Name":  "Traffic Manager Contributor",
|                                    "Description":  "Lets you manage Traffic Manager profiles, but does not let you control who has access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Network/trafficManagerProfiles/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "18d7d88d-d35e-4fb5-a5c3-7773c20a72d9",
|                                    "Name":  "User Access Administrator",
|                                    "Description":  "Lets you manage user access to Azure resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.Authorization/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9980e02c-c2be-4d73-94e8-173b1dc7cf3c",
|                                    "Name":  "Virtual Machine Contributor",
|                                    "Description":  "Lets you manage virtual machines, but not access to them, and not the virtual network or storage account they\u0027re connected to.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Compute/availabilitySets/*",
|                                                    "Microsoft.Compute/locations/*",
|                                                    "Microsoft.Compute/virtualMachines/*",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/*",
|                                                    "Microsoft.Compute/cloudServices/*",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/hostgroups/write",
|                                                    "Microsoft.Compute/hostgroups/hosts/write",
|                                                    "Microsoft.DevTestLab/schedules/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Network/applicationGateways/backendAddressPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/inboundNatPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
|                                                    "Microsoft.Network/loadBalancers/probes/join/action",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/locations/*",
|                                                    "Microsoft.Network/networkInterfaces/*",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/publicIPAddresses/join/action",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.RecoveryServices/locations/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/write",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/*/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/write",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/write",
|                                                    "Microsoft.RecoveryServices/Vaults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                    "Microsoft.RecoveryServices/Vaults/write",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.SerialConsole/serialPorts/connect/action",
|                                                    "Microsoft.SqlVirtualMachine/*",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b",
|                                    "Name":  "Web Plan Contributor",
|                                    "Description":  "Lets you manage the web plans for websites, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Web/serverFarms/*",
|                                                    "Microsoft.Web/hostingEnvironments/Join/Action",
|                                                    "Microsoft.Insights/autoscalesettings/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "de139f84-1756-47ae-9be6-808fbbe84772",
|                                    "Name":  "Website Contributor",
|                                    "Description":  "Lets you manage websites (not web plans), but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/components/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Web/certificates/*",
|                                                    "Microsoft.Web/listSitesAssignedToHostName/read",
|                                                    "Microsoft.Web/register/action",
|                                                    "Microsoft.Web/serverFarms/join/action",
|                                                    "Microsoft.Web/serverFarms/read",
|                                                    "Microsoft.Web/sites/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "090c5cfd-751d-490a-894a-3ce6f1109419",
|                                    "Name":  "Azure Service Bus Data Owner",
|                                    "Description":  "Allows for full access to Azure Service Bus resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ServiceBus/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ServiceBus/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f526a384-b230-433a-b45c-95f59c4a2dec",
|                                    "Name":  "Azure Event Hubs Data Owner",
|                                    "Description":  "Allows for full access to Azure Event Hubs resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EventHub/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventHub/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bbf86eb8-f7b4-4cce-96e4-18cddf81d86e",
|                                    "Name":  "Attestation Contributor",
|                                    "Description":  "Can read write or delete the attestation provider instance",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Attestation/attestationProviders/attestation/read",
|                                                    "Microsoft.Attestation/attestationProviders/attestation/write",
|                                                    "Microsoft.Attestation/attestationProviders/attestation/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "61ed4efc-fab3-44fd-b111-e24485cc132a",
|                                    "Name":  "HDInsight Cluster Operator",
|                                    "Description":  "Lets you read and modify HDInsight cluster configurations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HDInsight/*/read",
|                                                    "Microsoft.HDInsight/clusters/getGatewaySettings/action",
|                                                    "Microsoft.HDInsight/clusters/updateGatewaySettings/action",
|                                                    "Microsoft.HDInsight/clusters/configurations/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "230815da-be43-4aae-9cb4-875f7bd000aa",
|                                    "Name":  "Cosmos DB Operator",
|                                    "Description":  "Lets you manage Azure Cosmos DB accounts, but not access data in them. Prevents access to account keys and connection strings.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DocumentDb/databaseAccounts/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.DocumentDB/databaseAccounts/copyJobs/*",
|                                                       "Microsoft.DocumentDB/databaseAccounts/dataTransferJobs/*",
|                                                       "Microsoft.DocumentDB/databaseAccounts/readonlyKeys/*",
|                                                       "Microsoft.DocumentDB/databaseAccounts/regenerateKey/*",
|                                                       "Microsoft.DocumentDB/databaseAccounts/listKeys/*",
|                                                       "Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/*",
|                                                       "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions/write",
|                                                       "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions/delete",
|                                                       "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/write",
|                                                       "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/delete",
|                                                       "Microsoft.DocumentDB/databaseAccounts/mongodbRoleDefinitions/write",
|                                                       "Microsoft.DocumentDB/databaseAccounts/mongodbRoleDefinitions/delete",
|                                                       "Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/write",
|                                                       "Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/delete"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "48b40c6e-82e0-4eb3-90d5-19e40f49b624",
|                                    "Name":  "Hybrid Server Resource Administrator",
|                                    "Description":  "Can read, write, delete, and re-onboard Hybrid servers to the Hybrid Resource Provider.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/machines/*",
|                                                    "Microsoft.HybridCompute/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d1e5ee4-7c68-4a71-ac8b-0739630a3dfb",
|                                    "Name":  "Hybrid Server Onboarding",
|                                    "Description":  "Can onboard new Hybrid servers to the Hybrid Resource Provider.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a638d3c7-ab3a-418d-83e6-5f17a39d4fde",
|                                    "Name":  "Azure Event Hubs Data Receiver",
|                                    "Description":  "Allows receive access to Azure Event Hubs resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EventHub/*/eventhubs/consumergroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventHub/*/receive/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2b629674-e913-4c01-ae53-ef4638d8f975",
|                                    "Name":  "Azure Event Hubs Data Sender",
|                                    "Description":  "Allows send access to Azure Event Hubs resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EventHub/*/eventhubs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventHub/*/send/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4f6d3b9b-027b-4f4c-9142-0e5a2a2247e0",
|                                    "Name":  "Azure Service Bus Data Receiver",
|                                    "Description":  "Allows for receive access to Azure Service Bus resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ServiceBus/*/queues/read",
|                                                    "Microsoft.ServiceBus/*/topics/read",
|                                                    "Microsoft.ServiceBus/*/topics/subscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ServiceBus/*/receive/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "69a216fc-b8fb-44d8-bc22-1f3c2cd27a39",
|                                    "Name":  "Azure Service Bus Data Sender",
|                                    "Description":  "Allows for send access to Azure Service Bus resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ServiceBus/*/queues/read",
|                                                    "Microsoft.ServiceBus/*/topics/read",
|                                                    "Microsoft.ServiceBus/*/topics/subscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ServiceBus/*/send/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "aba4ae5f-2193-4029-9191-0cb91df5e314",
|                                    "Name":  "Storage File Data SMB Share Reader",
|                                    "Description":  "Allows for read access to Azure File Share over SMB",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb",
|                                    "Name":  "Storage File Data SMB Share Contributor",
|                                    "Description":  "Allows for read, write, and delete access in Azure Storage file shares over SMB",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b12aa53e-6015-4669-85d0-8515ebb3ae7f",
|                                    "Name":  "Private DNS Zone Contributor",
|                                    "Description":  "Lets you manage private DNS zone resources, but not the virtual networks they are linked to.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Network/privateDnsZones/*",
|                                                    "Microsoft.Network/privateDnsOperationResults/*",
|                                                    "Microsoft.Network/privateDnsOperationStatuses/*",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "db58b8e5-c6ad-4a2a-8342-4190687cbf4a",
|                                    "Name":  "Storage Blob Delegator",
|                                    "Description":  "Allows for generation of a user delegation key which can be used to sign SAS tokens",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1d18fff3-a72a-46b5-b4a9-0b38a3cd7e63",
|                                    "Name":  "Desktop Virtualization User",
|                                    "Description":  "Allows user to use the applications in an application group.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DesktopVirtualization/applicationGroups/useApplications/action",
|                                                        "Microsoft.DesktopVirtualization/appAttachPackages/useApplications/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a7264617-510b-434b-a828-9731dc254ea7",
|                                    "Name":  "Storage File Data SMB Share Elevated Contributor",
|                                    "Description":  "Allows for read, write, delete and modify NTFS permission access in Azure Storage file shares over SMB",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "41077137-e803-4205-871c-5a86e6a753b4",
|                                    "Name":  "Blueprint Contributor",
|                                    "Description":  "Can manage blueprint definitions, but not assign them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Blueprint/blueprints/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "437d2ced-4a38-4302-8479-ed2bcb43d090",
|                                    "Name":  "Blueprint Operator",
|                                    "Description":  "Can assign existing published blueprints, but cannot create new blueprints. NOTE: this only works if the assignment is done with a user-assigned managed identity.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Blueprint/blueprintAssignments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ab8e14d6-4a74-4a29-9ba8-549422addade",
|                                    "Name":  "Microsoft Sentinel Contributor",
|                                    "Description":  "Microsoft Sentinel Contributor",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SecurityInsights/*",
|                                                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                    "Microsoft.OperationalInsights/workspaces/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/*",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.OperationalInsights/querypacks/*/read",
|                                                    "Microsoft.Insights/workbooks/*",
|                                                    "Microsoft.Insights/myworkbooks/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                       "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3e150937-b8fe-4cfb-8069-0eaf05ecd056",
|                                    "Name":  "Microsoft Sentinel Responder",
|                                    "Description":  "Microsoft Sentinel Responder",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SecurityInsights/*/read",
|                                                    "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                    "Microsoft.SecurityInsights/automationRules/*",
|                                                    "Microsoft.SecurityInsights/cases/*",
|                                                    "Microsoft.SecurityInsights/incidents/*",
|                                                    "Microsoft.SecurityInsights/entities/runPlaybook/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/bulkTag/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/replaceTags/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/systems/undoAction/action",
|                                                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                    "Microsoft.OperationalInsights/workspaces/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.OperationalInsights/querypacks/*/read",
|                                                    "Microsoft.Insights/workbooks/read",
|                                                    "Microsoft.Insights/myworkbooks/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.SecurityInsights/cases/*/Delete",
|                                                       "Microsoft.SecurityInsights/incidents/*/Delete",
|                                                       "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                       "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8d289c81-5878-46d4-8554-54e1e3d8b5cb",
|                                    "Name":  "Microsoft Sentinel Reader",
|                                    "Description":  "Microsoft Sentinel Reader",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SecurityInsights/*/read",
|                                                    "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                    "Microsoft.OperationalInsights/workspaces/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/LinkedServices/read",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                    "Microsoft.OperationalInsights/querypacks/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.Insights/workbooks/read",
|                                                    "Microsoft.Insights/myworkbooks/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/templateSpecs/*/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                       "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "66bb4e9e-b016-4a94-8249-4c0511c2be84",
|                                    "Name":  "Policy Insights Data Writer (Preview)",
|                                    "Description":  "Allows read access to resource policies and write access to resource component policy events.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/policyassignments/read",
|                                                    "Microsoft.Authorization/policydefinitions/read",
|                                                    "Microsoft.Authorization/policyexemptions/read",
|                                                    "Microsoft.Authorization/policysetdefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.PolicyInsights/checkDataPolicyCompliance/action",
|                                                        "Microsoft.PolicyInsights/policyEvents/logDataEvents/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "04165923-9d83-45d5-8227-78b77b0a687e",
|                                    "Name":  "SignalR AccessKey Reader",
|                                    "Description":  "Read SignalR Service Access Keys",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SignalRService/*/read",
|                                                    "Microsoft.SignalRService/SignalR/listkeys/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8cf5e20a-e4b2-4e9d-b3a1-5ceb692c2761",
|                                    "Name":  "SignalR/Web PubSub Contributor",
|                                    "Description":  "Create, Read, Update, and Delete SignalR service resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SignalRService/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b64e21ea-ac4e-4cdf-9dc9-5b892992bee7",
|                                    "Name":  "Azure Connected Machine Onboarding",
|                                    "Description":  "Can onboard Azure Connected Machines.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/settings/read",
|                                                    "Microsoft.HybridCompute/settings/write",
|                                                    "Microsoft.HybridCompute/gateways/read",
|                                                    "Microsoft.HybridCompute/privateLinkScopes/read",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                    "Microsoft.Insights/dataCollectionRuleAssociations/write",
|                                                    "Microsoft.Insights/dataCollectionRuleAssociations/delete",
|                                                    "Microsoft.Insights/dataCollectionRuleAssociations/read",
|                                                    "Microsoft.HybridCompute/machines/addExtensions/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "91c1777a-f3dc-4fae-b103-61d183457e46",
|                                    "Name":  "Managed Services Registration assignment Delete Role",
|                                    "Description":  "Managed Services Registration Assignment Delete Role allows the managing tenant users to delete the registration assignment assigned to their tenant.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ManagedServices/registrationAssignments/read",
|                                                    "Microsoft.ManagedServices/registrationAssignments/delete",
|                                                    "Microsoft.ManagedServices/operationStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5ae67dd6-50cb-40e7-96ff-dc2bfa4b606b",
|                                    "Name":  "App Configuration Data Owner",
|                                    "Description":  "Allows full access to App Configuration data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppConfiguration/configurationStores/*/read",
|                                                        "Microsoft.AppConfiguration/configurationStores/*/write",
|                                                        "Microsoft.AppConfiguration/configurationStores/*/delete",
|                                                        "Microsoft.AppConfiguration/configurationStores/*/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "516239f1-63e1-4d78-a4de-a74fb236a071",
|                                    "Name":  "App Configuration Data Reader",
|                                    "Description":  "Allows read access to App Configuration data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppConfiguration/configurationStores/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "34e09817-6cbe-4d01-b1a2-e0eac5743d41",
|                                    "Name":  "Kubernetes Cluster - Azure Arc Onboarding",
|                                    "Description":  "Role definition to authorize any user/service to create connectedClusters resource",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Kubernetes/connectedClusters/Write",
|                                                    "Microsoft.Kubernetes/connectedClusters/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7f646f1b-fa08-80eb-a22b-edd6ce5c915c",
|                                    "Name":  "Experimentation Contributor",
|                                    "Description":  "Experimentation Contributor",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/read",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/write",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/delete",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/experiment/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/emergencystop/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/read",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/write",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "466ccd10-b268-4a11-b098-b4849f024126",
|                                    "Name":  "Cognitive Services QnA Maker Reader",
|                                    "Description":  "Let’s you read and test a KB only.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/download/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/generateanswer/action",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/alterations/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/endpointkeys/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/endpointsettings/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/download/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/generateanswer/action",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/alterations/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointkeys/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointsettings/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/download/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/generateanswer/action",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/alterations/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointkeys/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointsettings/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f4cc2bf9-21be-47a1-bdf1-5c5804381025",
|                                    "Name":  "Cognitive Services QnA Maker Editor",
|                                    "Description":  "Let’s you create, edit, import and export a KB. You cannot publish or delete a KB.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/download/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/create/write",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/write",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/generateanswer/action",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/knowledgebases/train/action",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/alterations/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/alterations/write",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/endpointkeys/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/endpointkeys/refreshkeys/action",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/endpointsettings/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/endpointsettings/write",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker/operations/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/download/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/create/write",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/write",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/generateanswer/action",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/knowledgebases/train/action",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/alterations/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/alterations/write",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointkeys/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointkeys/refreshkeys/action",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointsettings/read",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/endpointsettings/write",
|                                                        "Microsoft.CognitiveServices/accounts/QnAMaker.v2/operations/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/download/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/create/write",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/write",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/generateanswer/action",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/knowledgebases/train/action",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/alterations/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/alterations/write",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointkeys/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointkeys/refreshkeys/action",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointsettings/read",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/endpointsettings/write",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/QnAMaker/operations/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7f646f1b-fa08-80eb-a33b-edd6ce5c915c",
|                                    "Name":  "Experimentation Administrator",
|                                    "Description":  "Experimentation Administrator",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/admin/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/read",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/write",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/delete",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/experimentadmin/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/experiment/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/emergencystop/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/read",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/write",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/delete",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/admin/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/metricwrite/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/metricwrite/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3df8b902-2a6f-47c7-8cc5-360e9b272a7e",
|                                    "Name":  "Remote Rendering Administrator",
|                                    "Description":  "Provides user with conversion, manage session, rendering and diagnostics capabilities for Azure Remote Rendering",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/convert/action",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/convert/read",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/convert/delete",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/read",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/action",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/delete",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/render/read",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/diagnostic/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d39065c4-c120-43c9-ab0a-63eed9795f0a",
|                                    "Name":  "Remote Rendering Client",
|                                    "Description":  "Provides user with manage session, rendering and diagnostics capabilities for Azure Remote Rendering.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/read",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/action",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/managesessions/delete",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/render/read",
|                                                        "Microsoft.MixedReality/RemoteRenderingAccounts/diagnostic/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "641177b8-a67a-45b9-a033-47bc880bb21e",
|                                    "Name":  "Managed Application Contributor Role",
|                                    "Description":  "Allows for creating managed application resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.Solutions/applications/*",
|                                                    "Microsoft.Solutions/register/action",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/*",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "612c2aa1-cb24-443b-ac28-3ab7272de6f5",
|                                    "Name":  "Security Assessment Contributor",
|                                    "Description":  "Lets you push assessments to Security Center",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Security/assessments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4a9ae827-6dc8-4573-8ac7-8239d42aa03f",
|                                    "Name":  "Tag Contributor",
|                                    "Description":  "Lets you manage tags on entities, without providing access to the entities themselves.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/resources/read",
|                                                    "Microsoft.Resources/subscriptions/resources/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Resources/tags/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c7aa55d3-1abb-444a-a5ca-5e51e485d6ec",
|                                    "Name":  "Integration Service Environment Developer",
|                                    "Description":  "Allows developers to create and update workflows, integration accounts and API connections in integration service environments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Logic/integrationServiceEnvironments/read",
|                                                    "Microsoft.Logic/integrationServiceEnvironments/*/join/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a41e2c5b-bd99-4a07-88f4-9bf657a760b8",
|                                    "Name":  "Integration Service Environment Contributor",
|                                    "Description":  "Lets you manage integration service environments, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Logic/integrationServiceEnvironments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8",
|                                    "Name":  "Azure Kubernetes Service Contributor Role",
|                                    "Description":  "Grants access to read and write Azure Kubernetes Service clusters",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ContainerService/locations/*",
|                                                    "Microsoft.ContainerService/managedClusters/*",
|                                                    "Microsoft.ContainerService/managedclustersnapshots/*",
|                                                    "Microsoft.ContainerService/snapshots/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/deploymentSafeguards/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d57506d4-4c8d-48b1-8587-93c323f6a5a3",
|                                    "Name":  "Azure Digital Twins Data Reader",
|                                    "Description":  "Read-only role for Digital Twins data-plane properties",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DigitalTwins/digitaltwins/read",
|                                                        "Microsoft.DigitalTwins/digitaltwins/relationships/read",
|                                                        "Microsoft.DigitalTwins/eventroutes/read",
|                                                        "Microsoft.DigitalTwins/jobs/import/read",
|                                                        "Microsoft.DigitalTwins/jobs/imports/read",
|                                                        "Microsoft.DigitalTwins/jobs/deletions/read",
|                                                        "Microsoft.DigitalTwins/models/read",
|                                                        "Microsoft.DigitalTwins/query/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bcd981a7-7f74-457b-83e1-cceb9e632ffe",
|                                    "Name":  "Azure Digital Twins Data Owner",
|                                    "Description":  "Full access role for Digital Twins data-plane",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DigitalTwins/digitaltwins/*",
|                                                        "Microsoft.DigitalTwins/digitaltwins/commands/*",
|                                                        "Microsoft.DigitalTwins/digitaltwins/relationships/*",
|                                                        "Microsoft.DigitalTwins/eventroutes/*",
|                                                        "Microsoft.DigitalTwins/jobs/*",
|                                                        "Microsoft.DigitalTwins/models/*",
|                                                        "Microsoft.DigitalTwins/query/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "350f8d15-c687-4448-8ae1-157740a3936d",
|                                    "Name":  "Hierarchy Settings Administrator",
|                                    "Description":  "Allows users to edit and delete Hierarchy Settings",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Management/managementGroups/settings/write",
|                                                    "Microsoft.Management/managementGroups/settings/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5a1fc7df-4bf1-4951-a576-89034ee01acd",
|                                    "Name":  "FHIR Data Contributor",
|                                    "Description":  "Role allows user or principal full access to FHIR Data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/*",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3db33094-8700-4567-8da5-1501d4e7e843",
|                                    "Name":  "FHIR Data Exporter",
|                                    "Description":  "Role allows user or principal to read and export FHIR Data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/export/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/export/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4c8d0bbc-75d3-4935-991f-5f3c56d81508",
|                                    "Name":  "FHIR Data Reader",
|                                    "Description":  "Role allows user or principal to read FHIR Data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3f88fce4-5892-4214-ae73-ba5294559913",
|                                    "Name":  "FHIR Data Writer",
|                                    "Description":  "Role allows user or principal to read and write FHIR Data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/write",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/delete",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/export/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/resourceValidate/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/reindex/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/convertData/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/editProfileDefinitions/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/import/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/write",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/delete",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/export/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/resourceValidate/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/reindex/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/convertData/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/editProfileDefinitions/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/import/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "49632ef5-d9ac-41f4-b8e7-bbe587fa74a1",
|                                    "Name":  "Experimentation Reader",
|                                    "Description":  "Experimentation Reader",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Experimentation/experimentWorkspaces/read",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4dd61c23-6743-42fe-a388-d8bdd41cb745",
|                                    "Name":  "Object Understanding Account Owner",
|                                    "Description":  "Provides user with ingestion capabilities for Azure Object Understanding.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/ObjectUnderstandingAccounts/ingest/action",
|                                                        "Microsoft.MixedReality/ObjectUnderstandingAccounts/ingest/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8f5e0ce6-4f7b-4dcf-bddf-e6f48634a204",
|                                    "Name":  "Azure Maps Data Contributor",
|                                    "Description":  "Grants access to read, write, and delete access to map related data from an Azure maps account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Maps/accounts/*/read",
|                                                        "Microsoft.Maps/accounts/*/write",
|                                                        "Microsoft.Maps/accounts/*/delete",
|                                                        "Microsoft.Maps/accounts/*/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c1ff6cc2-c111-46fe-8896-e0ef812ad9f3",
|                                    "Name":  "Cognitive Services Custom Vision Contributor",
|                                    "Description":  "Full access to the project, including the ability to view, create, edit, or delete projects.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5c4089e1-6d96-4d2f-b296-c1bc7137275f",
|                                    "Name":  "Cognitive Services Custom Vision Deployment",
|                                    "Description":  "Publish, unpublish or export models. Deployment can view the project but can’t update.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/predictions/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/iterations/publish/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/iterations/export/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/quicktest/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/classify/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/detect/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "88424f51-ebe7-446f-bc41-7fa16989e96c",
|                                    "Name":  "Cognitive Services Custom Vision Labeler",
|                                    "Description":  "View, edit training images and create, add, remove, or delete the image tags. Labelers can view the project but can’t update anything other than training images and tags.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/predictions/query/action",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/images/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/tags/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/images/suggested/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/tagsandregions/suggestions/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "93586559-c37d-4a6b-ba08-b9f0940c2d73",
|                                    "Name":  "Cognitive Services Custom Vision Reader",
|                                    "Description":  "Read-only actions in the project. Readers can’t create or update the project.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/projects/predictions/query/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0a5ae4ab-0d65-4eeb-be61-29fc9b54394b",
|                                    "Name":  "Cognitive Services Custom Vision Trainer",
|                                    "Description":  "View, edit projects and train the models, including the ability to publish, unpublish, export the models. Trainers can’t create or delete the project.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/CustomVision/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "00482a5a-887f-4fb3-b363-3b7fe8e74483",
|                                    "Name":  "Key Vault Administrator",
|                                    "Description":  "Perform all data plane operations on a key vault and all objects in it, including certificates, keys, and secrets. Cannot manage key vault resources or manage role assignments. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.KeyVault/checkNameAvailability/read",
|                                                    "Microsoft.KeyVault/deletedVaults/read",
|                                                    "Microsoft.KeyVault/locations/*/read",
|                                                    "Microsoft.KeyVault/vaults/*/read",
|                                                    "Microsoft.KeyVault/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "12338af0-0e69-4776-bea7-57ae8d297424",
|                                    "Name":  "Key Vault Crypto User",
|                                    "Description":  "Perform cryptographic operations using keys. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/keys/read",
|                                                        "Microsoft.KeyVault/vaults/keys/update/action",
|                                                        "Microsoft.KeyVault/vaults/keys/backup/action",
|                                                        "Microsoft.KeyVault/vaults/keys/encrypt/action",
|                                                        "Microsoft.KeyVault/vaults/keys/decrypt/action",
|                                                        "Microsoft.KeyVault/vaults/keys/wrap/action",
|                                                        "Microsoft.KeyVault/vaults/keys/unwrap/action",
|                                                        "Microsoft.KeyVault/vaults/keys/sign/action",
|                                                        "Microsoft.KeyVault/vaults/keys/verify/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b86a8fe4-44ce-4948-aee5-eccb2c155cd7",
|                                    "Name":  "Key Vault Secrets Officer",
|                                    "Description":  "Perform any action on the secrets of a key vault, except manage permissions. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.KeyVault/checkNameAvailability/read",
|                                                    "Microsoft.KeyVault/deletedVaults/read",
|                                                    "Microsoft.KeyVault/locations/*/read",
|                                                    "Microsoft.KeyVault/vaults/*/read",
|                                                    "Microsoft.KeyVault/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/secrets/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4633458b-17de-408a-b874-0445c86b69e6",
|                                    "Name":  "Key Vault Secrets User",
|                                    "Description":  "Read secret contents. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/secrets/getSecret/action",
|                                                        "Microsoft.KeyVault/vaults/secrets/readMetadata/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a4417e6f-fecd-4de8-b567-7b0420556985",
|                                    "Name":  "Key Vault Certificates Officer",
|                                    "Description":  "Perform any action on the certificates of a key vault, except manage permissions. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.KeyVault/checkNameAvailability/read",
|                                                    "Microsoft.KeyVault/deletedVaults/read",
|                                                    "Microsoft.KeyVault/locations/*/read",
|                                                    "Microsoft.KeyVault/vaults/*/read",
|                                                    "Microsoft.KeyVault/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/certificatecas/*",
|                                                        "Microsoft.KeyVault/vaults/certificates/*",
|                                                        "Microsoft.KeyVault/vaults/certificatecontacts/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "21090545-7ca7-4776-b22c-e363652d74d2",
|                                    "Name":  "Key Vault Reader",
|                                    "Description":  "Read metadata of key vaults and its certificates, keys, and secrets. Cannot read sensitive values such as secret contents or key material. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.KeyVault/checkNameAvailability/read",
|                                                    "Microsoft.KeyVault/deletedVaults/read",
|                                                    "Microsoft.KeyVault/locations/*/read",
|                                                    "Microsoft.KeyVault/vaults/*/read",
|                                                    "Microsoft.KeyVault/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/*/read",
|                                                        "Microsoft.KeyVault/vaults/secrets/readMetadata/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e147488a-f6f5-4113-8e2d-b22465e65bf6",
|                                    "Name":  "Key Vault Crypto Service Encryption User",
|                                    "Description":  "Read metadata of keys and perform wrap/unwrap operations. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EventGrid/eventSubscriptions/write",
|                                                    "Microsoft.EventGrid/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/eventSubscriptions/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/keys/read",
|                                                        "Microsoft.KeyVault/vaults/keys/wrap/action",
|                                                        "Microsoft.KeyVault/vaults/keys/unwrap/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "63f0a09d-1495-4db4-a681-037d84835eb4",
|                                    "Name":  "Azure Arc Kubernetes Viewer",
|                                    "Description":  "Lets you view all resources in cluster/namespace, except secrets.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/deployments/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/batch/jobs/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/configmaps/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/endpoints/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/events/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/pods/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/services/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5b999177-9696-4545-85c7-50de3797e5a1",
|                                    "Name":  "Azure Arc Kubernetes Writer",
|                                    "Description":  "Lets you update everything in cluster/namespace, except (cluster)roles and (cluster)role bindings.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/configmaps/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/endpoints/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/events/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/pods/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/secrets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/services/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8393591c-06b9-48a2-a542-1bd6b377f6a2",
|                                    "Name":  "Azure Arc Kubernetes Cluster Admin",
|                                    "Description":  "Lets you manage all resources in the cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Kubernetes/connectedClusters/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dffb1e0c-446f-4dde-a09f-99eb5cc68b96",
|                                    "Name":  "Azure Arc Kubernetes Admin",
|                                    "Description":  "Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/authorization.k8s.io/localsubjectaccessreviews/write",
|                                                        "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/configmaps/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/endpoints/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/events/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/limitranges/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/namespaces/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/pods/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/rolebindings/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/roles/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",
|                                                        "Microsoft.Kubernetes/connectedClusters/secrets/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",
|                                                        "Microsoft.Kubernetes/connectedClusters/services/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b",
|                                    "Name":  "Azure Kubernetes Service RBAC Cluster Admin",
|                                    "Description":  "Lets you manage all resources in the cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/managedClusters/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3498e952-d568-435e-9b2c-8d77e338d7f7",
|                                    "Name":  "Azure Kubernetes Service RBAC Admin",
|                                    "Description":  "Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/managedClusters/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7f6c6a51-bcf8-42ba-9220-52d62157d7db",
|                                    "Name":  "Azure Kubernetes Service RBAC Reader",
|                                    "Description":  "Allows read-only access to see most objects in a namespace. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation). Applying this role at cluster scope will give access across all namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/managedClusters/apps/daemonsets/read",
|                                                        "Microsoft.ContainerService/managedClusters/apps/deployments/read",
|                                                        "Microsoft.ContainerService/managedClusters/apps/replicasets/read",
|                                                        "Microsoft.ContainerService/managedClusters/apps/statefulsets/read",
|                                                        "Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/read",
|                                                        "Microsoft.ContainerService/managedClusters/batch/cronjobs/read",
|                                                        "Microsoft.ContainerService/managedClusters/batch/jobs/read",
|                                                        "Microsoft.ContainerService/managedClusters/configmaps/read",
|                                                        "Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read",
|                                                        "Microsoft.ContainerService/managedClusters/endpoints/read",
|                                                        "Microsoft.ContainerService/managedClusters/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/managedClusters/events/read",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/daemonsets/read",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/deployments/read",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/ingresses/read",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/networkpolicies/read",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/replicasets/read",
|                                                        "Microsoft.ContainerService/managedClusters/limitranges/read",
|                                                        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read",
|                                                        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read",
|                                                        "Microsoft.ContainerService/managedClusters/namespaces/read",
|                                                        "Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/read",
|                                                        "Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/read",
|                                                        "Microsoft.ContainerService/managedClusters/persistentvolumeclaims/read",
|                                                        "Microsoft.ContainerService/managedClusters/pods/read",
|                                                        "Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/read",
|                                                        "Microsoft.ContainerService/managedClusters/replicationcontrollers/read",
|                                                        "Microsoft.ContainerService/managedClusters/resourcequotas/read",
|                                                        "Microsoft.ContainerService/managedClusters/serviceaccounts/read",
|                                                        "Microsoft.ContainerService/managedClusters/services/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a7ffa36f-339b-4b5c-8bdf-e2c188b2c0eb",
|                                    "Name":  "Azure Kubernetes Service RBAC Writer",
|                                    "Description":  "Allows read/write access to most objects in a namespace.This role does not allow viewing or modifying roles or role bindings. However, this role allows accessing Secrets and running Pods as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace. Applying this role at cluster scope will give access across all namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/managedClusters/apps/daemonsets/*",
|                                                        "Microsoft.ContainerService/managedClusters/apps/deployments/*",
|                                                        "Microsoft.ContainerService/managedClusters/apps/replicasets/*",
|                                                        "Microsoft.ContainerService/managedClusters/apps/statefulsets/*",
|                                                        "Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/*",
|                                                        "Microsoft.ContainerService/managedClusters/batch/cronjobs/*",
|                                                        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/read",
|                                                        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/write",
|                                                        "Microsoft.ContainerService/managedClusters/coordination.k8s.io/leases/delete",
|                                                        "Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read",
|                                                        "Microsoft.ContainerService/managedClusters/batch/jobs/*",
|                                                        "Microsoft.ContainerService/managedClusters/configmaps/*",
|                                                        "Microsoft.ContainerService/managedClusters/endpoints/*",
|                                                        "Microsoft.ContainerService/managedClusters/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/managedClusters/events/*",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/daemonsets/*",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/deployments/*",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/ingresses/*",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/networkpolicies/*",
|                                                        "Microsoft.ContainerService/managedClusters/extensions/replicasets/*",
|                                                        "Microsoft.ContainerService/managedClusters/limitranges/read",
|                                                        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read",
|                                                        "Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read",
|                                                        "Microsoft.ContainerService/managedClusters/namespaces/read",
|                                                        "Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/*",
|                                                        "Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/*",
|                                                        "Microsoft.ContainerService/managedClusters/persistentvolumeclaims/*",
|                                                        "Microsoft.ContainerService/managedClusters/pods/*",
|                                                        "Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/*",
|                                                        "Microsoft.ContainerService/managedClusters/replicationcontrollers/*",
|                                                        "Microsoft.ContainerService/managedClusters/resourcequotas/read",
|                                                        "Microsoft.ContainerService/managedClusters/secrets/*",
|                                                        "Microsoft.ContainerService/managedClusters/serviceaccounts/*",
|                                                        "Microsoft.ContainerService/managedClusters/services/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "82200a5b-e217-47a5-b665-6d8765ee745b",
|                                    "Name":  "Services Hub Operator",
|                                    "Description":  "Services Hub Operator allows you to perform all read, write, and deletion operations related to Services Hub Connectors.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.ServicesHub/connectors/write",
|                                                    "Microsoft.ServicesHub/connectors/read",
|                                                    "Microsoft.ServicesHub/connectors/delete",
|                                                    "Microsoft.ServicesHub/connectors/checkAssessmentEntitlement/action",
|                                                    "Microsoft.ServicesHub/connectors/*",
|                                                    "Microsoft.ServicesHub/*",
|                                                    "Microsoft.ServicesHub/supportOfferingEntitlement/read",
|                                                    "Microsoft.ServicesHub/workspaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d18777c0-1514-4662-8490-608db7d334b6",
|                                    "Name":  "Object Understanding Account Reader",
|                                    "Description":  "Lets you read ingestion jobs for an object understanding account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/ObjectUnderstandingAccounts/ingest/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fd53cd77-2268-407a-8f46-7e7863d0f521",
|                                    "Name":  "SignalR REST API Owner",
|                                    "Description":  "Full access to Azure SignalR Service REST APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SignalRService/SignalR/auth/clientToken/action",
|                                                        "Microsoft.SignalRService/SignalR/hub/*",
|                                                        "Microsoft.SignalRService/SignalR/group/*",
|                                                        "Microsoft.SignalRService/SignalR/clientConnection/*",
|                                                        "Microsoft.SignalRService/SignalR/user/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "daa9e50b-21df-454c-94a6-a8050adab352",
|                                    "Name":  "Collaborative Data Contributor",
|                                    "Description":  "Can manage data packages of a collaborative.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.IndustryDataLifecycle/custodianCollaboratives/*/read",
|                                                    "Microsoft.IndustryDataLifecycle/memberCollaboratives/*/read",
|                                                    "Microsoft.IndustryDataLifecycle/locations/dataPackages/*",
|                                                    "Microsoft.IndustryDataLifecycle/custodianCollaboratives/receivedDataPackages/*",
|                                                    "Microsoft.IndustryDataLifecycle/custodianCollaboratives/rejectDataPackage/action",
|                                                    "Microsoft.IndustryDataLifecycle/memberCollaboratives/sharedDataPackages/*",
|                                                    "Microsoft.IndustryDataLifecycle/custodianCollaboratives/dataModels/*",
|                                                    "Microsoft.IndustryDataLifecycle/custodianCollaboratives/auditLogs/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e9dba6fb-3d52-4cf0-bce3-f06ce71b9e0f",
|                                    "Name":  "Device Update Reader",
|                                    "Description":  "Gives you read access to management and content operations, but does not allow making changes",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.DeviceUpdate/accounts/read",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/read",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/management/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "02ca0879-e8e4-47a5-a61e-5c618b76e64a",
|                                    "Name":  "Device Update Administrator",
|                                    "Description":  "Gives you full access to management and content operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.DeviceUpdate/accounts/read",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/read",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/write",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/delete",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/management/read",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/management/write",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/management/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0378884a-3af5-44ab-8323-f5b22f9f3c98",
|                                    "Name":  "Device Update Content Administrator",
|                                    "Description":  "Gives you full access to content operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.DeviceUpdate/accounts/read",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/read",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/write",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d1ee9a80-8b14-47f0-bdc2-f4a351625a7b",
|                                    "Name":  "Device Update Content Reader",
|                                    "Description":  "Gives you read access to content operations, but does not allow making changes",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.DeviceUpdate/accounts/read",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cb43c632-a144-4ec5-977c-e80c4affc34a",
|                                    "Name":  "Cognitive Services Metrics Advisor Administrator",
|                                    "Description":  "Full access to the project, including the system level configuration.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/MetricsAdvisor/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3b20f47b-3825-43cb-8114-4bd2201156a8",
|                                    "Name":  "Cognitive Services Metrics Advisor User",
|                                    "Description":  "Access to the project.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/MetricsAdvisor/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2c56ea50-c6b3-40a6-83c0-9d98858bc7d2",
|                                    "Name":  "Schema Registry Reader",
|                                    "Description":  "Read and list Schema Registry groups and schemas.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EventHub/namespaces/schemagroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventHub/namespaces/schemas/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5dffeca3-4936-4216-b2bc-10343a5abb25",
|                                    "Name":  "Schema Registry Contributor",
|                                    "Description":  "Read, write, and delete Schema Registry groups and schemas.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EventHub/namespaces/schemagroups/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventHub/namespaces/schemas/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7ec7ccdc-f61e-41fe-9aaf-980df0a44eba",
|                                    "Name":  "AgFood Platform Service Reader",
|                                    "Description":  "Provides read access to AgFood Platform Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/*/list/action",
|                                                        "Microsoft.AgFoodPlatform/*/read",
|                                                        "Microsoft.AgFoodPlatform/*/search/action",
|                                                        "Microsoft.AgFoodPlatform/*/download/action",
|                                                        "Microsoft.AgFoodPlatform/*/overlap/action",
|                                                        "Microsoft.AgFoodPlatform/*/checkConsent/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8508508a-4469-4e45-963b-2518ee0bb728",
|                                    "Name":  "AgFood Platform Service Contributor",
|                                    "Description":  "Provides contribute access to AgFood Platform Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/*/action",
|                                                        "Microsoft.AgFoodPlatform/*/read",
|                                                        "Microsoft.AgFoodPlatform/*/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f8da80de-1ff9-4747-ad80-a19b7f6079e3",
|                                    "Name":  "AgFood Platform Service Admin",
|                                    "Description":  "Provides admin access to AgFood Platform Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "18500a29-7fe2-46b2-a342-b16a415e101d",
|                                    "Name":  "Managed HSM contributor",
|                                    "Description":  "Lets you manage managed HSM pools, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.KeyVault/managedHSMs/*",
|                                                    "Microsoft.KeyVault/deletedManagedHsms/read",
|                                                    "Microsoft.KeyVault/locations/deletedManagedHsms/read",
|                                                    "Microsoft.KeyVault/locations/deletedManagedHsms/purge/action",
|                                                    "Microsoft.KeyVault/locations/managedHsmOperationResults/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0b555d9b-b4a7-4f43-b330-627f0e5be8f0",
|                                    "Name":  "Security Detonation Chamber Submitter",
|                                    "Description":  "Allowed to create submissions to Security Detonation Chamber",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/delete",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/write",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/read",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/files/read",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/accesskeyview/read",
|                                                        "Microsoft.SecurityDetonation/chambers/platforms/metadata/read",
|                                                        "Microsoft.SecurityDetonation/chambers/workflows/metadata/read",
|                                                        "Microsoft.SecurityDetonation/chambers/toolsets/metadata/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ddde6b66-c0df-4114-a159-3618637b3035",
|                                    "Name":  "SignalR REST API Reader",
|                                    "Description":  "Read-only access to Azure SignalR Service REST APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SignalRService/SignalR/group/read",
|                                                        "Microsoft.SignalRService/SignalR/clientConnection/read",
|                                                        "Microsoft.SignalRService/SignalR/user/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7e4f1700-ea5a-4f59-8f37-079cfe29dce3",
|                                    "Name":  "SignalR Service Owner",
|                                    "Description":  "Full access to Azure SignalR Service REST APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SignalRService/SignalR/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f7b75c60-3036-4b75-91c3-6b41c27c1689",
|                                    "Name":  "Reservation Purchaser",
|                                    "Description":  "Lets you purchase reservations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Capacity/catalogs/read",
|                                                    "Microsoft.Capacity/register/action",
|                                                    "Microsoft.Compute/register/action",
|                                                    "Microsoft.Consumption/register/action",
|                                                    "Microsoft.Consumption/reservationRecommendationDetails/read",
|                                                    "Microsoft.Consumption/reservationRecommendations/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.SQL/register/action",
|                                                    "Microsoft.Support/supporttickets/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "635dd51f-9968-44d3-b7fb-6d9a6bd613ae",
|                                    "Name":  "AzureML Metrics Writer (preview)",
|                                    "Description":  "Lets you write metrics to AzureML workspace",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/metrics/*/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1",
|                                    "Name":  "Storage Account Backup Contributor",
|                                    "Description":  "Lets you perform backup and restore operations using Azure Backup on the storage account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Authorization/locks/read",
|                                                    "Microsoft.Authorization/locks/write",
|                                                    "Microsoft.Authorization/locks/delete",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/operations/read",
|                                                    "Microsoft.Storage/storageAccounts/objectReplicationPolicies/delete",
|                                                    "Microsoft.Storage/storageAccounts/objectReplicationPolicies/read",
|                                                    "Microsoft.Storage/storageAccounts/objectReplicationPolicies/write",
|                                                    "Microsoft.Storage/storageAccounts/objectReplicationPolicies/restorePointMarkers/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/write",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/restoreBlobRanges/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6188b7c9-7d01-4f99-a59f-c88b630326c0",
|                                    "Name":  "Experimentation Metric Contributor",
|                                    "Description":  "Allows for creation, writes and reads to the metric set via the metrics service APIs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/read",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/experimentationGroups/metricwrite/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/metricwrite/action",
|                                                        "Microsoft.Experimentation/experimentWorkspaces/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9ef4ef9c-a049-46b0-82ab-dd8ac094c889",
|                                    "Name":  "Project Babylon Data Curator",
|                                    "Description":  "The Microsoft.ProjectBabylon data curator can create, read, modify and delete catalog data objects and establish relationships between objects. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ProjectBabylon/accounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ProjectBabylon/accounts/data/read",
|                                                        "Microsoft.ProjectBabylon/accounts/data/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c8d896ba-346d-4f50-bc1d-7d1c84130446",
|                                    "Name":  "Project Babylon Data Reader",
|                                    "Description":  "The Microsoft.ProjectBabylon data reader can read catalog data objects. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ProjectBabylon/accounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ProjectBabylon/accounts/data/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "05b7651b-dc44-475e-b74d-df3db49fae0f",
|                                    "Name":  "Project Babylon Data Source Administrator",
|                                    "Description":  "The Microsoft.ProjectBabylon data source administrator can manage data sources and data scans. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ProjectBabylon/accounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ProjectBabylon/accounts/scan/read",
|                                                        "Microsoft.ProjectBabylon/accounts/scan/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ca6382a4-1721-4bcf-a114-ff0c70227b6b",
|                                    "Name":  "Application Group Contributor",
|                                    "Description":  "Contributor of the Application Group.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/applicationgroups/*",
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                    "Microsoft.DesktopVirtualization/workspaces/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "49a72310-ab8d-41df-bbb0-79b649203868",
|                                    "Name":  "Desktop Virtualization Reader",
|                                    "Description":  "Reader of Desktop Virtualization.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "082f0a83-3be5-4ba1-904c-961cca79b387",
|                                    "Name":  "Desktop Virtualization Contributor",
|                                    "Description":  "Contributor of Desktop Virtualization.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "21efdde3-836f-432b-bf3d-3e8e734d4b2b",
|                                    "Name":  "Desktop Virtualization Workspace Contributor",
|                                    "Description":  "Contributor of the Desktop Virtualization Workspace.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/workspaces/*",
|                                                    "Microsoft.DesktopVirtualization/applicationgroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ea4bfff8-7fb4-485a-aadd-d4129a0ffaa6",
|                                    "Name":  "Desktop Virtualization User Session Operator",
|                                    "Description":  "Operator of the Desktop Virtualization User Session.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2ad6aaab-ead9-4eaa-8ac5-da422f562408",
|                                    "Name":  "Desktop Virtualization Session Host Operator",
|                                    "Description":  "Operator of the Desktop Virtualization Session Host.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ceadfde2-b300-400a-ab7b-6143895aa822",
|                                    "Name":  "Desktop Virtualization Host Pool Reader",
|                                    "Description":  "Reader of the Desktop Virtualization Host Pool.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/hostpools/*/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e307426c-f9b6-4e81-87de-d99efb3c32bc",
|                                    "Name":  "Desktop Virtualization Host Pool Contributor",
|                                    "Description":  "Contributor of the Desktop Virtualization Host Pool.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/hostpools/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "aebf23d0-b568-4e86-b8f9-fe83a2c6ab55",
|                                    "Name":  "Desktop Virtualization Application Group Reader",
|                                    "Description":  "Reader of the Desktop Virtualization Application Group.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/applicationgroups/*/read",
|                                                    "Microsoft.DesktopVirtualization/applicationgroups/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "86240b0e-9422-4c43-887b-b61143f32ba8",
|                                    "Name":  "Desktop Virtualization Application Group Contributor",
|                                    "Description":  "Contributor of the Desktop Virtualization Application Group.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/applicationgroups/*",
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0fa44ee9-7a7d-466b-9bb2-2bf446b1204d",
|                                    "Name":  "Desktop Virtualization Workspace Reader",
|                                    "Description":  "Reader of the Desktop Virtualization Workspace.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/workspaces/read",
|                                                    "Microsoft.DesktopVirtualization/applicationgroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3e5e47e6-65f7-47ef-90b5-e5dd4d455f24",
|                                    "Name":  "Disk Backup Reader",
|                                    "Description":  "Provides permission to backup vault to perform disk backup.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b50d9833-a0cb-478e-945f-707fcc997c13",
|                                    "Name":  "Disk Restore Operator",
|                                    "Description":  "Provides permission to backup vault to perform disk restore.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action",
|                                                    "Microsoft.Compute/disks/endGetAccess/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7efff54f-a5b4-42b5-a1c5-5411624893ce",
|                                    "Name":  "Disk Snapshot Contributor",
|                                    "Description":  "Provides permission to backup vault to manage disk snapshots.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Compute/snapshots/delete",
|                                                    "Microsoft.Compute/snapshots/write",
|                                                    "Microsoft.Compute/snapshots/read",
|                                                    "Microsoft.Compute/snapshots/beginGetAccess/action",
|                                                    "Microsoft.Compute/snapshots/endGetAccess/action",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action",
|                                                    "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5548b2cf-c94c-4228-90ba-30851930a12f",
|                                    "Name":  "Microsoft.Kubernetes connected cluster role",
|                                    "Description":  "Microsoft.Kubernetes connected cluster role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Kubernetes/connectedClusters/read",
|                                                    "Microsoft.Kubernetes/connectedClusters/write",
|                                                    "Microsoft.Kubernetes/connectedClusters/delete",
|                                                    "Microsoft.Kubernetes/registeredSubscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a37b566d-3efa-4beb-a2f2-698963fa42ce",
|                                    "Name":  "Security Detonation Chamber Submission Manager",
|                                    "Description":  "Allowed to create and manage submissions to Security Detonation Chamber",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/delete",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/write",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/read",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/files/read",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/accesskeyview/read",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/adminview/read",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/analystview/read",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/publicview/read",
|                                                        "Microsoft.SecurityDetonation/chambers/platforms/metadata/read",
|                                                        "Microsoft.SecurityDetonation/chambers/workflows/metadata/read",
|                                                        "Microsoft.SecurityDetonation/chambers/toolsets/metadata/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "352470b3-6a9c-4686-b503-35deb827e500",
|                                    "Name":  "Security Detonation Chamber Publisher",
|                                    "Description":  "Allowed to publish and modify platforms, workflows and toolsets to Security Detonation Chamber",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SecurityDetonation/chambers/platforms/read",
|                                                        "Microsoft.SecurityDetonation/chambers/platforms/write",
|                                                        "Microsoft.SecurityDetonation/chambers/platforms/delete",
|                                                        "Microsoft.SecurityDetonation/chambers/platforms/metadata/read",
|                                                        "Microsoft.SecurityDetonation/chambers/workflows/read",
|                                                        "Microsoft.SecurityDetonation/chambers/workflows/write",
|                                                        "Microsoft.SecurityDetonation/chambers/workflows/delete",
|                                                        "Microsoft.SecurityDetonation/chambers/workflows/metadata/read",
|                                                        "Microsoft.SecurityDetonation/chambers/toolsets/read",
|                                                        "Microsoft.SecurityDetonation/chambers/toolsets/write",
|                                                        "Microsoft.SecurityDetonation/chambers/toolsets/delete",
|                                                        "Microsoft.SecurityDetonation/chambers/toolsets/metadata/read",
|                                                        "Microsoft.SecurityDetonation/chambers/publishRequests/read",
|                                                        "Microsoft.SecurityDetonation/chambers/publishRequests/cancel/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7a6f0e70-c033-4fb1-828c-08514e5f4102",
|                                    "Name":  "Collaborative Runtime Operator",
|                                    "Description":  "Can manage resources created by AICS at runtime",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.IndustryDataLifecycle/derivedModels/*",
|                                                    "Microsoft.IndustryDataLifecycle/pipelineSets/*",
|                                                    "Microsoft.IndustryDataLifecycle/modelMappings/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5432c526-bc82-444a-b7ba-57c5b0b5b34f",
|                                    "Name":  "CosmosRestoreOperator",
|                                    "Description":  "Can perform restore action for Cosmos DB database account with continuous backup mode",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DocumentDB/locations/restorableDatabaseAccounts/restore/action",
|                                                    "Microsoft.DocumentDB/locations/restorableDatabaseAccounts/*/read",
|                                                    "Microsoft.DocumentDB/locations/restorableDatabaseAccounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a1705bd2-3a8f-45a5-8683-466fcfd5cc24",
|                                    "Name":  "FHIR Data Converter",
|                                    "Description":  "Role allows user or principal to convert data from legacy format to FHIR",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/convertData/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/convertData/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0e5f05e5-9ab9-446b-b98d-1e2157c94125",
|                                    "Name":  "Quota Request Operator",
|                                    "Description":  "Read and create quota requests, get quota request status, and create support tickets.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Capacity/resourceProviders/locations/serviceLimits/read",
|                                                    "Microsoft.Capacity/resourceProviders/locations/serviceLimits/write",
|                                                    "Microsoft.Capacity/resourceProviders/locations/serviceLimitsRequests/read",
|                                                    "Microsoft.Capacity/register/action",
|                                                    "Microsoft.Quota/usages/read",
|                                                    "Microsoft.Quota/quotas/read",
|                                                    "Microsoft.Quota/quotas/write",
|                                                    "Microsoft.Quota/quotaRequests/read",
|                                                    "Microsoft.Quota/register/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1e241071-0855-49ea-94dc-649edcd759de",
|                                    "Name":  "EventGrid Contributor",
|                                    "Description":  "Lets you manage EventGrid operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.EventGrid/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "28241645-39f8-410b-ad48-87863e2951d5",
|                                    "Name":  "Security Detonation Chamber Reader",
|                                    "Description":  "Allowed to query submission info and files from Security Detonation Chamber",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/read",
|                                                        "Microsoft.SecurityDetonation/chambers/submissions/files/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4a167cdf-cb95-4554-9203-2347fe489bd9",
|                                    "Name":  "Object Anchors Account Reader",
|                                    "Description":  "Lets you read ingestion jobs for an object anchors account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/ObjectAnchorsAccounts/ingest/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ca0835dd-bacc-42dd-8ed2-ed5e7230d15b",
|                                    "Name":  "Object Anchors Account Owner",
|                                    "Description":  "Provides user with ingestion capabilities for an object anchors account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/ObjectAnchorsAccounts/ingest/action",
|                                                        "Microsoft.MixedReality/ObjectAnchorsAccounts/ingest/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d17ce0a2-0697-43bc-aac5-9113337ab61c",
|                                    "Name":  "WorkloadBuilder Migration Agent Role",
|                                    "Description":  "WorkloadBuilder Migration Agent Role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.WorkloadBuilder/migrationAgents/Read",
|                                                    "Microsoft.WorkloadBuilder/migrationAgents/Write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b5537268-8956-4941-a8f0-646150406f0c",
|                                    "Name":  "Azure Spring Cloud Data Reader",
|                                    "Description":  "Allow read access to Azure Spring Cloud Data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0e75ca1e-0464-4b4d-8b93-68208a576181",
|                                    "Name":  "Cognitive Services Speech Contributor",
|                                    "Description":  "Full access to Speech projects, including read, write and delete all entities, for real-time speech recognition and batch transcription tasks, real-time speech synthesis and long audio tasks, custom speech and custom voice.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVoice/*",
|                                                        "Microsoft.CognitiveServices/accounts/AudioContentCreation/*",
|                                                        "Microsoft.CognitiveServices/accounts/TTSPlayer/*",
|                                                        "Microsoft.CognitiveServices/accounts/VideoTranslation/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomAvatar/*",
|                                                        "Microsoft.CognitiveServices/accounts/BatchAvatar/*",
|                                                        "Microsoft.CognitiveServices/accounts/BatchTextToSpeech/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9894cab4-e18a-44aa-828b-cb588cd6f2d7",
|                                    "Name":  "Cognitive Services Face Recognizer",
|                                    "Description":  "Lets you perform detect, verify, identify, group, and find similar operations on Face API. This role does not allow create or delete operations, which makes it well suited for endpoints that only need inferencing capabilities, following \u0027least privilege\u0027 best practices.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/Face/detect/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/verify/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/identify/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/group/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/findsimilars/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/detectliveness/multimodal/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/detectliveness/singlemodal/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/detectlivenesswithverify/singlemodal/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/*/sessions/action",
|                                                        "Microsoft.CognitiveServices/accounts/Face/*/sessions/delete",
|                                                        "Microsoft.CognitiveServices/accounts/Face/*/sessions/read",
|                                                        "Microsoft.CognitiveServices/accounts/Face/*/sessions/audit/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1ec5b3c1-b17e-4e25-8312-2acb3c3c5abf",
|                                    "Name":  "Stream Analytics Query Tester",
|                                    "Description":  "Lets you perform query testing without creating a stream analytics job first",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.StreamAnalytics/locations/TestQuery/action",
|                                                    "Microsoft.StreamAnalytics/locations/OperationResults/read",
|                                                    "Microsoft.StreamAnalytics/locations/SampleInput/action",
|                                                    "Microsoft.StreamAnalytics/locations/CompileQuery/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a2138dac-4907-4679-a376-736901ed8ad8",
|                                    "Name":  "AnyBuild Builder",
|                                    "Description":  "Basic user role for AnyBuild. This role allows listing of agent information and execution of remote build capabilities.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AnyBuild/clusters/build/write",
|                                                        "Microsoft.AnyBuild/clusters/build/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b447c946-2db7-41ec-983d-d8bf3b1c77e3",
|                                    "Name":  "IoT Hub Data Reader",
|                                    "Description":  "Allows for full read access to IoT Hub data-plane properties",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Devices/IotHubs/*/read",
|                                                        "Microsoft.Devices/IotHubs/fileUpload/notifications/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "494bdba2-168f-4f31-a0a1-191d2f7c028c",
|                                    "Name":  "IoT Hub Twin Contributor",
|                                    "Description":  "Allows for read and write access to all IoT Hub device and module twins.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Devices/IotHubs/twins/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4ea46cd5-c1b2-4a8e-910b-273211f9ce47",
|                                    "Name":  "IoT Hub Registry Contributor",
|                                    "Description":  "Allows for full access to IoT Hub device registry.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Devices/IotHubs/devices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4fc6c259-987e-4a07-842e-c321cc9d413f",
|                                    "Name":  "IoT Hub Data Contributor",
|                                    "Description":  "Allows for full access to IoT Hub data plane operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Devices/IotHubs/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "15e0f5a1-3450-4248-8e25-e2afe88a9e85",
|                                    "Name":  "Test Base Reader",
|                                    "Description":  "Let you view and download packages and test results.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.TestBase/testBaseAccounts/packages/testResults/getDownloadUrl/action",
|                                                    "Microsoft.TestBase/testBaseAccounts/packages/testResults/getVideoDownloadUrl/action",
|                                                    "Microsoft.TestBase/testBaseAccounts/packages/getDownloadUrl/action",
|                                                    "Microsoft.TestBase/*/read",
|                                                    "Microsoft.TestBase/testBaseAccounts/customerEvents/write",
|                                                    "Microsoft.TestBase/testBaseAccounts/customerEvents/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1407120a-92aa-4202-b7e9-c0e197c71c8f",
|                                    "Name":  "Search Index Data Reader",
|                                    "Description":  "Grants read access to Azure Cognitive Search index data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Search/searchServices/indexes/documents/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8ebe5a00-799e-43f5-93ac-243d3dce84a7",
|                                    "Name":  "Search Index Data Contributor",
|                                    "Description":  "Grants full access to Azure Cognitive Search index data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Search/searchServices/indexes/documents/*",
|                                                        "Microsoft.Search/searchServices/indexes/contentSecurity/elevatedOperations/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "76199698-9eea-4c19-bc75-cec21354c6b6",
|                                    "Name":  "Storage Table Data Reader",
|                                    "Description":  "Allows for read access to Azure Storage tables and entities",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/tableServices/tables/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/tableServices/tables/entities/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3",
|                                    "Name":  "Storage Table Data Contributor",
|                                    "Description":  "Allows for read, write and delete access to Azure Storage tables and entities",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/tableServices/tables/read",
|                                                    "Microsoft.Storage/storageAccounts/tableServices/tables/write",
|                                                    "Microsoft.Storage/storageAccounts/tableServices/tables/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/tableServices/tables/entities/read",
|                                                        "Microsoft.Storage/storageAccounts/tableServices/tables/entities/write",
|                                                        "Microsoft.Storage/storageAccounts/tableServices/tables/entities/delete",
|                                                        "Microsoft.Storage/storageAccounts/tableServices/tables/entities/add/action",
|                                                        "Microsoft.Storage/storageAccounts/tableServices/tables/entities/update/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e89c7a3c-2f64-4fa1-a847-3e4c9ba4283a",
|                                    "Name":  "DICOM Data Reader",
|                                    "Description":  "Read and search DICOM data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/workspaces/dicomservices/resources/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "58a3b984-7adf-4c20-983a-32417c86fbc8",
|                                    "Name":  "DICOM Data Owner",
|                                    "Description":  "Full access to DICOM data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/workspaces/dicomservices/resources/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d5a91429-5739-47e2-a06b-3470a27159e7",
|                                    "Name":  "EventGrid Data Sender",
|                                    "Description":  "Allows send access to event grid events.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.EventGrid/topics/read",
|                                                    "Microsoft.EventGrid/domains/read",
|                                                    "Microsoft.EventGrid/partnerNamespaces/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.EventGrid/namespaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventGrid/events/send/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "60fc6e62-5479-42d4-8bf4-67625fcc2840",
|                                    "Name":  "Disk Pool Operator",
|                                    "Description":  "Used by the StoragePool Resource Provider to manage Disks added to a Disk Pool.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f6c7c914-8db3-469d-8ca1-694a8f32e121",
|                                    "Name":  "AzureML Data Scientist",
|                                    "Description":  "Can perform all actions within an Azure Machine Learning workspace, except for creating or deleting compute resources and modifying the workspace itself.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/*/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/*/action",
|                                                    "Microsoft.MachineLearningServices/workspaces/*/delete",
|                                                    "Microsoft.MachineLearningServices/workspaces/*/write"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.MachineLearningServices/workspaces/delete",
|                                                       "Microsoft.MachineLearningServices/workspaces/write",
|                                                       "Microsoft.MachineLearningServices/workspaces/computes/*/write",
|                                                       "Microsoft.MachineLearningServices/workspaces/computes/*/delete",
|                                                       "Microsoft.MachineLearningServices/workspaces/computes/listKeys/action",
|                                                       "Microsoft.MachineLearningServices/workspaces/listKeys/action",
|                                                       "Microsoft.MachineLearningServices/workspaces/hubs/write",
|                                                       "Microsoft.MachineLearningServices/workspaces/hubs/delete",
|                                                       "Microsoft.MachineLearningServices/workspaces/featurestores/write",
|                                                       "Microsoft.MachineLearningServices/workspaces/featurestores/delete"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "22926164-76b3-42b3-bc55-97df8dab3e41",
|                                    "Name":  "Grafana Admin",
|                                    "Description":  "Manage server-wide settings and manage access to resources such as organizations, users, and licenses.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Dashboard/grafana/ActAsGrafanaAdmin/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e8113dce-c529-4d33-91fa-e9b972617508",
|                                    "Name":  "Azure Connected SQL Server Onboarding",
|                                    "Description":  "Microsoft.AzureArcData service role to access the resources of Microsoft.AzureArcData stored with RPSAAS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureArcData/sqlServerInstances/read",
|                                                    "Microsoft.AzureArcData/sqlServerInstances/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "26baccc8-eea7-41f1-98f4-1762cc7f685d",
|                                    "Name":  "Azure Relay Sender",
|                                    "Description":  "Allows for send access to Azure Relay resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Relay/*/wcfRelays/read",
|                                                    "Microsoft.Relay/*/hybridConnections/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Relay/*/send/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2787bf04-f1f5-4bfe-8383-c8a24483ee38",
|                                    "Name":  "Azure Relay Owner",
|                                    "Description":  "Allows for full access to Azure Relay resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Relay/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Relay/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "26e0b698-aa6d-4085-9386-aadae190014d",
|                                    "Name":  "Azure Relay Listener",
|                                    "Description":  "Allows for listen access to Azure Relay resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Relay/*/wcfRelays/read",
|                                                    "Microsoft.Relay/*/hybridConnections/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Relay/*/listen/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "60921a7e-fef1-4a43-9b16-a26c52ad4769",
|                                    "Name":  "Grafana Viewer",
|                                    "Description":  "View dashboards, playlists, and query data sources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Dashboard/grafana/ActAsGrafanaViewer/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a79a5197-3a5c-4973-a920-486035ffd60f",
|                                    "Name":  "Grafana Editor",
|                                    "Description":  "Create, edit, delete, or view dashboards; create, edit, or delete folders; and edit or view playlists.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Dashboard/grafana/ActAsGrafanaEditor/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f353d9bd-d4a6-484e-a77a-8050b599b867",
|                                    "Name":  "Automation Contributor",
|                                    "Description":  "Manage azure automation resources and other resources using azure automation.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Automation/automationAccounts/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/ActionGroups/*",
|                                                    "Microsoft.Insights/ActivityLogAlerts/*",
|                                                    "Microsoft.Insights/MetricAlerts/*",
|                                                    "Microsoft.Insights/ScheduledQueryRules/*",
|                                                    "Microsoft.Insights/diagnosticSettings/*",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedKeys/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "85cb6faf-e071-4c9b-8136-154b5a04f717",
|                                    "Name":  "Kubernetes Extension Contributor",
|                                    "Description":  "Can create, update, get, list and delete Kubernetes Extensions, and get extension async operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.KubernetesConfiguration/register/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "10745317-c249-44a1-a5ce-3a4353c0bbd8",
|                                    "Name":  "Device Provisioning Service Data Reader",
|                                    "Description":  "Allows for full read access to Device Provisioning Service data-plane properties.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Devices/provisioningServices/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dfce44e4-17b7-4bd1-a6d1-04996ec95633",
|                                    "Name":  "Device Provisioning Service Data Contributor",
|                                    "Description":  "Allows for full access to Device Provisioning Service data-plane operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Devices/provisioningServices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2837e146-70d7-4cfd-ad55-7efa6464f958",
|                                    "Name":  "Artifact Signing Certificate Profile Signer",
|                                    "Description":  "Sign files with a certificate profile.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CodeSigning/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CodeSigning/certificateProfiles/Sign/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cff1b556-2399-4e7e-856d-a8f754be7b65",
|                                    "Name":  "Azure Spring Cloud Service Registry Reader",
|                                    "Description":  "Allow read access to Azure Spring Cloud Service Registry",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/eurekaService/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f5880b48-c26d-48be-b172-7927bfa1c8f1",
|                                    "Name":  "Azure Spring Cloud Service Registry Contributor",
|                                    "Description":  "Allow read, write and delete access to Azure Spring Cloud Service Registry",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/eurekaService/read",
|                                                        "Microsoft.AppPlatform/Spring/eurekaService/write",
|                                                        "Microsoft.AppPlatform/Spring/eurekaService/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d04c6db6-4947-4782-9e91-30a88feb7be7",
|                                    "Name":  "Azure Spring Cloud Config Server Reader",
|                                    "Description":  "Allow read access to Azure Spring Cloud Config Server",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/configService/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a06f5c24-21a7-4e1a-aa2b-f19eb6684f5b",
|                                    "Name":  "Azure Spring Cloud Config Server Contributor",
|                                    "Description":  "Allow read, write and delete access to Azure Spring Cloud Config Server",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/configService/read",
|                                                        "Microsoft.AppPlatform/Spring/configService/write",
|                                                        "Microsoft.AppPlatform/Spring/configService/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6ae96244-5829-4925-a7d3-5975537d91dd",
|                                    "Name":  "Azure VM Managed identities restore Contributor",
|                                    "Description":  "Azure VM Managed identities restore Contributors are allowed to perform Azure VM Restores with managed identities both user and system",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6be48352-4f82-47c9-ad5e-0acacefdb005",
|                                    "Name":  "Azure Maps Search and Render Data Reader",
|                                    "Description":  "Grants access to very limited set of data APIs for common visual web SDK scenarios. Specifically, render and search data APIs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Maps/accounts/services/render/read",
|                                                        "Microsoft.Maps/accounts/services/search/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dba33070-676a-4fb0-87fa-064dc56ff7fb",
|                                    "Name":  "Azure Maps Contributor",
|                                    "Description":  "Grants access all Azure Maps resource management.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Maps/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b748a06d-6150-4f8a-aaa9-ce3940cd96cb",
|                                    "Name":  "Azure Arc VMware VM Contributor",
|                                    "Description":  "Arc VMware VM Contributor has permissions to perform all VM actions.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ConnectedVMwarevSphere/virtualmachines/*",
|                                                    "Microsoft.ConnectedVMwarevSphere/virtualmachineinstances/*",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                    "Microsoft.HybridCompute/machines/installPatches/action",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.HybridCompute/locations/operationresults/read",
|                                                    "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                    "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/write",
|                                                    "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                    "Microsoft.HybridCompute/licenses/read",
|                                                    "Microsoft.HybridCompute/licenses/write",
|                                                    "Microsoft.HybridCompute/licenses/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ce551c02-7c42-47e0-9deb-e3b6fc3a9a83",
|                                    "Name":  "Azure Arc VMware Private Cloud User",
|                                    "Description":  "Azure Arc VMware Private Cloud User has permissions to use the VMware cloud resources to deploy VMs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ConnectedVMwarevSphere/virtualnetworks/join/action",
|                                                    "Microsoft.ConnectedVMwarevSphere/virtualnetworks/Read",
|                                                    "Microsoft.ConnectedVMwarevSphere/virtualmachinetemplates/clone/action",
|                                                    "Microsoft.ConnectedVMwarevSphere/virtualmachinetemplates/Read",
|                                                    "Microsoft.ConnectedVMwarevSphere/resourcepools/deploy/action",
|                                                    "Microsoft.ConnectedVMwarevSphere/resourcepools/Read",
|                                                    "Microsoft.ConnectedVMwarevSphere/hosts/deploy/action",
|                                                    "Microsoft.ConnectedVMwarevSphere/hosts/Read",
|                                                    "Microsoft.ConnectedVMwarevSphere/clusters/deploy/action",
|                                                    "Microsoft.ConnectedVMwarevSphere/clusters/Read",
|                                                    "Microsoft.ConnectedVMwarevSphere/datastores/allocateSpace/action",
|                                                    "Microsoft.ConnectedVMwarevSphere/datastores/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ddc140ed-e463-4246-9145-7c664192013f",
|                                    "Name":  "Azure Arc VMware Administrator role ",
|                                    "Description":  "Arc VMware VM Contributor has permissions to perform all connected VMwarevSphere actions.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ConnectedVMwarevSphere/*",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                    "Microsoft.HybridCompute/machines/installPatches/action",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.HybridCompute/locations/operationresults/read",
|                                                    "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                    "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/write",
|                                                    "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                    "Microsoft.HybridCompute/licenses/read",
|                                                    "Microsoft.HybridCompute/licenses/write",
|                                                    "Microsoft.HybridCompute/licenses/delete",
|                                                    "Microsoft.ExtendedLocation/customLocations/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f72c8140-2111-481c-87ff-72b910f6e3f8",
|                                    "Name":  "Cognitive Services LUIS Owner",
|                                    "Description":  " Has access to all Read, Test, Write, Deploy and Delete functions under LUIS",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.CognitiveServices/accounts/listkeys/action",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/LUIS/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7628b7b8-a8b2-4cdc-b46f-e9b35248918e",
|                                    "Name":  "Cognitive Services Language Reader",
|                                    "Description":  "Has access to Read and Test functions under Language portal",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/LanguageAuthoring/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/projects/export/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/Language/*/projects/export/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/query-text/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/query-dataverse/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/analyze-text/jobs/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/analyze-text/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/analyze-text/jobscancel/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/analyze-conversations/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/analyze-conversations/jobscancel/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/analyze-conversations/jobs/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/query-knowledgebases/action",
|                                                        "Microsoft.CognitiveServices/accounts/Language/generate/action",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f2310ca1-dc64-4889-bb49-c8e0fa3d47a8",
|                                    "Name":  "Cognitive Services Language Writer",
|                                    "Description":  " Has access to all Read, Test, and Write functions under Language Portal",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/LanguageAuthoring/*",
|                                                        "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/*",
|                                                        "Microsoft.CognitiveServices/accounts/Language/*",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f07febfe-79bc-46b1-8b37-790e26e6e498",
|                                    "Name":  "Cognitive Services Language Owner",
|                                    "Description":  "Has access to all Read, Test, Write, Deploy and Delete functions under Language portal",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.CognitiveServices/accounts/listkeys/action",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/LanguageAuthoring/*",
|                                                        "Microsoft.CognitiveServices/accounts/ConversationalLanguageUnderstanding/*",
|                                                        "Microsoft.CognitiveServices/accounts/Language/*",
|                                                        "Microsoft.CognitiveServices/accounts/TextAnalytics/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "18e81cdc-4e98-4e29-a639-e7d10c5a6226",
|                                    "Name":  "Cognitive Services LUIS Reader",
|                                    "Description":  "Has access to Read and Test functions under LUIS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/LUIS/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/LUIS/apps/testdatasets/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6322a993-d5c9-4bed-b113-e49bbea25b27",
|                                    "Name":  "Cognitive Services LUIS Writer",
|                                    "Description":  "Has access to all Read, Test, and Write functions under LUIS",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/LUIS/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a9a19cc5-31f4-447c-901f-56c0bb18fcaf",
|                                    "Name":  "PlayFab Reader",
|                                    "Description":  "Provides read access to PlayFab resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.PlayFab/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "749a398d-560b-491b-bb21-08924219302e",
|                                    "Name":  "Load Test Contributor",
|                                    "Description":  "View, create, update, delete and execute load tests. View and list load test resources but can not make any changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.LoadTestService/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.LoadTestService/PlaywrightWorkspaces/*",
|                                                       "Microsoft.LoadTestService/locations/PlaywrightQuotas/*"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.LoadTestService/loadtests/*",
|                                                        "Microsoft.LoadTestService/testProfiles/*",
|                                                        "Microsoft.LoadTestService/testProfileRuns/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "45bb0b16-2f0c-4e78-afaa-a07599b003f6",
|                                    "Name":  "Load Test Owner",
|                                    "Description":  "Execute all operations on load test resources and load tests",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.LoadTestService/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.LoadTestService/PlaywrightWorkspaces/*",
|                                                       "Microsoft.LoadTestService/locations/PlaywrightQuotas/*"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.LoadTestService/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0c8b84dc-067c-4039-9615-fa1a4b77c726",
|                                    "Name":  "PlayFab Contributor",
|                                    "Description":  "Provides contributor access to PlayFab resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.PlayFab/*/read",
|                                                    "Microsoft.PlayFab/*/write",
|                                                    "Microsoft.PlayFab/*/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3ae3fb29-0000-4ccd-bf80-542e7b26e081",
|                                    "Name":  "Load Test Reader",
|                                    "Description":  "View and list all load tests and load test resources but can not make any changes",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.LoadTestService/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.LoadTestService/PlaywrightWorkspaces/*",
|                                                       "Microsoft.LoadTestService/locations/PlaywrightQuotas/*"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.LoadTestService/loadtests/readTest/action",
|                                                        "Microsoft.LoadTestService/testProfiles/read",
|                                                        "Microsoft.LoadTestService/testProfileRuns/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b2de6794-95db-4659-8781-7e080d3f2b9d",
|                                    "Name":  "Cognitive Services Immersive Reader User",
|                                    "Description":  "Provides access to create Immersive Reader sessions and call APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/ImmersiveReader/getcontentmodelforreader/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f69b8690-cc87-41d6-b77a-a4bc3c0a966f",
|                                    "Name":  "Lab Services Contributor",
|                                    "Description":  "The lab services contributor role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.LabServices/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.LabServices/labPlans/createLab/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2a5c394f-5eb7-4d4f-9c8e-e8eae39faebc",
|                                    "Name":  "Lab Services Reader",
|                                    "Description":  "The lab services reader role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.LabServices/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ce40b423-cede-4313-a93f-9b28290b72e1",
|                                    "Name":  "Lab Assistant",
|                                    "Description":  "The lab assistant role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.LabServices/labPlans/images/read",
|                                                    "Microsoft.LabServices/labPlans/read",
|                                                    "Microsoft.LabServices/labs/read",
|                                                    "Microsoft.LabServices/labs/schedules/read",
|                                                    "Microsoft.LabServices/labs/users/read",
|                                                    "Microsoft.LabServices/labs/users/invite/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/read",
|                                                    "Microsoft.LabServices/labs/virtualMachines/start/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/stop/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/reimage/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/redeploy/action",
|                                                    "Microsoft.LabServices/locations/usages/read",
|                                                    "Microsoft.LabServices/skus/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a36e6959-b6be-4b12-8e9f-ef4b474d304d",
|                                    "Name":  "Lab Operator",
|                                    "Description":  "The lab operator role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.LabServices/labPlans/images/read",
|                                                    "Microsoft.LabServices/labPlans/read",
|                                                    "Microsoft.LabServices/labPlans/saveImage/action",
|                                                    "Microsoft.LabServices/labs/publish/action",
|                                                    "Microsoft.LabServices/labs/read",
|                                                    "Microsoft.LabServices/labs/schedules/read",
|                                                    "Microsoft.LabServices/labs/schedules/write",
|                                                    "Microsoft.LabServices/labs/schedules/delete",
|                                                    "Microsoft.LabServices/labs/users/read",
|                                                    "Microsoft.LabServices/labs/users/write",
|                                                    "Microsoft.LabServices/labs/users/delete",
|                                                    "Microsoft.LabServices/labs/users/invite/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/read",
|                                                    "Microsoft.LabServices/labs/virtualMachines/start/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/stop/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/reimage/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/redeploy/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/resetPassword/action",
|                                                    "Microsoft.LabServices/locations/usages/read",
|                                                    "Microsoft.LabServices/skus/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5daaa2af-1fe8-407c-9122-bba179798270",
|                                    "Name":  "Lab Contributor",
|                                    "Description":  "The lab contributor role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.LabServices/labPlans/images/read",
|                                                    "Microsoft.LabServices/labPlans/read",
|                                                    "Microsoft.LabServices/labPlans/saveImage/action",
|                                                    "Microsoft.LabServices/labs/read",
|                                                    "Microsoft.LabServices/labs/write",
|                                                    "Microsoft.LabServices/labs/delete",
|                                                    "Microsoft.LabServices/labs/publish/action",
|                                                    "Microsoft.LabServices/labs/syncGroup/action",
|                                                    "Microsoft.LabServices/labs/schedules/read",
|                                                    "Microsoft.LabServices/labs/schedules/write",
|                                                    "Microsoft.LabServices/labs/schedules/delete",
|                                                    "Microsoft.LabServices/labs/users/read",
|                                                    "Microsoft.LabServices/labs/users/write",
|                                                    "Microsoft.LabServices/labs/users/delete",
|                                                    "Microsoft.LabServices/labs/users/invite/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/read",
|                                                    "Microsoft.LabServices/labs/virtualMachines/start/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/stop/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/reimage/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/redeploy/action",
|                                                    "Microsoft.LabServices/labs/virtualMachines/resetPassword/action",
|                                                    "Microsoft.LabServices/locations/usages/read",
|                                                    "Microsoft.LabServices/skus/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.LabServices/labPlans/createLab/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fb1c8493-542b-48eb-b624-b4c8fea62acd",
|                                    "Name":  "Security Admin",
|                                    "Description":  "Security Admin Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Authorization/policyAssignments/*",
|                                                    "Microsoft.Authorization/policyDefinitions/*",
|                                                    "Microsoft.Authorization/policyExemptions/*",
|                                                    "Microsoft.Authorization/policySetDefinitions/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.operationalInsights/workspaces/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Security/*",
|                                                    "Microsoft.IoTSecurity/*",
|                                                    "Microsoft.IoTFirmwareDefense/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "12cf5a90-567b-43ae-8102-96cf46c7d9b4",
|                                    "Name":  "Web PubSub Service Owner",
|                                    "Description":  "Full access to Azure Web PubSub Service REST APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SignalRService/WebPubSub/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bfb1c7d2-fb1a-466b-b2ba-aee63b92deaf",
|                                    "Name":  "Web PubSub Service Reader",
|                                    "Description":  "Read-only access to Azure Web PubSub Service REST APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SignalRService/WebPubSub/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "420fcaa2-552c-430f-98ca-3264be4806c7",
|                                    "Name":  "SignalR App Server",
|                                    "Description":  "Lets your app server access SignalR Service with AAD auth options.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.SignalRService/SignalR/auth/accessKey/action",
|                                                        "Microsoft.SignalRService/SignalR/serverConnection/write",
|                                                        "Microsoft.SignalRService/SignalR/clientConnection/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fb879df8-f326-4884-b1cf-06f3ad86be52",
|                                    "Name":  "Virtual Machine User Login",
|                                    "Description":  "View Virtual Machines in the portal and login as a regular user.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Compute/virtualMachines/*/read",
|                                                    "Microsoft.HybridCompute/machines/*/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Compute/virtualMachines/login/action",
|                                                        "Microsoft.HybridCompute/machines/login/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1c0163c0-47e6-4577-8991-ea5c82e286e4",
|                                    "Name":  "Virtual Machine Administrator Login",
|                                    "Description":  "View Virtual Machines in the portal and login as administrator",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Compute/virtualMachines/*/read",
|                                                    "Microsoft.HybridCompute/machines/*/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Compute/virtualMachines/login/action",
|                                                        "Microsoft.Compute/virtualMachines/loginAsAdmin/action",
|                                                        "Microsoft.HybridCompute/machines/login/action",
|                                                        "Microsoft.HybridCompute/machines/loginAsAdmin/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cd570a14-e51a-42ad-bac8-bafd67325302",
|                                    "Name":  "Azure Connected Machine Resource Administrator",
|                                    "Description":  "Can read, write, delete and re-onboard Azure Connected Machines.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/machines/*",
|                                                    "Microsoft.HybridCompute/machines/extensions/*",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/*",
|                                                    "Microsoft.HybridCompute/machines/runCommands/*",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/settings/*",
|                                                    "Microsoft.HybridCompute/gateways/*",
|                                                    "Microsoft.HybridCompute/privateLinkScopes/*",
|                                                    "Microsoft.HybridCompute/licenses/*",
|                                                    "Microsoft.HybridCompute/locations/*",
|                                                    "Microsoft.HybridCompute/*/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "00c29273-979b-4161-815c-10b084fb9324",
|                                    "Name":  "Backup Operator",
|                                    "Description":  "Lets you manage backup services, except removal of backup, vault creation and giving access to others",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/backup/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/operationsStatus/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/provisionInstantItemRecovery/action",
|                                                    "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/accessToken/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/restore/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/revokeInstantItemRecovery/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/write",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/refreshContainers/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupJobs/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupJobsExport/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupOperationResults/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectableItems/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectedItems/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectionContainers/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupUsageSummaries/read",
|                                                    "Microsoft.RecoveryServices/Vaults/certificates/write",
|                                                    "Microsoft.RecoveryServices/Vaults/extendedInformation/read",
|                                                    "Microsoft.RecoveryServices/Vaults/extendedInformation/write",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/read",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringConfigurations/*",
|                                                    "Microsoft.RecoveryServices/Vaults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/operationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/read",
|                                                    "Microsoft.RecoveryServices/Vaults/registeredIdentities/write",
|                                                    "Microsoft.RecoveryServices/Vaults/usages/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupstorageconfig/*",
|                                                    "Microsoft.RecoveryServices/Vaults/backupValidateOperation/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupTriggerValidateOperation/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupValidateOperationResults/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupValidateOperationsStatuses/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupOperations/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupPolicies/operations/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/write",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/inquire/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupEngines/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/write",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectableContainers/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/items/read",
|                                                    "Microsoft.RecoveryServices/locations/backupStatus/action",
|                                                    "Microsoft.RecoveryServices/locations/backupPreValidateProtection/action",
|                                                    "Microsoft.RecoveryServices/locations/backupValidateFeatures/action",
|                                                    "Microsoft.RecoveryServices/locations/backupAadProperties/read",
|                                                    "Microsoft.RecoveryServices/locations/backupCrrJobs/action",
|                                                    "Microsoft.RecoveryServices/locations/backupCrrJob/action",
|                                                    "Microsoft.RecoveryServices/locations/backupCrossRegionRestore/action",
|                                                    "Microsoft.RecoveryServices/locations/backupCrrOperationResults/read",
|                                                    "Microsoft.RecoveryServices/locations/backupCrrOperationsStatus/read",
|                                                    "Microsoft.RecoveryServices/Vaults/monitoringAlerts/write",
|                                                    "Microsoft.RecoveryServices/operations/read",
|                                                    "Microsoft.RecoveryServices/locations/operationStatus/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/write",
|                                                    "Microsoft.DataProtection/backupVaults/deletedBackupInstances/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupPolicies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/findRestorableTimeRanges/action",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/backupVaults/operationResults/read",
|                                                    "Microsoft.DataProtection/backupVaults/operationStatus/read",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/backupVaults/read",
|                                                    "Microsoft.DataProtection/locations/operationStatus/read",
|                                                    "Microsoft.DataProtection/locations/operationResults/read",
|                                                    "Microsoft.DataProtection/operations/read",
|                                                    "Microsoft.DataProtection/backupVaults/validateForBackup/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/backup/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/validateRestore/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/restore/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/crossRegionRestore/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/validateCrossRegionRestore/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJobs/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchCrossRegionRestoreJob/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/fetchSecondaryRecoveryPoints/action",
|                                                    "Microsoft.DataProtection/locations/checkFeatureSupport/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/delete",
|                                                    "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/read",
|                                                    "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/unlockDelete/action",
|                                                    "Microsoft.RecoveryServices/Vaults/backupResourceGuardProxies/write",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/write",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/delete",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/unlockDelete/action",
|                                                    "Microsoft.DataProtection/backupVaults/backupInstances/validateForModifyBackup/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e8ddcd69-c73f-4f9f-9844-4100522f16ad",
|                                    "Name":  "Workbook Contributor",
|                                    "Description":  "Can save shared workbooks.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Insights/workbooks/write",
|                                                    "Microsoft.Insights/workbooks/delete",
|                                                    "Microsoft.Insights/workbooks/read",
|                                                    "Microsoft.Insights/workbooks/revisions/read",
|                                                    "Microsoft.Insights/workbooktemplates/write",
|                                                    "Microsoft.Insights/workbooktemplates/delete",
|                                                    "Microsoft.Insights/workbooktemplates/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b279062a-9be3-42a0-92ae-8b3cf002ec4d",
|                                    "Name":  "Workbook Reader",
|                                    "Description":  "Can read workbooks.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "microsoft.insights/workbooks/read",
|                                                    "microsoft.insights/workbooks/revisions/read",
|                                                    "microsoft.insights/workbooktemplates/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "749f88d5-cbae-40b8-bcfc-e573ddc772fa",
|                                    "Name":  "Monitoring Contributor",
|                                    "Description":  "Can read all monitoring data and update monitoring settings.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.AlertsManagement/alerts/*",
|                                                    "Microsoft.AlertsManagement/alertsSummary/*",
|                                                    "Microsoft.AlertsManagement/issues/*",
|                                                    "Microsoft.Insights/actiongroups/*",
|                                                    "Microsoft.Insights/activityLogAlerts/*",
|                                                    "Microsoft.Insights/AlertRules/*",
|                                                    "Microsoft.Insights/components/*",
|                                                    "Microsoft.Insights/createNotifications/*",
|                                                    "Microsoft.Insights/dataCollectionEndpoints/*",
|                                                    "Microsoft.Insights/dataCollectionRules/*",
|                                                    "Microsoft.Insights/dataCollectionRuleAssociations/*",
|                                                    "Microsoft.Insights/DiagnosticSettings/*",
|                                                    "Microsoft.Insights/eventtypes/*",
|                                                    "Microsoft.Insights/LogDefinitions/*",
|                                                    "Microsoft.Insights/metricalerts/*",
|                                                    "Microsoft.Insights/MetricDefinitions/*",
|                                                    "Microsoft.Insights/Metrics/*",
|                                                    "Microsoft.Insights/notificationStatus/*",
|                                                    "Microsoft.Insights/Register/Action",
|                                                    "Microsoft.Insights/scheduledqueryrules/*",
|                                                    "Microsoft.Insights/webtests/*",
|                                                    "Microsoft.Insights/workbooks/*",
|                                                    "Microsoft.Insights/workbooktemplates/*",
|                                                    "Microsoft.Insights/privateLinkScopes/*",
|                                                    "Microsoft.Insights/privateLinkScopeOperationStatuses/*",
|                                                    "Microsoft.Monitor/accounts/*",
|                                                    "Microsoft.Monitor/settings/*",
|                                                    "Microsoft.OperationalInsights/workspaces/write",
|                                                    "Microsoft.OperationalInsights/workspaces/intelligencepacks/*",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/*",
|                                                    "Microsoft.OperationalInsights/workspaces/search/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedKeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedKeys/read",
|                                                    "Microsoft.OperationalInsights/workspaces/storageinsightconfigs/*",
|                                                    "Microsoft.OperationalInsights/locations/workspaces/failover/action",
|                                                    "Microsoft.OperationalInsights/workspaces/failback/action",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.AlertsManagement/smartDetectorAlertRules/*",
|                                                    "Microsoft.AlertsManagement/actionRules/*",
|                                                    "Microsoft.AlertsManagement/smartGroups/*",
|                                                    "Microsoft.AlertsManagement/migrateFromSmartDetection/*",
|                                                    "Microsoft.AlertsManagement/investigations/*",
|                                                    "Microsoft.AlertsManagement/prometheusRuleGroups/*",
|                                                    "Microsoft.Monitor/investigations/*",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3913510d-42f4-4e42-8a64-420c390055eb",
|                                    "Name":  "Monitoring Metrics Publisher",
|                                    "Description":  "Enables publishing metrics against Azure resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Insights/Register/Action",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Insights/Metrics/Write",
|                                                        "Microsoft.Insights/Telemetry/Write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8a3c2885-9b38-4fd2-9d99-91af537c1347",
|                                    "Name":  "Purview role 1 (Deprecated)",
|                                    "Description":  "Deprecated role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Purview/accounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Purview/accounts/data/read",
|                                                        "Microsoft.Purview/accounts/data/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "200bba9e-f0c8-430f-892b-6f0794863803",
|                                    "Name":  "Purview role 2 (Deprecated)",
|                                    "Description":  "Deprecated role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Purview/accounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Purview/accounts/scan/read",
|                                                        "Microsoft.Purview/accounts/scan/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ff100721-1b9d-43d8-af52-42b69c1272db",
|                                    "Name":  "Purview role 3 (Deprecated)",
|                                    "Description":  "Deprecated role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Purview/accounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Purview/accounts/data/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b8b15564-4fa6-4a59-ab12-03e1d9594795",
|                                    "Name":  "Autonomous Development Platform Data Contributor (Preview)",
|                                    "Description":  "Grants permissions to upload and manage new Autonomous Development Platform measurements.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AutonomousDevelopmentPlatform/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AutonomousDevelopmentPlatform/accounts/dataPools/discoveries/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/accounts/dataPools/uploads/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/accounts/dataPools/measurements/states/new/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/accounts/dataPools/measurementCollections/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/accounts/measurementCollections/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/workspaces/read",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/workspaces/discoveries/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/workspaces/uploads/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/workspaces/measurements/states/new/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/workspaces/measurements/classifications/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/workspaces/measurements/dataStreams/classifications/*",
|                                                        "Microsoft.AutonomousDevelopmentPlatform/workspaces/measurementCollections/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "27f8b550-c507-4db9-86f2-f4b8e816d59d",
|                                    "Name":  "Autonomous Development Platform Data Owner (Preview)",
|                                    "Description":  "Grants full access to Autonomous Development Platform data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AutonomousDevelopmentPlatform/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AutonomousDevelopmentPlatform/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d63b75f7-47ea-4f27-92ac-e0d173aaf093",
|                                    "Name":  "Autonomous Development Platform Data Reader (Preview)",
|                                    "Description":  "Grants read access to Autonomous Development Platform data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AutonomousDevelopmentPlatform/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AutonomousDevelopmentPlatform/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "14b46e9e-c2b7-41b4-b07b-48a6ebf60603",
|                                    "Name":  "Key Vault Crypto Officer",
|                                    "Description":  "Perform any action on the keys of a key vault, except manage permissions. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.KeyVault/checkNameAvailability/read",
|                                                    "Microsoft.KeyVault/deletedVaults/read",
|                                                    "Microsoft.KeyVault/locations/*/read",
|                                                    "Microsoft.KeyVault/vaults/*/read",
|                                                    "Microsoft.KeyVault/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/keys/*",
|                                                        "Microsoft.KeyVault/vaults/keyrotationpolicies/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "49e2f5d2-7741-4835-8efa-19e1fe35e47f",
|                                    "Name":  "Device Update Deployments Reader",
|                                    "Description":  "Gives you read access to management operations, but does not allow making changes",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.DeviceUpdate/accounts/read",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DeviceUpdate/accounts/instances/management/read",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e4237640-0e3d-4a46-8fda-70bc94856432",
|                                    "Name":  "Device Update Deployments Administrator",
|                                    "Description":  "Gives you full access to management operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.DeviceUpdate/accounts/read",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DeviceUpdate/accounts/instances/management/read",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/management/write",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/management/delete",
|                                                        "Microsoft.DeviceUpdate/accounts/instances/updates/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "67d33e57-3129-45e6-bb0b-7cc522f762fa",
|                                    "Name":  "Azure Arc VMware Private Clouds Onboarding",
|                                    "Description":  "Azure Arc VMware Private Clouds Onboarding role has permissions to provision all the required resources for onboard and deboard vCenter instances to Azure.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ConnectedVMwarevSphere/vcenters/Write",
|                                                    "Microsoft.ConnectedVMwarevSphere/vcenters/Read",
|                                                    "Microsoft.ConnectedVMwarevSphere/vcenters/Delete",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/Write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/Read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/Delete",
|                                                    "Microsoft.KubernetesConfiguration/operations/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/Write",
|                                                    "Microsoft.ExtendedLocation/customLocations/Delete",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.ResourceConnector/appliances/Read",
|                                                    "Microsoft.ResourceConnector/appliances/Write",
|                                                    "Microsoft.ResourceConnector/appliances/Delete",
|                                                    "Microsoft.ResourceConnector/appliances/listClusterUserCredential/action",
|                                                    "Microsoft.BackupSolutions/vmwareapplications/write",
|                                                    "Microsoft.BackupSolutions/vmwareapplications/delete",
|                                                    "Microsoft.BackupSolutions/vmwareapplications/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f4c81013-99ee-4d62-a7ee-b3f1f648599a",
|                                    "Name":  "Microsoft Sentinel Automation Contributor",
|                                    "Description":  "Microsoft Sentinel Automation Contributor",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Logic/workflows/triggers/read",
|                                                    "Microsoft.Logic/workflows/triggers/listCallbackUrl/action",
|                                                    "Microsoft.Logic/workflows/runs/read",
|                                                    "Microsoft.Web/sites/hostruntime/webhooks/api/workflows/triggers/read",
|                                                    "Microsoft.Web/sites/hostruntime/webhooks/api/workflows/triggers/listCallbackUrl/action",
|                                                    "Microsoft.Web/sites/hostruntime/webhooks/api/workflows/runs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "871e35f6-b5c1-49cc-a043-bde969a0f2cd",
|                                    "Name":  "CDN Endpoint Reader",
|                                    "Description":  "Can view CDN endpoints, but can\u0027t make changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Cdn/edgenodes/read",
|                                                    "Microsoft.Cdn/operationresults/*",
|                                                    "Microsoft.Cdn/profiles/endpoints/*/read",
|                                                    "Microsoft.Cdn/profiles/afdendpoints/validateCustomDomain/action",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f2dc8367-1007-4938-bd23-fe263f013447",
|                                    "Name":  "Cognitive Services Speech User",
|                                    "Description":  "Access to the real-time speech recognition and batch transcription APIs, real-time speech synthesis and long audio APIs, as well as to read the data/test/model/endpoint for custom models, but can’t create, delete or modify the data/test/model/endpoint for custom models.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/read",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/write",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/delete",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/*/transcriptions/action",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/*/frontend/action",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/text-dependent/*/action",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/text-independent/*/action",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/voiceagent/realtime/*",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/voicelive/realtime/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVoice/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVoice/evaluations/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomVoice/longaudiosynthesis/*",
|                                                        "Microsoft.CognitiveServices/accounts/AudioContentCreation/*",
|                                                        "Microsoft.CognitiveServices/accounts/TTSPlayer/*",
|                                                        "Microsoft.CognitiveServices/accounts/VideoTranslation/*",
|                                                        "Microsoft.CognitiveServices/accounts/CustomAvatar/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/BatchAvatar/*",
|                                                        "Microsoft.CognitiveServices/accounts/BatchTextToSpeech/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a6333a3e-0164-44c3-b281-7a577aff287f",
|                                    "Name":  "Windows Admin Center Administrator Login",
|                                    "Description":  "Let\u0027s you manage the OS of your resource via Windows Admin Center as an administrator.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/machines/*/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/*",
|                                                    "Microsoft.HybridCompute/machines/upgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read",
|                                                    "Microsoft.Network/networkWatchers/securityGroupView/action",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/write",
|                                                    "Microsoft.HybridConnectivity/endpoints/write",
|                                                    "Microsoft.HybridConnectivity/endpoints/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/write",
|                                                    "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/listManagedProxyDetails/action",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/patchAssessmentResults/latest/read",
|                                                    "Microsoft.Compute/virtualMachines/patchAssessmentResults/latest/softwarePatches/read",
|                                                    "Microsoft.Compute/virtualMachines/patchInstallationResults/read",
|                                                    "Microsoft.Compute/virtualMachines/patchInstallationResults/softwarePatches/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                    "Microsoft.Compute/virtualMachines/runCommands/read",
|                                                    "Microsoft.Compute/virtualMachines/vmSizes/read",
|                                                    "Microsoft.Compute/locations/publishers/artifacttypes/types/read",
|                                                    "Microsoft.Compute/locations/publishers/artifacttypes/types/versions/read",
|                                                    "Microsoft.Compute/diskAccesses/read",
|                                                    "Microsoft.Compute/galleries/images/read",
|                                                    "Microsoft.Compute/images/read",
|                                                    "Microsoft.AzureStackHCI/Clusters/Read",
|                                                    "Microsoft.AzureStackHCI/Clusters/ArcSettings/Read",
|                                                    "Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Read",
|                                                    "Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Write",
|                                                    "Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Delete",
|                                                    "Microsoft.AzureStackHCI/Operations/Read",
|                                                    "Microsoft.ConnectedVMwarevSphere/VirtualMachines/Read",
|                                                    "Microsoft.ConnectedVMwarevSphere/VirtualMachines/Extensions/Write",
|                                                    "Microsoft.ConnectedVMwarevSphere/VirtualMachines/Extensions/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HybridCompute/machines/WACLoginAsAdmin/action",
|                                                        "Microsoft.Compute/virtualMachines/WACloginAsAdmin/action",
|                                                        "Microsoft.AzureStackHCI/Clusters/WACloginAsAdmin/Action",
|                                                        "Microsoft.ConnectedVMwarevSphere/virtualmachines/WACloginAsAdmin/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "18ed5180-3e48-46fd-8541-4ea054d57064",
|                                    "Name":  "Azure Kubernetes Service Policy Add-on Deployment",
|                                    "Description":  "Deploy the Azure Policy add-on on Azure Kubernetes Service clusters",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/publicIPPrefixes/join/action",
|                                                    "Microsoft.Network/publicIPAddresses/join/action",
|                                                    "Microsoft.Compute/diskEncryptionSets/read",
|                                                    "Microsoft.Compute/proximityPlacementGroups/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "088ab73d-1256-47ae-bea9-9de8e7131f31",
|                                    "Name":  "Guest Configuration Resource Contributor",
|                                    "Description":  "Lets you read, write Guest Configuration Resource.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/write",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/*/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "361898ef-9ed1-48c2-849c-a832951106bb",
|                                    "Name":  "Domain Services Reader",
|                                    "Description":  "Can view Azure AD Domain Services and related network configurations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Insights/Logs/Read",
|                                                    "Microsoft.Insights/Metrics/read",
|                                                    "Microsoft.Insights/DiagnosticSettings/read",
|                                                    "Microsoft.Insights/DiagnosticSettingsCategories/Read",
|                                                    "Microsoft.AAD/domainServices/*/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
|                                                    "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/read",
|                                                    "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/azureFirewalls/read",
|                                                    "Microsoft.Network/ddosProtectionPlans/read",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/loadBalancers/*/read",
|                                                    "Microsoft.Network/natGateways/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                    "Microsoft.Network/routeTables/read",
|                                                    "Microsoft.Network/routeTables/routes/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "eeaeda52-9324-47f6-8069-5d5bade478b2",
|                                    "Name":  "Domain Services Contributor",
|                                    "Description":  "Can manage Azure AD Domain Services and related network configurations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Insights/Logs/Read",
|                                                    "Microsoft.Insights/Metrics/Read",
|                                                    "Microsoft.Insights/DiagnosticSettings/*",
|                                                    "Microsoft.Insights/DiagnosticSettingsCategories/Read",
|                                                    "Microsoft.AAD/register/action",
|                                                    "Microsoft.AAD/unregister/action",
|                                                    "Microsoft.AAD/domainServices/*",
|                                                    "Microsoft.Network/register/action",
|                                                    "Microsoft.Network/unregister/action",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/write",
|                                                    "Microsoft.Network/virtualNetworks/delete",
|                                                    "Microsoft.Network/virtualNetworks/peer/action",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/delete",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete",
|                                                    "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/diagnosticSettings/read",
|                                                    "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/azureFirewalls/read",
|                                                    "Microsoft.Network/ddosProtectionPlans/read",
|                                                    "Microsoft.Network/ddosProtectionPlans/join/action",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/loadBalancers/delete",
|                                                    "Microsoft.Network/loadBalancers/*/read",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
|                                                    "Microsoft.Network/natGateways/join/action",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/write",
|                                                    "Microsoft.Network/networkSecurityGroups/delete",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/write",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/delete",
|                                                    "Microsoft.Network/routeTables/read",
|                                                    "Microsoft.Network/routeTables/write",
|                                                    "Microsoft.Network/routeTables/delete",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/routeTables/routes/read",
|                                                    "Microsoft.Network/routeTables/routes/write",
|                                                    "Microsoft.Network/routeTables/routes/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d",
|                                    "Name":  "DNS Resolver Contributor",
|                                    "Description":  "Lets you manage DNS resolver resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/dnsResolvers/read",
|                                                    "Microsoft.Network/dnsResolvers/write",
|                                                    "Microsoft.Network/dnsResolvers/delete",
|                                                    "Microsoft.Network/dnsResolvers/join/action",
|                                                    "Microsoft.Network/dnsResolvers/inboundEndpoints/read",
|                                                    "Microsoft.Network/dnsResolvers/inboundEndpoints/write",
|                                                    "Microsoft.Network/dnsResolvers/inboundEndpoints/delete",
|                                                    "Microsoft.Network/dnsResolvers/inboundEndpoints/join/action",
|                                                    "Microsoft.Network/dnsResolvers/outboundEndpoints/read",
|                                                    "Microsoft.Network/dnsResolvers/outboundEndpoints/write",
|                                                    "Microsoft.Network/dnsResolvers/outboundEndpoints/delete",
|                                                    "Microsoft.Network/dnsResolvers/outboundEndpoints/join/action",
|                                                    "Microsoft.Network/dnsForwardingRulesets/read",
|                                                    "Microsoft.Network/dnsForwardingRulesets/write",
|                                                    "Microsoft.Network/dnsForwardingRulesets/delete",
|                                                    "Microsoft.Network/dnsForwardingRulesets/join/action",
|                                                    "Microsoft.Network/dnsForwardingRulesets/forwardingRules/read",
|                                                    "Microsoft.Network/dnsForwardingRulesets/forwardingRules/write",
|                                                    "Microsoft.Network/dnsForwardingRulesets/forwardingRules/delete",
|                                                    "Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks/read",
|                                                    "Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks/write",
|                                                    "Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks/delete",
|                                                    "Microsoft.Network/locations/dnsResolverOperationResults/read",
|                                                    "Microsoft.Network/locations/dnsResolverOperationStatuses/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Network/virtualNetworks/joinLoadBalancer/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinLoadBalancer/action",
|                                                    "Microsoft.Network/natGateways/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "00493d72-78f6-4148-b6c5-d3ce8e4799dd",
|                                    "Name":  "Azure Arc Enabled Kubernetes Cluster User Role",
|                                    "Description":  "List cluster user credentials action.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Kubernetes/connectedClusters/listClusterUserCredentials/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "959f8984-c045-4866-89c7-12bf9737be2e",
|                                    "Name":  "Data Operator for Managed Disks",
|                                    "Description":  "Provides permissions to upload data to empty managed disks, read, or export data of managed disks (not attached to running VMs) and snapshots using SAS URIs and Azure AD authentication.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Compute/disks/download/action",
|                                                        "Microsoft.Compute/disks/upload/action",
|                                                        "Microsoft.Compute/snapshots/download/action",
|                                                        "Microsoft.Compute/snapshots/upload/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6b77f0a0-0d89-41cc-acd1-579c22c17a67",
|                                    "Name":  "AgFood Platform Sensor Partner Contributor",
|                                    "Description":  "Provides contribute access to manage sensor related entities in AgFood Platform Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/sensorPartnerScope/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1ef6a3be-d0ac-425d-8c01-acb62866290b",
|                                    "Name":  "Compute Gallery Sharing Admin",
|                                    "Description":  "This role allows user to share gallery to another subscription/tenant or share it to the public.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/galleries/share/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cd08ab90-6b14-449c-ad9a-8f8e549482c6",
|                                    "Name":  "Scheduled Patching Contributor",
|                                    "Description":  "Provides access to manage maintenance configurations with maintenance scope InGuestPatch and corresponding configuration assignments",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Maintenance/maintenanceConfigurations/read",
|                                                    "Microsoft.Maintenance/maintenanceConfigurations/write",
|                                                    "Microsoft.Maintenance/maintenanceConfigurations/delete",
|                                                    "Microsoft.Maintenance/configurationAssignments/read",
|                                                    "Microsoft.Maintenance/configurationAssignments/write",
|                                                    "Microsoft.Maintenance/configurationAssignments/delete",
|                                                    "Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/read",
|                                                    "Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/write",
|                                                    "Microsoft.Maintenance/configurationAssignments/maintenanceScope/InGuestPatch/delete",
|                                                    "Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/read",
|                                                    "Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/write",
|                                                    "Microsoft.Maintenance/maintenanceConfigurations/maintenanceScope/InGuestPatch/delete",
|                                                    "Microsoft.Maintenance/applyUpdates/read",
|                                                    "Microsoft.Maintenance/updates/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "45d50f46-0b78-4001-a660-4198cbe8cd05",
|                                    "Name":  "DevCenter Dev Box User",
|                                    "Description":  "Provides access to create and manage dev boxes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DevCenter/projects/read",
|                                                    "Microsoft.DevCenter/projects/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userStop/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userStart/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userGetRemoteConnection/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userRead/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userWrite/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userDelete/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userUpcomingActionRead/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userUpcomingActionManage/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userActionRead/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userActionManage/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userCustomize/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "331c37c6-af14-46d9-b9f4-e1909e1b95a0",
|                                    "Name":  "DevCenter Project Admin",
|                                    "Description":  "Provides access to manage project resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DevCenter/projects/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.DevCenter/projects/write",
|                                                       "Microsoft.DevCenter/projects/delete"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DevCenter/projects/users/devboxes/adminStart/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/adminStop/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/adminRead/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/adminWrite/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/adminDelete/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/adminAlign/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/adminActionRead/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/adminActionManage/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userStop/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userStart/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userGetRemoteConnection/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userRead/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userWrite/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userDelete/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userActionRead/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userActionManage/action",
|                                                        "Microsoft.DevCenter/projects/users/devboxes/userCustomize/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminRead/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/userWrite/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminWrite/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/userDelete/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminDelete/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminAction/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminActionRead/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminActionManage/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminOutputsRead/action",
|                                                        "Microsoft.DevCenter/projects/pools/align/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "602da2ba-a5c2-41da-b01d-5360126ab525",
|                                    "Name":  "Virtual Machine Local User Login",
|                                    "Description":  "View Virtual Machines in the portal and login as a local user configured on the arc server",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/machines/*/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c0781e91-8102-4553-8951-97c6d4243cda",
|                                    "Name":  "Azure Arc ScVmm Private Cloud User",
|                                    "Description":  "Azure Arc ScVmm Private Cloud User has permissions to use the ScVmm resources to deploy VMs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "microsoft.scvmm/virtualnetworks/join/action",
|                                                    "microsoft.scvmm/virtualnetworks/Read",
|                                                    "microsoft.scvmm/virtualmachinetemplates/clone/action",
|                                                    "microsoft.scvmm/virtualmachinetemplates/Read",
|                                                    "microsoft.scvmm/clouds/deploy/action",
|                                                    "microsoft.scvmm/clouds/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/enabledresourcetypes/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e582369a-e17b-42a5-b10c-874c387c530b",
|                                    "Name":  "Azure Arc ScVmm VM Contributor",
|                                    "Description":  "Arc ScVmm VM Contributor has permissions to perform all VM actions.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "microsoft.scvmm/virtualmachines/*",
|                                                    "microsoft.scvmm/virtualMachineInstances/*",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                    "Microsoft.HybridCompute/machines/installPatches/action",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.HybridCompute/locations/operationresults/read",
|                                                    "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                    "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/write",
|                                                    "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                    "Microsoft.HybridCompute/licenses/read",
|                                                    "Microsoft.HybridCompute/licenses/write",
|                                                    "Microsoft.HybridCompute/licenses/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6aac74c4-6311-40d2-bbdd-7d01e7c6e3a9",
|                                    "Name":  "Azure Arc ScVmm Private Clouds Onboarding",
|                                    "Description":  "Azure Arc ScVmm Private Clouds Onboarding role has permissions to provision all the required resources for onboard and deboard vmm server instances to Azure.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "microsoft.scvmm/vmmservers/Read",
|                                                    "microsoft.scvmm/vmmservers/Write",
|                                                    "microsoft.scvmm/vmmservers/Delete",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a92dfd61-77f9-4aec-a531-19858b406c87",
|                                    "Name":  "Azure Arc ScVmm Administrator role",
|                                    "Description":  "Arc ScVmm VM Administrator has permissions to perform all ScVmm actions.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ScVmm/*",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                    "Microsoft.HybridCompute/machines/installPatches/action",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.HybridCompute/locations/operationresults/read",
|                                                    "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                    "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/write",
|                                                    "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                    "Microsoft.HybridCompute/licenses/read",
|                                                    "Microsoft.HybridCompute/licenses/write",
|                                                    "Microsoft.HybridCompute/licenses/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fd036e6b-1266-47a0-b0bb-a05d04831731",
|                                    "Name":  "HDInsight on AKS Cluster Admin",
|                                    "Description":  "Grants a user/group the ability to create, delete and manage clusters within a given cluster pool. Cluster Admin can also run workloads, monitor, and manage all user activity on these clusters.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/write",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/delete",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/resize/action",
|                                                    "Microsoft.HDInsight/clusterpools/clusters/instanceviews/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/jobs/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/runjob/action",
|                                                    "Microsoft.HDInsight/clusterpools/clusters/serviceconfigs/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/availableupgrades/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/upgrade/action",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/rollback/action",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/upgradehistories/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/libraries/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/managelibraries/action",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/*/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/logs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7656b436-37d4-490a-a4ab-d39f838f0042",
|                                    "Name":  "HDInsight on AKS Cluster Pool Admin",
|                                    "Description":  "Can read, create, modify and delete HDInsight on AKS cluster pools and create clusters",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/write",
|                                                    "Microsoft.HDInsight/clusterPools/delete",
|                                                    "Microsoft.HDInsight/clusterPools/read",
|                                                    "Microsoft.HDInsight/clusterPools/write",
|                                                    "Microsoft.HDInsight/clusterpools/availableupgrades/read",
|                                                    "Microsoft.HDInsight/clusterpools/upgrade/action",
|                                                    "Microsoft.HDInsight/clusterPools/upgradehistories/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/*/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/logs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4465e953-8ced-4406-a58e-0f6e3f3b530b",
|                                    "Name":  "FHIR Data Importer",
|                                    "Description":  "Role allows user or principal to read and import FHIR Data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/import/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bcf28286-af25-4c81-bb6f-351fcab5dbe9",
|                                    "Name":  "HDInsight on AKS Cluster Operator",
|                                    "Description":  "Grants a user/group the ability to read cluster configurations, resize clusters and run jobs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HDInsight/clusterPools/read",
|                                                    "Microsoft.Hdinsight/clusterpools/clusters/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/resize/action",
|                                                    "Microsoft.HDInsight/clusterpools/clusters/instanceviews/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/jobs/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/runjob/action",
|                                                    "Microsoft.HDInsight/clusterpools/clusters/serviceconfigs/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/availableupgrades/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/upgradehistories/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/libraries/read",
|                                                    "Microsoft.HDInsight/clusterPools/clusters/managelibraries/action",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/logs/read",
|                                                    "Microsoft.Insights/diagnosticSettings/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c031e6a8-4391-4de0-8d69-4706a7ed3729",
|                                    "Name":  "API Management Developer Portal Content Editor",
|                                    "Description":  "Can customize the developer portal, edit its content, and publish it.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/portalRevisions/read",
|                                                    "Microsoft.ApiManagement/service/portalRevisions/write",
|                                                    "Microsoft.ApiManagement/service/contentTypes/read",
|                                                    "Microsoft.ApiManagement/service/contentTypes/delete",
|                                                    "Microsoft.ApiManagement/service/contentTypes/write",
|                                                    "Microsoft.ApiManagement/service/contentTypes/contentItems/read",
|                                                    "Microsoft.ApiManagement/service/contentTypes/contentItems/write",
|                                                    "Microsoft.ApiManagement/service/contentTypes/contentItems/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d24ecba3-c1f4-40fa-a7bb-4588a071e8fd",
|                                    "Name":  "Defender Agentless VM Scan",
|                                    "Description":  "Role that provides access to disk snapshot for security analysis.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action",
|                                                    "Microsoft.Compute/diskEncryptionSets/read",
|                                                    "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/instanceView/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "80dcbedb-47ef-405d-95bd-188a1b4ac406",
|                                    "Name":  "Elastic SAN Owner",
|                                    "Description":  "Allows for full access to all resources under Azure Elastic SAN including changing network security policies to unblock data path access",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ElasticSan/elasticSans/*",
|                                                    "Microsoft.ElasticSan/locations/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "af6a70f8-3c9f-4105-acf1-d719e9fca4ca",
|                                    "Name":  "Elastic SAN Reader",
|                                    "Description":  "Allows for control path read access to Azure Elastic SAN",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ElasticSan/elasticSans/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "489581de-a3bd-480d-9518-53dea7416b33",
|                                    "Name":  "Desktop Virtualization Power On Contributor",
|                                    "Description":  "Provide permission to the Azure Virtual Desktop Resource Provider to start virtual machines.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/virtualMachines/start/action",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.HybridCompute/locations/operationresults/read",
|                                                    "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                    "Microsoft.AzureStackHCI/virtualMachineInstances/read",
|                                                    "Microsoft.AzureStackHCI/virtualMachineInstances/start/action",
|                                                    "Microsoft.AzureStackHCI/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a959dbd1-f747-45e3-8ba6-dd80f235f97c",
|                                    "Name":  "Desktop Virtualization Virtual Machine Contributor",
|                                    "Description":  "This role is in preview and subject to change. Provide permission to the Azure Virtual Desktop Resource Provider to create, delete, update, start, and stop virtual machines.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/write",
|                                                    "Microsoft.DesktopVirtualization/hostpools/retrieveRegistrationToken/action",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/write",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/delete",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/disconnect/action",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/sendMessage/action",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionHostConfigurations/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/doNotUseInternalAPI/action",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/retryprovisioning/action",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/availabilitySets/write",
|                                                    "Microsoft.Compute/availabilitySets/vmSizes/read",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/galleries/read",
|                                                    "Microsoft.Compute/galleries/images/read",
|                                                    "Microsoft.Compute/galleries/images/versions/read",
|                                                    "Microsoft.Compute/images/read",
|                                                    "Microsoft.Compute/locations/usages/read",
|                                                    "Microsoft.Compute/locations/vmSizes/read",
|                                                    "Microsoft.Compute/operations/read",
|                                                    "Microsoft.Compute/skus/read",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachines/delete",
|                                                    "Microsoft.Compute/virtualMachines/start/action",
|                                                    "Microsoft.Compute/virtualMachines/powerOff/action",
|                                                    "Microsoft.Compute/virtualMachines/restart/action",
|                                                    "Microsoft.Compute/virtualMachines/deallocate/action",
|                                                    "Microsoft.Compute/virtualMachines/runCommand/action",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/write",
|                                                    "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                    "Microsoft.Compute/virtualMachines/runCommands/read",
|                                                    "Microsoft.Compute/virtualMachines/runCommands/write",
|                                                    "Microsoft.Compute/virtualMachines/vmSizes/read",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/usages/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Marketplace/offerTypes/publishers/offers/plans/agreements/read",
|                                                    "Microsoft.KeyVault/vaults/deploy/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.DesktopVirtualization/scalingPlans/read",
|                                                    "Microsoft.DesktopVirtualization/scalingPlans/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "40c5ff49-9181-41f8-ae61-143b0e78555e",
|                                    "Name":  "Desktop Virtualization Power On Off Contributor",
|                                    "Description":  "Provide permission to the Azure Virtual Desktop Resource Provider to start and stop virtual machines.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.AzureStackHCI/operations/read",
|                                                    "Microsoft.AzureStackHCI/virtualMachineInstances/read",
|                                                    "Microsoft.AzureStackHCI/virtualMachineInstances/restart/action",
|                                                    "Microsoft.AzureStackHCI/virtualMachineInstances/start/action",
|                                                    "Microsoft.AzureStackHCI/virtualMachineInstances/stop/action",
|                                                    "Microsoft.Compute/virtualMachines/deallocate/action",
|                                                    "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                    "Microsoft.Compute/virtualMachines/powerOff/action",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/restart/action",
|                                                    "Microsoft.Compute/virtualMachines/start/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesCancelOperations/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteDeallocate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteHibernate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteStart/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationErrors/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationStatus/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitDeallocate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitHibernate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitStart/action",
|                                                    "Microsoft.ComputeSchedule/register/action",
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/delete",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/read",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/sendMessage/action",
|                                                    "Microsoft.DesktopVirtualization/hostpools/sessionhosts/write",
|                                                    "Microsoft.DesktopVirtualization/hostpools/write",
|                                                    "Microsoft.HybridCompute/locations/operationresults/read",
|                                                    "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/eventtypes/values/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "76cc9ee4-d5d3-4a45-a930-26add3d73475",
|                                    "Name":  "Access Review Operator Service Role",
|                                    "Description":  "Lets you grant Access Review System app permissions to discover and revoke access as needed by the access review process.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "Microsoft.Management/getEntities/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a8281131-f312-4f34-8d98-ae12be9f0d23",
|                                    "Name":  "Elastic SAN Volume Group Owner",
|                                    "Description":  "Allows for full access to a volume group in Azure Elastic SAN including changing network security policies to unblock data path access",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/*",
|                                                    "Microsoft.ElasticSan/locations/asyncoperations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4339b7cf-9826-4e41-b4ed-c7f4505dac08",
|                                    "Name":  "Artifact Signing Identity Verifier",
|                                    "Description":  "Manage identity or business verification requests.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CodeSigning/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CodeSigning/IdentityVerification/Read",
|                                                        "Microsoft.CodeSigning/IdentityVerification/Write",
|                                                        "Microsoft.CodeSigning/IdentityVerification/Delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a2c4a527-7dc0-4ee3-897b-403ade70fafb",
|                                    "Name":  "Video Indexer Restricted Viewer",
|                                    "Description":  "Has access to view and search through all video\u0027s insights and transcription in the Video Indexer portal. No access to model customization, embedding of widget, downloading videos, or sharing the account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.VideoIndexer/*/read",
|                                                    "Microsoft.VideoIndexer/accounts/*/action"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.VideoIndexer/*/write",
|                                                       "Microsoft.VideoIndexer/*/delete",
|                                                       "Microsoft.VideoIndexer/accounts/generateAccessToken/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b0d8363b-8ddd-447d-831f-62ca05bff136",
|                                    "Name":  "Monitoring Data Reader",
|                                    "Description":  "Can access the data in an Azure Monitor Workspace.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Monitor/accounts/data/metrics/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "30b27cfc-9c84-438e-b0ce-70e35255df80",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Reader",
|                                    "Description":  "Grants read-only access to most Kubernetes resources within a namespace in the fleet-managed hub cluster. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation).  Applying this role at cluster scope will give access across all namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/fleets/read",
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/fleets/apps/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/apps/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/apps/statefulsets/read",
|                                                        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
|                                                        "Microsoft.ContainerService/fleets/batch/cronjobs/read",
|                                                        "Microsoft.ContainerService/fleets/batch/jobs/read",
|                                                        "Microsoft.ContainerService/fleets/configmaps/read",
|                                                        "Microsoft.ContainerService/fleets/endpoints/read",
|                                                        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/fleets/events/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/limitranges/read",
|                                                        "Microsoft.ContainerService/fleets/namespaces/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
|                                                        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                        "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                        "Microsoft.ContainerService/fleets/serviceaccounts/read",
|                                                        "Microsoft.ContainerService/fleets/services/read",
|                                                        "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/internalmemberclusters/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverridesnapshots/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/works/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "18ab4d3d-a1bf-4477-8ad9-8359bc988f69",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Cluster Admin",
|                                    "Description":  "Grants read/write access to all Kubernetes resources in the fleet-managed hub cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/fleets/read",
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "434fb43a-c01c-447e-9f67-c3ad923cfaba",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Admin",
|                                    "Description":  "Grants read/write access to Kubernetes resources within a namespace in the fleet-managed hub cluster - provides write permissions on most objects within a a namespace, with the exception of ResourceQuota object and the namespace object itself. Applying this role at cluster scope will give access across all namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/fleets/read",
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/fleets/apps/daemonsets/*",
|                                                        "Microsoft.ContainerService/fleets/apps/deployments/*",
|                                                        "Microsoft.ContainerService/fleets/apps/statefulsets/*",
|                                                        "Microsoft.ContainerService/fleets/authorization.k8s.io/localsubjectaccessreviews/write",
|                                                        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/*",
|                                                        "Microsoft.ContainerService/fleets/batch/cronjobs/*",
|                                                        "Microsoft.ContainerService/fleets/batch/jobs/*",
|                                                        "Microsoft.ContainerService/fleets/configmaps/*",
|                                                        "Microsoft.ContainerService/fleets/endpoints/*",
|                                                        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/fleets/events/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/daemonsets/*",
|                                                        "Microsoft.ContainerService/fleets/extensions/deployments/*",
|                                                        "Microsoft.ContainerService/fleets/extensions/ingresses/*",
|                                                        "Microsoft.ContainerService/fleets/extensions/networkpolicies/*",
|                                                        "Microsoft.ContainerService/fleets/limitranges/read",
|                                                        "Microsoft.ContainerService/fleets/namespaces/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/*",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/*",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumeclaims/*",
|                                                        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/*",
|                                                        "Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/rolebindings/*",
|                                                        "Microsoft.ContainerService/fleets/rbac.authorization.k8s.io/roles/*",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/*",
|                                                        "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                        "Microsoft.ContainerService/fleets/secrets/*",
|                                                        "Microsoft.ContainerService/fleets/serviceaccounts/*",
|                                                        "Microsoft.ContainerService/fleets/services/*",
|                                                        "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/internalmemberclusters/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/*",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverridesnapshots/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/works/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5af6afb3-c06c-4fa4-8848-71a8aee05683",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Writer",
|                                    "Description":  "Grants read/write access to most Kubernetes resources within a namespace in the fleet-managed hub cluster. This role does not allow viewing or modifying roles or role bindings. However, this role allows accessing Secrets as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace.  Applying this role at cluster scope will give access across all namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/fleets/read",
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/fleets/apps/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/apps/daemonsets/write",
|                                                        "Microsoft.ContainerService/fleets/apps/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/apps/deployments/write",
|                                                        "Microsoft.ContainerService/fleets/apps/statefulsets/read",
|                                                        "Microsoft.ContainerService/fleets/apps/statefulsets/write",
|                                                        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
|                                                        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/write",
|                                                        "Microsoft.ContainerService/fleets/batch/cronjobs/read",
|                                                        "Microsoft.ContainerService/fleets/batch/cronjobs/write",
|                                                        "Microsoft.ContainerService/fleets/batch/jobs/read",
|                                                        "Microsoft.ContainerService/fleets/batch/jobs/write",
|                                                        "Microsoft.ContainerService/fleets/configmaps/read",
|                                                        "Microsoft.ContainerService/fleets/configmaps/write",
|                                                        "Microsoft.ContainerService/fleets/endpoints/read",
|                                                        "Microsoft.ContainerService/fleets/endpoints/write",
|                                                        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/fleets/events/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/daemonsets/write",
|                                                        "Microsoft.ContainerService/fleets/extensions/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/deployments/write",
|                                                        "Microsoft.ContainerService/fleets/extensions/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/ingresses/write",
|                                                        "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/networkpolicies/write",
|                                                        "Microsoft.ContainerService/fleets/limitranges/read",
|                                                        "Microsoft.ContainerService/fleets/namespaces/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/write",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/write",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumeclaims/write",
|                                                        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
|                                                        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/write",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/write",
|                                                        "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                        "Microsoft.ContainerService/fleets/secrets/read",
|                                                        "Microsoft.ContainerService/fleets/secrets/write",
|                                                        "Microsoft.ContainerService/fleets/serviceaccounts/read",
|                                                        "Microsoft.ContainerService/fleets/serviceaccounts/write",
|                                                        "Microsoft.ContainerService/fleets/services/read",
|                                                        "Microsoft.ContainerService/fleets/services/write",
|                                                        "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/internalmemberclusters/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/write",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverridesnapshots/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/works/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "63bb64ad-9799-4770-b5c3-24ed299a07bf",
|                                    "Name":  "Azure Kubernetes Fleet Manager Contributor Role",
|                                    "Description":  "Grants read/write access to Azure resources provided by Azure Kubernetes Fleet Manager, including fleets, fleet members, fleet update strategies, fleet update runs, etc.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/fleets/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.ContainerService/fleetMemberships/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ba79058c-0414-4a34-9e42-c3399d80cd5a",
|                                    "Name":  "Kubernetes Namespace User",
|                                    "Description":  "Allows a user to read namespace resources and retrieve kubeconfig for the cluster",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.KubernetesConfiguration/namespaces/read",
|                                                    "Microsoft.KubernetesConfiguration/namespaces/listUserCredential/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c6decf44-fd0a-444c-a844-d653c394e7ab",
|                                    "Name":  "Data Labeling - Labeler",
|                                    "Description":  "Can label data in Labeling.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/experiments/runs/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/labeling/projects/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/labeling/projects/summary/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/labeling/labels/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/labeling/labels/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f58310d9-a9f6-439a-9e8d-f62e7b41a168",
|                                    "Name":  "Role Based Access Control Administrator",
|                                    "Description":  "Manage access to Azure resources by assigning roles using Azure RBAC. This role does not allow you to manage access using other ways, such as Azure Policy.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "*/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "392ae280-861d-42bd-9ea5-08ee6d83b80e",
|                                    "Name":  "Template Spec Reader",
|                                    "Description":  "Allows read access to Template Specs at the assigned scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/templateSpecs/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1c9b6475-caf0-4164-b5a1-2142a7116f4b",
|                                    "Name":  "Template Spec Contributor",
|                                    "Description":  "Allows full access to Template Spec operations at the assigned scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/templateSpecs/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "51d6186e-6489-4900-b93f-92e23144cca5",
|                                    "Name":  "Microsoft Sentinel Playbook Operator",
|                                    "Description":  "Microsoft Sentinel Playbook Operator",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Logic/workflows/read",
|                                                    "Microsoft.Logic/workflows/triggers/listCallbackUrl/action",
|                                                    "Microsoft.Web/sites/hostruntime/webhooks/api/workflows/triggers/listCallbackUrl/action",
|                                                    "Microsoft.Web/sites/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "18e40d4e-8d2e-438d-97e1-9528336e149c",
|                                    "Name":  "Deployment Environments User",
|                                    "Description":  "Provides access to manage environment resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DevCenter/projects/read",
|                                                    "Microsoft.DevCenter/projects/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.DevCenter/projects/pools/read",
|                                                       "Microsoft.DevCenter/projects/pools/schedules/read"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DevCenter/projects/users/environments/userRead/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/userWrite/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/userDelete/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/userActionManage/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/userOutputsRead/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "80558df3-64f9-4c0f-b32d-e5094b036b0b",
|                                    "Name":  "Azure Spring Apps Connect Role",
|                                    "Description":  "Azure Spring Apps Connect Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/apps/deployments/connect/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a99b0159-1064-4c22-a57b-c9b3caa1c054",
|                                    "Name":  "Azure Spring Apps Remote Debugging Role",
|                                    "Description":  "Azure Spring Apps Remote Debugging Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/apps/deployments/remotedebugging/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1823dd4f-9b8c-4ab6-ab4e-7397a3684615",
|                                    "Name":  "AzureML Registry User",
|                                    "Description":  "Can perform all actions on Machine Learning Services Registry assets as well as get Registry resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/registries/read",
|                                                    "Microsoft.MachineLearningServices/registries/assets/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e503ece1-11d0-4e8e-8e2c-7a6c3bf38815",
|                                    "Name":  "AzureML Compute Operator",
|                                    "Description":  "Can access and perform CRUD operations on Machine Learning Services managed compute resources (including Notebook VMs).",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/computes/*",
|                                                    "Microsoft.MachineLearningServices/workspaces/notebooks/vm/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "05352d14-a920-4328-a0de-4cbe7430e26b",
|                                    "Name":  "Azure Center for SAP solutions reader",
|                                    "Description":  "This role provides read access to all capabilities of Azure Center for SAP solutions.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Advisor/configurations/read",
|                                                    "Microsoft.Advisor/recommendations/read",
|                                                    "Microsoft.Workloads/sapvirtualInstances/*/read",
|                                                    "Microsoft.Workloads/Locations/*/read",
|                                                    "Microsoft.Workloads/Operations/read",
|                                                    "Microsoft.Workloads/Locations/OperationStatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/virtualMachines/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/ipconfigurations/read",
|                                                    "Microsoft.Network/networkInterfaces/loadBalancers/read",
|                                                    "Microsoft.Network/networkInterfaces/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                    "Microsoft.Network/loadBalancers/frontendIPConfigurations/read",
|                                                    "Microsoft.Network/loadBalancers/loadBalancingRules/read",
|                                                    "Microsoft.Network/loadBalancers/inboundNatRules/read",
|                                                    "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.Network/loadBalancers/networkInterfaces/read",
|                                                    "Microsoft.Network/loadBalancers/outboundRules/read",
|                                                    "Microsoft.Network/loadBalancers/virtualMachines/read",
|                                                    "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/privateEndpoints/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/disks/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "aabbc5dd-1af0-458b-a942-81af88f9c138",
|                                    "Name":  "Azure Center for SAP solutions service role",
|                                    "Description":  "Azure Center for SAP solutions service role - This role is intended to be used for providing the permissions to user assigned managed identity. Azure Center for SAP solutions will use this identity to deploy and manage SAP systems.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/loadBalancers/write",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/write",
|                                                    "Microsoft.Network/loadBalancers/frontendIPConfigurations/read",
|                                                    "Microsoft.Network/loadBalancers/loadBalancingRules/read",
|                                                    "Microsoft.Network/loadBalancers/inboundNatRules/read",
|                                                    "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.Network/loadBalancers/networkInterfaces/read",
|                                                    "Microsoft.Network/loadBalancers/outboundRules/read",
|                                                    "Microsoft.Network/loadBalancers/virtualMachines/read",
|                                                    "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkInterfaces/ipconfigurations/read",
|                                                    "Microsoft.Network/networkInterfaces/loadBalancers/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/checkIpAddressAvailability/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/virtualMachines/read",
|                                                    "Microsoft.Network/virtualNetworks/virtualMachines/read",
|                                                    "Microsoft.Network/networkInterfaces/ipconfigurations/join/action",
|                                                    "Microsoft.Network/privateEndpoints/read",
|                                                    "Microsoft.Network/privateEndpoints/write",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/frontendIPConfigurations/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinLoadBalancer/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/write",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/write",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/availabilitySets/write",
|                                                    "Microsoft.Compute/skus/read",
|                                                    "Microsoft.Compute/sshPublicKeys/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/write",
|                                                    "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7b0c7e81-271f-4c71-90bf-e30bdfdbc2f7",
|                                    "Name":  "Azure Center for SAP solutions administrator",
|                                    "Description":  "This role provides read and write access to all capabilities of Azure Center for SAP solutions.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Advisor/configurations/read",
|                                                    "Microsoft.Advisor/recommendations/read",
|                                                    "Microsoft.Workloads/sapvirtualInstances/*/read",
|                                                    "Microsoft.Workloads/sapVirtualInstances/*/write",
|                                                    "Microsoft.Workloads/sapVirtualInstances/*/delete",
|                                                    "Microsoft.Workloads/Locations/*/action",
|                                                    "Microsoft.Workloads/Locations/*/read",
|                                                    "Microsoft.Workloads/sapVirtualInstances/*/start/action",
|                                                    "Microsoft.Workloads/sapVirtualInstances/*/stop/action",
|                                                    "Microsoft.Workloads/connectors/*/read",
|                                                    "Microsoft.Workloads/connectors/*/write",
|                                                    "Microsoft.Workloads/connectors/*/delete",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/virtualMachines/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/ipconfigurations/read",
|                                                    "Microsoft.Network/networkInterfaces/loadBalancers/read",
|                                                    "Microsoft.Network/networkInterfaces/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                    "Microsoft.Network/loadBalancers/frontendIPConfigurations/read",
|                                                    "Microsoft.Network/loadBalancers/loadBalancingRules/read",
|                                                    "Microsoft.Network/loadBalancers/inboundNatRules/read",
|                                                    "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.Network/loadBalancers/networkInterfaces/read",
|                                                    "Microsoft.Network/loadBalancers/outboundRules/read",
|                                                    "Microsoft.Network/loadBalancers/virtualMachines/read",
|                                                    "Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Network/privateEndpoints/read",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/sshPublicKeys/read",
|                                                    "Microsoft.Compute/sshPublicKeys/write",
|                                                    "Microsoft.Compute/sshPublicKeys/*/generateKeyPair/action",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                    "Microsoft.Compute/disks/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fbc52c3f-28ad-4303-a892-8a056630b8f1",
|                                    "Name":  "AppGw for Containers Configuration Manager",
|                                    "Description":  "Allows access and configuration updates to Application Gateway for Containers resource.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ServiceNetworking/trafficControllers/read",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/write",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/delete",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/frontends/read",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/frontends/write",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/frontends/delete",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/associations/read",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/associations/write",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/associations/delete",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/*/read",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/*/write",
|                                                    "Microsoft.ServiceNetworking/trafficControllers/*/delete",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ServiceNetworking/trafficControllers/serviceRoutingConfigurations/read",
|                                                        "Microsoft.ServiceNetworking/trafficControllers/serviceRoutingConfigurations/write",
|                                                        "Microsoft.ServiceNetworking/trafficControllers/serviceRoutingConfigurations/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4ba50f17-9666-485c-a643-ff00808643f0",
|                                    "Name":  "FHIR SMART User",
|                                    "Description":  "Role allows user to access FHIR Service according to SMART on FHIR specification",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/readById/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/search/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/smart/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/readById/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/search/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/smart/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a001fd3d-188f-4b5d-821b-7da978bf7442",
|                                    "Name":  "Cognitive Services OpenAI Contributor",
|                                    "Description":  "Full access including the ability to fine-tune, deploy and generate text",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.CognitiveServices/accounts/deployments/write",
|                                                    "Microsoft.CognitiveServices/accounts/deployments/delete",
|                                                    "Microsoft.CognitiveServices/accounts/raiPolicies/read",
|                                                    "Microsoft.CognitiveServices/accounts/raiPolicies/write",
|                                                    "Microsoft.CognitiveServices/accounts/raiPolicies/delete",
|                                                    "Microsoft.CognitiveServices/accounts/commitmentplans/read",
|                                                    "Microsoft.CognitiveServices/accounts/commitmentplans/write",
|                                                    "Microsoft.CognitiveServices/accounts/commitmentplans/delete",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5e0bd9bd-7b93-4f28-af87-19fc36ad61bd",
|                                    "Name":  "Cognitive Services OpenAI User",
|                                    "Description":  "Ability to view files, models, deployments. Readers can\u0027t make any changes They can inference and create images",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/*/read",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/engines/completions/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/engines/search/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/engines/generate/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/deployments/audio/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/deployments/search/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/deployments/completions/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/deployments/chat/completions/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/deployments/realtime/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/deployments/extensions/chat/completions/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/deployments/embeddings/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/images/generations/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/video/generations/*/action",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/video/generations/*/delete",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/assistants/*",
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/responses/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "36e80216-a7e8-4f42-a7e1-f12c98cbaf8a",
|                                    "Name":  "Azure impact Reporter role",
|                                    "Description":  "built-in role for azure impact write access",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Impact/WorkloadImpacts/*",
|                                                    "Microsoft.Impact/ImpactCategories/read",
|                                                    "Microsoft.Impact/TopologyImpacts/*",
|                                                    "Microsoft.Impact/getUploadToken/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "68ff5d27-c7f5-4fa9-a21c-785d0df7bd9e",
|                                    "Name":  "Impact Reader",
|                                    "Description":  "Allows read-only access to reported impacts and impact categories",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Impact/WorkloadImpacts/read",
|                                                    "Microsoft.Impact/ImpactCategories/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ad2dd5fb-cd4b-4fd4-a9b6-4fed3630980b",
|                                    "Name":  "ContainerApp Reader",
|                                    "Description":  "View all containerapp resources, but does not allow you to make any changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.App/containerApps/*/read",
|                                                    "Microsoft.App/containerApps/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1afdec4b-e479-420e-99e7-f82237c7c5e6",
|                                    "Name":  "Azure Kubernetes Service Cluster Monitoring User",
|                                    "Description":  "List cluster monitoring user credential action.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action",
|                                                    "Microsoft.ContainerService/managedClusters/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f5819b54-e033-4d82-ac66-4fec3cbf3f4c",
|                                    "Name":  "Azure Connected Machine Resource Manager",
|                                    "Description":  "Custom Role for AzureStackHCI RP to manage hybrid compute machines and hybrid connectivity endpoints in a resource group",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/*/read",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/write",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/*/read",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridConnectivity/endpoints/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/write",
|                                                    "Microsoft.HybridConnectivity/endpoints/write",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.EdgeMarketplace/locations/operationStatuses/read",
|                                                    "Microsoft.EdgeMarketPlace/offers/getAccessToken/action",
|                                                    "Microsoft.EdgeMarketPlace/offers/generateAccessToken/action",
|                                                    "Microsoft.EdgeMarketplace/publishers/read",
|                                                    "Microsoft.EdgeMarketplace/offers/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/read",
|                                                    "Microsoft.Attestation/attestationProviders/write",
|                                                    "Microsoft.Attestation/attestationProviders/read",
|                                                    "Microsoft.Attestation/attestationProviders/delete",
|                                                    "Microsoft.Attestation/attestationProviders/attestation/read",
|                                                    "Microsoft.Attestation/attestationProviders/attestation/write",
|                                                    "Microsoft.Attestation/attestationProviders/attestation/delete",
|                                                    "Microsoft.HybridCompute/settings/read",
|                                                    "Microsoft.HybridCompute/settings/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "189207d4-bb67-4208-a635-b06afe8b2c57",
|                                    "Name":  "SqlDb Migration Role",
|                                    "Description":  "Role for SqlDb migration",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Sql/servers/read",
|                                                    "Microsoft.Sql/servers/write",
|                                                    "Microsoft.Sql/servers/databases/read",
|                                                    "Microsoft.Sql/servers/databases/write",
|                                                    "Microsoft.Sql/servers/databases/delete",
|                                                    "Microsoft.DataMigration/locations/operationResults/read",
|                                                    "Microsoft.DataMigration/locations/operationStatuses/read",
|                                                    "Microsoft.DataMigration/locations/sqlMigrationServiceOperationResults/read",
|                                                    "Microsoft.DataMigration/databaseMigrations/write",
|                                                    "Microsoft.DataMigration/databaseMigrations/read",
|                                                    "Microsoft.DataMigration/databaseMigrations/delete",
|                                                    "Microsoft.DataMigration/databaseMigrations/cancel/action",
|                                                    "Microsoft.DataMigration/databaseMigrations/cutover/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/write",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/delete",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/read",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listAuthKeys/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/regenerateAuthKeys/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/deleteNode/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listMonitoringData/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listMigrations/read",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/MonitoringData/read",
|                                                    "Microsoft.DataMigration/register/action",
|                                                    "Microsoft.DataMigration/operations/read",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/validateIR/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c4bc862a-3b64-4a35-a021-a380c159b042",
|                                    "Name":  "Bayer Ag Powered Services GDU Solution",
|                                    "Description":  "Provide access to GDU Solution by Bayer Ag Powered Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/farms/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ef29765d-0d37-4119-a4f8-f9f9902c9588",
|                                    "Name":  "Bayer Ag Powered Services Imagery Solution",
|                                    "Description":  "Provide access to Imagery Solution by Bayer Ag Powered Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/farms/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/farms/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/ingestionJobs/satelliteDataIngestionJobs/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/scenes/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0105a6b0-4bb9-43d2-982a-12806f9faddb",
|                                    "Name":  "Azure Center for SAP solutions Service role for management",
|                                    "Description":  "This role has permissions that the user assigned managed identity must have to enable registration for the existing systems.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6d949e1d-41e2-46e3-8920-c6e4f31a8310",
|                                    "Name":  "Azure Center for SAP solutions Management role",
|                                    "Description":  "This role has permissions which allow users to register existing systems, view and manage systems.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d5a2ae44-610b-4500-93be-660a0c5f5ca6",
|                                    "Name":  "Defender Kubernetes API Access",
|                                    "Description":  "Grants Microsoft Defender for Cloud access to Azure Kubernetes Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/write",
|                                                    "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read",
|                                                    "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/delete",
|                                                    "Microsoft.ContainerService/managedClusters/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/providers/features/register/action",
|                                                    "Microsoft.Security/pricings/securityoperators/read",
|                                                    "Microsoft.Security/securityOperators/read",
|                                                    "Microsoft.Authorization/policyAssignments/read",
|                                                    "Microsoft.Authorization/policySetDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f0310ce6-e953-4cf8-b892-fb1c87eaf7f6",
|                                    "Name":  "Azure Usage Billing Data Sender",
|                                    "Description":  "Azure Usage Billing shared BuiltIn role to be used for all Customer Account Authentication",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.UsageBilling/accounts/inputs/send/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "96062cf7-95ca-4f89-9b9d-2a2aa47356af",
|                                    "Name":  "Defender Registry Access",
|                                    "Description":  "Grants Microsoft Defender for Cloud access to Azure Container Registry for security assessment of container images",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/pull/read",
|                                                    "Microsoft.ContainerRegistry/registries/push/write",
|                                                    "Microsoft.ContainerRegistry/registries/artifacts/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/write",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/write",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/delete",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1d335eef-eee1-47fe-a9e0-53214eba8872",
|                                    "Name":  "SqlMI Migration Role",
|                                    "Description":  "Role for SqlMI migration",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Sql/managedInstances/read",
|                                                    "Microsoft.Sql/managedInstances/write",
|                                                    "Microsoft.Sql/managedInstances/databases/read",
|                                                    "Microsoft.Sql/managedInstances/databases/write",
|                                                    "Microsoft.Sql/managedInstances/databases/delete",
|                                                    "Microsoft.Sql/managedInstances/metrics/read",
|                                                    "Microsoft.DataMigration/locations/operationResults/read",
|                                                    "Microsoft.DataMigration/locations/operationStatuses/read",
|                                                    "Microsoft.DataMigration/locations/sqlMigrationServiceOperationResults/read",
|                                                    "Microsoft.DataMigration/databaseMigrations/write",
|                                                    "Microsoft.DataMigration/databaseMigrations/read",
|                                                    "Microsoft.DataMigration/databaseMigrations/delete",
|                                                    "Microsoft.DataMigration/databaseMigrations/cancel/action",
|                                                    "Microsoft.DataMigration/databaseMigrations/cutover/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/write",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/delete",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/read",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listAuthKeys/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/regenerateAuthKeys/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/deleteNode/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listMonitoringData/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listMigrations/read",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/MonitoringData/read",
|                                                    "Microsoft.DataMigration/register/action",
|                                                    "Microsoft.DataMigration/operations/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/validateIR/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ae8036db-e102-405b-a1b9-bae082ea436d",
|                                    "Name":  "SqlVM Migration Role",
|                                    "Description":  "Role for SqlVM migration",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DataMigration/locations/operationResults/read",
|                                                    "Microsoft.DataMigration/locations/operationStatuses/read",
|                                                    "Microsoft.DataMigration/locations/sqlMigrationServiceOperationResults/read",
|                                                    "Microsoft.DataMigration/databaseMigrations/write",
|                                                    "Microsoft.DataMigration/databaseMigrations/read",
|                                                    "Microsoft.DataMigration/databaseMigrations/delete",
|                                                    "Microsoft.DataMigration/databaseMigrations/cancel/action",
|                                                    "Microsoft.DataMigration/databaseMigrations/cutover/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/write",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/delete",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/read",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listAuthKeys/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/regenerateAuthKeys/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/deleteNode/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listMonitoringData/action",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/listMigrations/read",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/MonitoringData/read",
|                                                    "Microsoft.DataMigration/register/action",
|                                                    "Microsoft.DataMigration/operations/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/listkeys/action",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.SqlVirtualMachine/sqlVirtualMachines/read",
|                                                    "Microsoft.SqlVirtualMachine/sqlVirtualMachines/write",
|                                                    "Microsoft.DataMigration/sqlMigrationServices/validateIR/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a9b99099-ead7-47db-8fcf-072597a61dfa",
|                                    "Name":  "Bayer Ag Powered Services CWUM Solution",
|                                    "Description":  "Provide access to CWUM Solution by Bayer Ag Powered Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/boundaries/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/farms/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/farms/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/ingestionJobs/satelliteDataIngestionJobs/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/scenes/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0ab34830-df19-4f8c-b84e-aa85b8afa6e8",
|                                    "Name":  "Azure Front Door Domain Contributor",
|                                    "Description":  "For internal use within Azure. Can manage Azure Front Door domains, but can\u0027t grant access to other users.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Cdn/operationresults/profileresults/customdomainresults/read",
|                                                    "Microsoft.Cdn/profiles/customdomains/read",
|                                                    "Microsoft.Cdn/profiles/customdomains/write",
|                                                    "Microsoft.Cdn/profiles/customdomains/delete",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3f2eb865-5811-4578-b90a-6fc6fa0df8e5",
|                                    "Name":  "Azure Front Door Secret Contributor",
|                                    "Description":  "For internal use within Azure. Can manage Azure Front Door secrets, but can\u0027t grant access to other users.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Cdn/operationresults/profileresults/secretresults/read",
|                                                    "Microsoft.Cdn/profiles/secrets/read",
|                                                    "Microsoft.Cdn/profiles/secrets/write",
|                                                    "Microsoft.Cdn/profiles/secrets/delete",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0f99d363-226e-4dca-9920-b807cf8e1a5f",
|                                    "Name":  "Azure Front Door Domain Reader",
|                                    "Description":  "For internal use within Azure. Can view Azure Front Door domains, but can\u0027t make changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Cdn/operationresults/profileresults/customdomainresults/read",
|                                                    "Microsoft.Cdn/profiles/customdomains/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0db238c4-885e-4c4f-a933-aa2cef684fca",
|                                    "Name":  "Azure Front Door Secret Reader",
|                                    "Description":  "For internal use within Azure. Can view Azure Front Door secrets, but can\u0027t make changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Cdn/operationresults/profileresults/secretresults/read",
|                                                    "Microsoft.Cdn/profiles/secrets/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d18ad5f3-1baf-4119-b49b-d944edb1f9d0",
|                                    "Name":  "MySQL Backup And Export Operator",
|                                    "Description":  "Grants full access to manage backup and export resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DBforMySQL/flexibleServers/validateBackup/action",
|                                                    "Microsoft.DBforMySQL/flexibleServers/backupAndExport/action",
|                                                    "Microsoft.DBforMySQL/locations/operationResults/read",
|                                                    "Microsoft.DBforMySQL/locations/azureAsyncOperation/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a8835c7d-b5cb-47fa-b6f0-65ea10ce07a2",
|                                    "Name":  "LocalNGFirewallAdministrator role",
|                                    "Description":  "Allows user to create, modify, describe, or delete NGFirewalls.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "PaloAltoNetworks.Cloudngfw/firewalls/*",
|                                                    "PaloAltoNetworks.Cloudngfw/localRulestacks/read",
|                                                    "PaloAltoNetworks.Cloudngfw/globalRulestacks/read",
|                                                    "PaloAltoNetworks.Cloudngfw/Locations/operationStatuses/read",
|                                                    "Microsoft.OperationalInsights/workspaces/write",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedKeys/read",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/publicIPAddresses/write",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/publicIPAddresses/join/action",
|                                                    "Microsoft.Network/networkVirtualAppliances/read",
|                                                    "Microsoft.Network/networkVirtualAppliances/write",
|                                                    "Microsoft.Network/networkVirtualAppliances/delete",
|                                                    "Microsoft.Network/virtualHubs/read",
|                                                    "Microsoft.Network/virtualWans/read",
|                                                    "Microsoft.Network/virtualWans/virtualHubs/read",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "PaloAltoNetworks.Cloudngfw/localRulestacks/fqdnlists/read",
|                                                    "PaloAltoNetworks.Cloudngfw/localRulestacks/localRules/read",
|                                                    "PaloAltoNetworks.Cloudngfw/localRulestacks/listFirewalls/action",
|                                                    "PaloAltoNetworks.Cloudngfw/createProductSerialNumber/action",
|                                                    "PaloAltoNetworks.Cloudngfw/listCloudManagerTenants/action",
|                                                    "PaloAltoNetworks.Cloudngfw/listProductSerialNumberStatus/action",
|                                                    "PaloAltoNetworks.Cloudngfw/listSupportInfo/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bda0d508-adf1-4af0-9c28-88919fc3ae06",
|                                    "Name":  "Azure Stack HCI Administrator",
|                                    "Description":  "Grants full access to the cluster and its resources, including the ability to register Azure Stack HCI and assign others as Azure Arc HCI VM Contributor and/or Azure Arc HCI VM Reader",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStackHCI/register/action",
|                                                    "Microsoft.AzureStackHCI/Unregister/Action",
|                                                    "Microsoft.AzureStackHCI/clusters/*",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/Read",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Read",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/Write",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Write",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/Delete",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Delete",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/join/action",
|                                                    "Microsoft.HybridCompute/register/action",
|                                                    "Microsoft.GuestConfiguration/register/action",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                    "Microsoft.HybridConnectivity/register/action",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.AzureStackHCI/*",
|                                                    "Microsoft.AzureStackHCI/EdgeMachines/*",
|                                                    "Microsoft.AzureStackHCI/DevicePools/*",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                    "Microsoft.HybridCompute/machines/installPatches/action",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.HybridCompute/locations/operationresults/read",
|                                                    "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                    "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/write",
|                                                    "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                    "Microsoft.HybridCompute/licenses/read",
|                                                    "Microsoft.HybridCompute/licenses/write",
|                                                    "Microsoft.HybridCompute/licenses/delete",
|                                                    "Microsoft.ResourceConnector/register/action",
|                                                    "Microsoft.ResourceConnector/appliances/read",
|                                                    "Microsoft.ResourceConnector/appliances/write",
|                                                    "Microsoft.ResourceConnector/appliances/delete",
|                                                    "Microsoft.ResourceConnector/locations/operationresults/read",
|                                                    "Microsoft.ResourceConnector/locations/operationsstatus/read",
|                                                    "Microsoft.ResourceConnector/appliances/listClusterUserCredential/action",
|                                                    "Microsoft.ResourceConnector/appliances/listKeys/action",
|                                                    "Microsoft.ResourceConnector/operations/read",
|                                                    "Microsoft.ExtendedLocation/register/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/write",
|                                                    "Microsoft.ExtendedLocation/customLocations/delete",
|                                                    "Microsoft.EdgeMarketplace/offers/read",
|                                                    "Microsoft.EdgeMarketplace/publishers/read",
|                                                    "Microsoft.Kubernetes/register/action",
|                                                    "Microsoft.KubernetesConfiguration/register/action",
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.KubernetesConfiguration/namespaces/read",
|                                                    "Microsoft.KubernetesConfiguration/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/Write",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/Read",
|                                                    "Microsoft.HybridContainerService/register/action",
|                                                    "Microsoft.HybridCompute/settings/write",
|                                                    "Microsoft.HybridCompute/settings/read",
|                                                    "Microsoft.HybridCompute/gateways/read",
|                                                    "Microsoft.HybridCompute/gateways/write",
|                                                    "Microsoft.HybridCompute/gateways/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bfc3b73d-c6ff-45eb-9a5f-40298295bf20",
|                                    "Name":  "LocalRulestacksAdministrator role",
|                                    "Description":  "Allows users to create, modify, describe, or delete Rulestacks.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "PaloAltoNetworks.Cloudngfw/localRulestacks/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Support/*",
|                                                    "PaloAltoNetworks.Cloudngfw/firewalls/read",
|                                                    "PaloAltoNetworks.Cloudngfw/createProductSerialNumber/action",
|                                                    "PaloAltoNetworks.Cloudngfw/listProductSerialNumberStatus/action",
|                                                    "PaloAltoNetworks.Cloudngfw/listSupportInfo/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7392c568-9289-4bde-aaaa-b7131215889d",
|                                    "Name":  "Azure Extension for SQL Server Deployment",
|                                    "Description":  "Microsoft.AzureArcData service role to enable deployment of Azure Extension for SQL Server",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d6470a16-71bd-43ab-86b3-6f3a73f4e787",
|                                    "Name":  "Azure Maps Data Read and Batch Role",
|                                    "Description":  "This role can be used to assign read and batch actions on Azure Maps.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Maps/accounts/services/*/read",
|                                                        "Microsoft.Maps/accounts/services/batch/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ef1c2c96-4a77-49e8-b9a4-6179fe1d2fd2",
|                                    "Name":  "API Management Workspace Reader",
|                                    "Description":  "Has read-only access to entities in the workspace. This role should be assigned on the workspace scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/workspaces/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/diagnosticSettings/*/read",
|                                                    "Microsoft.insights/logs/read",
|                                                    "Microsoft.insights/logs/ApiManagementGatewayLogs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "73c2c328-d004-4c5e-938c-35c6f5679a1f",
|                                    "Name":  "API Management Workspace API Product Manager",
|                                    "Description":  "Has read access to entities in the workspace and read and write access to entities for publishing APIs. This role should be assigned on the workspace scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/workspaces/*/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/products/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/subscriptions/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/groups/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/tags/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/notifications/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/diagnosticSettings/*/read",
|                                                    "Microsoft.insights/logs/read",
|                                                    "Microsoft.insights/logs/ApiManagementGatewayLogs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "56328988-075d-4c6a-8766-d93edd6725b6",
|                                    "Name":  "API Management Workspace API Developer",
|                                    "Description":  "Has read access to entities in the workspace and read and write access to entities for editing APIs. This role should be assigned on the workspace scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/workspaces/*/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/apis/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/apiVersionSets/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/policies/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/schemas/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/products/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/policyFragments/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/namedValues/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/tags/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/backends/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/certificates/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/diagnostics/*",
|                                                    "Microsoft.ApiManagement/service/workspaces/loggers/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/diagnosticSettings/*/read",
|                                                    "Microsoft.insights/logs/read",
|                                                    "Microsoft.insights/logs/ApiManagementGatewayLogs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d59a3e9c-6d52-4a5a-aeed-6bf3cf0e31da",
|                                    "Name":  "API Management Service Workspace API Product Manager",
|                                    "Description":  "Has the same access as API Management Service Workspace API Developer as well as read access to users and write access to allow assigning users to groups. This role should be assigned on the service scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/users/read",
|                                                    "Microsoft.ApiManagement/service/tags/read",
|                                                    "Microsoft.ApiManagement/service/tags/apiLinks/*",
|                                                    "Microsoft.ApiManagement/service/tags/operationLinks/*",
|                                                    "Microsoft.ApiManagement/service/tags/productLinks/*",
|                                                    "Microsoft.ApiManagement/service/products/read",
|                                                    "Microsoft.ApiManagement/service/products/apiLinks/*",
|                                                    "Microsoft.ApiManagement/service/groups/read",
|                                                    "Microsoft.ApiManagement/service/groups/users/*",
|                                                    "Microsoft.ApiManagement/service/read",
|                                                    "Microsoft.ApiManagement/service/authorizationServers/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9565a273-41b9-4368-97d2-aeb0c976a9b3",
|                                    "Name":  "API Management Service Workspace API Developer",
|                                    "Description":  "Has read access to tags and products and write access to allow: assigning APIs to products, assigning tags to products and APIs. This role should be assigned on the service scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/tags/read",
|                                                    "Microsoft.ApiManagement/service/tags/apiLinks/*",
|                                                    "Microsoft.ApiManagement/service/tags/operationLinks/*",
|                                                    "Microsoft.ApiManagement/service/tags/productLinks/*",
|                                                    "Microsoft.ApiManagement/service/products/read",
|                                                    "Microsoft.ApiManagement/service/products/apiLinks/*",
|                                                    "Microsoft.ApiManagement/service/read",
|                                                    "Microsoft.ApiManagement/service/authorizationServers/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0c34c906-8d99-4cb7-8bb7-33f5b0a1a799",
|                                    "Name":  "API Management Workspace Contributor",
|                                    "Description":  "Can manage the workspace and view, but not modify its members. This role should be assigned on the workspace scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/workspaces/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/diagnosticSettings/*/read",
|                                                    "Microsoft.insights/logs/read",
|                                                    "Microsoft.insights/logs/ApiManagementGatewayLogs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b8eda974-7b85-4f76-af95-65846b26df6d",
|                                    "Name":  "Storage File Data Privileged Reader",
|                                    "Description":  "Customer has read access on Azure Storage file shares.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "69566ab7-960f-475b-8e7c-b3118f30c6bd",
|                                    "Name":  "Storage File Data Privileged Contributor",
|                                    "Description":  "Customer has read, write, delete and modify NTFS permission access on Azure Storage file shares.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7eabc9a4-85f7-4f71-b8ab-75daaccc1033",
|                                    "Name":  "Windows 365 Network User",
|                                    "Description":  "This role is used by Windows 365 to read virtual networks and join the designated virtual networks.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/usages/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1f135831-5bbe-4924-9016-264044c00788",
|                                    "Name":  "Windows 365 Network Interface Contributor",
|                                    "Description":  "This role is used by Windows 365 to provision required network resources and join Microsoft-hosted VMs to network interfaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Network/locations/operationResults/read",
|                                                    "Microsoft.Network/locations/usages/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action",
|                                                    "Microsoft.Network/networkInterfaces/effectiveRouteTable/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3d55a8f6-4133-418d-8051-facdb1735758",
|                                    "Name":  "Windows365SubscriptionReader",
|                                    "Description":  "Read subscriptions, images, azure firewalls. This role is used in Windows365 scenarios.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0f37683f-2463-46b6-9ce7-9b788b988ba2",
|                                    "Name":  "App Compliance Automation Administrator",
|                                    "Description":  "Allows managing App Compliance Automation tool for Microsoft 365",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppComplianceAutomation/*",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/write",
|                                                    "Microsoft.Storage/storageAccounts/fileservices/write",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.PolicyInsights/policyStates/queryResults/action",
|                                                    "Microsoft.PolicyInsights/policyStates/triggerEvaluation/action",
|                                                    "Microsoft.Resources/resources/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/resources/read",
|                                                    "Microsoft.Resources/subscriptions/resources/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/tags/read",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Security/automations/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Security/automations/delete",
|                                                    "Microsoft.Security/automations/write",
|                                                    "Microsoft.Security/register/action",
|                                                    "Microsoft.Security/unregister/action",
|                                                    "*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ffc6bbe0-e443-4c3b-bf54-26581bb2f78e",
|                                    "Name":  "App Compliance Automation Reader",
|                                    "Description":  "Allows read-only access to App Compliance Automation tool for Microsoft 365",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8b9dfcab-4b77-4632-a6df-94bd07820648",
|                                    "Name":  "Azure Sphere Contributor",
|                                    "Description":  "Allows user read and write access to Azure Sphere resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureSphere/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/DiagnosticSettings/*",
|                                                    "Microsoft.Insights/DiagnosticSettingsCategories/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e9b8712a-cbcf-4ea7-b0f7-e71b803401e6",
|                                    "Name":  "SaaS Hub Contributor",
|                                    "Description":  "SaaS Hub contributor can manage SaaS Hub resource",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.SaaSHub/cloudservices/read",
|                                                    "Microsoft.SaaSHub/cloudservices/write",
|                                                    "Microsoft.SaaSHub/cloudservices/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c8ae6279-5a0b-4cb2-b3f0-d4d62845742c",
|                                    "Name":  "Azure Sphere Reader",
|                                    "Description":  "Allows user to read Azure Sphere resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureSphere/*/read",
|                                                    "Microsoft.AzureSphere/catalogs/countDevices/action",
|                                                    "Microsoft.AzureSphere/catalogs/listDeviceGroups/action",
|                                                    "Microsoft.AzureSphere/catalogs/listDeviceInsights/action",
|                                                    "Microsoft.AzureSphere/catalogs/listDevices/action",
|                                                    "Microsoft.AzureSphere/catalogs/listDeployments/action",
|                                                    "Microsoft.AzureSphere/catalogs/products/countDevices/action",
|                                                    "Microsoft.AzureSphere/catalogs/products/deviceGroups/countDevices/action",
|                                                    "Microsoft.AzureSphere/catalogs/certificates/retrieveCertChain/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/DiagnosticSettings/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6d994134-994b-4a59-9974-f479f0b227fb",
|                                    "Name":  "Azure Sphere Publisher",
|                                    "Description":  "Allows user to read and download Azure Sphere resources and upload images.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureSphere/*/read",
|                                                    "Microsoft.AzureSphere/catalogs/countDevices/action",
|                                                    "Microsoft.AzureSphere/catalogs/listDeviceGroups/action",
|                                                    "Microsoft.AzureSphere/catalogs/listDeviceInsights/action",
|                                                    "Microsoft.AzureSphere/catalogs/listDevices/action",
|                                                    "Microsoft.AzureSphere/catalogs/products/countDevices/action",
|                                                    "Microsoft.AzureSphere/catalogs/products/deviceGroups/countDevices/action",
|                                                    "Microsoft.AzureSphere/catalogs/certificates/retrieveProofOfPossessionNonce/action",
|                                                    "Microsoft.AzureSphere/catalogs/certificates/retrieveCertChain/action",
|                                                    "Microsoft.AzureSphere/catalogs/images/write",
|                                                    "Microsoft.AzureSphere/catalogs/uploadImage/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/DiagnosticSettings/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "be1a1ac2-09d3-4261-9e57-a73a6e227f53",
|                                    "Name":  "Procurement Contributor",
|                                    "Description":  "Lets you manage the procurement of products and services.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.SaaSHub/cloudservices/read",
|                                                    "Microsoft.SaaSHub/cloudservices/write",
|                                                    "Microsoft.SaaSHub/cloudservices/delete",
|                                                    "Microsoft.SaaSHub/register/action",
|                                                    "Microsoft.SaaS/resources/read",
|                                                    "Microsoft.SaaS/resources/write",
|                                                    "Microsoft.SaaS/resources/delete",
|                                                    "Microsoft.SaaS/register/action",
|                                                    "Microsoft.ProfessionalService/resources/read",
|                                                    "Microsoft.ProfessionalService/resources/write",
|                                                    "Microsoft.ProfessionalService/resources/delete",
|                                                    "Microsoft.ProfessionalService/register/action",
|                                                    "Microsoft.BillingBenefits/register/action",
|                                                    "Microsoft.BillingBenefits/maccs/read",
|                                                    "Microsoft.BillingBenefits/maccs/write",
|                                                    "Microsoft.BillingBenefits/maccs/delete",
|                                                    "Microsoft.BillingBenefits/maccs/cancel/action",
|                                                    "Microsoft.BillingBenefits/maccs/chargeShortfall/action",
|                                                    "Microsoft.BillingBenefits/maccs/writeOff/action",
|                                                    "Microsoft.BillingBenefits/maccs/contributors/read",
|                                                    "Microsoft.BillingBenefits/credits/read",
|                                                    "Microsoft.BillingBenefits/credits/write",
|                                                    "Microsoft.BillingBenefits/credits/cancel/action",
|                                                    "Microsoft.BillingBenefits/credits/sources/read",
|                                                    "Microsoft.BillingBenefits/credits/sources/write",
|                                                    "Microsoft.BillingBenefits/credits/sources/delete",
|                                                    "Microsoft.BillingBenefits/discounts/read",
|                                                    "Microsoft.BillingBenefits/discounts/write",
|                                                    "Microsoft.BillingBenefits/discounts/delete",
|                                                    "Microsoft.BillingBenefits/discounts/cancel/action",
|                                                    "Microsoft.BillingBenefits/conditionalCredits/read",
|                                                    "Microsoft.BillingBenefits/conditionalCredits/write",
|                                                    "Microsoft.BillingBenefits/conditionalCredits/delete",
|                                                    "Microsoft.BillingBenefits/conditionalCredits/cancel/action",
|                                                    "Microsoft.BillingBenefits/conditionalCredits/contributors/read",
|                                                    "Microsoft.EnterpriseSupport/enterpriseSupports/read",
|                                                    "Microsoft.EnterpriseSupport/enterpriseSupports/write",
|                                                    "Microsoft.EnterpriseSupport/enterpriseSupports/delete",
|                                                    "Microsoft.EnterpriseSupport/register/action",
|                                                    "Microsoft.SoftwarePlan/register/action",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/read",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/write",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/delete",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/cancel/action",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/listKeys/action",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/refreshFulfillment/action",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/productKeys/read",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/productKeys/showFullKey/action",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/productDownloadOptions/read",
|                                                    "Microsoft.SoftwarePlan/softwareSubscriptions/productDownloadOptions/generateDownloadLinks/action",
|                                                    "Microsoft.SoftwarePlan/validateSoftwareSubscriptionCreate/action",
|                                                    "Microsoft.SoftwarePlan/softwareLicenses/read",
|                                                    "Microsoft.SoftwarePlan/softwareLicenses/write",
|                                                    "Microsoft.SoftwarePlan/softwareLicenses/productKeys/read",
|                                                    "Microsoft.SoftwarePlan/softwareLicenses/productKeys/showFullKey/action",
|                                                    "Microsoft.SoftwarePlan/softwareLicenses/productDownloadOptions/read",
|                                                    "Microsoft.SoftwarePlan/softwareLicenses/productDownloadOptions/generateDownloadLinks/action",
|                                                    "Microsoft.SoftwarePlan/validateSoftwareLicenseCreate/action",
|                                                    "Microsoft.Hardware/register/action",
|                                                    "Microsoft.Hardware/orderPreview/action",
|                                                    "Microsoft.Hardware/orders/read",
|                                                    "Microsoft.Hardware/orders/write",
|                                                    "Microsoft.Hardware/orders/delete",
|                                                    "Microsoft.Hardware/returnPreview/action",
|                                                    "Microsoft.Hardware/returns/read",
|                                                    "Microsoft.Hardware/returns/write",
|                                                    "Microsoft.Hardware/returns/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ea01e6af-a1c1-4350-9563-ad00f8c72ec5",
|                                    "Name":  "Azure Machine Learning Workspace Connection Secrets Reader",
|                                    "Description":  "Can list workspace connection secrets",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/connections/listsecrets/action",
|                                                    "Microsoft.MachineLearningServices/workspaces/metadata/secrets/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "79b01272-bf9f-4f4c-9517-5506269cf524",
|                                    "Name":  "Cognitive Search Serverless Data Reader (Deprecated)",
|                                    "Description":  "This role has been deprecated",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveSearch/indexes/schema/read",
|                                                        "Microsoft.CognitiveSearch/indexes/documents/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7ac06ca7-21ca-47e3-a67b-cbd6e6223baf",
|                                    "Name":  "Cognitive Search Serverless Data Contributor (Deprecated)",
|                                    "Description":  "This role has been deprecated",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveSearch/indexes/schema/*",
|                                                        "Microsoft.CognitiveSearch/indexes/documents/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5e28a61e-8040-49db-b175-bb5b88af6239",
|                                    "Name":  "Community Owner Role",
|                                    "Description":  "Community Owner Role to access the resources of Microsoft.Mission stored with RPSAAS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Mission/register/action",
|                                                    "Microsoft.Mission/unregister/action",
|                                                    "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                    "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                    "Microsoft.Mission/Operations/read",
|                                                    "Microsoft.Mission/communities/read",
|                                                    "Microsoft.Mission/communities/write",
|                                                    "Microsoft.Mission/communities/delete",
|                                                    "Microsoft.Mission/communities/setMaintenanceMode/action",
|                                                    "Microsoft.Mission/communities/communityendpoints/connect/action",
|                                                    "Microsoft.Mission/communities/dedicatedHubs/connect/action",
|                                                    "Microsoft.Mission/virtualEnclaves/read",
|                                                    "Microsoft.Mission/virtualEnclaves/write",
|                                                    "Microsoft.Mission/virtualEnclaves/delete",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/write",
|                                                    "Microsoft.Mission/communities/communityEndpoints/delete",
|                                                    "Microsoft.Mission/communities/transitHubs/read",
|                                                    "Microsoft.Mission/communities/transitHubs/write",
|                                                    "Microsoft.Mission/communities/transitHubs/delete",
|                                                    "Microsoft.Mission/communities/dedicatedHubs/read",
|                                                    "Microsoft.Mission/communities/dedicatedHubs/write",
|                                                    "Microsoft.Mission/communities/dedicatedHubs/delete",
|                                                    "Microsoft.Mission/enclaveConnections/read",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                    "Microsoft.Mission/approvals/read",
|                                                    "Microsoft.Mission/approvals/write",
|                                                    "Microsoft.Mission/approvals/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9c1607d1-791d-4c68-885d-c7b7aaff7c8a",
|                                    "Name":  "Firmware Analysis Admin",
|                                    "Description":  "Administrative user that can upload/view firmwares \u0026 configure firmware workspaces",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.IoTFirmwareDefense/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8b54135c-b56d-4d72-a534-26097cfdc8d8",
|                                    "Name":  "Key Vault Data Access Administrator",
|                                    "Description":  "Manage access to Azure Key Vault by adding or removing role assignments for the Key Vault Administrator, Key Vault Certificates Officer, Key Vault Crypto Officer, Key Vault Crypto Service Encryption User, Key Vault Crypto User, Key Vault Reader, Key Vault Secrets Officer, or Key Vault Secrets User roles. Includes an ABAC condition to constrain role assignments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.KeyVault/vaults/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1e7ca9b1-60d1-4db8-a914-f2ca1ff27c40",
|                                    "Name":  "Defender for Storage Data Scanner",
|                                    "Description":  "Grants access to read blobs and update index tags. This role is used by the data scanner of Defender for Storage.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "df2711a6-406d-41cf-b366-b0250bff9ad1",
|                                    "Name":  "Compute Diagnostics Role",
|                                    "Description":  "Grants permissions to execute diagnostics provided by Compute Diagnostic Service for Compute Resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action",
|                                                    "Microsoft.Compute/virtualmachinescalesets/disks/beginGetAccess/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fa6cecf6-5db3-4c43-8470-c540bcb4eafa",
|                                    "Name":  "Elastic SAN Network Admin",
|                                    "Description":  "Allows access to create Private Endpoints on SAN resources, and to read SAN resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ElasticSan/elasticSans/*/read",
|                                                    "Microsoft.ElasticSan/elasticSans/PrivateEndpointConnectionsApproval/action",
|                                                    "Microsoft.ElasticSan/elasticSans/privateEndpointConnections/write",
|                                                    "Microsoft.ElasticSan/elasticSans/privateEndpointConnections/delete",
|                                                    "Microsoft.ElasticSan/locations/asyncoperations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bba48692-92b0-4667-a9ad-c31c7b334ac2",
|                                    "Name":  "Cognitive Services Usages Reader",
|                                    "Description":  "Minimal permission to view Cognitive Services usages.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/locations/usages/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c088a766-074b-43ba-90d4-1fb21feae531",
|                                    "Name":  "PostgreSQL Flexible Server Long Term Retention Backup Role",
|                                    "Description":  "Role to allow backup vault to access PostgreSQL Flexible Server Resource APIs for Long Term Retention Backup.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/ltrBackup/action",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/ltrBackupAccess/action",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/ltrBackupOperations/read",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/ltrBackupPreCheck/action",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/ltrPreBackup/action",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/ltrRestoreFinalize/action",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/ltrRestoreInitialize/action",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/ltrRestorePreCheck/action",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/read",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/startLtrBackup/action",
|                                                    "Microsoft.DBforPostgreSQL/locations/azureAsyncOperation/read",
|                                                    "Microsoft.DBforPostgreSQL/locations/operationResults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a02f7c31-354d-4106-865a-deedf37fa038",
|                                    "Name":  "Search Parameter Manager",
|                                    "Description":  "Role allows user or principal access to $status and $reindex to update search parameters",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/reindex/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/write",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/searchparameter/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "66f75aeb-eabe-4b70-9f1e-c350c4c9ad04",
|                                    "Name":  "Virtual Machine Data Access Administrator (preview)",
|                                    "Description":  "Manage access to Virtual Machines by adding or removing role assignments for the Virtual Machine Administrator Login and Virtual Machine User Login roles. Includes an ABAC condition to constrain role assignments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Compute/virtualMachines/*/read",
|                                                    "Microsoft.HybridCompute/machines/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4accf36b-2c05-432f-91c8-5c532dff4c73",
|                                    "Name":  "Logic Apps Standard Reader (Preview)",
|                                    "Description":  "You have read-only access to all resources in a Standard logic app and workflows, including the workflow runs and their history.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Web/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "523776ba-4eb2-4600-a3c8-f2dc93da4bdb",
|                                    "Name":  "Logic Apps Standard Developer (Preview)",
|                                    "Description":  "You can create and edit workflows, connections, and settings for a Standard logic app. You can\u0027t make changes outside the workflow scope.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Web/*/read",
|                                                    "Microsoft.Web/connections/*",
|                                                    "Microsoft.Web/customApis/*",
|                                                    "Microsoft.Web/sites/config/list/Action",
|                                                    "microsoft.web/sites/config/Write",
|                                                    "microsoft.web/sites/config/web/appsettings/delete",
|                                                    "microsoft.web/sites/config/web/appsettings/write",
|                                                    "microsoft.web/sites/deployWorkflowArtifacts/action",
|                                                    "microsoft.web/sites/hostruntime/*",
|                                                    "microsoft.web/sites/listworkflowsconnections/action",
|                                                    "Microsoft.Web/sites/publish/Action",
|                                                    "microsoft.web/sites/slots/config/appsettings/write",
|                                                    "Microsoft.Web/sites/slots/config/list/Action",
|                                                    "microsoft.web/sites/slots/config/web/appsettings/delete",
|                                                    "microsoft.web/sites/slots/deployWorkflowArtifacts/action",
|                                                    "microsoft.web/sites/slots/listworkflowsconnections/action",
|                                                    "Microsoft.Web/sites/slots/publish/Action",
|                                                    "microsoft.web/sites/workflows/*",
|                                                    "microsoft.web/sites/workflowsconfiguration/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ad710c24-b039-4e85-a019-deb4a06e8570",
|                                    "Name":  "Logic Apps Standard Contributor (Preview)",
|                                    "Description":  "You can manage all aspects of a Standard logic app and workflows. You can\u0027t change access or ownership.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Web/*/read",
|                                                    "Microsoft.Web/certificates/*",
|                                                    "Microsoft.Web/connectionGateways/*",
|                                                    "Microsoft.Web/connections/*",
|                                                    "Microsoft.Web/customApis/*",
|                                                    "Microsoft.Web/serverFarms/*",
|                                                    "Microsoft.Web/sites/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b70c96e9-66fe-4c09-b6e7-c98e69c98555",
|                                    "Name":  "Logic Apps Standard Operator (Preview)",
|                                    "Description":  "You can enable and disable the logic app, resubmit workflow runs, as well as create connections. You can\u0027t edit workflows or settings.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Web/*/read",
|                                                    "Microsoft.Web/sites/applySlotConfig/Action",
|                                                    "microsoft.web/sites/hostruntime/*",
|                                                    "Microsoft.Web/sites/restart/Action",
|                                                    "Microsoft.Web/sites/slots/restart/Action",
|                                                    "Microsoft.Web/sites/slots/slotsswap/Action",
|                                                    "Microsoft.Web/sites/slots/start/Action",
|                                                    "Microsoft.Web/sites/slots/stop/Action",
|                                                    "Microsoft.Web/sites/slotsdiffs/Action",
|                                                    "Microsoft.Web/sites/slotsswap/Action",
|                                                    "Microsoft.Web/sites/start/Action",
|                                                    "Microsoft.Web/sites/stop/Action",
|                                                    "Microsoft.Web/sites/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7b3e853f-ad5d-4fb5-a7b8-56a3581c7037",
|                                    "Name":  "IPAM Pool User",
|                                    "Description":  "Read IPAM Pools and child resources. Create and remove associations. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/networkManagers/ipamPools/*/read",
|                                                    "Microsoft.Network/networkManagers/ipamPools/*/action",
|                                                    "Microsoft.Network/networkManagers/ipamPools/*/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e9c9ed2b-2a99-4071-b2ff-5b113ebf73a1",
|                                    "Name":  "SpatialMapsAccounts Account Owner",
|                                    "Description":  "Lets you manage data in your account, including deleting them",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MixedReality/spatialMapsAccounts/read",
|                                                        "Microsoft.MixedReality/spatialMapsAccounts/delete",
|                                                        "Microsoft.MixedReality/spatialMapsAccounts/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0b962ed2-6d56-471c-bd5f-3477d83a7ba4",
|                                    "Name":  "Azure Resource Notifications System Topics Subscriber",
|                                    "Description":  "Lets you create system topics and event subscriptions on all system topics exposed currently and in the future by Azure Resource Notifications",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ResourceNotifications/systemTopics/subscribeToResources/action",
|                                                    "Microsoft.ResourceNotifications/systemTopics/subscribeToHealthResources/action",
|                                                    "Microsoft.ResourceNotifications/systemTopics/subscribeToMaintenanceResources/action",
|                                                    "Microsoft.ResourceNotifications/systemTopics/subscribeToComputeResources/action",
|                                                    "Microsoft.ResourceNotifications/systemTopics/subscribeToComputeScheduleResources/action",
|                                                    "Microsoft.ResourceNotifications/systemTopics/subscribeToContainerServiceEventResources/action",
|                                                    "Microsoft.ResourceNotifications/systemTopics/subscribeToImpactReportingResources/action",
|                                                    "Microsoft.ResourceNotifications/systemTopics/subscribeToAksResources/action",
|                                                    "Microsoft.EventGrid/eventSubscriptions/write",
|                                                    "Microsoft.EventGrid/systemTopics/eventSubscriptions/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1c4770c0-34f7-4110-a1ea-a5855cc7a939",
|                                    "Name":  "Elastic SAN Snapshot Exporter",
|                                    "Description":  "Allows for creating and exporting Snapshot of Elastic San Volume",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ElasticSan/elasticSans/*/read",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/snapshots/write",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/snapshots/delete",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/snapshots/beginGetAccess/action",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/preBackup/action",
|                                                    "Microsoft.ElasticSan/locations/*",
|                                                    "Microsoft.Compute/locations/*",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/snapshots/read",
|                                                    "Microsoft.Compute/snapshots/write",
|                                                    "Microsoft.Compute/snapshots/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "90e8b822-3e73-47b5-868a-787dc80c008f",
|                                    "Name":  "Elastic SAN Volume Importer",
|                                    "Description":  "Allows for Importing Elastic San Volume",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/*/read",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/write",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/delete",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/preRestore/action",
|                                                    "Microsoft.ElasticSan/locations/*",
|                                                    "Microsoft.Compute/locations/*",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action",
|                                                    "Microsoft.Compute/disks/endGetAccess/action",
|                                                    "Microsoft.Compute/snapshots/read",
|                                                    "Microsoft.Compute/snapshots/beginGetAccess/action",
|                                                    "Microsoft.Compute/snapshots/endGetAccess/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "49435da6-99fe-48a5-a235-fc668b9dc04a",
|                                    "Name":  "Community Contributor Role",
|                                    "Description":  "Community Contributor Role to access the resources of Microsoft.Mission stored with RPSAAS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Mission/register/action",
|                                                    "Microsoft.Mission/unregister/action",
|                                                    "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                    "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                    "Microsoft.Mission/Operations/read",
|                                                    "Microsoft.Mission/communities/read",
|                                                    "Microsoft.Mission/communities/write",
|                                                    "Microsoft.Mission/virtualEnclaves/read",
|                                                    "Microsoft.Mission/virtualEnclaves/write",
|                                                    "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                    "Microsoft.Mission/virtualEnclaves/endpoints/write",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/write",
|                                                    "Microsoft.Mission/communities/transitHubs/read",
|                                                    "Microsoft.Mission/communities/transitHubs/write",
|                                                    "Microsoft.Mission/enclaveConnections/read",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                    "Microsoft.Mission/approvals/read",
|                                                    "Microsoft.Mission/approvals/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4b0f2fd7-60b4-4eca-896f-4435034f8bf5",
|                                    "Name":  "EventGrid TopicSpaces Subscriber",
|                                    "Description":  "Lets you subscribe messages on topicspaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.EventGrid/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventGrid/topicSpaces/subscribe/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a12b0b94-b317-4dcd-84a8-502ce99884c6",
|                                    "Name":  "EventGrid TopicSpaces Publisher",
|                                    "Description":  "Lets you publish messages on topicspaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.EventGrid/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventGrid/topicSpaces/publish/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d1a38570-4b05-4d70-b8e4-1100bcf76d12",
|                                    "Name":  "Data Boundary Tenant Administrator",
|                                    "Description":  "Allows tenant level administration for data boundaries.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/dataBoundaries/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8a90fa6b-6997-4a07-8a95-30633a7c97b9",
|                                    "Name":  "DeID Batch Data Owner",
|                                    "Description":  "Create and manage DeID batch jobs. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthDataAIServices/DeidServices/Batch/write",
|                                                        "Microsoft.HealthDataAIServices/DeidServices/Batch/delete",
|                                                        "Microsoft.HealthDataAIServices/DeidServices/Batch/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b73a14ee-91f5-41b7-bd81-920e12466be9",
|                                    "Name":  "DeID Batch Data Reader",
|                                    "Description":  "Read DeID batch jobs. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthDataAIServices/DeidServices/Batch/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bb6577c4-ea0a-40b2-8962-ea18cb8ecd4e",
|                                    "Name":  "DeID Realtime Data User",
|                                    "Description":  "Execute requests against DeID realtime endpoint. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthDataAIServices/DeidServices/Realtime/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fa0d39e6-28e5-40cf-8521-1eb320653a4c",
|                                    "Name":  "Carbon Optimization Reader",
|                                    "Description":  "Allow read access to Azure Carbon Optimization data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Carbon/carbonEmissionReports/action",
|                                                    "Microsoft.Carbon/carbonEmissionReports/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "38863829-c2a4-4f8d-b1d2-2e325973ebc7",
|                                    "Name":  "Landing Zone Management Owner",
|                                    "Description":  "Microsoft.Sovereign Landing Zone Management Owner allowing to review and modify Landing Zone Configurations as well as reading and adding Landing Zone Registrations. Also enables read-access to policies and management groups for enabling the full user experience of the Sovereign Services RP in the Azure Portal (as otherwise some elements might not be accessible to end users).",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Sovereign/landingZoneConfigurations/*",
|                                                    "Microsoft.Sovereign/landingZoneRegistrations/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8fe6e843-6d9e-417b-9073-106b048f50bb",
|                                    "Name":  "Landing Zone Management Reader",
|                                    "Description":  "Microsoft.Sovereign Landing Zone Management Reader allowing to review Landing Zone Configurations and corresponding Registrations without the ability to modify. Also enables read-access to policies and management groups for enabling the full user experience of the Sovereign Services RP in the Azure Portal (as otherwise some elements might not be accessible to end users).",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Sovereign/landingZoneConfigurations/read",
|                                                    "Microsoft.Sovereign/landingZoneRegistrations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "865ae368-6a45-4bd1-8fbf-0d5151f56fc1",
|                                    "Name":  "Azure Stack HCI Device Management Role",
|                                    "Description":  "Microsoft.AzureStackHCI Device Management Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStackHCI/Clusters/*",
|                                                    "Microsoft.AzureStackHCI/EdgeDevices/*",
|                                                    "Microsoft.AzureStackHCI/DevicePools/*/read",
|                                                    "Microsoft.AzureStackHCI/EdgeMachines/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.HybridContainerService/register/action",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/read",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/write",
|                                                    "Microsoft.HybridContainerService/skus/read",
|                                                    "Microsoft.HybridContainerService/skus/write",
|                                                    "Microsoft.Authorization/roleassignments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/Write",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/Read",
|                                                    "Microsoft.AzureStackHCI/LogicalNetworks/Read",
|                                                    "Microsoft.AzureStackHCI/LogicalNetworks/Write",
|                                                    "Microsoft.AzureStackHCI/Register/Action",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.KubernetesConfiguration/namespaces/read",
|                                                    "Microsoft.KubernetesConfiguration/operations/read",
|                                                    "Microsoft.ResourceConnector/appliances/read",
|                                                    "Microsoft.ResourceConnector/appliances/write",
|                                                    "Microsoft.ResourceConnector/appliances/delete",
|                                                    "Microsoft.ResourceConnector/locations/operationresults/read",
|                                                    "Microsoft.ResourceConnector/locations/operationsstatus/read",
|                                                    "Microsoft.ResourceConnector/appliances/listClusterUserCredential/action",
|                                                    "Microsoft.ResourceConnector/appliances/listKeys/action",
|                                                    "Microsoft.ResourceConnector/appliances/upgradeGraphs/read",
|                                                    "Microsoft.ResourceConnector/telemetryconfig/read",
|                                                    "Microsoft.ResourceConnector/operations/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/write",
|                                                    "Microsoft.ExtendedLocation/customLocations/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4dae6930-7baf-46f5-909e-0383bc931c46",
|                                    "Name":  "Azure Customer Lockbox Approver for Subscription",
|                                    "Description":  "Can approve Microsoft support requests to access specific resources contained within a subscription, or the subscription itself, when Customer Lockbox for Microsoft Azure is enabled on the tenant where the subscription resides.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.CustomerLockbox/requests/UpdateApproval/action",
|                                                    "Microsoft.CustomerLockbox/requests/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/eventtypes/values/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7b1f81f9-4196-4058-8aae-762e593270df",
|                                    "Name":  "Azure Resource Bridge Deployment Role",
|                                    "Description":  "Azure Resource Bridge Deployment Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleassignments/read",
|                                                    "Microsoft.AzureStackHCI/Register/Action",
|                                                    "Microsoft.ResourceConnector/register/action",
|                                                    "Microsoft.ResourceConnector/appliances/read",
|                                                    "Microsoft.ResourceConnector/appliances/write",
|                                                    "Microsoft.ResourceConnector/appliances/delete",
|                                                    "Microsoft.ResourceConnector/locations/operationresults/read",
|                                                    "Microsoft.ResourceConnector/locations/operationsstatus/read",
|                                                    "Microsoft.ResourceConnector/appliances/listClusterUserCredential/action",
|                                                    "Microsoft.ResourceConnector/appliances/listKeys/action",
|                                                    "Microsoft.ResourceConnector/appliances/upgradeGraphs/read",
|                                                    "Microsoft.ResourceConnector/telemetryconfig/read",
|                                                    "Microsoft.ResourceConnector/operations/read",
|                                                    "Microsoft.ExtendedLocation/register/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/write",
|                                                    "Microsoft.ExtendedLocation/customLocations/delete",
|                                                    "Microsoft.HybridConnectivity/register/action",
|                                                    "Microsoft.Kubernetes/register/action",
|                                                    "Microsoft.KubernetesConfiguration/register/action",
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.KubernetesConfiguration/namespaces/read",
|                                                    "Microsoft.KubernetesConfiguration/operations/read",
|                                                    "Microsoft.GuestConfiguration/guestConfigurationAssignments/read",
|                                                    "Microsoft.HybridContainerService/register/action",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/read",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/write",
|                                                    "Microsoft.HybridContainerService/skus/read",
|                                                    "Microsoft.HybridContainerService/skus/write",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/Write",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "874d1c73-6003-4e60-a13a-cb31ea190a85",
|                                    "Name":  "Azure Stack HCI VM Contributor",
|                                    "Description":  "Grants permissions to perform all VM actions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStackHCI/VirtualMachines/*",
|                                                    "Microsoft.AzureStackHCI/virtualMachineInstances/*",
|                                                    "Microsoft.AzureStackHCI/NetworkInterfaces/*",
|                                                    "Microsoft.AzureStackHCI/VirtualHardDisks/*",
|                                                    "Microsoft.AzureStackHCI/VirtualNetworks/Read",
|                                                    "Microsoft.AzureStackHCI/VirtualNetworks/join/action",
|                                                    "Microsoft.AzureStackHCI/LogicalNetworks/Read",
|                                                    "Microsoft.AzureStackHCI/LogicalNetworks/join/action",
|                                                    "Microsoft.AzureStackHCI/GalleryImages/Read",
|                                                    "Microsoft.AzureStackHCI/GalleryImages/deploy/action",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/Read",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/deploy/action",
|                                                    "Microsoft.AzureStackHCI/MarketplaceGalleryImages/Read",
|                                                    "Microsoft.AzureStackHCI/MarketPlaceGalleryImages/deploy/action",
|                                                    "Microsoft.AzureStackHCI/Clusters/Read",
|                                                    "Microsoft.AzureStackHCI/Clusters/ArcSettings/Read",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/Read",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
|                                                    "Microsoft.HybridCompute/machines/assessPatches/action",
|                                                    "Microsoft.HybridCompute/machines/installPatches/action",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/operations/read",
|                                                    "Microsoft.HybridCompute/locations/operationresults/read",
|                                                    "Microsoft.HybridCompute/locations/operationstatus/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
|                                                    "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/read",
|                                                    "Microsoft.HybridCompute/osType/agentVersions/latest/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/read",
|                                                    "Microsoft.HybridCompute/machines/runcommands/write",
|                                                    "Microsoft.HybridCompute/machines/runcommands/delete",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/write",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/delete",
|                                                    "Microsoft.HybridCompute/licenses/read",
|                                                    "Microsoft.HybridCompute/licenses/write",
|                                                    "Microsoft.HybridCompute/licenses/delete",
|                                                    "Microsoft.ExtendedLocation/customLocations/Read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4b3fe76c-f777-4d24-a2d7-b027b0f7b273",
|                                    "Name":  "Azure Stack HCI VM Reader",
|                                    "Description":  "Grants permissions to view VMs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStackHCI/VirtualMachines/Read",
|                                                    "Microsoft.AzureStackHCI/virtualMachineInstances/Read",
|                                                    "Microsoft.AzureStackHCI/VirtualMachines/Extensions/Read",
|                                                    "Microsoft.AzureStackHCI/VirtualNetworks/Read",
|                                                    "Microsoft.AzureStackHCI/LogicalNetworks/Read",
|                                                    "Microsoft.AzureStackHCI/NetworkInterfaces/Read",
|                                                    "Microsoft.AzureStackHCI/VirtualHardDisks/Read",
|                                                    "Microsoft.AzureStackHCI/StorageContainers/Read",
|                                                    "Microsoft.AzureStackHCI/GalleryImages/Read",
|                                                    "Microsoft.AzureStackHCI/MarketplaceGalleryImages/Read",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/Read",
|                                                    "Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Read",
|                                                    "Microsoft.HybridCompute/licenses/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/licenseProfiles/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/read",
|                                                    "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/privateLinkScopes/networkSecurityPerimeterConfigurations/read",
|                                                    "Microsoft.HybridCompute/privateLinkScopes/privateEndpointConnections/read",
|                                                    "Microsoft.HybridCompute/privateLinkScopes/read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "64702f94-c441-49e6-a78b-ef80e0188fee",
|                                    "Name":  "Azure AI Developer",
|                                    "Description":  "Can perform all actions within an Azure AI resource besides managing the resource itself.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/*/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/*/action",
|                                                    "Microsoft.MachineLearningServices/workspaces/*/delete",
|                                                    "Microsoft.MachineLearningServices/workspaces/*/write",
|                                                    "Microsoft.MachineLearningServices/locations/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.MachineLearningServices/workspaces/delete",
|                                                       "Microsoft.MachineLearningServices/workspaces/write",
|                                                       "Microsoft.MachineLearningServices/workspaces/listKeys/action",
|                                                       "Microsoft.MachineLearningServices/workspaces/hubs/write",
|                                                       "Microsoft.MachineLearningServices/workspaces/hubs/delete",
|                                                       "Microsoft.MachineLearningServices/workspaces/featurestores/write",
|                                                       "Microsoft.MachineLearningServices/workspaces/featurestores/delete",
|                                                       "Microsoft.MachineLearningServices/workspaces/evaluations/results/labels/read",
|                                                       "Microsoft.MachineLearningServices/workspaces/evaluations/results/reasonings/read",
|                                                       "Microsoft.MachineLearningServices/workspaces/simulations/results/images/read"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/OpenAI/*",
|                                                        "Microsoft.CognitiveServices/accounts/SpeechServices/*",
|                                                        "Microsoft.CognitiveServices/accounts/ContentSafety/*",
|                                                        "Microsoft.CognitiveServices/accounts/MaaS/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "eb960402-bf75-4cc3-8d68-35b34f960f72",
|                                    "Name":  "Deployment Environments Reader",
|                                    "Description":  "Provides read access to environment resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DevCenter/projects/read",
|                                                    "Microsoft.DevCenter/projects/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.DevCenter/projects/pools/read",
|                                                       "Microsoft.DevCenter/projects/pools/schedules/read"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DevCenter/projects/users/environments/adminRead/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminActionRead/action",
|                                                        "Microsoft.DevCenter/projects/users/environments/adminOutputsRead/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1d8c3fe3-8864-474b-8749-01e3783e8157",
|                                    "Name":  "EventGrid Data Contributor",
|                                    "Description":  "Allows send and receive access to event grid events.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.EventGrid/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/locations/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.EventGrid/topics/read",
|                                                    "Microsoft.EventGrid/domains/read",
|                                                    "Microsoft.EventGrid/partnerNamespaces/read",
|                                                    "Microsoft.EventGrid/namespaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventGrid/events/send/action",
|                                                        "Microsoft.EventGrid/events/receive/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "78cbd9e7-9798-4e2e-9b5a-547d9ebb31fb",
|                                    "Name":  "EventGrid Data Receiver",
|                                    "Description":  "Allows receive access to event grid events.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.EventGrid/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/locations/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.EventGrid/namespaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.EventGrid/events/receive/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3afb7f49-54cb-416e-8c09-6dc049efa503",
|                                    "Name":  "Azure AI Inference Deployment Operator",
|                                    "Description":  "Can perform all actions required to create a resource deployment within a resource group.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Insights/AutoscaleSettings/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "65a14201-8f6c-4c28-bec4-12619c5a9aaa",
|                                    "Name":  "Connected Cluster Managed Identity CheckAccess Reader",
|                                    "Description":  "Built-in role that allows a Connected Cluster managed identity to call the checkAccess API",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c64499e0-74c3-47ad-921c-13865957895c",
|                                    "Name":  "Advisor Reviews Reader",
|                                    "Description":  "View reviews for a workload and recommendations linked to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Advisor/resiliencyReviews/read",
|                                                    "Microsoft.Advisor/triageRecommendations/read",
|                                                    "Microsoft.Advisor/triageResources/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8aac15f0-d885-4138-8afa-bfb5872f7d13",
|                                    "Name":  "Advisor Reviews Contributor",
|                                    "Description":  "View reviews for a workload and triage recommendations linked to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Advisor/resiliencyReviews/read",
|                                                    "Microsoft.Advisor/triageRecommendations/read",
|                                                    "Microsoft.Advisor/triageRecommendations/approve/action",
|                                                    "Microsoft.Advisor/triageRecommendations/reject/action",
|                                                    "Microsoft.Advisor/triageRecommendations/reset/action",
|                                                    "Microsoft.Advisor/triageResources/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a8d4b70f-0fb9-4f72-b267-b87b2f990aec",
|                                    "Name":  "AgFood Platform Dataset Admin",
|                                    "Description":  "Provides access to Dataset APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/datasets/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/datasetRecords/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0f641de8-0b88-4198-bdef-bd8b45ceba96",
|                                    "Name":  "Defender for Storage Scanner Operator",
|                                    "Description":  "Lets you enable and configure Microsoft Defender for Storage\u0027s malware scanning and sensitive data discovery features on your storage accounts. Includes an ABAC condition to limit role assignments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Security/defenderforstoragesettings/read",
|                                                    "Microsoft.Security/defenderforstoragesettings/write",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Security/datascanners/read",
|                                                    "Microsoft.Security/datascanners/write",
|                                                    "Microsoft.Security/dataScanners/delete",
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.EventGrid/topics/read",
|                                                    "Microsoft.EventGrid/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/eventSubscriptions/write",
|                                                    "Microsoft.EventGrid/eventSubscriptions/delete",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "662802e2-50f6-46b0-aed2-e834bacc6d12",
|                                    "Name":  "Azure Front Door Profile Reader",
|                                    "Description":  "Can view AFD standard and premium profiles and their endpoints, but can\u0027t make changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Cdn/edgenodes/read",
|                                                    "Microsoft.Cdn/operationresults/*",
|                                                    "Microsoft.Cdn/profiles/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Cdn/operationresults/profileresults/afdendpointresults/CheckCustomDomainDNSMappingStatus/action",
|                                                    "Microsoft.Cdn/profiles/queryloganalyticsmetrics/action",
|                                                    "Microsoft.Cdn/profiles/queryloganalyticsrankings/action",
|                                                    "Microsoft.Cdn/profiles/querywafloganalyticsmetrics/action",
|                                                    "Microsoft.Cdn/profiles/querywafloganalyticsrankings/action",
|                                                    "Microsoft.Cdn/profiles/afdendpoints/CheckCustomDomainDNSMappingStatus/action",
|                                                    "Microsoft.Cdn/profiles/Usages/action",
|                                                    "Microsoft.Cdn/profiles/afdendpoints/Usages/action",
|                                                    "Microsoft.Cdn/profiles/origingroups/Usages/action",
|                                                    "Microsoft.Cdn/profiles/rulesets/Usages/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "86fede04-b259-4277-8c3e-e26b9865abd8",
|                                    "Name":  "Enclave Reader Role",
|                                    "Description":  "Enclave Reader Role to access the resources of Microsoft.Mission stored with RPSAAS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Mission/Operations/read",
|                                                    "Microsoft.Mission/communities/read",
|                                                    "Microsoft.Mission/virtualEnclaves/read",
|                                                    "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/read",
|                                                    "Microsoft.Mission/communities/transitHubs/read",
|                                                    "Microsoft.Mission/enclaveConnections/read",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                    "Microsoft.Mission/approvals/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b5092dac-c796-4349-8681-1a322a31c3f9",
|                                    "Name":  "Azure Kubernetes Service Hybrid Cluster Admin Role",
|                                    "Description":  "List cluster admin credential action.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/listAdminKubeconfig/action",
|                                                    "Microsoft.Kubernetes/connectedClusters/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fc3f91a1-40bf-4439-8c46-45edbd83563a",
|                                    "Name":  "Azure Kubernetes Service Hybrid Cluster User Role",
|                                    "Description":  "List cluster user credential action.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/listUserKubeconfig/action",
|                                                    "Microsoft.Kubernetes/connectedClusters/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e7037d40-443a-4434-a3fb-8cd202011e1d",
|                                    "Name":  "Azure Kubernetes Service Hybrid Contributor Role",
|                                    "Description":  "Grants access to read and write Azure Kubernetes Services hybrid clusters",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridContainerService/Locations/operationStatuses/read",
|                                                    "Microsoft.HybridContainerService/Operations/read",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/read",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/write",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/delete",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/write",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/delete",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/write",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/delete",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/upgradeProfiles/read",
|                                                    "Microsoft.HybridContainerService/skus/read",
|                                                    "Microsoft.HybridContainerService/skus/write",
|                                                    "Microsoft.HybridContainerService/skus/delete",
|                                                    "Microsoft.HybridContainerService/virtualNetworks/read",
|                                                    "Microsoft.HybridContainerService/virtualNetworks/write",
|                                                    "Microsoft.HybridContainerService/virtualNetworks/delete",
|                                                    "Microsoft.Kubernetes/connectedClusters/Read",
|                                                    "Microsoft.Kubernetes/connectedClusters/Write",
|                                                    "Microsoft.Kubernetes/connectedClusters/Delete",
|                                                    "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3d5f3eff-eb94-473d-91e3-7aac74d6c0bb",
|                                    "Name":  "Enclave Owner Role",
|                                    "Description":  "Enclave Owner Role to access the resources of Microsoft.Mission stored with RPSAAS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                    "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                    "Microsoft.Mission/Operations/read",
|                                                    "Microsoft.Mission/virtualEnclaves/read",
|                                                    "Microsoft.Mission/virtualEnclaves/write",
|                                                    "Microsoft.Mission/virtualEnclaves/delete",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/delete",
|                                                    "Microsoft.Mission/communities/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/read",
|                                                    "Microsoft.Mission/communities/transitHubs/read",
|                                                    "Microsoft.Mission/enclaveConnections/read",
|                                                    "Microsoft.Mission/enclaveConnections/write",
|                                                    "Microsoft.Mission/enclaveConnections/delete",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/write",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/delete",
|                                                    "Microsoft.Mission/approvals/read",
|                                                    "Microsoft.Mission/approvals/write",
|                                                    "Microsoft.Mission/approvals/delete",
|                                                    "Microsoft.Mission/virtualEnclaves/setWorkloadRoleAssignments/action",
|                                                    "Microsoft.Mission/virtualEnclaves/setEnclaveRoleAssignments/action",
|                                                    "Microsoft.Mission/virtualenclaves/setMaintenanceMode/action",
|                                                    "Microsoft.Mission/virtualEnclaves/setSubnetConfiguration/action",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/connect/action",
|                                                    "Microsoft.Mission/enclaveConnections/setSourceCidr/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e6aadb6b-e64f-41c0-9392-d2bba3bc3ebc",
|                                    "Name":  "Community Reader Role",
|                                    "Description":  "Community Reader Role to access the resources of Microsoft.Mission stored with RPSAAS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                    "Microsoft.Mission/Operations/read",
|                                                    "Microsoft.Mission/communities/read",
|                                                    "Microsoft.Mission/virtualEnclaves/read",
|                                                    "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/read",
|                                                    "Microsoft.Mission/communities/transitHubs/read",
|                                                    "Microsoft.Mission/enclaveConnections/read",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                    "Microsoft.Mission/approvals/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "19feefae-eacc-4106-81fd-ac34c0671f14",
|                                    "Name":  "Enclave Contributor Role",
|                                    "Description":  "Enclave Contributor Role to access the resources of Microsoft.Mission stored with RPSAAS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Mission/register/action",
|                                                    "Microsoft.Mission/unregister/action",
|                                                    "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                    "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                    "Microsoft.Mission/Operations/read",
|                                                    "Microsoft.Mission/communities/read",
|                                                    "Microsoft.Mission/virtualEnclaves/read",
|                                                    "Microsoft.Mission/virtualEnclaves/write",
|                                                    "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                    "Microsoft.Mission/virtualEnclaves/endpoints/write",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/read",
|                                                    "Microsoft.Mission/communities/transitHubs/read",
|                                                    "Microsoft.Mission/enclaveConnections/read",
|                                                    "Microsoft.Mission/enclaveConnections/write",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/write",
|                                                    "Microsoft.Mission/approvals/read",
|                                                    "Microsoft.Mission/approvals/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "44f0a1a8-6fea-4b35-980a-8ff50c487c97",
|                                    "Name":  "Operator Nexus Key Vault Writer Service Role (Preview)",
|                                    "Description":  "(Preview) Provides Azure Operator Nexus services the ability to write to a Key Vault. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.KeyVault/vaults/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/secrets/setSecret/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a316ed6d-1efe-48ac-ac08-f7995a9c26fb",
|                                    "Name":  "Storage Account Encryption Scope Contributor Role",
|                                    "Description":  "Allows management of Encryption Scopes on a Storage Account",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/encryptionScopes/read",
|                                                    "Microsoft.Storage/storageAccounts/encryptionScopes/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "08bbd89e-9f13-488c-ac41-acfcb10c90ab",
|                                    "Name":  "Key Vault Crypto Service Release User",
|                                    "Description":  "Release keys. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/keys/release/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0cd9749a-3aaf-4ae5-8803-bd217705bf3b",
|                                    "Name":  "Kubernetes Runtime Storage Class Contributor Role",
|                                    "Description":  "Read, write, and delete Kubernetes Runtime storage classes in an Arc connected Kubernetes cluster",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.KubernetesRuntime/storageClasses/read",
|                                                    "Microsoft.KubernetesRuntime/storageClasses/write",
|                                                    "Microsoft.KubernetesRuntime/storageClasses/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "609c0c20-e0a0-4a71-b99f-e7e755ac493d",
|                                    "Name":  "Azure Programmable Connectivity Gateway User",
|                                    "Description":  "Allows access to all Gateway dataplane APIs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "db79e9a7-68ee-4b58-9aeb-b90e7c24fcba",
|                                    "Name":  "Key Vault Certificate User",
|                                    "Description":  "Read certificate contents. Only works for key vaults that use the \u0027Azure role-based access control\u0027 permission model.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.KeyVault/vaults/certificates/read",
|                                                        "Microsoft.KeyVault/vaults/secrets/getSecret/action",
|                                                        "Microsoft.KeyVault/vaults/secrets/readMetadata/action",
|                                                        "Microsoft.KeyVault/vaults/keys/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4301dc2a-25a9-44b0-ae63-3636cf7f2bd2",
|                                    "Name":  "Azure Spring Apps Spring Cloud Gateway Log Reader Role",
|                                    "Description":  "Read real-time logs for Spring Cloud Gateway in Azure Spring Apps",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppPlatform/Spring/read",
|                                                    "Microsoft.AppPlatform/Spring/gateways/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/SpringCloudGateway/logstream/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "52fd16bd-6ed5-46af-9c40-29cbd7952a29",
|                                    "Name":  "Azure Spring Apps Managed Components Log Reader Role",
|                                    "Description":  "Read real-time logs for all managed components in Azure Spring Apps",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/managedComponents/logstream/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6593e776-2a30-40f9-8a32-4fe28b77655d",
|                                    "Name":  "Azure Spring Apps Application Configuration Service Log Reader Role",
|                                    "Description":  "Read real-time logs for Application Configuration Service in Azure Spring Apps",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppPlatform/Spring/read",
|                                                    "Microsoft.AppPlatform/Spring/configurationServices/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/ApplicationConfigurationService/logstream/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "207bcc4b-86a6-4487-9141-d6c1f4c238aa",
|                                    "Name":  "Azure Edge On-Site Deployment Engineer",
|                                    "Description":  "Grants you access to take actions as an on-site person to assist in the provisioning of an edge device",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EdgeOrder/orderItems/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c7244dfb-f447-457d-b2ba-3999044d1706",
|                                    "Name":  "Azure API Center Data Reader",
|                                    "Description":  "Allows for access to Azure API Center data plane read operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ApiCenter/services/*/read",
|                                                        "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/exportSpecification/action",
|                                                        "Microsoft.ApiCenter/services/workspaces/search/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dfb2f09d-25f8-4558-8986-497084006d7a",
|                                    "Name":  "Azure impact-insight reader",
|                                    "Description":  "built-in role for azure impact-insight read access",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Impact/WorkloadImpacts/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8bb6f106-b146-4ee6-a3f9-b9c5a96e0ae5",
|                                    "Name":  "Defender Kubernetes Agent Operator",
|                                    "Description":  "Grants Microsoft Defender for Cloud permissions to provision the Kubernetes defender security agent",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.Kubernetes/connectedClusters/Write",
|                                                    "Microsoft.Kubernetes/connectedClusters/read",
|                                                    "Microsoft.OperationalInsights/workspaces/write",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.OperationalInsights/workspaces/listKeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedkeys/action",
|                                                    "Microsoft.Kubernetes/register/action",
|                                                    "Microsoft.KubernetesConfiguration/register/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5b7237c5-45e1-49d6-bc18-a1f62f400748",
|                                    "Name":  "Azure Red Hat OpenShift Disk Storage Operator",
|                                    "Description":  "Install Container Storage Interface (CSI) drivers that enable your cluster to use Azure Disks. Set OpenShift cluster-wide storage defaults to ensure a default storageclass exists for clusters.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/read",
|                                                    "Microsoft.Compute/snapshots/write",
|                                                    "Microsoft.Compute/snapshots/read",
|                                                    "Microsoft.Compute/snapshots/delete",
|                                                    "Microsoft.Compute/locations/operations/read",
|                                                    "Microsoft.Compute/locations/DiskOperations/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action",
|                                                    "Microsoft.Compute/diskEncryptionSets/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4436bae4-7702-4c84-919b-c4069ff25ee2",
|                                    "Name":  "Azure Red Hat OpenShift Service Operator",
|                                    "Description":  "Maintain machine health, network configuration, monitoring, and other features that are specific to an OpenShift cluster\u0027s continued functionality as a managed service.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/natGateways/join/action",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                    "Microsoft.Network/networkIntentPolicies/join/action",
|                                                    "Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Storage/storageAccounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0d7aedc0-15fd-4a67-a412-efad370c947e",
|                                    "Name":  "Azure Red Hat OpenShift File Storage Operator",
|                                    "Description":  "Install Container Storage Interface (CSI) drivers that enable your cluster to use Azure Files. Set OpenShift cluster-wide storage defaults to ensure a default storageclass exists for clusters.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/delete",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/delete",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/write",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/natGateways/join/action",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/privateEndpoints/write",
|                                                    "Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action",
|                                                    "Microsoft.Network/networkIntentPolicies/join/action",
|                                                    "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Network/privateDnsOperationStatuses/read",
|                                                    "Microsoft.Network/privateDnsZones/read",
|                                                    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
|                                                    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                    "Microsoft.Network/privateDnsZones/write",
|                                                    "Microsoft.Network/privateDnsZones/join/action",
|                                                    "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
|                                                    "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
|                                                    "Microsoft.Network/privateEndpoints/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8b32b316-c2f5-4ddf-b05b-83dacd2d08b5",
|                                    "Name":  "Azure Red Hat OpenShift Image Registry Operator",
|                                    "Description":  "Enables permissions for the operator to manage a singleton instance of the OpenShift image registry. It manages all configuration of the registry, including creating storage.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/delete",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Resources/tags/write",
|                                                    "Microsoft.Network/privateEndpoints/write",
|                                                    "Microsoft.Network/privateEndpoints/read",
|                                                    "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
|                                                    "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
|                                                    "Microsoft.Network/privateDnsZones/read",
|                                                    "Microsoft.Network/privateDnsZones/write",
|                                                    "Microsoft.Network/privateDnsZones/join/action",
|                                                    "Microsoft.Network/privateDnsZones/A/write",
|                                                    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/join/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "be7a6435-15ae-4171-8f30-4a343eff9e8f",
|                                    "Name":  "Azure Red Hat OpenShift Network Operator",
|                                    "Description":  "Install and upgrade the networking components on an OpenShift cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                    "Microsoft.Compute/virtualMachines/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a1f96423-95ce-4224-ab27-4e3dc72facd4",
|                                    "Name":  "Azure Red Hat OpenShift Cloud Controller Manager",
|                                    "Description":  "Manage and update the cloud controller manager deployed on top of OpenShift.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/loadBalancers/write",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/write",
|                                                    "Microsoft.Network/publicIPAddresses/join/action",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/publicIPAddresses/write",
|                                                    "Microsoft.Network/publicIPAddresses/delete",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/publicIPPrefixes/join/action",
|                                                    "Microsoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/privatelinkservices/write",
|                                                    "Microsoft.Network/privatelinkservices/read",
|                                                    "Microsoft.Network/privatelinkservices/delete",
|                                                    "Microsoft.Network/loadBalancers/loadBalancingRules/read",
|                                                    "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                    "Microsoft.Network/natGateways/join/action",
|                                                    "Microsoft.Network/networkIntentPolicies/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0358943c-7e01-48ba-8889-02cc51d78637",
|                                    "Name":  "Azure Red Hat OpenShift Machine API Operator",
|                                    "Description":  "Manage the lifecycle of specific-purpose custom resource definitions (CRD), controllers, and Azure RBAC objects that extend the Kubernetes API to declares the desired state of machines in a cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/availabilitySets/delete",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/availabilitySets/write",
|                                                    "Microsoft.Compute/diskEncryptionSets/read",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/galleries/images/versions/read",
|                                                    "Microsoft.Compute/skus/read",
|                                                    "Microsoft.Compute/virtualMachines/delete",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/capacityReservationGroups/deploy/action",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action",
|                                                    "Microsoft.Network/applicationSecurityGroups/read",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/loadBalancers/write",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/networkInterfaces/loadBalancers/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/write",
|                                                    "Microsoft.Network/publicIPAddresses/delete",
|                                                    "Microsoft.Network/publicIPAddresses/join/action",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/publicIPAddresses/write",
|                                                    "Microsoft.Network/routeTables/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/action",
|                                                    "Microsoft.Network/loadBalancers/frontendIPConfigurations/join/action",
|                                                    "Microsoft.Network/loadBalancers/inboundNATRules/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0336e1d3-7a87-462b-b6db-342b63f7802c",
|                                    "Name":  "Azure Red Hat OpenShift Cluster Ingress Operator",
|                                    "Description":  "Manage and configure the OpenShift router.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/dnsZones/A/delete",
|                                                    "Microsoft.Network/dnsZones/A/write",
|                                                    "Microsoft.Network/privateDnsZones/A/delete",
|                                                    "Microsoft.Network/privateDnsZones/A/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5a382001-fe36-41ff-bba4-8bf06bd54da9",
|                                    "Name":  "Azure Sphere Owner",
|                                    "Description":  "Allows user read and write access to Azure Sphere resources and RBAC configuration, includes an ABAC condition to constrain role assignments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureSphere/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Insights/DiagnosticSettings/*",
|                                                    "Microsoft.Insights/DiagnosticSettingsCategories/Read",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e2217c0e-04bb-4724-9580-91cf9871bc01",
|                                    "Name":  "GroupQuota Request Operator",
|                                    "Description":  "Read and create GroupQuota requests, get GroupQuota request status, and get groupQuotaLimits.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "MICROSOFT.QUOTA/QUOTAS/WRITE",
|                                                    "MICROSOFT.QUOTA/QUOTAS/READ",
|                                                    "MICROSOFT.QUOTA/USAGES/READ",
|                                                    "MICROSOFT.QUOTA/QUOTAREQUESTS/READ",
|                                                    "MICROSOFT.QUOTA/REGISTER/ACTION",
|                                                    "Microsoft.Quota/GROUPQUOTAS/*/READ",
|                                                    "Microsoft.Quota/GROUPQUOTAS/*/WRITE",
|                                                    "Microsoft.Quota/GROUPQUOTAS/*/DELETE"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d0f495dc-44ef-4140-aeb0-b89110e6a7c1",
|                                    "Name":  "GroupQuota Reader",
|                                    "Description":  "Read GroupQuota requests, get GroupQuota request status, and get groupQuotaLimits.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "MICROSOFT.QUOTA/QUOTAS/READ",
|                                                    "MICROSOFT.QUOTA/USAGES/READ",
|                                                    "MICROSOFT.QUOTA/QUOTAREQUESTS/READ",
|                                                    "MICROSOFT.QUOTA/REGISTER/ACTION",
|                                                    "Microsoft.Quota/GROUPQUOTAS/READ",
|                                                    "Microsoft.Quota/GROUPQUOTAS/subscriptions/READ",
|                                                    "Microsoft.Quota/GROUPQUOTAS/groupQuotaLimits/READ",
|                                                    "Microsoft.Quota/GROUPQUOTAS/quotaAllocations/READ"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "539283cd-c185-4a9a-9503-d35217a1db7b",
|                                    "Name":  "Bayer Ag Powered Services Smart Boundary Solution User Role",
|                                    "Description":  "Provide access to Smart Boundary Solution by Bayer Ag Powered Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/ingestionJobs/satelliteDataIngestionJobs/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/scenes/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8480c0f0-4509-4229-9339-7c10018cb8c4",
|                                    "Name":  "Defender CSPM Storage Scanner Operator",
|                                    "Description":  "Lets you enable and configure Microsoft Defender CSPM\u0027s sensitive data discovery feature on your storage accounts. Includes an ABAC condition to limit role assignments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Security/datascanners/read",
|                                                    "Microsoft.Security/datascanners/write",
|                                                    "Microsoft.Security/dataScanners/delete",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6b534d80-e337-47c4-864f-140f5c7f593d",
|                                    "Name":  "Advisor Recommendations Contributor (Assessments and Reviews)",
|                                    "Description":  "View assessment recommendations, accepted review recommendations, and manage the recommendations lifecycle (mark recommendations as completed, postponed or dismissed, in progress, or not started).",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Advisor/recommendations/read",
|                                                    "Microsoft.Advisor/recommendations/write",
|                                                    "Microsoft.Advisor/recommendations/available/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c9c97b9c-105d-4bb5-a2a7-7d15666c2484",
|                                    "Name":  "GeoCatalog Administrator",
|                                    "Description":  "Grants full access to manage GeoCatalogs, but does not allow you to assign roles in Azure RBAC.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Orbital/operations/read",
|                                                    "Microsoft.Orbital/geoCatalogs/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b7b8f583-43d0-40ae-b147-6b46f53661c1",
|                                    "Name":  "GeoCatalog Reader",
|                                    "Description":  "View GeoCatalogs, but does not allow you to make any changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Orbital/operations/read",
|                                                    "Microsoft.Orbital/geoCatalogs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "eb5a76d5-50e7-4c33-a449-070e7c9c4cf2",
|                                    "Name":  "Healthcare Agent Reader",
|                                    "Description":  "Users with reader access can sign in, have read-only access to the bot resources, scenarios and configuration setting except for the bot instance keys \u0026 secrets (including Authentication, Data Connection and Channels keys) and the end-user inputs (including Feedback, Unrecognized utterances and Conversation logs).",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthBot/healthBots/ResourceData/Read",
|                                                        "Microsoft.HealthBot/healthBots/Metadata/Read",
|                                                        "Microsoft.HealthBot/healthBots/CopilotStudioSolution/RestoreBuiltinTemplate/Read",
|                                                        "Microsoft.HealthBot/healthBots/Feedback/Read",
|                                                        "Microsoft.HealthBot/healthBots/Users/Read",
|                                                        "Microsoft.HealthBot/healthBots/AuditTrails/Read",
|                                                        "Microsoft.HealthBot/healthBots/AnalyticReport/Read",
|                                                        "Microsoft.HealthBot/healthBots/ExposedSkill/Read",
|                                                        "Microsoft.HealthBot/healthBots/RegisteredSkills/Read",
|                                                        "Microsoft.HealthBot/healthBots/Configuration/Read",
|                                                        "Microsoft.HealthBot/healthBots/Localization/Read",
|                                                        "Microsoft.HealthBot/healthBots/AuthenticationProviders/Read",
|                                                        "Microsoft.HealthBot/healthBots/DataConnections/Read",
|                                                        "Microsoft.HealthBot/healthBots/OpenAPIPlugins/Read",
|                                                        "Microsoft.HealthBot/healthBots/Scenarios/*/Read",
|                                                        "Microsoft.HealthBot/healthBots/LanguageModels/Read",
|                                                        "Microsoft.HealthBot/healthBots/Resources/Files/Read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "af854a69-80ce-4ff7-8447-f1118a2e0ca8",
|                                    "Name":  "Healthcare Agent Editor",
|                                    "Description":  "Users with editor access can sign in, view and edit all the bot resources, scenarios and configuration setting except for the bot instance keys \u0026 secrets and the end-user inputs (including Feedback, Unrecognized utterances and Conversation logs). A read-only access to the bot skills and channels.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthBot/healthBots/ResourceData/Read",
|                                                        "Microsoft.HealthBot/healthBots/Metadata/Read",
|                                                        "Microsoft.HealthBot/healthBots/CopilotStudioSolution/*",
|                                                        "Microsoft.HealthBot/healthBots/Feedback/Read",
|                                                        "Microsoft.HealthBot/healthBots/Users/Read",
|                                                        "Microsoft.HealthBot/healthBots/AuditTrails/Read",
|                                                        "Microsoft.HealthBot/healthBots/AnalyticReport/Read",
|                                                        "Microsoft.HealthBot/healthBots/ExposedSkill/Read",
|                                                        "Microsoft.HealthBot/healthBots/RegisteredSkills/Read",
|                                                        "Microsoft.HealthBot/healthBots/Configuration/*",
|                                                        "Microsoft.HealthBot/healthBots/Localization/*",
|                                                        "Microsoft.HealthBot/healthBots/AuthenticationProviders/*",
|                                                        "Microsoft.HealthBot/healthBots/Channels/*",
|                                                        "Microsoft.HealthBot/healthBots/DataConnections/*",
|                                                        "Microsoft.HealthBot/healthBots/OpenAPIPlugins/*",
|                                                        "Microsoft.HealthBot/healthBots/Scenarios/*",
|                                                        "Microsoft.HealthBot/healthBots/LanguageModels/*",
|                                                        "Microsoft.HealthBot/healthBots/Resources/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f1082fec-a70f-419f-9230-885d2550fb38",
|                                    "Name":  "Healthcare Agent Admin",
|                                    "Description":  "Users with admin access can sign in, view and edit all of the bot resources, scenarios and configuration setting including the bot instance keys \u0026 secrets.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthBot/healthBots/ResourceData/Read",
|                                                        "Microsoft.HealthBot/healthBots/Metadata/Read",
|                                                        "Microsoft.HealthBot/healthBots/CopilotStudioSolution/*",
|                                                        "Microsoft.HealthBot/healthBots/Feedback/Read",
|                                                        "Microsoft.HealthBot/healthBots/Users/Read",
|                                                        "Microsoft.HealthBot/healthBots/AuditTrails/Read",
|                                                        "Microsoft.HealthBot/healthBots/AnalyticReport/Read",
|                                                        "Microsoft.HealthBot/healthBots/ExposedSkill/Read",
|                                                        "Microsoft.HealthBot/healthBots/RegisteredSkills/Read",
|                                                        "Microsoft.HealthBot/healthBots/Configuration/*",
|                                                        "Microsoft.HealthBot/healthBots/Localization/*",
|                                                        "Microsoft.HealthBot/healthBots/AuthenticationProviders/*",
|                                                        "Microsoft.HealthBot/healthBots/Channels/*",
|                                                        "Microsoft.HealthBot/healthBots/DataConnections/*",
|                                                        "Microsoft.HealthBot/healthBots/OpenAPIPlugins/*",
|                                                        "Microsoft.HealthBot/healthBots/Scenarios/*",
|                                                        "Microsoft.HealthBot/healthBots/LanguageModels/*",
|                                                        "Microsoft.HealthBot/healthBots/Resources/*",
|                                                        "Microsoft.HealthBot/healthBots/Admin/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c20923c5-b089-47a5-bf67-fd89569c4ad9",
|                                    "Name":  "Azure Programmable Connectivity Gateway Dataplane User",
|                                    "Description":  "Allows access to all Gateway dataplane APIs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ProgrammableConnectivity/Gateways/NetworkAPIAccess"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b556d68e-0be0-4f35-a333-ad7ee1ce17ea",
|                                    "Name":  "Azure AI Enterprise Network Connection Approver",
|                                    "Description":  "Can approve private endpoint connections to Azure AI common dependency resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiManagement/service/privateEndpointConnections/read",
|                                                    "Microsoft.ApiManagement/service/privateEndpointConnections/write",
|                                                    "Microsoft.ApiManagement/service/privateLinkResources/read",
|                                                    "Microsoft.ApiManagement/service/read",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnections/read",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnections/write",
|                                                    "Microsoft.Cache/redis/read",
|                                                    "Microsoft.Cache/redis/privateEndpointConnections/read",
|                                                    "Microsoft.Cache/redis/privateEndpointConnections/write",
|                                                    "Microsoft.Cache/redis/privateLinkResources/read",
|                                                    "Microsoft.Cache/redis/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Cache/redisEnterprise/read",
|                                                    "Microsoft.Cache/redisEnterprise/privateEndpointConnections/read",
|                                                    "Microsoft.Cache/redisEnterprise/privateEndpointConnections/write",
|                                                    "Microsoft.Cache/redisEnterprise/privateLinkResources/read",
|                                                    "Microsoft.Cache/redisEnterprise/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.CognitiveServices/accounts/read",
|                                                    "Microsoft.CognitiveServices/accounts/privateEndpointConnections/read",
|                                                    "Microsoft.CognitiveServices/accounts/privateEndpointConnections/write",
|                                                    "Microsoft.CognitiveServices/accounts/privateLinkResources/read",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/read",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/privateEndpointConnections/write",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/privateLinkResources/read",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/read",
|                                                    "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/read",
|                                                    "Microsoft.DBforPostgreSQL/serverGroupsv2/privateEndpointConnections/write",
|                                                    "Microsoft.DBforPostgreSQL/serverGroupsv2/privateLinkResources/read",
|                                                    "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/read",
|                                                    "Microsoft.DBforMySQL/flexibleServers/privateEndpointConnections/write",
|                                                    "Microsoft.DBforMySQL/flexibleServers/privateLinkResources/read",
|                                                    "Microsoft.DBforMySQL/flexibleServers/read",
|                                                    "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/operationResults/read",
|                                                    "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/read",
|                                                    "Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write",
|                                                    "Microsoft.DocumentDB/databaseAccounts/privateLinkResources/read",
|                                                    "Microsoft.DocumentDB/databaseAccounts/read",
|                                                    "Microsoft.KeyVault/vaults/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.KeyVault/vaults/privateEndpointConnections/read",
|                                                    "Microsoft.KeyVault/vaults/privateEndpointConnections/write",
|                                                    "Microsoft.KeyVault/vaults/privateLinkResources/read",
|                                                    "Microsoft.KeyVault/vaults/read",
|                                                    "Microsoft.MachineLearningServices/registries/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.MachineLearningServices/registries/privateEndpointConnections/read",
|                                                    "Microsoft.MachineLearningServices/registries/privateEndpointConnections/write",
|                                                    "Microsoft.MachineLearningServices/registries/privateLinkResources/read",
|                                                    "Microsoft.MachineLearningServices/registries/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/privateEndpointConnections/write",
|                                                    "Microsoft.MachineLearningServices/workspaces/privateLinkResources/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/read",
|                                                    "Microsoft.Storage/storageAccounts/privateEndpointConnections/read",
|                                                    "Microsoft.Storage/storageAccounts/privateEndpointConnections/write",
|                                                    "Microsoft.Storage/storageAccounts/privateLinkResources/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Sql/servers/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Sql/servers/privateEndpointConnections/read",
|                                                    "Microsoft.Sql/servers/privateEndpointConnections/write",
|                                                    "Microsoft.Sql/servers/privateLinkResources/read",
|                                                    "Microsoft.Sql/servers/read",
|                                                    "Microsoft.EventHub/namespaces/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.EventHub/namespaces/privateEndpointConnections/read",
|                                                    "Microsoft.EventHub/namespaces/privateEndpointConnections/write",
|                                                    "Microsoft.EventHub/namespaces/privateLinkResources/read",
|                                                    "Microsoft.EventHub/namespaces/read",
|                                                    "Microsoft.Search/searchServices/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Search/searchServices/privateEndpointConnections/read",
|                                                    "Microsoft.Search/searchServices/privateEndpointConnections/write",
|                                                    "Microsoft.Search/searchServices/sharedPrivateLinkResources/read",
|                                                    "Microsoft.Search/searchServices/read",
|                                                    "Microsoft.Insights/privatelinkscopes/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Insights/privatelinkscopes/privateEndpointConnections/read",
|                                                    "Microsoft.Insights/privatelinkscopes/privateEndpointConnections/write",
|                                                    "Microsoft.Insights/privatelinkscopes/privateLinkResources/read",
|                                                    "Microsoft.Insights/privatelinkscopes/read",
|                                                    "Microsoft.Network/privateLinkServices/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Network/privateLinkServices/privateEndpointConnections/read",
|                                                    "Microsoft.Network/privateLinkServices/privateEndpointConnections/write",
|                                                    "Microsoft.Network/privateLinkServices/read",
|                                                    "Microsoft.Network/applicationGateways/privateEndpointConnections/read",
|                                                    "Microsoft.Network/applicationGateways/privateEndpointConnections/write",
|                                                    "Microsoft.Network/applicationGateways/privateLinkResources/read",
|                                                    "Microsoft.Network/applicationGateways/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "08d4c71a-cc63-4ce4-a9c8-5dd251b4d619",
|                                    "Name":  "Azure Container Storage Operator",
|                                    "Description":  "Role required by a Managed Identity for Azure Container Storage operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ElasticSan/elasticSans/*",
|                                                    "Microsoft.ElasticSan/locations/asyncoperations/read",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/virtualNetworks/write",
|                                                    "Microsoft.Network/virtualNetworks/delete",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/write",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
|                                                    "Microsoft.Resources/subscriptions/providers/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Network/virtualNetworks/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "95dd08a6-00bd-4661-84bf-f6726f83a4d0",
|                                    "Name":  "Azure Container Storage Contributor",
|                                    "Description":  "Lets you install Azure Container Storage and manage its storage resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "95de85bd-744d-4664-9dde-11430bc34793",
|                                    "Name":  "Azure Container Storage Owner",
|                                    "Description":  "Lets you install Azure Container Storage and grants access to its storage resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ElasticSan/elasticSans/*",
|                                                    "Microsoft.ElasticSan/locations/*",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/*",
|                                                    "Microsoft.ElasticSan/elasticSans/volumeGroups/volumes/*",
|                                                    "Microsoft.ElasticSan/locations/asyncoperations/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/delete",
|                                                    "Microsoft.KubernetesConfiguration/extensions/operations/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Management/managementGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d3f1697-4507-4d08-bb4a-477695db5f82",
|                                    "Name":  "Azure Kubernetes Service Arc Contributor Role",
|                                    "Description":  "Grants access to read and write Azure Kubernetes Services hybrid clusters",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridContainerService/Locations/operationStatuses/read",
|                                                    "Microsoft.HybridContainerService/Locations/operationStatuses/write",
|                                                    "Microsoft.HybridContainerService/Operations/read",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/read",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/write",
|                                                    "Microsoft.HybridContainerService/kubernetesVersions/delete",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/write",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/delete",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/write",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/delete",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/upgradeProfiles/read",
|                                                    "Microsoft.HybridContainerService/skus/read",
|                                                    "Microsoft.HybridContainerService/skus/write",
|                                                    "Microsoft.HybridContainerService/skus/delete",
|                                                    "Microsoft.HybridContainerService/virtualNetworks/read",
|                                                    "Microsoft.HybridContainerService/virtualNetworks/write",
|                                                    "Microsoft.HybridContainerService/virtualNetworks/delete",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/read",
|                                                    "Microsoft.Kubernetes/connectedClusters/Read",
|                                                    "Microsoft.Kubernetes/connectedClusters/Write",
|                                                    "Microsoft.Kubernetes/connectedClusters/Delete",
|                                                    "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action",
|                                                    "Microsoft.AzureStackHCI/clusters/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/hybridIdentityMetadata/delete",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/hybridIdentityMetadata/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "233ca253-b031-42ff-9fba-87ef12d6b55f",
|                                    "Name":  "Azure Kubernetes Service Arc Cluster User Role",
|                                    "Description":  "List cluster user credential action.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/listUserKubeconfig/action",
|                                                    "Microsoft.Kubernetes/connectedClusters/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b29efa5f-7782-4dc3-9537-4d5bc70a5e9f",
|                                    "Name":  "Azure Kubernetes Service Arc Cluster Admin Role",
|                                    "Description":  "List cluster admin credential action.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/read",
|                                                    "Microsoft.HybridContainerService/provisionedClusterInstances/listAdminKubeconfig/action",
|                                                    "Microsoft.Kubernetes/connectedClusters/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c2a970b4-16a7-4a51-8c84-8a8ea6ee0bb8",
|                                    "Name":  "Backup MUA Admin",
|                                    "Description":  "Backup MultiUser-Authorization. Can create/delete ResourceGuard ",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DataProtection/*/read",
|                                                    "Microsoft.DataProtection/*/resourceGuards/write",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/write",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/delete",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/read",
|                                                    "Microsoft.DataProtection/locations/operationResults/read",
|                                                    "Microsoft.DataProtection/locations/operationStatus/read",
|                                                    "Microsoft.DataProtection/locations/getBackupStatus/action",
|                                                    "Microsoft.DataProtection/locations/checkFeatureSupport/action",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/locations/operationStatus/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/read",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/write",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/delete",
|                                                    "Microsoft.DataProtection/backupVaults/backupResourceGuardProxies/unlockDelete/action",
|                                                    "Microsoft.DataProtection/subscriptions/providers/resourceGuards/read",
|                                                    "Microsoft.DataProtection/subscriptions/resourceGroups/providers/resourceGuards/{operationName}/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f54b6d04-23c6-443e-b462-9c16ab7b4a52",
|                                    "Name":  "Backup MUA Operator",
|                                    "Description":  "Backup MultiUser-Authorization. Allows user to perform critical operation protected by resourceguard",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DataProtection/*/action",
|                                                    "Microsoft.DataProtection/*/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3d24a3a0-c154-4f6f-a5ed-adc8e01ddb74",
|                                    "Name":  "Savings plan Purchaser",
|                                    "Description":  "Lets you purchase savings plans",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Capacity/register/action",
|                                                    "Microsoft.Capacity/catalogs/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.BillingBenefits/savingsPlanOrders/write",
|                                                    "Microsoft.BIllingBenefits/register/action",
|                                                    "Microsoft.Support/supporttickets/write",
|                                                    "Microsoft.Billing/billingProperty/read",
|                                                    "Microsoft.CostManagement/benefitRecommendations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "399c3b2b-64c2-4ff1-af34-571db925b068",
|                                    "Name":  "CrossConnectionManager",
|                                    "Description":  "Allows for read, write access to ExpressRoute CrossConnections",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ClassicNetwork/expressRouteCrossConnections/*",
|                                                    "Microsoft.Network/expressRouteCrossConnections/*",
|                                                    "Microsoft.Features/providers/features/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.Network/expressRouteCrossConnections/delete"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b6ee44de-fe58-4ddc-b5c2-ab174eb23f05",
|                                    "Name":  "CrossConnectionReader",
|                                    "Description":  "Allows for read access to ExpressRoute CrossConnections",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ClassicNetwork/expressRouteCrossConnections/*/read",
|                                                    "Microsoft.Network/expressRouteCrossConnections/*/read",
|                                                    "Microsoft.Features/providers/features/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5e93ba01-8f92-4c7a-b12a-801e3df23824",
|                                    "Name":  "Defender Containers Sensor",
|                                    "Description":  "Grants Microsoft Defender for Cloud access to Azure Kubernetes Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.ContainerService/managedClusters/read",
|                                                    "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/delete",
|                                                    "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read",
|                                                    "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/write",
|                                                    "Microsoft.ContainerService/managedClusters/write",
|                                                    "Microsoft.Security/pricings/securityoperators/read",
|                                                    "Microsoft.Security/securityOperators/read",
|                                                    "Microsoft.OperationalInsights/workspaces/write",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.OperationalInsights/workspaces/listKeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedkeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedkeys/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ede9aaa3-4627-494e-be13-4aa7c256148d",
|                                    "Name":  "Azure API Center Compliance Manager",
|                                    "Description":  "Allows managing API compliance in Azure API Center service.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiCenter/services/*/read",
|                                                    "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/updateAnalysisState/action",
|                                                    "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/exportSpecification/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6cba8790-29c5-48e5-bab1-c7541b01cb04",
|                                    "Name":  "Azure API Center Service Reader",
|                                    "Description":  "Allows read-only access to Azure API Center service.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiCenter/services/*/read",
|                                                    "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/exportSpecification/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dd24193f-ef65-44e5-8a7e-6fa6e03f7713",
|                                    "Name":  "Azure API Center Service Contributor",
|                                    "Description":  "Allows managing Azure API Center service.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ApiCenter/services/*",
|                                                    "Microsoft.ApiCenter/deletedServices/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.ApiCenter/services/workspaces/apis/versions/definitions/updateAnalysisState/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b5b192c1-773c-4543-bfb0-6c59254b74a9",
|                                    "Name":  "Bayer Ag Powered Services Historical Weather Data Solution User Role",
|                                    "Description":  "Provide access to Historical Weather Data Solution by Bayer Ag Powered Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/farms/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/farms/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4caf51ec-f9f5-413f-8a94-b9f5fddba66b",
|                                    "Name":  "Oracle Subscriptions Manager Built-in Role",
|                                    "Description":  "Grants full access to manage all Oracle Subscriptions resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/oracleSubscriptions/*/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/write",
|                                                    "Oracle.Database/oracleSubscriptions/*/delete",
|                                                    "Oracle.Database/oracleSubscriptions/*/action",
|                                                    "Oracle.Database/Locations/*/read",
|                                                    "Oracle.Database/Locations/*/write",
|                                                    "Oracle.Database/Operations/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4562aac9-b209-4bd7-a144-6d7f3bb516f4",
|                                    "Name":  "Oracle.Database Owner Built-in Role",
|                                    "Description":  "Grants full access to manage all Oracle.Database resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Compute/sshPublicKeys/read",
|                                                    "Microsoft.Compute/sshPublicKeys/write",
|                                                    "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d623d097-b882-4e1e-a26f-ac60e31065a1",
|                                    "Name":  "Oracle.Database Reader Built-in Role",
|                                    "Description":  "Grants read access to all Oracle.Database resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/Locations/*/read",
|                                                    "Oracle.Database/Operations/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/read",
|                                                    "Oracle.Database/cloudExadataInfrastructures/*/read",
|                                                    "Oracle.Database/cloudVmClusters/*/read",
|                                                    "Oracle.Database/cloudVmClusters/listPrivateIpAddresses/action",
|                                                    "Oracle.Database/oracleSubscriptions/listCloudAccountDetails/action",
|                                                    "Oracle.Database/exascaleDbStorageVaults/read",
|                                                    "Oracle.Database/exadbVmClusters/*/read",
|                                                    "Oracle.Database/resourceAnchors/read",
|                                                    "Oracle.Database/networkAnchors/read",
|                                                    "Oracle.Database/autonomousDatabases/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/locations/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e9ce8739-6fa2-4123-a0a2-0ef41a67806f",
|                                    "Name":  "Oracle.Database VmCluster Administrator Built-in Role",
|                                    "Description":  "Grants full access to manage all VmCluster resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/cloudVmClusters/*/read",
|                                                    "Oracle.Database/cloudVmClusters/*/write",
|                                                    "Oracle.Database/cloudVmClusters/*/delete",
|                                                    "Oracle.Database/cloudExadataInfrastructures/write",
|                                                    "Oracle.Database/cloudExadataInfrastructures/*/read",
|                                                    "Oracle.Database/Locations/*/read",
|                                                    "Oracle.Database/Locations/*/write",
|                                                    "Oracle.Database/Operations/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/read",
|                                                    "Oracle.Database/resourceAnchors/*",
|                                                    "Oracle.Database/networkAnchors/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Compute/sshPublicKeys/read",
|                                                    "Microsoft.Compute/sshPublicKeys/write",
|                                                    "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4cfdd23b-aece-4fd1-b614-ad3a06c53453",
|                                    "Name":  "Oracle.Database Exadata Infrastructure Administrator Built-in Role",
|                                    "Description":  "Grants full access to manage all Exadata Infrastructure resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/cloudExadataInfrastructures/*/read",
|                                                    "Oracle.Database/cloudExadataInfrastructures/*/write",
|                                                    "Oracle.Database/cloudExadataInfrastructures/*/delete",
|                                                    "Oracle.Database/cloudVmClusters/*/read",
|                                                    "Oracle.Database/cloudVmClusters/*/write",
|                                                    "Oracle.Database/cloudVmClusters/*/delete",
|                                                    "Oracle.Database/cloudVmClusters/*/action",
|                                                    "Oracle.Database/Locations/*/read",
|                                                    "Oracle.Database/Locations/*/write",
|                                                    "Oracle.Database/Operations/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/read",
|                                                    "Oracle.Database/oracleSubscriptions/listCloudAccountDetails/action",
|                                                    "Oracle.Database/resourceAnchors/*",
|                                                    "Oracle.Database/networkAnchors/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Compute/sshPublicKeys/read",
|                                                    "Microsoft.Compute/sshPublicKeys/write",
|                                                    "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "25211fc6-dc78-40b6-b205-e4ac934fd9fd",
|                                    "Name":  "Azure Spring Apps Application Configuration Service Config File Pattern Reader Role",
|                                    "Description":  "Read content of config file pattern for Application Configuration Service in Azure Spring Apps",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppPlatform/Spring/read",
|                                                    "Microsoft.AppPlatform/Spring/configurationServices/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/ApplicationConfigurationService/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f27b7598-bc64-41f7-8a44-855ff16326c2",
|                                    "Name":  "Azure Messaging Catalog Data Owner",
|                                    "Description":  "Allows for full access to Azure Messaging Catalog resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MessagingCatalog/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MessagingCatalog/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d9c6a55-fc0e-4e21-ae6f-f7b095497342",
|                                    "Name":  "Azure Hybrid Database Administrator - Read Only Service Role",
|                                    "Description":  "Read only access to Azure hybrid database services resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureArcData/*/read",
|                                                    "Microsoft.AzureArcData/sqlServerInstances/getTelemetry/action",
|                                                    "Microsoft.AzureArcData/sqlServerInstances/availabilityGroups/getDetailView/action",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c18f9900-27b8-47c7-a8f0-5b3b3d4c2bc2",
|                                    "Name":  "Microsoft Sentinel Business Applications Agent Operator",
|                                    "Description":  "List and update actions on a business applications system. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/read",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/write",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/systems/read",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/systems/write",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/systems/listActions/action",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/systems/reportActionStatus/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0fb8eba5-a2bb-4abe-b1c1-49dfad359bb0",
|                                    "Name":  "Azure ContainerApps Session Executor",
|                                    "Description":  "Create and execute sessions in a sessionPool",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/sessionPools/*/read",
|                                                    "Microsoft.App/sessionPools/sessions/generatesessions/action",
|                                                    "Microsoft.App/sessionPools/fetchMcpServerCredentials/action",
|                                                    "Microsoft.App/sessionPools/rotateMcpServerCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.App/sessionPools/*/read",
|                                                        "Microsoft.App/sessionPools/interpreters/execute/action",
|                                                        "Microsoft.App/sessionPools/interpreters/read",
|                                                        "Microsoft.App/sessionPools/executions/*",
|                                                        "Microsoft.App/sessionPools/files/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "83ee7727-862c-4213-8ed8-2ce6c5d69a40",
|                                    "Name":  "Microsoft.Edge Winfields federated subscription read access role",
|                                    "Description":  "Microsoft.Edge Winfields role for read access on federated subscriptions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ef318e2a-8334-4a05-9e4a-295a196c6a6e",
|                                    "Name":  "Azure Red Hat OpenShift Federated Credential",
|                                    "Description":  "Create, update and delete federated credentials on user assigned managed identities in order to build a trust relationship between the managed identity, OpenID Connect (OIDC), and the service account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/read",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "39138f76-04e6-41f0-ba6b-c411b59081a9",
|                                    "Name":  "Bayer Ag Powered Services Crop Id Solution User Role",
|                                    "Description":  "Provide access to Crop Id Solution by Bayer Ag Powered Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/ingestionJobs/satelliteDataIngestionJobs/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/scenes/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b67fe603-310e-4889-b9ee-8257d09d353d",
|                                    "Name":  "Scheduled Events Contributor",
|                                    "Description":  "Provides access to scheduled event actions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Maintenance/scheduledevents/acknowledge/action",
|                                                    "Microsoft.Compute/VirtualMachines/read",
|                                                    "Microsoft.Compute/VirtualMachineScaleSets/read",
|                                                    "Microsoft.Compute/AvailabilitySets/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e82342c9-ac7f-422b-af64-e426d2e12b2d",
|                                    "Name":  "Compute Recommendations Role",
|                                    "Description":  "Grants permissions to call Compute Recommendations APIs provided by Compute Diagnostic Resource Provider service.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/locations/placementScores/generate/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b459aa1d-e3c8-436f-ae21-c0531140f43e",
|                                    "Name":  "Azure Spring Apps Job Log Reader Role",
|                                    "Description":  "Read real-time logs for jobs in Azure Spring Apps",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppPlatform/Spring/read",
|                                                    "Microsoft.AppPlatform/Spring/jobs/read",
|                                                    "Microsoft.AppPlatform/Spring/jobs/executions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/jobs/executions/logstream/action",
|                                                        "Microsoft.AppPlatform/Spring/jobs/executions/listInstances/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "91422e52-bb88-4415-bb4a-90f5b71f6dcb",
|                                    "Name":  "Azure Spring Apps Job Execution Instance List Role",
|                                    "Description":  "List instances for job executions in Azure Spring Apps",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/jobs/executions/listInstances/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a5eb8433-97a5-4a06-80b2-a877e1622c31",
|                                    "Name":  "Nexus Network Fabric Service Writer",
|                                    "Description":  "Read-write access to Nexus Network Fabric Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ManagedNetworkFabric/*/read",
|                                                    "Microsoft.ManagedNetworkFabric/*/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "05fdd44c-adc6-4aff-981c-61041f0c929a",
|                                    "Name":  "Nexus Network Fabric Service Reader",
|                                    "Description":  "Read-only access to Nexus Network Fabric Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ManagedNetworkFabric/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationStatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "adb29209-aa1d-457b-a786-c913953d2891",
|                                    "Name":  "Azure Deployment Stack Owner",
|                                    "Description":  "Allows a user to manage deployment stacks, including those with deny assignments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deploymentStacks/*",
|                                                    "Microsoft.Resources/deploymentStacksWhatIfResults/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bf7f8882-3383-422a-806a-6526c631a88a",
|                                    "Name":  "Azure Deployment Stack Contributor",
|                                    "Description":  "Allows a user to manage deployment stacks, but cannot create or delete deny assignments within the deployment stack.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deploymentStacks/write",
|                                                    "Microsoft.Resources/deploymentStacks/read",
|                                                    "Microsoft.Resources/deploymentStacks/validate/action",
|                                                    "Microsoft.Resources/deploymentStacks/exportTemplate/action",
|                                                    "Microsoft.Resources/deploymentStacksWhatIfResults/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "74252426-c508-480e-9345-4607bbebead4",
|                                    "Name":  "Azure Spring Apps Spring Cloud Config Server Log Reader Role",
|                                    "Description":  "Read real-time logs for Spring Cloud Config Server in Azure Spring Apps",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppPlatform/Spring/read",
|                                                    "Microsoft.AppPlatform/Spring/configServers/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/Spring/configService/logstream/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bfdb9389-c9a5-478a-bb2f-ba9ca092c3c7",
|                                    "Name":  "Container Registry Repository Catalog Lister",
|                                    "Description":  "Allows for listing all repositories in an Azure Container Registry.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/catalog/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2efddaa5-3f1f-4df3-97df-af3f13818f4c",
|                                    "Name":  "Container Registry Repository Contributor",
|                                    "Description":  "Allows for read, write, and delete access to Azure Container Registry repositories, but excluding catalog listing.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/write",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/write",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/delete",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b93aa761-3e63-49ed-ac28-beffa264f7ac",
|                                    "Name":  "Container Registry Repository Reader",
|                                    "Description":  "Allows for read access to Azure Container Registry repositories, but excluding catalog listing.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2a1e307c-b015-4ebd-883e-5b7698a07328",
|                                    "Name":  "Container Registry Repository Writer",
|                                    "Description":  "Allows for read and write access to Azure Container Registry repositories, but excluding catalog listing.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/write",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "78e4b983-1a0b-472e-8b7d-8d770f7c5890",
|                                    "Name":  "DeID Data Owner",
|                                    "Description":  "Full access to DeID data. This role is in preview and subject to change",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthDataAIServices/DeidServices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "28bf596f-4eb7-45ce-b5bc-6cf482fec137",
|                                    "Name":  "Locks Contributor",
|                                    "Description":  "Can Manage Locks Operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/locks/read",
|                                                    "Microsoft.Authorization/locks/write",
|                                                    "Microsoft.Authorization/locks/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b1e6a0dd-ea0f-4108-8925-7047693f2cfe",
|                                    "Name":  "CloudTest Leased VM Reader",
|                                    "Description":  "Can view CloudTest leased VM\u0027s credentials",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.CloudTest/pools/leases/action",
|                                                    "Microsoft.CloudTest/pools/leases/complete/action",
|                                                    "Microsoft.CloudTest/pools/leases/extend/action",
|                                                    "Microsoft.CloudTest/hostedpools/leases/action",
|                                                    "Microsoft.CloudTest/hostedpools/leases/complete/action",
|                                                    "Microsoft.CloudTest/hostedpools/leases/extend/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "39fcb0de-8844-4706-b050-c28ddbe3ff83",
|                                    "Name":  "Standby Container Group Pool Contributor",
|                                    "Description":  "Allows users to manage standby container group pool resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ContainerInstance/containerGroupProfiles/read",
|                                                    "Microsoft.ContainerInstance/containerGroupProfiles/revisions/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.StandbyPool/Locations/OperationStatuses/read",
|                                                    "Microsoft.StandbyPool/Operations/read",
|                                                    "Microsoft.StandbyPool/standbyContainerGroupPools/delete",
|                                                    "Microsoft.StandbyPool/standbyContainerGroupPools/read",
|                                                    "Microsoft.StandbyPool/standbyContainerGroupPools/runtimeViews/read",
|                                                    "Microsoft.StandbyPool/standbyContainerGroupPools/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "85a2d0d9-2eba-4c9c-b355-11c2cc0788ab",
|                                    "Name":  "Compute Gallery Artifacts Publisher",
|                                    "Description":  "This is the role for publishing gallery artifacts.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/galleries/*",
|                                                    "Microsoft.Compute/locations/capsOperations/read",
|                                                    "Microsoft.Compute/locations/communityGalleries/*",
|                                                    "Microsoft.Compute/locations/sharedGalleries/*",
|                                                    "Microsoft.Compute/images/*",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.Compute/galleries/share/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c5826735-177b-4a0d-a9a3-d0e4b4bda107",
|                                    "Name":  "ToolchainOrchestrator Viewer Role",
|                                    "Description":  "Grant access to view all Toolchain orchestrator resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ToolchainOrchestrator/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2ccf8795-8983-4912-8036-1c45212c95e8",
|                                    "Name":  "ToolchainOrchestrator Admin Role",
|                                    "Description":  "Grant full access to manage all Toolchain orchestrator resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ToolchainOrchestrator/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a3ab03bc-5350-42ff-b0d5-00207672db55",
|                                    "Name":  "ProviderHub Contributor",
|                                    "Description":  "Allows you to create and manage Microsoft.ProviderHub resources through the Resource Provider Platform. Does not allow you to assign roles in Azure RBAC.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ProviderHub/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4d8c6f2e-3fd6-4d40-826e-93e3dc4c3fc1",
|                                    "Name":  "ProviderHub Reader",
|                                    "Description":  "Allows you to view all Microsoft.ProviderHub resources created through the Resource Provider Platform, but does not allow you to make any changes to the resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ProviderHub/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c99c945f-8bd1-4fb1-a903-01460aae6068",
|                                    "Name":  "Azure Stack HCI Connected InfraVMs",
|                                    "Description":  "Role of Arc Integration for Azure Stack HCI Infrastructure Virtual Machines.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/*/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/machines/UpgradeExtensions/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dfce8971-25e3-42e3-ba33-6055438e3080",
|                                    "Name":  "VM Restore Operator",
|                                    "Description":  "Create and Delete resources during VM Restore. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action",
|                                                    "Microsoft.Compute/disks/endGetAccess/action",
|                                                    "Microsoft.Compute/locations/diskOperations/read",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachines/delete",
|                                                    "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/write",
|                                                    "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Network/locations/operationResults/read",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Network/locations/usages/read",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/networkInterfaces/ipconfigurations/read",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                    "Microsoft.Network/publicIPAddresses/delete",
|                                                    "Microsoft.Network/publicIPAddresses/join/action",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/publicIPAddresses/write",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/checkNameAvailability/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0847e196-2fd2-4c2f-a48c-fca6fd030f44",
|                                    "Name":  "HDInsight Cluster Admin",
|                                    "Description":  "Can read, create, modify and delete HDInsight clusters, configuration, extensions, etc.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/APPLICATIONS/DELETE",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/APPLICATIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/APPLICATIONS/WRITE",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/AZUREASYNCOPERATIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/CONFIGURATIONS/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/CONFIGURATIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/DELETE",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/EXECUTESCRIPTACTIONS/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/EXTENSIONS/DELETE",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/EXTENSIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/EXTENSIONS/WRITE",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/GETGATEWAYSETTINGS/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/LISTHOSTS/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/OPERATIONRESULTS/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/PRIVATEENDPOINTCONNECTIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/PRIVATELINKRESOURCES/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/RESOLVEPRIVATELINKSERVICEID/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/RESTARTHOSTS/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/ROLES/AUTOSCALE/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/ROLES/RESIZE/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/SCRIPTACTIONS/DELETE",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/SCRIPTACTIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/SCRIPTEXECUTIONHISTORY/PROMOTE/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/SCRIPTEXECUTIONHISTORY/READ",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/UPDATEGATEWAYSETTINGS/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/CLUSTERS/WRITE",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/AVAILABLECLUSTERVERSIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/AZUREASYNCOPERATIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/BILLINGSPECS/READ",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/CAPABILITIES/READ",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/CHECKNAMEAVAILABILITY/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/OPERATIONRESULTS/READ",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/OPERATIONSTATUSES/READ",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/OPERATIONSTATUSES/WRITE",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/USAGES/READ",
|                                                    "MICROSOFT.HDINSIGHT/LOCATIONS/VALIDATECREATEREQUEST/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/OPERATIONS/READ",
|                                                    "MICROSOFT.HDINSIGHT/REGISTER/ACTION",
|                                                    "MICROSOFT.HDINSIGHT/RESOURCETYPES/READ",
|                                                    "MICROSOFT.HDINSIGHT/UNREGISTER/ACTION",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4aa368ec-fba9-4e93-81ed-396b3d461cc5",
|                                    "Name":  "Operator Nexus Compute Contributor Role (Preview)",
|                                    "Description":  "(Preview) Manage and configure Azure Operator Nexus infrastructure resources. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/classicAdministrators/operationstatuses/read",
|                                                    "Microsoft.Authorization/classicAdministrators/read",
|                                                    "Microsoft.Authorization/denyAssignments/read",
|                                                    "Microsoft.Authorization/diagnosticSettings/read",
|                                                    "Microsoft.Authorization/diagnosticSettingsCategories/read",
|                                                    "Microsoft.Authorization/locks/read",
|                                                    "Microsoft.Authorization/operations/read",
|                                                    "Microsoft.Authorization/permissions/read",
|                                                    "Microsoft.Authorization/policyAssignments/read",
|                                                    "Microsoft.Authorization/policyAssignments/privateLinkAssociations/read",
|                                                    "Microsoft.Authorization/policyAssignments/resourceManagementPrivateLinks/read",
|                                                    "Microsoft.Authorization/policyAssignments/resourceManagementPrivateLinks/privateEndpointConnectionProxies/read",
|                                                    "Microsoft.Authorization/policyAssignments/resourceManagementPrivateLinks/privateEndpointConnections/read",
|                                                    "Microsoft.Authorization/policyDefinitions/read",
|                                                    "Microsoft.Authorization/policyExemptions/read",
|                                                    "Microsoft.Authorization/policySetDefinitions/read",
|                                                    "Microsoft.Authorization/providerOperations/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleAssignmentScheduleInstances/read",
|                                                    "Microsoft.Authorization/roleAssignmentScheduleRequests/read",
|                                                    "Microsoft.Authorization/roleAssignmentSchedules/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read",
|                                                    "Microsoft.Authorization/roleEligibilityScheduleInstances/read",
|                                                    "Microsoft.Authorization/roleEligibilityScheduleRequests/read",
|                                                    "Microsoft.Authorization/roleEligibilitySchedules/read",
|                                                    "Microsoft.Authorization/roleManagementPolicies/read",
|                                                    "Microsoft.Authorization/roleManagementPolicyAssignments/read",
|                                                    "Microsoft.ExtendedLocation/customLocations/deploy/action",
|                                                    "Microsoft.ExtendedLocation/customLocations/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.Insights/alertRules/activated/action",
|                                                    "Microsoft.Insights/alertRules/delete",
|                                                    "Microsoft.Insights/alertRules/incidents/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Insights/alertRules/resolved/action",
|                                                    "Microsoft.Insights/alertRules/throttled/action",
|                                                    "Microsoft.Insights/alertRules/write",
|                                                    "Microsoft.Kubernetes/connectedClusters/read",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read",
|                                                    "Microsoft.ManagedNetworkFabric/networkFabricControllers/join/action",
|                                                    "Microsoft.ManagedNetworkFabric/networkFabrics/join/action",
|                                                    "Microsoft.ManagedNetworkFabric/networkRacks/join/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/cordon/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/delete",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/powerOff/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/read",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/reimage/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/replace/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/restart/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/runDataExtracts/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/runReadCommands/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/start/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/uncordon/action",
|                                                    "Microsoft.NetworkCloud/bareMetalMachines/write",
|                                                    "Microsoft.NetworkCloud/clusterManagers/delete",
|                                                    "Microsoft.NetworkCloud/clusterManagers/read",
|                                                    "Microsoft.NetworkCloud/clusterManagers/write",
|                                                    "Microsoft.NetworkCloud/clusters/bareMetalMachineKeySets/read",
|                                                    "Microsoft.NetworkCloud/clusters/bmcKeySets/read",
|                                                    "Microsoft.NetworkCloud/clusters/continueUpdateVersion/action",
|                                                    "Microsoft.NetworkCloud/clusters/delete",
|                                                    "Microsoft.NetworkCloud/clusters/deploy/action",
|                                                    "Microsoft.NetworkCloud/clusters/metricsConfigurations/delete",
|                                                    "Microsoft.NetworkCloud/clusters/metricsConfigurations/read",
|                                                    "Microsoft.NetworkCloud/clusters/metricsConfigurations/write",
|                                                    "Microsoft.NetworkCloud/clusters/read",
|                                                    "Microsoft.NetworkCloud/clusters/scanRuntime/action",
|                                                    "Microsoft.NetworkCloud/clusters/updateVersion/action",
|                                                    "Microsoft.NetworkCloud/clusters/write",
|                                                    "Microsoft.NetworkCloud/locations/operationStatuses/read",
|                                                    "Microsoft.NetworkCloud/operations/read",
|                                                    "Microsoft.NetworkCloud/rackSkus/read",
|                                                    "Microsoft.NetworkCloud/racks/delete",
|                                                    "Microsoft.NetworkCloud/racks/join/action",
|                                                    "Microsoft.NetworkCloud/racks/read",
|                                                    "Microsoft.NetworkCloud/racks/write",
|                                                    "Microsoft.NetworkCloud/register/action",
|                                                    "Microsoft.NetworkCloud/registeredSubscriptions/read",
|                                                    "Microsoft.NetworkCloud/storageAppliances/read",
|                                                    "Microsoft.NetworkCloud/unregister/action",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d977122-f97e-4b4d-a52f-6b43003ddb4d",
|                                    "Name":  "Azure Container Instances Contributor Role",
|                                    "Description":  "Grants read/write access to container groups provided by Azure Container Instances",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerInstance/containerGroups/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6cdbb904-5ff3-429d-8169-7d7818b91bd8",
|                                    "Name":  "Connector Reader",
|                                    "Description":  "Read connectors and their associated resources, such as impacts and insights.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Impact/Connectors/Read",
|                                                    "Microsoft.Impact/WorkloadImpacts/Read",
|                                                    "Microsoft.Impact/WorkloadImpacts/Insights/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8ad4d0ee-9bfb-49e8-93fc-01abb8db6240",
|                                    "Name":  "Transparency Logs Owner",
|                                    "Description":  "Grants full access to manage Transparency Log resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Sovereign/transparencyLogs/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "41e04612-9dac-4699-a02b-c82ff2cc3fb5",
|                                    "Name":  "Grafana Limited Viewer",
|                                    "Description":  "View home page.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Dashboard/grafana/ActAsGrafanaLimitedViewer/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "136d308c-0937-4a49-9bd7-edfb42adbffc",
|                                    "Name":  "Disk Encryption Set Operator for Managed Disks",
|                                    "Description":  "Provides permissions to read, write or delete disk encryption sets which are used for encrypting managed disks with customer managed keys",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/diskEncryptionSets/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1af232de-e806-426f-8ca1-c36142449755",
|                                    "Name":  "Bayer Ag Powered Services Field Imagery Solution Service Role",
|                                    "Description":  "Provide access to Field Imagery Solution by Bayer Ag Powered Services",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/read",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/fields/write",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insights/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/parties/models/resourceTypes/resources/insightAttachments/*",
|                                                        "Microsoft.AgFoodPlatform/farmBeats/scenes/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9295f069-25d0-4f44-bb6a-3da70d11aa00",
|                                    "Name":  "Azure Edge Hardware Center Administrator",
|                                    "Description":  "Grants you access to take actions as an edge order administrator",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EdgeOrder/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b78c5d69-af96-48a3-bf8d-a8b4d589de94",
|                                    "Name":  "Azure AI Administrator",
|                                    "Description":  "A Built-In Role that has all control plane permissions to work with Azure AI and its dependencies.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.CognitiveServices/*",
|                                                    "Microsoft.ContainerRegistry/registries/*",
|                                                    "Microsoft.DocumentDb/databaseAccounts/*",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/providers/features/register/action",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/components/*",
|                                                    "Microsoft.Insights/diagnosticSettings/*",
|                                                    "Microsoft.Insights/generateLiveToken/read",
|                                                    "Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.Insights/metricAlerts/*",
|                                                    "Microsoft.Insights/metricdefinitions/read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.Insights/scheduledqueryrules/*",
|                                                    "Microsoft.Insights/topology/read",
|                                                    "Microsoft.Insights/transactions/read",
|                                                    "Microsoft.Insights/webtests/*",
|                                                    "Microsoft.KeyVault/*",
|                                                    "Microsoft.MachineLearningServices/workspaces/*",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Storage/storageAccounts/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Search/searchServices/write",
|                                                    "Microsoft.Search/searchServices/read",
|                                                    "Microsoft.Search/searchServices/delete",
|                                                    "Microsoft.Search/searchServices/indexes/*",
|                                                    "Microsoft.Search/searchServices/listAdminKeys/action",
|                                                    "Microsoft.Search/searchServices/privateEndpointConnections/*",
|                                                    "Microsoft.DataFactory/factories/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cf7c76d2-98a3-4358-a134-615aa78bf44d",
|                                    "Name":  "Compute Gallery Image Reader",
|                                    "Description":  "This is the role for reading gallery images.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/galleries/images/read",
|                                                    "Microsoft.Compute/galleries/images/versions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "edd66693-d32a-450b-997d-0158c03976b0",
|                                    "Name":  "Container Apps Jobs Reader",
|                                    "Description":  "Read access to ContainerApps jobs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "microsoft.app/jobs/read",
|                                                    "Microsoft.App/jobs/*/read",
|                                                    "Microsoft.App/managedenvironments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "358470bc-b998-42bd-ab17-a7e34c199c0f",
|                                    "Name":  "Container Apps Contributor",
|                                    "Description":  "Full management of Container Apps, including creation, deletion, and updates.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/containerApps/*/read",
|                                                    "Microsoft.App/containerApps/*/write",
|                                                    "Microsoft.App/containerApps/*/delete",
|                                                    "Microsoft.App/containerApps/*/action",
|                                                    "Microsoft.App/managedEnvironments/read",
|                                                    "Microsoft.App/managedEnvironments/*/read",
|                                                    "Microsoft.App/managedEnvironments/join/action",
|                                                    "Microsoft.App/managedEnvironments/checknameavailability/action",
|                                                    "Microsoft.App/connectedEnvironments/read",
|                                                    "Microsoft.App/connectedEnvironments/*/read",
|                                                    "Microsoft.App/connectedEnvironments/join/action",
|                                                    "Microsoft.App/connectedEnvironments/checknameavailability/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f3bd1b5c-91fa-40e7-afe7-0c11d331232c",
|                                    "Name":  "Container Apps Operator",
|                                    "Description":  "Read, logstream and exec into Container Apps.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/containerApps/*/read",
|                                                    "Microsoft.App/containerApps/*/action",
|                                                    "Microsoft.App/managedEnvironments/read",
|                                                    "Microsoft.App/managedEnvironments/*/read",
|                                                    "Microsoft.App/managedEnvironments/join/action",
|                                                    "Microsoft.App/managedEnvironments/checknameavailability/action",
|                                                    "Microsoft.App/connectedEnvironments/read",
|                                                    "Microsoft.App/connectedEnvironments/*/read",
|                                                    "Microsoft.App/connectedEnvironments/join/action",
|                                                    "Microsoft.App/connectedEnvironments/checknameavailability/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.App/containerApps/logstream/action",
|                                                        "Microsoft.App/containerApps/exec/action",
|                                                        "Microsoft.App/containerApps/debug/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "af61e8fc-2633-4b95-bed3-421ad6826515",
|                                    "Name":  "Container Apps SessionPools Reader",
|                                    "Description":  "Read access to ContainerApps sessionpools.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/sessionPools/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f7669afb-68b2-44b4-9c5f-6d2a47fddda0",
|                                    "Name":  "Container Apps SessionPools Contributor",
|                                    "Description":  "Full management of Container Apps SessionPools, including creation, deletion, and updates.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/sessionPools/*/read",
|                                                    "Microsoft.App/sessionPools/*/write",
|                                                    "Microsoft.App/sessionPools/*/delete",
|                                                    "Microsoft.App/sessionPools/*/action",
|                                                    "microsoft.App/managedEnvironments/read",
|                                                    "Microsoft.App/managedEnvironments/*/read",
|                                                    "Microsoft.App/managedEnvironments/join/action",
|                                                    "Microsoft.App/managedEnvironments/checknameavailability/action",
|                                                    "microsoft.App/connectedEnvironments/read",
|                                                    "Microsoft.App/connectedEnvironments/*/read",
|                                                    "Microsoft.App/connectedEnvironments/join/action",
|                                                    "Microsoft.App/connectedEnvironments/checknameavailability/action",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.App/sessionPools/fetchMcpServerCredentials/action",
|                                                       "Microsoft.App/sessionPools/rotateMcpServerCredentials/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "57cc5028-e6a7-4284-868d-0611c5923f8d",
|                                    "Name":  "Container Apps ManagedEnvironments Contributor",
|                                    "Description":  "Full management of Container Apps ManagedEnvironments, including creation, deletion, and updates.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/managedEnvironments/*/read",
|                                                    "Microsoft.App/managedEnvironments/*/write",
|                                                    "Microsoft.App/managedEnvironments/*/delete",
|                                                    "Microsoft.App/managedEnvironments/*/action",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1b32c00b-7eff-4c22-93e6-93d11d72d2d8",
|                                    "Name":  "Container Apps ManagedEnvironments Reader",
|                                    "Description":  "Read access to ContainerApps managedenvironments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/managedEnvironments/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4e3d2b60-56ae-4dc6-a233-09c8e5a82e68",
|                                    "Name":  "Container Apps Jobs Contributor",
|                                    "Description":  "Full management of Container Apps jobs, including creation, deletion, and updates.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "microsoft.app/jobs/read",
|                                                    "Microsoft.App/jobs/*/read",
|                                                    "Microsoft.App/jobs/*/action",
|                                                    "Microsoft.App/jobs/write",
|                                                    "Microsoft.App/jobs/delete",
|                                                    "Microsoft.app/managedenvironments/read",
|                                                    "Microsoft.App/managedenvironments/*/read",
|                                                    "Microsoft.App/managedenvironments/join/action",
|                                                    "Microsoft.App/managedenvironments/checknameavailability/action",
|                                                    "Microsoft.app/connectedEnvironments/read",
|                                                    "Microsoft.App/connectedEnvironments/*/read",
|                                                    "Microsoft.App/connectedEnvironments/join/action",
|                                                    "Microsoft.App/connectedEnvironments/checknameavailability/action",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0ad04412-c4d5-4796-b79c-f76d14c8d402",
|                                    "Name":  "Durable Task Data Contributor",
|                                    "Description":  "Durable Task role for all data access operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DurableTask/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1a5682fc-4f12-4b25-927e-e8cfed0c539e",
|                                    "Name":  "KubernetesRuntime Load Balancer Contributor Role",
|                                    "Description":  "Read, write, and delete load balancers in an Arc connected Kubernetes cluster",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.KubernetesRuntime/loadBalancers/read",
|                                                    "Microsoft.KubernetesRuntime/loadBalancers/write",
|                                                    "Microsoft.KubernetesRuntime/loadBalancers/delete",
|                                                    "Microsoft.KubernetesRuntime/bgpPeers/read",
|                                                    "Microsoft.KubernetesRuntime/bgpPeers/write",
|                                                    "Microsoft.KubernetesRuntime/bgpPeers/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.KubernetesRuntime/locations/operationStatuses/write",
|                                                    "Microsoft.KubernetesRuntime/services/write",
|                                                    "Microsoft.KubernetesRuntime/services/delete",
|                                                    "Microsoft.KubernetesRuntime/bfdProfiles/write",
|                                                    "Microsoft.KubernetesRuntime/bfdProfiles/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d715fb95-a0f0-4f1c-8be6-5ad2d2767f67",
|                                    "Name":  "AVS Orchestrator Role",
|                                    "Description":  "Do not remove this role from your resource group because it is critical to enable your AVS private cloud to operate. If the role is removed, it will cause your AVS private cloud control plane to no longer operate correctly. The role is used to enable the AVS private cloud control plane to create the supporting resources in the resource group of the private clouds attached virtual network and bind them to the attached virtual network. This role is not intended for use cases outside of assignment to the associated AVS identity in your entra-id tenant.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/operationStatuses/read",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Network/virtualHubs/delete",
|                                                    "Microsoft.Network/publicIPAddresses/delete",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/delete",
|                                                    "Microsoft.Network/virtualNetworks/subnets/delete",
|                                                    "Microsoft.Network/networkIntentPolicies/read",
|                                                    "Microsoft.Network/networkIntentPolicies/delete",
|                                                    "Microsoft.Network/networkIntentPolicies/write",
|                                                    "Microsoft.Network/networkSecurityGroups/delete",
|                                                    "Microsoft.Network/networkSecurityGroups/write",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/write",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/delete",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/delete",
|                                                    "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action",
|                                                    "Microsoft.Network/virtualHubs/write",
|                                                    "Microsoft.Network/publicIPAddresses/write",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/virtualHubs/ipConfigurations/write",
|                                                    "Microsoft.Network/networkSecurityGroups/securityRules/read",
|                                                    "Microsoft.Network/virtualHubs/ipConfigurations/read",
|                                                    "Microsoft.Network/virtualHubs/bgpConnections/write",
|                                                    "Microsoft.Network/virtualHubs/bgpConnections/read",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete",
|                                                    "Microsoft.Network/virtualNetworks/peer/action",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Network/locations/operationResults/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/routeTables/read",
|                                                    "Microsoft.Network/routeTables/write",
|                                                    "Microsoft.Network/routeTables/delete",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/routeTables/routes/read",
|                                                    "Microsoft.Network/routeTables/routes/write",
|                                                    "Microsoft.Network/routeTables/routes/delete",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "db7003cd-07a9-490c-bfa5-23e40314f8d7",
|                                    "Name":  "Service Connector Contributor",
|                                    "Description":  "Can Manage Service Connector.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ServiceLinker/linkers/read",
|                                                    "Microsoft.ServiceLinker/linkers/delete",
|                                                    "Microsoft.ServiceLinker/linkers/write",
|                                                    "Microsoft.ServiceLinker/linkers/listConfigurations/action",
|                                                    "Microsoft.ServiceLinker/linkers/validateLinker/action",
|                                                    "Microsoft.ServiceLinker/dryruns/delete",
|                                                    "Microsoft.ServiceLinker/dryruns/write",
|                                                    "Microsoft.ServiceLinker/linkers/generateConfigurations/action",
|                                                    "Microsoft.ServiceLinker/locations/connectors/delete",
|                                                    "Microsoft.ServiceLinker/locations/connectors/generateConfigurations/action",
|                                                    "Microsoft.ServiceLinker/locations/connectors/validate/action",
|                                                    "Microsoft.ServiceLinker/locations/connectors/write",
|                                                    "Microsoft.ServiceLinker/locations/dryruns/delete",
|                                                    "Microsoft.ServiceLinker/locations/dryruns/write",
|                                                    "Microsoft.ServiceLinker/locations/operationStatuses/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2a740172-0fc2-4039-972c-b31864cd47d6",
|                                    "Name":  "Azure Device Update Agent",
|                                    "Description":  "Provide full access to all Azure Device Update agent operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DeviceUpdate/updateAccounts/agents/requestUpdate/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2142ea27-02ad-4094-bfea-2dbac6d24934",
|                                    "Name":  "Enclave Approver Role",
|                                    "Description":  "Read all resources in Azure Virtual Enclaves and Approve approval requests within the Enclave",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Mission/Operations/read",
|                                                    "Microsoft.Mission/communities/read",
|                                                    "Microsoft.Mission/virtualEnclaves/read",
|                                                    "Microsoft.Mission/virtualEnclaves/endpoints/read",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Mission/communities/communityEndpoints/read",
|                                                    "Microsoft.Mission/communities/transitHubs/read",
|                                                    "Microsoft.Mission/enclaveConnections/read",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/read",
|                                                    "Microsoft.Mission/approvals/read",
|                                                    "Microsoft.Mission/approvals/write",
|                                                    "Microsoft.Mission/enclaveConnections/approvalCallback/action",
|                                                    "Microsoft.Mission/virtualEnclaves/approvalCallback/action",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/approvalCallback/action",
|                                                    "Microsoft.Mission/communities/communityEndpoints/approvalCallback/action",
|                                                    "Microsoft.Mission/approvals/initiatorCallback/action",
|                                                    "Microsoft.Mission/communities/setMaintenanceMode/action",
|                                                    "Microsoft.Mission/communities/communityendpoints/connect/action",
|                                                    "Microsoft.Mission/virtualEnclaves/setWorkloadRoleAssignments/action",
|                                                    "Microsoft.Mission/virtualEnclaves/setEnclaveRoleAssignments/action",
|                                                    "Microsoft.Mission/virtualEnclaves/setSubnetConfiguration/action",
|                                                    "Microsoft.Mission/virtualEnclaves/enclaveEndpoints/connect/action",
|                                                    "Microsoft.Mission/enclaveConnections/setSourceCidr/action",
|                                                    "Microsoft.Mission/virtualenclaves/setMaintenanceMode/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a68e7c17-0ab2-4c09-9a58-125dae29748c",
|                                    "Name":  "Key Vault Purge Operator",
|                                    "Description":  "Allows permanent deletion of soft-deleted vaults.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.KeyVault/deletedVaults/read",
|                                                    "Microsoft.KeyVault/locations/deletedVaults/read",
|                                                    "Microsoft.KeyVault/locations/deletedVaults/purge/action",
|                                                    "Microsoft.KeyVault/locations/operationResults/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b5b0c71d-aca9-4081-aee2-9b1bb335fc1a",
|                                    "Name":  "Cognitive Services Face Contributor",
|                                    "Description":  "Full access to perform all Face APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleDefinitions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/Face/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b9a307c4-5aa3-4b52-ba60-2b17c136cd7b",
|                                    "Name":  "Container Apps Jobs Operator",
|                                    "Description":  "Read, start, and stop Container Apps jobs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "microsoft.app/jobs/read",
|                                                    "Microsoft.App/jobs/*/read",
|                                                    "Microsoft.App/jobs/*/action",
|                                                    "Microsoft.app/managedenvironments/read",
|                                                    "Microsoft.App/managedenvironments/*/read",
|                                                    "Microsoft.App/managedenvironments/join/action",
|                                                    "Microsoft.App/managedenvironments/checknameavailability/action",
|                                                    "Microsoft.app/connectedEnvironments/read",
|                                                    "Microsoft.App/connectedEnvironments/*/read",
|                                                    "Microsoft.App/connectedEnvironments/join/action",
|                                                    "Microsoft.App/connectedEnvironments/checknameavailability/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.App/jobs/logstream/action",
|                                                        "Microsoft.App/jobs/exec/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "77be276d-fb44-4f3b-beb5-9bf03c4cd2d3",
|                                    "Name":  "Operator Nexus Owner (Preview)",
|                                    "Description":  "(Preview) This role allows full access to Azure Operator Nexus Network Cloud resources. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.NetworkCloud/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4e9d0bd4-5aab-4f91-92df-9def33fe287c",
|                                    "Name":  "CloudTest Contributor Role",
|                                    "Description":  "Read, write, delete and perform actions on CloudTest Accounts, CloudTest Pools, 1ES Hosted Pools, 1ES Build Caches and 1ES Images.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CloudTest/*/read",
|                                                    "Microsoft.CloudTest/hostedpools/write",
|                                                    "Microsoft.CloudTest/hostedpools/delete",
|                                                    "Microsoft.CloudTest/images/write",
|                                                    "Microsoft.CloudTest/images/delete",
|                                                    "Microsoft.CloudTest/images/cancel/action",
|                                                    "Microsoft.CloudTest/images/refresh/action",
|                                                    "Microsoft.CloudTest/pools/write",
|                                                    "Microsoft.CloudTest/pools/delete",
|                                                    "Microsoft.CloudTest/accounts/write",
|                                                    "Microsoft.CloudTest/accounts/delete",
|                                                    "Microsoft.CloudTest/buildcaches/write",
|                                                    "Microsoft.CloudTest/buildcaches/delete",
|                                                    "Microsoft.CloudTest/pools/leases/action",
|                                                    "Microsoft.CloudTest/pools/leases/complete/action",
|                                                    "Microsoft.CloudTest/pools/leases/extend/action",
|                                                    "Microsoft.CloudTest/hostedpools/leases/action",
|                                                    "Microsoft.CloudTest/hostedpools/leases/complete/action",
|                                                    "Microsoft.CloudTest/hostedpools/leases/extend/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8d6517c1-e434-405c-9f3f-e0ae65085d76",
|                                    "Name":  "Azure Automanage Contributor",
|                                    "Description":  "Azure Automanage Contributor",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Automanage/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9fc6112f-f48e-4e27-8b09-72a5c94e4ae9",
|                                    "Name":  "Azure Bot Service Contributor Role",
|                                    "Description":  "To perform actions on the bots by copilot studio platform and extensibility team",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.BotService/listAuthServiceProviders/action",
|                                                    "Microsoft.BotService/listauthserviceproviders/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.BotService/botServices/read",
|                                                    "Microsoft.BotService/botServices/write",
|                                                    "Microsoft.BotService/botServices/delete",
|                                                    "Microsoft.BotService/botServices/channels/write",
|                                                    "Microsoft.BotService/botServices/channels/read",
|                                                    "Microsoft.BotService/botServices/channels/listchannelwithkeys/action",
|                                                    "Microsoft.BotService/botServices/channels/delete",
|                                                    "Microsoft.BotService/botServices/channels/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.BotService/botServices/connections/read",
|                                                    "Microsoft.BotService/botServices/connections/write",
|                                                    "Microsoft.BotService/botServices/connections/delete",
|                                                    "Microsoft.BotService/botServices/connections/listwithsecrets/write",
|                                                    "Microsoft.BotService/botServices/connections/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.BotService/botServices/createemailsigninurl/action",
|                                                    "Microsoft.BotService/botServices/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.BotService/botServices/joinPerimeter/action",
|                                                    "Microsoft.BotService/botServices/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.BotService/checknameavailability/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.BotService/hostsettings/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.BotService/botServices/privateEndpointConnectionProxies/write",
|                                                    "Microsoft.BotService/botServices/privateEndpointConnectionProxies/delete",
|                                                    "Microsoft.BotService/botServices/privateEndpointConnectionProxies/validate/action",
|                                                    "Microsoft.BotService/botServices/privateEndpointConnections/write",
|                                                    "Microsoft.BotService/botServices/privateEndpointConnections/delete",
|                                                    "Microsoft.BotService/listqnamakerendpointkeys/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.BotService/botServices/networkSecurityPerimeterConfigurations/reconcile/action",
|                                                    "Microsoft.BotService/botServices/networkSecurityPerimeterAssociationProxies/write",
|                                                    "Microsoft.BotService/botServices/networkSecurityPerimeterAssociationProxies/delete",
|                                                    "Microsoft.BotService/locations/notifyNetworkSecurityPerimeterUpdatesAvailable/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.BotService/botServices/channels/regeneratekeys/action",
|                                                    "Microsoft.BotService/botServices/Connections/listWithSecrets/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "175b81b9-6e0d-490a-85e4-0d422273c10c",
|                                    "Name":  "App Configuration Reader",
|                                    "Description":  "Grants permission for read operations for App Configuration resources. This role does not grant access to data plane resources such as key-values, snapshots, and feature flags.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppConfiguration/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fe86443c-f201-4fc4-9d2a-ac61149fbda0",
|                                    "Name":  "App Configuration Contributor",
|                                    "Description":  "Grants permission for all management operations, except purge, for App Configuration resources. This role does not grant access to data plane resources such as key-values, snapshots, and feature flags.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppConfiguration/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.AppConfiguration/locations/deletedConfigurationStores/purge/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "83f80186-3729-438c-ad2d-39e94d718838",
|                                    "Name":  "Service Fabric Managed Cluster Contributor",
|                                    "Description":  "Deploy and manage your Service Fabric Managed Cluster resources. Includes managed clusters, node types, application types, application type versions, applications, and services.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ServiceFabric/managedclusters/*",
|                                                    "Microsoft.ServiceFabric/operations/read",
|                                                    "Microsoft.ServiceFabric/locations/clusterVersions/read",
|                                                    "Microsoft.ServiceFabric/locations/environments/clusterVersions/read",
|                                                    "Microsoft.ServiceFabric/locations/operationresults/read",
|                                                    "Microsoft.ServiceFabric/locations/operations/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "577a9874-89fd-4f24-9dbd-b5034d0ad23a",
|                                    "Name":  "Container Registry Data Importer and Data Reader",
|                                    "Description":  "Provides the ability to import images into a registry through the registry import operation. Provides the ability to list repositories, view images and tags, get manifests, and pull images. Does not provide permissions for importing images through configuring registry transfer pipelines such as import and export pipelines. Does not provide permissions for importing through configuring Artifact Cache or Sync rules.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/importImage/action",
|                                                    "Microsoft.ContainerRegistry/registries/read",
|                                                    "Microsoft.ContainerRegistry/registries/pull/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                        "Microsoft.ContainerRegistry/registries/catalog/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a35466a1-cfd6-450a-b35e-683fcdf30363",
|                                    "Name":  "Azure Batch Service Orchestration Role",
|                                    "Description":  "Grants the required permissions to Azure Batch Resource Provider to manage compute and other backing resources in the subscription.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Security/assessments/read",
|                                                    "Microsoft.AzureFleet/fleets/write",
|                                                    "Microsoft.AzureFleet/fleets/read",
|                                                    "Microsoft.AzureFleet/fleets/delete",
|                                                    "Microsoft.Compute/locations/DiskOperations/read",
|                                                    "Microsoft.Compute/locations/operations/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/approveRollingUpgrade/action",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/deallocate/action",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/delete",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/delete/action",
|                                                    "Microsoft.Compute/VirtualMachineScaleSets/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/reimage/action",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/reimageall/action",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/restart/action",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/start/action",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/write",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/extensions/read",
|                                                    "microsoft.Compute/virtualMachineScaleSets/networkInterfaces/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachineScaleSets/virtualmachines/restart/action",
|                                                    "Microsoft.Compute/diskEncryptionSets/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/dataCollectionRuleAssociations/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Insights/diagnosticSettings/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/resources/read",
|                                                    "Microsoft.Network/networkWatchers/read",
|                                                    "Microsoft.Network/virtualNetworks/delete",
|                                                    "Microsoft.Network/virtualNetworks/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8c87871d-6201-42da-abb1-1c0c985ff71c",
|                                    "Name":  "Microsoft PowerBI Tenant Operations Role",
|                                    "Description":  "Allows management of tenant operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.PowerBI/tenants/workspaces/read",
|                                                    "Microsoft.PowerBI/tenants/workspaces/delete",
|                                                    "Microsoft.PowerBI/tenants/read",
|                                                    "Microsoft.PowerBI/tenants/delete",
|                                                    "Microsoft.PowerBI/tenants/write",
|                                                    "Microsoft.PowerBI/tenants/workspaces/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b6efc156-f0da-4e90-a50a-8c000140b017",
|                                    "Name":  "Service Fabric Cluster Contributor",
|                                    "Description":  "Manage your Service Fabric Cluster resources. Includes clusters, application types, application type versions, applications, and services. You will need additional permissions to deploy and manage the cluster\u0027s underlying resources such as virtual machine scale sets, storage accounts, networks, etc.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ServiceFabric/clusters/*",
|                                                    "Microsoft.ServiceFabric/operations/read",
|                                                    "Microsoft.ServiceFabric/locations/clusterVersions/read",
|                                                    "Microsoft.ServiceFabric/locations/environments/clusterVersions/read",
|                                                    "Microsoft.ServiceFabric/locations/operationresults/read",
|                                                    "Microsoft.ServiceFabric/locations/operations/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6e0c8711-85a0-4490-8365-8ec13c4560b4",
|                                    "Name":  "Stream Analytics Contributor",
|                                    "Description":  "Contributor access to Clusters and Streaming Jobs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.StreamAnalytics/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1dfc38e8-6ce7-447f-807c-029c65262c5f",
|                                    "Name":  "Stream Analytics Reader",
|                                    "Description":  "Read-only access to Clusters and Streaming Jobs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.StreamAnalytics/streamingjobs/Read",
|                                                    "Microsoft.StreamAnalytics/streamingjobs/*/Read",
|                                                    "Microsoft.StreamAnalytics/clusters/Read",
|                                                    "Microsoft.StreamAnalytics/clusters/*/Read",
|                                                    "Microsoft.StreamAnalytics/clusters/ListStreamingJobs/action",
|                                                    "Microsoft.StreamAnalytics/locations/*/Read",
|                                                    "Microsoft.StreamAnalytics/operations/Read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "80d0d6b0-f522-40a4-8886-a5a11720c375",
|                                    "Name":  "Durable Task Worker",
|                                    "Description":  "Used by worker applications to interact with the Durable Task service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DurableTask/schedulers/taskhubs/orchestrations/execute/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "78eacb5e-e318-4560-85a9-e6a724ca60c9",
|                                    "Name":  "Portal Dashboard Writer Role",
|                                    "Description":  "Can write an Azure Portal Dashboard",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Portal/dashboards/read",
|                                                    "Microsoft.Portal/dashboards/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "21bffb94-04c0-4ed0-b676-68bb926e832b",
|                                    "Name":  "Microsoft.Windows365.CloudPcDelegatedMsis Writer User",
|                                    "Description":  "Built in role to perform Write operations on CloudPcDelegatedMsis resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Windows365/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bf2b6809-e9a5-4aea-a6e1-40a9dc8c43a7",
|                                    "Name":  "Landing Zone Account Owner",
|                                    "Description":  "Microsoft.Sovereign Landing Zone Account Owner allowing to review and modify Landing Zone Account, Landing Zone Configurations, as well as reading and adding Landing Zone Registrations. Also enables read-access to policies and management groups for enabling the full user experience of the Sovereign Services RP in the Azure Portal (as otherwise some elements might not be accessible to end users).",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Sovereign/landingZoneAccounts/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2718b1f7-eb07-424e-8868-0137541392a1",
|                                    "Name":  "Landing Zone Account Reader",
|                                    "Description":  "Microsoft.Sovereign Landing Zone Account Reader allowing to read Landing Zone Account, Landing Zone Configurations and Landing Zone Registrations. Also enables read-access to policies and management groups for enabling the full user experience of the Sovereign Services RP in the Azure Portal (as otherwise some elements might not be accessible to end users).",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Sovereign/landingZoneAccounts/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0b6ca2e8-2cdc-4bd6-b896-aa3d8c21fc35",
|                                    "Name":  "Defender Sensitive Data Discovery",
|                                    "Description":  "Grants permissions for Microsoft Defender for Cloud Sensitive Data Discovery plan features",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Security/defenderforstoragesettings/read",
|                                                    "Microsoft.Security/defenderforstoragesettings/write",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Security/securityOperators/read",
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "11076f67-66f6-4be0-8f6b-f0609fd05cc9",
|                                    "Name":  "Azure Batch Account Reader",
|                                    "Description":  "Lets you view all resources including pools and jobs in the Batch account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Batch/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Batch/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "29fe4964-1e60-436b-bd3a-77fd4c178b3c",
|                                    "Name":  "Azure Batch Account Contributor",
|                                    "Description":  "Grants full access to manage all Batch resources, including Batch accounts, pools and jobs.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Batch/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Batch/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "48e5e92e-a480-4e71-aa9c-2778f4c13781",
|                                    "Name":  "Azure Batch Job Submitter",
|                                    "Description":  "Lets you submit and manage jobs in the Batch account.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Batch/batchAccounts/applications/read",
|                                                    "Microsoft.Batch/batchAccounts/applications/versions/read",
|                                                    "Microsoft.Batch/batchAccounts/pools/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Batch/batchAccounts/jobSchedules/*",
|                                                        "Microsoft.Batch/batchAccounts/jobs/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6aaa78f1-f7de-44ca-8722-c64a23943cae",
|                                    "Name":  "Azure Batch Data Contributor",
|                                    "Description":  "Grants permissions to manage Batch pools and jobs but not to modify accounts.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Batch/batchAccounts/read",
|                                                    "Microsoft.Batch/batchAccounts/applications/*",
|                                                    "Microsoft.Batch/batchAccounts/certificates/*",
|                                                    "Microsoft.Batch/batchAccounts/certificateOperationResults/*",
|                                                    "Microsoft.Batch/batchAccounts/pools/*",
|                                                    "Microsoft.Batch/batchAccounts/poolOperationResults/*",
|                                                    "Microsoft.Batch/locations/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Batch/batchAccounts/jobSchedules/*",
|                                                        "Microsoft.Batch/batchAccounts/jobs/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5c2d7e57-b7c2-4d8a-be4f-82afa42c6e95",
|                                    "Name":  "Azure Managed Grafana Workspace Contributor",
|                                    "Description":  "Can manage Azure Managed Grafana resources, without providing access to the workspaces themselves.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Dashboard/grafana/write",
|                                                    "Microsoft.Dashboard/grafana/delete",
|                                                    "Microsoft.Dashboard/grafana/PrivateEndpointConnectionsApproval/action",
|                                                    "Microsoft.Dashboard/grafana/managedPrivateEndpoints/action",
|                                                    "Microsoft.Dashboard/locations/operationStatuses/write",
|                                                    "Microsoft.Dashboard/grafana/privateEndpointConnectionProxies/validate/action",
|                                                    "Microsoft.Dashboard/grafana/privateEndpointConnectionProxies/write",
|                                                    "Microsoft.Dashboard/grafana/privateEndpointConnectionProxies/delete",
|                                                    "Microsoft.Dashboard/grafana/privateEndpointConnections/write",
|                                                    "Microsoft.Dashboard/grafana/privateEndpointConnections/delete",
|                                                    "Microsoft.Dashboard/grafana/managedPrivateEndpoints/write",
|                                                    "Microsoft.Dashboard/grafana/managedPrivateEndpoints/delete",
|                                                    "Microsoft.Dashboard/grafana/integrationFabrics/write",
|                                                    "Microsoft.Dashboard/grafana/integrationFabrics/delete",
|                                                    "Microsoft.Dashboard/grafana/grafanaDefinitions/read",
|                                                    "Microsoft.Dashboard/grafana/grafanaDefinitions/write",
|                                                    "Microsoft.Dashboard/grafana/grafanaDefinitions/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d5adeb5b-107f-4aca-99ea-4e3f4fc008d5",
|                                    "Name":  "Container Apps ConnectedEnvironments Reader",
|                                    "Description":  "Read access to Container Apps ConnectedEnvironments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.App/connectedEnvironments/read",
|                                                    "Microsoft.App/connectedEnvironments/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "19c28022-e58e-450d-a464-0b2a53034789",
|                                    "Name":  "Cognitive Services Data Contributor (Preview)",
|                                    "Description":  "Allows to call data plane APIs, but not any control plane APIs for Microsoft Cognitive Services. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bd80684d-2f5f-4130-892a-0955546282de",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Cluster Reader",
|                                    "Description":  "Grants read-only access to most Kubernetes cluster-scoped resources in the fleet-managed hub cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/fleets/read",
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/apiextensions.k8s.io/customresourcedefinitions/read",
|                                                        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/fleets/apps/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/apps/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/apps/statefulsets/read",
|                                                        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
|                                                        "Microsoft.ContainerService/fleets/batch/cronjobs/read",
|                                                        "Microsoft.ContainerService/fleets/batch/jobs/read",
|                                                        "Microsoft.ContainerService/fleets/configmaps/read",
|                                                        "Microsoft.ContainerService/fleets/endpoints/read",
|                                                        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/fleets/events/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/limitranges/read",
|                                                        "Microsoft.ContainerService/fleets/namespaces/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/nodes/read",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumes/read",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
|                                                        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                        "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                        "Microsoft.ContainerService/fleets/serviceaccounts/read",
|                                                        "Microsoft.ContainerService/fleets/services/read",
|                                                        "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/memberclusters/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceplacements/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourcebindings/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourcesnapshots/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterschedulingpolicysnapshots/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverrides/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverridesnapshots/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1dc4cd5a-de51-4ee4-bc8e-b40e9c17e320",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Cluster Writer",
|                                    "Description":  "Grants read/write access to most Kubernetes cluster-scoped resources in the fleet-managed hub cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/fleets/read",
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/apiextensions.k8s.io/customresourcedefinitions/read",
|                                                        "Microsoft.ContainerService/fleets/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/fleets/apps/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/apps/daemonsets/write",
|                                                        "Microsoft.ContainerService/fleets/apps/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/apps/deployments/write",
|                                                        "Microsoft.ContainerService/fleets/apps/statefulsets/read",
|                                                        "Microsoft.ContainerService/fleets/apps/statefulsets/write",
|                                                        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/read",
|                                                        "Microsoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/write",
|                                                        "Microsoft.ContainerService/fleets/batch/cronjobs/read",
|                                                        "Microsoft.ContainerService/fleets/batch/cronjobs/write",
|                                                        "Microsoft.ContainerService/fleets/batch/jobs/read",
|                                                        "Microsoft.ContainerService/fleets/batch/jobs/write",
|                                                        "Microsoft.ContainerService/fleets/configmaps/read",
|                                                        "Microsoft.ContainerService/fleets/configmaps/write",
|                                                        "Microsoft.ContainerService/fleets/endpoints/read",
|                                                        "Microsoft.ContainerService/fleets/endpoints/write",
|                                                        "Microsoft.ContainerService/fleets/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/fleets/events/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/daemonsets/write",
|                                                        "Microsoft.ContainerService/fleets/extensions/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/deployments/write",
|                                                        "Microsoft.ContainerService/fleets/extensions/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/ingresses/write",
|                                                        "Microsoft.ContainerService/fleets/extensions/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/extensions/networkpolicies/write",
|                                                        "Microsoft.ContainerService/fleets/limitranges/read",
|                                                        "Microsoft.ContainerService/fleets/namespaces/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/ingresses/write",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/networking.k8s.io/networkpolicies/write",
|                                                        "Microsoft.ContainerService/fleets/nodes/read",
|                                                        "Microsoft.ContainerService/fleets/nodes/write",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumes/read",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumes/write",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumeclaims/read",
|                                                        "Microsoft.ContainerService/fleets/persistentvolumeclaims/write",
|                                                        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/read",
|                                                        "Microsoft.ContainerService/fleets/policy/poddisruptionbudgets/write",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/read",
|                                                        "Microsoft.ContainerService/fleets/replicationcontrollers/write",
|                                                        "Microsoft.ContainerService/fleets/resourcequotas/read",
|                                                        "Microsoft.ContainerService/fleets/secrets/read",
|                                                        "Microsoft.ContainerService/fleets/secrets/write",
|                                                        "Microsoft.ContainerService/fleets/serviceaccounts/read",
|                                                        "Microsoft.ContainerService/fleets/serviceaccounts/write",
|                                                        "Microsoft.ContainerService/fleets/services/read",
|                                                        "Microsoft.ContainerService/fleets/services/write",
|                                                        "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/memberclusters/read",
|                                                        "Microsoft.ContainerService/fleets/cluster.kubernetes-fleet.io/memberclusters/write",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceplacements/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceplacements/write",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourcebindings/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourcesnapshots/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterschedulingpolicysnapshots/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverrides/read",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverrides/write",
|                                                        "Microsoft.ContainerService/fleets/placement.kubernetes-fleet.io/clusterresourceoverridesnapshots/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1a40e87e-6645-48e0-b27a-0b115d849a20",
|                                    "Name":  "Chaos Studio Operator",
|                                    "Description":  "Can run and see details for experiments but cannot create experiments or manage targets and capabilities.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Chaos/*/read",
|                                                    "Microsoft.Chaos/experiments/start/action",
|                                                    "Microsoft.Chaos/experiments/cancel/action",
|                                                    "Microsoft.Chaos/experiments/executions/getExecutionDetails/action",
|                                                    "Microsoft.Chaos/locations/operationResults/read",
|                                                    "Microsoft.Chaos/locations/operationStatuses/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "29e2da8a-229c-4157-8ae8-cc72fc506b74",
|                                    "Name":  "Chaos Studio Reader",
|                                    "Description":  "Can view targets, capabilities, experiments, and experiment details.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Chaos/*/read",
|                                                    "Microsoft.Chaos/experiments/executions/getExecutionDetails/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7c2e40b7-25eb-482a-82cb-78ba06cb46d5",
|                                    "Name":  "Chaos Studio Experiment Contributor",
|                                    "Description":  "Can create, run, and see details for experiments, onboard targets, and manage capabilities.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Chaos/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6f4fe6fc-f04f-4d97-8528-8bc18c848dca",
|                                    "Name":  "Container Apps ConnectedEnvironments Contributor",
|                                    "Description":  "Full management of Container Apps ConnectedEnvironments, including creation, deletion, and updates.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/connectedEnvironments/*",
|                                                    "Microsoft.App/connectedEnvironments/*/read",
|                                                    "Microsoft.App/connectedEnvironments/*/write",
|                                                    "Microsoft.App/connectedEnvironments/*/delete",
|                                                    "Microsoft.App/connectedEnvironments/*/action",
|                                                    "Microsoft.App/connectedEnvironments/daprComponents/listSecrets/action",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ff478a4e-8633-416e-91bc-ec33ce7c9516",
|                                    "Name":  "Azure Messaging Connectors Owner",
|                                    "Description":  "Allows for full access to Azure Messaging Connectors resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MessagingConnectors/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.MessagingConnectors/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3bc748fc-213d-45c1-8d91-9da5725539b9",
|                                    "Name":  "Container Registry Contributor and Data Access Configuration Administrator",
|                                    "Description":  "Provides permissions to create, list, and update container registries and registry configuration properties. Provides permissions to configure data access such as admin user credentials, scope maps, and tokens, which can be used to read, write or delete repositories and images. Does not provide direct permissions to read, list, or write registry contents including repositories and images. Does not provide permissions to modify data plane content such as imports, Artifact Cache or Sync, and Transfer Pipelines. Does not provide permissions for managing Tasks.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerRegistry/registries/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/read",
|                                                    "Microsoft.ContainerRegistry/registries/write",
|                                                    "Microsoft.ContainerRegistry/registries/delete",
|                                                    "Microsoft.ContainerRegistry/registries/listCredentials/action",
|                                                    "Microsoft.ContainerRegistry/registries/regenerateCredential/action",
|                                                    "Microsoft.ContainerRegistry/registries/generateCredentials/action",
|                                                    "Microsoft.ContainerRegistry/registries/replications/read",
|                                                    "Microsoft.ContainerRegistry/registries/replications/write",
|                                                    "Microsoft.ContainerRegistry/registries/replications/delete",
|                                                    "Microsoft.ContainerRegistry/registries/replications/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/action",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnections/read",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnections/write",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnections/delete",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnections/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/tokens/read",
|                                                    "Microsoft.ContainerRegistry/registries/tokens/write",
|                                                    "Microsoft.ContainerRegistry/registries/tokens/delete",
|                                                    "Microsoft.ContainerRegistry/registries/tokens/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/scopeMaps/read",
|                                                    "Microsoft.ContainerRegistry/registries/scopeMaps/write",
|                                                    "Microsoft.ContainerRegistry/registries/scopeMaps/delete",
|                                                    "Microsoft.ContainerRegistry/registries/scopeMaps/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/read",
|                                                    "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.ContainerRegistry/registries/connectedRegistries/read",
|                                                    "Microsoft.ContainerRegistry/registries/connectedRegistries/write",
|                                                    "Microsoft.ContainerRegistry/registries/connectedRegistries/delete",
|                                                    "Microsoft.ContainerRegistry/registries/connectedRegistries/deactivate/action",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/read",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/write",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/delete",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/getCallbackConfig/action",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/ping/action",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/listEvents/action",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/operationStatuses/read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read",
|                                                    "Microsoft.ContainerRegistry/locations/operationResults/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/privateEndpoints/privateLinkServiceProxies/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "566f0da3-e2a5-4393-9089-763f8bab8fb6",
|                                    "Name":  "Health Safeguards Data User",
|                                    "Description":  "Allows processing of health data in all available Health Safeguards",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalAnchoring/Process/Action",
|                                                        "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalCodesValidation/Process/Action",
|                                                        "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalConflictDetection/Process/Action",
|                                                        "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalEvidenceVerification/Process/Action",
|                                                        "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalProvenance/Process/Action",
|                                                        "Microsoft.HealthBot/healthBots/HealthSafeguards/ClinicalSemanticValidation/Process/Action",
|                                                        "Microsoft.HealthBot/healthBots/HealthSafeguards/DetectHallucinationsAndOmissions/Process/Action",
|                                                        "Microsoft.HealthBot/healthBots/HealthSafeguards/HealthAdaptedFiltering/Process/Action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "69b07be0-09bf-439a-b9a6-e73de851bd59",
|                                    "Name":  "Container Registry Configuration Reader and Data Access Configuration Reader",
|                                    "Description":  "Provides permissions to list container registries and registry configuration properties. Provides permissions to list data access configuration such as admin user credentials, scope maps, and tokens, which can be used to read, write or delete repositories and images. Does not provide direct permissions to read, list, or write registry contents including repositories and images. Does not provide permissions to modify data plane content such as imports, Artifact Cache or Sync, and Transfer Pipelines. Does not provide permissions for managing Tasks.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/read",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnections/read",
|                                                    "Microsoft.ContainerRegistry/registries/privateEndpointConnections/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/listCredentials/action",
|                                                    "Microsoft.ContainerRegistry/registries/tokens/read",
|                                                    "Microsoft.ContainerRegistry/registries/tokens/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/scopeMaps/read",
|                                                    "Microsoft.ContainerRegistry/registries/scopeMaps/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/read",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/getCallbackConfig/action",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/listEvents/action",
|                                                    "Microsoft.ContainerRegistry/registries/webhooks/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/replications/read",
|                                                    "Microsoft.ContainerRegistry/registries/replications/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/connectedRegistries/read",
|                                                    "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/read",
|                                                    "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/metricDefinitions/read",
|                                                    "Microsoft.Insights/AlertRules/Write",
|                                                    "Microsoft.Insights/AlertRules/Delete",
|                                                    "Microsoft.Insights/AlertRules/Read",
|                                                    "Microsoft.Insights/AlertRules/Activated/Action",
|                                                    "Microsoft.Insights/AlertRules/Resolved/Action",
|                                                    "Microsoft.Insights/AlertRules/Throttled/Action",
|                                                    "Microsoft.Insights/AlertRules/Incidents/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bf94e731-3a51-4a7c-8c54-a1ab9971dfc1",
|                                    "Name":  "Container Registry Transfer Pipeline Contributor",
|                                    "Description":  "Provides the ability to transfer, import, and export artifacts through configuring registry transfer pipelines that involve intermediary storage accounts and key vaults. Does not provide permissions to push or pull images. Does not provide permissions to create, manage, or list storage accounts or key vaults. Does not provide permissions to perform role assignments.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/exportPipelines/read",
|                                                    "Microsoft.ContainerRegistry/registries/exportPipelines/write",
|                                                    "Microsoft.ContainerRegistry/registries/exportPipelines/delete",
|                                                    "Microsoft.ContainerRegistry/registries/importPipelines/read",
|                                                    "Microsoft.ContainerRegistry/registries/importPipelines/write",
|                                                    "Microsoft.ContainerRegistry/registries/importPipelines/delete",
|                                                    "Microsoft.ContainerRegistry/registries/pipelineRuns/read",
|                                                    "Microsoft.ContainerRegistry/registries/pipelineRuns/write",
|                                                    "Microsoft.ContainerRegistry/registries/pipelineRuns/delete",
|                                                    "Microsoft.ContainerRegistry/registries/pipelineRuns/operationStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "97dfb3ce-e936-462c-9425-9cdb67e66d45",
|                                    "Name":  "Desktop Virtualization App Attach Contributor",
|                                    "Description":  "Provide permission to manage app attach resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DesktopVirtualization/hostpools/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.DesktopVirtualization/appattachpackages/read",
|                                                    "Microsoft.DesktopVirtualization/appattachpackages/write",
|                                                    "Microsoft.DesktopVirtualization/appattachpackages/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e9701b4d-e6e7-4657-91cd-360a0881d224",
|                                    "Name":  "HybridCompute Machine ListAccessDetails Action In-Built Role",
|                                    "Description":  "In-Built Role definition that grants permissions to execute the listAccessDetails action on HybridCompute Machines",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/machines/listAccessDetails/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8ea85a25-eb16-4e29-ab4d-6f2a26c711a2",
|                                    "Name":  "App Service Environment Contributor",
|                                    "Description":  "Manage App Service Environments but not the App Service Plans or Websites that it hosts.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Web/hostingEnvironments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ada52afe-776a-4b4d-a8f2-55670d3d8178",
|                                    "Name":  "Kubernetes Agent Subscription Level Operator",
|                                    "Description":  "Grants Microsoft Defender for Cloud subscription level permissions needed to activate Containers plan",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.OperationalInsights/workspaces/write",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.OperationalInsights/workspaces/listKeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedkeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedkeys/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c1410b24-3e69-4857-8f86-4d0a2e603250",
|                                    "Name":  "Quantum Workspace Data Contributor",
|                                    "Description":  "Create, read, and modify jobs and other Workspace data. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Quantum/Workspaces/read",
|                                                    "Microsoft.Quantum/locations/offerings/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Quantum/Workspaces/jobs/read",
|                                                        "Microsoft.Quantum/Workspaces/jobs/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "09976791-48a7-449e-bb21-39d1a415f350",
|                                    "Name":  "Communication and Email Service Owner",
|                                    "Description":  "Create, read, modify, and delete Communications and Email Service resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Communication/CheckNameAvailability/action",
|                                                    "Microsoft.Communication/Locations/OperationStatuses/read",
|                                                    "Microsoft.Communication/Locations/OperationStatuses/write",
|                                                    "Microsoft.Communication/Operations/read",
|                                                    "Microsoft.Communication/CommunicationServices/read",
|                                                    "Microsoft.Communication/CommunicationServices/write",
|                                                    "Microsoft.Communication/CommunicationServices/delete",
|                                                    "Microsoft.Communication/CommunicationServices/ListKeys/action",
|                                                    "Microsoft.Communication/CommunicationServices/RegenerateKey/action",
|                                                    "Microsoft.Communication/CommunicationServices/LinkNotificationHub/action",
|                                                    "Microsoft.Communication/CommunicationServices/EventGridFilters/read",
|                                                    "Microsoft.Communication/CommunicationServices/EventGridFilters/write",
|                                                    "Microsoft.Communication/CommunicationServices/EventGridFilters/delete",
|                                                    "Microsoft.Communication/EmailServices/read",
|                                                    "Microsoft.Communication/EmailServices/write",
|                                                    "Microsoft.Communication/EmailServices/delete",
|                                                    "Microsoft.Communication/EmailServices/Domains/read",
|                                                    "Microsoft.Communication/EmailServices/Domains/write",
|                                                    "Microsoft.Communication/EmailServices/Domains/delete",
|                                                    "Microsoft.Communication/EmailServices/Domains/SenderUsernames/read",
|                                                    "Microsoft.Communication/EmailServices/Domains/SenderUsernames/write",
|                                                    "Microsoft.Communication/EmailServices/Domains/SenderUsernames/delete",
|                                                    "Microsoft.Communication/EmailServices/Domains/SuppressionLists/read",
|                                                    "Microsoft.Communication/EmailServices/Domains/SuppressionLists/write",
|                                                    "Microsoft.Communication/EmailServices/Domains/SuppressionLists/delete",
|                                                    "Microsoft.Communication/EmailServices/Domains/SuppressionLists/SuppressionListAddresses/read",
|                                                    "Microsoft.Communication/EmailServices/Domains/SuppressionLists/SuppressionListAddresses/write",
|                                                    "Microsoft.Communication/EmailServices/Domains/SuppressionLists/SuppressionListAddresses/delete",
|                                                    "Microsoft.Communication/EmailServices/Domains/InitiateVerification/action",
|                                                    "Microsoft.Communication/EmailServices/Domains/CancelVerification/action",
|                                                    "Microsoft.Communication/EmailServices/Domains/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "59c05558-2358-462d-ba19-afbd7118936d",
|                                    "Name":  "Oracle.Database Autonomous Database Administrator",
|                                    "Description":  "Grants full access to manage all Autonomous Database resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/autonomousDatabases/*/read",
|                                                    "Oracle.Database/autonomousDatabases/*/write",
|                                                    "Oracle.Database/autonomousDatabases/*/delete",
|                                                    "Oracle.Database/autonomousDatabases/*/action",
|                                                    "Oracle.Database/Locations/*/read",
|                                                    "Oracle.Database/Locations/*/write",
|                                                    "Oracle.Database/Operations/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/action",
|                                                    "Oracle.Database/resourceAnchors/*",
|                                                    "Oracle.Database/networkAnchors/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/locations/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "11102f94-c441-49e6-a78b-ef80e0188abc",
|                                    "Name":  "Azure AI Safety Evaluator",
|                                    "Description":  "This role can perform all actions under workspace evaluations and simulations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/evaluations/*",
|                                                    "Microsoft.MachineLearningServices/workspaces/simulations/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fb382eab-e894-4461-af04-94435c366c3f",
|                                    "Name":  "Container Registry Tasks Contributor",
|                                    "Description":  "Provides permissions to configure, read, list, trigger, or cancel Container Registry Tasks, Task Runs, Task Logs, Quick Runs, Quick Builds, and Task Agent Pools. Permissions granted for Tasks management can be used for full registry data plane permissions including reading/writing/deleting container images in registries. Permissions granted for Tasks management can also be used to run customer authored build directives and run scripts to build software artifacts.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/agentpools/read",
|                                                    "Microsoft.ContainerRegistry/registries/agentpools/write",
|                                                    "Microsoft.ContainerRegistry/registries/agentpools/delete",
|                                                    "Microsoft.ContainerRegistry/registries/agentpools/listQueueStatus/action",
|                                                    "Microsoft.ContainerRegistry/registries/agentpools/operationResults/status/read",
|                                                    "Microsoft.ContainerRegistry/registries/agentpools/operationStatuses/read",
|                                                    "Microsoft.ContainerRegistry/registries/tasks/read",
|                                                    "Microsoft.ContainerRegistry/registries/tasks/write",
|                                                    "Microsoft.ContainerRegistry/registries/tasks/delete",
|                                                    "Microsoft.ContainerRegistry/registries/tasks/listDetails/action",
|                                                    "Microsoft.ContainerRegistry/registries/scheduleRun/action",
|                                                    "Microsoft.ContainerRegistry/registries/listBuildSourceUploadUrl/action",
|                                                    "Microsoft.ContainerRegistry/registries/runs/read",
|                                                    "Microsoft.ContainerRegistry/registries/runs/write",
|                                                    "Microsoft.ContainerRegistry/registries/runs/listLogSasUrl/action",
|                                                    "Microsoft.ContainerRegistry/registries/runs/cancel/action",
|                                                    "Microsoft.ContainerRegistry/registries/taskruns/read",
|                                                    "Microsoft.ContainerRegistry/registries/taskruns/write",
|                                                    "Microsoft.ContainerRegistry/registries/taskruns/delete",
|                                                    "Microsoft.ContainerRegistry/registries/taskruns/listDetails/action",
|                                                    "Microsoft.ContainerRegistry/registries/taskruns/operationStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerRegistry/registries/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "afc680e2-a938-412d-b213-9a49efa7fb83",
|                                    "Name":  "Azure Backup Snapshot Contributor",
|                                    "Description":  "Provide permissions to backup identity to manage RPC snapshots",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/restorePointCollections/read",
|                                                    "Microsoft.Compute/restorePointCollections/write",
|                                                    "Microsoft.Compute/restorePointCollections/restorePoints/write",
|                                                    "Microsoft.Compute/restorePointCollections/restorePoints/read",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/disks/beginGetAccess/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "49fc33c1-886f-4b21-a00e-1d9993234734",
|                                    "Name":  "AVS on Fleet VIS Role",
|                                    "Description":  "Do not remove this role from your resource because it is critical to enable your AVS private cloud to operate. If the role is removed, it will cause your AVS private cloud control plane to no longer operate correctly. The role is used to enable the AVS private cloud control plane to inject address prefix changes of the private clouds attached virtual network to SDN and support peering sync feature. This role is not intended for use cases outside of assignment to the associated AVS identity in your entra-id tenant.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/write",
|                                                    "Microsoft.Network/virtualNetworks/peer/action",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
|                                                    "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                    "Microsoft.Network/natGateways/join/action",
|                                                    "Microsoft.Network/networkIntentPolicies/join/action",
|                                                    "Microsoft.Network/ddosProtectionPlans/join/action",
|                                                    "Microsoft.Network/networkManagers/ipamPools/associateResourcesToPool/action",
|                                                    "Microsoft.BareMetal/peeringSettings/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "53e48117-a530-4075-bcbe-d91913e3bdb8",
|                                    "Name":  "Edge Management Copilot User",
|                                    "Description":  "Enables users access to Edge Management Copilot.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EdgeManagement/locations/chat/action",
|                                                    "Microsoft.EdgeManagement/troubleshoot/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d6a5505f-6ebb-45a4-896e-ac8274cfc0ac",
|                                    "Name":  "Durable Task Data Reader",
|                                    "Description":  "Read all Durable Task Scheduler data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DurableTask/schedulers/taskhubs/orchestrations/read",
|                                                        "Microsoft.DurableTask/schedulers/taskhubs/orchestrations/metadata/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1a6f9009-515c-4455-b170-143e4c9ce229",
|                                    "Name":  "Azure Stack HCI Edge Machine Contributor Role",
|                                    "Description":  "Microsoft.AzureStackHCI Edge Machine Contributor Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStackHCI/EdgeMachines/*",
|                                                    "Microsoft.AzureStackHCI/locations/ValidateOwnershipVouchers/action",
|                                                    "Microsoft.Edge/Sites/read",
|                                                    "Microsoft.Edge/Sites/write",
|                                                    "Microsoft.Edge/configurationReferences/read",
|                                                    "Microsoft.Edge/configurationReferences/write",
|                                                    "Microsoft.Edge/Configurations/*/read",
|                                                    "Microsoft.Edge/Configurations/*/write",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/deployments/operationstatuses/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "53747cdd-e97c-477a-948c-b587d0e514b2",
|                                    "Name":  "Online Experimentation Data Owner",
|                                    "Description":  "Allows full access to Online Experimentation data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.OnlineExperimentation/workspaces/read",
|                                                        "Microsoft.OnlineExperimentation/workspaces/write",
|                                                        "Microsoft.OnlineExperimentation/workspaces/delete",
|                                                        "Microsoft.OnlineExperimentation/workspaces/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1363e94d-546f-4fe9-8434-b0eefb292d59",
|                                    "Name":  "Online Experimentation Data Reader",
|                                    "Description":  "Allows read access to Online Experimentation data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.OnlineExperimentation/workspaces/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "59a618e3-3c9a-406e-9f03-1a20dd1c55f1",
|                                    "Name":  "Chaos Studio Target Contributor",
|                                    "Description":  "Can onboard targets and manage capabilities but cannot create, run, or see details for experiments",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Chaos/targets/write",
|                                                    "Microsoft.Chaos/targets/delete",
|                                                    "Microsoft.Chaos/targets/read",
|                                                    "Microsoft.Chaos/targets/capabilities/write",
|                                                    "Microsoft.Chaos/targets/capabilities/delete",
|                                                    "Microsoft.Chaos/targets/capabilities/read",
|                                                    "Microsoft.Chaos/locations/targetTypes/read",
|                                                    "Microsoft.Chaos/locations/targetTypes/capabilityTypes/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a8d01690-9418-4783-8ca2-9f0f1791783d",
|                                    "Name":  "Auto Actions Contributor",
|                                    "Description":  "Allows users to manage Auto Actions resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ComputeSchedule/locations/OperationStatuses/write",
|                                                    "Microsoft.ComputeSchedule/autoActions/write",
|                                                    "Microsoft.ComputeSchedule/autoActions/delete",
|                                                    "Microsoft.ComputeSchedule/autoActions/attachResources/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/cancelNextOccurrence/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/detachResources/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/disable/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/enable/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/listResources/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/patchResources/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/triggerManualOccurrence/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/occurrences/cancel/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/occurrences/delay/action",
|                                                    "Microsoft.ComputeSchedule/autoActions/occurrences/listResources/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a227fb39-f479-404b-96fd-0176f5d88ab4",
|                                    "Name":  "Azure Device Onboarding Discovery Contributor",
|                                    "Description":  "Can read, write or delete the discovery and it\u0027s child resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DeviceOnboarding/discoveryServices/*",
|                                                    "Microsoft.DeviceOnboarding/locations/operationStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "31ef6312-5b0c-4ce9-8c5d-587a91344fe7",
|                                    "Name":  "SSH PublicKeys Reader Role",
|                                    "Description":  "This is the role created for SSH PublicKeys Reader",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/sshpublickeys/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fc6e3395-6a8c-4527-bb4c-d0abd41e8e74",
|                                    "Name":  "SSH PublicKeys Contributor Role",
|                                    "Description":  "This is the role created for SSH PublicKeys Contributor",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/sshpublickeys/read",
|                                                    "Microsoft.Compute/sshpublickeys/write",
|                                                    "Microsoft.Compute/sshpublickeys/delete",
|                                                    "Microsoft.Compute/sshpublickeys/generatekeypair/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1b7f3653-4324-473a-9165-bc55e4d04ba8",
|                                    "Name":  "Azure Kubernetes Service Agent Pool Manager Role",
|                                    "Description":  "Role for agentpool related actions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/managedClusters/agentPools/read",
|                                                    "Microsoft.ContainerService/managedClusters/agentPools/write",
|                                                    "Microsoft.ContainerService/managedClusters/agentPools/delete",
|                                                    "Microsoft.ContainerService/managedClusters/agentPools/upgradeNodeImageVersion/action",
|                                                    "Microsoft.ContainerService/managedClusters/agentPools/abort/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "68ac31b4-936a-4046-a6d2-ba6f8a757bf6",
|                                    "Name":  "Defender Serverless Scanner",
|                                    "Description":  "Grants access to Serverless resources and thier connections",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "microsoft.web/sites/publish/action",
|                                                    "Microsoft.Web/sites/sitecontainers/read",
|                                                    "microsoft.web/sites/slots/publish/action",
|                                                    "microsoft.web/sites/config/list/action",
|                                                    "microsoft.web/sites/slots/config/list/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "96ebd254-ecc7-4590-aff5-e9af3ff5f3b3",
|                                    "Name":  "Dedicated Host Contributor Role",
|                                    "Description":  "This is the role created for DedicatedHosts Contributor",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/hostGroups/read",
|                                                    "Microsoft.Compute/hostGroups/write",
|                                                    "Microsoft.Compute/hostGroups/delete",
|                                                    "Microsoft.Compute/hostGroups/hosts/read",
|                                                    "Microsoft.Compute/hostGroups/hosts/write",
|                                                    "Microsoft.Compute/hostGroups/hosts/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2bed379c-9fba-455b-99e4-6b911073bcf2",
|                                    "Name":  "Compute Fleet Contributor",
|                                    "Description":  "Allows users to manage Compute Fleet resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureFleet/fleets/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1df7cd83-1d3f-41df-95b0-53b30d963369",
|                                    "Name":  "Azure API Center Credential Access Reader",
|                                    "Description":  "Allows for access to Azure API Center data plane get credentials operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ApiCenter/services/workspaces/apis/versions/securityRequirements/read",
|                                                        "Microsoft.ApiCenter/services/workspaces/apis/versions/securityRequirements/getCredentials/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7e559ce2-48d7-4b27-9128-fa1b247f1308",
|                                    "Name":  "Managed Identity Federated Identity Credential Contributor",
|                                    "Description":  "Create, Read, Update, and Delete User Assigned Identity Federated Identity Credentials(FIC)",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/read",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read",
|                                                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "92b92042-07d9-4307-87f7-36a593fc5850",
|                                    "Name":  "Azure File Sync Administrator",
|                                    "Description":  "Provides full access to manage all Azure File Sync (Storage Sync Service) resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.StorageSync/register/action",
|                                                    "Microsoft.StorageSync/unregister/action",
|                                                    "Microsoft.StorageSync/locations/*",
|                                                    "Microsoft.StorageSync/deployments/preflight/action",
|                                                    "Microsoft.StorageSync/storageSyncServices/*",
|                                                    "Microsoft.StorageSync/operations/read",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Insights/AlertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "754c1a27-40dc-4708-8ad4-2bffdeee09e8",
|                                    "Name":  "Azure File Sync Reader",
|                                    "Description":  "Provides read access to Azure File Sync service (Storage Sync Service).",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.StorageSync/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "88366f10-ed47-4cc0-9fab-c8a06148393e",
|                                    "Name":  "Azure Red Hat OpenShift Hosted Control Planes Cluster API Provider",
|                                    "Description":  "Enables permissions to allow cluster API to manage nodes, networks and disks for OpenShift cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/diskEncryptionSets/read",
|                                                    "Microsoft.Compute/availabilitySets/delete",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/availabilitySets/write",
|                                                    "Microsoft.Compute/virtualMachines/delete",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/networkInterfaces/join/action",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a00ed373-f085-4b75-a950-53eacdc52ac0",
|                                    "Name":  "Oracle.Database Exascale Storage Vault Administrator",
|                                    "Description":  "Grants full access to manage Exascale Storage Vaults",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/exascaleDbStorageVaults/read",
|                                                    "Oracle.Database/exascaleDbStorageVaults/write",
|                                                    "Oracle.Database/exascaleDbStorageVaults/delete",
|                                                    "Oracle.Database/Locations/*/read",
|                                                    "Oracle.Database/Locations/*/write",
|                                                    "Oracle.Database/Operations/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/read",
|                                                    "Oracle.Database/resourceAnchors/*",
|                                                    "Oracle.Database/networkAnchors/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "58b80de8-4b34-424c-9e47-23faf0f7cfe2",
|                                    "Name":  "Online Experimentation Reader",
|                                    "Description":  "Grants permission for read operations to Online Experimentation resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.OnlineExperimentation/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2c7a01fe-5518-4a42-93c2-658e45441691",
|                                    "Name":  "Online Experimentation Contributor",
|                                    "Description":  "Grants permissions for all management operations to Online Experimentation resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.OnlineExperimentation/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "61eb6405-5f4a-440b-ad03-fe06c5c85e44",
|                                    "Name":  "Flux Configurations Contributor",
|                                    "Description":  "Can create, update, get, list and delete Flux Configurations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.KubernetesConfiguration/fluxConfigurations/write",
|                                                    "Microsoft.KubernetesConfiguration/fluxConfigurations/read",
|                                                    "Microsoft.KubernetesConfiguration/fluxConfigurations/delete",
|                                                    "Microsoft.KubernetesConfiguration/fluxConfigurations/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f094fb07-0703-4400-ad6a-e16dd8000e14",
|                                    "Name":  "Container Registry Credential Set Administrator",
|                                    "Description":  "Create, Read, Update, and Delete Credential Sets in Container Registry. This role doesn\u0027t affect the needed permissions for storing content inside Azure Key Vault. This role also doesn\u0027t grant permissions to manage Cache Rules.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/credentialSets/read",
|                                                    "Microsoft.ContainerRegistry/registries/credentialSets/write",
|                                                    "Microsoft.ContainerRegistry/registries/credentialSets/delete",
|                                                    "Microsoft.ContainerRegistry/registries/credentialSets/operationStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c357b964-0002-4b64-a50d-7a28f02edc52",
|                                    "Name":  "Container Registry Cache Rule Reader",
|                                    "Description":  "Read the configuration of Cache Rules in Container Registry. This permission doesn\u0027t grant permission to read Credential Sets.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/cacheRules/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "29093635-9924-4f2c-913b-650a12949526",
|                                    "Name":  "Container Registry Credential Set Reader",
|                                    "Description":  "Read the configuration of Credential Sets in Container Registry. This permission doesn\u0027t allow permission to see content inside Azure Key vault only the content inside Container Registry. This permission doesn\u0027t grant permission to read Cache Rules.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/credentialSets/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0869d06d-e3d1-4472-8764-1bb71b2bdaf7",
|                                    "Name":  "Oracle.Database Exascale VmCluster Administrator",
|                                    "Description":  "Grants full access to manage Exascale VmClusters",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/exascaleDbStorageVaults/read",
|                                                    "Oracle.Database/exadbVmClusters/*/read",
|                                                    "Oracle.Database/exadbVmClusters/*/write",
|                                                    "Oracle.Database/exadbVmClusters/*/delete",
|                                                    "Oracle.Database/exadbVmClusters/*/action",
|                                                    "Oracle.Database/Locations/*/read",
|                                                    "Oracle.Database/Locations/*/write",
|                                                    "Oracle.Database/Operations/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/read",
|                                                    "Oracle.Database/resourceAnchors/*",
|                                                    "Oracle.Database/networkAnchors/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Compute/sshPublicKeys/read",
|                                                    "Microsoft.Compute/sshPublicKeys/write",
|                                                    "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8d7ecc5c-f27b-43cf-883f-46409d445502",
|                                    "Name":  "Issue Contributor",
|                                    "Description":  "Can read all issues data and update issues settings.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AlertsManagement/Issues/*",
|                                                    "microsoft.monitor/accounts/issues/*",
|                                                    "Microsoft.AlertsManagement/alerts/*",
|                                                    "Microsoft.Insights/components/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "df87f177-bb12-4db1-9793-a413691eff94",
|                                    "Name":  "Container Registry Cache Rule Administrator",
|                                    "Description":  "Create, Read, Update, and Delete Cache Rules in Container Registry. This role doesn\u0027t grant permissions to manage Credential Sets.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/cacheRules/read",
|                                                    "Microsoft.ContainerRegistry/registries/cacheRules/write",
|                                                    "Microsoft.ContainerRegistry/registries/cacheRules/delete",
|                                                    "Microsoft.ContainerRegistry/registries/cacheRules/operationStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2593f4c7-8bf4-4fff-9804-2ee069b41902",
|                                    "Name":  "Power Platform Account Contributor",
|                                    "Description":  "Create, Read, Update, and Delete Power Platform Account resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.PowerPlatform/accounts/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "babe7770-cdbc-4f46-9bd7-b90b34842946",
|                                    "Name":  "Power Platform Enterprise Policy Contributor",
|                                    "Description":  "Create, Read, Update, and Delete Power Platform Enterprise Policy resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.PowerPlatform/enterprisePolicies/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "33cdeeac-0940-4f85-9317-7e2432c17289",
|                                    "Name":  "Usage Billing Contributor",
|                                    "Description":  "Contributor access to Accounts",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.UsageBilling/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "db9875ba-bd2b-4e98-934d-0daa549a07f0",
|                                    "Name":  "Workload Orchestration Solution External Validator",
|                                    "Description":  "Grants you access to fetch targets, solution templates, solutions and update the external validation status",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Edge/targets/read",
|                                                    "Microsoft.Edge/solutionTemplates/read",
|                                                    "Microsoft.Edge/solutionTemplates/versions/read",
|                                                    "Microsoft.Edge/targets/solutions/versions/read",
|                                                    "Microsoft.Edge/targets/updateExternalValidationStatus/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "eadc314b-1a2d-4efa-be10-5d325db5065e",
|                                    "Name":  "Azure AI Project Manager",
|                                    "Description":  "Lets you perform developer actions and management actions on Azure AI Foundry Projects. Allows for making role assignments, but limited to Cognitive Service User role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "Microsoft.CognitiveServices/accounts/*/read",
|                                                    "Microsoft.CognitiveServices/accounts/projects/*",
|                                                    "Microsoft.CognitiveServices/locations/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0618ae3d-2930-4bb7-aa00-718db34ee9f9",
|                                    "Name":  "Azure Monitor Dashboards with Grafana Contributor",
|                                    "Description":  "Can manage dashboards with Grafana.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Dashboard/dashboards/read",
|                                                    "Microsoft.Dashboard/dashboards/write",
|                                                    "Microsoft.Dashboard/dashboards/delete",
|                                                    "Microsoft.Dashboard/dashboards/dashboardDefinitions/read",
|                                                    "Microsoft.Dashboard/dashboards/dashboardDefinitions/write",
|                                                    "Microsoft.Dashboard/dashboards/dashboardDefinitions/delete",
|                                                    "Microsoft.Dashboard/locations/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/deployments/write",
|                                                    "Microsoft.Resources/deployments/delete",
|                                                    "Microsoft.Resources/deployments/cancel/action",
|                                                    "Microsoft.Resources/deployments/validate/action",
|                                                    "Microsoft.Resources/deployments/whatIf/action",
|                                                    "Microsoft.Resources/deployments/exportTemplate/action",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e47c6f54-e4a2-4754-9501-8e0985b135e1",
|                                    "Name":  "Azure AI Account Owner",
|                                    "Description":  "Grants full access to manage AI projects and accounts. Grants conditional assignment of the Azure AI User role to other user principles.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "Microsoft.CognitiveServices/*",
|                                                    "Microsoft.Features/features/read",
|                                                    "Microsoft.Features/providers/features/read",
|                                                    "Microsoft.Features/providers/features/register/action",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Insights/diagnosticSettings/*",
|                                                    "Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.Insights/metricdefinitions/read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5c227a58-cff3-4b51-9fa3-51bdafb6ca55",
|                                    "Name":  "Secrets Store Extension Owner",
|                                    "Description":  "Read, create and modify secretsync and secretproviderclass objects. Register and deregister the provider from the subscription.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SecretSyncController/register/action",
|                                                    "Microsoft.SecretSyncController/unregister/action",
|                                                    "Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/read",
|                                                    "Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/write",
|                                                    "Microsoft.SecretSyncController/azureKeyVaultSecretProviderClasses/delete",
|                                                    "Microsoft.SecretSyncController/locations/operationStatuses/read",
|                                                    "Microsoft.SecretSyncController/locations/operationStatuses/write",
|                                                    "Microsoft.SecretSyncController/operations/read",
|                                                    "Microsoft.SecretSyncController/secretSyncs/read",
|                                                    "Microsoft.SecretSyncController/secretSyncs/write",
|                                                    "Microsoft.SecretSyncController/secretSyncs/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "53ca6127-db72-4b80-b1b0-d745d6d5456d",
|                                    "Name":  "Azure AI User",
|                                    "Description":  "Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.CognitiveServices/*/read",
|                                                    "Microsoft.CognitiveServices/accounts/listkeys/action",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Insights/diagnosticSettings/read",
|                                                    "Microsoft.Insights/logDefinitions/read",
|                                                    "Microsoft.Insights/metricdefinitions/read",
|                                                    "Microsoft.Insights/metrics/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c0ff367d-66d8-445e-917c-583feb0ef0d4",
|                                    "Name":  "Azure Red Hat OpenShift Hosted Control Planes Service Managed Identity",
|                                    "Description":  "Azure Red Hat OpenShift Hosted Control Planes Service Managed Identity",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/routeTables/read",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/natGateways/read",
|                                                    "Microsoft.Network/natGateways/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/read",
|                                                    "Microsoft.Network/loadBalancers/backendAddressPools/write",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/loadBalancers/write",
|                                                    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
|                                                    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Network/virtualNetworks/joinLoadBalancer/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fc0c873f-45e9-4d0d-a7d1-585aab30c6ed",
|                                    "Name":  "Azure Red Hat OpenShift Hosted Control Planes Control Plane Operator",
|                                    "Description":  "Enables the control plane operator to read resources necessary for OpenShift cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/networkSecurityGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "de2b316d-7a2c-4143-b4cd-c148f6a355a1",
|                                    "Name":  "Azure Kubernetes Fleet Manager Hub Agent Role",
|                                    "Description":  "Grants access to Azure resources needed by Azure Kubernetes Fleet Manager hub agents.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/trafficManagerProfiles/read",
|                                                    "Microsoft.Network/trafficManagerProfiles/write",
|                                                    "Microsoft.Network/trafficManagerProfiles/delete",
|                                                    "Microsoft.Network/trafficManagerProfiles/azureEndpoints/read",
|                                                    "Microsoft.Network/trafficManagerProfiles/azureEndpoints/write",
|                                                    "Microsoft.Network/trafficManagerProfiles/azureEndpoints/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "63304235-eaf4-4c15-8e93-46c483611231",
|                                    "Name":  "Workload Orchestration IT Admin",
|                                    "Description":  "Grants you access to manage the IT Admin operations for Workload Orchestration",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Edge/contexts/eventGridFilters/delete",
|                                                    "Microsoft.Edge/contexts/eventGridFilters/read",
|                                                    "Microsoft.Edge/contexts/eventGridFilters/write",
|                                                    "Microsoft.Edge/contexts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f6e92014-8af2-414d-9948-9b1abf559285",
|                                    "Name":  "Arc Gateway Manager",
|                                    "Description":  "Manage Arc Gateway Resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridCompute/settings/write",
|                                                    "Microsoft.HybridCompute/settings/read",
|                                                    "Microsoft.HybridCompute/gateways/read",
|                                                    "Microsoft.HybridCompute/gateways/write",
|                                                    "Microsoft.HybridCompute/gateways/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8e253927-1f29-4d89-baa2-c3a549eff423",
|                                    "Name":  "Azure Kubernetes Service Machine Manager Role",
|                                    "Description":  "Role for machine related actions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/managedClusters/agentPools/deleteMachines/action",
|                                                    "Microsoft.ContainerService/managedClusters/agentPools/machines/read",
|                                                    "Microsoft.ContainerService/managedClusters/agentPools/machines/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5f569efd-4da5-4123-99cd-d42fbb2a836e",
|                                    "Name":  "Microsoft.AzureStackHCI EdgeMachine Reader",
|                                    "Description":  "Microsoft.AzureStackHCI EdgeMachine Reader",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStackHCI/EdgeMachines/Read/*",
|                                                    "Microsoft.AzureStackHCI/EdgeMachines/Jobs/Read/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "adc3c795-c41e-4a89-a478-0b321783324c",
|                                    "Name":  "Microsoft.AzureStackHCI Device Pool Manager",
|                                    "Description":  "Microsoft.AzureStackHCI Device Pool Manager ",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStackHCI/DevicePools/read",
|                                                    "Microsoft.AzureStackHCI/DevicePools/ClaimDevices/action",
|                                                    "Microsoft.AzureStackHCI/DevicePools/ReleaseDevices/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "47be4a87-7950-4631-9daf-b664a405f074",
|                                    "Name":  "Monitoring Policy Contributor",
|                                    "Description":  "Allows read access to all monitoring data, update permissions for monitoring settings and permissions to deploy and remediate Azure Monitor alert policies.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.AlertsManagement/alerts/*",
|                                                    "Microsoft.AlertsManagement/alertsSummary/*",
|                                                    "Microsoft.AlertsManagement/issues/*",
|                                                    "Microsoft.Insights/actiongroups/*",
|                                                    "Microsoft.Insights/activityLogAlerts/*",
|                                                    "Microsoft.Insights/AlertRules/*",
|                                                    "Microsoft.Insights/components/*",
|                                                    "Microsoft.Insights/createNotifications/*",
|                                                    "Microsoft.Insights/dataCollectionEndpoints/*",
|                                                    "Microsoft.Insights/dataCollectionRules/*",
|                                                    "Microsoft.Insights/dataCollectionRuleAssociations/*",
|                                                    "Microsoft.Insights/DiagnosticSettings/*",
|                                                    "Microsoft.Insights/eventtypes/*",
|                                                    "Microsoft.Insights/LogDefinitions/*",
|                                                    "Microsoft.Insights/metricalerts/*",
|                                                    "Microsoft.Insights/MetricDefinitions/*",
|                                                    "Microsoft.Insights/Metrics/*",
|                                                    "Microsoft.Insights/notificationStatus/*",
|                                                    "Microsoft.Insights/Register/Action",
|                                                    "Microsoft.Insights/scheduledqueryrules/*",
|                                                    "Microsoft.Insights/webtests/*",
|                                                    "Microsoft.Insights/workbooks/*",
|                                                    "Microsoft.Insights/workbooktemplates/*",
|                                                    "Microsoft.Insights/privateLinkScopes/*",
|                                                    "Microsoft.Insights/privateLinkScopeOperationStatuses/*",
|                                                    "Microsoft.Monitor/accounts/*",
|                                                    "Microsoft.OperationalInsights/workspaces/write",
|                                                    "Microsoft.OperationalInsights/workspaces/intelligencepacks/*",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/*",
|                                                    "Microsoft.OperationalInsights/workspaces/search/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedKeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedKeys/read",
|                                                    "Microsoft.OperationalInsights/workspaces/storageinsightconfigs/*",
|                                                    "Microsoft.OperationalInsights/locations/workspaces/failover/action",
|                                                    "Microsoft.OperationalInsights/workspaces/failback/action",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.AlertsManagement/smartDetectorAlertRules/*",
|                                                    "Microsoft.AlertsManagement/actionRules/*",
|                                                    "Microsoft.AlertsManagement/smartGroups/*",
|                                                    "Microsoft.AlertsManagement/migrateFromSmartDetection/*",
|                                                    "Microsoft.AlertsManagement/investigations/*",
|                                                    "Microsoft.AlertsManagement/prometheusRuleGroups/*",
|                                                    "Microsoft.Monitor/investigations/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.PolicyInsights/remediations/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "765a04e0-5de8-4bb2-9bf6-b2a30bc03e91",
|                                    "Name":  "Storage File Delegator",
|                                    "Description":  "Allows for generation of a user delegation key, which can then be used to create a shared access signature for a file or Azure file share that is signed with Entra ID credentials.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/fileServices/generateUserDelegationKey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "965033a5-c8eb-4f35-b82f-fef460a3606d",
|                                    "Name":  "Storage Table Delegator",
|                                    "Description":  "Allows for generation of a user delegation key, which can then be used to create a shared access signature for an Azure Storage table that is signed with Entra ID credentials.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/tableServices/generateUserDelegationKey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7ee386e9-84f0-448e-80a6-f185f6533131",
|                                    "Name":  "Storage Queue Delegator",
|                                    "Description":  "Allows for generation of a user delegation key, which can then be used to create a shared access signature for an Azure Storage queue that is signed with Entra ID credentials.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/queueServices/generateUserDelegationKey/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6fbca9a8-3561-41fd-8b20-6576043c1076",
|                                    "Name":  "Scheduled Actions Contributor",
|                                    "Description":  "Allows users to use Scheduled Actions offered by Microsoft.ComputeSchedule",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesCancelOperations/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteDeallocate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteHibernate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteStart/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteCreate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesExecuteDelete/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationErrors/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationStatus/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitDeallocate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitHibernate/action",
|                                                    "Microsoft.ComputeSchedule/locations/virtualMachinesSubmitStart/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/write",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/delete",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/attachResources/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/cancelNextOccurrence/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/detachResources/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/disable/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/enable/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/listResources/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/patchResources/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/triggerManualOccurrence/action",
|                                                    "Microsoft.ComputeSchedule/register/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b6d9c0f6-d69f-472b-91b4-7a6838c6d1cb",
|                                    "Name":  "Microsoft.AzureStackHCI Device Pool Machine Manager",
|                                    "Description":  "Microsoft.AzureStackHCI Device Pool Machine Manager ",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridConnectivity/endpoints/write",
|                                                    "Microsoft.HybridConnectivity/endpoints/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/delete",
|                                                    "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/write",
|                                                    "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/read",
|                                                    "Microsoft.HybridConnectivity/endpoints/serviceConfigurations/delete",
|                                                    "Microsoft.HybridConnectivity/endpoints/listCredentials/action",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8b9beb50-e28c-4879-8472-24c9d328085f",
|                                    "Name":  "AI Model Scanner Operator",
|                                    "Description":  "Grants Microsoft Defender for AI access to AI services and resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/models/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/models/versions/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/datastores/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/metadata/artifacts/read",
|                                                    "Microsoft.MachineLearningServices/registries/read",
|                                                    "Microsoft.MachineLearningServices/registries/assets/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c9f76ca8-b262-4b10-8ed2-09cf0948aa35",
|                                    "Name":  "Azure Kubernetes Service Namespace User",
|                                    "Description":  "Allows users to read Azure Kubernetes Service namespace resources. In-cluster namespace access further requires assignment of Azure Kubernetes Service RBAC roles to the namespace resource for an Entra ID enabled cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/managedClusters/managedNamespaces/read",
|                                                    "Microsoft.ContainerService/managedClusters/managedNamespaces/listCredential/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "289d8817-ee69-43f1-a0af-43a45505b488",
|                                    "Name":  "Azure Kubernetes Service Namespace Contributor",
|                                    "Description":  "Allows users to create and manage Azure Kubernetes Service namespace resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/managedClusters/managedNamespaces/*",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "76153a9e-0edb-49bc-8e01-93c47e6b5180",
|                                    "Name":  "DevOps Infrastructure Contributor",
|                                    "Description":  "Read, write, delete and perform actions on Managed DevOps Pools",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DevOpsInfrastructure/register/action",
|                                                    "Microsoft.DevOpsInfrastructure/unregister/action",
|                                                    "Microsoft.DevOpsInfrastructure/*/read",
|                                                    "Microsoft.DevOpsInfrastructure/Locations/OperationStatuses/write",
|                                                    "Microsoft.DevOpsInfrastructure/pools/write",
|                                                    "Microsoft.DevOpsInfrastructure/pools/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4c6569b6-f23e-4295-9b90-bd4cc4ff3292",
|                                    "Name":  "DevCenter Owner",
|                                    "Description":  "Provides access to manage all Microsoft.DevCenter resources, and to manage access to Microsoft.DevCenter resources by adding or removing role assignments for the DevCenter Project Admin and DevCenter Dev Box roles.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DevCenter/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "32c34659-0f83-4a4c-80f2-63a244f8ae0b",
|                                    "Name":  "Service Health Billing Reader",
|                                    "Description":  "Grants permissions to view billing information present in service health events",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ResourceHealth/events/action",
|                                                    "Microsoft.ResourceHealth/AvailabilityStatuses/read",
|                                                    "Microsoft.ResourceHealth/AvailabilityStatuses/current/read",
|                                                    "Microsoft.ResourceHealth/Operations/read",
|                                                    "Microsoft.ResourceHealth/emergingissues/read",
|                                                    "Microsoft.ResourceHealth/events/read",
|                                                    "Microsoft.ResourceHealth/events/fetchBillingCommunicationDetails/action",
|                                                    "Microsoft.ResourceHealth/events/impactedResources/read",
|                                                    "Microsoft.ResourceHealth/metadata/read",
|                                                    "Microsoft.ResourceHealth/potentialoutages/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.ResourceHealth/events/fetchEventDetails/action",
|                                                       "Microsoft.ResourceHealth/events/listSecurityAdvisoryImpactedResources/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1a928ab0-1fee-43cf-9266-f9d8c22a8ddb",
|                                    "Name":  "Service Health Security Reader",
|                                    "Description":  "Grants permissions to view sensitive security information present in service health events",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ResourceHealth/events/action",
|                                                    "Microsoft.ResourceHealth/AvailabilityStatuses/read",
|                                                    "Microsoft.ResourceHealth/AvailabilityStatuses/current/read",
|                                                    "Microsoft.ResourceHealth/Operations/read",
|                                                    "Microsoft.ResourceHealth/emergingissues/read",
|                                                    "Microsoft.ResourceHealth/events/read",
|                                                    "Microsoft.ResourceHealth/events/fetchEventDetails/action",
|                                                    "Microsoft.ResourceHealth/events/listSecurityAdvisoryImpactedResources/action",
|                                                    "Microsoft.ResourceHealth/events/impactedResources/read",
|                                                    "Microsoft.ResourceHealth/metadata/read",
|                                                    "Microsoft.ResourceHealth/potentialoutages/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.ResourceHealth/events/fetchBillingCommunicationDetails/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "12b8206a-0216-4469-908d-a3e2025fe085",
|                                    "Name":  "Azure Stack Edge Operations Role",
|                                    "Description":  "Built in role for managing operations in azure stack edge",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/bandwidthSchedules/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/bandwidthSchedules/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/deviceCapacityCheck/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/downloadUpdates/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/generateCertificate/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/getExtendedInformation/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/installUpdates/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/orders/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/orders/listDCAccessCode/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/orders/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/providers/Microsoft.Insights/diagnosticSettings/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/publishers/offers/skus/versions/generatesastoken/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/addons/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/addons/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/migrate/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/monitoringConfig/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/monitoringConfig/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/roles/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/scanForUpdates/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/securitySettings/update/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/shares/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/shares/refresh/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/shares/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccountCredentials/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccountCredentials/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/containers/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/containers/refresh/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/containers/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/storageAccounts/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/triggers/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/triggers/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/triggerSupportPackage/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/updateExtendedInformation/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/uploadCertificate/action",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/users/delete",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/users/write",
|                                                    "Microsoft.DataBoxEdge/dataBoxEdgeDevices/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2016c9ed-c18d-4120-93d7-178e583efe92",
|                                    "Name":  "Grounding with Bing User",
|                                    "Description":  "Enable Approved Microsoft Applications to connect to Bing to retrieve and ground responses using real-time data",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Bing/accounts/useGrounding/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "69a41f41-6dce-4ea7-8a34-8e095ddba55c",
|                                    "Name":  "Azure Advisor Service Role",
|                                    "Description":  "Grants permission to delete and write access for suppressions, configurations and assmessments",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Advisor/suppressions/write",
|                                                    "Microsoft.Advisor/suppressions/delete",
|                                                    "Microsoft.Advisor/recommendations/suppressions/write",
|                                                    "Microsoft.Advisor/recommendations/suppressions/delete",
|                                                    "Microsoft.Advisor/assessments/write",
|                                                    "Microsoft.Advisor/configurations/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "548d7e7c-65ee-412b-ae37-2dbb419d4207",
|                                    "Name":  "Experimentation Resource Admin",
|                                    "Description":  "Experimentation Resource Admin",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Experimentation/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "804db8d3-32c7-4ad4-a975-3f6f90d5f5f5",
|                                    "Name":  "FHIR Data Bulk Operator",
|                                    "Description":  "Role allows user or principal to perform bulk operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/read",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/write",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/delete",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/export/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/reindex/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/import/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/hardDelete/action",
|                                                        "Microsoft.HealthcareApis/services/fhir/resources/bulkOperator/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/read",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/write",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/delete",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/export/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/reindex/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/import/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/hardDelete/action",
|                                                        "Microsoft.HealthcareApis/workspaces/fhirservices/resources/bulkOperator/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3bb7c424-af4e-436b-bfcc-8779c8934c31",
|                                    "Name":  "Microsoft Discovery Platform Reader (Preview)",
|                                    "Description":  "Grants readonly permissions to view Microsoft.Discovery resources. This role in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Discovery/*/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Discovery/*/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7a2b6e6c-472e-4b39-8878-a26eb63d75c6",
|                                    "Name":  "Microsoft Discovery Platform Administrator (Preview)",
|                                    "Description":  "Grants full access to manage Microsoft.Discovery resources. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Discovery/locations/operationStatuses/read",
|                                                    "Microsoft.Discovery/checkNameAvailability/action",
|                                                    "Microsoft.Discovery/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Discovery/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "01288891-85ee-45a7-b367-9db3b752fc65",
|                                    "Name":  "Microsoft Discovery Platform Contributor (Preview)",
|                                    "Description":  "Grants permissions to view and operate on most Discovery platform resources, including workspaces, supercomputers, storages, agents, bookshelves, data containers, models, tools, workflows, and investigations, as well as perform data plane actions, but does not allow creating, updating, or deleting core resources such as workspaces, supercomputers, storages, bookshelves, node pools, or projects. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Discovery/locations/operationStatuses/read",
|                                                    "Microsoft.Discovery/operations/read",
|                                                    "Microsoft.Discovery/workspaces/read",
|                                                    "Microsoft.Discovery/supercomputers/read",
|                                                    "Microsoft.Discovery/storages/read",
|                                                    "Microsoft.Discovery/agents/*",
|                                                    "Microsoft.Discovery/bookshelves/read",
|                                                    "Microsoft.Discovery/dataContainers/*",
|                                                    "Microsoft.Discovery/dataContainers/dataAssets/*",
|                                                    "Microsoft.Discovery/storageContainers/*",
|                                                    "Microsoft.Discovery/storageContainers/storageAssets/*",
|                                                    "Microsoft.Discovery/models/*",
|                                                    "Microsoft.Discovery/supercomputers/nodePools/read",
|                                                    "Microsoft.Discovery/tools/*",
|                                                    "Microsoft.Discovery/workflows/*",
|                                                    "Microsoft.Discovery/workspaces/chatModelDeployments/read",
|                                                    "Microsoft.Discovery/workspaces/projects/read",
|                                                    "Microsoft.Discovery/operations/read",
|                                                    "Microsoft.Insights/AlertRules/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.Discovery/workspaces/write",
|                                                       "Microsoft.Discovery/workspaces/delete",
|                                                       "Microsoft.Discovery/supercomputers/write",
|                                                       "Microsoft.Discovery/supercomputers/delete",
|                                                       "Microsoft.Discovery/storages/write",
|                                                       "Microsoft.Discovery/storages/delete",
|                                                       "Microsoft.Discovery/bookshelves/write",
|                                                       "Microsoft.Discovery/bookshelves/delete",
|                                                       "Microsoft.Discovery/supercomputers/nodePools/write",
|                                                       "Microsoft.Discovery/supercomputers/nodePools/delete",
|                                                       "Microsoft.Discovery/workspaces/chatModelDeployments/write",
|                                                       "Microsoft.Discovery/workspaces/chatModelDeployments/delete",
|                                                       "Microsoft.Discovery/workspaces/projects/write",
|                                                       "Microsoft.Discovery/workspaces/projects/delete"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Discovery/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5bc02df6-6cd5-43fe-ad3d-4c93cf56cc16",
|                                    "Name":  "Azure IoT Operations Administrator",
|                                    "Description":  "View, create, edit and delete AIO resources. Manage all resources, including instance and its downstream resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.IoTOperations/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.DeviceRegistry/Assets/*",
|                                                    "Microsoft.DeviceRegistry/AssetEndpointProfiles/*",
|                                                    "Microsoft.DeviceRegistry/Namespaces/Assets/*",
|                                                    "Microsoft.DeviceRegistry/Namespaces/Devices/*",
|                                                    "Microsoft.DeviceRegistry/Namespaces/DiscoveredAssets/*",
|                                                    "Microsoft.DeviceRegistry/Namespaces/DiscoveredDevices/*",
|                                                    "Microsoft.DeviceRegistry/SchemaRegistries/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Edge/sites/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7b7c71ed-33fa-4ed2-a91a-e56d5da260b5",
|                                    "Name":  "Azure IoT Operations Onboarding",
|                                    "Description":  "User can Azure arc connect and deploy Azure IoT Operations securely.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.IoTOperations/*",
|                                                    "Microsoft.DeviceRegistry/register/action",
|                                                    "Microsoft.DeviceRegistry/schemaRegistries/read",
|                                                    "Microsoft.DeviceRegistry/schemaRegistries/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Edge/sites/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c459b115-f629-486b-b359-35feb5568b83",
|                                    "Name":  "Connector Writer",
|                                    "Description":  "Write connectors and have basic customer permissions like reading authorizations, alert rules and resourceGroups",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Impact/Connectors/Write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1abf4029-2200-4343-800c-e4c4c01eddbd",
|                                    "Name":  "Virtual Enclave Owner Role",
|                                    "Description":  "Virtual Enclave Owner Role to access the resources of Microsoft.Mission stored with RPSAAS.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Mission/Locations/OperationStatuses/read",
|                                                    "Microsoft.Mission/Locations/OperationStatuses/write",
|                                                    "Microsoft.Mission/Operations/read",
|                                                    "Microsoft.Mission/virtualEnclaves/read",
|                                                    "Microsoft.Mission/virtualEnclaves/write",
|                                                    "Microsoft.Mission/virtualEnclaves/delete",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/read",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/write",
|                                                    "Microsoft.Mission/virtualEnclaves/workloads/delete",
|                                                    "Microsoft.Mission/communities/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "61aed14c-6c9a-4ed5-aa44-49fc5e96a167",
|                                    "Name":  "NginxPlus Contributor service role",
|                                    "Description":  "Provides access to all Nginx.NginxPlus Control Plane operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "NGINX.NGINXPLUS/register/action",
|                                                    "NGINX.NGINXPLUS/unregister/action",
|                                                    "NGINX.NGINXPLUS/locations/read",
|                                                    "NGINX.NGINXPLUS/locations/operationStatuses/read",
|                                                    "NGINX.NGINXPLUS/locations/operationStatuses/write",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/Read",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/Write",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/Delete",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/apiKeys/Read",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/apiKeys/Write",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/apiKeys/Delete",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/certificates/Read",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/certificates/Write",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/certificates/Delete",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/configurations/Read",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/configurations/Write",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/configurations/Delete",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/wafPolicies/Read",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/wafPolicies/Write",
|                                                    "NGINX.NGINXPLUS/nginxDeployments/wafPolicies/Delete",
|                                                    "NGINX.NGINXPLUS/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "35ffec73-9cb8-4593-8718-40d5bc4b7f6f",
|                                    "Name":  "CosmosDB Fleet Operator Role",
|                                    "Description":  "Lets you manage Azure CosmosDB Fleets and related child resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DocumentDB/fleets/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "29f61507-bdfb-4987-b629-20033be2d6c3",
|                                    "Name":  "Healthcare Apis contributor",
|                                    "Description":  "Allows all actions on healthcareapis provider resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HealthcareApis/services/*",
|                                                    "Microsoft.HealthcareApis/workspaces/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "81b67e46-ef5b-4404-bddd-090985bb4a28",
|                                    "Name":  "Liftr Datadog Contributor",
|                                    "Description":  "Provides access to Datadog Control Plane Operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Datadog/register/action",
|                                                    "Microsoft.Datadog/unregister/action",
|                                                    "Microsoft.Datadog/agreements/read",
|                                                    "Microsoft.Datadog/agreements/write",
|                                                    "Microsoft.Datadog/locations/read",
|                                                    "Microsoft.Datadog/locations/operationStatuses/read",
|                                                    "Microsoft.Datadog/locations/operationStatuses/write",
|                                                    "Microsoft.Datadog/monitors/read",
|                                                    "Microsoft.Datadog/monitors/write",
|                                                    "Microsoft.Datadog/monitors/delete",
|                                                    "Microsoft.Datadog/monitors/listApiKeys/action",
|                                                    "Microsoft.Datadog/monitors/getDefaultKey/action",
|                                                    "Microsoft.Datadog/monitors/setDefaultKey/action",
|                                                    "Microsoft.Datadog/monitors/refreshSetPasswordLink/action",
|                                                    "Microsoft.Datadog/monitors/listLinkedResources/action",
|                                                    "Microsoft.Datadog/monitors/listHosts/read",
|                                                    "Microsoft.Datadog/monitors/listLinkedResources/read",
|                                                    "Microsoft.Datadog/monitors/listMonitoredResources/read",
|                                                    "Microsoft.Datadog/monitors/monitoredSubscriptions/read",
|                                                    "Microsoft.Datadog/monitors/monitoredSubscriptions/write",
|                                                    "Microsoft.Datadog/monitors/singleSignOnConfigurations/write",
|                                                    "Microsoft.Datadog/monitors/singleSignOnConfigurations/read",
|                                                    "Microsoft.Datadog/monitors/tagRules/read",
|                                                    "Microsoft.Datadog/monitors/tagRules/write",
|                                                    "Microsoft.Datadog/registeredSubscriptions/read",
|                                                    "Microsoft.Datadog/subscriptionStatuses/read",
|                                                    "Microsoft.Datadog/operations/read",
|                                                    "Microsoft.Datadog/monitors/getDefaultApplicationKey/action",
|                                                    "Microsoft.Datadog/monitors/manageSreAgentConnectors/action",
|                                                    "Microsoft.Datadog/monitors/latestLinkedSaaS/action",
|                                                    "Microsoft.Datadog/monitors/linkSaaS/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d68eeb8d-afae-4932-a331-203b7957e509",
|                                    "Name":  "Liftr Elastic Contributor",
|                                    "Description":  "Provides access to Elastic Control Plane Operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Elastic/getOrganizationApiKey/action",
|                                                    "Microsoft.Elastic/checkNameAvailability/action",
|                                                    "Microsoft.Elastic/register/action",
|                                                    "Microsoft.Elastic/locations/read",
|                                                    "Microsoft.Elastic/locations/operationStatuses/read",
|                                                    "Microsoft.Elastic/locations/operationStatuses/write",
|                                                    "Microsoft.Elastic/monitors/read",
|                                                    "Microsoft.Elastic/monitors/write",
|                                                    "Microsoft.Elastic/monitors/delete",
|                                                    "Microsoft.Elastic/monitors/listMonitoredResources/action",
|                                                    "Microsoft.Elastic/monitors/listVMHost/action",
|                                                    "Microsoft.Elastic/monitors/createOrUpdateExternalUser/action",
|                                                    "Microsoft.Elastic/monitors/listAllTrafficFilters/action",
|                                                    "Microsoft.Elastic/monitors/listAssociatedTrafficFilters/action",
|                                                    "Microsoft.Elastic/monitors/createAndAssociateIPFilter/action",
|                                                    "Microsoft.Elastic/monitors/createAndAssociatePLFilter/action",
|                                                    "Microsoft.Elastic/monitors/associateTrafficFilter/action",
|                                                    "Microsoft.Elastic/monitors/detachAndDeleteTrafficFilter/action",
|                                                    "Microsoft.Elastic/monitors/detachTrafficFilter/action",
|                                                    "Microsoft.Elastic/monitors/deleteTrafficFilter/action",
|                                                    "Microsoft.Elastic/monitors/listUpgradableVersions/action",
|                                                    "Microsoft.Elastic/monitors/getBillingInfo/action",
|                                                    "Microsoft.Elastic/monitors/listConnectedPartnerResources/action",
|                                                    "Microsoft.Elastic/monitors/upgrade/action",
|                                                    "Microsoft.Elastic/monitors/vmIngestionDetails/action",
|                                                    "Microsoft.Elastic/monitors/vmCollectionUpdate/action",
|                                                    "Microsoft.Elastic/monitors/listDeploymentInfo/action",
|                                                    "Microsoft.Elastic/monitors/resubscribe/action",
|                                                    "Microsoft.Elastic/monitors/monitoredSubscriptions/read",
|                                                    "Microsoft.Elastic/monitors/monitoredSubscriptions/write",
|                                                    "Microsoft.Elastic/monitors/openAIIntegrations/read",
|                                                    "Microsoft.Elastic/monitors/openAIIntegrations/write",
|                                                    "Microsoft.Elastic/monitors/openAIIntegrations/getStatus/action",
|                                                    "Microsoft.Elastic/monitors/tagRules/read",
|                                                    "Microsoft.Elastic/monitors/tagRules/write",
|                                                    "Microsoft.Elastic/registeredSubscriptions/read",
|                                                    "Microsoft.Elastic/elasticVersions/read",
|                                                    "Microsoft.Elastic/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "225efd4d-4ca0-42a1-ae53-5f233ba23c73",
|                                    "Name":  "Liftr Elastic Owner",
|                                    "Description":  "Grants full access to manage Elastic resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Elastic/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a60da355-bdec-443f-8d42-a03f0422f04d",
|                                    "Name":  "Liftr Newrelic Contributor",
|                                    "Description":  "Provides access to Newrelic Control Plane Operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "NewRelic.Observability/register/action",
|                                                    "NewRelic.Observability/unregister/action",
|                                                    "NewRelic.Observability/accounts/read",
|                                                    "NewRelic.Observability/plans/read",
|                                                    "NewRelic.Observability/organizations/read",
|                                                    "NewRelic.Observability/locations/read",
|                                                    "NewRelic.Observability/locations/operationStatuses/read",
|                                                    "NewRelic.Observability/locations/operationStatuses/write",
|                                                    "NewRelic.Observability/monitors/read",
|                                                    "NewRelic.Observability/monitors/write",
|                                                    "NewRelic.Observability/monitors/delete",
|                                                    "NewRelic.Observability/monitors/monitoredResources/action",
|                                                    "NewRelic.Observability/monitors/vmHostPayloads/action",
|                                                    "NewRelic.Observability/monitors/listAppServices/action",
|                                                    "NewRelic.Observability/monitors/listHosts/action",
|                                                    "NewRelic.Observability/monitors/refreshIngestionKey/action",
|                                                    "NewRelic.Observability/monitors/getMetricRules/action",
|                                                    "NewRelic.Observability/monitors/getMetricStatus/action",
|                                                    "NewRelic.Observability/monitors/switchBilling/action",
|                                                    "NewRelic.Observability/monitors/latestLinkedSaaS/action",
|                                                    "NewRelic.Observability/monitors/linkSaaS/action",
|                                                    "NewRelic.Observability/monitors/resubscribe/action",
|                                                    "NewRelic.Observability/monitors/getBillingInfo/action",
|                                                    "NewRelic.Observability/monitors/listConnectedPartnerResources/action",
|                                                    "NewRelic.Observability/monitors/listLinkedResources/action",
|                                                    "NewRelic.Observability/monitors/monitoredSubscriptions/read",
|                                                    "NewRelic.Observability/monitors/monitoredSubscriptions/write",
|                                                    "NewRelic.Observability/monitors/tagRules/read",
|                                                    "NewRelic.Observability/monitors/tagRules/write",
|                                                    "NewRelic.Observability/registeredSubscriptions/read",
|                                                    "NewRelic.Observability/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "285ce6d6-fa11-43bd-94ef-42a9b3740bfd",
|                                    "Name":  "Policy Enrollments Contributor",
|                                    "Description":  "Allows the creation and modification of policy enrollments",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/policyenrollments/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.PolicyInsights/*",
|                                                    "Microsoft.Resources/deployments/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fa96a588-3fac-4adb-bfb2-f8404ece07e0",
|                                    "Name":  "Liftr Dynatrace Contributor",
|                                    "Description":  "Provides access to Dynatrace Control Plane Operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Dynatrace.Observability/checkNameAvailability/action",
|                                                    "Dynatrace.Observability/register/action",
|                                                    "Dynatrace.Observability/unregister/action",
|                                                    "Dynatrace.Observability/getMarketplaceSaaSResourceDetails/action",
|                                                    "Dynatrace.Observability/locations/read",
|                                                    "Dynatrace.Observability/locations/operationStatuses/read",
|                                                    "Dynatrace.Observability/locations/operationStatuses/write",
|                                                    "Dynatrace.Observability/monitors/read",
|                                                    "Dynatrace.Observability/monitors/write",
|                                                    "Dynatrace.Observability/monitors/delete",
|                                                    "Dynatrace.Observability/monitors/listMonitoredResources/action",
|                                                    "Dynatrace.Observability/monitors/getVMHostPayload/action",
|                                                    "Dynatrace.Observability/monitors/listHosts/action",
|                                                    "Dynatrace.Observability/monitors/listAppServices/action",
|                                                    "Dynatrace.Observability/monitors/getSSODetails/action",
|                                                    "Dynatrace.Observability/monitors/listLinkableEnvironments/action",
|                                                    "Dynatrace.Observability/monitors/getMetricStatus/action",
|                                                    "Dynatrace.Observability/monitors/manageAgentInstallation/action",
|                                                    "Dynatrace.Observability/monitors/monitoredSubscriptions/read",
|                                                    "Dynatrace.Observability/monitors/monitoredSubscriptions/write",
|                                                    "Dynatrace.Observability/monitors/singleSignOnConfigurations/write",
|                                                    "Dynatrace.Observability/monitors/singleSignOnConfigurations/read",
|                                                    "Dynatrace.Observability/monitors/tagRules/read",
|                                                    "Dynatrace.Observability/monitors/tagRules/write",
|                                                    "Dynatrace.Observability/registeredSubscriptions/read",
|                                                    "Dynatrace.Observability/operations/read",
|                                                    "Dynatrace.Observability/monitors/manageSreAgentConnectors/action",
|                                                    "Dynatrace.Observability/monitors/latestLinkedSaaS/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "79732128-7761-4733-aebf-35590da9f29b",
|                                    "Name":  "Microsoft.OffAzureSpringBoot Service Owner",
|                                    "Description":  "Full access to Azure Microsoft.OffAzureSpringBoot Service REST APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.OffAzureSpringBoot/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "46c70067-0f50-457f-8137-2449c90de518",
|                                    "Name":  "Nexus Network Fabric Owner",
|                                    "Description":  "Provides owner access to nexus network fabric resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ManagedNetworkFabric/*/read",
|                                                    "Microsoft.ManagedNetworkFabric/*/write",
|                                                    "Microsoft.ManagedNetworkFabric/*/action",
|                                                    "Microsoft.ManagedNetworkFabric/*/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "374a1cc6-96cb-4946-8d8b-a41054c8ae97",
|                                    "Name":  "Nexus Identity Owner",
|                                    "Description":  "Provides owner access to nexusidentity resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.NexusIdentity/*/read",
|                                                    "Microsoft.NexusIdentity/*/write",
|                                                    "Microsoft.NexusIdentity/*/action",
|                                                    "Microsoft.NexusIdentity/*/delete",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b3eb788f-5426-48bd-821d-561701ede368",
|                                    "Name":  "Conversation Session User",
|                                    "Description":  "Allows sending a message to the agent and receive a response, using the conversation session API",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthBot/healthBots/ConversationSession/Action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "eded264d-1796-4e25-8500-a78427f8a316",
|                                    "Name":  "Azure Data Transfer Owner",
|                                    "Description":  "Create, read, modify, and delete pipelines, connections, and flows in Azure Data Transfer. Also perform any appropriate control plane operations for managing Azure Data Transfer resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureDataTransfer/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bf41e52e-617f-4981-8b7a-47431bd4e011",
|                                    "Name":  "CosmosDB Fleet Analytics Storage Data Writer",
|                                    "Description":  "Write telemetry data from the Fleet Analytics Synapse workspace to customer-provided storage accounts or Fabric Lakehouses.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3f99eaab-6f59-4877-adf5-1cacd22e20b0",
|                                    "Name":  "Video Indexer Account Contributor",
|                                    "Description":  "Can manage Video Indexer Account resources and generate access tokens for data plane operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.VideoIndexer/checknameavailability/action",
|                                                    "Microsoft.VideoIndexer/accounts/generateAccessToken/action",
|                                                    "Microsoft.VideoIndexer/accounts/generateRestrictedViewerAccessToken/action",
|                                                    "Microsoft.VideoIndexer/accounts/generateExtensionAccessToken/action",
|                                                    "Microsoft.VideoIndexer/accounts/generateExtensionRestrictedViewerAccessToken/action",
|                                                    "Microsoft.VideoIndexer/accounts/read",
|                                                    "Microsoft.VideoIndexer/accounts/write",
|                                                    "Microsoft.VideoIndexer/accounts/delete",
|                                                    "Microsoft.VideoIndexer/accounts/PrivateEndpointConnectionsApproval/action",
|                                                    "Microsoft.VideoIndexer/accounts/privateEndpointConnections/read",
|                                                    "Microsoft.VideoIndexer/accounts/privateEndpointConnections/write",
|                                                    "Microsoft.VideoIndexer/accounts/privateEndpointConnections/delete",
|                                                    "Microsoft.VideoIndexer/accounts/privateLinkResources/read",
|                                                    "Microsoft.VideoIndexer/locations/operationstatuses/read",
|                                                    "Microsoft.VideoIndexer/locations/operationstatuses/write",
|                                                    "Microsoft.VideoIndexer/operations/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f4eb044f-76b9-47af-92f9-1d95c4c14ab5",
|                                    "Name":  "Azure Business Continuity DUPI Reader",
|                                    "Description":  "Lets you view Deleted Unified Protected items in Azure Business Continuity Center.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleDefinitions/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.AzureBusinessContinuity/deletedUnifiedProtectedItems/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "59f98be6-0817-488b-831e-36a353c8000b",
|                                    "Name":  "Sites Reader",
|                                    "Description":  "View all Sites related resources but does not allow you to make any changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Edge/sites/read",
|                                                    "Microsoft.Edge/configurations/read",
|                                                    "Microsoft.Edge/configurations/networkConfigurations/read",
|                                                    "Microsoft.Edge/configurations/securityConfigurations/read",
|                                                    "Microsoft.Edge/configurations/timeServerConfigurations/read",
|                                                    "Microsoft.Edge/configurations/connectivityConfigurations/read",
|                                                    "Microsoft.Edge/configurations/provisioningConfigurations/read",
|                                                    "Microsoft.Edge/configurations/arcGatewayConfigurations/read",
|                                                    "Microsoft.Edge/configurationReferences/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1cd7e4da-2789-457f-adbe-3e9e84037a93",
|                                    "Name":  "Sites Owner",
|                                    "Description":  "Microsoft Edge Sites Owner role - Grants full access to manage all resources, including the ability to assign roles in Azure RBAC.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Edge/sites/read",
|                                                    "Microsoft.Edge/sites/write",
|                                                    "Microsoft.Edge/sites/delete",
|                                                    "Microsoft.Edge/configurations/read",
|                                                    "Microsoft.Edge/configurations/write",
|                                                    "Microsoft.Edge/configurations/delete",
|                                                    "Microsoft.Edge/configurations/networkConfigurations/read",
|                                                    "Microsoft.Edge/configurations/networkConfigurations/write",
|                                                    "Microsoft.Edge/configurations/networkConfigurations/delete",
|                                                    "Microsoft.Edge/configurations/securityConfigurations/read",
|                                                    "Microsoft.Edge/configurations/securityConfigurations/write",
|                                                    "Microsoft.Edge/configurations/securityConfigurations/delete",
|                                                    "Microsoft.Edge/configurations/timeServerConfigurations/read",
|                                                    "Microsoft.Edge/configurations/timeServerConfigurations/write",
|                                                    "Microsoft.Edge/configurations/timeServerConfigurations/delete",
|                                                    "Microsoft.Edge/configurations/connectivityConfigurations/read",
|                                                    "Microsoft.Edge/configurations/connectivityConfigurations/write",
|                                                    "Microsoft.Edge/configurations/connectivityConfigurations/delete",
|                                                    "Microsoft.Edge/configurations/provisioningConfigurations/read",
|                                                    "Microsoft.Edge/configurations/provisioningConfigurations/write",
|                                                    "Microsoft.Edge/configurations/provisioningConfigurations/delete",
|                                                    "Microsoft.Edge/configurations/arcGatewayConfigurations/read",
|                                                    "Microsoft.Edge/configurations/arcGatewayConfigurations/write",
|                                                    "Microsoft.Edge/configurations/arcGatewayConfigurations/delete",
|                                                    "Microsoft.Edge/configurationReferences/read",
|                                                    "Microsoft.Edge/configurationReferences/write",
|                                                    "Microsoft.Edge/configurationReferences/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "85546f1f-f28b-4cb3-b852-73e422a96897",
|                                    "Name":  "Liftr PureStorage Owner role",
|                                    "Description":  "Provides access to all PureStorage related operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "PureStorage.Block/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d683b71b-2b91-4fc1-a43e-b53b3d85bed9",
|                                    "Name":  "Liftr Dell Owner role",
|                                    "Description":  "Provides access to all Dell related operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Dell.Storage/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6d6f52ba-a7de-4c56-a58f-522154514fba",
|                                    "Name":  "SupportPlan Contributor",
|                                    "Description":  "Contributor role for Enterprise Support Resource Provider",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.EnterpriseSupport/services/delete",
|                                                    "Microsoft.EnterpriseSupport/services/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4037dd68-1cc7-4a64-8765-3a79963a9940",
|                                    "Name":  "Azure Spring Apps Service Owner",
|                                    "Description":  "Full access to Azure Spring Apps Service REST APIs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppPlatform/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.AppPlatform/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "25cabde7-1a6c-4350-8877-cb6fe59f1399",
|                                    "Name":  "Azure AI Enterprise Networking Outbound Rules Operator",
|                                    "Description":  "A Built-in role that can authorize users to access and update the managed network settings of a machine learning workspace.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.MachineLearningServices/workspaces/managedNetworks/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/managedNetworks/write",
|                                                    "Microsoft.MachineLearningServices/workspaces/managedNetworks/outboundRules/read",
|                                                    "Microsoft.MachineLearningServices/workspaces/managedNetworks/outboundRules/write",
|                                                    "Microsoft.MachineLearningServices/workspaces/managedNetworks/outboundRules/delete",
|                                                    "Microsoft.MachineLearningServices/workspaces/managedNetworks/batchOutboundRules/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3b5a0aa9-eccd-48dc-9011-f2fd03b5e5f9",
|                                    "Name":  "Azure Business Continuity UPI Reader",
|                                    "Description":  "Lets you view Unified Protected items in Azure Business Continuity Center.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleDefinitions/read",
|                                                    "Microsoft.Authorization/roleAssignments/read",
|                                                    "Microsoft.AzureBusinessContinuity/unifiedProtectedItems/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dd799a69-ffc8-4aa8-9701-b51f686857d9",
|                                    "Name":  "Pinecone.VectorDb Contributor Role",
|                                    "Description":  "Provides access to all Pinecone.VectorDb related operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Pinecone.VectorDb/checkNameAvailability/action",
|                                                    "Pinecone.VectorDb/register/action",
|                                                    "Pinecone.VectorDb/unregister/action",
|                                                    "Pinecone.VectorDb/locations/operationStatuses/read",
|                                                    "Pinecone.VectorDb/locations/operationStatuses/write",
|                                                    "Pinecone.VectorDb/operations/read",
|                                                    "Pinecone.VectorDb/organizations/read",
|                                                    "Pinecone.VectorDb/organizations/write",
|                                                    "Pinecone.VectorDb/organizations/delete",
|                                                    "Pinecone.VectorDb/registeredSubscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "246fffca-69ee-4945-bbf1-2a867dce4fda",
|                                    "Name":  "Microsoft.WeightsAndBiases Contributor Role",
|                                    "Description":  "Provides access to all Microsoft.WeightsAndBiases related operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.WeightsAndBiases/checkNameAvailability/action",
|                                                    "Microsoft.WeightsAndBiases/register/action",
|                                                    "Microsoft.WeightsAndBiases/unregister/action",
|                                                    "Microsoft.WeightsAndBiases/instances/read",
|                                                    "Microsoft.WeightsAndBiases/instances/write",
|                                                    "Microsoft.WeightsAndBiases/instances/delete",
|                                                    "Microsoft.WeightsAndBiases/locations/operationStatuses/read",
|                                                    "Microsoft.WeightsAndBiases/locations/operationStatuses/write",
|                                                    "Microsoft.WeightsAndBiases/operations/read",
|                                                    "Microsoft.WeightsAndBiases/registeredSubscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "44a00263-b2a0-45d5-a618-5d8d11709349",
|                                    "Name":  "LambdaTest.HyperExecute Contributor Role",
|                                    "Description":  "Provides access to all LambdaTest.HyperExecute related operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "LambdaTest.HyperExecute/checkNameAvailability/action",
|                                                    "LambdaTest.HyperExecute/register/action",
|                                                    "LambdaTest.HyperExecute/unregister/action",
|                                                    "LambdaTest.HyperExecute/locations/operationStatuses/read",
|                                                    "LambdaTest.HyperExecute/locations/operationStatuses/write",
|                                                    "LambdaTest.HyperExecute/operations/read",
|                                                    "LambdaTest.HyperExecute/organizations/read",
|                                                    "LambdaTest.HyperExecute/organizations/write",
|                                                    "LambdaTest.HyperExecute/organizations/delete",
|                                                    "LambdaTest.HyperExecute/registeredSubscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dca88c6f-5090-44cd-a0ff-a88f337b12a5",
|                                    "Name":  "ArizeAi.ObservabilityEval Contributor Role",
|                                    "Description":  "Provides access to all ArizeAi.ObservabilityEval related operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "ArizeAi.ObservabilityEval/checkNameAvailability/action",
|                                                    "ArizeAi.ObservabilityEval/register/action",
|                                                    "ArizeAi.ObservabilityEval/unregister/action",
|                                                    "ArizeAi.ObservabilityEval/locations/operationStatuses/read",
|                                                    "ArizeAi.ObservabilityEval/locations/operationStatuses/write",
|                                                    "ArizeAi.ObservabilityEval/operations/read",
|                                                    "ArizeAi.ObservabilityEval/organizations/read",
|                                                    "ArizeAi.ObservabilityEval/organizations/write",
|                                                    "ArizeAi.ObservabilityEval/organizations/delete",
|                                                    "ArizeAi.ObservabilityEval/registeredSubscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "376d0802-aca8-4c2d-83a5-c88630f396fe",
|                                    "Name":  "Recurring Scheduled Actions Contributor",
|                                    "Description":  "Allows users to use Recurring Scheduled Actions offered by Microsoft.ComputeSchedule",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ComputeSchedule/scheduledActions/write",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/delete",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/attachResources/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/cancelNextOccurrence/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/detachResources/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/disable/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/enable/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/listResources/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/patchResources/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/triggerManualOccurrence/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/occurrences/cancel/action",
|                                                    "Microsoft.ComputeSchedule/scheduledActions/occurrences/delay/action",
|                                                    "Microsoft.ComputeSchedule/register/action",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ff09793b-be48-49f6-ad96-70d32039c0b9",
|                                    "Name":  "Azure Resilience Management Drills Operator",
|                                    "Description":  "Operator Role of Azure Resilience Management Drills Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/action",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/write",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                    "Microsoft.Insights/alertRules/",
|                                                    "Microsoft.Monitor/accounts/read",
|                                                    "Microsoft.Monitor/slis/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e131102b-11a5-4ff4-8508-ed922132b74c",
|                                    "Name":  "Azure Resilience Management Drills Contributor",
|                                    "Description":  "Contributor Role of Azure Resilience Management Drills Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/action",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/delete",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/write",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/delete",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c914561b-1575-4601-af9c-a1356bf59818",
|                                    "Name":  "Azure Resilience Management Drills Administrator",
|                                    "Description":  "Administrator Role of Azure Resilience Management Drills Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/action",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/delete",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/*/write",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/delete",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d2e8fe82-9212-490f-af3e-34bb52d87d3d",
|                                    "Name":  "Azure Resilience Management Drills Reader",
|                                    "Description":  "Reader Role of Azure Resilience Management Drills Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/",
|                                                    "Microsoft.Resources/deployments/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/drillResources/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/drillRuns/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/drillRuns/drillRunChildJobs/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/drillRuns/drillRunResources/read",
|                                                    "Microsoft.AzureResilienceManagement/drills/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f24a559b-c2fc-4409-b96e-9af4b0c28ad6",
|                                    "Name":  "Edge Order Partner Inventory Manager Service Role",
|                                    "Description":  "Manage inventory metadata and inventory links associated with Edge Order Partner scenarios. Enables configuration and control of inventory resources for tracking and fulfillment purposes",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EdgeOrderPartner/locations/productFamilies/inventories/manageLink/action",
|                                                    "Microsoft.EdgeOrderPartner/locations/productFamilies/inventories/manageInventoryMetadata/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c5c82243-e78e-43f9-8428-793bba85b28e",
|                                    "Name":  "Defender For Container Registries Operator",
|                                    "Description":  "Grants Microsoft Defender for Cloud access to Azure Container Registries",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerRegistry/registries/pull/read",
|                                                    "Microsoft.ContainerRegistry/registries/metadata/read",
|                                                    "Microsoft.ContainerRegistry/registries/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerRegistry/registries/repositories/content/read",
|                                                        "Microsoft.ContainerRegistry/registries/repositories/metadata/read",
|                                                        "Microsoft.ContainerRegistry/registries/catalog/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fdb3df26-8dd6-49ff-9a74-e95dbfadcad3",
|                                    "Name":  "Change Safety Contributor",
|                                    "Description":  "Grants access to manage all Microsoft.ChangeSafety resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ChangeSafety/changeStates/read",
|                                                    "Microsoft.ChangeSafety/changeStates/write",
|                                                    "Microsoft.ChangeSafety/changeStates/delete",
|                                                    "Microsoft.ChangeSafety/changeRecords/read",
|                                                    "Microsoft.ChangeSafety/changeRecords/write",
|                                                    "Microsoft.ChangeSafety/changeRecords/delete",
|                                                    "Microsoft.ChangeSafety/changeStates/stageProgressions/read",
|                                                    "Microsoft.ChangeSafety/changeStates/stageProgressions/write",
|                                                    "Microsoft.ChangeSafety/changeStates/stageProgressions/delete",
|                                                    "Microsoft.ChangeSafety/changeRecords/stageProgressions/read",
|                                                    "Microsoft.ChangeSafety/changeRecords/stageProgressions/write",
|                                                    "Microsoft.ChangeSafety/changeRecords/stageProgressions/delete",
|                                                    "Microsoft.ChangeSafety/locations/operationstatuses/read",
|                                                    "Microsoft.ChangeSafety/locations/operationstatuses/write",
|                                                    "Microsoft.ChangeSafety/safeRollouts/read",
|                                                    "Microsoft.ChangeSafety/safeRollouts/write",
|                                                    "Microsoft.ChangeSafety/safeRollouts/delete",
|                                                    "Microsoft.ChangeSafety/safeRollouts/steps/read",
|                                                    "Microsoft.ChangeSafety/stageMaps/read",
|                                                    "Microsoft.ChangeSafety/stageMaps/write",
|                                                    "Microsoft.ChangeSafety/stageMaps/delete",
|                                                    "Microsoft.ChangeSafety/validations/read",
|                                                    "Microsoft.ChangeSafety/validations/write",
|                                                    "Microsoft.ChangeSafety/validations/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d0a94e7a-d791-4571-b2e0-8bdd8f867544",
|                                    "Name":  "Clinical Coder Data User",
|                                    "Description":  "Allows processing of health data in Clinical Coder",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthBot/healthBots/AIActions/ClinicalCoder/Process/Action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "40ead2a5-466e-4039-8a80-325542d9d2dd",
|                                    "Name":  "Defender Unified RBAC Data Manager",
|                                    "Description":  "Defender Unified RBAC Data Manager. This role is managed and assigned automatically by the Defender Unified RBAC system. Manual assignment of this role is not recommended, as the Defender Unified RBAC system may modify or remove it at any time based on system requirements.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.operationalinsights/workspaces/read",
|                                                    "Microsoft.operationalinsights/workspaces/write",
|                                                    "Microsoft.operationalinsights/workspaces/query/read",
|                                                    "Microsoft.operationalinsights/workspaces/tables/write",
|                                                    "Microsoft.operationalinsights/workspaces/tables/delete",
|                                                    "Microsoft.operationalinsights/workspaces/sharedkeys/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "478d20ba-a53e-4946-b33c-8078a92f2d0a",
|                                    "Name":  "Azure Local Disconnected Operations Role",
|                                    "Description":  "Azure Local Disconnected Operations Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Edge/disconnectedOperations/*/read",
|                                                    "Microsoft.Edge/disconnectedOperations/*/write",
|                                                    "Microsoft.Edge/disconnectedOperations/*/delete",
|                                                    "Microsoft.Edge/winfields/*/read",
|                                                    "Microsoft.Edge/winfields/*/write",
|                                                    "Microsoft.Edge/winfields/*/delete",
|                                                    "Microsoft.Edge/winfields/*/action",
|                                                    "Microsoft.Edge/disconnectedOperations/*/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cbb820e9-e561-45bb-84c2-ef45d0a13f7d",
|                                    "Name":  "Workload Orchestration Administrator",
|                                    "Description":  "Workload Orchestration Administrator Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Edge/contexts/*",
|                                                    "Microsoft.Edge/configTemplates/*",
|                                                    "Microsoft.Edge/solutionTemplates/*",
|                                                    "Microsoft.Edge/configurations/*",
|                                                    "Microsoft.Edge/configurationreferences/*",
|                                                    "Microsoft.Edge/schemas/*",
|                                                    "Microsoft.Edge/schemaReferences/*",
|                                                    "Microsoft.Edge/targets/*",
|                                                    "Microsoft.Edge/jobs/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2a94a2fd-3c4f-45d1-847d-6585ba88af94",
|                                    "Name":  "Firmware Analysis Reader",
|                                    "Description":  "View firmware images but not upload them or perform any workspace configuration",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.IoTFirmwareDefense/*/read",
|                                                    "Microsoft.IoTFirmwareDefense/workspaces/firmwares/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.IoTFirmwareDefense/firmwareGroups/*",
|                                                       "Microsoft.IoTFirmwareDefense/workspaces/firmwares/write",
|                                                       "Microsoft.IoTFirmwareDefense/workspaces/firmwares/delete"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "04f6c337-ffae-414c-b00f-3e80c9ab8a2c",
|                                    "Name":  "Garnet Data Owner",
|                                    "Description":  "Allows read, write, destructive and scripting actions on the Garnet resource",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1694e55a-2496-4d07-b005-7259aa3fcbe8",
|                                    "Name":  "Garnet Data Contributor",
|                                    "Description":  "Allows read and write access to all keys within the Garnet resource",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/append/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/bzmpop/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/bzpopmax/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/bzpopmin/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/decr/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/decrby/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/del/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/exists/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/expire/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/get/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/getdel/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/getex/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/getrange/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/getset/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hdel/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hexists/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hexpire/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hexpireat/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hexpiretime/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hgetall/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hincrby/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hincrbyfloat/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/histogram/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hkeys/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hlen/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hmget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hmset/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hpersist/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hpexpire/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hpexpireat/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hpexpiretime/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hpttl/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hrandfield/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hscan/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hset/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hsetnx/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hstrlen/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/httl/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hvals/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/incr/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/incrby/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/incrbyfloat/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/lcs/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/mget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/mset/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/msetnx/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/psetex/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/readonly/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/readwrite/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sadd/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/scard/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sdiff/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sdiffstore/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/set/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/setex/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/setnx/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/setrange/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sinter/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sintercard/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sinterstore/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sismember/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/slots/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/smembers/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/smismember/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/smove/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/spop/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/srandmember/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/srem/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sscan/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/strlen/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/substr/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sunion/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sunionstore/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/unlink/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zadd/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zcard/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zcount/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zdiff/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zdiffstore/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zincrby/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zinter/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zintercard/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zinterstore/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zlexcount/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zmpop/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zmscore/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zpopmax/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zpopmin/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrandmember/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrange/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrangebylex/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrangebyscore/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrangestore/write",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrank/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrem/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zremrangebylex/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zremrangebyrank/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zremrangebyscore/delete",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrevrange/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrevrangebylex/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrevrangebyscore/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrevrank/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zscan/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zscore/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zunion/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zunionstore/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d9cd91b9-dada-4fa9-9406-454c4659c137",
|                                    "Name":  "Garnet Data Reader",
|                                    "Description":  "Allows read access to all keys within the Garnet resource",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/exists/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/get/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/getex/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/getrange/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hexists/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hexpiretime/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hgetall/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/histogram/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hkeys/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hlen/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hmget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hpexpiretime/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hpttl/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hrandfield/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hscan/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hstrlen/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/httl/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/hvals/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/lcs/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/mget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/readonly/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/scard/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sdiff/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sinter/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sintercard/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sismember/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/slots/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/smembers/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/smismember/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/srandmember/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sscan/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/strlen/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/substr/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/sunion/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zcard/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zcount/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zdiff/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zinter/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zintercard/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zlexcount/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zmscore/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrandmember/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrange/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrangebylex/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrangebyscore/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrank/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrevrange/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrevrangebylex/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrevrangebyscore/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zrevrank/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zscan/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zscore/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/zunion/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7021ea36-e168-4bc0-af53-88de51d20665",
|                                    "Name":  "Garnet Script Data Contributor",
|                                    "Description":  "Allows execution and management of scripts on the Garnet resource",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/scripteval/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/scriptevalsha/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/scriptexists/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/scriptflush/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/scriptload/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/slots/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1fd5d8bf-9037-4ede-89bf-680f798e2765",
|                                    "Name":  "Defender Unified RBAC Authorization Manager",
|                                    "Description":  "Defender Unified RBAC Authorization Manager. This role is managed and assigned automatically by the Defender Unified RBAC system. Manual assignment of this role is not recommended, as the Defender Unified RBAC system may modify or remove it at any time based on system requirements.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "78b7345a-1e1b-483a-ac62-62228c6ea89d",
|                                    "Name":  "Defender Unified RBAC Reader",
|                                    "Description":  "Defender Unified RBAC Reader. This role is managed and assigned automatically by the Defender Unified RBAC system. Manual assignment of this role is not recommended, as the Defender Unified RBAC system may modify or remove it at any time based on system requirements.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SecurityInsights/*/read",
|                                                    "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                    "Microsoft.OperationalInsights/workspaces/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/LinkedServices/read",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                    "Microsoft.OperationalInsights/querypacks/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.Insights/workbooks/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                       "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.OperationalInsights/workspaces/tables/data/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "625a1cea-653b-4a19-bd3a-df1d66ab6637",
|                                    "Name":  "Defender Unified RBAC Contributor and Responder",
|                                    "Description":  "Defender Unified RBAC Contributor and Responder. This role is managed and assigned automatically by the Defender Unified RBAC system. Manual assignment of this role is not recommended, as the Defender Unified RBAC system may modify or remove it at any time based on system requirements.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.OperationalInsights/querypacks/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/read",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/*",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.SecurityInsights/*",
|                                                    "Microsoft.SecurityInsights/*/read",
|                                                    "Microsoft.SecurityInsights/automationRules/*",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/systems/undoAction/action",
|                                                    "Microsoft.SecurityInsights/cases/*",
|                                                    "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                    "Microsoft.SecurityInsights/entities/runPlaybook/action",
|                                                    "Microsoft.SecurityInsights/incidents/*",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/bulkTag/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/replaceTags/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                    "Microsoft.Insights/workbooks/*",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.SecurityInsights/cases/*/Delete",
|                                                       "Microsoft.SecurityInsights/incidents/*/Delete",
|                                                       "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                       "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ca62263b-07d5-4b48-b437-088803f5c2ff",
|                                    "Name":  "Defender Unified RBAC Authorization Reader",
|                                    "Description":  "Defender Unified RBAC Authorization Reader. This role is managed and assigned automatically by the Defender Unified RBAC system. Manual assignment of this role is not recommended, as the Defender Unified RBAC system may modify or remove it at any time based on system requirements.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1bacae94-6c0f-4d2d-8dfa-408d5a28e6ec",
|                                    "Name":  "Defender Unified RBAC Responder",
|                                    "Description":  "Defender Unified RBAC Responder. This role is managed and assigned automatically by the Defender Unified RBAC system. Manual assignment of this role is not recommended, as the Defender Unified RBAC system may modify or remove it at any time based on system requirements.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SecurityInsights/*/read",
|                                                    "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                    "Microsoft.SecurityInsights/automationRules/*",
|                                                    "Microsoft.SecurityInsights/cases/*",
|                                                    "Microsoft.SecurityInsights/incidents/*",
|                                                    "Microsoft.SecurityInsights/entities/runPlaybook/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/bulkTag/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/replaceTags/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                    "Microsoft.SecurityInsights/businessApplicationAgents/systems/undoAction/action",
|                                                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                    "Microsoft.OperationalInsights/workspaces/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.OperationalInsights/querypacks/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/workbooks/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.SecurityInsights/cases/*/Delete",
|                                                       "Microsoft.SecurityInsights/incidents/*/Delete",
|                                                       "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                       "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "679dc20a-52e8-4ac0-a23c-3b557dfb1e24",
|                                    "Name":  "Azure Monitor Pipeline Contributor",
|                                    "Description":  "Manage Azure Monitor Pipeline resources, providing full read and write access to pipeline configurations and monitoring features.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Monitor/pipelineGroups/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2d50f159-7b96-4f1e-8fc7-fee6957ab7cc",
|                                    "Name":  "Azure Monitor Pipeline Reader",
|                                    "Description":  "Read Azure Monitor Pipeline resources, including pipeline configurations and monitoring features.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Monitor/pipelineGroups/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fd8ea4d5-6509-4db0-bada-356ab233b4fa",
|                                    "Name":  "Azure Migrate Owner",
|                                    "Description":  "Grants full access to create and manage Azure Migrate projects including appliance-based discovery, creation of business case \u0026 assessment report and execution of migrations; Also grants ability to assign Azure Migrate specific roles in Azure RBAC.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/locations/read",
|                                                    "Microsoft.Resources/checkResourceName/action",
|                                                    "Microsoft.Resources/deploymentScripts/write",
|                                                    "Microsoft.Resources/deploymentScripts/read",
|                                                    "Microsoft.Resources/links/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Authorization/locks/write",
|                                                    "Microsoft.Authorization/locks/delete",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Migrate/*",
|                                                    "Microsoft.ApplicationMigration/*",
|                                                    "Microsoft.OffAzure/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.MySQLDiscovery/*",
|                                                    "Microsoft.DependencyMap/*",
|                                                    "Microsoft.KeyVault/vaults/*",
|                                                    "Microsoft.KeyVault/checkNameAvailability/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/register/action",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Network/privateEndpoints/read",
|                                                    "Microsoft.Network/privateEndpoints/write",
|                                                    "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
|                                                    "Microsoft.Network/privateDnsZones/write",
|                                                    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                    "Microsoft.Network/privateDnsZones/join/action",
|                                                    "Microsoft.Network/privateDnsZones/A/write",
|                                                    "Microsoft.Network/register/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/*",
|                                                    "Microsoft.GuestConfiguration/register/action",
|                                                    "Microsoft.Compute/register/action",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/availabilitySets/vmSizes/read",
|                                                    "Microsoft.Compute/diskEncryptionSets/read",
|                                                    "Microsoft.Compute/skus/read",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachines/delete",
|                                                    "Microsoft.HybridConnectivity/register/action",
|                                                    "Microsoft.RecoveryServices/vaults/*",
|                                                    "Microsoft.RecoveryServices/register/action",
|                                                    "Microsoft.RecoveryServices/operations/read",
|                                                    "Microsoft.DataReplication/*/read",
|                                                    "Microsoft.DataReplication/register/action",
|                                                    "Microsoft.DataReplication/replicationVaults/write",
|                                                    "Microsoft.KeyVault/register/action",
|                                                    "Microsoft.AzureArcData/register/action",
|                                                    "Microsoft.Resources/links/read",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7859c0b0-0bb9-4994-bd12-cd529af7d646",
|                                    "Name":  "Azure Migrate Decide and Plan Expert",
|                                    "Description":  "Grants restricted access on Azure Migrate project to only perform planning operations including appliance-based discovery, managing inventory, identifying server dependencies, creation of business case \u0026 assessment reports.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/locations/read",
|                                                    "Microsoft.Resources/checkResourceName/action",
|                                                    "Microsoft.Resources/deploymentScripts/write",
|                                                    "Microsoft.Resources/deploymentScripts/read",
|                                                    "Microsoft.Resources/links/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Authorization/locks/write",
|                                                    "Microsoft.Authorization/locks/delete",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Migrate/*",
|                                                    "Microsoft.ApplicationMigration/*",
|                                                    "Microsoft.OffAzure/*",
|                                                    "Microsoft.MySQLDiscovery/*",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.DependencyMap/*",
|                                                    "Microsoft.KeyVault/vaults/*",
|                                                    "Microsoft.KeyVault/checkNameAvailability/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/write",
|                                                    "Microsoft.HybridCompute/machines/delete",
|                                                    "Microsoft.HybridCompute/register/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/virtualNetworks/join/action",
|                                                    "Microsoft.Network/privateEndpoints/read",
|                                                    "Microsoft.Network/privateEndpoints/write",
|                                                    "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
|                                                    "Microsoft.Network/privateDnsZones/write",
|                                                    "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
|                                                    "Microsoft.Network/privateDnsZones/join/action",
|                                                    "Microsoft.Network/privateDnsZones/A/write",
|                                                    "Microsoft.Network/register/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/*/read",
|                                                    "Microsoft.Storage/storageAccounts/*/write",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.GuestConfiguration/register/action",
|                                                    "Microsoft.HybridConnectivity/register/action",
|                                                    "Microsoft.DataReplication/*/read",
|                                                    "Microsoft.DataReplication/register/action",
|                                                    "Microsoft.DataReplication/replicationVaults/write",
|                                                    "Microsoft.RecoveryServices/vaults/*",
|                                                    "Microsoft.RecoveryServices/register/action",
|                                                    "Microsoft.KeyVault/register/action",
|                                                    "Microsoft.AzureArcData/register/action",
|                                                    "Microsoft.Resources/links/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ba480ccd-6499-4709-b581-8f38bb215c63",
|                                    "Name":  "Azure Migrate Service Reader",
|                                    "Description":  "Grants required access to the system assigned managed identity of Azure Migrate project resource.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.ApplicationMigration/*/read",
|                                                    "Microsoft.Migrate/*/read",
|                                                    "Microsoft.OffAzure/*/read",
|                                                    "Microsoft.MySQLDiscovery/*/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectableItems/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationProtectedItems/read",
|                                                    "Microsoft.RecoveryServices/vaults/replicationFabrics/replicationProtectionContainers/replicationMigrationItems/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1cfa4eac-9a23-481c-a793-bfb6958e836b",
|                                    "Name":  "Azure Migrate Execute Expert",
|                                    "Description":  "Grants restricted access on an Azure Migrate project to only perform migration related operations, including replication, execution of test migrations, tracking and monitoring of migration progress, and initiation of agentless and agent-based migrations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write",
|                                                    "Microsoft.Resources/subscriptions/locations/read",
|                                                    "Microsoft.Resources/checkResourceName/action",
|                                                    "Microsoft.Resources/deploymentScripts/write",
|                                                    "Microsoft.Resources/deploymentScripts/read",
|                                                    "Microsoft.Resources/links/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Authorization/locks/write",
|                                                    "Microsoft.Authorization/locks/delete",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Migrate/*/read",
|                                                    "Microsoft.ApplicationMigration/*/read",
|                                                    "Microsoft.OffAzure/*/read",
|                                                    "Microsoft.MySQLDiscovery/*/read",
|                                                    "Microsoft.Support/*",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/networkInterfaces/write",
|                                                    "Microsoft.Network/networkInterfaces/delete",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Storage/storageAccounts/*/read",
|                                                    "Microsoft.Storage/storageAccounts/*/write",
|                                                    "Microsoft.Storage/storageAccounts/listKeys/action",
|                                                    "Microsoft.Compute/register/action",
|                                                    "Microsoft.Compute/availabilitySets/read",
|                                                    "Microsoft.Compute/availabilitySets/vmSizes/read",
|                                                    "Microsoft.Compute/diskEncryptionSets/read",
|                                                    "Microsoft.Compute/skus/read",
|                                                    "Microsoft.Compute/disks/read",
|                                                    "Microsoft.Compute/disks/write",
|                                                    "Microsoft.Compute/disks/delete",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Compute/virtualMachines/write",
|                                                    "Microsoft.Compute/virtualMachines/delete",
|                                                    "Microsoft.RecoveryServices/vaults/*",
|                                                    "Microsoft.RecoveryServices/register/action",
|                                                    "Microsoft.RecoveryServices/operations/read",
|                                                    "Microsoft.Resources/links/read",
|                                                    "Microsoft.DependencyMap/*/read",
|                                                    "Microsoft.DependencyMap/maps/*/action",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.OffAzure/hypervSites/machines/inventoryinsights/pendingupdates/*",
|                                                       "Microsoft.OffAzure/hypervSites/machines/inventoryinsights/vulnerabilities/*",
|                                                       "Microsoft.OffAzure/serverSites/machines/inventoryinsights/pendingupdates/*",
|                                                       "Microsoft.OffAzure/serverSites/machines/inventoryinsights/vulnerabilities/*",
|                                                       "Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/vulnerabilities/*",
|                                                       "Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/pendingupdates/*"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "98c206fe-ea1b-4578-93f8-83a99a5628fc",
|                                    "Name":  "Aws Connector contributor role",
|                                    "Description":  "Microsoft.AwsConnector contributor role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AwsConnector/accessAnalyzerAnalyzers/delete",
|                                                    "Microsoft.AwsConnector/accessAnalyzerAnalyzers/write",
|                                                    "Microsoft.AwsConnector/acmCertificateSummaries/delete",
|                                                    "Microsoft.AwsConnector/acmCertificateSummaries/write",
|                                                    "Microsoft.AwsConnector/apiGatewayRestApis/delete",
|                                                    "Microsoft.AwsConnector/apiGatewayRestApis/write",
|                                                    "Microsoft.AwsConnector/apiGatewayStages/delete",
|                                                    "Microsoft.AwsConnector/apiGatewayStages/write",
|                                                    "Microsoft.AwsConnector/applicationAutoScalingScalableTargets/delete",
|                                                    "Microsoft.AwsConnector/applicationAutoScalingScalableTargets/write",
|                                                    "Microsoft.AwsConnector/appSyncGraphqlApis/delete",
|                                                    "Microsoft.AwsConnector/appSyncGraphqlApis/write",
|                                                    "Microsoft.AwsConnector/autoScalingAutoScalingGroups/delete",
|                                                    "Microsoft.AwsConnector/autoScalingAutoScalingGroups/write",
|                                                    "Microsoft.AwsConnector/bedrockAgentAliases/delete",
|                                                    "Microsoft.AwsConnector/bedrockAgentAliases/write",
|                                                    "Microsoft.AwsConnector/bedrockAgents/delete",
|                                                    "Microsoft.AwsConnector/bedrockAgents/write",
|                                                    "Microsoft.AwsConnector/bedrockApplicationInferenceProfiles/delete",
|                                                    "Microsoft.AwsConnector/bedrockApplicationInferenceProfiles/write",
|                                                    "Microsoft.AwsConnector/bedrockBlueprints/delete",
|                                                    "Microsoft.AwsConnector/bedrockBlueprints/write",
|                                                    "Microsoft.AwsConnector/bedrockDataAutomationProjects/delete",
|                                                    "Microsoft.AwsConnector/bedrockDataAutomationProjects/write",
|                                                    "Microsoft.AwsConnector/bedrockDataSources/delete",
|                                                    "Microsoft.AwsConnector/bedrockDataSources/write",
|                                                    "Microsoft.AwsConnector/bedrockFlowAliases/delete",
|                                                    "Microsoft.AwsConnector/bedrockFlowAliases/write",
|                                                    "Microsoft.AwsConnector/bedrockGuardrails/delete",
|                                                    "Microsoft.AwsConnector/bedrockGuardrails/write",
|                                                    "Microsoft.AwsConnector/bedrockKnowledgeBases/delete",
|                                                    "Microsoft.AwsConnector/bedrockKnowledgeBases/write",
|                                                    "Microsoft.AwsConnector/bedrockPrompts/delete",
|                                                    "Microsoft.AwsConnector/bedrockPrompts/write",
|                                                    "Microsoft.AwsConnector/cloudFormationStacks/delete",
|                                                    "Microsoft.AwsConnector/cloudFormationStacks/write",
|                                                    "Microsoft.AwsConnector/cloudFormationStackSets/delete",
|                                                    "Microsoft.AwsConnector/cloudFormationStackSets/write",
|                                                    "Microsoft.AwsConnector/cloudFrontDistributions/delete",
|                                                    "Microsoft.AwsConnector/cloudFrontDistributions/write",
|                                                    "Microsoft.AwsConnector/cloudTrailTrails/delete",
|                                                    "Microsoft.AwsConnector/cloudTrailTrails/write",
|                                                    "Microsoft.AwsConnector/cloudWatchAlarms/delete",
|                                                    "Microsoft.AwsConnector/cloudWatchAlarms/write",
|                                                    "Microsoft.AwsConnector/codeBuildProjects/delete",
|                                                    "Microsoft.AwsConnector/codeBuildProjects/write",
|                                                    "Microsoft.AwsConnector/codeBuildSourceCredentialsInfos/delete",
|                                                    "Microsoft.AwsConnector/codeBuildSourceCredentialsInfos/write",
|                                                    "Microsoft.AwsConnector/configServiceConfigurationRecorders/delete",
|                                                    "Microsoft.AwsConnector/configServiceConfigurationRecorders/write",
|                                                    "Microsoft.AwsConnector/configServiceConfigurationRecorderStatuses/delete",
|                                                    "Microsoft.AwsConnector/configServiceConfigurationRecorderStatuses/write",
|                                                    "Microsoft.AwsConnector/configServiceDeliveryChannels/delete",
|                                                    "Microsoft.AwsConnector/configServiceDeliveryChannels/write",
|                                                    "Microsoft.AwsConnector/databaseMigrationServiceReplicationInstances/delete",
|                                                    "Microsoft.AwsConnector/databaseMigrationServiceReplicationInstances/write",
|                                                    "Microsoft.AwsConnector/daxClusters/delete",
|                                                    "Microsoft.AwsConnector/daxClusters/write",
|                                                    "Microsoft.AwsConnector/dynamoDBContinuousBackupsDescriptions/delete",
|                                                    "Microsoft.AwsConnector/dynamoDBContinuousBackupsDescriptions/write",
|                                                    "Microsoft.AwsConnector/dynamoDBTables/delete",
|                                                    "Microsoft.AwsConnector/dynamoDBTables/write",
|                                                    "Microsoft.AwsConnector/ec2AccountAttributes/delete",
|                                                    "Microsoft.AwsConnector/ec2AccountAttributes/write",
|                                                    "Microsoft.AwsConnector/ec2Addresses/delete",
|                                                    "Microsoft.AwsConnector/ec2Addresses/write",
|                                                    "Microsoft.AwsConnector/ec2FlowLogs/delete",
|                                                    "Microsoft.AwsConnector/ec2FlowLogs/write",
|                                                    "Microsoft.AwsConnector/ec2Images/delete",
|                                                    "Microsoft.AwsConnector/ec2Images/write",
|                                                    "Microsoft.AwsConnector/ec2Instances/delete",
|                                                    "Microsoft.AwsConnector/ec2Instances/start/action",
|                                                    "Microsoft.AwsConnector/ec2Instances/stop/action",
|                                                    "Microsoft.AwsConnector/ec2Instances/write",
|                                                    "Microsoft.AwsConnector/ec2InstanceStatuses/delete",
|                                                    "Microsoft.AwsConnector/ec2InstanceStatuses/write",
|                                                    "Microsoft.AwsConnector/ec2Ipams/delete",
|                                                    "Microsoft.AwsConnector/ec2Ipams/write",
|                                                    "Microsoft.AwsConnector/ec2KeyPairs/delete",
|                                                    "Microsoft.AwsConnector/ec2KeyPairs/write",
|                                                    "Microsoft.AwsConnector/ec2NetworkAcls/delete",
|                                                    "Microsoft.AwsConnector/ec2NetworkAcls/write",
|                                                    "Microsoft.AwsConnector/ec2NetworkInterfaces/delete",
|                                                    "Microsoft.AwsConnector/ec2NetworkInterfaces/write",
|                                                    "Microsoft.AwsConnector/ec2RouteTables/delete",
|                                                    "Microsoft.AwsConnector/ec2RouteTables/write",
|                                                    "Microsoft.AwsConnector/ec2SecurityGroups/delete",
|                                                    "Microsoft.AwsConnector/ec2SecurityGroups/write",
|                                                    "Microsoft.AwsConnector/ec2Snapshots/delete",
|                                                    "Microsoft.AwsConnector/ec2Snapshots/write",
|                                                    "Microsoft.AwsConnector/ec2Subnets/delete",
|                                                    "Microsoft.AwsConnector/ec2Subnets/write",
|                                                    "Microsoft.AwsConnector/ec2Volumes/delete",
|                                                    "Microsoft.AwsConnector/ec2Volumes/write",
|                                                    "Microsoft.AwsConnector/ec2VPCEndpoints/delete",
|                                                    "Microsoft.AwsConnector/ec2VPCEndpoints/write",
|                                                    "Microsoft.AwsConnector/ec2VPCPeeringConnections/delete",
|                                                    "Microsoft.AwsConnector/ec2VPCPeeringConnections/write",
|                                                    "Microsoft.AwsConnector/ec2Vpcs/delete",
|                                                    "Microsoft.AwsConnector/ec2Vpcs/write",
|                                                    "Microsoft.AwsConnector/ecrImageDetails/delete",
|                                                    "Microsoft.AwsConnector/ecrImageDetails/write",
|                                                    "Microsoft.AwsConnector/ecrRepositories/delete",
|                                                    "Microsoft.AwsConnector/ecrRepositories/write",
|                                                    "Microsoft.AwsConnector/ecsClusters/delete",
|                                                    "Microsoft.AwsConnector/ecsClusters/write",
|                                                    "Microsoft.AwsConnector/ecsServices/delete",
|                                                    "Microsoft.AwsConnector/ecsServices/write",
|                                                    "Microsoft.AwsConnector/ecsTaskDefinitions/delete",
|                                                    "Microsoft.AwsConnector/ecsTaskDefinitions/write",
|                                                    "Microsoft.AwsConnector/efsFileSystems/delete",
|                                                    "Microsoft.AwsConnector/efsFileSystems/write",
|                                                    "Microsoft.AwsConnector/efsMountTargets/delete",
|                                                    "Microsoft.AwsConnector/efsMountTargets/write",
|                                                    "Microsoft.AwsConnector/eksClusters/delete",
|                                                    "Microsoft.AwsConnector/eksClusters/write",
|                                                    "Microsoft.AwsConnector/eksNodegroups/delete",
|                                                    "Microsoft.AwsConnector/eksNodegroups/write",
|                                                    "Microsoft.AwsConnector/elasticBeanstalkApplications/delete",
|                                                    "Microsoft.AwsConnector/elasticBeanstalkApplications/write",
|                                                    "Microsoft.AwsConnector/elasticBeanstalkConfigurationTemplates/delete",
|                                                    "Microsoft.AwsConnector/elasticBeanstalkConfigurationTemplates/write",
|                                                    "Microsoft.AwsConnector/elasticBeanstalkEnvironments/delete",
|                                                    "Microsoft.AwsConnector/elasticBeanstalkEnvironments/write",
|                                                    "Microsoft.AwsConnector/elasticLoadBalancingV2Listeners/delete",
|                                                    "Microsoft.AwsConnector/elasticLoadBalancingV2Listeners/write",
|                                                    "Microsoft.AwsConnector/elasticLoadBalancingV2LoadBalancers/delete",
|                                                    "Microsoft.AwsConnector/elasticLoadBalancingV2LoadBalancers/write",
|                                                    "Microsoft.AwsConnector/elasticLoadBalancingV2TargetGroups/delete",
|                                                    "Microsoft.AwsConnector/elasticLoadBalancingV2TargetGroups/write",
|                                                    "Microsoft.AwsConnector/elasticLoadBalancingV2TargetHealthDescriptions/delete",
|                                                    "Microsoft.AwsConnector/elasticLoadBalancingV2TargetHealthDescriptions/write",
|                                                    "Microsoft.AwsConnector/elasticsearchDomains/delete",
|                                                    "Microsoft.AwsConnector/elasticsearchDomains/write",
|                                                    "Microsoft.AwsConnector/emrClusters/delete",
|                                                    "Microsoft.AwsConnector/emrClusters/write",
|                                                    "Microsoft.AwsConnector/guardDutyDetectors/delete",
|                                                    "Microsoft.AwsConnector/guardDutyDetectors/write",
|                                                    "Microsoft.AwsConnector/iamAccessKeyLastUseds/delete",
|                                                    "Microsoft.AwsConnector/iamAccessKeyLastUseds/write",
|                                                    "Microsoft.AwsConnector/iamAccessKeyMetadata/delete",
|                                                    "Microsoft.AwsConnector/iamAccessKeyMetadata/write",
|                                                    "Microsoft.AwsConnector/iamGroups/delete",
|                                                    "Microsoft.AwsConnector/iamGroups/write",
|                                                    "Microsoft.AwsConnector/iamInstanceProfiles/delete",
|                                                    "Microsoft.AwsConnector/iamInstanceProfiles/write",
|                                                    "Microsoft.AwsConnector/iamManagedPolicies/delete",
|                                                    "Microsoft.AwsConnector/iamManagedPolicies/write",
|                                                    "Microsoft.AwsConnector/iamMFADevices/delete",
|                                                    "Microsoft.AwsConnector/iamMFADevices/write",
|                                                    "Microsoft.AwsConnector/iamPasswordPolicies/delete",
|                                                    "Microsoft.AwsConnector/iamPasswordPolicies/write",
|                                                    "Microsoft.AwsConnector/iamPolicyVersions/delete",
|                                                    "Microsoft.AwsConnector/iamPolicyVersions/write",
|                                                    "Microsoft.AwsConnector/iamRoles/delete",
|                                                    "Microsoft.AwsConnector/iamRoles/write",
|                                                    "Microsoft.AwsConnector/iamServerCertificates/delete",
|                                                    "Microsoft.AwsConnector/iamServerCertificates/write",
|                                                    "Microsoft.AwsConnector/iamUserPolicies/delete",
|                                                    "Microsoft.AwsConnector/iamUserPolicies/write",
|                                                    "Microsoft.AwsConnector/iamVirtualMFADevices/delete",
|                                                    "Microsoft.AwsConnector/iamVirtualMFADevices/write",
|                                                    "Microsoft.AwsConnector/kmsAliases/delete",
|                                                    "Microsoft.AwsConnector/kmsAliases/write",
|                                                    "Microsoft.AwsConnector/kmsKeys/delete",
|                                                    "Microsoft.AwsConnector/kmsKeys/write",
|                                                    "Microsoft.AwsConnector/lambdaFunctionCodeLocations/delete",
|                                                    "Microsoft.AwsConnector/lambdaFunctionCodeLocations/write",
|                                                    "Microsoft.AwsConnector/lambdaFunctionConfigurations/delete",
|                                                    "Microsoft.AwsConnector/lambdaFunctionConfigurations/write",
|                                                    "Microsoft.AwsConnector/lambdaFunctions/delete",
|                                                    "Microsoft.AwsConnector/lambdaFunctions/write",
|                                                    "Microsoft.AwsConnector/licenseManagerLicenses/delete",
|                                                    "Microsoft.AwsConnector/licenseManagerLicenses/write",
|                                                    "Microsoft.AwsConnector/lightsailBuckets/delete",
|                                                    "Microsoft.AwsConnector/lightsailBuckets/write",
|                                                    "Microsoft.AwsConnector/lightsailInstances/delete",
|                                                    "Microsoft.AwsConnector/lightsailInstances/write",
|                                                    "Microsoft.AwsConnector/Locations/OperationStatuses/write",
|                                                    "Microsoft.AwsConnector/logsLogGroups/delete",
|                                                    "Microsoft.AwsConnector/logsLogGroups/write",
|                                                    "Microsoft.AwsConnector/logsLogStreams/delete",
|                                                    "Microsoft.AwsConnector/logsLogStreams/write",
|                                                    "Microsoft.AwsConnector/logsMetricFilters/delete",
|                                                    "Microsoft.AwsConnector/logsMetricFilters/write",
|                                                    "Microsoft.AwsConnector/logsSubscriptionFilters/delete",
|                                                    "Microsoft.AwsConnector/logsSubscriptionFilters/write",
|                                                    "Microsoft.AwsConnector/macie2JobSummaries/delete",
|                                                    "Microsoft.AwsConnector/macie2JobSummaries/write",
|                                                    "Microsoft.AwsConnector/macieAllowLists/delete",
|                                                    "Microsoft.AwsConnector/macieAllowLists/write",
|                                                    "Microsoft.AwsConnector/networkFirewallFirewallPolicies/delete",
|                                                    "Microsoft.AwsConnector/networkFirewallFirewallPolicies/write",
|                                                    "Microsoft.AwsConnector/networkFirewallFirewalls/delete",
|                                                    "Microsoft.AwsConnector/networkFirewallFirewalls/write",
|                                                    "Microsoft.AwsConnector/networkFirewallRuleGroups/delete",
|                                                    "Microsoft.AwsConnector/networkFirewallRuleGroups/write",
|                                                    "Microsoft.AwsConnector/openSearchDomainStatuses/delete",
|                                                    "Microsoft.AwsConnector/openSearchDomainStatuses/write",
|                                                    "Microsoft.AwsConnector/openSearchServiceDomains/delete",
|                                                    "Microsoft.AwsConnector/openSearchServiceDomains/write",
|                                                    "Microsoft.AwsConnector/organizationsAccounts/delete",
|                                                    "Microsoft.AwsConnector/organizationsAccounts/write",
|                                                    "Microsoft.AwsConnector/organizationsOrganizations/delete",
|                                                    "Microsoft.AwsConnector/organizationsOrganizations/write",
|                                                    "Microsoft.AwsConnector/rdsDBClusters/delete",
|                                                    "Microsoft.AwsConnector/rdsDBClusters/write",
|                                                    "Microsoft.AwsConnector/rdsDBInstances/delete",
|                                                    "Microsoft.AwsConnector/rdsDBInstances/write",
|                                                    "Microsoft.AwsConnector/rdsDBSnapshotAttributesResults/delete",
|                                                    "Microsoft.AwsConnector/rdsDBSnapshotAttributesResults/write",
|                                                    "Microsoft.AwsConnector/rdsDBSnapshots/delete",
|                                                    "Microsoft.AwsConnector/rdsDBSnapshots/write",
|                                                    "Microsoft.AwsConnector/rdsEventSubscriptions/delete",
|                                                    "Microsoft.AwsConnector/rdsEventSubscriptions/write",
|                                                    "Microsoft.AwsConnector/rdsExportTasks/delete",
|                                                    "Microsoft.AwsConnector/rdsExportTasks/write",
|                                                    "Microsoft.AwsConnector/redshiftClusterParameterGroups/delete",
|                                                    "Microsoft.AwsConnector/redshiftClusterParameterGroups/write",
|                                                    "Microsoft.AwsConnector/redshiftClusters/delete",
|                                                    "Microsoft.AwsConnector/redshiftClusters/write",
|                                                    "Microsoft.AwsConnector/route53DomainsDomainSummaries/delete",
|                                                    "Microsoft.AwsConnector/route53DomainsDomainSummaries/write",
|                                                    "Microsoft.AwsConnector/route53HostedZones/delete",
|                                                    "Microsoft.AwsConnector/route53HostedZones/write",
|                                                    "Microsoft.AwsConnector/route53ResourceRecordSets/delete",
|                                                    "Microsoft.AwsConnector/route53ResourceRecordSets/write",
|                                                    "Microsoft.AwsConnector/s3AccessControlPolicies/delete",
|                                                    "Microsoft.AwsConnector/s3AccessControlPolicies/write",
|                                                    "Microsoft.AwsConnector/s3AccessPoints/delete",
|                                                    "Microsoft.AwsConnector/s3AccessPoints/write",
|                                                    "Microsoft.AwsConnector/s3BucketPolicies/delete",
|                                                    "Microsoft.AwsConnector/s3BucketPolicies/write",
|                                                    "Microsoft.AwsConnector/s3Buckets/delete",
|                                                    "Microsoft.AwsConnector/s3Buckets/write",
|                                                    "Microsoft.AwsConnector/s3ControlMultiRegionAccessPointPolicyDocuments/delete",
|                                                    "Microsoft.AwsConnector/s3ControlMultiRegionAccessPointPolicyDocuments/write",
|                                                    "Microsoft.AwsConnector/sageMakerApps/delete",
|                                                    "Microsoft.AwsConnector/sageMakerApps/write",
|                                                    "Microsoft.AwsConnector/sageMakerDevices/delete",
|                                                    "Microsoft.AwsConnector/sageMakerDevices/write",
|                                                    "Microsoft.AwsConnector/sageMakerImages/delete",
|                                                    "Microsoft.AwsConnector/sageMakerImages/write",
|                                                    "Microsoft.AwsConnector/sageMakerNotebookInstanceSummaries/delete",
|                                                    "Microsoft.AwsConnector/sageMakerNotebookInstanceSummaries/write",
|                                                    "Microsoft.AwsConnector/secretsManagerResourcePolicies/delete",
|                                                    "Microsoft.AwsConnector/secretsManagerResourcePolicies/write",
|                                                    "Microsoft.AwsConnector/secretsManagerSecrets/delete",
|                                                    "Microsoft.AwsConnector/secretsManagerSecrets/write",
|                                                    "Microsoft.AwsConnector/snsSubscriptions/delete",
|                                                    "Microsoft.AwsConnector/snsSubscriptions/write",
|                                                    "Microsoft.AwsConnector/snsTopics/delete",
|                                                    "Microsoft.AwsConnector/snsTopics/write",
|                                                    "Microsoft.AwsConnector/sqsQueues/delete",
|                                                    "Microsoft.AwsConnector/sqsQueues/write",
|                                                    "Microsoft.AwsConnector/ssmInstanceInformations/delete",
|                                                    "Microsoft.AwsConnector/ssmInstanceInformations/write",
|                                                    "Microsoft.AwsConnector/ssmParameters/delete",
|                                                    "Microsoft.AwsConnector/ssmParameters/write",
|                                                    "Microsoft.AwsConnector/ssmResourceComplianceSummaryItems/delete",
|                                                    "Microsoft.AwsConnector/ssmResourceComplianceSummaryItems/write",
|                                                    "Microsoft.AwsConnector/wafv2IPSets/delete",
|                                                    "Microsoft.AwsConnector/wafv2IPSets/write",
|                                                    "Microsoft.AwsConnector/wafv2LoggingConfigurations/delete",
|                                                    "Microsoft.AwsConnector/wafv2LoggingConfigurations/write",
|                                                    "Microsoft.AwsConnector/wafv2WebACLAssociations/delete",
|                                                    "Microsoft.AwsConnector/wafv2WebACLAssociations/write",
|                                                    "Microsoft.AwsConnector/wafWebACLSummaries/delete",
|                                                    "Microsoft.AwsConnector/wafWebACLSummaries/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a4b156ac-253f-4a1a-9851-96d62b71b047",
|                                    "Name":  "SRE Agent Reader",
|                                    "Description":  "Grants read-only access to all SRE Agent data, including chats, incidents, logs, and configurations. Does not permit interaction with the agent.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/agents/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.App/agents/threads/read",
|                                                        "Microsoft.App/agents/graph/read",
|                                                        "Microsoft.App/agents/memory/read",
|                                                        "Microsoft.App/agents/incidentManagement/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f0f57965-de58-41bc-ba76-2aaab4d09f30",
|                                    "Name":  "Hybrid Connectivity contributor role",
|                                    "Description":  "Microsoft.HybridConnectivity contributor role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridConnectivity/endpoints/listIngressGatewayCredentials/action",
|                                                    "Microsoft.HybridConnectivity/Locations/OperationStatuses/write",
|                                                    "Microsoft.HybridConnectivity/publicCloudConnectors/delete",
|                                                    "Microsoft.HybridConnectivity/publicCloudConnectors/read",
|                                                    "Microsoft.HybridConnectivity/publicCloudConnectors/testPermissions/action",
|                                                    "Microsoft.HybridConnectivity/publicCloudConnectors/write",
|                                                    "Microsoft.HybridConnectivity/solutionConfigurations/delete",
|                                                    "Microsoft.HybridConnectivity/solutionConfigurations/read",
|                                                    "Microsoft.HybridConnectivity/solutionConfigurations/syncNow/action",
|                                                    "Microsoft.HybridConnectivity/solutionConfigurations/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a235d3ee-5935-4cfb-8cc5-a3303ad5995e",
|                                    "Name":  "Storage File Data SMB MI Admin",
|                                    "Description":  "Allows for admin-level access for managed identities on files/directories in Azure file shares.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/takeOwnership/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/runAsBuiltInFileAdministrator/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b256d512-9a3a-4a96-9366-9f54f900e58b",
|                                    "Name":  "Common Edge Admin",
|                                    "Description":  "Common Edge Admin Role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Edge/connectivityStatuses/delete",
|                                                    "Microsoft.Edge/connectivityStatuses/write",
|                                                    "Microsoft.Edge/locations/operationStatuses/write",
|                                                    "Microsoft.Edge/updates/delete",
|                                                    "Microsoft.Edge/updates/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "53b2724d-1e51-44fa-b586-bcace0c82609",
|                                    "Name":  "Firmware Analysis User",
|                                    "Description":  "Upload and analyze firmware images but not perform any workspace configuration",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.IoTFirmwareDefense/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/deployments/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.IoTFirmwareDefense/firmwareGroups/*",
|                                                       "Microsoft.IoTFirmwareDefense/register/action",
|                                                       "Microsoft.IoTFirmwareDefense/unregister/action",
|                                                       "Microsoft.IoTFirmwareDefense/workspaces/write",
|                                                       "Microsoft.IoTFirmwareDefense/workspaces/delete"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e79298df-d852-4c6d-84f9-5d13249d1e55",
|                                    "Name":  "SRE Agent Administrator",
|                                    "Description":  "Full control of the agent—manage chats, incident response plans, and agent run modes; approve and execute commands.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/agents/read",
|                                                    "Microsoft.App/agents/*/read",
|                                                    "Microsoft.App/agents/write",
|                                                    "Microsoft.App/agents/*/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.App/agents/*/read",
|                                                        "Microsoft.App/agents/*/write",
|                                                        "Microsoft.App/agents/*/delete",
|                                                        "Microsoft.App/agents/threads/approve/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2d84a65a-63b2-4343-bbb6-31105d857bc1",
|                                    "Name":  "SRE Agent Standard User",
|                                    "Description":  "Grants access to interact with the SRE Agent to triage incidents and run diagnostics.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/agents/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.App/agents/threads/read",
|                                                        "Microsoft.App/agents/graph/read",
|                                                        "Microsoft.App/agents/memory/read",
|                                                        "Microsoft.App/agents/incidentManagement/read",
|                                                        "Microsoft.App/agents/threads/write",
|                                                        "Microsoft.App/agents/graph/write",
|                                                        "Microsoft.App/agents/memory/write",
|                                                        "Microsoft.App/agents/scheduledtasks/read",
|                                                        "Microsoft.App/agents/scheduledtasks/write",
|                                                        "Microsoft.App/agents/scheduledtasks/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "850c5848-fc51-4a9a-8823-f220370626e3",
|                                    "Name":  "Azure Kubernetes Fleet Manager Hub Cluster User Role",
|                                    "Description":  "Grants read access to Azure Kubernetes Fleet Manager as well as the Kubernetes config file to connect to the fleet-managed hub cluster.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action",
|                                                    "Microsoft.ContainerService/fleets/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3b03c2da-16b3-4a49-8834-0f8130efdd3b",
|                                    "Name":  "Log Analytics Data Reader",
|                                    "Description":  "Log Analytics Data Reader can query and search the logs it is allowed to view over Log Analytics workspaces and tables",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.OperationalInsights/workspaces/query/read",
|                                                    "Microsoft.OperationalInsights/workspaces/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.OperationalInsights/workspaces/tables/data/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "89f7a3ec-e9d0-40eb-9b96-c016a5c2a53f",
|                                    "Name":  "Dynamics 365 Customer Insights Service Role",
|                                    "Description":  "Enables Diagnostic Logging setup for Customer Insights instances.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.D365CustomerInsights/instances/write",
|                                                    "Microsoft.D365CustomerInsights/instances/providers/Microsoft.Insights/diagnosticSettings/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "77789c21-1643-48a2-8f27-47f858540b51",
|                                    "Name":  "Storage Actions Task Assignment Contributor",
|                                    "Description":  "Used by the Storage Actions assigner to create a Task Assignment on their target Storage Account, with RBAC privileges for Managed Identity",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/reports/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/storageTaskAssignments/read",
|                                                    "Microsoft.Storage/storageAccounts/storageTaskAssignments/write",
|                                                    "Microsoft.Storage/storageAccounts/storageTaskAssignments/delete",
|                                                    "Microsoft.Storage/storageAccounts/storageTaskAssignments/reports/read",
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/roleAssignments/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4bad4d9e-2a13-4888-94bb-c8432f6f3040",
|                                    "Name":  "Storage Actions Blob Data Operator",
|                                    "Description":  "Used by the Storage Actions - Storage Task to list \u0026 perform operations on the Storage Account blobs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/runAsSuperUser/action",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/immutableStorage/runAsSuperUser/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "55077723-1b30-4603-a70b-68de134cfa20",
|                                    "Name":  "Azure Native Dynatrace Agent Management Role",
|                                    "Description":  "Grants access to manage Dynatrace Agent on compute resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.KubernetesConfiguration/extensions/write",
|                                                    "Microsoft.KubernetesConfiguration/extensions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bd8acdb0-202c-4493-a7fe-ef98eefbfbc4",
|                                    "Name":  "Storage Actions Contributor",
|                                    "Description":  "Used by the Storage Actions author to create, read, update, and delete Storage Actions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.StorageActions/storageTasks/read",
|                                                    "Microsoft.StorageActions/storageTasks/write",
|                                                    "Microsoft.StorageActions/storageTasks/delete",
|                                                    "Microsoft.StorageActions/storageTasks/storageTaskAssignments/read",
|                                                    "Microsoft.StorageActions/storageTasks/reports/read",
|                                                    "Microsoft.StorageActions/locations/previewActions/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "34013b0a-565b-43aa-8755-1b7c286f6cf7",
|                                    "Name":  "Essential Machine Management Administrator",
|                                    "Description":  "Can managed Essential Machine Management resources for subscriptions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Insights/dataCollectionRules/read",
|                                                    "Microsoft.Insights/dataCollectionRules/write",
|                                                    "Microsoft.Monitor/accounts/write",
|                                                    "Microsoft.Monitor/accounts/read",
|                                                    "Microsoft.ManagedOps/managedOps/read",
|                                                    "Microsoft.ManagedOps/managedOps/write",
|                                                    "Microsoft.ManagedOps/managedOps/delete",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.OperationsManagement/solutions/write",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedkeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedkeys/read",
|                                                    "Microsoft.OperationalInsights/workspaces/listKeys/action",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/metricAlerts/write",
|                                                    "Microsoft.Insights/metricAlerts/read",
|                                                    "Microsoft.Security/pricings/write",
|                                                    "Microsoft.Security/pricings/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "56e95fdc-3337-468d-b964-30d07f2a2018",
|                                    "Name":  "Garnet PubSub Data Contributor",
|                                    "Description":  "Allows read and write access to all channels within the Garnet resource",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/slots/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/channels/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/numsub/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/numpat/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/psubscribe/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/publish/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/punsubscribe/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/subscribe/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/unsubscribe/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "da9adf61-39cd-41d5-87a0-30b21f7270d8",
|                                    "Name":  "Garnet PubSub Data Reader",
|                                    "Description":  "Allows read access to all channels within the Garnet resource",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientid/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/clientinfo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/configget/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/echo/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/info/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/keyslot/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/nodes/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/ping/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/slots/read",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/channels/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/psubscribe/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/punsubscribe/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/subscribe/action",
|                                                        "Microsoft.DocumentDB/garnetClusters/acl/unsubscribe/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0a7c2fa1-6f28-41a4-86b8-e74937c63222",
|                                    "Name":  "Tenant Contributor",
|                                    "Description":  "Allows users to create and manage Entra ID Tenants.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureActiveDirectory/directories/write",
|                                                    "Microsoft.AzureActiveDirectory/directories/read",
|                                                    "Microsoft.AzureActiveDirectory/entraTenants/write",
|                                                    "Microsoft.AzureActiveDirectory/entraTenants/read",
|                                                    "Microsoft.AzureActiveDirectory/entraTenants/delete",
|                                                    "Microsoft.AzureActiveDirectory/register/action",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "bbf004e3-0e4b-4f86-ae4f-1f8fb47b357b",
|                                    "Name":  "Storage File Data SMB Admin",
|                                    "Description":  "Allows for admin access equivalent to storage account key for end users over SMB.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/delete",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/modifypermissions/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/takeOwnership/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "68899692-f960-4247-af28-82f55b357997",
|                                    "Name":  "Supercomputer Infrastructure Contributor",
|                                    "Description":  "Lets you manage Supercomputer Infrastructure resources, but not access to them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.SupercomputerInfrastructure/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "13d06eae-ec82-4345-bcd6-c38625ddffbc",
|                                    "Name":  "Healthcare Agent Contributer",
|                                    "Description":  "Manage Helathcare Agent resources - list, view details, edit and delete resources.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HealthBot/healthBots/Read",
|                                                    "Microsoft.HealthBot/healthBots/Write",
|                                                    "Microsoft.HealthBot/healthBots/Delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4c7fd853-7345-4453-babd-e9481e9b460b",
|                                    "Name":  "Azure Resilience Management Recovery Contributor",
|                                    "Description":  "Contributor Role of Azure Resilience Management Recovery Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/delete",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/write",
|                                                    "Microsoft.Insights/alertRules/",
|                                                    "Microsoft.Management/ServiceGroups/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/write",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "481d9636-d9f0-468b-b93d-6056318e6f36",
|                                    "Name":  "Azure Resilience Management Recovery Administrator",
|                                    "Description":  "Administrator Role of Azure Resilience Management Recovery Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/delete",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/write",
|                                                    "Microsoft.Insights/alertRules/",
|                                                    "Microsoft.Management/ServiceGroups/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/write",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8210e6a3-4e4c-4e1a-bd83-ef8bac788a45",
|                                    "Name":  "Azure Resilience Management Recovery Reader",
|                                    "Description":  "Reader Role of Azure Resilience Management Recovery Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                    "Microsoft.Insights/alertRules/",
|                                                    "Microsoft.Management/ServiceGroups/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/read",
|                                                    "Microsoft.Resources/deployments/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "517781b0-5ad4-4418-94d5-f2421834b586",
|                                    "Name":  "Azure Resilience Management Recovery Operator",
|                                    "Description":  "Operator Role of Azure Resilience Management Recovery Service",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/action",
|                                                    "Microsoft.AzureResilienceManagement/recoveryPlans/*/read",
|                                                    "Microsoft.Insights/alertRules/",
|                                                    "Microsoft.Management/ServiceGroups/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a5c3590a-3a1a-4cd4-9648-ea0a32b15137",
|                                    "Name":  "Azure Device Registry Contributor",
|                                    "Description":  "Allows for full access to IoT devices within Azure Device Registry Namespace.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "microsoft.deviceregistry/namespaces/read",
|                                                    "microsoft.deviceregistry/namespaces/devices/*",
|                                                    "microsoft.deviceregistry/namespaces/discovereddevices/*",
|                                                    "microsoft.deviceregistry/namespaces/credentials/read",
|                                                    "microsoft.deviceregistry/namespaces/credentials/policies/read",
|                                                    "microsoft.devices/iothubs/certificates/*",
|                                                    "microsoft.devices/iothubs/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "microsoft.deviceregistry/namespaces/credentials/policies/issueCertificate/action",
|                                                        "microsoft.devices/iothubs/devices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "09267e11-2e06-40b5-8fe4-68cea20794c9",
|                                    "Name":  "Azure Device Registry Credentials Contributor",
|                                    "Description":  "Allows for full access to manage credentials and policies within Azure Device Registry Namespace.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "microsoft.deviceregistry/namespaces/credentials/*",
|                                                    "microsoft.deviceregistry/namespaces/credentials/policies/*",
|                                                    "microsoft.deviceregistry/namespaces/devices/revoke/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d5dddae-e124-4753-972d-aae60b37deb4",
|                                    "Name":  "Migrate Arc Discovery Reader - Preview",
|                                    "Description":  "Read metadata of Azure Arc enabled server resources and metadata, performance and migration suitability of Arc enabled SQL server resources. Users creating Azure Migrate project that uses Arc resource discovery require this role on Arc scope of the project. To enable periodic sync, Azure Migrate project managed identity must be assigned this role. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.AzureArcData/sqlServerInstances/read",
|                                                    "Microsoft.AzureArcData/sqlServerInstances/databases/read",
|                                                    "Microsoft.AzureArcData/sqlServerInstances/availabilityGroups/read",
|                                                    "Microsoft.AzureArcData/sqlServerInstances/getTelemetry/action",
|                                                    "Microsoft.AzureArcData/sqlServerInstances/availabilityGroups/getDetailView/action",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "547f7f0a-69c0-4807-bd9e-0321dfb66a84",
|                                    "Name":  "Azure Device Registry Onboarding",
|                                    "Description":  "Allows for full access to Azure Device Registry Namespace and X.509 certificate provisioning.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DeviceRegistry/namespaces/read",
|                                                    "Microsoft.DeviceRegistry/namespaces/write",
|                                                    "Microsoft.DeviceRegistry/namespaces/delete",
|                                                    "Microsoft.DeviceRegistry/namespaces/credentials/*",
|                                                    "Microsoft.DeviceRegistry/namespaces/credentials/policies/*",
|                                                    "Microsoft.Devices/iothubs/*",
|                                                    "Microsoft.Devices/provisioningServices/*",
|                                                    "microsoft.deviceregistry/namespaces/devices/revoke/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Devices/provisioningServices/enrollments/*",
|                                                        "Microsoft.Devices/provisioningServices/enrollmentGroups/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9d3ef640-3c86-4e0a-8907-8d361559c012",
|                                    "Name":  "Hybrid Network Owner",
|                                    "Description":  "Provides owner access to Hybrid Network Resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HybridNetwork/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a2b7cc47-30ec-462f-a2f4-9ac6e1c266af",
|                                    "Name":  "Azure Resilience Management Goals Administrator",
|                                    "Description":  "This role allows users to view, assign and delete resiliency goals for the service group, as well as modify the list of service group members that get evaluated against the goal. This role also allows a user to assign goal related permissions to other users.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Management/ServiceGroups/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/read",
|                                                    "Microsoft.AzureResilienceManagement/goalTemplates/delete",
|                                                    "Microsoft.AzureResilienceManagement/goalTemplates/read",
|                                                    "Microsoft.AzureResilienceManagement/goalTemplates/write",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/delete",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/read",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/write",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/goalResources/read",
|                                                    "Microsoft.AzureResilienceManagement/locations/operationStatuses/read",
|                                                    "Microsoft.AzureResilienceManagement/operations/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3910633d-19d0-4d31-b5e6-4f3101b137b9",
|                                    "Name":  "Azure Resilience Management Goals Contributor",
|                                    "Description":  "This role allows users to view, assign and delete resiliency goals for the service group, as well as modify the list of service group members that get evaluated against the goal.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Management/ServiceGroups/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/read",
|                                                    "Microsoft.AzureResilienceManagement/goalTemplates/delete",
|                                                    "Microsoft.AzureResilienceManagement/goalTemplates/read",
|                                                    "Microsoft.AzureResilienceManagement/goalTemplates/write",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/delete",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/read",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/write",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/goalResources/read",
|                                                    "Microsoft.AzureResilienceManagement/locations/operationStatuses/read",
|                                                    "Microsoft.AzureResilienceManagement/operations/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "39ea2c4e-798a-4469-b81d-65dc7c54cbdb",
|                                    "Name":  "Azure Resilience Management Goals Reader",
|                                    "Description":  "This role allows users to view the resiliency goals for the service group, as well as view the list of service group members that are being evaluated against the goal.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.AzureResilienceManagement/goalTemplates/read",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/read",
|                                                    "Microsoft.AzureResilienceManagement/goalAssignments/goalResources/read",
|                                                    "Microsoft.AzureResilienceManagement/locations/operationStatuses/read",
|                                                    "Microsoft.AzureResilienceManagement/operations/read",
|                                                    "Microsoft.Management/ServiceGroups/read",
|                                                    "Microsoft.Relationships/ServiceGroupMember/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "852e55ca-96ce-48b0-abca-2cd74d9042ca",
|                                    "Name":  "Azure Kubernetes Application Network Contributor Role",
|                                    "Description":  "Grant read, write and delete access to Azure Kubernetes Application Network",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AppLink/AppLinks/read",
|                                                    "Microsoft.AppLink/AppLinks/write",
|                                                    "Microsoft.AppLink/AppLinks/delete",
|                                                    "Microsoft.AppLink/AppLinks/AppLinkMembers/read",
|                                                    "Microsoft.AppLink/AppLinks/AppLinkMembers/write",
|                                                    "Microsoft.AppLink/AppLinks/AppLinkMembers/delete",
|                                                    "Microsoft.AppLink/locations/operationStatuses/read",
|                                                    "Microsoft.AppLink/Locations/OperationStatuses/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "463ad26c-fcce-4469-9c7f-5653d8acbab5",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Reader for Member Clusters",
|                                    "Description":  "Allows read-only access to see most objects in a namespace. It does not allow viewing roles or role bindings. This role does not allow viewing Secrets, since reading the contents of Secrets enables access to ServiceAccount credentials in the namespace, which would allow API access as any ServiceAccount in the namespace (a form of privilege escalation).  Applying this role at cluster scope will give access across all namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/members/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/fleets/members/apps/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/members/apps/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/members/apps/replicasets/read",
|                                                        "Microsoft.ContainerService/fleets/members/apps/statefulsets/read",
|                                                        "Microsoft.ContainerService/fleets/members/autoscaling/horizontalpodautoscalers/read",
|                                                        "Microsoft.ContainerService/fleets/members/batch/cronjobs/read",
|                                                        "Microsoft.ContainerService/fleets/members/batch/jobs/read",
|                                                        "Microsoft.ContainerService/fleets/members/configmaps/read",
|                                                        "Microsoft.ContainerService/fleets/members/discovery.k8s.io/endpointslices/read",
|                                                        "Microsoft.ContainerService/fleets/members/endpoints/read",
|                                                        "Microsoft.ContainerService/fleets/members/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/fleets/members/events/read",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/daemonsets/read",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/deployments/read",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/replicasets/read",
|                                                        "Microsoft.ContainerService/fleets/members/limitranges/read",
|                                                        "Microsoft.ContainerService/fleets/members/metrics.k8s.io/pods/read",
|                                                        "Microsoft.ContainerService/fleets/members/metrics.k8s.io/nodes/read",
|                                                        "Microsoft.ContainerService/fleets/members/namespaces/read",
|                                                        "Microsoft.ContainerService/fleets/members/networking.k8s.io/ingresses/read",
|                                                        "Microsoft.ContainerService/fleets/members/networking.k8s.io/networkpolicies/read",
|                                                        "Microsoft.ContainerService/fleets/members/persistentvolumeclaims/read",
|                                                        "Microsoft.ContainerService/fleets/members/pods/read",
|                                                        "Microsoft.ContainerService/fleets/members/policy/poddisruptionbudgets/read",
|                                                        "Microsoft.ContainerService/fleets/members/replicationcontrollers/read",
|                                                        "Microsoft.ContainerService/fleets/members/resourcequotas/read",
|                                                        "Microsoft.ContainerService/fleets/members/serviceaccounts/read",
|                                                        "Microsoft.ContainerService/fleets/members/services/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d1f699ed-700a-4c77-a22f-29890ac7b115",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Admin for Member Clusters",
|                                    "Description":  "This role grants admin access - provides write permissions on most objects within a namespace, with the exception of ResourceQuota object and the namespace object itself. Applying this role at cluster scope will give access across all namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/members/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "50346970-0998-40f2-b47d-f3b8809840f8",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Writer for Member Clusters",
|                                    "Description":  "Allows read/write access to most objects in a namespace. This role does not allow viewing or modifying roles or role bindings. However, this role allows accessing Secrets and running Pods as any ServiceAccount in the namespace, so it can be used to gain the API access levels of any ServiceAccount in the namespace.  Applying this role at cluster scope will give access across all namespaces.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/members/apps/controllerrevisions/read",
|                                                        "Microsoft.ContainerService/fleets/members/apps/daemonsets/*",
|                                                        "Microsoft.ContainerService/fleets/members/apps/deployments/*",
|                                                        "Microsoft.ContainerService/fleets/members/apps/replicasets/*",
|                                                        "Microsoft.ContainerService/fleets/members/apps/statefulsets/*",
|                                                        "Microsoft.ContainerService/fleets/members/autoscaling/horizontalpodautoscalers/*",
|                                                        "Microsoft.ContainerService/fleets/members/batch/cronjobs/*",
|                                                        "Microsoft.ContainerService/fleets/members/coordination.k8s.io/leases/read",
|                                                        "Microsoft.ContainerService/fleets/members/coordination.k8s.io/leases/write",
|                                                        "Microsoft.ContainerService/fleets/members/coordination.k8s.io/leases/delete",
|                                                        "Microsoft.ContainerService/fleets/members/discovery.k8s.io/endpointslices/read",
|                                                        "Microsoft.ContainerService/fleets/members/batch/jobs/*",
|                                                        "Microsoft.ContainerService/fleets/members/configmaps/*",
|                                                        "Microsoft.ContainerService/fleets/members/endpoints/*",
|                                                        "Microsoft.ContainerService/fleets/members/events.k8s.io/events/read",
|                                                        "Microsoft.ContainerService/fleets/members/events/*",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/daemonsets/*",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/deployments/*",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/ingresses/*",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/networkpolicies/*",
|                                                        "Microsoft.ContainerService/fleets/members/extensions/replicasets/*",
|                                                        "Microsoft.ContainerService/fleets/members/limitranges/read",
|                                                        "Microsoft.ContainerService/fleets/members/metrics.k8s.io/pods/read",
|                                                        "Microsoft.ContainerService/fleets/members/metrics.k8s.io/nodes/read",
|                                                        "Microsoft.ContainerService/fleets/members/namespaces/read",
|                                                        "Microsoft.ContainerService/fleets/members/networking.k8s.io/ingresses/*",
|                                                        "Microsoft.ContainerService/fleets/members/networking.k8s.io/networkpolicies/*",
|                                                        "Microsoft.ContainerService/fleets/members/persistentvolumeclaims/*",
|                                                        "Microsoft.ContainerService/fleets/members/pods/*",
|                                                        "Microsoft.ContainerService/fleets/members/policy/poddisruptionbudgets/*",
|                                                        "Microsoft.ContainerService/fleets/members/replicationcontrollers/*",
|                                                        "Microsoft.ContainerService/fleets/members/resourcequotas/read",
|                                                        "Microsoft.ContainerService/fleets/members/secrets/*",
|                                                        "Microsoft.ContainerService/fleets/members/serviceaccounts/*",
|                                                        "Microsoft.ContainerService/fleets/members/services/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "79a36d98-eb96-4a76-ae1d-481dc98d2c23",
|                                    "Name":  "Azure Kubernetes Fleet Manager RBAC Cluster Admin for Member Clusters",
|                                    "Description":  "Lets you manage all resources in the member clusters in the fleet.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/members/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5eaf7b81-a48f-45ed-b6b4-c64bfe86d523",
|                                    "Name":  "Relationship Reader",
|                                    "Description":  "Role definition allowing read access to all relationship types",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Relationships/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b54df9c1-53dc-45cc-a86d-7a83cced2ed0",
|                                    "Name":  "Relationship Administrator",
|                                    "Description":  "Role definition allowing read, write and delete access to all relationship types",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Relationships/*/read",
|                                                    "Microsoft.Relationships/*/write",
|                                                    "Microsoft.Relationships/*/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "05b1aaf9-00c9-477b-b0e8-2da660b78c51",
|                                    "Name":  "Service Group Member Relationship Contributor",
|                                    "Description":  "Role definition allowing read, write and delete access to Service Group Member relationship types",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Relationships/serviceGroupMember/read",
|                                                    "Microsoft.Relationships/serviceGroupMember/write",
|                                                    "Microsoft.Relationships/serviceGroupMember/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "eb64ab4c-23eb-4f63-a9c2-27da365f04e7",
|                                    "Name":  "SRE Agent Author",
|                                    "Description":  "Allows users to add custom features to the SRE Agent using incident handlers and extended agents.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.App/agents/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.App/agents/threads/read",
|                                                        "Microsoft.App/agents/incidentManagement/read",
|                                                        "Microsoft.App/agents/incidentManagement/write",
|                                                        "Microsoft.App/agents/incidentManagement/delete",
|                                                        "Microsoft.App/agents/extendedAgents/read",
|                                                        "Microsoft.App/agents/extendedAgents/write",
|                                                        "Microsoft.App/agents/extendedAgents/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5052f0f9-7e27-4570-bc13-9ee1cf442526",
|                                    "Name":  "Microsoft Confluent Contributor role",
|                                    "Description":  "Microsoft Confluent Provider role to manage organizations and child resource.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Confluent/agreements/write",
|                                                    "Microsoft.Confluent/locations/OperationStatuses/write",
|                                                    "Microsoft.Confluent/organizations/access/createInvitation/action",
|                                                    "Microsoft.Confluent/organizations/access/deleteRoleBinding/delete",
|                                                    "Microsoft.Confluent/organizations/access/listClusters/action",
|                                                    "Microsoft.Confluent/organizations/access/listEnvironments/action",
|                                                    "Microsoft.Confluent/organizations/access/listInvitations/action",
|                                                    "Microsoft.Confluent/organizations/access/listRoleBindings/action",
|                                                    "Microsoft.Confluent/organizations/access/listServiceAccounts/action",
|                                                    "Microsoft.Confluent/organizations/access/listUsers/action",
|                                                    "Microsoft.Confluent/organizations/apiKeys/delete",
|                                                    "Microsoft.Confluent/organizations/delete",
|                                                    "Microsoft.Confluent/organizations/environments/clusters/connectors/delete",
|                                                    "Microsoft.Confluent/organizations/environments/clusters/connectors/write",
|                                                    "Microsoft.Confluent/organizations/environments/clusters/createAPIKey/action",
|                                                    "Microsoft.Confluent/organizations/environments/clusters/delete",
|                                                    "Microsoft.Confluent/organizations/environments/clusters/topics/delete",
|                                                    "Microsoft.Confluent/organizations/environments/clusters/topics/write",
|                                                    "Microsoft.Confluent/organizations/environments/clusters/write",
|                                                    "Microsoft.Confluent/organizations/environments/delete",
|                                                    "Microsoft.Confluent/organizations/environments/write",
|                                                    "Microsoft.Confluent/organizations/listRegions/action",
|                                                    "Microsoft.Confluent/organizations/write",
|                                                    "Microsoft.Confluent/validations/orgvalidate/action",
|                                                    "Microsoft.Confluent/validations/orgvalidateV2/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "2e481b5d-5af3-463b-8b01-f9c948aaf0c5",
|                                    "Name":  "Informatica DataManagement Contributor role",
|                                    "Description":  "Informatica DataManagement Provider role to manage organizations and child resource.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Informatica.DataManagement/locations/operationStatuses/write",
|                                                    "Informatica.DataManagement/organizations/delete",
|                                                    "Informatica.DataManagement/organizations/getServerlessMetadata/action",
|                                                    "Informatica.DataManagement/organizations/serverlessRuntimes/delete",
|                                                    "Informatica.DataManagement/organizations/serverlessRuntimes/write",
|                                                    "Informatica.DataManagement/organizations/singleSignOnConfigurations/delete",
|                                                    "Informatica.DataManagement/organizations/singleSignOnConfigurations/write",
|                                                    "Informatica.DataManagement/organizations/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "512ef07a-840c-48d2-9be4-9a30a75a5c70",
|                                    "Name":  "Defender Cloud Secrets Posture",
|                                    "Description":  "Service role that provides permissions for Microsoft Defender Cloud Secrets Posture",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DocumentDB/databaseAccounts/listKeys/action",
|                                                    "Microsoft.documentdb/mongoClusters/read",
|                                                    "Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action",
|                                                    "Microsoft.CognitiveServices/accounts/listKeys/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5a2ec2f1-2375-4950-9906-59ec1d979249",
|                                    "Name":  "Azure Resilience Management Drills Assets Administrator",
|                                    "Description":  "This Role grants permissions on the Chaos Subscription to create, read, and delete Resource Groups, Automation Accounts, and Chaos Experiments, and assigns necessary roles to Drill and Chaos MSIs for executing post actions required by Azure Resilience Management Drills.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/delete",
|                                                    "Microsoft.Automation/automationAccounts/read",
|                                                    "Microsoft.Automation/automationAccounts/write",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/delete",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/write",
|                                                    "Microsoft.Chaos/experiments/delete",
|                                                    "Microsoft.Chaos/experiments/read",
|                                                    "Microsoft.Chaos/experiments/write",
|                                                    "Microsoft.Chaos/locations/operationResults/read",
|                                                    "Microsoft.Chaos/locations/operationStatuses/read",
|                                                    "Microsoft.Chaos/workspaces/delete",
|                                                    "Microsoft.Chaos/workspaces/read",
|                                                    "Microsoft.Chaos/workspaces/write",
|                                                    "Microsoft.Chaos/workspaces/refreshRecommendations/action",
|                                                    "Microsoft.Chaos/workspaces/discoveredResources/read",
|                                                    "Microsoft.Chaos/workspaces/scenarios/delete",
|                                                    "Microsoft.Chaos/workspaces/scenarios/read",
|                                                    "Microsoft.Chaos/workspaces/scenarios/write",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/delete",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/read",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/write",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/cancel/action",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/execute/action",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/validate/action",
|                                                    "Microsoft.Chaos/workspaces/scenarios/runs/read",
|                                                    "Microsoft.Insights/dataCollectionEndpoints/read",
|                                                    "Microsoft.Insights/dataCollectionEndpoints/write",
|                                                    "Microsoft.Insights/dataCollectionRules/read",
|                                                    "Microsoft.Insights/dataCollectionRules/write",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedKeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/tables/read",
|                                                    "Microsoft.OperationalInsights/workspaces/tables/write",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.OperationalInsights/workspaces/write",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "344b740c-5e7c-4d32-89b2-ee3b51cb89bc",
|                                    "Name":  "Azure Resilience Management Drills Assets Contributor",
|                                    "Description":  "This Role grants permissions on the Chaos Subscription to create, read, and delete Resource Groups, Automation Accounts, and Chaos Experiments for managing chaos engineering workflows required by Azure Resilience Management Drills",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Automation/automationAccounts/delete",
|                                                    "Microsoft.Automation/automationAccounts/read",
|                                                    "Microsoft.Automation/automationAccounts/write",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/delete",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/read",
|                                                    "Microsoft.Automation/automationAccounts/runbooks/write",
|                                                    "Microsoft.Chaos/experiments/delete",
|                                                    "Microsoft.Chaos/experiments/read",
|                                                    "Microsoft.Chaos/experiments/write",
|                                                    "Microsoft.Chaos/workspaces/delete",
|                                                    "Microsoft.Chaos/workspaces/read",
|                                                    "Microsoft.Chaos/workspaces/write",
|                                                    "Microsoft.Chaos/workspaces/refreshRecommendations/action",
|                                                    "Microsoft.Chaos/workspaces/discoveredResources/read",
|                                                    "Microsoft.Chaos/workspaces/scenarios/delete",
|                                                    "Microsoft.Chaos/workspaces/scenarios/read",
|                                                    "Microsoft.Chaos/workspaces/scenarios/write",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/delete",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/read",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/write",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/cancel/action",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/execute/action",
|                                                    "Microsoft.Chaos/workspaces/scenarios/configurations/validate/action",
|                                                    "Microsoft.Chaos/workspaces/scenarios/runs/read",
|                                                    "Microsoft.Chaos/locations/operationResults/read",
|                                                    "Microsoft.Chaos/locations/operationStatuses/read",
|                                                    "Microsoft.Insights/dataCollectionEndpoints/read",
|                                                    "Microsoft.Insights/dataCollectionEndpoints/write",
|                                                    "Microsoft.Insights/dataCollectionRules/read",
|                                                    "Microsoft.Insights/dataCollectionRules/write",
|                                                    "Microsoft.OperationalInsights/workspaces/sharedKeys/action",
|                                                    "Microsoft.OperationalInsights/workspaces/tables/read",
|                                                    "Microsoft.OperationalInsights/workspaces/tables/write",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.OperationalInsights/workspaces/write",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/delete",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e4c7f620-39b8-4688-bba2-70dd82ef367b",
|                                    "Name":  "Azure Resilience Management Drills Target Resource Administrator",
|                                    "Description":  "This role should be assigned at the Service Group Members scope to enable resource read access, manage role assignments, and configure chaos targets and capabilities for fault injection, failover, and other post-fault actions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/roleAssignments/write",
|                                                    "*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Chaos/locations/targetTypes/capabilityTypes/read",
|                                                    "Microsoft.Chaos/locations/targetTypes/read",
|                                                    "Microsoft.Chaos/targets/capabilities/delete",
|                                                    "Microsoft.Chaos/targets/capabilities/read",
|                                                    "Microsoft.Chaos/targets/capabilities/write",
|                                                    "Microsoft.Chaos/targets/delete",
|                                                    "Microsoft.Chaos/targets/read",
|                                                    "Microsoft.Chaos/targets/write",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/virtualNetworks/read ",
|                                                    "Microsoft.Sql/managedInstances/read",
|                                                    "Microsoft.Web/serverfarms/read",
|                                                    "Microsoft.Web/sites/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "82c6a823-ae9c-4b90-b5c5-bff581c45896",
|                                    "Name":  "Azure Resilience Management Drills Target Resource Contributor",
|                                    "Description":  "This role should be assigned at the Service Group Members scope to enable resource read access and configure chaos targets and capabilities for fault injection, failover, and other post-fault actions",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Chaos/locations/targetTypes/capabilityTypes/read",
|                                                    "Microsoft.Chaos/locations/targetTypes/read",
|                                                    "Microsoft.Chaos/targets/capabilities/delete",
|                                                    "Microsoft.Chaos/targets/capabilities/read",
|                                                    "Microsoft.Chaos/targets/capabilities/write",
|                                                    "Microsoft.Chaos/targets/delete",
|                                                    "Microsoft.Chaos/targets/read",
|                                                    "Microsoft.Chaos/targets/write",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/virtualNetworks/read ",
|                                                    "Microsoft.Sql/managedInstances/read",
|                                                    "Microsoft.Web/serverfarms/read",
|                                                    "Microsoft.Web/sites/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "dc0882cc-bc27-4d21-9ea2-f821aaa10fb1",
|                                    "Name":  "ARN Service Event Grid Subscriber Role",
|                                    "Description":  "Allows ARN to subscribe to partner event grid topics",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EventGrid/EventSubscriptions/write",
|                                                    "Microsoft.EventGrid/*/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a51d5f27-deba-47d1-9ccd-8589014b2e28",
|                                    "Name":  "Gcp Connector contributor role",
|                                    "Description":  "Microsoft.GcpConnector contributor role",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.GcpConnector/bigQueryDatasets/delete",
|                                                    "Microsoft.GcpConnector/bigQueryDatasets/write",
|                                                    "Microsoft.GcpConnector/cloudFunctions/delete",
|                                                    "Microsoft.GcpConnector/cloudFunctions/write",
|                                                    "Microsoft.GcpConnector/computeInstances/delete",
|                                                    "Microsoft.GcpConnector/computeInstances/write",
|                                                    "Microsoft.GcpConnector/containerClusters/delete",
|                                                    "Microsoft.GcpConnector/containerClusters/write",
|                                                    "Microsoft.GcpConnector/Locations/OperationStatuses/write",
|                                                    "Microsoft.GcpConnector/sqlAdminInstances/delete",
|                                                    "Microsoft.GcpConnector/sqlAdminInstances/write",
|                                                    "Microsoft.GcpConnector/storageBuckets/delete",
|                                                    "Microsoft.GcpConnector/storageBuckets/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "46023a6a-0702-4cbf-956c-d8c3ac27bc2b",
|                                    "Name":  "Defender CSPM",
|                                    "Description":  "Grants permissions for Microsoft Defender for Cloud CSPM base plan features",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/accounts/aiservices/agents/read",
|                                                        "Microsoft.CognitiveServices/accounts/aiservices/assets/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5d9bac3f-34b2-432f-bde5-78aa8e73ce6b",
|                                    "Name":  "Storage File Data SMB Take Ownership",
|                                    "Description":  "Allows end user to assume ownership of a file/directory",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/fileServices/takeOwnership/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "35c49d44-ccc1-4b18-8267-cfb3bacdd396",
|                                    "Name":  "Storage DataShare Contributor",
|                                    "Description":  "Allows creating and managing storage dataShares to share data from storage accounts in-place. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/listServiceSas/action",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/locations/DataManagementRPOperationStatuses/read",
|                                                    "Microsoft.Storage/locations/DataManagementRPOperationStatuses/write",
|                                                    "Microsoft.Storage/storageAccounts/dataShares/read",
|                                                    "Microsoft.Storage/storageAccounts/dataShares/delete",
|                                                    "Microsoft.Storage/storageAccounts/dataShares/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9d819e60-1b9f-4871-b492-4e6cdee0b50a",
|                                    "Name":  "Storage Connector Contributor",
|                                    "Description":  "Allows creating and managing storage connectors to access remote data sources in-place in a storage account. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.Storage/storageAccounts/listServiceSas/action",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
|                                                    "Microsoft.Storage/locations/DataManagementRPOperationStatuses/read",
|                                                    "Microsoft.Storage/locations/DataManagementRPOperationStatuses/write",
|                                                    "Microsoft.Storage/storageAccounts/connectors/read",
|                                                    "Microsoft.Storage/storageAccounts/connectors/delete",
|                                                    "Microsoft.Storage/storageAccounts/connectors/write",
|                                                    "Microsoft.Storage/storageAccounts/connectors/testExistingConnection/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "14f26b53-9d80-4924-8141-f664426a48f6",
|                                    "Name":  "Cognitive Services Security Integration Admin",
|                                    "Description":  "Lets you manage safety providers for Cognitive Services.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "45265627-32f7-4da4-9ab0-b1cb0e9ec70b",
|                                    "Name":  "Playwright Workspace Owner",
|                                    "Description":  "Perform all operations on Playwright Workspace resources. Can manage service access tokens and execute Playwright tests.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Loadtestservice/playwrightworkspaces/*",
|                                                    "Microsoft.Loadtestservice/locations/playwrightquotas/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "19d36063-d00b-4ea5-a1ac-a7c4926a0b78",
|                                    "Name":  "Playwright Workspace Reader",
|                                    "Description":  "View and list all Playwright Workspace resources and tests but can not make any changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Loadtestservice/playwrightworkspaces/*/read",
|                                                    "Microsoft.Loadtestservice/locations/playwrightquotas/*/read",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "78cf819f-0969-4ebe-8759-015c6efcd5bf",
|                                    "Name":  "Playwright Workspace Contributor",
|                                    "Description":  "View and list Playwright Workspace resources but can not make any changes. Can manage service access tokens and execute Playwright tests.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Loadtestservice/playwrightworkspaces/*/read",
|                                                    "Microsoft.Loadtestservice/locations/playwrightquotas/*",
|                                                    "Microsoft.Loadtestservice/playwrightworkspaces/AccessTokens/*",
|                                                    "Microsoft.Loadtestservice/playwrightworkspaces/TestRuns/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6f91a4f9-10ee-4b95-b8cd-96ee73c5968d",
|                                    "Name":  "Defender API Security",
|                                    "Description":  "Grants Microsoft Defender for Cloud access to computes to provide API security",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Security/pricings/read",
|                                                    "Microsoft.Security/apiCollections/read",
|                                                    "Microsoft.ApiManagement/service/read",
|                                                    "Microsoft.ApiManagement/service/apis/read",
|                                                    "Microsoft.ApiManagement/service/apis/operations/read",
|                                                    "Microsoft.ApiManagement/service/apiVersionSets/read",
|                                                    "Microsoft.ApiManagement/service/apis/diagnostics/read",
|                                                    "Microsoft.ApiManagement/service/apis/diagnostics/write",
|                                                    "Microsoft.ApiManagement/service/apis/diagnostics/delete",
|                                                    "Microsoft.ApiManagement/service/apis/policies/read",
|                                                    "Microsoft.ApiManagement/service/backends/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/apis/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/apis/operations/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/apiVersionSets/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/apis/diagnostics/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/apis/diagnostics/write",
|                                                    "Microsoft.ApiManagement/service/workspaces/apis/diagnostics/delete",
|                                                    "Microsoft.ApiManagement/service/workspaces/apis/policies/read",
|                                                    "Microsoft.ApiManagement/service/workspaces/backends/read",
|                                                    "Microsoft.ApiManagement/gateways/configConnections/read",
|                                                    "Microsoft.ApiManagement/service/workspaceLinks/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "7d0c0268-1199-449b-a52e-75c20879f46b",
|                                    "Name":  "Defender Settings Contributor",
|                                    "Description":  "Grants Microsoft Defender for Cloud access to Defender Settings",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "microsoft.security/pricings/read",
|                                                    "microsoft.security/pricings/write",
|                                                    "microsoft.security/pricings/securityoperators/read",
|                                                    "microsoft.security/securityoperators/read",
|                                                    "microsoft.security/register/action",
|                                                    "microsoft.security/settings/read",
|                                                    "microsoft.security/settings/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d56b031f-8d90-4376-9231-b5c94fce88ef",
|                                    "Name":  "Defender Unified RBAC Scoped Reader",
|                                    "Description":  "Defender Unified RBAC Scoped Reader. This role is managed and assigned automatically by the Defender Unified RBAC system. Manual assignment of this role is not recommended, as the Defender Unified RBAC system may modify or remove it at any time based on system requirements.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.SecurityInsights/*/read",
|                                                    "Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/indicators/query/action",
|                                                    "Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action",
|                                                    "Microsoft.OperationalInsights/workspaces/analytics/query/action",
|                                                    "Microsoft.OperationalInsights/workspaces/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/LinkedServices/read",
|                                                    "Microsoft.OperationalInsights/workspaces/savedSearches/read",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/read",
|                                                    "Microsoft.OperationalInsights/workspaces/query/*/read",
|                                                    "Microsoft.OperationalInsights/querypacks/*/read",
|                                                    "Microsoft.OperationalInsights/workspaces/dataSources/read",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.Insights/workbooks/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/templateSpecs/*/read",
|                                                    "Microsoft.Authorization/*/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.SecurityInsights/ConfidentialWatchlists/*",
|                                                       "Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*",
|                                                       "Microsoft.SecurityInsights/alertRules/read"
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.OperationalInsights/workspaces/tables/data/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a954a0e0-f57f-4606-8421-fd7bd4e54b0f",
|                                    "Name":  "Azure Device Onboarding Contributor",
|                                    "Description":  "Can read, write, or delete resources for onboarding services, policies, and device states.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DeviceOnboarding/onboardingServices/read",
|                                                    "Microsoft.DeviceOnboarding/onboardingServices/write",
|                                                    "Microsoft.DeviceOnboarding/onboardingServices/delete",
|                                                    "Microsoft.DeviceOnboarding/onboardingServices/policies/read",
|                                                    "Microsoft.DeviceOnboarding/onboardingServices/policies/write",
|                                                    "Microsoft.DeviceOnboarding/onboardingServices/policies/delete",
|                                                    "Microsoft.DeviceOnboarding/deviceStates/read",
|                                                    "Microsoft.DeviceOnboarding/deviceStates/write",
|                                                    "Microsoft.DeviceOnboarding/deviceStates/delete",
|                                                    "Microsoft.DeviceOnboarding/deviceStates/prepareForOnboarding/action",
|                                                    "Microsoft.DeviceOnboarding/locations/operationStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "980cf6f7-edec-4fd1-8e9e-28f70b1d5258",
|                                    "Name":  "Compute Limit Operator",
|                                    "Description":  "Read and manage compute limits using compute limit operations.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ComputeLimit/locations/guestSubscriptions/read",
|                                                    "Microsoft.ComputeLimit/locations/guestSubscriptions/write",
|                                                    "Microsoft.ComputeLimit/locations/guestSubscriptions/delete",
|                                                    "Microsoft.ComputeLimit/locations/sharedLimits/read",
|                                                    "Microsoft.ComputeLimit/locations/sharedLimits/write",
|                                                    "Microsoft.ComputeLimit/locations/sharedLimits/delete",
|                                                    "Microsoft.ComputeLimit/register/action",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "045b6ee5-0c68-42c4-9be0-7389794309f5",
|                                    "Name":  "MongoDB Atlas Contributor",
|                                    "Description":  "Provides access to MongoDB.Atlas Control Plane Operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "MongoDB.Atlas/checkNameAvailability/action",
|                                                    "MongoDB.Atlas/register/action",
|                                                    "MongoDB.Atlas/unregister/action",
|                                                    "MongoDB.Atlas/operations/read",
|                                                    "MongoDB.Atlas/locations/operationStatuses/read",
|                                                    "MongoDB.Atlas/locations/operationStatuses/write",
|                                                    "MongoDB.Atlas/registeredSubscriptions/read",
|                                                    "MongoDB.Atlas/organizations/read",
|                                                    "MongoDB.Atlas/organizations/write",
|                                                    "MongoDB.Atlas/organizations/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ee99642a-225b-4fe8-a771-9d9036053e87",
|                                    "Name":  "Arc Container Storage Contributor",
|                                    "Description":  "Create, read, modify, and delete Arc Container Storage resources on connected clusters. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ArcContainerStorage/edgeStorageConfigurations/read",
|                                                    "Microsoft.ArcContainerStorage/edgeStorageConfigurations/write",
|                                                    "Microsoft.ArcContainerStorage/edgeStorageConfigurations/delete",
|                                                    "Microsoft.ArcContainerStorage/edgeVolumes/read",
|                                                    "Microsoft.ArcContainerStorage/edgeVolumes/write",
|                                                    "Microsoft.ArcContainerStorage/edgeVolumes/delete",
|                                                    "Microsoft.ArcContainerStorage/edgeVolumes/ingestSubvolumes/read",
|                                                    "Microsoft.ArcContainerStorage/edgeVolumes/ingestSubvolumes/write",
|                                                    "Microsoft.ArcContainerStorage/edgeVolumes/ingestSubvolumes/delete",
|                                                    "Microsoft.ArcContainerStorage/locations/operationStatuses/read",
|                                                    "Microsoft.ArcContainerStorage/locations/operationStatuses/write"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.ArcContainerStorage/register/action",
|                                                       "Microsoft.ArcContainerStorage/unregister/action"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c883944f-8b7b-4483-af10-35834be79c4a",
|                                    "Name":  "Azure AI Owner",
|                                    "Description":  "Grants full to manage AI project and accounts. Grants reader access to AI projects, reader access to AI accounts, and data actions for an AI project.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AlertsManagement/actionRules/*",
|                                                    "Microsoft.AlertsManagement/alerts/*",
|                                                    "Microsoft.AlertsManagement/issues/*",
|                                                    "Microsoft.AlertsManagement/prometheusRuleGroups/*",
|                                                    "Microsoft.AlertsManagement/smartDetectorAlertRules/*",
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.CognitiveServices/*",
|                                                    "Microsoft.Insights/activityLogAlerts/*",
|                                                    "Microsoft.Insights/metricalerts/*",
|                                                    "Microsoft.Insights/scheduledqueryrules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/deployments/operations/read",
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Support/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.CognitiveServices/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "42f3c60f-e7b1-46d7-ba56-6de681664342",
|                                    "Name":  "Azure Red Hat OpenShift First Party Network",
|                                    "Description":  "Grant ARO Classic First Party Service Principal or managed identity required network permissions.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/join/action",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/routeTables/join/action",
|                                                    "Microsoft.Network/routeTables/read",
|                                                    "Microsoft.Network/natGateways/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/join/action",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/serviceEndpointPolicies/join/action",
|                                                    "Microsoft.Network/networkIntentPolicies/join/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8da79822-b118-42bc-83c9-789fdbdcd77b",
|                                    "Name":  "Elastic SAN Volume Data Contributor",
|                                    "Description":  "Allows for read and write access to a volume data on Azure Elastic SAN",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.ElasticSan/elasticsans/volumeGroups/volumes/write",
|                                                    "Microsoft.ElasticSan/elasticsans/volumeGroups/volumes/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ElasticSan/elasticsans/volumeGroups/volumes/data/read",
|                                                        "Microsoft.ElasticSan/elasticsans/volumeGroups/volumes/data/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "92318126-08be-45d0-a1b2-532e6c7d52ce",
|                                    "Name":  "Microsoft Approvals Workflow Contributor",
|                                    "Description":  "Performs approval workflow management operations including workflow creation, execution and deletion.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Approvals/approvalSettings/read",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/read",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/write",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/delete",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/read",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/write",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/syncPolicyStatus/action",
|                                                    "Microsoft.Approvals/approvalWorkflowAssignments/read",
|                                                    "Microsoft.Approvals/approvalWorkflowAssignments/write",
|                                                    "Microsoft.Approvals/approvalWorkflowAssignments/delete",
|                                                    "Microsoft.Approvals/invokeAndFetchApprovalRequest/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "98d40527-c073-4096-943a-dd593105ca9c",
|                                    "Name":  "Microsoft Approvals Service Operator",
|                                    "Description":  "Performs Approvals service-level management operations including service onboarding and configuration.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Approvals/approvalSettings/read",
|                                                    "Microsoft.Approvals/approvalSettings/write",
|                                                    "Microsoft.Approvals/approvalSettings/delete",
|                                                    "Microsoft.Approvals/approvalSettings/initialize/action",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/read",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/read",
|                                                    "Microsoft.Approvals/approvalWorkflowAssignments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0343f3e8-01ac-4bb8-8f93-78b1d31ba64b",
|                                    "Name":  "Microsoft Approvals Request User",
|                                    "Description":  "Requests approval workflow execution for resource changes.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Approvals/invokeAndFetchApprovalRequest/action",
|                                                    "Microsoft.Approvals/approvalSettings/read",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/read",
|                                                    "Microsoft.Approvals/approvalWorkflowDefinitions/approvalWorkflowInstances/read",
|                                                    "Microsoft.Approvals/approvalWorkflowAssignments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a6a9a135-9048-45df-b559-a90bb025e92f",
|                                    "Name":  "Astronomer Astro Contributor",
|                                    "Description":  "Provides access to Astronomer.Astro Control Plane Operations",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Astronomer.Astro/register/action",
|                                                    "Astronomer.Astro/unregister/action",
|                                                    "Astronomer.Astro/operations/read",
|                                                    "Astronomer.Astro/organizations/read",
|                                                    "Astronomer.Astro/organizations/write",
|                                                    "Astronomer.Astro/organizations/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0e2ecf2a-0574-4b08-89e2-be133aa6303f",
|                                    "Name":  "Defender Databricks Operator",
|                                    "Description":  "Grants permissions for Microsoft Defender for Cloud feature on Databricks.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Databricks/workspaces/read",
|                                                    "Microsoft.Databricks/workspaces/assignWorkspaceAdmin/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4b2b8358-764b-4884-85c6-f4b7946d95ad",
|                                    "Name":  "EdgeMarketPlace role",
|                                    "Description":  "Microsoft.EdgeMarketPlace role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.EdgeMarketplace/locations/operationStatuses/write",
|                                                    "Microsoft.EdgeMarketplace/locations/operationStatuses/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "9a0e5da3-6c70-4a35-b13a-715cd5a7919a",
|                                    "Name":  "Azure Stack Hub registration role",
|                                    "Description":  "Microsoft.AzureStack registration role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStack/registrations/customerSubscriptions/delete",
|                                                    "Microsoft.AzureStack/registrations/customerSubscriptions/write",
|                                                    "Microsoft.AzureStack/registrations/delete",
|                                                    "Microsoft.AzureStack/registrations/enableRemoteManagement/action",
|                                                    "Microsoft.AzureStack/registrations/getActivationKey/action",
|                                                    "Microsoft.AzureStack/registrations/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "17e4de9d-139f-4531-b521-20804c310cf8",
|                                    "Name":  "Azure Stack Hub Linked Subscriptions role",
|                                    "Description":  "Microsoft.AzureStack Linked Subscriptions role.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStack/linkedSubscriptions/delete",
|                                                    "Microsoft.AzureStack/linkedSubscriptions/linkedProviders/action",
|                                                    "Microsoft.AzureStack/linkedSubscriptions/linkedResourceGroups/action",
|                                                    "Microsoft.AzureStack/linkedSubscriptions/operations/action",
|                                                    "Microsoft.AzureStack/linkedSubscriptions/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d2acaa63-2a62-4c01-998a-cdbe7a00d709",
|                                    "Name":  "Defender Azure Cosmos DB",
|                                    "Description":  "Microsoft Defender for Azure Cosmos DB role. Grant permissions for enablement.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DocumentDB/databaseAccounts/read",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "99626c15-0799-47ad-96ab-f298031f69d6",
|                                    "Name":  "Defender Open Source Relational Databases",
|                                    "Description":  "Microsoft Defender for Open Source Relational Databases role. Grant permissions for enablement.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DBforMySQL/flexibleServers/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.DBforMySQL/flexibleServers/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.DBforMySQL/flexibleServers/read",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/read",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.DBforPostgreSQL/flexibleServers/advancedThreatProtectionSettings/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d9468a2b-1820-47e1-a40e-d2b7fba1879a",
|                                    "Name":  "Defender SQL Servers On Machines",
|                                    "Description":  "Microsoft Defender for SQL Servers On Machines role. Grant permissions for enablement.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/virtualMachines/extensions/delete",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/write",
|                                                    "Microsoft.Compute/virtualMachines/instanceView/read",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "a366d631-94bf-46bf-b4af-b38f28c80774",
|                                    "Name":  "Defender for Storage Threat Protection",
|                                    "Description":  "Microsoft Defender for Storage Threat Protection role - grants the permissions needed to enable/disable Defender for Storage Advanced Threat Protection at resource level.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Security/defenderForStorageSettings/read",
|                                                    "Microsoft.Security/defenderForStorageSettings/write",
|                                                    "Microsoft.Storage/storageAccounts/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "e1663658-d5f7-4383-9afb-af9fdc9c5eae",
|                                    "Name":  "Azure Kubernetes Fleet Manager ABAC Custom Resources Reader for Member Clusters",
|                                    "Description":  "Allows read-only access to view Kubernetes custom resources on Azure Kubernetes Fleet Manager member clusters. This role enables viewing custom resources without the ability to create, modify, or delete them. Applying this role at cluster scope will give read access to custom resources across all namespaces. More information on supported attributes for Attribute-Based Access Control (ABAC) conditions can be found under documentation at aka.ms/aks/abac/custom-resources/docs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/members/customresources/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "673366d4-9664-4020-b03b-b0093366bff9",
|                                    "Name":  "Azure Kubernetes Fleet Manager ABAC Custom Resources Writer for Member Clusters",
|                                    "Description":  "Allows write and delete access to manage Kubernetes custom resources on Azure Kubernetes Fleet Manager member clusters. This role enables creating, modifying, and deleting custom resources. Applying this role at cluster scope will give access to custom resources across all namespaces. More information on supported attributes for Attribute-Based Access Control (ABAC) conditions can be found under documentation at aka.ms/aks/abac/custom-resources/docs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/members/customresources/write",
|                                                        "Microsoft.ContainerService/fleets/members/customresources/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f82fbe13-0f98-4809-af81-b82c343db82f",
|                                    "Name":  "Device Update Contributor",
|                                    "Description":  "Gives you full access to manage Device Update accounts, instances, and private endpoint connections",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.DeviceUpdate/accounts/read",
|                                                    "Microsoft.DeviceUpdate/accounts/write",
|                                                    "Microsoft.DeviceUpdate/accounts/delete",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/read",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/write",
|                                                    "Microsoft.DeviceUpdate/accounts/instances/delete",
|                                                    "Microsoft.DeviceUpdate/accounts/privateEndpointConnections/read",
|                                                    "Microsoft.DeviceUpdate/accounts/privateEndpointConnections/write",
|                                                    "Microsoft.DeviceUpdate/accounts/privateEndpointConnections/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "20cf746c-c765-402a-885e-c389c64478ce",
|                                    "Name":  "Azure Kubernetes Fleet Manager ABAC Custom Resources Reader",
|                                    "Description":  "Allows read-only access to view Kubernetes custom resources on Azure Kubernetes Fleet Manager fleets. This role enables viewing custom resources without the ability to create, modify, or delete them. Applying this role at cluster scope will give read access to custom resources across all namespaces. More information on supported attributes for Attribute-Based Access Control (ABAC) conditions can be found under documentation at aka.ms/aks/abac/custom-resources/docs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/fleets/read",
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/customresources/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ff8eb232-5069-437e-94e5-31112ef30539",
|                                    "Name":  "Azure Kubernetes Fleet Manager ABAC Custom Resources Writer",
|                                    "Description":  "Allows write and delete access to manage Kubernetes custom resources on Azure Kubernetes Fleet Manager fleets. This role enables creating, modifying, and deleting custom resources. Applying this role at cluster scope will give access to custom resources across all namespaces. More information on supported attributes for Attribute-Based Access Control (ABAC) conditions can be found under documentation at aka.ms/aks/abac/custom-resources/docs",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Resources/subscriptions/operationresults/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.ContainerService/fleets/read",
|                                                    "Microsoft.ContainerService/fleets/listCredentials/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ContainerService/fleets/customresources/write",
|                                                        "Microsoft.ContainerService/fleets/customresources/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "78b19ac9-582c-44d8-9e11-733ae424ad83",
|                                    "Name":  "Defender Servers P1",
|                                    "Description":  "Defender Servers P1",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "ef3729d8-2861-401e-95ae-c7d4845a6097",
|                                    "Name":  "Genome Admin",
|                                    "Description":  "Full access to Genome control plane operations only",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Genome/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "1dc24dd8-b00e-4344-837c-58b193cd23c7",
|                                    "Name":  "Defender Servers P2",
|                                    "Description":  "Defender Servers P2",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/virtualMachines/read",
|                                                    "Microsoft.Network/loadBalancers/read",
|                                                    "Microsoft.Network/networkSecurityGroups/read",
|                                                    "Microsoft.Network/networkSecurityGroups/write",
|                                                    "Microsoft.Network/azureFirewalls/read",
|                                                    "Microsoft.Network/azureFirewalls/write",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/networkInterfaces/read",
|                                                    "Microsoft.Network/publicIPAddresses/read",
|                                                    "Microsoft.Network/routeTables/read",
|                                                    "Microsoft.HybridCompute/machines/read",
|                                                    "Microsoft.OperationalInsights/workspaces/read",
|                                                    "Microsoft.OperationsManagement/solutions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/write",
|                                                    "Microsoft.HybridCompute/machines/extensions/delete",
|                                                    "Microsoft.HybridCompute/machines/extensions/read",
|                                                    "Microsoft.Compute/virtualMachines/extensions/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "585db2ed-219e-4821-a06a-c6c14b602afa",
|                                    "Name":  "Healthcare Interop Contributor",
|                                    "Description":  "Allows all actions on healthcare interop provider resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.HealthcareInterop/ddmsConnectors/delete",
|                                                    "Microsoft.HealthcareInterop/ddmsConnectors/write",
|                                                    "Microsoft.HealthcareInterop/ddmsFhirEventBatchChannels/delete",
|                                                    "Microsoft.HealthcareInterop/ddmsFhirEventBatchChannels/write",
|                                                    "Microsoft.HealthcareInterop/ddmsFhirFlatFileBatchChannels/delete",
|                                                    "Microsoft.HealthcareInterop/ddmsFhirFlatFileBatchChannels/write",
|                                                    "Microsoft.HealthcareInterop/dicomConnectors/delete",
|                                                    "Microsoft.HealthcareInterop/dicomConnectors/write",
|                                                    "Microsoft.HealthcareInterop/dicomDirectChannels/delete",
|                                                    "Microsoft.HealthcareInterop/dicomDirectChannels/write",
|                                                    "Microsoft.HealthcareInterop/dicomEdgeConnectors/delete",
|                                                    "Microsoft.HealthcareInterop/dicomEdgeConnectors/write",
|                                                    "Microsoft.HealthcareInterop/fhirQueryEventBatchChannels/delete",
|                                                    "Microsoft.HealthcareInterop/fhirQueryEventBatchChannels/write",
|                                                    "Microsoft.HealthcareInterop/fhirQueryFlatFileBatchChannels/delete",
|                                                    "Microsoft.HealthcareInterop/fhirQueryFlatFileBatchChannels/write",
|                                                    "Microsoft.HealthcareInterop/hl7Connectors/delete",
|                                                    "Microsoft.HealthcareInterop/hl7Connectors/write",
|                                                    "Microsoft.HealthcareInterop/hl7EdgeConnectors/delete",
|                                                    "Microsoft.HealthcareInterop/hl7EdgeConnectors/write",
|                                                    "Microsoft.HealthcareInterop/hubs/delete",
|                                                    "Microsoft.HealthcareInterop/hubs/write",
|                                                    "Microsoft.HealthcareInterop/locations/operationStatuses/write",
|                                                    "Microsoft.HealthcareInterop/oneLakeConnectors/delete",
|                                                    "Microsoft.HealthcareInterop/oneLakeConnectors/write",
|                                                    "Microsoft.HealthcareInterop/storageAccountConnectors/delete",
|                                                    "Microsoft.HealthcareInterop/storageAccountConnectors/write",
|                                                    "Microsoft.HealthcareInterop/locations/operationStatuses/read",
|                                                    "Microsoft.HealthcareInterop/operations/read",
|                                                    "Microsoft.HealthcareInterop/hl7Connectors/read",
|                                                    "Microsoft.HealthcareInterop/oneLakeConnectors/read",
|                                                    "Microsoft.HealthcareInterop/storageAccountConnectors/read",
|                                                    "Microsoft.HealthcareInterop/fhirQueryFlatFileBatchChannels/read",
|                                                    "Microsoft.HealthcareInterop/fhirQueryEventBatchChannels/read",
|                                                    "Microsoft.HealthcareInterop/hl7EdgeConnectors/read",
|                                                    "Microsoft.HealthcareInterop/hubs/read",
|                                                    "Microsoft.HealthcareInterop/dicomEdgeConnectors/read",
|                                                    "Microsoft.HealthcareInterop/dicomConnectors/read",
|                                                    "Microsoft.HealthcareInterop/dicomDirectChannels/read",
|                                                    "Microsoft.HealthcareInterop/ddmsFhirEventBatchChannels/read",
|                                                    "Microsoft.HealthcareInterop/ddmsConnectors/read",
|                                                    "Microsoft.HealthcareInterop/ddmsFhirFlatFileBatchChannels/read",
|                                                    "Microsoft.HealthcareInterop/register/action",
|                                                    "Microsoft.HealthcareInterop/unregister/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "fc896ebc-f9a8-484d-a5ff-bd6a8c36289f",
|                                    "Name":  "Cosmos DB Long Term Retention Backup Role",
|                                    "Description":  "Allows performing long term retention backup operations for Cosmos DB",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DocumentDB/databaseAccounts/validateForLongTermProtection/action",
|                                                    "Microsoft.DocumentDB/databaseAccounts/enableLongTermProtection/action",
|                                                    "Microsoft.DocumentDB/databaseAccounts/disableLongTermProtection/action",
|                                                    "Microsoft.DocumentDB/databaseAccounts/preBackup/action",
|                                                    "Microsoft.DocumentDB/databaseAccounts/backup/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "955d0cb2-de4e-43ed-819a-14220e079ba7",
|                                    "Name":  "Cosmos DB Long Term Retention Restore Role",
|                                    "Description":  "Allows performing long term retention restore operations for Cosmos DB",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DocumentDB/databaseAccounts/preRestore/action",
|                                                    "Microsoft.DocumentDB/databaseAccounts/restore/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "78739afa-3ece-4d6b-90ba-762fdccd7438",
|                                    "Name":  "Azure Edge On-Site Deployment Manager",
|                                    "Description":  "Grants you access to take actions as an on-site person to assist in the provisioning of an edge device",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.AzureStackHCI/EdgeMachines/Read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "6fe711ec-654d-4ef7-8e32-eb7de3d94774",
|                                    "Name":  "Defender AI",
|                                    "Description":  "Service role that provides permissions for Microsoft Defender for AI",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.CognitiveServices/accounts/read",
|                                                    "Microsoft.CognitiveServices/accounts/defenderForAISettings/read",
|                                                    "Microsoft.CognitiveServices/accounts/defenderForAISettings/write",
|                                                    "Microsoft.CognitiveServices/accounts/defenderForAISettings/delete",
|                                                    "Microsoft.CognitiveServices/raiPolicy/read",
|                                                    "Microsoft.CognitiveServices/raiPolicy/write",
|                                                    "Microsoft.Search/searchServices/knowledgeBases/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "12675fd7-7f59-493f-9201-f7944860a2f1",
|                                    "Name":  "Azure Device Registry Administrator",
|                                    "Description":  "Azure Device Registry Administrator",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.DeviceRegistry/*"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "cd50fd1f-0421-46f2-8cce-afc587dbcc77",
|                                    "Name":  "Defender Storage Malware Data Scanner",
|                                    "Description":  "Grants data plane permissions for Microsoft Defender for Storage scanning operations — blob/file read, index tag updates.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write",
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read",
|                                                        "Microsoft.Storage/storageAccounts/fileServices/readFileBackupSemantics/action",
|                                                        "Microsoft.EventGrid/events/send/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "d622af9a-030e-4f32-8267-419abfd54702",
|                                    "Name":  "Pro Active Coding Data User",
|                                    "Description":  "Allows processing of health data in Pro Active Coding",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.HealthBot/healthBots/AIActions/ProActiveCoding/Process/Action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "eef9d654-743f-4e2c-ad0f-9ed243177663",
|                                    "Name":  "Defender Azure SQL Databases",
|                                    "Description":  "Microsoft Defender for Azure SQL Databases role. Grant permissions for enablement.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Sql/managedInstances/read",
|                                                    "Microsoft.Sql/managedInstances/securityAlertPolicies/read",
|                                                    "Microsoft.Sql/managedInstances/securityAlertPolicies/write",
|                                                    "Microsoft.Sql/servers/read",
|                                                    "Microsoft.Sql/servers/securityAlertPolicies/read",
|                                                    "Microsoft.Sql/servers/securityAlertPolicies/write",
|                                                    "Microsoft.Sql/servers/sqlVulnerabilityAssessments/read",
|                                                    "Microsoft.Sql/servers/sqlVulnerabilityAssessments/write",
|                                                    "Microsoft.Synapse/workspaces/read",
|                                                    "Microsoft.Synapse/workspaces/securityAlertPolicies/read",
|                                                    "Microsoft.Synapse/workspaces/securityAlertPolicies/write",
|                                                    "Microsoft.Sql/servers/vulnerabilityAssessments/read",
|                                                    "Microsoft.Synapse/workspaces/vulnerabilityAssessments/read",
|                                                    "Microsoft.Sql/managedInstances/vulnerabilityAssessments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "971cce9f-2680-4357-9678-c947847a9425",
|                                    "Name":  "Defender Storage Malware Operator",
|                                    "Description":  "Grants permissions for Microsoft Defender for Storage malware scanning operations including blob/file read, index tag updates, EventGrid management, and network bypass.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Security/defenderforstoragesettings/read",
|                                                    "Microsoft.Security/defenderforstoragesettings/write",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/read",
|                                                    "Microsoft.Security/advancedThreatProtectionSettings/write",
|                                                    "Microsoft.Security/securityOperators/read",
|                                                    "Microsoft.Storage/storageAccounts/write",
|                                                    "Microsoft.Storage/storageAccounts/read",
|                                                    "Microsoft.EventGrid/topics/read",
|                                                    "Microsoft.EventGrid/register/action",
|                                                    "Microsoft.EventGrid/eventSubscriptions/read",
|                                                    "Microsoft.EventGrid/eventSubscriptions/write",
|                                                    "Microsoft.EventGrid/eventSubscriptions/delete",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
|                                                    "Microsoft.Storage/storageAccounts/fileServices/shares/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c6c9b2d8-9a5e-4122-85e1-81612a046ab2",
|                                    "Name":  "Defender Storage Automated Malware Remediation",
|                                    "Description":  "Grants additional permissions for Microsoft Defender for Storage automated remediation operations including soft-delete management and blob deletion.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Storage/storageAccounts/blobServices/read",
|                                                    "Microsoft.Storage/storageAccounts/blobServices/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4f1e6fca-3fde-4291-961e-642def6d5e1d",
|                                    "Name":  "Confidential Ledger Data Reader",
|                                    "Description":  "Allows read access to Confidential Ledger transactions, including reading entries, receipts, and transaction status.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ConfidentialLedger/ledgers/transactions/read"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f1641a58-a144-402b-baf9-39d1a4c10119",
|                                    "Name":  "Confidential Ledger Data Contributor",
|                                    "Description":  "Allows read and write access to Confidential Ledger transactions, including reading entries, receipts, and transaction status, and creating new ledger entries.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.ConfidentialLedger/ledgers/transactions/read",
|                                                        "Microsoft.ConfidentialLedger/ledgers/transactions/write"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "8ec773c5-7ce6-4b78-91d1-182f8faa536d",
|                                    "Name":  "Microsoft Discovery Bookshelf Index Data Reader - Preview",
|                                    "Description":  "Grants query access to search and retrieve data from Microsoft Discovery Bookshelf knowledge bases. This is the minimum role required to use the retrieve action when linking a knowledge base to an agent. This role is in preview and subject to change.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Discovery/bookshelf/knowledgeBaseVersions/query/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "63342533-d951-495d-a3c3-a459aa02362b",
|                                    "Name":  "Oracle Database DbSystems Administrator",
|                                    "Description":  "Grants full access to manage DbSystems resources",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Oracle.Database/dbSystems/*/read",
|                                                    "Oracle.Database/dbSystems/*/write",
|                                                    "Oracle.Database/dbSystems/*/delete",
|                                                    "Oracle.Database/Locations/*/read",
|                                                    "Oracle.Database/Locations/*/write",
|                                                    "Oracle.Database/Operations/read",
|                                                    "Oracle.Database/oracleSubscriptions/*/read",
|                                                    "Oracle.Database/resourceAnchors/*",
|                                                    "Oracle.Database/networkAnchors/*",
|                                                    "Microsoft.Network/virtualNetworks/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/read",
|                                                    "Microsoft.Network/virtualNetworks/subnets/write",
|                                                    "Microsoft.Network/locations/operations/read",
|                                                    "Microsoft.Compute/sshPublicKeys/read",
|                                                    "Microsoft.Compute/sshPublicKeys/write",
|                                                    "Microsoft.Compute/sshPublicKeys/generateKeyPair/action"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "f287ba2f-f923-4464-a5bd-721c3951d32d",
|                                    "Name":  "Azure Managed Redis Reader",
|                                    "Description":  "Lets you view Azure Managed Redis resources, but not modify them or access keys or access to the data stored in them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Cache/locations/operationsStatus/read",
|                                                    "Microsoft.Cache/operations/read",
|                                                    "Microsoft.Cache/redisEnterprise/read",
|                                                    "Microsoft.Cache/redisEnterprise/*/read",
|                                                    "Microsoft.Insights/alertRules/read",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "3015e5ed-6856-4ab3-b2f0-b8492aa30ca6",
|                                    "Name":  "Azure Managed Redis Contributor",
|                                    "Description":  "Lets you manage Azure Managed Redis resources, but not access the data stored in them.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Cache/locations/operationsStatus/read",
|                                                    "Microsoft.Cache/locations/checknameavailability/action",
|                                                    "Microsoft.Cache/operations/read",
|                                                    "Microsoft.Cache/redisEnterprise/*",
|                                                    "Microsoft.Insights/alertRules/*",
|                                                    "Microsoft.ResourceHealth/availabilityStatuses/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "c24cf47c-5077-412d-a19c-45202126392c",
|                                    "Name":  "Dev Compute SandboxGroup Data Owner",
|                                    "Description":  "Ownership of all SandboxGroup data.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.App/sandboxGroups/*/read",
|                                                        "Microsoft.App/sandboxGroups/*/write",
|                                                        "Microsoft.App/sandboxGroups/*/delete",
|                                                        "Microsoft.App/sandboxGroups/*/action"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "4417a88f-3e58-4cf2-a4e9-112cf414254c",
|                                    "Name":  "Services Hub User",
|                                    "Description":  "Services Hub User allows you to perform all read, write, and deletion operations related to Services Hub Connectors except create/delete connector and managing law.",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.Resources/subscriptions/resourceGroups/read",
|                                                    "Microsoft.Resources/subscriptions/read",
|                                                    "Microsoft.Resources/deployments/*",
|                                                    "Microsoft.ServicesHub/connectors/read",
|                                                    "Microsoft.ServicesHub/connectors/*",
|                                                    "Microsoft.ServicesHub/*",
|                                                    "Microsoft.ServicesHub/workspaces/read"
|                                                ],
|                                    "NotActions":  [
|                                                       "Microsoft.ServicesHub/connectors/write",
|                                                       "Microsoft.ServicesHub/connectors/delete"
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "0e91b552-ae32-49ea-9898-317af306aa4b",
|                                    "Name":  "Genome EndUser",
|                                    "Description":  "Full access to Genome data plane operations only",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|                                                        "Microsoft.Genome/*"
|                                                    ]
|                                },
|                                {
|                                    "Id":  "64375caa-ac3e-48b3-9492-da4d60aba7bb",
|                                    "Name":  "Diagnostics Operator",
|                                    "Description":  "Role allows users to collect diagnostic information regarding their Virtual Machine",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Compute/virtualMachines/DiagnosticRunCommands/write",
|                                                    "Microsoft.Compute/virtualMachines/DiagnosticRunCommands/read",
|                                                    "Microsoft.Compute/virtualMachines/DiagnosticRunCommands/delete"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b66c1f7c-c685-40d6-b8b8-64b8230febf4",
|                                    "Name":  "Azure Resilience Management Usage Administrator",
|                                    "Description":  "Administrator Role of Azure Resilience Management Usage",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "b130f7de-5374-4e3d-ada8-bae6e49114b9",
|                                    "Name":  "Azure Resilience Management Usage Reader",
|                                    "Description":  "Reader Role of Azure Resilience Management Usage",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                },
|                                {
|                                    "Id":  "5ca51376-e049-4302-abcc-64c588049c59",
|                                    "Name":  "Azure Resilience Management Usage Contributor",
|                                    "Description":  "Contributor Role of Azure Resilience Management Usage",
|                                    "IsCustom":  false,
|                                    "Actions":  [
|                                                    "Microsoft.Authorization/*/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/write",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/delete",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/read",
|                                                    "Microsoft.AzureResilienceManagement/usagePlans/enrollments/write"
|                                                ],
|                                    "NotActions":  [
|
|                                                   ],
|                                    "DataActions":  [
|
|                                                    ]
|                                }
|                            ],
|    "Summary":  {
|                    "AD_Groups":  {
|                                      "Tier0":  9,
|                                      "Tier1":  6,
|                                      "Tier2":  3,
|                                      "Tier3":  51,
|                                      "Untiered":  0,
|                                      "TotalGroups":  69
|                                  },
|                    "EntraRoles":  {
|                                       "Tier0":  5,
|                                       "Tier1":  23,
|                                       "Tier2":  20,
|                                       "Tier3":  96,
|                                       "Untiered":  0,
|                                       "TotalRoles":  144
|                                   },
|                    "APIPermissions":  {
|                                           "Tier0":  2,
|                                           "Tier1":  59,
|                                           "Tier2":  138,
|                                           "Tier3":  1027,
|                                           "Untiered":  0,
|                                           "TotalPermissions":  1226
|                                       },
|                    "AzureRoles":  {
|                                       "Tier0":  3,
|                                       "Tier1":  14,
|                                       "Tier2":  130,
|                                       "Tier3":  726,
|                                       "Untiered":  0,
|                                       "TotalRoles":  873
|                                   }
|                }
|}
'@ }
$__siSupportFiles['engine/data-model/SI-RecommendationExclusions.ps1'] = @{ Sha256 = 'af1e5fbd97fde86610b1cc7cf2a5bc1238944de2e02d5440d0d0dd618af9f05f'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- KNOWN FALSE POSITIVES OF A PROVIDER'S RECOMMENDATION (#546 (5)).
|
|    A Microsoft-sourced recommendation that is wrong in a stated situation (the customer case: a password recommendation
|    for accounts whose password lives in Active Directory) is suppressed by a DEFAULT RULE in the data model, with its
|    reason -- never by disabling the report, never by a hand-made exclusion list.
|
|    TEMPLATE  data-model/recommendation-exclusions.locked.json (kind 'recommendation-exclusion', items 'rules'):
|                { "id": "<rule id>",
|                  "configurationIds": [ "<the Risk Analysis row's ConfigurationId>", ... ],   (one or more, exact, case-insensitive)
|                  "reports": [ "<ReportName>", ... ],                                         (optional; none = every report)
|                  "when": { <condition over the finding's CI, SI fields only> },               (SI-Conditions.ps1 language)
|                  "reason": "<why the recommendation is wrong in that situation>",             (required -- it is logged)
|                  "reference": "<the provider's documentation>",                              (optional)
|                  "stage": "production" | "testing" | "not_used" }                            (default production)
|    CUSTOMER  Pro: one cfg.ItemOverride row per rule ('recommendation-exclusions:<id>' -- override, disable or add);
|              Community: data-model/recommendation-exclusions.custom.json, the same shape, only the rules that differ.
|              Both through the data-model merge (Get-SIDataModelTemplate).
|    APPLIED   Risk Analysis, after each row is tied to its CI (RA-RecommendationExclusions.ps1): a row whose ConfigurationId
|              a production rule names, in a report the rule covers, whose CI meets the rule's condition, is left out and
|              counted per rule (with the reason) in the run log. A row without a known CI is never suppressed: an
|              exclusion that cannot be checked must not hide a finding.
|
|    PURE except Get-SIRecommendationExclusions (reads the template). PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Test-SICondition -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-Conditions.ps1') }
|
|function Test-SIRecommendationExclusionRule {
|    <# PURE. The reasons one rule is not accepted (empty = accepted). #>
|    param($Rule)
|    $why = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Rule) { $why.Add('a rule is empty'); return $why.ToArray() }
|    $id = [string](Get-SIItemValue $Rule 'id')
|    if ($id -notmatch '^[a-z0-9][a-z0-9_\-\.]{0,99}$') { $why.Add(("rule id '{0}': lower-case letters, digits, - _ . (at most 100)" -f $id)) }
|    $ids = @(@(Get-SIItemValue $Rule 'configurationIds') | Where-Object { $_ -and ([string]$_).Trim() })
|    if ($ids.Count -eq 0) { $why.Add(("rule '{0}': configurationIds names at least one recommendation id" -f $id)) }
|    if (-not ([string](Get-SIItemValue $Rule 'reason')).Trim()) { $why.Add(("rule '{0}': a reason is required -- it is what the run log says" -f $id)) }
|    $st = [string](Get-SIItemValue $Rule 'stage')
|    if ($st -and $st -notin 'production', 'testing', 'not_used') { $why.Add(("rule '{0}': stage '{1}' (production | testing | not_used)" -f $id, $st)) }
|    $when = Get-SIItemValue $Rule 'when'
|    if ($null -eq $when) { $why.Add(("rule '{0}': a condition (when) is required -- a rule states the situation it holds in" -f $id)) }
|    else {
|        $ops = Get-SIConditionOps
|        foreach ($leafField in (Get-SIConditionFields $when)) {
|            if ($leafField -notmatch '^si_[a-z0-9_]+$') { $why.Add(("rule '{0}': reads '{1}' -- a rule reads SI fields (si_*) only" -f $id, $leafField)) }
|        }
|        $stack = New-Object System.Collections.Generic.Stack[object]; $stack.Push($when)
|        while ($stack.Count -gt 0) {
|            $c = $stack.Pop()
|            $isGroup = $false
|            foreach ($k in 'all', 'any') {
|                $has = ($c -is [System.Collections.IDictionary] -and $c.Contains($k)) -or ($null -ne $c -and $c.PSObject.Properties[$k])
|                if ($has) { $isGroup = $true; foreach ($x in (Get-SIValueList (Get-SIItemValue $c $k))) { $stack.Push($x) } }
|            }
|            if (-not $isGroup) { $op = [string](Get-SIItemValue $c 'op'); if ($ops -notcontains $op) { $why.Add(("rule '{0}': unknown condition operation '{1}'" -f $id, $op)) } }
|        }
|    }
|    $why.ToArray()
|}
|
|function Test-SIRecommendationExclusions {
|    <# PURE. Every rule valid, every id once. Returns the problems. #>
|    param($Document)
|    $why = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Document) { return $why.ToArray() }
|    $ids = @{}
|    foreach ($r in @(Get-SIItemValue $Document 'rules')) {
|        if ($null -eq $r) { continue }
|        foreach ($x in (Test-SIRecommendationExclusionRule -Rule $r)) { $why.Add([string]$x) }
|        $rid = [string](Get-SIItemValue $r 'id')
|        if ($ids.ContainsKey($rid)) { $why.Add(("recommendation-exclusions: rule '{0}' is defined twice" -f $rid)) }; $ids[$rid] = 1
|    }
|    $why.ToArray()
|}
|
|function ConvertTo-SIRecommendationExclusionIndex {
|    <#
|        PURE. The merged template -> lower-case ConfigurationId -> [ @{ Id; Reports (lower-case, empty = every); When; Reason } ].
|        Only valid production rules (no stage = production).
|    #>
|    param($Document)
|    $idx = New-Object System.Collections.Hashtable ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($r in @(Get-SIItemValue $Document 'rules')) {
|        if ($null -eq $r) { continue }
|        $st = [string](Get-SIItemValue $r 'stage'); if ($st -and $st -ne 'production') { continue }
|        if (@(Test-SIRecommendationExclusionRule -Rule $r).Count -gt 0) { continue }
|        $e = @{ Id = [string](Get-SIItemValue $r 'id'); When = (Get-SIItemValue $r 'when'); Reason = ([string](Get-SIItemValue $r 'reason')).Trim()
|            Reports = @(@(Get-SIItemValue $r 'reports') | Where-Object { $_ } | ForEach-Object { ([string]$_).Trim() }) }
|        foreach ($cid in @(Get-SIItemValue $r 'configurationIds')) {
|            $k = ([string]$cid).Trim(); if (-not $k) { continue }
|            if (-not $idx.ContainsKey($k)) { $idx[$k] = New-Object System.Collections.Generic.List[object] }
|            $idx[$k].Add($e)
|        }
|    }
|    foreach ($k in @($idx.Keys)) { $idx[$k] = $idx[$k].ToArray() }
|    $idx
|}
|
|function Find-SIRecommendationExclusion {
|    <#
|    .SYNOPSIS  PURE. The rule that suppresses one finding, or $null: a production rule naming its ConfigurationId, covering the
|               report, whose condition the finding's CI meets. No CI = never suppressed.
|    #>
|    param([hashtable]$Index, [AllowEmptyString()][string]$ConfigurationId, [AllowEmptyString()][string]$ReportName, $Ci, [hashtable]$Context)
|    if ($null -eq $Index -or $Index.Count -eq 0 -or -not $ConfigurationId -or $null -eq $Ci) { return $null }
|    $k = $ConfigurationId.Trim()
|    if (-not $Index.ContainsKey($k)) { return $null }
|    foreach ($e in @($Index[$k])) {
|        if (@($e.Reports).Count -gt 0 -and -not (@($e.Reports) | Where-Object { [string]::Equals($_, $ReportName, [StringComparison]::OrdinalIgnoreCase) })) { continue }
|        $ok = $false
|        try { $ok = [bool](Test-SICondition -Condition $e.When -Item $Ci -Context $Context) } catch { $ok = $false }
|        if ($ok) { return $e }
|    }
|    return $null
|}
|
|function Get-SIRecommendationExclusions {
|    <#
|        The merged template (shipped + the customer's) as an index; an empty index when there is none or it cannot be read
|        (nothing is suppressed -- never fails).
|    #>
|    param([string]$Root, [string]$OverlayRoot = $global:SI_DataModelOverlayRoot)
|    try {
|        if (-not (Get-Command -Name Get-SIDataModelTemplate -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-DataModelTemplates.ps1') }
|        $r = Get-SIDataModelRoot $Root
|        if (-not (Test-Path -LiteralPath (Join-Path $r 'recommendation-exclusions.locked.json'))) {
|            # Pro: an exported data model from before this template was published -- the shipped template (no override yet)
|            $shipped = Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'data-model'
|            if (-not (Test-Path -LiteralPath (Join-Path $shipped 'recommendation-exclusions.locked.json'))) { return @{} }
|            $r = $shipped
|        }
|        $t = Get-SIDataModelTemplate -Name 'recommendation-exclusions' -Root $r -OverlayRoot $OverlayRoot
|        foreach ($p in (Test-SIRecommendationExclusions -Document $t.Document)) { Write-Warning ("recommendation exclusions: {0} -- that rule is not applied" -f $p) }
|        return (ConvertTo-SIRecommendationExclusionIndex -Document $t.Document)
|    } catch {
|        Write-Warning ("recommendation exclusions could not be read -- {0}. No finding is suppressed by them." -f $_.Exception.Message)
|        return @{}
|    }
|}
'@ }
$__siSupportFiles['engine/data-model/SI-RecommendationEquivalence.ps1'] = @{ Sha256 = '31d3fa9c321121bf40ddbd61f3a77d1bc66e5a7f2d580c4262b6213f99ff3549'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE SAME RECOMMENDATION ACROSS PROVIDERS (#464, V3-DATA-MODEL 2.8.2 phase 2).
|
|    One recommendation reported by several providers (Defender for Endpoint and Defender for Cloud, Exposure Management,
|    ...) is ONE finding on the CI with every provider as evidence -- not one finding per provider.
|
|    TEMPLATE  data-model/recommendation-equivalence.locked.json (kind 'recommendation-equivalence', items 'groups'):
|                { "id": "<group id>", "canonicalId": "<the finding key the group is known by>", "canonicalTitle": "...",
|                  "stage": "production" | "testing" | "not_used",            (default production; only production merges)
|                  "members": [ { "provider": "mde", "id": "scid-..." }, { "provider": "mdc", "title": "..." } ] }
|              A member names the provider's recommendation id (the Risk Analysis row's ConfigurationId) or its exact title
|              (ConfigurationName, compared case-insensitively, spaces collapsed). An id or a title belongs to ONE group.
|              Keep the canonical id = the id the oldest provider already reports: its existing findings keep their key.
|    CUSTOMER  Pro: one cfg.ItemOverride row per group ('recommendation-equivalence:<id>' -- override, disable or add);
|              Community: data-model/recommendation-equivalence.custom.json, the same shape, only the groups that differ.
|              Both through the data-model merge (Get-SIDataModelTemplate), like every other data-model template.
|    APPLIED   Risk Analysis' finding keys (RA-Findings.ps1: the CI's finding key becomes the canonical id, the reports'
|              own keys are kept in si_finding_aliases and every report's key + severity in si_finding_evidence) and the
|              finding lifecycle (SI-DataCiLifecycle.ps1: an existing lifecycle row under an alias key is carried onto the
|              canonical key -- FirstDetected kept, never closed and reopened because the key changed).
|
|    #693 GENERALISED -- link two findings into one, for every finding type. A group has a "match" (default "key"):
|      key   (above) the same recommendation under each provider's id or title -- per row, any CI.
|      link  a MANUAL link an operator made on ONE owner (CI id, or asset:<id>): "owner", two or more "members" (finding
|            keys -- any provider, the same provider or report twice is allowed), "canonicalId" = the member that stays,
|            "linkedBy" + "reason" (+ "linkedAt") recorded. Unlink = stage "not_used" (the record stays: reversible, audited).
|            Per row, like key, so it reaches the database's finding key, the pager and the lifecycle unchanged.
|      fold  a MEANING rule over the generic SI finding fields AFTER mapping and value normalisation (never a provider's
|            raw column): "evidence" and "canonical" = conditions { field: si_*, pattern: <regex, named captures> | equals },
|            "on" = pairs { evidence: <si field or capture name>, canonical: <si field> } compared normalised (lower case,
|            spaces / underscores made one). On one CI, a finding matching "evidence" whose "on" values meet a finding
|            matching "canonical" is NOT a finding of its own: it is evidence on every such canonical finding (its key an
|            alias of the first, so its history carries over), its reports added to their si_detected_by. Applied to the
|            CI's findings (Merge-SIFindingFolds); the report rows themselves are never touched (no row is lost).
|    Only production groups apply; a shipped fold rule starts as "testing" until it is proven on an internal run.
|
|    PURE except Get-SIRecommendationEquivalence (reads the template). PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|function Get-SIEqMatch {
|    <# PURE. A group's match: key (default) | link | fold | the unknown value as given. #>
|    param($Group)
|    $m = ([string](Get-SIEqValue $Group 'match')).Trim().ToLowerInvariant()
|    if (-not $m) { return 'key' }
|    $m
|}
|
|function ConvertTo-SIFindingMatchValue {
|    <# PURE. A value as a link rule compares it: lower case, runs of spaces / underscores made one space, trimmed. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    if (-not $Value) { return '' }
|    (($Value.Trim().ToLowerInvariant()) -replace '[\s_]+', ' ').Trim()
|}
|
|function Test-SIFindingFoldCondition {
|    <# PURE. The reasons one fold condition is not accepted; adds its pattern's named captures to -Captures. #>
|    param($Condition, [string]$Group, [string]$Side, [System.Collections.Generic.List[string]]$Captures)
|    $why = New-Object System.Collections.Generic.List[string]
|    $f = [string](Get-SIEqValue $Condition 'field')
|    if ($f -notmatch '^si_[a-z0-9_]+$') { $why.Add(("group '{0}': a {1} condition's field '{2}' -- a generic SI field (si_...), never a provider column" -f $Group, $Side, $f)) }
|    $pat = Get-SIEqValue $Condition 'pattern'; $eqv = Get-SIEqValue $Condition 'equals'
|    if (($null -eq $pat) -eq ($null -eq $eqv)) { $why.Add(("group '{0}': a {1} condition on '{2}' has exactly one of pattern / equals" -f $Group, $Side, $f)) }
|    if ($null -ne $pat) {
|        try {
|            $rx = New-Object System.Text.RegularExpressions.Regex ([string]$pat), 'IgnoreCase'
|            if ($null -ne $Captures) { foreach ($n in $rx.GetGroupNames()) { if ($n -notmatch '^\d+$' -and -not $Captures.Contains($n)) { $Captures.Add($n) } } }
|        } catch { $why.Add(("group '{0}': the {1} pattern on '{2}' is not a valid regular expression" -f $Group, $Side, $f)) }
|    }
|    $why.ToArray()
|}
|
|function Get-SIRecommendationTitleKey {
|    <# PURE. A title as the equivalence compares it: lower case, spaces collapsed, trimmed. '' for none. #>
|    param([AllowNull()][AllowEmptyString()][string]$Title)
|    if (-not $Title) { return '' }
|    (($Title.Trim().ToLowerInvariant()) -replace '\s+', ' ')
|}
|
|function Get-SIEqValue {
|    <# PURE. A named value of a dictionary / object, or $null (this file stands alone: no other helper needed). #>
|    param($Item, [string]$Name)
|    if ($null -eq $Item) { return $null }
|    if ($Item -is [System.Collections.IDictionary]) { foreach ($k in $Item.Keys) { if ([string]$k -ieq $Name) { return $Item[$k] } }; return $null }
|    $p = $Item.PSObject.Properties[$Name]; if ($p) { return $p.Value }
|    $null
|}
|
|function Test-SIRecommendationEquivalenceGroup {
|    <# PURE. The reasons one group is not accepted (empty = accepted). #>
|    param($Group)
|    $why = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Group) { $why.Add('a group is empty'); return $why.ToArray() }
|    $id = [string](Get-SIEqValue $Group 'id')
|    if ($id -notmatch '^[a-z0-9][a-z0-9_\-\.]{0,99}$') { $why.Add(("group id '{0}': lower-case letters, digits, - _ . (at most 100)" -f $id)) }
|    $st = [string](Get-SIEqValue $Group 'stage')
|    $match = Get-SIEqMatch $Group
|    if ($match -notin 'key', 'link', 'fold') { $why.Add(("group '{0}': match '{1}' (key | link | fold)" -f $id, $match)); return $why.ToArray() }
|    if ($match -eq 'fold') {
|        # #693 a meaning rule: conditions on generic SI fields, joined on SI fields / captures
|        if ($st -and $st -notin 'production', 'testing', 'not_used') { $why.Add(("group '{0}': stage '{1}' (production | testing | not_used)" -f $id, $st)) }
|        $caps = New-Object System.Collections.Generic.List[string]
|        foreach ($side in 'evidence', 'canonical') {
|            $conds = @(Get-SIEqValue $Group $side) | Where-Object { $null -ne $_ }
|            if (@($conds).Count -lt 1) { $why.Add(("group '{0}': at least one {1} condition" -f $id, $side)) }
|            $c2 = $null; if ($side -eq 'evidence') { $c2 = $caps }
|            foreach ($c in @($conds)) { foreach ($x in (Test-SIFindingFoldCondition -Condition $c -Group $id -Side $side -Captures $c2)) { $why.Add([string]$x) } }
|        }
|        $on = @(Get-SIEqValue $Group 'on') | Where-Object { $null -ne $_ }
|        if (@($on).Count -lt 1) { $why.Add(("group '{0}': at least one 'on' pair -- what the two findings share" -f $id)) }
|        foreach ($p in @($on)) {
|            $e = [string](Get-SIEqValue $p 'evidence'); $c = [string](Get-SIEqValue $p 'canonical')
|            if ($e -notmatch '^si_[a-z0-9_]+$' -and -not $caps.Contains($e)) { $why.Add(("group '{0}': on.evidence '{1}' is an SI field or a named capture of an evidence pattern" -f $id, $e)) }
|            if ($c -notmatch '^si_[a-z0-9_]+$') { $why.Add(("group '{0}': on.canonical '{1}' is an SI field" -f $id, $c)) }
|        }
|        return $why.ToArray()
|    }
|    if ($match -eq 'link') {
|        # #693 (3) a manual link on one owner: who and why are recorded; unlink = stage not_used
|        if ($st -and $st -notin 'production', 'testing', 'not_used') { $why.Add(("group '{0}': stage '{1}' (production | testing | not_used)" -f $id, $st)) }
|        $own = ([string](Get-SIEqValue $Group 'owner')).Trim()
|        if (-not $own -or $own.Length -gt 400) { $why.Add(("group '{0}': owner is required -- the CI id (or asset:<id>) the two findings are on" -f $id)) }
|        foreach ($n in 'linkedBy', 'reason') { if (-not ([string](Get-SIEqValue $Group $n)).Trim()) { $why.Add(("group '{0}': {1} is required -- a link records who made it and why" -f $id, $n)) } }
|        $members = @(Get-SIEqValue $Group 'members') | Where-Object { $null -ne $_ }
|        $keys = @($members | ForEach-Object { ([string](Get-SIEqValue $_ 'id')).Trim() })
|        if (@($members).Count -lt 2) { $why.Add(("group '{0}': at least two members -- the findings linked into one" -f $id)) }
|        if (@($keys | Where-Object { -not $_ }).Count -gt 0) { $why.Add(("group '{0}': every member names its finding key (id)" -f $id)) }
|        $cid = ([string](Get-SIEqValue $Group 'canonicalId')).Trim()
|        if (-not $cid -or -not (@($keys | Where-Object { $_ -ieq $cid }).Count)) { $why.Add(("group '{0}': canonicalId is one of the members -- the finding that stays" -f $id)) }
|        return $why.ToArray()
|    }
|    $cid = [string](Get-SIEqValue $Group 'canonicalId')
|    if (-not $cid.Trim() -or $cid.Length -gt 256) { $why.Add(("group '{0}': canonicalId is required (at most 256 characters) -- the finding key the group is known by" -f $id)) }
|    if (-not ([string](Get-SIEqValue $Group 'canonicalTitle')).Trim()) { $why.Add(("group '{0}': canonicalTitle is required" -f $id)) }
|    if ($st -and $st -notin 'production', 'testing', 'not_used') { $why.Add(("group '{0}': stage '{1}' (production | testing | not_used)" -f $id, $st)) }
|    $members = @(Get-SIEqValue $Group 'members') | Where-Object { $null -ne $_ }
|    if (@($members).Count -lt 2) { $why.Add(("group '{0}': at least two members -- one recommendation from two or more providers" -f $id)) }
|    $providers = @{}
|    foreach ($m in @($members)) {
|        $p = [string](Get-SIEqValue $m 'provider'); $mi = [string](Get-SIEqValue $m 'id'); $mt = [string](Get-SIEqValue $m 'title')
|        if ($p -notmatch '^[a-z][a-z0-9_\-]{0,40}$') { $why.Add(("group '{0}': a member's provider '{1}' (lower-case name)" -f $id, $p)) }
|        if (-not $mi.Trim() -and -not $mt.Trim()) { $why.Add(("group '{0}': a member of {1} names neither an id nor a title" -f $id, $p)) }
|        if ($p) { $providers[$p] = 1 }
|    }
|    if (@($members).Count -ge 2 -and $providers.Count -lt 2) { $why.Add(("group '{0}': its members come from one provider -- the same recommendation across providers needs two" -f $id)) }
|    $why.ToArray()
|}
|
|function Test-SIRecommendationEquivalence {
|    <# PURE. Every group valid, every id / title in one group only. Returns the problems. #>
|    param($Document)
|    $why = New-Object System.Collections.Generic.List[string]
|    if ($null -eq $Document) { return $why.ToArray() }
|    $ids = @{}; $keys = @{}
|    foreach ($g in @(Get-SIEqValue $Document 'groups')) {
|        if ($null -eq $g) { continue }
|        foreach ($x in (Test-SIRecommendationEquivalenceGroup -Group $g)) { $why.Add([string]$x) }
|        $gid = [string](Get-SIEqValue $g 'id')
|        if ($ids.ContainsKey($gid)) { $why.Add(("recommendation-equivalence: group '{0}' is defined twice" -f $gid)) }; $ids[$gid] = 1
|        $gm = Get-SIEqMatch $g
|        if ($gm -eq 'fold') { continue }
|        if ($gm -eq 'link') {
|            # #693 a finding key on one owner is in one ACTIVE manual link (an unlinked one -- not_used -- is history)
|            if ([string](Get-SIEqValue $g 'stage') -in 'not_used', 'testing') { continue }
|            $own = ([string](Get-SIEqValue $g 'owner')).Trim().ToLowerInvariant()
|            foreach ($m in @(Get-SIEqValue $g 'members')) {
|                $k = 'link:' + $own + '|' + ([string](Get-SIEqValue $m 'id')).Trim().ToLowerInvariant()
|                if ($keys.ContainsKey($k) -and $keys[$k] -ne $gid) { $why.Add(("recommendation-equivalence: {0} is in link '{1}' and in link '{2}' -- a finding is linked once" -f $k, $keys[$k], $gid)) }
|                $keys[$k] = $gid
|            }
|            continue
|        }
|        foreach ($m in @(Get-SIEqValue $g 'members')) {
|            foreach ($k in @(('id:' + ([string](Get-SIEqValue $m 'id')).Trim().ToLowerInvariant()), ('title:' + (Get-SIRecommendationTitleKey ([string](Get-SIEqValue $m 'title')))))) {
|                if ($k -in 'id:', 'title:') { continue }
|                if ($keys.ContainsKey($k) -and $keys[$k] -ne $gid) { $why.Add(("recommendation-equivalence: {0} is in group '{1}' and in group '{2}' -- a recommendation belongs to one group" -f $k, $keys[$k], $gid)) }
|                $keys[$k] = $gid
|            }
|        }
|    }
|    $why.ToArray()
|}
|
|function ConvertTo-SIRecommendationEquivalenceIndex {
|    <#
|        PURE. The template (merged) -> @{ ById; ByTitle } (lower-case id / title key -> @{ Group; CanonicalId; CanonicalTitle }).
|        Only production groups (no stage = production) merge; testing and not_used groups are left out. A group that is not
|        valid is left out (the template check reports it).
|    #>
|    param($Document)
|    $byId = New-Object System.Collections.Hashtable ([StringComparer]::OrdinalIgnoreCase)
|    $byTitle = New-Object System.Collections.Hashtable ([StringComparer]::OrdinalIgnoreCase)
|    $byOwner = New-Object System.Collections.Hashtable ([StringComparer]::OrdinalIgnoreCase)   # #693 manual links: 'owner|key'
|    $folds = New-Object System.Collections.Generic.List[object]                                # #693 meaning rules
|    foreach ($g in @(Get-SIEqValue $Document 'groups')) {
|        if ($null -eq $g) { continue }
|        $st = [string](Get-SIEqValue $g 'stage'); if ($st -and $st -ne 'production') { continue }
|        if (@(Test-SIRecommendationEquivalenceGroup -Group $g).Count -gt 0) { continue }
|        $gm = Get-SIEqMatch $g
|        if ($gm -eq 'fold') {
|            $cv = { param($list) @(foreach ($c in @($list)) { if ($null -eq $c) { continue }
|                        $p = Get-SIEqValue $c 'pattern'
|                        @{ Field = [string](Get-SIEqValue $c 'field')
|                           Regex = $(if ($null -ne $p) { New-Object System.Text.RegularExpressions.Regex ([string]$p), 'IgnoreCase' } else { $null })
|                           EqualsValue = $(if ($null -eq $p) { ConvertTo-SIFindingMatchValue ([string](Get-SIEqValue $c 'equals')) } else { $null }) } }) }
|            $folds.Add(@{ Group = [string](Get-SIEqValue $g 'id'); Evidence = (& $cv (Get-SIEqValue $g 'evidence')); Canonical = (& $cv (Get-SIEqValue $g 'canonical'))
|                          On = @(foreach ($p in @(Get-SIEqValue $g 'on')) { if ($null -ne $p) { @{ Evidence = [string](Get-SIEqValue $p 'evidence'); Canonical = [string](Get-SIEqValue $p 'canonical') } } }) })
|            continue
|        }
|        if ($gm -eq 'link') {
|            $own = ([string](Get-SIEqValue $g 'owner')).Trim()
|            $e = @{ Group = [string](Get-SIEqValue $g 'id'); CanonicalId = ([string](Get-SIEqValue $g 'canonicalId')).Trim(); CanonicalTitle = ([string](Get-SIEqValue $g 'canonicalTitle')).Trim()
|                    Manual = $true; LinkedBy = [string](Get-SIEqValue $g 'linkedBy'); Reason = [string](Get-SIEqValue $g 'reason') }
|            foreach ($m in @(Get-SIEqValue $g 'members')) {
|                $k = $own + '|' + ([string](Get-SIEqValue $m 'id')).Trim()
|                if (-not $byOwner.ContainsKey($k)) { $byOwner[$k] = $e }
|            }
|            continue
|        }
|        $e = @{ Group = [string](Get-SIEqValue $g 'id'); CanonicalId = ([string](Get-SIEqValue $g 'canonicalId')).Trim(); CanonicalTitle = ([string](Get-SIEqValue $g 'canonicalTitle')).Trim() }
|        # the canonical id itself maps onto its group (a provider that already reports it)
|        if (-not $byId.ContainsKey($e.CanonicalId)) { $byId[$e.CanonicalId] = $e }
|        foreach ($m in @(Get-SIEqValue $g 'members')) {
|            $mi = ([string](Get-SIEqValue $m 'id')).Trim(); $mt = Get-SIRecommendationTitleKey ([string](Get-SIEqValue $m 'title'))
|            if ($mi -and -not $byId.ContainsKey($mi)) { $byId[$mi] = $e }
|            if ($mt -and -not $byTitle.ContainsKey($mt)) { $byTitle[$mt] = $e }
|        }
|    }
|    @{ ById = $byId; ByTitle = $byTitle; ByOwner = $byOwner; Folds = $folds.ToArray() }
|}
|
|function Resolve-SIRecommendationKey {
|    <#
|        PURE. A finding key + title -> its group entry (@{ Group; CanonicalId; CanonicalTitle }) or $null. The id wins over
|        the title. #693 -Owner (the CI id or asset:<id>): an operator's manual link on that owner wins over both.
|    #>
|    param($Index, [AllowEmptyString()][string]$Key, [AllowEmptyString()][AllowNull()][string]$Title, [AllowEmptyString()][AllowNull()][string]$Owner = '')
|    if ($null -eq $Index) { return $null }
|    if ($Owner -and $Key -and $Index.ByOwner -and $Index.ByOwner.Count -gt 0) {
|        $ok = $Owner + '|' + $Key.Trim()
|        if ($Index.ByOwner.ContainsKey($ok)) { return $Index.ByOwner[$ok] }
|    }
|    if ($Key -and $Index.ById.ContainsKey($Key.Trim())) { return $Index.ById[$Key.Trim()] }
|    $t = Get-SIRecommendationTitleKey $Title
|    if ($t -and $Index.ByTitle.ContainsKey($t)) { return $Index.ByTitle[$t] }
|    $null
|}
|
|function Get-SIFindingFieldValues {
|    <# PURE. A finding's generic SI field as a list of raw text values (an array field gives each element; '' left out). #>
|    param($Finding, [string]$Field)
|    $v = Get-SIEqValue $Finding $Field
|    if ($null -eq $v) { return @() }
|    $vals = if ($v -is [string]) { @($v) } elseif ($v -is [System.Collections.IEnumerable] -and -not ($v -is [System.Collections.IDictionary])) { @($v) } else { @([string]$v) }
|    @($vals | ForEach-Object { ([string]$_).Trim() } | Where-Object { $_ })
|}
|
|function Test-SIFindingFoldSide {
|    <#
|        PURE. Does a finding meet every condition of one side of a fold rule? Returns $null (no) or a hashtable of the
|        normalised named captures of its patterns (yes; empty when the side captures nothing).
|    #>
|    param($Finding, [object[]]$Conditions)
|    $caps = @{}
|    foreach ($c in @($Conditions)) {
|        $vals = @(Get-SIFindingFieldValues $Finding $c.Field)
|        $hit = $false
|        foreach ($v in $vals) {
|            if ($null -ne $c.Regex) {
|                $m = $c.Regex.Match($v)
|                if ($m.Success) {
|                    $hit = $true
|                    foreach ($n in $c.Regex.GetGroupNames()) { if ($n -notmatch '^\d+$' -and $m.Groups[$n].Success) { $caps[$n] = ConvertTo-SIFindingMatchValue $m.Groups[$n].Value } }
|                    break
|                }
|            } elseif ((ConvertTo-SIFindingMatchValue $v) -eq $c.EqualsValue) { $hit = $true; break }
|        }
|        if (-not $hit) { return $null }
|    }
|    $caps
|}
|
|function Merge-SIFindingFolds {
|    <#
|        PURE. #693 (7) / (8) -- the meaning rules (the index's Folds) over one batch of SI findings (ConvertTo-SIFindingRows'
|        output; every finding of a CI in the same batch). Per owner (si_ci_id, else asset:<si_asset_id>): a finding meeting
|        a rule's evidence side whose 'on' values meet a canonical-side finding (not itself) is folded -- it is no finding of
|        its own; on EVERY canonical it met: si_finding_evidence gains it (report, key, title, severity, rule) after the
|        canonical's own entry, si_detected_by gains its reports; on the FIRST canonical (by key) its key and its aliases are
|        aliases, so its lifecycle row carries over. A finding that received evidence is never folded itself (no chain). The
|        canonical's key, title, severity and exemption stay its own. Returns the findings left, in their order.
|    #>
|    param([AllowEmptyCollection()][object[]]$Findings = @(), [object[]]$Folds = @())
|    if (@($Folds).Count -eq 0 -or @($Findings).Count -lt 2) { return @($Findings) }
|    $byOwner = [ordered]@{}
|    for ($i = 0; $i -lt $Findings.Count; $i++) {
|        $f = $Findings[$i]; if ($null -eq $f) { continue }
|        $o = [string](Get-SIEqValue $f 'si_ci_id'); if (-not $o) { $o = 'asset:' + [string](Get-SIEqValue $f 'si_asset_id') }
|        if (-not $byOwner.Contains($o)) { $byOwner[$o] = New-Object System.Collections.Generic.List[int] }
|        $byOwner[$o].Add($i)
|    }
|    $folded = New-Object 'System.Collections.Generic.HashSet[int]'
|    $target = New-Object 'System.Collections.Generic.HashSet[int]'
|    $ev = { param($x) [ordered]@{ report = [string](Get-SIEqValue $x 'si_report_name'); key = [string](Get-SIEqValue $x 'si_finding_key'); title = [string](Get-SIEqValue $x 'si_title'); severity = [string](Get-SIEqValue $x 'si_severity') } }
|    foreach ($o in $byOwner.Keys) {
|        $ix = $byOwner[$o]; if ($ix.Count -lt 2) { continue }
|        foreach ($rule in @($Folds)) {
|            $canon = @(foreach ($i in $ix) { if ($folded.Contains($i)) { continue }; $c = Test-SIFindingFoldSide -Finding $Findings[$i] -Conditions $rule.Canonical; if ($null -ne $c) { $i } })
|            if ($canon.Count -eq 0) { continue }
|            $canon = @($canon | Sort-Object { [string](Get-SIEqValue $Findings[$_] 'si_finding_key') })
|            foreach ($i in $ix) {
|                if ($folded.Contains($i) -or $target.Contains($i)) { continue }
|                $caps = Test-SIFindingFoldSide -Finding $Findings[$i] -Conditions $rule.Evidence
|                if ($null -eq $caps) { continue }
|                $hits = @(foreach ($t in $canon) {
|                        if ($t -eq $i -or $folded.Contains($t)) { continue }
|                        $ok = $true
|                        foreach ($p in @($rule.On)) {
|                            $left = if ($caps.ContainsKey($p.Evidence)) { @($caps[$p.Evidence]) } else { @(Get-SIFindingFieldValues $Findings[$i] $p.Evidence | ForEach-Object { ConvertTo-SIFindingMatchValue $_ }) }
|                            $right = @(Get-SIFindingFieldValues $Findings[$t] $p.Canonical | ForEach-Object { ConvertTo-SIFindingMatchValue $_ })
|                            if (@($left | Where-Object { $_ -and $_ -in $right }).Count -eq 0) { $ok = $false; break }
|                        }
|                        if ($ok) { $t }
|                    })
|                if ($hits.Count -eq 0) { continue }
|                [void]$folded.Add($i)
|                $e = $Findings[$i]
|                $eEntry = & $ev $e; $eEntry['rule'] = $rule.Group
|                $first = $true
|                foreach ($t in $hits) {
|                    [void]$target.Add($t)
|                    $c = $Findings[$t]
|                    $list = New-Object System.Collections.Generic.List[object]
|                    $cur = @(Get-SIEqValue $c 'si_finding_evidence') | Where-Object { $null -ne $_ }
|                    if (@($cur).Count -eq 0) { $list.Add((& $ev $c)) } else { foreach ($x in $cur) { $list.Add($x) } }
|                    foreach ($x in @(Get-SIEqValue $e 'si_finding_evidence') | Where-Object { $null -ne $_ }) { if ([string](Get-SIEqValue $x 'key') -ne $eEntry.key) { $list.Add($x) } }
|                    $list.Add($eEntry)
|                    $c | Add-Member -NotePropertyName 'si_finding_evidence' -NotePropertyValue $list.ToArray() -Force
|                    $det = New-Object System.Collections.Generic.List[string]
|                    foreach ($d in @(Get-SIFindingFieldValues $c 'si_detected_by') + @(Get-SIFindingFieldValues $e 'si_detected_by')) { if (-not $det.Contains($d)) { $det.Add($d) } }
|                    $c | Add-Member -NotePropertyName 'si_detected_by' -NotePropertyValue $det.ToArray() -Force
|                    if ($first) {
|                        $al = New-Object System.Collections.Generic.List[string]
|                        foreach ($a in @(Get-SIFindingFieldValues $c 'si_finding_aliases') + @($eEntry.key) + @(Get-SIFindingFieldValues $e 'si_finding_aliases')) { if ($a -and $a -ne [string](Get-SIEqValue $c 'si_finding_key') -and -not $al.Contains($a)) { $al.Add($a) } }
|                        $c | Add-Member -NotePropertyName 'si_finding_aliases' -NotePropertyValue $al.ToArray() -Force
|                        $first = $false
|                    }
|                }
|            }
|        }
|    }
|    if ($folded.Count -eq 0) { return @($Findings) }
|    @(for ($i = 0; $i -lt $Findings.Count; $i++) { if (-not $folded.Contains($i)) { $Findings[$i] } })
|}
|
|function Get-SIRecommendationEquivalence {
|    <#
|        The merged template (shipped + the customer's: Pro's exported data model or Community's custom file) as an index;
|        $null when there is none or it cannot be read -- findings are then keyed as the providers report them (never fails).
|    #>
|    param([string]$Root, [string]$OverlayRoot = $global:SI_DataModelOverlayRoot)
|    try {
|        if (-not (Get-Command -Name Get-SIDataModelTemplate -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-DataModelTemplates.ps1') }
|        $r = Get-SIDataModelRoot $Root
|        if (-not (Test-Path -LiteralPath (Join-Path $r 'recommendation-equivalence.locked.json'))) {
|            # Pro: an exported data model from before this template was published -- the shipped template (no override yet)
|            $shipped = Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'data-model'
|            if (-not (Test-Path -LiteralPath (Join-Path $shipped 'recommendation-equivalence.locked.json'))) { return $null }
|            $r = $shipped
|        }
|        $t = Get-SIDataModelTemplate -Name 'recommendation-equivalence' -Root $r -OverlayRoot $OverlayRoot
|        foreach ($p in (Test-SIRecommendationEquivalence -Document $t.Document)) { Write-Warning ("recommendation equivalence: {0} -- that group is not applied" -f $p) }
|        return (ConvertTo-SIRecommendationEquivalenceIndex -Document $t.Document)
|    } catch {
|        Write-Warning ("recommendation equivalence could not be read -- {0}. Findings are keyed as each provider reports them." -f $_.Exception.Message)
|        return $null
|    }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-OutputScope.ps1'] = @{ Sha256 = 'f95b4d71161726e75ba82c3ea849bb3ab2f760d2dc5e6a7842514b9e2ff8a295'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight Pro -- OUTPUT SCOPE PER DESTINATION (#274).
|
|    Risk Analysis decides WHAT is found (each report's own severity / tier scope, the report templates). The output scope
|    decides what each DESTINATION receives of it:
|        excel             Risk Analysis's own read-time view: the workbook, the JSON sibling, the AI summary, the KPIs and
|                          the mail (the rows Select-RAReportRows keeps). Log Analytics always receives every row.
|        vuln-sql          the vulnerability close-loop's SQL connector(s)          (Invoke-SIVulnLoop.ps1, the plan step)
|        vuln-servicenow   the vulnerability close-loop's ServiceNow connector(s)   (Invoke-SIVulnLoop.ps1, the plan step)
|        cmdb-sql          the SQL CMDB connector -- an ASSET scope (tiers, asset kinds)
|        cmdb-servicenow   the ServiceNow CMDB connector (Invoke-SICmdb.ps1) and the ServiceNow CI output of the data-out
|                          connector -- an ASSET scope (tiers, asset kinds) plus, #1055, the CI rules 'include' / 'exclude'
|                          on the CI's asset type, OS family and class (Test-SIOutputScopeCiRules)
|
|    Where it comes from: the Pro settings database (cfg.ItemOverride, kind 'outputscope', one item per destination),
|    materialised by Export-SIProConfig into <run>\config\output-scope.json (SI_ProConfigRoot) with every named report
|    template already resolved to its reports. No file, or no entry for a destination = everything passes (today's
|    behaviour, unchanged).
|
|    THE RULE (one rule, the C# preview counts with the same one -- SI.Management.Core.ProData.OutputScope):
|      - an empty list = any value passes;
|      - a BLANK value on a row passes (as Risk Analysis's own scope filter keeps blanks -- IncludeBlank);
|      - severity compares by its key (case, spaces, '-' and '_' do not count; Critical = Very High, as #246);
|      - tier compares by number (0..3): a number, or a tier label ("High - tier 1");
|      - reports: the row passes when ANY of its report names is in the resolved report list.
|      - FILTERS (owner 2026-10-19, "define filters on one or more filters like risk rating"): 'filters' = { "<SI field>":
|        { "values": [...] } } -- risk rating, class, component, patch cycle, OS family, ServiceNow sub-CI, or any other SI
|        field of the finding (si_*). A row passes a filter when ANY of its values for the field is one of the values (case
|        does not count; OR within a filter); every filter must pass (AND across). A row WITHOUT a value for the field does
|        not pass a filter on it (owner: "we can NOT have a finding without a risk rating" -- such a row is raised as
|        "Classification incomplete", never hidden by a scope). The old lists (severities, tiers, domains) keep today's rule
|        -- a blank passes -- so no scope in force changes.
|
|    🔒 A SCOPE NEVER CLOSES ANYTHING AS FIXED. The CMDB connectors leave a CI that is out of scope exactly as it is. The
|    vulnerability connectors (#279 decision 3, operator 2026-10-04) close an open record whose finding left the scope
|    with the reason 'Out of scope' -- never Remediated, never counted by the close ceiling -- and reopen it when it comes
|    back: narrowing a scope can never read as "remediated" (#217, rule 4).
|
|    The SQL CMDB connector (Invoke-SICmdbSql.ps1) passes Get-SIOutputScope -Destination 'cmdb-sql' to its sync core, which
|    narrows BOTH sides of its plan (Select-SICmdbScopedPlanInput) -- it retires absent CIs, so a scope must never make a CI
|    read as absent. The ServiceNow CMDB connector has no link store yet (it never closes); it filters its asset list.
|
|    NO Set-StrictMode here -- it leaks into the caller's scope.
|#>
|
|$script:SIOutputScopeDestinations = [ordered]@{
|    'excel'           = @{ Asset = $false; Label = 'Excel + mail' }
|    'vuln-sql'        = @{ Asset = $false; Label = 'Vulnerability connector (SQL)' }
|    'vuln-servicenow' = @{ Asset = $false; Label = 'Vulnerability connector (ServiceNow)' }
|    'cmdb-sql'        = @{ Asset = $true;  Label = 'CMDB connector (SQL)' }
|    'cmdb-servicenow' = @{ Asset = $true;  Label = 'CMDB connector (ServiceNow)' }
|}
|$script:SIOutputScopeFile = 'output-scope.json'
|$script:SIOutputScopeSeverityKeys = @('veryhigh', 'high', 'mediumhigh', 'medium', 'low', 'informational')
|$script:SIOutputScopeDomains = @('Endpoint', 'Identity', 'Azure', 'PublicIP')
|# #817 (owner 2026-10-20: "i should see all asset kinds incl. public ip + identity ... dont limit options"): every kind
|# the data holds -- the C# twin is ReportVocabulary.AssetKinds
|$script:SIOutputScopeAssetKinds = @('endpoint', 'identity', 'azure', 'publicip')
|
|# The fields a scope filter offers by name (any other si_* field of the finding is accepted too): the columns a row
|# carries it under (first that has a value -- a Risk Analysis row names the risk rating RiskRating), its values when the
|# list is closed, and the default for a row without a value. The web app's twin: OutputScopeFilter.Fields (C#).
|$script:SIOutputScopeFilterFields = [ordered]@{
|    'si_risk_rating'      = @{ Label = 'Risk rating'; Columns = @('RiskRating', 'si_risk_rating'); Values = @('Critical', 'High', 'Moderate', 'Low') }
|    'si_category'         = @{ Label = 'Category'; Columns = @('si_category', 'Category'); Values = @() }
|    'si_subcategory'      = @{ Label = 'Subcategory'; Columns = @('si_subcategory', 'SubCategory', 'Subcategory'); Values = @() }
|    'si_class'            = @{ Label = 'Class'; Columns = @('si_class', 'AssetClass'); Values = @('device', 'identity', 'cloud_resource', 'public_ip') }
|    'si_component'        = @{ Label = 'Component'; Columns = @('si_component', 'Component'); Values = @('OS', 'SQL', 'Network', 'Hardware', 'Browser', 'Office', 'Application', 'Other') }
|    'si_patch_cycle'      = @{ Label = 'Patch cycle'; Columns = @('si_patch_cycle'); Values = @() }
|    'si_os_family'        = @{ Label = 'OS family'; Columns = @('si_os_family'); Values = @() }
|    'si_servicenow_subci' = @{ Label = 'ServiceNow sub-CI'; Columns = @('si_servicenow_subci'); Values = @() }
|}
|
|# #1055 (owner 2026-11-02: "we should NOT be syncing these assets [mobile phones] into snow"; "we need to be able to filter
|# on this in the snow connectors"): THE CI RULES of the ServiceNow CI output -- 'include' and 'exclude', each a list of
|# entries { "<CI field>": [values], ... }. An entry MATCHES a CI when, for EVERY field it names, the CI's value is one of
|# the entry's values (case does not count); a CI without a value for a field never matches an entry that names it. A CI
|# passes when no include entry is set or it matches ANY include entry, AND it matches NO exclude entry. Only the CI
|# destination of the ServiceNow data-out connector takes them (a vulnerable item whose CI they leave out is out of scope
|# too -- Invoke-SIDataOutContractPage). The web app's twin: CiRules (C#).
|$script:SIOutputScopeCiRuleDestinations = @('cmdb-servicenow')
|$script:SIOutputScopeCiRuleFields = [ordered]@{
|    'si_asset_type' = @{ Label = 'Asset type'; Values = @() }
|    'si_os_family'  = @{ Label = 'OS family'; Values = @() }
|    'si_class'      = @{ Label = 'Class'; Values = @('device', 'identity', 'cloud_resource', 'public_ip') }
|}
|$script:SIOutputScopeCiRuleMax = 25
|
|function Get-SIOutputScopeCiRuleFields { <# PURE. The CI fields a CI rule may name, in order (unrolled: @(Get-SIOutputScopeCiRuleFields) is the list). #> @($script:SIOutputScopeCiRuleFields.Keys) }
|
|function Test-SIOutputScopeCiRuleDestination {
|    <# PURE. Does a destination take CI rules (include / exclude)? #>
|    param([string]$Destination)
|    $script:SIOutputScopeCiRuleDestinations -contains [string]$Destination
|}
|
|function ConvertTo-SIOutputScopeCiRules {
|    <# PURE. An 'include' / 'exclude' list -> one entry per rule: @{ Fields = @( @{ Field; Values (lower) } ) } (a rule naming no value is dropped). #>
|    param($Rules)
|    if ($null -eq $Rules) { return }
|    foreach ($r in @($Rules)) {
|        if ($null -eq $r -or $r -is [string]) { continue }
|        $names = if ($r -is [System.Collections.IDictionary]) { @($r.Keys | ForEach-Object { [string]$_ }) } else { @($r.PSObject.Properties | ForEach-Object { $_.Name }) }
|        $fs = @(foreach ($n in @($names | Sort-Object)) {
|            $vals = @(Get-SIOutputScopeList $r $n | ForEach-Object { ([string]$_).Trim().ToLowerInvariant() } | Where-Object { $_ })
|            if ($vals.Count) { [pscustomobject]@{ Field = $n; Values = $vals } }
|        })
|        if ($fs.Count) { [pscustomobject]@{ Fields = $fs } }
|    }
|}
|
|function Test-SIOutputScopeCiRuleMatch {
|    <# PURE. Does a CI (-Fields: field -> its value(s)) match ONE rule: every field the rule names holds one of its values? #>
|    param($Rule, [hashtable]$Fields)
|    foreach ($f in @($Rule.Fields)) {
|        $have = @()
|        if ($null -ne $Fields -and $Fields.ContainsKey($f.Field)) { $have = @(Get-SIOutputScopeNames $Fields[$f.Field] | ForEach-Object { $_.ToLowerInvariant() }) }
|        if ($have.Count -eq 0) { return $false }
|        $hit = $false
|        foreach ($h in $have) { if ($f.Values -contains $h) { $hit = $true; break } }
|        if (-not $hit) { return $false }
|    }
|    $true
|}
|
|function Test-SIOutputScopeCiRules {
|    <# PURE. Does a CI pass the scope's CI rules: any include rule (when there is one) and no exclude rule? No rules = it passes. #>
|    param($Scope, [hashtable]$Fields)
|    if ($null -eq $Scope) { return $true }
|    if ($Scope.PSObject.Properties['CiInclude'] -and @($Scope.CiInclude).Count) {
|        $in = $false
|        foreach ($r in @($Scope.CiInclude)) { if ($r -and (Test-SIOutputScopeCiRuleMatch -Rule $r -Fields $Fields)) { $in = $true; break } }
|        if (-not $in) { return $false }
|    }
|    if ($Scope.PSObject.Properties['CiExclude']) {
|        foreach ($r in @($Scope.CiExclude)) { if ($r -and (Test-SIOutputScopeCiRuleMatch -Rule $r -Fields $Fields)) { return $false } }
|    }
|    $true
|}
|
|function Get-SIOutputScopeCiRuleText {
|    <# PURE. One rule in words: "asset type Unknown + OS family ios, android". #>
|    param($Rule)
|    (@($Rule.Fields) | ForEach-Object {
|        $lbl = if ($script:SIOutputScopeCiRuleFields.Contains($_.Field)) { $script:SIOutputScopeCiRuleFields[$_.Field].Label.ToLowerInvariant() } else { $_.Field }
|        '{0} {1}' -f $lbl, (@($_.Values) -join ', ')
|    }) -join ' + '
|}
|
|function Test-SIOutputScopeCiRuleBody {
|    <# PURE. The reasons the 'include' / 'exclude' lists of a scope body are not accepted. #>
|    param([string]$Key, $Body)
|    $why = New-Object System.Collections.Generic.List[string]
|    foreach ($side in 'include', 'exclude') {
|        $list = Get-SIOutputScopeValue $Body $side
|        if ($null -eq $list) { continue }
|        if (-not (Test-SIOutputScopeCiRuleDestination -Destination $Key)) { $why.Add(("'{0}' is a CI rule of the ServiceNow CI output only (cmdb-servicenow), not of {1}" -f $side, $Key)); continue }
|        $rules = @($list)
|        if ($list -is [string] -or $list -is [System.Management.Automation.PSCustomObject] -or $list -is [System.Collections.IDictionary]) { $why.Add(("'{0}' must be a list of rules: [ {{ ""si_asset_type"": [""Mobile""] }} ]" -f $side)); continue }
|        if ($rules.Count -gt $script:SIOutputScopeCiRuleMax) { $why.Add(("{0}: at most {1} rules" -f $side, $script:SIOutputScopeCiRuleMax)) }
|        $i = 0
|        foreach ($r in $rules) {
|            $i++
|            if (-not ($r -is [System.Management.Automation.PSCustomObject] -or $r -is [System.Collections.IDictionary])) { $why.Add(("{0} rule {1}: a rule is an object {{ ""<CI field>"": [values] }}" -f $side, $i)); continue }
|            $names = if ($r -is [System.Collections.IDictionary]) { @($r.Keys | ForEach-Object { [string]$_ }) } else { @($r.PSObject.Properties | ForEach-Object { $_.Name }) }
|            if ($names.Count -eq 0) { $why.Add(("{0} rule {1} names no field" -f $side, $i)); continue }
|            foreach ($n in $names) {
|                if (-not $script:SIOutputScopeCiRuleFields.Contains($n)) { $why.Add(("{0} rule {1}: '{2}' is not a CI field a rule may name ({3})" -f $side, $i, $n, (@($script:SIOutputScopeCiRuleFields.Keys) -join ', '))); continue }
|                $raw = Get-SIOutputScopeValue $r $n
|                if ($null -eq $raw -or $raw -is [System.Management.Automation.PSCustomObject] -or $raw -is [System.Collections.IDictionary]) { $why.Add(("{0} rule {1}: '{2}' must be a list of values" -f $side, $i, $n)); continue }
|                $vals = @(Get-SIOutputScopeList $r $n)
|                if ($vals.Count -eq 0) { $why.Add(("{0} rule {1}: '{2}' names no value" -f $side, $i, $n)) }
|                foreach ($x in $vals) {
|                    $s = [string]$x
|                    if ($s.Length -gt 64 -or $s -match '[\r\n\t;]') { $why.Add(("{0} rule {1}: '{2}' is not a value of {3} (one line, at most 64 characters)" -f $side, $i, $s, $n)) }
|                }
|                $known = $script:SIOutputScopeCiRuleFields[$n]
|                if (@($known.Values).Count) {
|                    foreach ($x in $vals) { if (@($known.Values | Where-Object { $_ -ieq [string]$x }).Count -eq 0) { $why.Add(("{0} rule {1}: '{2}' is not a {3} ({4})" -f $side, $i, $x, $known.Label.ToLowerInvariant(), (@($known.Values) -join ', '))) } }
|                }
|            }
|        }
|    }
|    $why.ToArray()
|}
|
|function Get-SIOutputScopeFilterColumns {
|    <# PURE. The row columns a filter field is read from (a named field's list, else the field itself). #>
|    param([Parameter(Mandatory)][string]$Field)
|    if ($script:SIOutputScopeFilterFields.Contains($Field)) { return @($script:SIOutputScopeFilterFields[$Field].Columns) }
|    @($Field)
|}
|
|function Test-SIOutputScopeFilters {
|    <#
|        PURE. Does a row pass every filter of a scope? -Values: field -> the row's value(s) for it (a list, one value, or
|        nothing). OR within a filter, AND across filters; a row without a value does not pass.
|    #>
|    param($Scope, [hashtable]$Values)
|    if ($null -eq $Scope -or -not $Scope.PSObject.Properties['Filters']) { return $true }
|    foreach ($f in @($Scope.Filters)) {
|        if ($null -eq $f) { continue }
|        $have = @()
|        if ($null -ne $Values -and $Values.ContainsKey($f.Field)) { $have = @(Get-SIOutputScopeNames $Values[$f.Field] | ForEach-Object { $_.ToLowerInvariant() }) }
|        if ($have.Count -eq 0) { return $false }
|        $hit = $false
|        foreach ($h in $have) { if ($f.Values -contains $h) { $hit = $true; break } }
|        if (-not $hit) { return $false }
|    }
|    $true
|}
|
|function Get-SIOutputScopeRowFields {
|    <# PURE. A row's values for the scope's filter fields (each from the first of its columns that has a value). #>
|    param($Row, $Scope)
|    $h = @{}
|    if ($null -eq $Scope -or -not $Scope.PSObject.Properties['Filters']) { return $h }
|    foreach ($f in @($Scope.Filters)) {
|        $h[$f.Field] = Get-SIOutputScopeRowValue $Row @(Get-SIOutputScopeFilterColumns -Field $f.Field)
|    }
|    $h
|}
|
|function Get-SIOutputScopeDestinations { $script:SIOutputScopeDestinations }
|
|function ConvertTo-SISeverityKey {
|    <# PURE. A severity's comparison key: lower case without spaces, '-' and '_'; Critical is Very High (#246). #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    if ([string]::IsNullOrWhiteSpace($Value)) { return '' }
|    $k = ($Value.Trim().ToLowerInvariant() -replace '[\s\-_]', '')
|    switch ($k) { 'critical' { 'veryhigh' } 'moderate' { 'medium' } 'info' { 'informational' } 'information' { 'informational' } default { $k } }
|}
|
|function ConvertTo-SIOutputScopeTier {
|    <# PURE. A tier as a number 0..3: a number, or a tier label ("High - tier 1"). $null = blank / unreadable. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $null }
|    $s = ([string]$Value).Trim()
|    if ($s -eq '') { return $null }
|    $n = 0
|    if ([int]::TryParse($s, [System.Globalization.NumberStyles]::Integer, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$n)) { return $n }
|    $m = [regex]::Match($s, '(?i)tier\s*(\d)')
|    if ($m.Success) { return [int]$m.Groups[1].Value }
|    $null
|}
|
|function Get-SIOutputScopeValue {
|    param($Object, [string]$Name)
|    if ($null -eq $Object) { return $null }
|    if ($Object -is [System.Collections.IDictionary]) { if ($Object.Contains($Name)) { return , $Object[$Name] } else { return $null } }
|    $p = $Object.PSObject.Properties[$Name]
|    if ($p) { return , $p.Value }
|    $null
|}
|
|function Get-SIOutputScopeList {
|    param($Object, [string]$Name)
|    $v = Get-SIOutputScopeValue $Object $Name
|    if ($null -eq $v) { return }
|    if ($v -is [string]) { if ($v.Trim()) { return $v.Trim() } else { return } }
|    @(@($v) | Where-Object { $null -ne $_ -and "$_".Trim() -ne '' } | ForEach-Object { if ($_ -is [string]) { $_.Trim() } else { $_ } })
|}
|
|function Test-SIOutputScopeBody {
|    <#
|        PURE. The reasons an output scope item is not accepted (empty = accepted). -Key is the destination. Same rules as
|        the web app's OutputScope.Validate (C#).
|    #>
|    param([string]$Key, $Body)
|    $why = New-Object System.Collections.Generic.List[string]
|    $spec = $script:SIOutputScopeDestinations[$Key]
|    if (-not $spec) { $why.Add(("'{0}' is not a destination ({1})" -f $Key, (@($script:SIOutputScopeDestinations.Keys) -join ', '))); return $why.ToArray() }
|    if ($null -eq $Body -or -not ($Body -is [System.Management.Automation.PSCustomObject] -or $Body -is [System.Collections.IDictionary])) { $why.Add('an output scope must be a JSON object'); return $why.ToArray() }
|    $names = if ($Body -is [System.Collections.IDictionary]) { @($Body.Keys | ForEach-Object { [string]$_ }) } else { @($Body.PSObject.Properties | ForEach-Object { $_.Name }) }
|    $allowed = if ($spec.Asset) { @('tiers', 'assetKinds') } else { @('templates', 'reports', 'severities', 'tiers', 'domains', 'filters') }
|    # #1055 the CI rules: the ServiceNow CI output only
|    if (Test-SIOutputScopeCiRuleDestination -Destination $Key) { $allowed += @('include', 'exclude') }
|    foreach ($n in $names) {
|        if ($allowed -notcontains $n) {
|            if ($n -in 'include', 'exclude') { continue }   # said by Test-SIOutputScopeCiRuleBody, in its own words
|            $why.Add(("'{0}' is not a scope of {1} ({2})" -f $n, $Key, ($allowed -join ', ')))
|        }
|    }
|    foreach ($w in @(Test-SIOutputScopeCiRuleBody -Key $Key -Body $Body)) { $why.Add($w) }
|    foreach ($n in $names) {
|        if ($n -in 'filters', 'include', 'exclude') { continue }
|        $v = Get-SIOutputScopeValue $Body $n
|        if ($null -ne $v -and -not ($v -is [System.Collections.IEnumerable] -and $v -isnot [string])) { $why.Add(("'{0}' must be a list" -f $n)) }
|    }
|    $flt = Get-SIOutputScopeValue $Body 'filters'
|    if ($null -ne $flt) {
|        if (-not ($flt -is [System.Management.Automation.PSCustomObject] -or $flt -is [System.Collections.IDictionary])) { $why.Add("'filters' must be an object: { ""<field>"": { ""values"": [...] } }") }
|        else {
|            $fnames = if ($flt -is [System.Collections.IDictionary]) { @($flt.Keys | ForEach-Object { [string]$_ }) } else { @($flt.PSObject.Properties | ForEach-Object { $_.Name }) }
|            foreach ($fn in $fnames) {
|                if ($fn -notmatch '^si_[a-z0-9_]{1,80}$') { $why.Add(("filters: '{0}' is not an SI field (si_...)" -f $fn)); continue }
|                $fo = Get-SIOutputScopeValue $flt $fn
|                $vals = @(Get-SIOutputScopeList $fo 'values')
|                if ($vals.Count -eq 0) { $why.Add(("filters: '{0}' names no value" -f $fn)) }
|                foreach ($x in $vals) { if (([string]$x).Length -gt 200) { $why.Add(("filters: a value of '{0}' is longer than 200 characters" -f $fn)) } }
|                foreach ($pn in @(if ($fo -is [System.Collections.IDictionary]) { $fo.Keys } else { $fo.PSObject.Properties.Name })) { if ([string]$pn -ne 'values') { $why.Add(("filters: '{0}' takes values only, not '{1}'" -f $fn, $pn)) } }
|                $known = $script:SIOutputScopeFilterFields[$fn]
|                if ($known -and @($known.Values).Count) {
|                    foreach ($x in $vals) { if (@($known.Values | Where-Object { $_ -ieq [string]$x }).Count -eq 0) { $why.Add(("filters: '{0}' is not a {1} ({2})" -f $x, $known.Label.ToLowerInvariant(), (@($known.Values) -join ', '))) } }
|                }
|            }
|        }
|    }
|    if ($why.Count) { return $why.ToArray() }
|    foreach ($t in @(Get-SIOutputScopeList $Body 'tiers')) {
|        $n = ConvertTo-SIOutputScopeTier $t
|        if ($null -eq $n -or $n -lt 0 -or $n -gt 3 -or ("$t" -notmatch '^\s*[0-3]\s*$')) { $why.Add(("tiers: '{0}' is not a tier (0, 1, 2 or 3)" -f $t)) }
|    }
|    foreach ($s in @(Get-SIOutputScopeList $Body 'severities')) {
|        if ($script:SIOutputScopeSeverityKeys -notcontains (ConvertTo-SISeverityKey ([string]$s))) { $why.Add(("severities: '{0}' is not a severity" -f $s)) }
|    }
|    foreach ($d in @(Get-SIOutputScopeList $Body 'domains')) {
|        if (@($script:SIOutputScopeDomains | Where-Object { $_ -ieq [string]$d }).Count -eq 0) { $why.Add(("domains: '{0}' is not a security domain ({1})" -f $d, ($script:SIOutputScopeDomains -join ', '))) }
|    }
|    foreach ($k in @(Get-SIOutputScopeList $Body 'assetKinds')) {
|        if ($script:SIOutputScopeAssetKinds -notcontains ([string]$k).ToLowerInvariant()) { $why.Add(("assetKinds: '{0}' is not an asset kind the CMDB connectors read ({1})" -f $k, ($script:SIOutputScopeAssetKinds -join ', '))) }
|    }
|    foreach ($n in 'templates', 'reports') {
|        foreach ($r in @(Get-SIOutputScopeList $Body $n)) { if ([string]$r -notmatch '^[A-Za-z0-9_]{1,100}$') { $why.Add(("{0}: '{1}' is not a report name" -f $n, $r)) } }
|    }
|    $why.ToArray()
|}
|
|function ConvertTo-SIOutputScope {
|    <#
|        PURE. One destination's scope as the engines use it: @{ Destination; Severities (keys); Tiers (int); Domains (lower);
|        AssetKinds (lower); ReportFilter (bool); Reports (HashSet, ordinal); Unresolved (template names not resolved) }.
|        $null for no body.
|    #>
|    param([string]$Destination, $Body)
|    if ($null -eq $Body) { return $null }
|    $reports = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::Ordinal)
|    $templates = @(Get-SIOutputScopeList $Body 'templates')
|    $named = @(Get-SIOutputScopeList $Body 'reports')
|    $resolvedRaw = Get-SIOutputScopeValue $Body 'resolvedReports'
|    $unresolved = @()
|    if ($null -ne $resolvedRaw) { foreach ($r in @($resolvedRaw)) { if ($r) { [void]$reports.Add([string]$r) } } }
|    else {
|        foreach ($r in $named) { [void]$reports.Add([string]$r) }
|        $unresolved = $templates
|    }
|    [pscustomobject]@{
|        Destination  = $Destination
|        Severities   = @(Get-SIOutputScopeList $Body 'severities' | ForEach-Object { ConvertTo-SISeverityKey ([string]$_) } | Where-Object { $_ })
|        Tiers        = @(Get-SIOutputScopeList $Body 'tiers' | ForEach-Object { ConvertTo-SIOutputScopeTier $_ } | Where-Object { $null -ne $_ })
|        Domains      = @(Get-SIOutputScopeList $Body 'domains' | ForEach-Object { ([string]$_).ToLowerInvariant() })
|        AssetKinds   = @(Get-SIOutputScopeList $Body 'assetKinds' | ForEach-Object { ([string]$_).ToLowerInvariant() })
|        ReportFilter = (($templates.Count + $named.Count) -gt 0)
|        Reports      = $reports
|        Unresolved   = $unresolved
|        Filters      = @(ConvertTo-SIOutputScopeFilterList (Get-SIOutputScopeValue $Body 'filters'))
|        # #1055 the CI rules (the ServiceNow CI output)
|        CiInclude    = @(ConvertTo-SIOutputScopeCiRules (Get-SIOutputScopeValue $Body 'include'))
|        CiExclude    = @(ConvertTo-SIOutputScopeCiRules (Get-SIOutputScopeValue $Body 'exclude'))
|    }
|}
|
|function ConvertTo-SIOutputScopeFilterList {
|    <# PURE. The 'filters' object -> @{ Field; Values (lower) } per field, by name. #>
|    param($Filters)
|    if ($null -eq $Filters) { return }
|    $names = if ($Filters -is [System.Collections.IDictionary]) { @($Filters.Keys | ForEach-Object { [string]$_ }) } else { @($Filters.PSObject.Properties | ForEach-Object { $_.Name }) }
|    foreach ($n in @($names | Sort-Object)) {
|        $fo = Get-SIOutputScopeValue $Filters $n
|        $vals = @(Get-SIOutputScopeList $fo 'values' | ForEach-Object { ([string]$_).Trim().ToLowerInvariant() } | Where-Object { $_ })
|        if ($vals.Count -eq 0) { continue }
|        [pscustomobject]@{ Field = $n; Values = $vals }
|    }
|}
|
|function Get-SIOutputScope {
|    <#
|        The scope of one destination for this run, or $null (everything passes). Reads <SI_ProConfigRoot>\output-scope.json
|        (materialised by the Pro settings layer); -ConfigRoot overrides (tests). A file that cannot be read THROWS: a scope
|        the operator set must never silently become "everything".
|    #>
|    param([Parameter(Mandatory)][string]$Destination, [string]$ConfigRoot)
|    if (-not $script:SIOutputScopeDestinations.Contains($Destination)) { throw ("'{0}' is not an output destination ({1})" -f $Destination, (@($script:SIOutputScopeDestinations.Keys) -join ', ')) }
|    if ([string]::IsNullOrWhiteSpace($ConfigRoot)) { $ConfigRoot = [string]$global:SI_ProConfigRoot }
|    if ([string]::IsNullOrWhiteSpace($ConfigRoot)) { return $null }
|    $p = [System.IO.Path]::Combine($ConfigRoot, $script:SIOutputScopeFile)
|    if (-not (Test-Path -LiteralPath $p)) { return $null }
|    $text = [System.IO.File]::ReadAllText($p).TrimStart([char]0xFEFF)
|    try { $doc = $text | ConvertFrom-Json -ErrorAction Stop } catch { throw ("the output scope file {0} is not valid JSON: {1}" -f $p, $_.Exception.Message) }
|    $dests = Get-SIOutputScopeValue $doc 'destinations'
|    $body = Get-SIOutputScopeValue $dests $Destination
|    if ($null -eq $body) { return $null }
|    ConvertTo-SIOutputScope -Destination $Destination -Body $body
|}
|
|function Get-SIOutputScopeText {
|    <# PURE. One line saying what a scope lets through (for the run log). #>
|    param($Scope)
|    if ($null -eq $Scope) { return 'everything' }
|    $parts = New-Object System.Collections.Generic.List[string]
|    if ($Scope.ReportFilter) { $parts.Add(('{0} report(s)' -f $Scope.Reports.Count)) }
|    if (@($Scope.Severities).Count) { $parts.Add(('severity ' + (@($Scope.Severities) -join ', '))) }
|    if (@($Scope.Tiers).Count) { $parts.Add(('tier ' + (@($Scope.Tiers) -join ', '))) }
|    if (@($Scope.Domains).Count) { $parts.Add(('domain ' + (@($Scope.Domains) -join ', '))) }
|    if (@($Scope.AssetKinds).Count) { $parts.Add(('asset kind ' + (@($Scope.AssetKinds) -join ', '))) }
|    if ($Scope.PSObject.Properties['Filters']) {
|        foreach ($f in @($Scope.Filters)) { if ($f) { $parts.Add(('{0} {1}' -f $f.Field, (@($f.Values) -join ', '))) } }
|    }
|    if ($Scope.PSObject.Properties['CiInclude'] -and @($Scope.CiInclude).Count) { $parts.Add(('only ' + ((@($Scope.CiInclude) | ForEach-Object { Get-SIOutputScopeCiRuleText $_ }) -join ' or '))) }
|    if ($Scope.PSObject.Properties['CiExclude']) { foreach ($r in @($Scope.CiExclude)) { if ($r) { $parts.Add(('leave out ' + (Get-SIOutputScopeCiRuleText $r))) } } }
|    if ($parts.Count -eq 0) { return 'everything' }
|    $parts -join '; '
|}
|
|function Test-SIOutputScopeFinding {
|    <#
|        PURE. Does one finding pass the scope? -Reports: the report name(s) the finding came from. Blank values pass.
|    #>
|    param($Scope, [AllowNull()][AllowEmptyString()][string]$Severity, [AllowNull()]$Tier, [AllowNull()][AllowEmptyString()][string]$Domain, [AllowNull()][string[]]$Reports,
|          [hashtable]$Fields)
|    if ($null -eq $Scope) { return $true }
|    # the filters (risk rating, class, component ...) -- only when the caller hands the row's values over (-Fields); a
|    # caller that checks one dimension (a domain) leaves them to its own call
|    if ($PSBoundParameters.ContainsKey('Fields') -and -not (Test-SIOutputScopeFilters -Scope $Scope -Values $Fields)) { return $false }
|    if (@($Scope.Severities).Count) {
|        $k = ConvertTo-SISeverityKey $Severity
|        if ($k -and @($Scope.Severities) -notcontains $k) { return $false }
|    }
|    if (@($Scope.Tiers).Count) {
|        $t = ConvertTo-SIOutputScopeTier $Tier
|        if ($null -ne $t -and @($Scope.Tiers) -notcontains $t) { return $false }
|    }
|    if (@($Scope.Domains).Count -and -not [string]::IsNullOrWhiteSpace($Domain)) {
|        if (@($Scope.Domains) -notcontains $Domain.Trim().ToLowerInvariant()) { return $false }
|    }
|    if ($Scope.ReportFilter) {
|        $names = @($Reports | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
|        if ($names.Count) {
|            $hit = $false
|            foreach ($n in $names) { if ($Scope.Reports.Contains($n.Trim())) { $hit = $true; break } }
|            if (-not $hit) { return $false }
|        }
|    }
|    $true
|}
|
|function Test-SIOutputScopeAsset {
|    <#
|        PURE. Does one asset pass a CMDB destination's asset scope (tiers, asset kinds)? Blank values pass. -Fields (#1055):
|        the CI's values for the CI rules (si_asset_type, si_os_family, si_class) -- given, the include / exclude rules are
|        applied too (Test-SIOutputScopeCiRules); not given, they are not (a caller without those values).
|    #>
|    param($Scope, [AllowNull()]$Tier, [AllowNull()][AllowEmptyString()][string]$Kind, [hashtable]$Fields)
|    if ($null -eq $Scope) { return $true }
|    if ($PSBoundParameters.ContainsKey('Fields') -and -not (Test-SIOutputScopeCiRules -Scope $Scope -Fields $Fields)) { return $false }
|    if (@($Scope.Tiers).Count) {
|        $t = ConvertTo-SIOutputScopeTier $Tier
|        if ($null -ne $t -and @($Scope.Tiers) -notcontains $t) { return $false }
|    }
|    if (@($Scope.AssetKinds).Count -and -not [string]::IsNullOrWhiteSpace($Kind)) {
|        if (@($Scope.AssetKinds) -notcontains $Kind.Trim().ToLowerInvariant()) { return $false }
|    }
|    $true
|}
|
|function Get-SIOutputScopeRowValue {
|    param($Row, [string[]]$Names)
|    foreach ($n in $Names) {
|        $v = Get-SIOutputScopeValue $Row $n
|        if ($null -ne $v -and "$v".Trim() -ne '') { return $v }
|    }
|    $null
|}
|
|function Select-SIOutputScopeRows {
|    <#
|        PURE. The rows of a Risk Analysis run that pass the scope (Excel + mail). A row's severity is SecuritySeverity, its
|        tier CriticalityTier (else the CriticalityTierLevel label), its domain SecurityDomain, its report
|        AssetDetectedInReportName (else ReportName). Returns @{ Rows; Dropped }. No scope = every row, Dropped 0.
|    #>
|    param([AllowNull()][object[]]$Rows, $Scope)
|    $all = @($Rows | Where-Object { $null -ne $_ })
|    if ($null -eq $Scope) { return [pscustomobject]@{ Rows = $all; Dropped = 0 } }
|    $kept = New-Object System.Collections.Generic.List[object]; $dropped = 0
|    foreach ($r in $all) {
|        $sev = [string](Get-SIOutputScopeRowValue $r @('SecuritySeverity'))
|        $tier = Get-SIOutputScopeRowValue $r @('CriticalityTier', 'CriticalityTierLevel')
|        $dom = [string](Get-SIOutputScopeRowValue $r @('SecurityDomain'))
|        $rep = [string](Get-SIOutputScopeRowValue $r @('AssetDetectedInReportName', 'ReportName'))
|        if (Test-SIOutputScopeFinding -Scope $Scope -Severity $sev -Tier $tier -Domain $dom -Reports @($rep) -Fields (Get-SIOutputScopeRowFields -Row $r -Scope $Scope)) { $kept.Add($r) } else { $dropped++ }
|    }
|    [pscustomobject]@{ Rows = $kept.ToArray(); Dropped = $dropped }
|}
|
|function Get-SIVulnScopeDestination {
|    <# PURE. The output destination of a vulnerability connector kind ('sql' | 'servicenow'); $null for one with none (rest). #>
|    param([string]$Kind)
|    switch (([string]$Kind).ToLowerInvariant()) { 'sql' { 'vuln-sql' } 'servicenow' { 'vuln-servicenow' } default { $null } }
|}
|
|function Get-SIOutputScopeNames {
|    <# PURE. Names from a query column: a list, a KQL dynamic array as JSON text ('["a","b"]' -- how a make_set comes back
|       from the query cmdlets), or one plain value. Blank names are dropped. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return }
|    if ($Value -is [string]) {
|        $t = $Value.Trim()
|        if ($t.StartsWith('[')) {
|            try { $arr = $t | ConvertFrom-Json -ErrorAction Stop } catch { $arr = @($t) }
|            foreach ($x in @($arr)) { if ($null -ne $x -and "$x".Trim() -ne '') { "$x".Trim() } }
|            return
|        }
|        if ($t) { $t }
|        return
|    }
|    foreach ($x in @($Value)) { if ($null -ne $x -and "$x".Trim() -ne '') { "$x".Trim() } }
|}
|
|function Select-SICmdbScopedPlanInput {
|    <#
|        PURE. A CMDB connector's plan inputs narrowed to its asset scope. -Desired / -Actual: CiKey -> CI (each with Kind and
|        Tier). A CI SI sees that is OUT of scope leaves the desired set AND the table's side -- it is neither created, updated
|        nor counted absent / retired: the table keeps it exactly as it is. A CI SI no longer sees is untouched by the scope.
|        Returns @{ Desired; Actual (ordered dictionaries); OutOfScope; LeftAsIs }.
|    #>
|    param([Parameter(Mandatory)][System.Collections.IDictionary]$Desired, [Parameter(Mandatory)][System.Collections.IDictionary]$Actual, $Scope)
|    if ($null -eq $Scope) { return [pscustomobject]@{ Desired = $Desired; Actual = $Actual; OutOfScope = 0; LeftAsIs = 0 } }
|    $d2 = [ordered]@{}; $out = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::Ordinal)
|    foreach ($k in @($Desired.Keys)) {
|        $ci = $Desired[$k]
|        if (Test-SIOutputScopeAsset -Scope $Scope -Tier (Get-SIOutputScopeValue $ci 'Tier') -Kind ([string](Get-SIOutputScopeValue $ci 'Kind'))) { $d2[$k] = $ci } else { [void]$out.Add([string]$k) }
|    }
|    $a2 = [ordered]@{}; $left = 0
|    foreach ($k in @($Actual.Keys)) { if ($out.Contains([string]$k)) { $left++ } else { $a2[$k] = $Actual[$k] } }
|    [pscustomobject]@{ Desired = $d2; Actual = $a2; OutOfScope = $out.Count; LeftAsIs = $left }
|}
|
|function Select-SIVulnScopedPlanInput {
|    <#
|        PURE. A vulnerability connector's plan inputs narrowed to its scope. -SnapshotRows: the desired-set query's rows
|        (AssetId, Cve, Severity, Tier, Domains, Reports). A finding OUT of scope leaves the desired set -- it is never
|        opened -- and its key goes to OutOfScopeKeys: #279 decision 3 (operator, 2026-10-04) closes an open record of it
|        with the reason 'Out of scope' (never as fixed, never counted by the close ceiling; back in scope = reopened).
|        -Actual is returned unchanged. Records SI does not report at all are untouched by the scope.
|        -AssetAlias (#279): @{ '<previous asset id lower>' = '<current SI_AssetId>' }. A target record stored under a
|        previous asset id is judged by the asset's CURRENT id -- OnTarget counts it, and the plan (given the same alias)
|        closes it as out of scope, never as absent or fixed.
|        Returns @{ Desired; Actual; OutOfScope (findings); OutOfScopeKeys (key -> why); OnTarget (target records out of scope) }.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Desired, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Actual,
|          [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$SnapshotRows, $Scope, [hashtable]$AssetAlias)
|    if ($null -eq $Scope) { return [pscustomobject]@{ Desired = @($Desired); Actual = @($Actual); OutOfScope = 0; OutOfScopeKeys = @{}; OnTarget = 0 } }
|    $keyOf = { param($id, $cve) ('{0}|{1}' -f ([string]$id).Trim().ToLowerInvariant(), ([string]$cve).Trim().ToUpperInvariant()) }
|    $out = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::Ordinal)
|    foreach ($r in $SnapshotRows) {
|        if ($null -eq $r) { continue }
|        $reports = @(Get-SIOutputScopeNames (Get-SIOutputScopeValue $r 'Reports'))
|        if (-not $reports.Count) { $reports = @(Get-SIOutputScopeNames (Get-SIOutputScopeValue $r 'ReportName')) }
|        $domains = @(Get-SIOutputScopeNames (Get-SIOutputScopeValue $r 'Domains'))
|        if (-not $domains.Count) { $domains = @(Get-SIOutputScopeNames (Get-SIOutputScopeValue $r 'SecurityDomain')) }
|        $domOk = ($domains.Count -eq 0)
|        foreach ($d in $domains) { if (Test-SIOutputScopeFinding -Scope $Scope -Domain $d) { $domOk = $true; break } }
|        # the filters read the snapshot's F_<field> sets (Get-SIVulnDesiredKql -ScopeFields), else the field's own columns
|        $fv = @{}
|        foreach ($f in @($Scope.Filters)) {
|            if ($null -eq $f) { continue }
|            $set = Get-SIOutputScopeValue $r ('F_' + $f.Field)
|            if ($null -eq $set) { $set = Get-SIOutputScopeRowValue $r @(Get-SIOutputScopeFilterColumns -Field $f.Field) }
|            $fv[$f.Field] = $set
|        }
|        $pass = $domOk -and (Test-SIOutputScopeFinding -Scope $Scope -Severity ([string](Get-SIOutputScopeValue $r 'Severity')) -Tier (Get-SIOutputScopeValue $r 'Tier') -Reports $reports -Fields $fv)
|        if (-not $pass) { [void]$out.Add((& $keyOf (Get-SIOutputScopeValue $r 'AssetId') (Get-SIOutputScopeValue $r 'Cve'))) }
|    }
|    $d2 = @($Desired | Where-Object { $null -ne $_ -and -not $out.Contains((& $keyOf $_.CorrelationId $_.Cve)) })
|    $currentId = {
|        param($id)
|        $k = ([string]$id).Trim().ToLowerInvariant()
|        if ($k -and $null -ne $AssetAlias -and $AssetAlias.ContainsKey($k)) { return [string]$AssetAlias[$k] }
|        $id
|    }
|    $why = ('this connector''s output scope ({0}) leaves the finding out -- closed as out of scope, not as fixed' -f (Get-SIOutputScopeText $Scope))
|    $keys = @{}; foreach ($k in $out) { $keys[$k] = $why }
|    $onTarget = @($Actual | Where-Object { $null -ne $_ -and $out.Contains((& $keyOf (& $currentId $_.CorrelationId) $_.Cve)) }).Count
|    [pscustomobject]@{ Desired = $d2; Actual = @($Actual); OutOfScope = $out.Count; OutOfScopeKeys = $keys; OnTarget = $onTarget }
|}
'@ }
$__siSupportFiles['risk-analysis-detection/riskscore.index.locked.csv'] = @{ Sha256 = 'b62e838dee99866a1ed08e0ff0cb95ab508bca872aa5cde71d67df018b030df3'; Text = @'
|si_finding_type,si_category,si_subcategory,si_component,si_finding_key,asset_class,si_severity,VulnerabilityBase,si_tier,AssetBase,Comments,Precedence
|,,,,scid-2002,device_server,,,,5,"Defender for Endpoint not responding (impaired communications) on a SERVER is critical at any tier (owner 2026-10-10, #559)",1
|,,,,scid-2002,device_client,,,0,4,the same on a Tier 0 client (a privileged workstation) stays high (#559),2
|,,,,scid-2002,device_client,,,,1,"the same on a user client is low: a user on vacation (owner 2026-10-10, #559)",3
|,Security controls,EDR,,scid-2002,device,critical,4,,,Fix Microsoft Defender for Endpoint impaired communications,4
|,Security controls,EDR,,scid-2002,device,,,0,4,Fix Microsoft Defender for Endpoint impaired communications,5
|,Security controls,EDR,,scid-2002,device,,,1,3,Fix Microsoft Defender for Endpoint impaired communications,6
|,Security controls,EDR,,scid-2002,device,,,2,2,Fix Microsoft Defender for Endpoint impaired communications,7
|,Security controls,EDR,,scid-2002,device,,,3,1,Fix Microsoft Defender for Endpoint impaired communications,8
|,Security controls,EDR,,scid-2001,device,critical,3,,,Fix Microsoft Defender for Endpoint sensor data collection (Very High >= High: owner 2026-10-10),9
|,Security controls,EDR,,scid-2001,device,,,0,1,Fix Microsoft Defender for Endpoint sensor data collection,10
|,Security controls,EDR,,scid-2001,device,,,1,1,Fix Microsoft Defender for Endpoint sensor data collection,11
|,Security controls,EDR,,scid-2001,device,,,2,1,Fix Microsoft Defender for Endpoint sensor data collection,12
|,Security controls,EDR,,scid-2001,device,,,3,1,Fix Microsoft Defender for Endpoint sensor data collection,13
|,Security controls,EDR,,scid-2000,device,critical,3,,,Turn on Microsoft Defender for Endpoint sensor (Very High >= High: owner 2026-10-10),14
|,Security controls,EDR,,scid-2000,device,,,0,1,Turn on Microsoft Defender for Endpoint sensor,15
|,Security controls,EDR,,scid-2000,device,,,1,1,Turn on Microsoft Defender for Endpoint sensor,16
|,Security controls,EDR,,scid-2000,device,,,2,1,Turn on Microsoft Defender for Endpoint sensor,17
|,Security controls,EDR,,scid-2000,device,,,3,1,Turn on Microsoft Defender for Endpoint sensor,18
|,Security controls,Antivirus,,scid-2014,device,,,0,4,,19
|,Security controls,Antivirus,,scid-2014,device,,,1,3,,20
|,Security controls,Antivirus,,scid-2014,device,,,2,2,,21
|,Security controls,Antivirus,,scid-2014,device,,,3,1,,22
|,Security controls,EDR,,,device,critical,4,,,,23
|,Security controls,EDR,,,device,,,0,4,,24
|,Security controls,EDR,,,device,,,1,3,,25
|,Security controls,EDR,,,device,,,2,2,,26
|,Security controls,EDR,,,device,,,3,1,,27
|,Security controls,Antivirus,,,device,,,0,4,,28
|,Security controls,Antivirus,,,device,,,1,3,,29
|,Security controls,Antivirus,,,device,,,2,2,,30
|,Security controls,Antivirus,,,device,,,3,1,,31
|,Security controls,,,,device,critical,5,,,,32
|,Security controls,,,,device,,,0,4,,33
|,Security controls,,,,device,,,1,3,,34
|,Security controls,,,,device,,,2,2,,35
|,Security controls,,,,device,,,3,1,,36
|,,,,,device,critical,4,,,,37
|,,,,,device,high,3,,,,38
|,,,,,device,medium_high,2,,,,39
|,,,,,device,medium,1,,,,40
|,,,,,device,low,1,,,,41
|,,,,,device,,,0,4,,42
|,,,,,device,,,1,3,,43
|,,,,,device,,,2,2,,44
|,,,,,device,,,3,1,,45
|,Security controls,Antivirus,,scid-2014,device,,5,,4,,46
|,Security controls,EDR,,scid-2002,device,,4,,4,,47
|,Security controls,EDR,,scid-2001,device,,2,,1,,48
|,Security controls,EDR,,scid-2000,device,,2,,1,,49
|,Security controls,Antivirus,,,device,,5,,4,,50
|,Security controls,EDR,,,device,,4,,4,,51
|,Security controls,,,,device,,5,,4,,52
|,,,,,device,,4,,4,,53
|,Security controls,EDR,,scid-2002,,critical,4,,,,54
|,Security controls,EDR,,scid-2002,,,,0,4,,55
|,Security controls,EDR,,scid-2002,,,,1,3,,56
|,Security controls,EDR,,scid-2002,,,,2,2,,57
|,Security controls,EDR,,scid-2002,,,,3,1,,58
|,Security controls,EDR,,scid-2001,,critical,3,,,Very High >= High: owner 2026-10-10,59
|,Security controls,EDR,,scid-2001,,,,0,1,,60
|,Security controls,EDR,,scid-2001,,,,1,1,,61
|,Security controls,EDR,,scid-2001,,,,2,1,,62
|,Security controls,EDR,,scid-2001,,,,3,1,,63
|,Security controls,EDR,,scid-2000,,critical,3,,,Very High >= High: owner 2026-10-10,64
|,Security controls,EDR,,scid-2000,,,,0,1,,65
|,Security controls,EDR,,scid-2000,,,,1,1,,66
|,Security controls,EDR,,scid-2000,,,,2,1,,67
|,Security controls,EDR,,scid-2000,,,,3,1,,68
|,Security controls,Antivirus,,scid-2014,,,,0,4,,69
|,Security controls,Antivirus,,scid-2014,,,,1,3,,70
|,Security controls,Antivirus,,scid-2014,,,,2,2,,71
|,Security controls,Antivirus,,scid-2014,,,,3,1,,72
|,Security controls,EDR,,,,critical,4,,,,73
|,Security controls,EDR,,,,,,0,4,,74
|,Security controls,EDR,,,,,,1,3,,75
|,Security controls,EDR,,,,,,2,2,,76
|,Security controls,EDR,,,,,,3,1,,77
|,Security controls,Antivirus,,,,,,0,4,,78
|,Security controls,Antivirus,,,,,,1,3,,79
|,Security controls,Antivirus,,,,,,2,2,,80
|,Security controls,Antivirus,,,,,,3,1,,81
|,Security controls,,,,,critical,5,,,,82
|,Security controls,,,,,,,0,4,,83
|,Security controls,,,,,,,1,3,,84
|,Security controls,,,,,,,2,2,,85
|,Security controls,,,,,,,3,1,,86
|,,,,,,critical,4,,,,87
|,,,,,,high,3,,,,88
|,,,,,,medium_high,2,,,,89
|,,,,,,medium,1,,,,90
|,,,,,,low,1,,,,91
|,,,,,,,,0,4,,92
|,,,,,,,,1,3,,93
|,,,,,,,,2,2,,94
|,,,,,,,,3,1,,95
|,Security controls,Antivirus,,scid-2014,,,5,,4,,96
|,Security controls,EDR,,scid-2002,,,4,,4,,97
|,Security controls,EDR,,scid-2001,,,2,,1,,98
|,Security controls,EDR,,scid-2000,,,2,,1,,99
|,Security controls,Antivirus,,,,,5,,4,,100
|,Security controls,EDR,,,,,4,,4,,101
|,Security controls,,,,,,5,,4,,102
'@ }
$__siSupportFiles['asset-profiling-enrichment/endpoint/AssetTagging.locked.yaml'] = @{ Sha256 = '6540592d3ffd2b8e6571ff8b616f13674a74d42065193ab370fdb5deb0e835e8'; Text = @'
|# ============================================================================
|# Auto-Exclude tagging rules driven by config/asset-tagging.config.json
|#
|# FOUR independent rules. Not ANDed. A device matching multiple gets
|# multiple Auto-* tags (downstream '--Excluded--SI' suffix doesn't care
|# which prefix carried it).
|#
|# Sources:
|#   Rules 1-3 (OnboardingStatus): source = DeviceInfo.
|#     DeviceInfo is the authoritative table for OnboardingStatus and
|#     surfaces EVERY device Defender has signal for -- including the
|#     ones that ExposureGraphNodes doesn't node-up (e.g. fully
|#     un-onboarded CanBeOnboarded devices). EG is left-joined ONLY to
|#     pull rawData.deviceManualTags + deviceDynamicTags for the
|#     'already-tagged?' delta filter -- devices not in EG get an empty
|#     AssetTags string and naturally pass the filter (which is fine;
|#     the engine will skip them later if their DeviceId is empty,
|#     i.e. they have no MDE machine record to tag).
|#
|#   Rule 4 (DeviceNamePattern): source = ExposureGraphNodes.
|#     Name-pattern targets ONBOARDED machines (typically endpoints);
|#     EG is the modern source and gives us EntityIds + AssetTags in
|#     one read.
|#
|# Gates: AutoExcludeRules.{ExcludeCanBeOnboarded, ExcludeInsufficientInfo,
|#        ExcludeUnsupported, ExcludeByDeviceNamePattern}.
|#
|# Delta: each rule ends with 'where array_index_of(AssetTagsArray,
|# AssetTagName) == -1', so already-tagged devices don't re-hit MDE on
|# every cron tick.
|#
|# Limitation operators must understand: the MDE machine-tag REST API
|# (POST /api/machines/{id}/tags) requires an MDE-onboarded machine ID
|# (SenseDeviceId / DeviceInfo.DeviceId). Devices that exist in
|# DeviceInfo passively (switches, APs, printers, IoT, mobile, dummy
|# names) typically have empty DeviceId -- those rows are surfaced by
|# rules 1-3 but the engine drops them silently with an aggregate
|# 'Skipped Defender rows Count=N Reason=Missing SenseDeviceId' line.
|# Tagging un-onboarded devices is not technically possible via this
|# API path -- not a bug.
|# ============================================================================
|
|AssetTagging:
|
|  - AssetTagName: Auto-CanBeOnboarded--Excluded--SI
|    Mode: Prod
|    QueryEngine: DefenderGraph
|    EnabledByConfigFlag: AutoExcludeRules.ExcludeCanBeOnboarded
|    Description: |
|      Tags every DeviceInfo row whose OnboardingStatus is 'Can be onboarded'.
|      Source = DeviceInfo (authoritative). Left-join to ExposureGraphNodes
|      provides current AssetTags for the delta filter.
|    Query:
|      - |
|        let TaggedNodes =
|            ExposureGraphNodes
|            | where NodeLabel has "device"
|            | extend rawData = todynamic(NodeProperties).rawData
|            | extend
|                deviceManualTags  = iff(isnull(rawData.deviceManualTags),  dynamic([]), todynamic(rawData.deviceManualTags)),
|                deviceDynamicTags = iff(isnull(rawData.deviceDynamicTags), dynamic([]), todynamic(rawData.deviceDynamicTags))
|            | extend AssetTags = strcat_array(array_concat(deviceManualTags, deviceDynamicTags), ";")
|            | extend entityIds_dyn = todynamic(EntityIds)
|            | mv-apply e=entityIds_dyn on (
|                summarize SenseDeviceId = anyif(tostring(e.id), tostring(e.type) == "SenseDeviceId")
|              )
|            | where isnotempty(SenseDeviceId)
|            | project SenseDeviceId, AssetTags;
|        DeviceInfo
|        | where OnboardingStatus =~ "Can be onboarded"
|        | summarize arg_max(Timestamp, *) by DeviceId
|        | project SenseDeviceId = DeviceId, DeviceName, MachineGroup, OnboardingStatus
|        | extend
|            AssetTagType = "Asset--Excluded--SI",
|            AssetTag     = "Auto-CanBeOnboarded",
|            AssetTagName = strcat("Auto-CanBeOnboarded", "--Excluded--SI")
|        | join kind=leftouter TaggedNodes on SenseDeviceId
|        | extend AssetTags = coalesce(AssetTags, "")
|        | extend AssetTagsArray = iff(isempty(AssetTags), dynamic([]), split(AssetTags, ";"))
|        | where array_index_of(AssetTagsArray, AssetTagName) == -1
|        | project SenseDeviceId, DeviceName, MachineGroup, OnboardingStatus, AssetTags, AssetTagType, AssetTag, AssetTagName
|
|  - AssetTagName: Auto-InsufficientInfo--Excluded--SI
|    Mode: Prod
|    QueryEngine: DefenderGraph
|    EnabledByConfigFlag: AutoExcludeRules.ExcludeInsufficientInfo
|    Description: |
|      Tags every DeviceInfo row whose OnboardingStatus is 'Insufficient info'.
|      Source = DeviceInfo. Left-join to ExposureGraphNodes provides AssetTags
|      for the delta filter.
|    Query:
|      - |
|        let TaggedNodes =
|            ExposureGraphNodes
|            | where NodeLabel has "device"
|            | extend rawData = todynamic(NodeProperties).rawData
|            | extend
|                deviceManualTags  = iff(isnull(rawData.deviceManualTags),  dynamic([]), todynamic(rawData.deviceManualTags)),
|                deviceDynamicTags = iff(isnull(rawData.deviceDynamicTags), dynamic([]), todynamic(rawData.deviceDynamicTags))
|            | extend AssetTags = strcat_array(array_concat(deviceManualTags, deviceDynamicTags), ";")
|            | extend entityIds_dyn = todynamic(EntityIds)
|            | mv-apply e=entityIds_dyn on (
|                summarize SenseDeviceId = anyif(tostring(e.id), tostring(e.type) == "SenseDeviceId")
|              )
|            | where isnotempty(SenseDeviceId)
|            | project SenseDeviceId, AssetTags;
|        DeviceInfo
|        | where OnboardingStatus =~ "Insufficient info"
|        | summarize arg_max(Timestamp, *) by DeviceId
|        | project SenseDeviceId = DeviceId, DeviceName, MachineGroup, OnboardingStatus
|        | extend
|            AssetTagType = "Asset--Excluded--SI",
|            AssetTag     = "Auto-InsufficientInfo",
|            AssetTagName = strcat("Auto-InsufficientInfo", "--Excluded--SI")
|        | join kind=leftouter TaggedNodes on SenseDeviceId
|        | extend AssetTags = coalesce(AssetTags, "")
|        | extend AssetTagsArray = iff(isempty(AssetTags), dynamic([]), split(AssetTags, ";"))
|        | where array_index_of(AssetTagsArray, AssetTagName) == -1
|        | project SenseDeviceId, DeviceName, MachineGroup, OnboardingStatus, AssetTags, AssetTagType, AssetTag, AssetTagName
|
|  - AssetTagName: Auto-Unsupported--Excluded--SI
|    Mode: Prod
|    QueryEngine: DefenderGraph
|    EnabledByConfigFlag: AutoExcludeRules.ExcludeUnsupported
|    Description: |
|      Tags every DeviceInfo row whose OnboardingStatus is 'Unsupported'.
|      Source = DeviceInfo. Left-join to ExposureGraphNodes provides AssetTags
|      for the delta filter.
|    Query:
|      - |
|        let TaggedNodes =
|            ExposureGraphNodes
|            | where NodeLabel has "device"
|            | extend rawData = todynamic(NodeProperties).rawData
|            | extend
|                deviceManualTags  = iff(isnull(rawData.deviceManualTags),  dynamic([]), todynamic(rawData.deviceManualTags)),
|                deviceDynamicTags = iff(isnull(rawData.deviceDynamicTags), dynamic([]), todynamic(rawData.deviceDynamicTags))
|            | extend AssetTags = strcat_array(array_concat(deviceManualTags, deviceDynamicTags), ";")
|            | extend entityIds_dyn = todynamic(EntityIds)
|            | mv-apply e=entityIds_dyn on (
|                summarize SenseDeviceId = anyif(tostring(e.id), tostring(e.type) == "SenseDeviceId")
|              )
|            | where isnotempty(SenseDeviceId)
|            | project SenseDeviceId, AssetTags;
|        DeviceInfo
|        | where OnboardingStatus =~ "Unsupported"
|        | summarize arg_max(Timestamp, *) by DeviceId
|        | project SenseDeviceId = DeviceId, DeviceName, MachineGroup, OnboardingStatus
|        | extend
|            AssetTagType = "Asset--Excluded--SI",
|            AssetTag     = "Auto-Unsupported",
|            AssetTagName = strcat("Auto-Unsupported", "--Excluded--SI")
|        | join kind=leftouter TaggedNodes on SenseDeviceId
|        | extend AssetTags = coalesce(AssetTags, "")
|        | extend AssetTagsArray = iff(isempty(AssetTags), dynamic([]), split(AssetTags, ";"))
|        | where array_index_of(AssetTagsArray, AssetTagName) == -1
|        | project SenseDeviceId, DeviceName, MachineGroup, OnboardingStatus, AssetTags, AssetTagType, AssetTag, AssetTagName
|
|  - AssetTagName: Auto-NamePattern--Excluded--SI
|    Mode: Prod
|    QueryEngine: DefenderGraph
|    ApplyDeviceNamePatterns: true
|    EnabledByConfigFlag: AutoExcludeRules.ExcludeByDeviceNamePattern
|    Description: |
|      Tags every DeviceInfo row whose DeviceName matches any entry in
|      DeviceNamePatterns.{StartsWith, Contains, MatchesRegex}. Source =
|      DeviceInfo so we see EVERY known device (including ones not in
|      ExposureGraphNodes). Left-join to EG provides AssetTags for the
|      delta filter. Independent of OnboardingStatus -- e.g. desktop-*
|      gets tagged whether onboarded, canBeOnboarded, or unsupported.
|    Query:
|      - |
|        let TaggedNodes =
|            ExposureGraphNodes
|            | where NodeLabel has "device"
|            | extend rawData = todynamic(NodeProperties).rawData
|            | extend
|                deviceManualTags  = iff(isnull(rawData.deviceManualTags),  dynamic([]), todynamic(rawData.deviceManualTags)),
|                deviceDynamicTags = iff(isnull(rawData.deviceDynamicTags), dynamic([]), todynamic(rawData.deviceDynamicTags))
|            | extend AssetTags = strcat_array(array_concat(deviceManualTags, deviceDynamicTags), ";")
|            | extend entityIds_dyn = todynamic(EntityIds)
|            | mv-apply e=entityIds_dyn on (
|                summarize SenseDeviceId = anyif(tostring(e.id), tostring(e.type) == "SenseDeviceId")
|              )
|            | where isnotempty(SenseDeviceId)
|            | project SenseDeviceId, AssetTags;
|        DeviceInfo
|        | summarize arg_max(Timestamp, *) by DeviceId
|        | project SenseDeviceId = DeviceId, DeviceName, MachineGroup, OnboardingStatus
|        | extend
|            AssetTagType = "Asset--Excluded--SI",
|            AssetTag     = "Auto-NamePattern",
|            AssetTagName = strcat("Auto-NamePattern", "--Excluded--SI")
|        | join kind=leftouter TaggedNodes on SenseDeviceId
|        | extend AssetTags = coalesce(AssetTags, "")
|        | extend AssetTagsArray = iff(isempty(AssetTags), dynamic([]), split(AssetTags, ";"))
|        | where array_index_of(AssetTagsArray, AssetTagName) == -1
|        | project SenseDeviceId, DeviceName, MachineGroup, OnboardingStatus, AssetTags, AssetTagType, AssetTag, AssetTagName
'@ }
$__siSupportFiles['config/service-model.locked.json'] = @{ Sha256 = 'dfb474299a468627c120eb0ce4768d22d7c3109d15fc98f4c654dbfc6903a5f4'; Text = @'
|{
|  "_doc": "SI v3 -- THE SERVICE MODEL (V3-ARCHITECTURE 3.6, levels 1 and 2). Declares the customer's BUSINESS SERVICES (level 1) and the COMPONENTS within them (level 2), plus the ordered rules that bind an ASSET (level 3) to a component. SI owns level 3 and the asset->component binding; the customer owns levels 1 and 2.",
|
|  "_whyShippedEmpty": "SERVICES IS DELIBERATELY EMPTY, AND THAT IS THE WHOLE POINT. 3.6: 'Business service structure is asserted metadata, not observable. SI can see that server13 runs SQL; it cannot see that server13 is the backend of Order Management.' A shipped default service model would be SI inventing business structure it cannot verify -- the same overreach 3.4b rejects with 'SI should not be the judge'. An empty model means every asset is reported as an ORPHAN, which is the honest answer until a customer declares one, and orphan is a concept SI already has (IsCmdbOrphan).",
|
|  "_whySiNeverCreates": "4.8: 'SI never creates Services or Components -- levels 1-2 are business-owned. SI matches into existing ones and reports what it could not place.' This file is therefore a MATCHING TARGET, never a creation source. Nothing in the connector may propose a Service or a Component to ServiceNow, whatever this file says, and the ordering holds regardless: a component must exist before an asset can be related to it.",
|
|  "_whyOrderedRules": "First match wins, and the winning rule is STAMPED on the binding (SI_ServiceMatchRule). Same contract as the CMDB source precedence (58.1) and the tier attribution: a binding nobody can explain is a binding nobody can review, and 'which rule decided this' is the first question asked when a service mapping looks wrong. An asset matching two rules is not an error -- the order is the decision.",
|
|  "_matchSources": "tag = an Azure/resource tag on the asset (key + value). resourceGroup = the ARM resource group name. namePattern = a regex against SI_AssetName. cmdbField = a value already enriched from the customer's CMDB (cmdbName / cmdbCriticality / etc). All four are ASSERTED sources in 3.4a's sense -- a human wrote them -- which is why none of them may ever raise a tier on its own.",
|
|  "serviceModel": {
|    "services": [],
|
|    "bindings": [],
|
|    "_sampleServices": [
|      {
|        "name": "Order Management",
|        "owner": "retail-platform@example.com",
|        "businessCriticality": "High",
|        "components": [
|          { "name": "Order Management - frontend",   "role": "frontend"   },
|          { "name": "Order Management - middletier", "role": "middletier" },
|          { "name": "Order Management - backend",    "role": "backend"    }
|        ]
|      }
|    ],
|
|    "_sampleBindings": [
|      { "rule": "tag-service-and-tier", "match": { "source": "tag", "key": "Service", "equals": "Order Management" }, "service": "Order Management", "component": "Order Management - frontend" },
|      { "rule": "rg-convention",        "match": { "source": "resourceGroup", "matches": "(?i)^rg-ordermgmt-be$" },   "service": "Order Management", "component": "Order Management - backend" },
|      { "rule": "hostname-convention",  "match": { "source": "namePattern",   "matches": "(?i)^ordm-(web|frontend)" }, "service": "Order Management", "component": "Order Management - frontend" }
|    ]
|  }
|}
'@ }
$__siSupportFiles['engine/pro-settings/SI-Audit.ps1'] = @{ Sha256 = 'f8e6e98e22e7341c1972cd70b6d929aa2841a529c159d9e5631a770c306c9501'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT PRO -- THE AUDIT TRAIL, PowerShell half (#260, framework DOCS\REQUIREMENTS.md AUDIT-1).
|
|    ONE trail per install: cfg.AuditEvent in the Pro database (sql\si-pro-settings.sql). The web app writes its events
|    there (SI.Management.Web Audit\AuditCore.cs); the jobs, setup tools and engines write theirs with Write-SIAuditEvent;
|    every cfg.ChangeLog row is copied in by the table's trigger in the same transaction.
|
|    The CLOSED action list is config\audit-actions.locked.json -- the file the web app reads too; a test compares the two
|    lists. A failed write NEVER fails the step it records (the change already happened): it is warned once per failure,
|    counted (Get-SIAuditHealth) and answered $false. A plan / dry run is written with WhatIf = 1, or not at all.
|
|    Append-only: the database refuses UPDATE / DELETE on the trail to every identity (#289, a DENY in
|    sql\si-pro-settings.sql). The ONE removal is the retention step below (Invoke-SIAuditRetention), run by the data
|    sync job through the procedure cfg.AuditRetentionApply, bounded by SI_Pro_AuditRetentionMonths (not set = kept forever;
|    at least 13 months), and it records itself on the trail.
|#>
|
|$script:SIAuditRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|$script:SIAuditHealth = @{ Written = 0; Failed = 0; LastError = '' }
|$script:SIAuditMinRetentionMonths = 13
|
|function Get-SIAuditActionCatalog {
|    <# PURE (reads one shipped file). The closed list as shipped: actions, change categories / verbs, sources, outcomes. #>
|    param([string]$SIRoot = $script:SIAuditRoot)
|    $p = [System.IO.Path]::Combine($SIRoot, 'config', 'audit-actions.locked.json')
|    ConvertFrom-Json -InputObject ([System.IO.File]::ReadAllText($p))
|}
|
|function Get-SIAuditActionList {
|    <# Every action a row may carry, sorted ordinally: the listed actions + <category>.change.<verb> of the change rows. #>
|    param([string]$SIRoot = $script:SIAuditRoot)
|    $c = Get-SIAuditActionCatalog -SIRoot $SIRoot
|    $all = New-Object System.Collections.Generic.List[string]
|    foreach ($a in @($c.actions)) { $all.Add([string]$a.action) }
|    foreach ($cat in @($c.changeCategories)) { foreach ($v in @($c.changeVerbs)) { $all.Add(('{0}.change.{1}' -f $cat, $v)) } }
|    $arr = [string[]]@($all | Select-Object -Unique)
|    [Array]::Sort($arr, [StringComparer]::Ordinal)
|    $arr
|}
|
|function Test-SIAuditAction {
|    <# $true when the action is on the closed list. #>
|    param([Parameter(Mandatory)][string]$Action, [string]$SIRoot = $script:SIAuditRoot)
|    @(Get-SIAuditActionList -SIRoot $SIRoot) -contains $Action
|}
|
|function Get-SIAuditInsertSql {
|    <# THE PowerShell writer's one statement: an INSERT into cfg.AuditEvent (TsUtc is the store's). Same text as the web app's. #>
|@'
|IF OBJECT_ID(N'cfg.AuditEvent') IS NULL
|    SELECT N'Missing' AS Outcome;
|ELSE
|BEGIN
|    INSERT cfg.AuditEvent (RecordType, Action, Actor, ActorSource, Target, Reason, Outcome, OutcomeText, BeforeJson, AfterJson, CorrelationId, WhatIf, ScopeDomain, ScopeDepartmentId)
|    VALUES (N'event', @Action, @Actor, @ActorSource, @Target, @Reason, @Outcome, @OutcomeText, @BeforeJson, @AfterJson, @CorrelationId, @WhatIf, @ScopeDomain, @ScopeDepartmentId);
|    SELECT N'Saved' AS Outcome;
|END
|'@
|}
|
|function Test-SIAuditSecretName {
|    <# PURE. A field whose value is a secret or a credential -- never written to the trail (the web app's rule). #>
|    param([AllowEmptyString()][string]$Name)
|    if ($Name.StartsWith('__')) { return $true }
|    $Name -match '(?i)(secret|password|passwd|^pwd$|token|^otp|otp$|^pin$|code$|credential|apikey|api_key|signature|cookie|^t$|^sig$)'
|}
|
|function ConvertTo-SIAuditText {
|    <# PURE. Free text with any long opaque run (a token, a key) cut out, at most -Max characters. #>
|    param([AllowNull()][AllowEmptyString()][string]$Text, [int]$Max = 1000)
|    if ($null -eq $Text) { return $null }
|    $t = [regex]::Replace($Text, '(?<![A-Za-z0-9_\-+=])(?=[A-Za-z0-9_\-+=]*[0-9])(?=[A-Za-z0-9_\-+=]*[A-Za-z])[A-Za-z0-9_\-+=]{40,}', '(hidden)')
|    if ($t.Length -gt $Max) { $t = $t.Substring(0, $Max) }
|    $t
|}
|
|function ConvertTo-SIAuditJson {
|    <# PURE. A before / after state as compact JSON with every secret-named field hidden (one level of a hashtable or object). #>
|    param($InputObject)
|    if ($null -eq $InputObject) { return $null }
|    if ($InputObject -is [string]) { return (ConvertTo-Json -InputObject (ConvertTo-SIAuditText -Text $InputObject -Max 4000) -Compress) }
|    $o = [ordered]@{}
|    $isDict = $InputObject -is [System.Collections.IDictionary]
|    $names = if ($isDict) { @($InputObject.get_Keys() | ForEach-Object { [string]$_ }) } else { @($InputObject.PSObject.Properties | ForEach-Object { [string]$_.Name }) }
|    foreach ($k in $names) {
|        $v = if ($isDict) { $InputObject[$k] } else { $InputObject.$k }
|        if (Test-SIAuditSecretName -Name $k) { $o[$k] = '(hidden)' }
|        elseif ($v -is [string]) { $o[$k] = ConvertTo-SIAuditText -Text $v -Max 2000 }
|        else { $o[$k] = $v }
|    }
|    ConvertTo-Json -InputObject $o -Depth 5 -Compress
|}
|
|function Get-SIAuditActor {
|    <#
|        Who a job / setup step runs as: the managed identity (its client id) in a container, else the signed-in Windows
|        account, else the operating-system user -- never a parameter. -Job names the job it ran in.
|    #>
|    param([string]$Job)
|    $id = if (Get-Command -Name Get-SIProSessionActor -ErrorAction SilentlyContinue) { Get-SIProSessionActor }
|          elseif ($global:SI_UseManagedIdentity) { $c = [Environment]::GetEnvironmentVariable('AZURE_CLIENT_ID'); if ($c) { 'managed identity ' + $c } else { 'managed identity' } }
|          else { [System.Environment]::UserName }
|    if ($Job) { '{0} ({1})' -f $Job, $id } else { [string]$id }
|}
|
|function New-SIAuditRecord {
|    <# PURE. The parameters of one event row, validated against the closed lists; refuses a malformed row. #>
|    param(
|        [Parameter(Mandatory)][string]$Action,
|        [Parameter(Mandatory)][string]$Actor,
|        [ValidateSet('web', 'job', 'engine', 'setup', 'api', 'portal')][string]$ActorSource = 'job',
|        [string]$Target, [string]$Reason,
|        [ValidateSet('ok', 'error', 'refused', 'held')][string]$Outcome = 'ok',
|        [string]$OutcomeText, $Before, $After, [string]$CorrelationId,
|        [switch]$WhatIfRun, [string]$ScopeDomain, $ScopeDepartmentId
|    )
|    if ($Action -notmatch '^[a-z][a-z0-9-]*\.[a-z][a-z0-9-]*\.[a-z][a-z0-9-]*$') { throw "audit action '$Action' is not lower-case domain.object.verb" }
|    $cut = { param([string]$s, [int]$n) if ($null -eq $s -or $s.Length -le $n) { $s } else { $s.Substring(0, $n) } }
|    [ordered]@{
|        Action = $Action; Actor = (& $cut $Actor 256); ActorSource = $ActorSource; Target = (& $cut $Target 400); Reason = (& $cut $Reason 400)
|        Outcome = $Outcome; OutcomeText = (ConvertTo-SIAuditText -Text $OutcomeText -Max 1000)
|        BeforeJson = (ConvertTo-SIAuditJson -InputObject $Before); AfterJson = (ConvertTo-SIAuditJson -InputObject $After)
|        CorrelationId = $(if ($CorrelationId) { $CorrelationId } else { $null }); WhatIf = [bool]$WhatIfRun
|        ScopeDomain = (& $cut $ScopeDomain 64); ScopeDepartmentId = $(if ($null -ne $ScopeDepartmentId -and "$ScopeDepartmentId" -match '^\d+$') { [int]$ScopeDepartmentId } else { $null })
|    }
|}
|
|function Write-SIAuditEvent {
|    <#
|        THE PowerShell writer: one 'event' row on the trail. -Store (New-SIProSettingsStore) or -Invoke (the
|        (sql, params, mode) seam of every Pro engine). NEVER throws: a failure is warned, counted and answered $false.
|    #>
|    <#
|        #302 (framework AUDIT-1.1): a row a JOB writes (-ActorSource job / engine) names the PERSON who asked for the
|        change when one did: -Attribution (a record from Get-SIChangeAttribution, looked up by the caller by its target),
|        else the person who started this job execution (Get-SIJobAttribution: SI_AUDIT_CID in the environment, set by the
|        web app). The row then reads Actor = that person, After.appliedBy = the job (-Actor), After.jobRun = -JobRun (else
|        the caller's -CorrelationId, else the execution), After.approvedBy, and CorrelationId = the commit / request id.
|        No person asked: the job stays the actor and After.initiatedBy says so. -NoAttribution: a row that already names
|        the person itself (a release approved on a VM's command line).
|    #>
|    param(
|        $Store, [scriptblock]$Invoke,
|        [Parameter(Mandatory)][string]$Action,
|        [string]$Actor,
|        [string]$ActorSource = 'job',
|        [string]$Target, [string]$Reason,
|        [string]$Outcome = 'ok',
|        [string]$OutcomeText, $Before, $After, [string]$CorrelationId,
|        [switch]$WhatIfRun, [string]$ScopeDomain, $ScopeDepartmentId,
|        $Attribution, [string]$JobRun, [switch]$NoAttribution,
|        [scriptblock]$Log
|    )
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Warning $msg } }
|    if (-not $Invoke -and $Store) { $Invoke = $Store.Invoke }
|    try {
|        if (-not $Invoke) { throw 'no Pro database to write to' }
|        if (-not $Actor) { $Actor = Get-SIAuditActor }
|        if ($ActorSource -in @('job', 'engine') -and -not $NoAttribution) {
|            $attr = $Attribution
|            if ($null -eq $attr) { try { $attr = Get-SIJobAttribution -Invoke $Invoke -Log $Log } catch { $attr = $null } }
|            $res = Resolve-SIAuditAttribution -JobActor $Actor -Attribution $attr -JobRun $JobRun -CorrelationId $CorrelationId -After $After
|            $Actor = $res.Actor; $After = $res.After; $CorrelationId = $res.CorrelationId
|        }
|        try { if (-not (Test-SIAuditAction -Action $Action)) { & $Log 'WARN' ("audit action '{0}' is not on the closed list (config\audit-actions.locked.json) -- written anyway" -f $Action) } } catch { }
|        $p = New-SIAuditRecord -Action $Action -Actor $Actor -ActorSource $ActorSource -Target $Target -Reason $Reason -Outcome $Outcome -OutcomeText $OutcomeText `
|                -Before $Before -After $After -CorrelationId $CorrelationId -WhatIfRun:$WhatIfRun -ScopeDomain $ScopeDomain -ScopeDepartmentId $ScopeDepartmentId
|        $r = & $Invoke (Get-SIAuditInsertSql) $p 'scalar'
|        if ("$r" -eq 'Missing') { throw 'the Pro database has no cfg.AuditEvent yet -- apply sql\si-pro-settings.sql (it only adds)' }
|        if ($null -eq $script:SIAuditHealth) { $script:SIAuditHealth = @{ Written = 0; Failed = 0; LastError = '' } }
|        $script:SIAuditHealth.Written++
|        return $true
|    } catch {
|        # 2026-10-04, live on ring 1: loaded into another scope, the counter was $null and `.Failed++` THREW -- an audit
|        # failure stopped the vulnerability connector. An audit failure never fails the step: initialise here, never throw.
|        $auditErr = [string]$_.Exception.Message
|        if ($null -eq $script:SIAuditHealth) { $script:SIAuditHealth = @{ Written = 0; Failed = 0; LastError = '' } }
|        try { $script:SIAuditHealth.Failed++; $script:SIAuditHealth.LastError = $auditErr } catch { }
|        & $Log 'WARN' ("the audit trail row '{0}' could not be written: {1} -- the step itself is not affected" -f $Action, $auditErr)
|        return $false
|    }
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|# #302 (framework AUDIT-1.1): THE ACTOR OF A CHANGE A JOB CARRIES OUT IS THE PERSON WHO ASKED FOR IT.
|# The web app records, AT COMMIT, who initiated each change it hands to a job (and who approved it) in
|# cfg.ChangeAttribution, under the commit's correlation id and keyed by the changed target. The jobs look it up here.
|# ------------------------------------------------------------------------------------------------------------------
|$script:SIAttributionDays = 30
|$script:SIJobAttribution = $null
|
|function Get-SIChangeAttributionInsertSql {
|    <# The one write of an attribution row (a release approved on a VM's command line; the web app has the same text). #>
|@'
|IF OBJECT_ID(N'cfg.ChangeAttribution') IS NULL
|    SELECT N'Missing' AS Outcome;
|ELSE
|BEGIN
|    INSERT cfg.ChangeAttribution (CorrelationId, TargetKey, Kind, Op, Title, Actor, ApprovedBy, Source)
|    VALUES (@CorrelationId, @TargetKey, @Kind, @Op, @Title, @Actor, @ApprovedBy, @Source);
|    SELECT N'Saved' AS Outcome;
|END
|'@
|}
|
|function Get-SIChangeAttributionSelectSql {
|    <# The newest attribution of a correlation id and / or a target (and kind), within the last @Days days. #>
|@'
|IF OBJECT_ID(N'cfg.ChangeAttribution') IS NOT NULL
|SELECT TOP (1) CorrelationId, TargetKey, Kind, Op, Title, Actor, ApprovedBy, Source, CreatedAt
|FROM cfg.ChangeAttribution
|WHERE (@Cid IS NULL OR CorrelationId = @Cid) AND (@Target IS NULL OR TargetKey = @Target) AND (@Kind IS NULL OR Kind = @Kind)
|  AND CreatedAt >= DATEADD(day, -@Days, SYSUTCDATETIME())
|ORDER BY AttributionId DESC;
|'@
|}
|
|function ConvertTo-SIChangeAttribution {
|    <# PURE. A cfg.ChangeAttribution row (hashtable or object) -> the attribution record the writer applies; $null without an actor. #>
|    param($Row, [string]$Via = 'store')
|    if ($null -eq $Row) { return $null }
|    $g = { param($n) if ($Row -is [System.Collections.IDictionary]) { $Row[$n] } elseif ($Row.PSObject.Properties[$n]) { $Row.$n } else { $null } }
|    $actor = [string](& $g 'Actor')
|    if ([string]::IsNullOrWhiteSpace($actor)) { return $null }
|    $ap = [string](& $g 'ApprovedBy')
|    [pscustomobject]@{
|        Actor = $actor.Trim(); ApprovedBy = $(if ($ap.Trim()) { $ap.Trim() } else { '' }); CorrelationId = [string](& $g 'CorrelationId')
|        TargetKey = [string](& $g 'TargetKey'); Kind = [string](& $g 'Kind'); Op = [string](& $g 'Op'); Title = [string](& $g 'Title'); Via = $Via
|    }
|}
|
|function Save-SIChangeAttribution {
|    <# One attribution row, AT COMMIT. NEVER throws: a failure is warned and answered $false (the change itself happened). #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$CorrelationId, [Parameter(Mandatory)][string]$TargetKey,
|          [Parameter(Mandatory)][string]$Actor, [string]$ApprovedBy, [ValidateSet('change', 'start', 'release', 'flow')][string]$Kind = 'change',
|          [ValidateSet('set', 'remove', 'start', 'approve')][string]$Op = 'set', [string]$Title, [string]$Source = 'job', [scriptblock]$Log)
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Warning $msg } }
|    $cut = { param([string]$s, [int]$n) if ($null -eq $s -or $s.Length -le $n) { $s } else { $s.Substring(0, $n) } }
|    try {
|        $p = [ordered]@{ CorrelationId = (& $cut $CorrelationId 64); TargetKey = (& $cut $TargetKey 400); Kind = $Kind; Op = $Op; Title = (& $cut $Title 400)
|                         Actor = (& $cut $Actor 256); ApprovedBy = $(if ($ApprovedBy) { & $cut $ApprovedBy 256 } else { $null }); Source = (& $cut $Source 16) }
|        $r = & $Invoke (Get-SIChangeAttributionInsertSql) $p 'scalar'
|        if ("$r" -eq 'Missing') { throw 'the Pro database has no cfg.ChangeAttribution yet -- apply sql\si-pro-settings.sql (it only adds)' }
|        return $true
|    } catch {
|        & $Log 'WARN' ("who asked for '{0}' could not be recorded: {1} -- the change itself is not affected" -f $TargetKey, $_.Exception.Message)
|        return $false
|    }
|}
|
|function Get-SIChangeAttribution {
|    <#
|        The newest attribution of -CorrelationId and / or -TargetKey (optionally of one -Kind), at most -Days old -- or $null.
|        NEVER throws: an unreadable store attributes nothing (the job stays the actor), warned once.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [string]$CorrelationId, [string]$TargetKey, [string]$Kind, [int]$Days = $script:SIAttributionDays, [scriptblock]$Log)
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Warning $msg } }
|    if (-not $CorrelationId -and -not $TargetKey) { return $null }
|    try {
|        $p = [ordered]@{ Cid = $(if ($CorrelationId) { $CorrelationId } else { $null }); Target = $(if ($TargetKey) { $TargetKey } else { $null }); Kind = $(if ($Kind) { $Kind } else { $null }); Days = $Days }
|        $rows = @(& $Invoke (Get-SIChangeAttributionSelectSql) $p 'reader' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })
|        if (-not $rows.Count) { return $null }
|        return (ConvertTo-SIChangeAttribution -Row $rows[0] -Via 'store')
|    } catch {
|        & $Log 'WARN' ("who asked for this change could not be read (the job is recorded as the actor): {0}" -f $_.Exception.Message)
|        return $null
|    }
|}
|
|function Get-SIJobAttribution {
|    <#
|        The person who started THIS job execution, when one did: the web app starts a job for a person with SI_AUDIT_CID
|        (the request's correlation id, recorded in cfg.ChangeAttribution at that moment) and SI_AUDIT_STARTED_BY. The
|        store's row wins; the variable is the fallback when the store cannot be read (Via 'environment'). $null = the
|        job's own run (a schedule). Resolved once per process and execution.
|    #>
|    param([scriptblock]$Invoke, [scriptblock]$Log)
|    $cid = [string]$env:SI_AUDIT_CID; $by = [string]$env:SI_AUDIT_STARTED_BY
|    if (-not $cid.Trim() -and -not $by.Trim()) { return $null }
|    $key = $cid + '|' + $by
|    if ($script:SIJobAttribution -and $script:SIJobAttribution.Key -eq $key) { return $script:SIJobAttribution.Value }
|    $v = $null
|    if ($Invoke -and $cid.Trim()) { $v = Get-SIChangeAttribution -Invoke $Invoke -CorrelationId $cid.Trim() -Log $Log }
|    if (-not $v -and $by.Trim()) {
|        $v = [pscustomobject]@{ Actor = $by.Trim(); ApprovedBy = ''; CorrelationId = $cid.Trim(); TargetKey = ''; Kind = 'start'; Op = 'start'; Title = ''; Via = 'environment' }
|    }
|    $script:SIJobAttribution = @{ Key = $key; Value = $v }
|    $v
|}
|
|function Get-SIAuditJobRun {
|    <# The job execution this process runs in (a container's execution name), else ''. #>
|    $e = [string]$env:CONTAINER_APP_JOB_EXECUTION_NAME
|    if ($e.Trim()) { return $e.Trim() }
|    ''
|}
|
|function Resolve-SIAuditAttribution {
|    <#
|        PURE. The rule of AUDIT-1.1 for one row a job writes. With an attribution: Actor = the person who initiated it,
|        After.appliedBy = the job (-JobActor), After.jobRun = -JobRun (else the caller's -CorrelationId, which was the job's
|        run, else the execution), After.approvedBy when an approval applied, CorrelationId = the commit / request id (the
|        caller's when the attribution has none). Without: the job stays the actor, After.initiatedBy says no person asked,
|        and the run is kept. Returns @{ Actor; After; CorrelationId; Attributed }.
|    #>
|    param([Parameter(Mandatory)][string]$JobActor, $Attribution, [string]$JobRun, [string]$CorrelationId, $After)
|    $a = [ordered]@{}
|    if ($null -ne $After) {
|        if ($After -is [string]) { $a['detail'] = $After }
|        elseif ($After -is [System.Collections.IDictionary]) { foreach ($k in @($After.Keys)) { $a[[string]$k] = $After[$k] } }
|        else { foreach ($pp in @($After.PSObject.Properties)) { $a[$pp.Name] = $pp.Value } }
|    }
|    $run = if ($JobRun) { $JobRun } elseif ($CorrelationId) { $CorrelationId } else { Get-SIAuditJobRun }
|    if ($null -ne $Attribution -and [string]$Attribution.Actor) {
|        $a['appliedBy'] = $JobActor
|        if ($run) { $a['jobRun'] = $run }
|        if ([string]$Attribution.ApprovedBy -and ([string]$Attribution.ApprovedBy).ToLowerInvariant() -ne ([string]$Attribution.Actor).ToLowerInvariant()) { $a['approvedBy'] = [string]$Attribution.ApprovedBy }
|        $cid = if ([string]$Attribution.CorrelationId) { [string]$Attribution.CorrelationId } else { $CorrelationId }
|        return [pscustomobject]@{ Actor = [string]$Attribution.Actor; After = $a; CorrelationId = $cid; Attributed = $true }
|    }
|    if (-not $a.Contains('initiatedBy')) { $a['initiatedBy'] = 'no person -- the job''s own run (a schedule, an expiry, a retention or its own checks)' }
|    if ($run -and -not $a.Contains('jobRun')) { $a['jobRun'] = $run }
|    [pscustomobject]@{ Actor = $JobActor; After = $a; CorrelationId = $CorrelationId; Attributed = $false }
|}
|
|function Get-SIChangeAttributionPendingSql {
|    <#
|        The committed changes (Kind 'change') of the last @Days days that THIS job has not yet recorded as put in force
|        (no settings.change.apply event of the same commit, target and job) -- oldest first, at most @Max.
|    #>
|@'
|IF OBJECT_ID(N'cfg.ChangeAttribution') IS NOT NULL AND OBJECT_ID(N'cfg.AuditEvent') IS NOT NULL
|SELECT TOP (@Max) a.AttributionId, a.CorrelationId, a.TargetKey, a.Kind, a.Op, a.Title, a.Actor, a.ApprovedBy, a.Source, a.CreatedAt
|FROM cfg.ChangeAttribution AS a
|WHERE a.Kind = N'change' AND a.CreatedAt >= DATEADD(day, -@Days, SYSUTCDATETIME())
|  AND NOT EXISTS (SELECT 1 FROM cfg.AuditEvent AS e
|                  WHERE e.CorrelationId = a.CorrelationId AND e.Action = N'settings.change.apply' AND e.RecordType = N'event'
|                    AND e.Target = LEFT(a.TargetKey, 400) AND e.AfterJson LIKE @JobLike ESCAPE N'\')
|ORDER BY a.AttributionId;
|'@
|}
|
|function Invoke-SIChangeAttributionApply {
|    <#
|        Run start (the settings layer of every Pro job): each change a person committed in the web app since this job last
|        ran is now in force for it -- ONE event 'settings.change.apply' per change and job, Actor = the person who initiated
|        it, After.appliedBy = the job, After.jobRun = the run, After.approvedBy, CorrelationId = the commit id (the same id
|        as the web event and its change rows). A removal is attributed the same way (the row is keyed by its target, not
|        read from the live table). NEVER throws; returns the number recorded.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$Job, [string]$JobRun, [int]$Days = $script:SIAttributionDays, [int]$Max = 500, [scriptblock]$Log)
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Warning $msg } }
|    $jobKey = ($Job -replace '[^A-Za-z0-9:._ -]', '').Trim()
|    if (-not $jobKey) { return 0 }
|    $like = '%"appliedJob":"' + ($jobKey -replace '\\', '\\' -replace '%', '\%' -replace '_', '\_' -replace '\[', '\[') + '"%'
|    $rows = @()
|    try { $rows = @(& $Invoke (Get-SIChangeAttributionPendingSql) ([ordered]@{ Days = $Days; Max = $Max; JobLike = $like }) 'reader' | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) }
|    catch { & $Log 'WARN' ("the changes committed in the web app could not be read for the audit trail: {0}" -f $_.Exception.Message); return 0 }
|    $n = 0
|    $actor = Get-SIAuditActor -Job $jobKey
|    foreach ($r in $rows) {
|        $attr = ConvertTo-SIChangeAttribution -Row $r -Via 'store'
|        if (-not $attr) { continue }
|        $after = [ordered]@{ appliedJob = $jobKey; op = $attr.Op; change = $attr.Title }
|        $ok = Write-SIAuditEvent -Invoke $Invoke -Action 'settings.change.apply' -Actor $actor -ActorSource 'job' -Target $attr.TargetKey `
|                -OutcomeText $(if ($attr.Op -eq 'remove') { 'removed -- no longer in force from this run' } else { 'in force from this run' }) `
|                -After $after -Attribution $attr -JobRun $JobRun -Log $Log
|        if ($ok) { $n++ }
|    }
|    $n
|}
|
|function Get-SIAuditHealth {
|    <# How many trail rows this process wrote, and how many it could not (with the last reason). #>
|    if ($null -eq $script:SIAuditHealth) { $script:SIAuditHealth = @{ Written = 0; Failed = 0; LastError = '' } }
|    [pscustomobject]@{ Written = [int]$script:SIAuditHealth.Written; Failed = [int]$script:SIAuditHealth.Failed; LastError = [string]$script:SIAuditHealth.LastError }
|}
|
|function Get-SIAuditSessionContextSql {
|    <# The SESSION_CONTEXT the cfg.ChangeLog trigger reads (the web app's SessionContextSql): change rows join the event. #>
|@'
|EXEC sys.sp_set_session_context @key = N'si.audit.cid', @value = @AuditCid;
|EXEC sys.sp_set_session_context @key = N'si.audit.source', @value = @AuditSource;
|'@
|}
|
|function New-SIAuditInvoke {
|    <#
|        Wraps an -Invoke seam so every batch first stamps the audit context: the cfg.ChangeLog rows the step writes carry
|        -CorrelationId and -ActorSource and show under the step's event on the Audit page. Pure wrapper (no I/O itself).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$CorrelationId, [string]$ActorSource = 'job')
|    $inner = $Invoke; $prefix = Get-SIAuditSessionContextSql; $cid = $CorrelationId; $src = $ActorSource
|    {
|        param([string]$sql, $p, [string]$mode)
|        $q = [ordered]@{}
|        if ($p) { foreach ($k in @($p.Keys)) { $q[$k] = $p[$k] } }
|        $q['AuditCid'] = $cid; $q['AuditSource'] = $src
|        & $inner ($prefix + $sql) $q $mode
|    }.GetNewClosure()
|}
|
|function Resolve-SIAuditRetentionMonths {
|    <#
|        PURE. SI_Pro_AuditRetentionMonths -> @{ Months; Problem }. Not set (or empty) = $null: kept forever. A whole number
|        of at least 13 (AUDIT-1.3: at least as long as Invardia's uplink rows); anything else is refused -- the trail is
|        then kept, never cut shorter by a typo.
|    #>
|    param($Value)
|    if ($null -eq $Value -or "$Value".Trim() -eq '') { return [pscustomobject]@{ Months = $null; Problem = '' } }
|    $n = 0
|    if (-not [int]::TryParse("$Value".Trim(), [ref]$n)) { return [pscustomobject]@{ Months = $null; Problem = ("SI_Pro_AuditRetentionMonths = '{0}' is not a whole number -- the audit trail is kept" -f $Value) } }
|    if ($n -lt $script:SIAuditMinRetentionMonths) { return [pscustomobject]@{ Months = $null; Problem = ("SI_Pro_AuditRetentionMonths = {0} is below the minimum of {1} months -- the audit trail is kept" -f $n, $script:SIAuditMinRetentionMonths) } }
|    [pscustomobject]@{ Months = $n; Problem = '' }
|}
|
|function Get-SIAuditRetentionDeleteSql {
|    <#
|        The ONE removal of trail rows (#289): a call of cfg.AuditRetentionApply (sql\si-pro-settings.sql). The database
|        refuses UPDATE / DELETE on the trail to every identity (DENY); only that procedure removes rows, and it decides
|        what may go: at least 13 months, never younger than that before the server's clock, a batch at a time, for the
|        job identity only. A database without the procedure answers -1 and nothing is removed.
|    #>
|    "IF OBJECT_ID(N'cfg.AuditRetentionApply') IS NULL SELECT -1 AS N; ELSE EXEC cfg.AuditRetentionApply @Months = @Months, @Cutoff = @Cutoff, @Batch = @Batch;"
|}
|
|function Get-SIAuditRetentionCountSql { "IF OBJECT_ID(N'cfg.AuditEvent') IS NULL SELECT -1 AS N; ELSE SELECT COUNT_BIG(*) AS N FROM cfg.AuditEvent WHERE TsUtc < @Cutoff;" }
|
|function Invoke-SIAuditRetention {
|    <#
|        The audited retention step (AUDIT-1.3), run by the data sync job: removes trail rows older than
|        SI_Pro_AuditRetentionMonths, in batches, and records ONE event 'audit.retention.apply' with the cutoff and the
|        count (a dry run counts only and records the plan with WhatIf = 1). Not set = nothing removed, nothing recorded.
|        Returns @{ Months; Cutoff; Removed; Problem; DryRun }.
|    #>
|    param(
|        [Parameter(Mandatory)][scriptblock]$Invoke,
|        $Months,
|        [datetime]$Now = [datetime]::UtcNow,
|        [switch]$DryRun,
|        [string]$Actor,
|        [int]$Batch = 5000,
|        [scriptblock]$Log
|    )
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Host ('[{0}] {1}' -f $level, $msg) } }
|    $cfg = Resolve-SIAuditRetentionMonths -Value $Months
|    $res = [ordered]@{ Months = $cfg.Months; Cutoff = $null; Removed = 0; Problem = $cfg.Problem; DryRun = [bool]$DryRun }
|    if ($cfg.Problem) { & $Log 'WARN' ('audit     : ' + $cfg.Problem); return [pscustomobject]$res }
|    if ($null -eq $cfg.Months) { & $Log 'INFO' 'audit     : SI_Pro_AuditRetentionMonths is not set -- the audit trail is kept in full.'; return [pscustomobject]$res }
|    $cutoff = $Now.ToUniversalTime().AddMonths(-[int]$cfg.Months)
|    $res.Cutoff = $cutoff
|    $cutText = $cutoff.ToString('yyyy-MM-ddTHH:mm:ss', [System.Globalization.CultureInfo]::InvariantCulture)
|    if (-not $Actor) { $Actor = Get-SIAuditActor -Job 'data sync' }
|    $n = [long](& $Invoke (Get-SIAuditRetentionCountSql) @{ Cutoff = $cutText } 'scalar')
|    if ($n -lt 0) { & $Log 'INFO' 'audit     : the Pro database has no audit trail yet -- nothing to keep or remove.'; return [pscustomobject]$res }
|    $after = [ordered]@{ months = [int]$cfg.Months; cutoffUtc = $cutText; rows = $n }
|    if ($DryRun) {
|        & $Log 'INFO' ("audit     : {0} trail row(s) older than {1} month(s) would be removed (before {2:yyyy-MM-dd}); nothing is removed." -f $n, $cfg.Months, $cutoff)
|        [void](Write-SIAuditEvent -Invoke $Invoke -Action 'audit.retention.apply' -Actor $Actor -ActorSource 'job' -Target 'cfg.AuditEvent' -Reason 'SI_Pro_AuditRetentionMonths' -WhatIfRun -After $after -Log $Log)
|        return [pscustomobject]$res
|    }
|    $removed = [long]0
|    try {
|        while ($true) {
|            $k = [long](& $Invoke (Get-SIAuditRetentionDeleteSql) @{ Months = [int]$cfg.Months; Cutoff = $cutText; Batch = $Batch } 'scalar')
|            if ($k -lt 0) {
|                $res.Problem = 'the Pro database does not have the audit retention procedure yet -- apply sql\si-pro-settings.sql (it only adds); the audit trail is kept'
|                & $Log 'WARN' ('audit     : ' + $res.Problem)
|                return [pscustomobject]$res
|            }
|            $removed += $k
|            if ($k -lt $Batch) { break }
|        }
|    } catch {
|        $res.Removed = $removed
|        $after.removed = $removed
|        [void](Write-SIAuditEvent -Invoke $Invoke -Action 'audit.retention.apply' -Actor $Actor -ActorSource 'job' -Target 'cfg.AuditEvent' -Reason 'SI_Pro_AuditRetentionMonths' -Outcome 'error' -OutcomeText $_.Exception.Message -After $after -Log $Log)
|        throw
|    }
|    $res.Removed = $removed
|    $after.removed = $removed
|    [void](Write-SIAuditEvent -Invoke $Invoke -Action 'audit.retention.apply' -Actor $Actor -ActorSource 'job' -Target 'cfg.AuditEvent' -Reason 'SI_Pro_AuditRetentionMonths' -After $after -Log $Log)
|    & $Log 'OK' ("audit     : {0} month(s) -- removed {1} trail row(s) from before {2:yyyy-MM-dd} (recorded on the trail)" -f $cfg.Months, $removed, $cutoff)
|    [pscustomobject]$res
|}
'@ }
$__siSupportFiles['config/audit-actions.locked.json'] = @{ Sha256 = '6e82a29f1e11640b90b755cd19d21384802eee0faf132ea41ab32f231edfcf8b'; Text = @'
|{
|  "_": "THE CLOSED LIST of audit actions of SecurityInsight Pro (#260, framework AUDIT-1.1). Read by BOTH writers: the web app (SI.Management.Web Audit/AuditActions.cs, linked into the build) and PowerShell (engine/pro-settings/SI-Audit.ps1, Write-SIAuditEvent). A test compares the two lists, a test checks every [Audit] handler names an action listed here, and a test checks the trigger's category CASE in sql/si-pro-settings.sql against changeCategories. An action is lower-case domain.object.verb. Adding one = one entry here; renaming one breaks the history of the old name -- add, never rename.",
|  "actorSources": [ "web", "job", "engine", "setup", "api", "portal" ],
|  "outcomes": [ "ok", "error", "refused", "held" ],
|  "changeCategories": [ "setting", "document", "item", "template", "licence", "access", "exemption", "domainrole", "cmdb", "connector", "department", "signin", "finding", "governance", "remediation", "responsibility", "job", "magiclink", "other" ],
|  "changeVerbs": [ "set", "reset" ],
|  "actions": [
|    { "action": "access.assignment.save", "source": "web", "what": "a role / scope assignment created or changed (Configuration > Access (roles + scopes))" },
|    { "action": "access.assignment.remove", "source": "web", "what": "a role / scope assignment removed (Configuration > Access (roles + scopes))" },
|    { "action": "audit.trail.export", "source": "web", "what": "the audit trail exported (CSV or Excel) -- the filter and the row count" },
|    { "action": "audit.trail.print", "source": "web", "what": "the audit trail's print view opened (evidence)" },
|    { "action": "audit.retention.apply", "source": "job", "what": "audit rows older than the retention removed by the data sync's retention step" },
|    { "action": "changes.batch.commit", "source": "web", "what": "staged changes committed (Review & commit) -- each change also has its change row" },
|    { "action": "changes.batch.discard", "source": "web", "what": "staged changes discarded (Review & commit)" },
|    { "action": "closeloop.connector.apply", "source": "job", "what": "the vulnerability close-loop applied one connector's plan (opened / reopened / closed / errors)" },
|    { "action": "closeloop.connector.rekey", "source": "job", "what": "the vulnerability close-loop moved one record to its asset's current id, or retired it as a duplicate of the record that keeps the finding (never as fixed)" },
|    { "action": "config.commit.undo", "source": "web", "what": "a commit undone (framework CONFIG-1.2): the inverse of the chosen records committed through Review & commit, journaled with Source undo and the commit it reverses" },
|    { "action": "config.undo.stage", "source": "web", "what": "the inverse of a commit staged for Review & commit (Operations > Commits (undo)); nothing is written until it is committed" },
|    { "action": "config.backup.take", "source": "web", "what": "a configuration backup taken: by the daily backup job or Back up now -- a copy, or 'no change' recorded without a copy" },
|    { "action": "config.backup.prune", "source": "job", "what": "configuration backups older than the retention removed by the backup job (pinned ones and content a kept backup points at stay)" },
|    { "action": "config.backup.pin", "source": "web", "what": "a configuration backup pinned (kept past the retention) or unpinned" },
|    { "action": "config.backup.export", "source": "web", "what": "a configuration backup downloaded as a signed file" },
|    { "action": "config.backup.import", "source": "web", "what": "a configuration backup file imported as a backup (its signature verified, or accepted unverified by an explicit tick)" },
|    { "action": "config.backup.restore", "source": "web", "what": "records restored from a configuration backup (framework CONFIG-1.4): chosen per record, staged, committed through Review & commit with Source restore" },
|    { "action": "config.restore.stage", "source": "web", "what": "records chosen from a backup staged for Review & commit (or sent to a second SuperAdmin); nothing is written until committed" },
|    { "action": "config.approval.request", "source": "web", "what": "a guard release or a restore asked of a second SuperAdmin (framework CONFIG-1.5, setting SIWeb_ConfigSecondPerson)" },
|    { "action": "config.approval.decide", "source": "web", "what": "a second SuperAdmin approved or rejected a guard release or a restore asked by someone else" },
|    { "action": "config.journal.prune", "source": "job", "what": "change journal rows older than SI_Pro_ConfigJournalRetentionDays removed (never shorter than the backup retention)" },
|    { "action": "config.io.export", "source": "web", "what": "the configuration exported to a signed file (framework CONFIG-IO-1): all of it or the chosen sections -- never a secret value" },
|    { "action": "config.io.inspect", "source": "web", "what": "a configuration file uploaded on Export / Import and compared with the configuration now (signature, version and tenant checked); nothing is written" },
|    { "action": "config.io.preview", "source": "web", "what": "the chosen items of an uploaded configuration file previewed (WhatIf): what Apply would stage; nothing is written" },
|    { "action": "config.io.stage", "source": "web", "what": "the chosen items of an uploaded configuration file staged for Review & commit (or sent to a second SuperAdmin), the file kept as a backup" },
|    { "action": "connector.collection.resend", "source": "web", "what": "an earlier collection sent again into a connector by hand (the request, and the job that ran it through the connector's normal path and guards)" },
|    { "action": "connector.run.undo", "source": "web", "what": "the last run of a connector undone where the connector can reverse it (the request, and the job that put the items back)" },
|    { "action": "cmdb.service.add", "source": "web", "what": "a business service added to the SecurityInsight CMDB" },
|    { "action": "cmdb.service.save", "source": "web", "what": "a business service changed" },
|    { "action": "cmdb.service.retire", "source": "web", "what": "a business service retired" },
|    { "action": "cmdb.import.upload", "source": "web", "what": "an external CMDB CSV uploaded as the new snapshot" },
|    { "action": "cmdb.import.migrate", "source": "web", "what": "a v2.2 CMDB.csv migrated into the SecurityInsight CMDB" },
|    { "action": "cmdb.link.stage", "source": "web", "what": "a service-map link change staged" },
|    { "action": "cmdb.source.save", "source": "web", "what": "the authoritative CMDB source changed" },
|    { "action": "cmdb.ci.sync", "source": "job", "what": "the SQL CMDB connector wrote (or, as a plan, would write) the CI table in the Pro database: created / updated / absent / retired CIs, or why the run was refused" },
|    { "action": "cmdb.asset.retire", "source": "job", "what": "an asset SecurityInsight no longer sees was retired after the grace period of its category (#406): its open vulnerabilities close as AssetRetired, its CI is retired, ServiceNow gets u_si_state = retired" },
|    { "action": "cmdb.asset.reactivate", "source": "job", "what": "a retired or no-longer-seen asset was seen again and is active again (#406); its findings reopen" },
|    { "action": "cmdb.asset.retire-early", "source": "web", "what": "an Admin retired an asset SecurityInsight no longer sees before its grace period ended (Assets & services > CMDB > Not seen anymore, #406)" },
|    { "action": "connector.definition.stage", "source": "web", "what": "a connector definition staged" },
|    { "action": "connector.removal.stage", "source": "web", "what": "a connector's removal staged" },
|    { "action": "connector.state.stage", "source": "web", "what": "a connector's enable / disable staged" },
|    { "action": "connector.servicenow.verify", "source": "web", "what": "a ServiceNow check asked for (the connection, the Import Set table, its columns and its column mapping): the mail job runs it with its own identity and records the result; the web app never signs in to ServiceNow" },
|    { "action": "data.export.download", "source": "web", "what": "data exported (CSV / Excel) -- the page, the filter and the row count" },
|    { "action": "data.store.reset", "source": "setup", "what": "a fresh start of the install's data (setup\\Reset-SIData.ps1): every data table emptied in place (the identity ledger only with -IncludeIdentityLedger), the configuration, users and grants kept -- the rows per table, whether the ledger was emptied, whether another system's keys were accepted as lost, the read-back" },
|    { "action": "datamodel.item.stage", "source": "web", "what": "a risk factor or provider mapping of the Pro data model changed, turned off or put back (Configuration > Risk factors), staged" },
|    { "action": "cioverride.set.stage", "source": "web", "what": "a manual override of one CI field (tier, purpose, category, department or a CMDB field) set or changed, with its reason and expiry, staged" },
|    { "action": "cioverride.remove.stage", "source": "web", "what": "the removal (soft) of a manual CI override staged" },
|    { "action": "cisuspect.decide.stage", "source": "web", "what": "a decision about a group of correlation suspects staged -- the same machine (the next CI build merges them) or not the same machine, with its reason" },
|    { "action": "cisuspect.remove.stage", "source": "web", "what": "the removal (soft) of a correlation decision staged -- a \"same machine\" decision is split again by the next CI build" },
|    { "action": "cibuild.cutoff.set", "source": "setup", "what": "the one-time CI cut-off set (setup\\Set-SICiCutoff.ps1, hidden -- not a setting; #1100): the CI build ignores the records collected before it and retires at once the CIs built only from them -- the time, the reason, the CIs counted to retire, the data-out outputs that are on" },
|    { "action": "cibuild.cutoff.clear", "source": "setup", "what": "the one-time CI cut-off taken back (setup\\Set-SICiCutoff.ps1 -Clear; #1100): the row is kept, marked cleared; the CIs it already retired stay retired until a source records them again" },
|    { "action": "support.consent.applied", "source": "job", "what": "the Invardia Support app's consent level the customer set in the Invardia portal, applied by the updater from its own call to Invardia (troubleshoot / setup, or none = the consent removed), read back; with the level before and after" },
|    { "action": "riskanalysis.bucket-reset.stage", "source": "web", "what": "a one-time reset of a Risk Analysis report's bucket count (or of every report) staged on Operations > Risk Analysis query splitting: who, why, which report" },
|    { "action": "riskanalysis.source-accept.stage", "source": "web", "what": "a source that went silent accepted as empty for good for one Risk Analysis report, staged on Run health > Risk Analysis reports: who, why, which report and source" },
|    { "action": "riskanalysis.source-accept-undo.stage", "source": "web", "what": "an acceptance of a report's empty source undone, staged on Run health > Risk Analysis reports: who, why, which acceptance" },
|    { "action": "rulepack.decision.stage", "source": "web", "what": "a CI rule pack turned on or off, staged for testing, promoted to live or put back to testing (Configuration > Rule packs), staged" },
|    { "action": "rulepack.reset.stage", "source": "web", "what": "a CI rule pack put back to its shipped version (the customer's decision removed), staged" },
|    { "action": "datasync.asset.merge", "source": "job", "what": "the data sync merged duplicate assets of one device into the asset that carries its id (each pair, the findings moved)" },
|    { "action": "datasync.reportname.backfill", "source": "job", "what": "the data sync filled the report of stored findings that had none, from each finding's own data" },
|    { "action": "datasync.responsibility.resolve", "source": "job", "what": "the data sync resolved findings to departments with the current responsibility policy" },
|    { "action": "datasync.assetproperties.prune", "source": "job", "what": "the data sync removed full asset metadata older than its retention (SI_AssetProperties_RetentionDays) from the Pro database" },
|    { "action": "datasync.collection.retention", "source": "job", "what": "the data sync removed the finding rows of collections older than the newest complete one and the one before it, and of collections a stopped run left loading (each collection and the rows per table)" },
|    { "action": "datasync.collection.finish", "source": "job", "what": "the data sync completed a collection whose Risk Analysis run stopped after its verdicts were final, before the run marked it (the collection, its reports and rows, whether it was partial)" },
|    { "action": "department.advisor.add", "source": "web", "what": "an external advisor added to a department" },
|    { "action": "department.advisor.revoke", "source": "web", "what": "an external advisor revoked" },
|    { "action": "department.department.create", "source": "web", "what": "a department created" },
|    { "action": "department.department.save", "source": "web", "what": "a department changed" },
|    { "action": "department.department.retire", "source": "web", "what": "a department retired" },
|    { "action": "department.member.add", "source": "web", "what": "a person added to a department" },
|    { "action": "department.member.remove", "source": "web", "what": "a person removed from a department" },
|    { "action": "department.member.set", "source": "web", "what": "a department's people table saved: people added to and removed from their roles" },
|    { "action": "domainrole.member.add", "source": "web", "what": "a security owner added (Configuration > Security owners): a Domain Owner, a Category Owner or a domain approver" },
|    { "action": "domainrole.member.remove", "source": "web", "what": "a security owner removed (Configuration > Security owners): a Domain Owner, a Category Owner or a domain approver" },
|    { "action": "exemption.finding.stage", "source": "web", "what": "an exemption of a finding staged (findings browser / finding page)" },
|    { "action": "exemption.request.submit", "source": "web", "what": "an exemption request submitted" },
|    { "action": "exemption.request.approve", "source": "web", "what": "an exemption request approved" },
|    { "action": "exemption.bulk.refuse", "source": "web", "what": "a request for ALL matching findings refused by the bulk guard (no narrowing filter, or more than SIWeb_Exemption_BulkMax) -- the reason and the request" },
|    { "action": "exemption.request.reject", "source": "web", "what": "an exemption request rejected" },
|    { "action": "exemption.review.record", "source": "web", "what": "exemptions reviewed (kept / ended) by a domain owner" },
|    { "action": "exemption.revoke.stage", "source": "web", "what": "an exemption's revocation staged" },
|    { "action": "finding.comment.add", "source": "web", "what": "a comment / recommendation / approval left on a finding" },
|    { "action": "finding.link.create", "source": "web", "what": "two or more findings of one CI linked into one finding (the finding that stays, who and why; one recommendation-equivalence link item)" },
|    { "action": "finding.link.remove", "source": "web", "what": "an operator's link of findings undone -- the link kept as history, marked not used (who and why)" },
|    { "action": "finding.task.cancel", "source": "web", "what": "a follow-up task on a finding cancelled (Tasks)" },
|    { "action": "finding.task.complete", "source": "web", "what": "a follow-up task on a finding completed (Tasks)" },
|    { "action": "finding.task.create", "source": "web", "what": "follow-up tasks created on one or more findings (Tasks > New, a finding's thread)" },
|    { "action": "finding.task.reopen", "source": "web", "what": "a completed or cancelled follow-up task reopened (Tasks)" },
|    { "action": "finding.action.apply", "source": "web", "what": "a request to the shared action bar (Actions > Apply) that named no known action -- a request that names one is recorded under that action's own name, with the outcome per finding" },
|    { "action": "getstarted.step.save", "source": "web", "what": "a Get Started step saved: its settings (the same rows as Settings), a person or group given a role, a collection started or a test mail queued" },
|    { "action": "getstarted.reminder.send", "source": "job", "what": "the daily Get Started reminder queued for the alert recipients while a required step is open (framework MAIL-2 item 8)" },
|    { "action": "governance.action.apply", "source": "web", "what": "a remediation action or status applied to a finding" },
|    { "action": "governance.status.set", "source": "web", "what": "the governance status of 1..N findings set with a comment (the shared action bar), the outcome per finding" },
|    { "action": "governance.vendor.escalate", "source": "web", "what": "1..N findings escalated to the vendor of their remediation flow (the shared action bar), the outcome per finding" },
|    { "action": "governance.mail.send", "source": "job", "what": "a queued governance (vendor) mail sent" },
|    { "action": "governance.notice.send", "source": "job", "what": "a department's new-findings mail sent" },
|    { "action": "governance.review.send", "source": "job", "what": "a department's monthly technical review sent" },
|    { "action": "governance.remediation.schedule", "source": "job", "what": "findings planned into a maintenance window by an automatic remediation flow" },
|    { "action": "guard.release.approve", "source": "web", "what": "an Admin released, once, the vulnerability closes a close limit held in one connector run (Operations > Guards (safety checks), the guard mail link, or -ReleaseHeldCloses on the command line)" },
|    { "action": "guard.release.apply", "source": "job", "what": "a job applied a released held set: the vulnerability connector's closes (how many closed, how many came back and stayed open), or the data sync loading a released Risk Analysis collection once, marked partial" },
|    { "action": "guard.release.supersede", "source": "job", "what": "a job closed an older held set because a newer run of the same safety check decided again under the current rules (a newer collection is loaded, a run was within the limit, or a newer set is held) -- only current holds are shown" },
|    { "action": "guard.collection.release", "source": "web", "what": "an Admin released, once and with a reason, a Risk Analysis collection the data sync held because its run was not complete: the next data sync loads it, marked partial wherever it is shown (Operations > Guards (safety checks))" },
|    { "action": "guard.event.acknowledge", "source": "web", "what": "an Admin acknowledged a guard event (and later repeats of exactly it): it is hidden by default on Operations > Guards (safety checks); nothing else changes" },
|    { "action": "guard.event.clear", "source": "job", "what": "a guard cleared itself: a later complete run was back at the normal level (typically the first run on a release that fixed the cause) -- which guard, the run and the version; Invardia is told so its ticket closes" },
|    { "action": "guard.event.accept", "source": "setup", "what": "the owner accepted a guard situation at this install (a guard and a version range, or one guard key), through the Invardia Support app or the guard mail's link: who, why, the owner's own words, the version that caused it; its trips acknowledged, its episodes cleared, held sets released once through the release path" },
|    { "action": "guard.event.trip", "source": "job", "what": "a guard held, refused or halted a step to protect data: which guard, the numbers against the limit, what was held, whether the mail and the report to Invardia went out" },
|    { "action": "data-health.override.set", "source": "web", "what": "a SuperAdmin let one data-out channel send while SecurityInsight's data is Unhealthy, with a reason (Configuration > Connectors > Data-health hold); it lasts until the data is Healthy again" },
|    { "action": "data-health.override.clear", "source": "web", "what": "a SuperAdmin took back a data-out channel they had let through while the data is Unhealthy: the channel plans only again (Configuration > Connectors > Data-health hold)" },
|    { "action": "performance.size.request", "source": "web", "what": "an Admin asked for another size of the main database or the web app (Operations > Performance): the customer's setting is saved, the updater applies it (up or down) on its next run" },
|    { "action": "performance.size.apply", "source": "web", "what": "a SuperAdmin started the updater from Operations > Performance so a size asked for is applied now instead of at the next update" },
|    { "action": "guard.strict.end-early", "source": "web", "what": "a SuperAdmin ended, with a reason, the stricter period of the safety checks early (their limits are halved for 24 hours after a release that changed engine code); the normal limits apply again from then on (Operations > Guards (safety checks))" },
|    { "action": "guard.control.save", "source": "web", "what": "a SuperAdmin turned a safety check (or its mail, or every check) on or off, or changed its limit, on Operations > Guards (safety checks): the same settings as Settings > Guards, with the values before and after" },
|    { "action": "job.execution.start", "source": "web", "what": "a container job started now" },
|    { "action": "job.schedule.disable", "source": "web", "what": "a container job disabled" },
|    { "action": "job.schedule.enable", "source": "web", "what": "a container job enabled" },
|    { "action": "job.schedule.change", "source": "web", "what": "a container job's schedule changed" },
|    { "action": "job.flow.start", "source": "web", "what": "Run now on the daily pipeline, one of its stages or one step (queued until nothing else runs), or a re-run from a step (Operations > Jobs, #269, #306)" },
|    { "action": "job.flow.cancel", "source": "web", "what": "a Run now request taken out of the pipeline's queue before it started (Operations > Jobs, #306)" },
|    { "action": "job.flow.change", "source": "web", "what": "the daily pipeline changed: when it runs (time, time zone), a step added / removed / moved / moved to another stage / edited, a stage's failure rule (Operations > Jobs, #269, #306)" },
|    { "action": "job.flow.mode", "source": "web", "what": "the jobs switched between one flow and a timer per job, every job's trigger as previewed (Operations > Jobs, #269)" },
|    { "action": "job.flow.run", "source": "job", "what": "one run of the daily job flow ended: its trigger and each step's outcome (the flow runner, #269)" },
|    { "action": "job.flowrun.cancel", "source": "web", "what": "the RUNNING pipeline run cancelled by a person, with the reason: marked cancelled (never resumed), the lock released, the runner started to stop its job executions (Operations > Jobs, #700)" },
|    { "action": "job.flowrun.stop", "source": "job", "what": "a cancelled pipeline run's job executions stopped and the lock released -- asked from Operations > Jobs, by a support start of the runner, or by the update (a run that started on another version) (#700)" },
|    { "action": "licence.licence.install", "source": "setup", "what": "a licence installed into Key Vault (Set-SILicense)" },
|    { "action": "licence.request.send", "source": "job", "what": "the updater job asked Invardia for this install's licence by itself (none, ending within 30 days, or in its grace period)" },
|    { "action": "licence.request.install", "source": "job", "what": "the updater job installed the licence Invardia approved, after checking it (also mailed)" },
|    { "action": "licence.request.fail", "source": "job", "what": "an automatic licence request did not succeed: rejected, refused as incomplete, not reachable, or the licence sent did not pass the checks (also mailed)" },
|    { "action": "magiclink.link.issue", "source": "web", "what": "a one-page magic link issued (Configuration > Settings > E-mail + links)" },
|    { "action": "mail.test.send", "source": "web", "what": "a test mail queued from Settings > E-mail (sent by the mail job through the one mail transport)" },
|    { "action": "mail.restriction.verify", "source": "web", "what": "the mail job started to check again that Mail.Send is restricted to the shared mailbox (home banner Verify)" },
|    { "action": "mail.sharedmailbox.configure", "source": "web", "what": "the guided mail setup run for a shared mailbox (create, Exchange scope, role assignment, verify, settings, test mail) -- each step and its outcome" },
|    { "action": "mail.smtp.configure", "source": "web", "what": "the guided mail setup saved an SMTP relay (password only as a Key Vault secret name) and queued a test mail" },
|    { "action": "mail.smtp.keep", "source": "web", "what": "the SMTP relay kept by choice (home banner Ignore) or no longer (Settings > E-mail Undo): SI_Mail_SmtpKept written through the settings writer" },
|    { "action": "remediation.flow.add", "source": "web", "what": "a remediation flow added" },
|    { "action": "remediation.flow.retire", "source": "web", "what": "a remediation flow retired" },
|    { "action": "responsibility.rule.add", "source": "web", "what": "a responsibility rule added" },
|    { "action": "responsibility.rule.remove", "source": "web", "what": "a responsibility rule removed" },
|    { "action": "responsibility.override.set", "source": "web", "what": "an asset / recommendation assigned to a department by hand" },
|    { "action": "responsibility.override.revoke", "source": "web", "what": "a hand assignment revoked" },
|    { "action": "responsibility.assignment.bulk", "source": "web", "what": "rows of a department grid assigned to a department in bulk" },
|    { "action": "riskindex.draft.check", "source": "web", "what": "the risk index draft validated and dry-run over current findings (WhatIf; nothing stored)" },
|    { "action": "riskindex.draft.import", "source": "web", "what": "a risk index CSV (v2.2 or v3) imported into the draft (nothing stored until staged)" },
|    { "action": "riskindex.draft.sort", "source": "web", "what": "the risk index draft sorted by specificity (nothing stored until staged)" },
|    { "action": "riskindex.index.stage", "source": "web", "what": "an edited risk index staged for Review & commit (Configuration > Risk index); the commit is changes.batch.commit and its rows item.change.set" },
|    { "action": "report.scope.change", "source": "web", "what": "a Risk Analysis report's severity / tier scope, switch or back-to-vendor staged (Reports & outputs > Report catalog, one report or a bulk selection)" },
|    { "action": "report.template.change", "source": "web", "what": "a report template created, copied, renamed, retired or its reports changed, staged (Reports & outputs > Report templates)" },
|    { "action": "report.custom.create", "source": "web", "what": "a custom report (your own query) staged, with its links into report templates (Reports & outputs > Custom reports)" },
|    { "action": "report.custom.remove", "source": "web", "what": "a custom report's removal staged (and its links out of report templates)" },
|    { "action": "report.summary.save", "source": "web", "what": "a management summary report added or changed: sections, data, recipients, schedule (Reports & outputs > Management summary)" },
|    { "action": "report.summary.remove", "source": "web", "what": "a management summary report removed (nothing more is sent)" },
|    { "action": "report.summary.send", "source": "web", "what": "a management summary queued for its recipients -- sent now by a person, or by its schedule (one per period)" },
|    { "action": "report.presentation.download", "source": "web", "what": "a management presentation (PowerPoint) downloaded -- the run, the run compared with, the sections and the audience" },
|    { "action": "report.custom.test", "source": "web", "what": "a report query tested read-only against the workspace (capped, timed out; WhatIf, nothing stored)" },
|    { "action": "report.environment.export", "source": "web", "what": "the environment report exported as JSON (framework ENV-REPORT-1): names, ids and states only" },
|    { "action": "notify.recipient.save", "source": "web", "what": "a mail recipient's notifications saved or a recipient added (audience, reports and alerts on or off); a recipient who was not a user added as Reader" },
|    { "action": "notify.recipient.remove", "source": "web", "what": "a mail recipient's saved notification choices removed (their role is not changed)" },
|    { "action": "output.scope.change", "source": "web", "what": "the output scope of a destination (Excel + mail, a vulnerability or CMDB connector) staged (Reports & outputs > Output scope)" },
|    { "action": "secret.value.set", "source": "web", "what": "a secret's value set by a SuperAdmin (Set value, #822): the secret's NAME, who and when -- handed to the updater encrypted, never the value" },
|    { "action": "exclusions.document.stage", "source": "web", "what": "Risk Analysis exclusions (global or one report) staged from the Exclusions editor" },
|    { "action": "exclusions.draft.import", "source": "web", "what": "a v2.2 exclusions file read into the Exclusions editor (nothing stored until staged)" },
|    { "action": "weights.document.stage", "source": "web", "what": "weighted risk factors (the solution's or one report's) staged from the Weights editor" },
|    { "action": "rules.draft.check", "source": "web", "what": "a profiling rule draft re-shaped, switched between form and YAML, or checked (WhatIf; nothing stored)" },
|    { "action": "rules.rule.stage", "source": "web", "what": "a profiling rule change (save / turn off / reset / remove) staged for Review & commit; the commit is changes.batch.commit and its row item.change.set" },
|    { "action": "schemaoverlay.draft.check", "source": "web", "what": "a schema overlay draft re-shaped or checked (WhatIf; nothing stored)" },
|    { "action": "schemaoverlay.overlay.stage", "source": "web", "what": "a schema overlay (save / remove) staged for Review & commit; the commit is changes.batch.commit and its row item.change.set" },
|    { "action": "outputmap.column.stage", "source": "web", "what": "an output column change (change / remove / restore / add) staged for Review & commit; the commit is changes.batch.commit and its row item.change.set" },
|    { "action": "tagging.draft.check", "source": "web", "what": "an asset tag draft re-shaped or checked (WhatIf; nothing stored)" },
|    { "action": "tagging.tag.stage", "source": "web", "what": "an asset tag change (save / turn off / reset / remove) staged for Review & commit; the commit is changes.batch.commit and its row item.change.set" },
|    { "action": "tagging.gates.stage", "source": "web", "what": "the asset tagging gates and device-name patterns staged for Review & commit" },
|    { "action": "settings.value.save", "source": "web", "what": "a setting saved (licence request settings included)" },
|    { "action": "update.installkey.claim-again", "source": "web", "what": "an Admin asked the updater to claim the install key from Invardia once more after Invardia reset it (Settings > Updates; offered only while the claim is held)" },
|    { "action": "settings.document.stage", "source": "web", "what": "a structured setting (document) staged" },
|    { "action": "settings.document.stage-reset", "source": "web", "what": "a structured setting's reset staged" },
|    { "action": "settings.import.apply", "source": "setup", "what": "settings imported from the files into the Pro database (Import-SIProSettings)" },
|    { "action": "settings.change.apply", "source": "job", "what": "a job put in force, at its next run, a change a person committed in the web app (a setting, a document, a rule, a tag, a schema overlay, a report, a CMDB link, a connector, an approved exemption request) -- the actor is the person who initiated it, approvedBy the approver, appliedBy the job; a removal is attributed too" },
|    { "action": "signin.link.issue", "source": "web", "what": "a department sign-in link issued to a person" },
|    { "action": "signin.link.revoke", "source": "web", "what": "a department sign-in link revoked" },
|    { "action": "signin.link.request", "source": "portal", "what": "a sign-in link requested from the sign-in page (answered the same whatever the address)" },
|    { "action": "signin.link.redeem", "source": "portal", "what": "a magic link or department sign-in link redeemed -- or refused" },
|    { "action": "signin.code.send", "source": "portal", "what": "the second check: a one-time code mailed" },
|    { "action": "signin.code.verify", "source": "portal", "what": "the second check: a one-time code entered (passed or failed)" },
|    { "action": "signin.session.end", "source": "web", "what": "a sign-out" },
|    { "action": "template.conformance.stage", "source": "web", "what": "take / keep of a template item staged" },
|    { "action": "template.release.stage", "source": "web", "what": "a template pack release staged" },
|    { "action": "template.rollback.stage", "source": "web", "what": "a template roll back staged" },
|    { "action": "template.pack.publish", "source": "setup", "what": "templates published / adopted into the Pro database (Publish-SITemplates)" },
|    { "action": "tier.change.stage", "source": "web", "what": "a tier move / rule override staged (tier board)" },
|    { "action": "verification.decision.save", "source": "web", "what": "a data-collection gap of the verification service ignored or accepted, or its decision reviewed (Operations > Verification (data gaps)): who, why, the reviewer and the review date" },
|    { "action": "verification.decision.revoke", "source": "web", "what": "the decision on a data-collection gap withdrawn (Operations > Verification (data gaps)): the gap is open again" },
|    { "action": "view.pivot.save", "source": "web", "what": "a pivot of the weighted risk page saved as a named view (personal, or shared by an Admin)" },
|    { "action": "view.pivot.remove", "source": "web", "what": "a saved pivot view removed (the owner's own, or a shared one by an Admin)" },
|    { "action": "view.columns.save", "source": "web", "what": "the columns of a grid saved (a person's own, or the tenant default by an Admin)" },
|    { "action": "view.columns.reset", "source": "web", "what": "a grid's saved columns removed (a person's own -- back to the tenant default -- or the tenant default by an Admin)" },
|    { "action": "view.state.save", "source": "web", "what": "a person's last sort / filters / search of a data view remembered (rows of an earlier version only: a person's own sort, filters and widths are no longer recorded -- the trail records layouts)" },
|    { "action": "view.state.clear", "source": "web", "what": "a person's remembered sort / filters of a data view cleared (rows of an earlier version only: no longer recorded)" },
|    { "action": "view.widths.save", "source": "web", "what": "a person's column widths of a data view saved (rows of an earlier version only: no longer recorded)" },
|    { "action": "view.layout.save", "source": "web", "what": "a named layout of a data view saved (a person's own, or for everyone by an Admin): columns, order, sort, filters and widths" },
|    { "action": "view.layout.apply", "source": "web", "what": "a named layout of a data view chosen: it becomes the person's set-up of that view (rows of an earlier version only: choosing a layout is no longer recorded -- saving, renaming, deleting and publishing one are)" },
|    { "action": "view.layout.rename", "source": "web", "what": "a named layout of a data view renamed (a person's own, or a published one by an Admin)" },
|    { "action": "view.layout.delete", "source": "web", "what": "a named layout of a data view deleted (a person's own, or a published one by an Admin)" },
|    { "action": "view.layout.publish", "source": "web", "what": "a named layout of a data view published for everyone by an Admin" },
|    { "action": "view.layout.pin", "source": "web", "what": "a named layout pinned to the menu: in the person's own My views, or for everyone by an Admin (a published layout)" },
|    { "action": "view.layout.unpin", "source": "web", "what": "a named layout taken off the menu: from the person's own My views, or from everyone's menu by an Admin" },
|    { "action": "web.request.refused", "source": "web", "what": "a request refused by the role framework before any handler ran" },
|    { "action": "web.handler.unlisted", "source": "web", "what": "SAFETY NET: a mutating request whose handler names no action (a test keeps this at zero)" }
|  ]
|}
'@ }
$__siSupportFiles['engine/_shared/SI-InstallRing.ps1'] = @{ Sha256 = '172d3c05df58445ebed9db3c754234cdecca4cee934b14486c6ccc5971b64f8f'; Text = @'
|#Requires -Version 5.1
|<#
|.SYNOPSIS
|    SecurityInsight Pro -- THIS INSTALL'S UPDATE RING, recorded once where everyone reads it (#308).
|
|.DESCRIPTION
|    The ring is a property of the INSTALL, known when it is installed -- not something only an updater run discovers.
|    ONE record: the Pro database row cfg.InstallState 'Ring', compact JSON
|
|        { "ring": 1, "channel": "internal", "setBy": "bootstrap", "source": "setting", "setAt": "2026-10-05T10:00:00Z" }
|
|    written by every path that knows the ring:
|      setup\Set-SIInstallRing.ps1   the command an admin (or a build script) runs -- also what the guided install and
|                                    Bootstrap-ContainerAppJob.ps1 call
|      the updater job               whenever it resolves a ring (Invardia's manifest; the release map on the feed path)
|
|    WHICH RING a writer records -- Resolve-SIInstallRing:
|      1. the ring the writer was GIVEN (-Ring on the command line; the ring the updater resolved)   source 'parameter' / 'updater'
|      2. the admin's setting SI_UpdateRing (0-3) in the Pro database, else in the configuration       source 'setting'
|      3. the ring in the install's resource-group name (rg-si-r1-pro-ca = 1; rg-si-prod-... = 3)     source 'resource-group'
|    Source 3 is derived, so it never replaces a row that is already there; 1 and 2 always write.
|
|    The web app's header reads, in order: the updater's state (UpdateState) > this row > the setting.
|
|    Rings are the framework's: 0 dev, 1 internal, 2 design partners / early release, 3 broad.
|    Everything here is PURE except Save-SIInstallRing / Read-SIInstallRing / Read-SIUpdateRingSetting, which go through
|    the store seam ($Store.Invoke(sql, params, mode)) the rest of the Pro code uses. Never writes outside cfg.InstallState.
|    Windows PowerShell 5.1 and PowerShell 7.
|#>
|
|$script:SIInstallRingStateName = 'Ring'
|$script:SIUpdateRingSettingName = 'SI_UpdateRing'
|$script:SIInstallRingSources = @('parameter', 'updater', 'setting', 'resource-group')
|
|function ConvertTo-SIUpdateRing {
|    <#
|        PURE. A ring in any of the forms the product uses -> 0..3, or $null when it is not one.
|        0..3 (number or text), 'r0'..'r3', 'ring 1', and the setup naming's 'prod' (a production install = 3, broad).
|    #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [bool]) { return $null }
|    $t = ("$Value").Trim().ToLowerInvariant()
|    if (-not $t) { return $null }
|    if ($t -eq 'prod') { return 3 }
|    $t = $t -replace '^(ring\s*|r)', ''
|    $n = 0
|    if (-not [int]::TryParse($t, [System.Globalization.NumberStyles]::Integer, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$n)) { return $null }
|    if ($n -lt 0 -or $n -gt 3) { return $null }
|    [int]$n
|}
|
|function Get-SIRingFromResourceGroupName {
|    <# PURE. The ring in a resource group named by setup's pattern (rg-si-<r0|r1|r2|prod>-<edition>-<hosting>), else $null. #>
|    param([AllowNull()][AllowEmptyString()][string]$ResourceGroupName)
|    if ("$ResourceGroupName" -cmatch '^rg-si-(r0|r1|r2|prod)-(community|pro)-(ca|vm)(-[a-z0-9][a-z0-9-]*)?$') { return (ConvertTo-SIUpdateRing $Matches[1]) }
|    $null
|}
|
|function Resolve-SIInstallRing {
|    <#
|        PURE. Which ring a writer records, and why. -Ring = the ring the writer was given (a parameter, or the ring the
|        updater resolved; -RingSource says which); -Setting = SI_UpdateRing; -ResourceGroupName = the install's resource
|        group. Returns @{ Ring; Source; Weak; Problems } -- Ring $null = nothing known (write nothing).
|    #>
|    param([AllowNull()]$Ring, [ValidateSet('parameter', 'updater')][string]$RingSource = 'parameter', [AllowNull()]$Setting,
|          [AllowNull()][AllowEmptyString()][string]$ResourceGroupName)
|    $problems = New-Object System.Collections.Generic.List[string]
|    $given = ConvertTo-SIUpdateRing $Ring
|    if ($null -ne $Ring -and "$Ring".Trim() -and $null -eq $given) { $problems.Add(("'{0}' is not an update ring (0, 1, 2 or 3)" -f $Ring)) }
|    $set = ConvertTo-SIUpdateRing $Setting
|    if ($null -ne $Setting -and "$Setting".Trim() -and $null -eq $set) { $problems.Add(("the setting {0} = '{1}' is not an update ring (0, 1, 2 or 3) -- ignored" -f $script:SIUpdateRingSettingName, $Setting)) }
|    if ($null -ne $given) { return [pscustomobject]@{ Ring = $given; Source = $RingSource; Weak = $false; Problems = $problems.ToArray() } }
|    if ($null -ne $set) { return [pscustomobject]@{ Ring = $set; Source = 'setting'; Weak = $false; Problems = $problems.ToArray() } }
|    $rg = Get-SIRingFromResourceGroupName -ResourceGroupName $ResourceGroupName
|    if ($null -ne $rg) { return [pscustomobject]@{ Ring = $rg; Source = 'resource-group'; Weak = $true; Problems = $problems.ToArray() } }
|    [pscustomobject]@{ Ring = $null; Source = ''; Weak = $false; Problems = $problems.ToArray() }
|}
|
|function ConvertTo-SIInstallRingJson {
|    <# PURE. The row's value: compact JSON { ring, channel, setBy, source, setAt } (cfg.InstallState.Value is NVARCHAR(400)). #>
|    param([Parameter(Mandatory)][int]$Ring, [string]$Channel = '', [Parameter(Mandatory)][string]$SetBy, [string]$Source = '',
|          [Parameter(Mandatory)][datetime]$NowUtc)
|    $cut = { param($t, $n) $t = ("$t").Trim(); if ($t.Length -gt $n) { $t.Substring(0, $n) } else { $t } }
|    $o = [ordered]@{
|        ring    = $Ring
|        channel = (& $cut $Channel 40)
|        setBy   = (& $cut $SetBy 80)
|        source  = (& $cut $Source 40)
|        setAt   = $NowUtc.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture)
|    }
|    $o | ConvertTo-Json -Compress
|}
|
|function ConvertFrom-SIInstallRingJson {
|    <# PURE. The row's value -> @{ Ring; Channel; SetBy; Source; SetAt }, or $null when it holds no usable ring. #>
|    param([AllowNull()][AllowEmptyString()][string]$Json)
|    if ([string]::IsNullOrWhiteSpace($Json)) { return $null }
|    try { $o = $Json | ConvertFrom-Json -ErrorAction Stop } catch { return $null }
|    if (-not $o -or -not $o.PSObject.Properties['ring']) { return $null }
|    $r = ConvertTo-SIUpdateRing $o.ring
|    if ($null -eq $r) { return $null }
|    # (PowerShell 7's ConvertFrom-Json turns an ISO time into a [datetime]: written back in the same ISO form)
|    $p = { param($n) if ($o.PSObject.Properties[$n] -and $null -ne $o.$n) { $v = $o.$n; if ($v -is [datetime]) { $v.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture) } else { "$v" } } else { '' } }
|    [pscustomobject]@{ Ring = $r; Channel = (& $p 'channel'); SetBy = (& $p 'setBy'); Source = (& $p 'source'); SetAt = (& $p 'setAt') }
|}
|
|function Get-SIInstallRingSql {
|    <#
|        The upsert. @Weak = 1 (a ring derived from a name) never replaces a row that is already there. Returns one row:
|        Written 1 / 0. Without cfg.InstallState (a database setup has not created yet) nothing is written (Written 0, NoTable 1).
|    #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID('cfg.InstallState') IS NULL
|    SELECT CAST(0 AS int) AS Written, CAST(1 AS int) AS NoTable;
|ELSE
|BEGIN
|    SET XACT_ABORT ON;
|    BEGIN TRAN;
|    DECLARE @written int = 0;
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @Name)
|    BEGIN
|        IF @Weak = 0
|        BEGIN
|            UPDATE cfg.InstallState SET Value = @Value, [Version] = NULL, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @Name;
|            SET @written = 1;
|        END
|    END
|    ELSE
|    BEGIN
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@Name, @Value, NULL, @By);
|        SET @written = 1;
|    END
|    COMMIT;
|    SELECT @written AS Written, CAST(0 AS int) AS NoTable;
|END
|'@
|}
|
|function Save-SIInstallRing {
|    <#
|        Writes the row. Returns @{ Written; Ring; Reason }. Throws only on a database error (the callers decide whether that
|        stops them -- every caller in the product treats it as a warning).
|    #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][int]$Ring, [string]$Channel = '', [Parameter(Mandatory)][string]$SetBy,
|          [string]$Source = '', [switch]$Weak, [datetime]$NowUtc = [datetime]::UtcNow)
|    if ($Ring -lt 0 -or $Ring -gt 3) { throw ("{0} is not an update ring (0, 1, 2 or 3)" -f $Ring) }
|    $json = ConvertTo-SIInstallRingJson -Ring $Ring -Channel $Channel -SetBy $SetBy -Source $Source -NowUtc $NowUtc
|    $rows = @(& $Store.Invoke (Get-SIInstallRingSql) ([ordered]@{ Name = $script:SIInstallRingStateName; Value = $json; By = $SetBy; Weak = $(if ($Weak) { 1 } else { 0 }) }) 'reader' | ForEach-Object { $_ })
|    $row = $rows | Select-Object -First 1
|    $get = { param($n) if ($row -is [System.Collections.IDictionary]) { $row[$n] } elseif ($row) { $row.$n } else { $null } }
|    if ($row -and [int](& $get 'NoTable') -eq 1) { return [pscustomobject]@{ Written = $false; Ring = $Ring; Reason = 'the Pro database has no cfg.InstallState yet (run setup first) -- nothing recorded' } }
|    if ($row -and [int](& $get 'Written') -eq 1) { return [pscustomobject]@{ Written = $true; Ring = $Ring; Reason = ('ring {0} recorded for this install ({1})' -f $Ring, $(if ($Source) { $Source } else { $SetBy })) } }
|    [pscustomobject]@{ Written = $false; Ring = $Ring; Reason = ('a ring is recorded already -- ring {0} from the resource-group name does not replace it' -f $Ring) }
|}
|
|function Read-SIInstallRing {
|    <# The recorded row (ConvertFrom-SIInstallRingJson), or $null. #>
|    param([Parameter(Mandatory)]$Store)
|    $rows = @(& $Store.Invoke "IF OBJECT_ID('cfg.InstallState') IS NOT NULL SELECT Value FROM cfg.InstallState WHERE Name = @Name" ([ordered]@{ Name = $script:SIInstallRingStateName }) 'reader' | ForEach-Object { $_ })
|    $row = $rows | Select-Object -First 1
|    if (-not $row) { return $null }
|    ConvertFrom-SIInstallRingJson ([string]$(if ($row -is [System.Collections.IDictionary]) { $row['Value'] } else { $row.Value }))
|}
|
|function Read-SIUpdateRingSetting {
|    <# The admin's SI_UpdateRing at solution scope in the Pro database (0..3), or $null (not set, not a ring, or no table). #>
|    param([Parameter(Mandatory)]$Store)
|    $rows = @(& $Store.Invoke "IF OBJECT_ID('cfg.Setting') IS NOT NULL SELECT ValueJson FROM cfg.Setting WHERE Name = @Name AND Scope = N'solution'" ([ordered]@{ Name = $script:SIUpdateRingSettingName }) 'reader' | ForEach-Object { $_ })
|    $row = $rows | Select-Object -First 1
|    if (-not $row) { return $null }
|    $j = [string]$(if ($row -is [System.Collections.IDictionary]) { $row['ValueJson'] } else { $row.ValueJson })
|    if (-not $j) { return $null }
|    try { $v = $j | ConvertFrom-Json -ErrorAction Stop } catch { $v = $j }
|    ConvertTo-SIUpdateRing $v
|}
|
|function Invoke-SIRecordInstallRing {
|    <#
|        The one entry every writer calls: resolve the ring (Resolve-SIInstallRing; the database setting first, else
|        -ConfigSetting = $global:SI_UpdateRing from the configuration), record it, say what happened. NEVER throws:
|        returns @{ Written; Ring; Source; Reason; Problems }.
|    #>
|    param([Parameter(Mandatory)]$Store, [AllowNull()]$Ring, [ValidateSet('parameter', 'updater')][string]$RingSource = 'parameter',
|          [AllowNull()]$ConfigSetting, [AllowNull()][AllowEmptyString()][string]$ResourceGroupName, [string]$Channel = '',
|          [Parameter(Mandatory)][string]$SetBy, [datetime]$NowUtc = [datetime]::UtcNow)
|    $out = [pscustomobject]@{ Written = $false; Ring = $null; Source = ''; Reason = ''; Problems = @() }
|    try {
|        $setting = $null
|        try { $setting = Read-SIUpdateRingSetting -Store $Store } catch { $setting = $null }
|        if ($null -eq $setting) { $setting = $ConfigSetting }
|        $r = Resolve-SIInstallRing -Ring $Ring -RingSource $RingSource -Setting $setting -ResourceGroupName $ResourceGroupName
|        $out.Problems = $r.Problems; $out.Source = $r.Source; $out.Ring = $r.Ring
|        if ($null -eq $r.Ring) {
|            $out.Reason = ("no update ring is known here -- set {0} (0-3) on the Settings page, or run setup\Set-SIInstallRing.ps1 -Ring <0-3>" -f $script:SIUpdateRingSettingName)
|            return $out
|        }
|        $s = Save-SIInstallRing -Store $Store -Ring $r.Ring -Channel $Channel -SetBy $SetBy -Source $r.Source -Weak:([bool]$r.Weak) -NowUtc $NowUtc
|        $out.Written = $s.Written; $out.Reason = $s.Reason
|    } catch {
|        $out.Reason = ('the update ring could not be recorded: {0}' -f $_.Exception.Message)
|    }
|    $out
|}
|
|# The ring a status report carries is resolved in engine\_shared\SI-ReportedRing.ps1 (shipped in both editions);
|# this Pro file only reads the two rows it is resolved from.
|function Read-SIInstallRingFacts {
|    <#
|        The cfg.InstallState rows the reported ring is read from ('UpdateState' and 'Ring') -- plus the install's own links
|        ('Endpoints', framework §8.4, recorded by the updater for the identified heartbeat) -- in ONE query on a store the
|        caller already opened (the Pro settings layer at run start). Returns @{ UpdateState; Ring; Endpoints } (JSON text,
|        '' when absent) -- and InvardiaEnvironment (#710: the environment id Invardia's answer named, for the customer
|        mail's portal link). NEVER THROWS: a failed read leaves all empty -- the ring then falls back to the setting.
|    #>
|    param([Parameter(Mandatory)]$Store)
|    $out = [pscustomobject]@{ UpdateState = ''; Ring = ''; Endpoints = ''; PipelineSchedule = ''; SecretHandover = ''; InvardiaEnvironment = '' }
|    try {
|        $rows = @(& $Store.Invoke "IF OBJECT_ID('cfg.InstallState') IS NOT NULL SELECT Name, Value FROM cfg.InstallState WHERE Name IN (N'UpdateState', N'Ring', N'Endpoints', N'PipelineSchedule', N'SecretHandover', N'InvardiaEnvironment')" @{} 'reader' | ForEach-Object { $_ })
|        foreach ($row in $rows) {
|            if (-not $row) { continue }
|            $get = { param($n) if ($row -is [System.Collections.IDictionary]) { if ($row.Contains($n)) { $row[$n] } else { $null } } elseif ($row.PSObject.Properties[$n]) { $row.$n } else { $null } }
|            $n = [string](& $get 'Name'); $v = & $get 'Value'
|            if ($null -eq $v -or $v -is [System.DBNull]) { continue }
|            if ($n -eq 'UpdateState') { $out.UpdateState = [string]$v } elseif ($n -eq 'PipelineSchedule') { $out.PipelineSchedule = [string]$v } elseif ($n -eq 'SecretHandover') { $out.SecretHandover = [string]$v } elseif ($n -eq 'Endpoints') { $out.Endpoints = [string]$v } elseif ($n -eq 'InvardiaEnvironment') { $out.InvardiaEnvironment = [string]$v } elseif ($n -eq $script:SIInstallRingStateName) { $out.Ring = [string]$v }
|        }
|    } catch { }
|    $out
|}
'@ }
$__siSupportFiles['engine/data-model/identity/SI-ObjectLedgerStore.ps1'] = @{ Sha256 = '8384752e589f2d96c44cb93a4363ee91a047362c8d6dba3ecbe09479b0ba2ae0'; Text = @'
|#Requires -Version 5.1
|<#
|    SI v3 -- the identity ledger's SQL persistence. THIN ON PURPOSE.
|
|    Every decision lives in SI-ObjectIdentity.ps1, which is pure and has 24 tests. This file only moves
|    rows in and out, so the part that can be wrong without a database stays provable without one.
|
|    🔒 ENTRA-ONLY, CERTIFICATE AUTH. The server is created with azureADOnlyAuthentication, so there is
|    no SQL login to leak and no password to store -- matching the connect rules (SPN + certificate,
|    never a secret).
|
|    🔴 DEGRADE LOUDLY, NEVER DIE. If the ledger is unreachable the run still publishes: the map is the
|    customer's output and losing it to protect an id would be the wrong trade. What must NOT happen is
|    silently emitting a derived id that LOOKS durable -- so the rows go out marked
|    `SI_IdSource = derived-provisional`, which is true, and a connector is already forbidden from
|    creating CIs from those. An outage costs a late CI, never a duplicate one.
|#>
|
|# The rule for an identifier value longer than the table's column (ConvertTo-SILedgerStoredValue) lives with the pure
|# ledger functions; this file writes and looks up every value through it.
|if (-not (Get-Command -Name ConvertTo-SILedgerStoredValue -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-ObjectIdentity.ps1') }
|
|function Assert-SILedgerRowsFit {
|    <#
|        PURE. Refuses, BEFORE anything is written, a ledger row the table cannot hold -- in a moment, not after minutes of
|        writes that are then undone (2026-10-12: 18,820 anchors written for 10 minutes and all of them lost to one value).
|        -Rows: @{ Type; Value (as stored); CorrelationId }. The value's own length cannot fail any more (the short form
|        of a long value always fits); the type and the id are checked all the same. Throws with the first row that does
|        not fit and how many there are.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @())
|    $bad = 0; $first = ''
|    foreach ($r in $Rows) {
|        if ($null -eq $r) { continue }
|        $why = ''
|        if (([string]$r.Value).Length -gt 256) { $why = 'its value is {0} characters long (the most is 256)' -f ([string]$r.Value).Length }
|        elseif (([string]$r.Type).Length -gt 64) { $why = 'its type name is {0} characters long (the most is 64)' -f ([string]$r.Type).Length }
|        elseif (([string]$r.CorrelationId).Length -gt 64) { $why = 'its id is {0} characters long (the most is 64)' -f ([string]$r.CorrelationId).Length }
|        if ($why) { $bad++; if (-not $first) { $v = [string]$r.Value; if ($v.Length -gt 80) { $v = $v.Substring(0, 80) + '...' }; $first = "identifier '{0}' = '{1}': {2}" -f [string]$r.Type, $v, $why } }
|    }
|    if ($bad -gt 0) { throw ("the identity ledger cannot hold {0} identifier(s) of this run, so nothing was written to it (first: {1})" -f $bad, $first) }
|}
|
|function Get-SILedgerCertificate {
|    <#
|        The engine SPN's certificate, found WITHOUT depending on the `Cert:` provider.
|
|        🔑 The provider is not always there. A Windows PowerShell 5.1 child that inherits a pwsh 7
|        parent's PSModulePath resolves Microsoft.PowerShell.Security to the PS7 build, fails to load it,
|        and loses the `Cert:` drive with it -- so `Get-ChildItem Cert:\...` returns nothing for a
|        certificate that is installed and readable. That is framework finding AUTH-1, and this file had
|        its own copy of the same lookup. X509Store exists on both hosts, so the provider is the
|        convenience and the store is the authority.
|    #>
|    param([Parameter(Mandatory)][string]$Thumbprint)
|
|    $t = ($Thumbprint -replace '\s', '').ToUpperInvariant()
|    if ([string]::IsNullOrWhiteSpace($t)) { return $null }
|
|    foreach ($loc in 'LocalMachine', 'CurrentUser') {
|        $found = $null
|        if (Get-PSDrive -Name Cert -ErrorAction SilentlyContinue) {
|            $found = Get-ChildItem "Cert:\$loc\My" -ErrorAction SilentlyContinue |
|                     Where-Object { $_.Thumbprint -eq $t -and $_.HasPrivateKey } | Select-Object -First 1
|        }
|        if (-not $found) {
|            try {
|                $store = New-Object System.Security.Cryptography.X509Certificates.X509Store('My', $loc)
|                $store.Open('ReadOnly')
|                $found = @($store.Certificates | Where-Object { $_.Thumbprint -eq $t -and $_.HasPrivateKey })[0]
|                $store.Close()
|            } catch {
|                Write-Verbose ("ledger: X509Store {0}\My unreadable -- {1}" -f $loc, $_.Exception.Message)
|            }
|        }
|        if ($found) { return $found }
|    }
|    return $null
|}
|
|function Get-SILedgerAccessToken {
|    <#
|        A database.windows.net access token for the engine SPN, via a certificate-signed client
|        assertion.
|
|        🔴 MSAL IS DELIBERATELY NOT USED, and this is the whole point of the function.
|        `[Microsoft.Identity.Client.ConfidentialClientApplicationBuilder]` resolves under Windows
|        PowerShell 5.1, because Az.Accounts loads MSAL into the default context there. Under pwsh 7
|        Az.Accounts isolates its assemblies in a private load context, so the type does not exist and
|        the call throws "Unable to find type". Measured on one machine within the same minute:
|        5.1 -> ledger works, pwsh 7 -> ledger unavailable, publishing provisional ids.
|        🔑 That mattered because the VisualCron nightly runs every SI launcher under **pwsh 7**, so the
|        one host the schedule actually uses was the one host where durable ids silently stopped.
|        A signed assertion needs only System.Security and an HTTPS POST, which behave identically on
|        both hosts and cannot be disabled by someone else's module loading strategy.
|    #>
|    param(
|        [Parameter(Mandatory)][System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate,
|        [Parameter(Mandatory)][string]$AppId,
|        [Parameter(Mandatory)][string]$TenantId,
|        [string]$Scope = 'https://database.windows.net/.default'
|    )
|
|    # PS 5.1 defaults to TLS 1.0/1.1 on some hosts; the token endpoint requires 1.2+.
|    try {
|        if (([Net.ServicePointManager]::SecurityProtocol -band [Net.SecurityProtocolType]::Tls12) -ne [Net.SecurityProtocolType]::Tls12) {
|            [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
|        }
|    } catch { }
|
|    $b64url = {
|        param([byte[]]$Bytes)
|        [Convert]::ToBase64String($Bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_')
|    }
|
|    $tokenUri = "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token"
|    $now      = [DateTimeOffset]::UtcNow.ToUnixTimeSeconds()
|
|    $header  = @{ alg = 'RS256'; typ = 'JWT'; x5t = (& $b64url $Certificate.GetCertHash()) } | ConvertTo-Json -Compress
|    $payload = @{ aud = $tokenUri; iss = $AppId; sub = $AppId; jti = [guid]::NewGuid().ToString()
|                  nbf = $now; exp = ($now + 600) } | ConvertTo-Json -Compress
|
|    $unsigned = (& $b64url ([Text.Encoding]::UTF8.GetBytes($header))) + '.' +
|                (& $b64url ([Text.Encoding]::UTF8.GetBytes($payload)))
|
|    $rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($Certificate)
|    if (-not $rsa) { throw ("ledger: certificate {0} has no usable RSA private key." -f $Certificate.Thumbprint) }
|    $sig = & $b64url ($rsa.SignData([Text.Encoding]::UTF8.GetBytes($unsigned),
|                                    [Security.Cryptography.HashAlgorithmName]::SHA256,
|                                    [Security.Cryptography.RSASignaturePadding]::Pkcs1))
|
|    # a time limit: without one this call waits for as long as the other side stays silent (PowerShell 7 has no default)
|    $resp = Invoke-RestMethod -Method Post -Uri $tokenUri -TimeoutSec 60 -Body @{
|        client_id             = $AppId
|        scope                 = $Scope
|        client_assertion_type = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
|        client_assertion      = "$unsigned.$sig"
|        grant_type            = 'client_credentials'
|    }
|    if (-not $resp.access_token) { throw 'ledger: token endpoint returned no access_token.' }
|    [string]$resp.access_token
|}
|
|# Test-SISqlTransientError: the shared SQL retry (engine\_shared\SI-SqlRetry.ps1) -- one list of transient Azure SQL faults
|. ([IO.Path]::Combine($PSScriptRoot, '..', '..', '_shared', 'SI-SqlRetry.ps1'))
|
|function Get-SIObjectLedgerConnection {
|    <#
|        A SqlConnection authenticated as the engine SPN with its certificate.
|        Returns $null when the ledger is not configured -- which is the normal state until an operator
|        points SI at a store, and must not be an error.
|    #>
|    param(
|        [Parameter()][string]$Server   = [string]$global:SI_LedgerSqlServer,
|        [Parameter()][string]$Database = [string]$global:SI_LedgerDatabase,
|        [int]$MaxAttempts = 4
|    )
|    if ([string]::IsNullOrWhiteSpace($Server) -or [string]::IsNullOrWhiteSpace($Database)) { return $null }
|
|    if ((Get-Command -Name Test-SIUseManagedIdentity -ErrorAction SilentlyContinue) -and (Test-SIUseManagedIdentity)) {
|        # #209: a container job signing in as its managed identity. Its database user is created once by the
|        # operator (CREATE USER [<identity name>] FROM EXTERNAL PROVIDER) -- setup prints that step.
|        $token = Get-SIManagedIdentityToken -Resource 'https://database.windows.net/'
|    } else {
|        $thumb  = [string]$global:SI_SPN_CertThumbprint
|        $appId  = [string]$global:SI_SPN_AppId
|        $tenant = [string]$global:SI_SPN_TenantId
|        if ([string]::IsNullOrWhiteSpace($thumb) -or [string]::IsNullOrWhiteSpace($appId)) {
|            throw 'ledger: SI_SPN_AppId / SI_SPN_CertThumbprint are empty -- the engine bridges these from HighPriv_Modern_* at entry; if they are missing here that bridge did not run.'
|        }
|
|        $cert = Get-SILedgerCertificate -Thumbprint $thumb
|        if (-not $cert) { throw ("ledger: certificate {0} not found with a private key in LocalMachine\My or CurrentUser\My (checked via the Cert: drive AND X509Store)." -f $thumb) }
|
|        $token = Get-SILedgerAccessToken -Certificate $cert -AppId $appId -TenantId $tenant
|    }
|
|    # The database is provisioned to RUN CONTINUOUSLY (no auto-pause), so a cold-start resume is not
|    # the expected path any more. The retry stays because Azure SQL is a shared service that can still
|    # throttle or fail over, and because a single attempt against ANY managed database is a coin flip.
|    # It is bounded and only covers the named transient codes -- see Test-SISqlTransientError.
|    $delay = 5
|    for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
|        $conn = New-Object System.Data.SqlClient.SqlConnection
|        $conn.ConnectionString = "Server=tcp:$Server,1433;Database=$Database;Encrypt=True;TrustServerCertificate=False;Connection Timeout=60;"
|        $conn.AccessToken = $token
|        try {
|            $conn.Open()
|            if ($attempt -gt 1) { Write-Warning ("ledger connected on attempt {0} of {1}" -f $attempt, $MaxAttempts) }
|            return $conn
|        } catch {
|            try { $conn.Dispose() } catch { }
|            $isTransient = Test-SISqlTransientError -ErrorRecord $_
|            if (-not $isTransient -or $attempt -eq $MaxAttempts) { throw }
|            # Write-Warning, not the engine's Write-Corr* helpers: those are defined in the CALLER, so a
|            # test dot-sourcing this file on its own would fail inside the retry -- the one path that
|            # must not add a second failure to the one it is recovering from.
|            Write-Warning ("ledger connect attempt {0}/{1} hit a transient fault ({2}); retrying in {3}s" -f `
|                            $attempt, $MaxAttempts, $_.Exception.Message.Split([char]10)[0].Trim(), $delay)
|            Start-Sleep -Seconds $delay
|            $delay = [Math]::Min($delay * 2, 40)
|        }
|    }
|}
|
|function Get-SIObjectLedger {
|    <#
|        The whole ledger as the hashtable Resolve-SIObjectIdentity expects:
|        "type|value" -> @{ CorrelationId; FirstSeen }.
|
|        Read whole rather than queried per anchor: a run resolves every object at once, and one round
|        trip against a table of this shape beats thousands. Revisit only if a real estate makes it hurt
|        -- not before, and with a measurement.
|    #>
|    param([Parameter()]$Connection)
|    $ledger = @{}
|    if ($null -eq $Connection) { return $ledger }
|
|    $cmd = $Connection.CreateCommand()
|    $cmd.CommandTimeout = 0
|    $cmd.CommandText = 'SELECT IdentifierType, IdentifierValue, SI_CorrelationId, FirstSeen FROM si.ObjectIdentity'
|    $rdr = $cmd.ExecuteReader()
|    try {
|        while ($rdr.Read()) {
|            $k = '{0}|{1}' -f ([string]$rdr['IdentifierType']).ToLowerInvariant(), ([string]$rdr['IdentifierValue']).ToLowerInvariant()
|            $ledger[$k] = @{ CorrelationId = [string]$rdr['SI_CorrelationId']; FirstSeen = [datetime]$rdr['FirstSeen'] }
|        }
|    } finally { $rdr.Close() }
|    $ledger
|}
|
|function Save-SIObjectLedger {
|    <#
|        Persist one run's decisions: new anchors, and any merge supersessions.
|
|        🔒 ONE TRANSACTION. A half-written merge is the worst possible state -- anchors re-pointed at a
|        survivor while the superseded row is missing means the connector never learns old -> new and
|        orphans a CI, which is precisely the failure the ledger exists to prevent. All or nothing.
|
|        Anchors are UPSERTed by (type, value), never blind-inserted: an anchor already present under
|        the same id is the normal case on every run after the first, and must be a no-op rather than a
|        primary-key violation.
|    #>
|    param(
|        [Parameter(Mandatory)]$Connection,
|        [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Decisions,
|        [Parameter()][AllowEmptyCollection()][object[]]$Superseded,
|        [Parameter()][datetime]$Now = ([datetime]::UtcNow)
|    )
|
|    # EVERY ROW IS MADE READY AND CHECKED BEFORE THE FIRST ONE IS WRITTEN: a value longer than the column goes in as its
|    # short form (ConvertTo-SILedgerStoredValue), and a row the table cannot hold is refused here, in a moment -- not by
|    # the database after minutes of writes that are then all undone.
|    $anchors = New-Object System.Collections.Generic.List[object]
|    foreach ($d in @($Decisions)) {
|        if ($null -eq $d -or [string]::IsNullOrWhiteSpace([string]$d.CorrelationId)) { continue }
|        foreach ($n in @($d.NewIdentifiers)) {
|            if ($null -eq $n) { continue }
|            $anchors.Add([pscustomobject]@{ Type = [string]$n.Type; Value = (ConvertTo-SILedgerStoredValue -Value ([string]$n.Value)); CorrelationId = [string]$n.CorrelationId })
|        }
|    }
|    Assert-SILedgerRowsFit -Rows $anchors.ToArray()
|
|    # 🔑 ONE STATEMENT, not one round trip per anchor (2026-10-16, #605: a first run or a rebuild writes tens of thousands of
|    # anchors, one MERGE each). The same rows land: an anchor written twice in one run keeps its LAST id (what the MERGEs
|    # in order left), a supersession written twice keeps its FIRST new id (what 'insert when not there' left) -- decided
|    # here, so the statement sees each key once. The same time: the run's time as the database stores a datetime
|    # parameter. Still ONE transaction (Get-SIObjectLedgerSetSql), all or nothing.
|    $byKey = New-Object 'System.Collections.Generic.Dictionary[string,object]' ([StringComparer]::OrdinalIgnoreCase)
|    $order = New-Object System.Collections.Generic.List[string]
|    foreach ($n in $anchors) {
|        $k = $n.Type + '|' + $n.Value
|        if (-not $byKey.ContainsKey($k)) { $order.Add($k) }
|        $byKey[$k] = $n
|    }
|    $a = @(foreach ($k in $order) { $n = $byKey[$k]; [ordered]@{ ty = [string]$n.Type; va = [string]$n.Value; cid = [string]$n.CorrelationId } })
|    $seenOld = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $s = @(foreach ($x in @($Superseded)) { if ($null -ne $x -and $seenOld.Add([string]$x.OldId)) { [ordered]@{ o = [string]$x.OldId; n = [string]$x.NewId } } })
|    $nowText = ([System.Data.SqlTypes.SqlDateTime]$Now).Value.ToString('o')
|    $p = @{ a = (ConvertTo-SILedgerJsonArray $a); s = (ConvertTo-SILedgerJsonArray $s); nowText = $nowText }
|    $null = @(Invoke-SIObjectLedgerSql -Connection $Connection -Sql (Get-SIObjectLedgerSetSql) -Params $p)
|    # the counts as before: every anchor and every supersession of the run's decisions
|    [pscustomobject]@{ AnchorsWritten = $anchors.Count; SupersededWritten = @(@($Superseded) | Where-Object { $null -ne $_ }).Count }
|}
|function Get-SIObjectLedgerSubsetSql {
|    <# The ledger rows of the given identifiers (@j = [{ t; v }]) and every row of the ids they point at. #>
|    @'
|SET NOCOUNT ON;
|DECLARE @k TABLE (IdentifierType NVARCHAR(64), IdentifierValue NVARCHAR(450), PRIMARY KEY (IdentifierType, IdentifierValue));
|INSERT @k SELECT DISTINCT t, v FROM OPENJSON(@j) WITH (t NVARCHAR(64), v NVARCHAR(450)) WHERE t IS NOT NULL AND v IS NOT NULL;
|WITH hit AS (SELECT o.SI_CorrelationId FROM si.ObjectIdentity o JOIN @k k ON o.IdentifierType = k.IdentifierType AND o.IdentifierValue = k.IdentifierValue)
|SELECT o.IdentifierType, o.IdentifierValue, o.SI_CorrelationId, o.FirstSeen FROM si.ObjectIdentity o
|WHERE o.SI_CorrelationId IN (SELECT SI_CorrelationId FROM hit);
|'@
|}
|
|function Invoke-SIObjectLedgerSql {
|    <# One statement on the ledger's open connection -> rows (objects). The seam both ledger functions below use. #>
|    param([Parameter(Mandatory)]$Connection, [Parameter(Mandatory)][string]$Sql, [hashtable]$Params = @{})
|    $cmd = $Connection.CreateCommand(); $cmd.CommandTimeout = 0; $cmd.CommandText = $Sql
|    foreach ($k in $Params.Keys) { $pp = $cmd.Parameters.Add('@' + $k, [System.Data.SqlDbType]::NVarChar, -1); $pp.Value = [string]$Params[$k] }
|    $rdr = $cmd.ExecuteReader()
|    try {
|        $names = @(for ($i = 0; $i -lt $rdr.FieldCount; $i++) { $rdr.GetName($i) })
|        while ($rdr.Read()) {
|            $o = [ordered]@{}
|            for ($i = 0; $i -lt $names.Count; $i++) { $v = $rdr.GetValue($i); if ($v -is [System.DBNull]) { $v = $null }; $o[$names[$i]] = $v }
|            [pscustomobject]$o
|        }
|    } finally { $rdr.Close() }
|}
|
|function ConvertTo-SILedgerJsonArray {
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Items)
|    if ($null -eq $Items -or @($Items).Count -eq 0) { return '[]' }
|    $j = ConvertTo-Json -InputObject @($Items) -Compress -Depth 3
|    if ($j.TrimStart().StartsWith('[')) { $j } else { '[' + $j + ']' }
|}
|
|function Get-SIObjectLedgerSubset {
|    <#
|        #477 / #501: the part of the ledger ONE batch of CIs needs, not the whole map -- the rows of the batch's identifiers
|        and every row of the ids those point at (Resolve-SIObjectIdentity reports an id's anchors that did not appear).
|        -Keys: @{ Type; Value } (canonical type). Same hashtable shape as Get-SIObjectLedger.
|        -Invoke { param($Sql, $Params, $Mode) } is the seam (tests); default = the connection.
|    #>
|    param([Parameter()]$Connection, [AllowEmptyCollection()][object[]]$Keys = @(), [scriptblock]$Invoke)
|    $ledger = @{}
|    if (@($Keys).Count -eq 0) { return $ledger }
|    # asked for as the table holds it: a value longer than the column under its short form (ConvertTo-SILedgerStoredValue).
|    # The rows come back under that short form too, and Resolve-SIObjectIdentity finds them (Get-SILedgerEntryKey).
|    $items = @(foreach ($k in $Keys) { [ordered]@{ t = [string]$k.Type; v = (ConvertTo-SILedgerStoredValue -Value ([string]$k.Value).ToLowerInvariant()) } })
|    $p = @{ j = (ConvertTo-SILedgerJsonArray $items) }
|    if ($Invoke) { $rows = @(& $Invoke (Get-SIObjectLedgerSubsetSql) $p 'rows') }
|    else { $rows = @(Invoke-SIObjectLedgerSql -Connection $Connection -Sql (Get-SIObjectLedgerSubsetSql) -Params $p) }
|    foreach ($r in $rows) {
|        if ($null -eq $r) { continue }
|        $k = '{0}|{1}' -f ([string]$r.IdentifierType).ToLowerInvariant(), ([string]$r.IdentifierValue).ToLowerInvariant()
|        $ledger[$k] = @{ CorrelationId = [string]$r.SI_CorrelationId; FirstSeen = [datetime]$r.FirstSeen }
|    }
|    $ledger
|}
|
|function Get-SIObjectLedgerSetSql {
|    <#
|        #501: one batch's ledger changes in ONE statement and ONE transaction (Save-SIObjectLedger sends one MERGE per
|        identifier -- a first run of a 100,000-record tenant is hundreds of thousands of round trips). The same rule:
|        anchors upserted by (type, value), a supersession written once per old id. @a = anchors, @s = supersessions.
|    #>
|    @'
|SET NOCOUNT ON;
|SET XACT_ABORT ON;
|DECLARE @now DATETIME2(3) = ISNULL(TRY_CONVERT(DATETIME2(3), @nowText, 127), SYSUTCDATETIME());
|DECLARE @x TABLE (IdentifierType NVARCHAR(64), IdentifierValue NVARCHAR(450), SI_CorrelationId NVARCHAR(64), PRIMARY KEY (IdentifierType, IdentifierValue));
|INSERT @x SELECT ty, va, MAX(cid) FROM OPENJSON(@a) WITH (ty NVARCHAR(64), va NVARCHAR(450), cid NVARCHAR(64))
|WHERE ty IS NOT NULL AND va IS NOT NULL AND cid IS NOT NULL GROUP BY ty, va;
|BEGIN TRANSACTION;
|MERGE si.ObjectIdentity AS t USING @x AS s
|   ON t.IdentifierType = s.IdentifierType AND t.IdentifierValue = s.IdentifierValue
|WHEN MATCHED THEN UPDATE SET SI_CorrelationId = s.SI_CorrelationId, LastSeen = @now
|WHEN NOT MATCHED THEN INSERT (IdentifierType, IdentifierValue, SI_CorrelationId, FirstSeen, LastSeen)
|     VALUES (s.IdentifierType, s.IdentifierValue, s.SI_CorrelationId, @now, @now);
|DECLARE @anchors INT = @@ROWCOUNT;
|INSERT INTO si.ObjectIdentitySuperseded (OldId, NewId, SupersededAt, Reason)
|SELECT s.o, MAX(s.n), @now, N'merge: anchors resolved to two ids' FROM OPENJSON(@s) WITH (o NVARCHAR(64), n NVARCHAR(64)) s
|WHERE s.o IS NOT NULL AND NOT EXISTS (SELECT 1 FROM si.ObjectIdentitySuperseded x WHERE x.OldId = s.o) GROUP BY s.o;
|DECLARE @sup INT = @@ROWCOUNT;
|COMMIT TRANSACTION;
|SELECT @anchors AS AnchorsWritten, @sup AS SupersededWritten;
|'@
|}
|
|function Save-SIObjectLedgerSet {
|    <# Persist one batch's decisions set-based (Get-SIObjectLedgerSetSql). -Invoke is the seam (tests). #>
|    param([Parameter()]$Connection, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Decisions, [AllowEmptyCollection()][object[]]$Superseded = @(),
|          [datetime]$Now = [datetime]::UtcNow, [scriptblock]$Invoke)
|    $a = New-Object System.Collections.Generic.List[object]
|    foreach ($d in @($Decisions)) {
|        if ($null -eq $d -or [string]::IsNullOrWhiteSpace([string]$d.CorrelationId)) { continue }
|        # a value longer than the column goes in as its short form (ConvertTo-SILedgerStoredValue) -- the statement would
|        # otherwise drop it without a word (over 450 characters) or fail the whole batch (257 to 450)
|        foreach ($n in @($d.NewIdentifiers)) { if ($n) { $a.Add([ordered]@{ ty = [string]$n.Type; va = (ConvertTo-SILedgerStoredValue -Value ([string]$n.Value)); cid = [string]$n.CorrelationId }) } }
|    }
|    # refused here, before the statement runs, when a row cannot be held at all
|    Assert-SILedgerRowsFit -Rows @(foreach ($x in $a) { [pscustomobject]@{ Type = $x.ty; Value = $x.va; CorrelationId = $x.cid } })
|    $s = @(foreach ($x in @($Superseded)) { if ($x) { [ordered]@{ o = [string]$x.OldId; n = [string]$x.NewId } } })
|    if ($a.Count -eq 0 -and $s.Count -eq 0) { return [pscustomobject]@{ AnchorsWritten = 0; SupersededWritten = 0 } }
|    $p = @{ a = (ConvertTo-SILedgerJsonArray $a.ToArray()); s = (ConvertTo-SILedgerJsonArray $s); nowText = $Now.ToUniversalTime().ToString('o') }
|    if ($Invoke) { $rows = @(& $Invoke (Get-SIObjectLedgerSetSql) $p 'rows') }
|    else { $rows = @(Invoke-SIObjectLedgerSql -Connection $Connection -Sql (Get-SIObjectLedgerSetSql) -Params $p) }
|    if ($rows.Count -gt 0 -and $rows[0]) { return [pscustomobject]@{ AnchorsWritten = [int]$rows[0].AnchorsWritten; SupersededWritten = [int]$rows[0].SupersededWritten } }
|    [pscustomobject]@{ AnchorsWritten = 0; SupersededWritten = 0 }
|}
'@ }
$__siSupportFiles['engine/data-model/identity/SI-ObjectIdentity.ps1'] = @{ Sha256 = 'f561066dbf68d40218839a779da71b4b2e24a1220992d6065afc8f271c56b088'; Text = @'
|#Requires -Version 5.1
|<#
|    SI v3 -- THE IDENTITY LEDGER, as pure functions.
|
|    Operator decision 2026-08-13 (V3-ARCHITECTURE 2.3a): a minted, stored SI_CorrelationId plus an
|    anchor ledger and a superseded table. ANCHORS ARE HOW WE RECOGNISE AN ASSET; THEY ARE NEVER WHAT WE
|    CALL IT.
|
|    🔴 WHY THIS EXISTS, and it is a correctness fix rather than an optimisation.
|    Get-SICorrelationId seeds from the ordinally-lowest value of the highest-priority type PRESENT IN
|    THE GROUP. That is `same INPUT -> same id`, which is NOT what a connector needs -- it needs
|    `same OBJECT -> same id`. The two diverge the moment group membership changes, and membership is not
|    stable:
|
|      * MEASURED 2026-08-13: adding one member carrying a lower-sorting exposure-graph id moved a group
|        from `exposuregraphnodeid:aaa` to `exposuregraphnodeid:000`.
|      * The same day, EndpointEG timed out at 0 rows and 51 assets left the snapshot entirely.
|      * Anchors churn regardless: MDE device ids rotate, a rebuilt VM gets a new ARM path, a re-enrolled
|        device gets a new AadDeviceId. Editing SISeedPriority would re-key the whole estate at once.
|
|    A ServiceNow CI bound to a key that moves becomes a SECOND CI, and duplicate CIs are effectively
|    permanent once incidents point at them.
|
|    🔑 WHY NOT "PICK A DURABLE NATIVE ID AND RE-PICK WHEN IT DIES" -- considered and rejected by the
|    operator. Re-picking IS the orphaning event. Their own example proves anchors die while assets live:
|    decommission AD sync and the SID goes. Everyone who tried natural-key-as-identity built the alias
|    table anyway -- sIDHistory, and Entra Connect keying ms-DS-ConsistencyGuid rather than SID.
|    ServiceNow's own answer is correlation_id PLUS the IRE identification rules.
|
|    PURE ON PURPOSE. No SQL, no I/O. The store is a detail; the DECISIONS are the part worth proving,
|    and they are provable before a schema exists. Same reasoning as SI-CorrelationCore.
|
|    NO Set-StrictMode here -- it leaks into the caller's scope (measured 2026-08-12).
|#>
|
|# Namespace for SI's UUIDv5 derivation. Fixed forever: changing it re-keys every asset in every estate,
|# which is the one thing this file exists to prevent. Chosen once, never generated at runtime.
|$script:SIObjectIdNamespace = [guid]'6b1f4a2e-8c33-5d47-9a10-2f7e5c8d4b91'
|
|# The birth anchor's type priority. The correlation engine (Pro) sets the same list in SI-CorrelationCore.ps1; the CI build
|# runs WITHOUT it in Community (Risk Analysis builds the CIs), where this list was missing and every object minted the
|# same id. Same values -- one list, set here when the correlation engine has not.
|if (-not $script:SISeedPriority) {
|    $script:SISeedPriority = @('ExposureGraphNodeId', 'EgNodeId', 'AzureResourceId', 'AadDeviceId', 'AadObjectId', 'MdeDeviceId',
|        'ActiveDirectoryObjectGuid', 'SecurityIdentifier', 'OnPremObjectGuid', 'AzureVmId')
|}
|
|# #642 THE IDENTIFIER TYPES ONE OBJECT HOLDS EXACTLY ONCE (lower-case canonical type). A service principal has one object id
|# and one app id; an Azure resource is its one resource id; an Exposure Graph node and an AD object guid name one object.
|# Types that legitimately rotate or come in several on one object (a Defender device id after a re-onboarding, an Entra
|# device id after a re-registration, a SID with history) are NOT here -- they never prove two objects apart.
|$script:SIOnePerObjectIdTypes = @('aadobjectid', 'aadappid', 'azureresourceid', 'exposuregraphnodeid', 'activedirectoryobjectguid', 'cloudnativeresourceid')
|
|function Test-SILedgerWrongMerge {
|    <#
|        PURE. #642 IS THIS GROUP PROVABLY ANOTHER OBJECT THAN THE REST OF THE LEDGER ID IT RESOLVED TO?
|
|        Found at a ring 1 install 2026-10-13: one ledger id held 11 different service principals (11 object ids, 11 app ids,
|        11 Exposure Graph nodes, all born in ONE run) -- separate per-subscription service principals with the same display
|        name. An Exposure Graph node matched BY DISPLAY NAME had given every one of them the same node id (Invoke-Collect.ps1,
|        identity EG enrichment), the correlation fused them on it, and the ledger kept the fusion for good: every run after
|        that each service principal resolved to the one id again.
|
|        The proof needs no guess about sources that failed (the reason Resolve-SIObjectIdentity never splits on its own): for
|        TWO OR MORE identifier types an object holds only once ($script:SIOnePerObjectIdTypes), the id holds a value of the
|        group's own type that the group does not carry, and that value was written in the SAME RUN as the group's own value
|        (FirstSeen within one second). One object cannot have two object ids AND two app ids born in the same run; an object
|        whose id rotated over time (a new value in a later run) is never taken for two objects.
|
|        -Ids: the group's identifiers (Type, Value; canonical, lower-cased). -AnchorKeys: the ledger keys of the id (Get-SILedgerKeysOfId).
|        Returns @{ Proven; Types = the conflicting types }.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Ids, [Parameter()][AllowNull()][hashtable]$Ledger,
|          [Parameter()][AllowEmptyCollection()][string[]]$AnchorKeys = @())
|    $none = [pscustomobject]@{ Proven = $false; Types = @() }
|    if ($null -eq $Ledger -or @($AnchorKeys).Count -eq 0) { return $none }
|    # the group's own anchors under this id, by type: key -> FirstSeen
|    $own = @{}; $ownKeys = @{}
|    foreach ($id in $Ids) {
|        $t = ([string]$id.Type).ToLowerInvariant()
|        if ($script:SIOnePerObjectIdTypes -notcontains $t) { continue }
|        $k = Get-SILedgerEntryKey -Ledger $Ledger -Type ([string]$id.Type) -Value ([string]$id.Value)
|        $ownKeys[(Get-SILedgerKey -Type ([string]$id.Type) -Value ([string]$id.Value))] = $true
|        if ($null -eq $k) { continue }
|        $ownKeys[$k] = $true
|        if (-not $own.ContainsKey($t)) { $own[$t] = New-Object System.Collections.Generic.List[datetime] }
|        if ($null -ne $Ledger[$k].FirstSeen) { $own[$t].Add([datetime]$Ledger[$k].FirstSeen) }
|    }
|    foreach ($x in @($own.Keys)) { if ($own[$x].Count -eq 0) { $own.Remove($x) } }
|    if ($own.Count -lt 2) { return $none }
|    $types = New-Object System.Collections.Generic.List[string]
|    foreach ($ak in $AnchorKeys) {
|        if ($ownKeys.ContainsKey($ak)) { continue }
|        $cut = ([string]$ak).IndexOf('|'); if ($cut -lt 1) { continue }
|        $t = ([string]$ak).Substring(0, $cut)
|        if (-not $own.ContainsKey($t) -or $types.Contains($t)) { continue }
|        if ($null -eq $Ledger[$ak] -or $null -eq $Ledger[$ak].FirstSeen) { continue }
|        $fs = [datetime]$Ledger[$ak].FirstSeen
|        foreach ($mine in $own[$t]) { if ([Math]::Abs(($fs - $mine).TotalSeconds) -lt 1) { $types.Add($t); break } }
|    }
|    [pscustomobject]@{ Proven = ($types.Count -ge 2); Types = $types.ToArray() }
|}
|
|function Get-SILedgerIdKeeperKey {
|    <#
|        PURE. #642 The ledger key of the anchor whose object KEEPS a ledger id when the id is found to hold several objects:
|        the anchor the id was minted from (its v5 id is the id itself) -- else the oldest anchor (FirstSeen), ties broken by
|        the ordinally lowest key. Decided from the ledger alone, so every batch of a CI build and every engine agree on it.
|    #>
|    param([Parameter(Mandatory)][string]$CorrelationId, [Parameter()][AllowNull()][hashtable]$Ledger,
|          [Parameter()][AllowEmptyCollection()][string[]]$AnchorKeys = @())
|    $best = $null; $bestT = $null
|    foreach ($ak in $AnchorKeys) {
|        if ((New-SIObjectUuidV5 -Name ([string]$ak)).ToString() -eq $CorrelationId) { return [string]$ak }
|        $t = [datetime]::MaxValue; if ($null -ne $Ledger[$ak] -and $null -ne $Ledger[$ak].FirstSeen) { $t = [datetime]$Ledger[$ak].FirstSeen }
|        if ($null -eq $best -or $t -lt $bestT -or ($t -eq $bestT -and [string]::CompareOrdinal([string]$ak, $best) -lt 0)) { $best = [string]$ak; $bestT = $t }
|    }
|    $best
|}
|
|function New-SIObjectUuidV5 {
|    <#
|        RFC 4122 v5 (SHA-1, name-based) UUID.
|
|        DETERMINISTIC AT BIRTH, which is the whole point of choosing v5 over a random GUID: if the
|        ledger is ever lost, ids can be PARTIALLY rebuilt by re-deriving from the anchors that are still
|        present, instead of re-keying the estate and orphaning every CI. A random GUID would have made
|        loss unrecoverable.
|
|        🔒 It is derived ONCE, at birth, and then STORED. It is never re-derived at runtime to answer
|        "what is this object called" -- that would reintroduce exactly the anchor-dependence this
|        design removes. Derivation is for minting and for disaster recovery, nothing else.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$Name,
|        [Parameter()][guid]$Namespace = $script:SIObjectIdNamespace
|    )
|
|    # Namespace goes in BIG-ENDIAN network order, per RFC 4122. .NET's Guid.ToByteArray() returns the
|    # first three fields little-endian, so they must be flipped or the id differs from every other
|    # implementation -- and an id that disagrees with the rest of the world is a bug we would only find
|    # when someone cross-checked it.
|    $nb = $Namespace.ToByteArray()
|    [Array]::Reverse($nb, 0, 4)
|    [Array]::Reverse($nb, 4, 2)
|    [Array]::Reverse($nb, 6, 2)
|
|    # 🪤 NOT `$name` -- PowerShell variable names are CASE-INSENSITIVE, so `$name` IS the `[string]$Name`
|    # parameter. Assigning a byte[] into it silently COERCES back to a string, and `.Length` then counts
|    # characters instead of bytes: the buffer is sized wrong and Array.Copy dies with "Source array was
|    # not long enough". It failed on some inputs and not others, which is what made it look like a data
|    # problem rather than a shadowing one.
|    $nameBytes = [System.Text.Encoding]::UTF8.GetBytes($Name)
|    $buf = New-Object byte[] ($nb.Length + $nameBytes.Length)
|    [Array]::Copy($nb, 0, $buf, 0, $nb.Length)
|    [Array]::Copy($nameBytes, 0, $buf, $nb.Length, $nameBytes.Length)
|
|    $sha = [System.Security.Cryptography.SHA1]::Create()
|    try { $hash = $sha.ComputeHash($buf) } finally { $sha.Dispose() }
|
|    $out = New-Object byte[] 16
|    [Array]::Copy($hash, 0, $out, 0, 16)
|    $out[6] = [byte](($out[6] -band 0x0F) -bor 0x50)   # version 5
|    $out[8] = [byte](($out[8] -band 0x3F) -bor 0x80)   # RFC 4122 variant
|
|    # Flip back to .NET's little-endian layout so [guid] renders the canonical string.
|    [Array]::Reverse($out, 0, 4)
|    [Array]::Reverse($out, 4, 2)
|    [Array]::Reverse($out, 6, 2)
|    [guid][byte[]]$out
|}
|
|function Get-SIObjectBirthAnchor {
|    <#
|        The anchor an object is BORN with: highest-priority identifier type present, and within that
|        type the ordinally-lowest value.
|
|        Reuses SISeedPriority so birth and today's seed agree -- but note the difference that matters:
|        this is consulted ONCE, at mint. After that the id is stored and the anchor may die freely.
|
|        ORDINAL, never Sort-Object: culture-sensitive sort makes the same object mint a different id on
|        a Danish host than an English one (see Sort-SIOrdinal). SI ships to ~6,000 installs whose locale
|        we do not choose.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Identifiers)
|
|    $ids = @($Identifiers | Where-Object { $null -ne $_ })
|    if ($ids.Count -eq 0) { return $null }
|
|    foreach ($type in $script:SISeedPriority) {
|        $vals = @()
|        foreach ($id in $ids) { if ($id.Type -ieq $type) { $vals += [string]$id.Value } }
|        if ($vals.Count -gt 0) {
|            $first = @(Sort-SIOrdinal -Value $vals)[0]
|            return [pscustomobject]@{ Type = (Get-SICanonicalIdType -Type $type); Value = [string]$first }
|        }
|    }
|    # 🔴 No type of the priority list (a public IP, an Intune-only device, an app id): the ordinally-lowest ledger key of
|    # what the object HAS. Returning nothing here minted every such object from the empty key -- ONE id for all of them
|    # (#477, 2026-10-09: found when the CI build ran without the correlation engine, where the list was not even loaded).
|    $keys = @(foreach ($id in $ids) { Get-SILedgerKey -Type ([string]$id.Type) -Value ([string]$id.Value) })
|    $low = @(Sort-SIOrdinal -Value $keys)[0]
|    $cut = $low.IndexOf('|')
|    $match = @($ids | Where-Object { (Get-SILedgerKey -Type ([string]$_.Type) -Value ([string]$_.Value)) -ceq $low })[0]
|    [pscustomobject]@{ Type = (Get-SICanonicalIdType -Type ([string]$match.Type)); Value = $low.Substring($cut + 1) }
|}
|
|function Get-SILedgerKey {
|    <# The ledger's lookup key. Canonicalised and lower-cased, so one fact cannot have two spellings. #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Type,
|          [Parameter(Mandatory)][AllowEmptyString()][string]$Value)
|    # while Resolve-SIObjectIdentity runs, every key is made once (2026-10-16: five times per identifier of every object --
|    # a quarter of the correlation job's ledger step on a large install); the same text, from a table of this call's keys
|    $memo = $script:SILedgerKeyMemo
|    if ($null -ne $memo) {
|        $mk = $Type + [char]1 + $Value
|        $hit = $null
|        if ($memo.TryGetValue($mk, [ref]$hit)) { return $hit }
|        $k = '{0}|{1}' -f (Get-SICanonicalIdType -Type $Type).ToLowerInvariant(), ([string]$Value).ToLowerInvariant()
|        $memo[$mk] = $k
|        return $k
|    }
|    '{0}|{1}' -f (Get-SICanonicalIdType -Type $Type).ToLowerInvariant(), ([string]$Value).ToLowerInvariant()
|}
|
|# The widest identifier value the ledger's table holds is 256 characters (si.ObjectIdentity.IdentifierValue,
|# NVARCHAR(256)). The column is part of the table's primary key, so it cannot simply be made wider: SQL Server limits a
|# clustered key to 900 bytes, and the type (64 characters) + 256 characters already take 640 of them.
|function ConvertTo-SILedgerStoredValue {
|    <#
|        PURE. THE ONE RULE for an identifier value that is longer than the ledger's column (an Azure resource id can be
|        2,000 characters and more): the value as the ledger's table stores it and looks it up.
|
|          256 characters or fewer -> the value itself, untouched
|          longer                  -> '~sha256:' + SHA-256 of the lower-cased value (64 hex) + ':' + its first 160 characters
|
|        The same long value always gives the same short form (so it is found again), two different long values never give
|        the same one (the hash decides; the readable start is only there so a person can see what it is). Always 233
|        characters or fewer. The id an object is BORN with is still derived from the full value (New-SIObjectUuidV5) --
|        this is only what the table holds.
|
|        Found 2026-10-12: a new install's first run wrote 18,820 anchors for 10 minutes and lost all of them, because one
|        Azure resource id did not fit the column.
|
|        (The two numbers are written out, not read from the variables above: this function is also called where this
|        file's script scope is not the caller's.)
|    #>
|    param([Parameter()][AllowNull()][AllowEmptyString()][string]$Value)
|    if ($null -eq $Value) { return '' }
|    if ($Value.Length -le 256) { return $Value }
|    $low = $Value.ToLowerInvariant()
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $hex = ([System.BitConverter]::ToString($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($low))) -replace '-', '').ToLowerInvariant() }
|    finally { $sha.Dispose() }
|    $head = $low.Substring(0, 160)
|    # never half of a two-part character at the cut
|    if ([char]::IsHighSurrogate($head[$head.Length - 1])) { $head = $head.Substring(0, $head.Length - 1) }
|    '~sha256:' + $hex + ':' + $head
|}
|
|function Get-SILedgerEntryKey {
|    <#
|        PURE. The key under which -Ledger holds this identifier, or $null when it does not: the plain key, or -- for a
|        value longer than the ledger's column -- the key of its stored short form (what a ledger read from the table
|        carries; ConvertTo-SILedgerStoredValue). A ledger kept as a file holds long values whole, so the plain key is
|        asked first.
|    #>
|    param([Parameter()][AllowNull()][hashtable]$Ledger,
|          [Parameter(Mandatory)][AllowEmptyString()][string]$Type,
|          [Parameter(Mandatory)][AllowEmptyString()][string]$Value)
|    if ($null -eq $Ledger) { return $null }
|    $k = Get-SILedgerKey -Type $Type -Value $Value
|    if ($Ledger.ContainsKey($k)) { return $k }
|    if ($Value.Length -gt 256) {
|        $k2 = Get-SILedgerKey -Type $Type -Value (ConvertTo-SILedgerStoredValue -Value $Value)
|        if ($Ledger.ContainsKey($k2)) { return $k2 }
|    }
|    $null
|}
|
|function Get-SILedgerKeysById {
|    <#
|        PURE. The ledger's keys by the id they point at, for "which anchors does this id hold" without
|        reading the whole ledger once per object.
|
|        Returns { LedgerKeys = <every ledger key, in the ledger's own order>; ById = <id -> positions in
|        LedgerKeys, ascending>; Other = <positions whose id is not plain text> }.
|
|        🔒 IT MUST FIND EXACTLY WHAT `[string]$Ledger[$k].CorrelationId -eq $cid` FINDS, in the same order.
|        `-eq` on strings ignores case by the invariant culture's rules. For PLAIN text (printable ASCII --
|        every id SI mints is a GUID) that is the same as an ordinal ignore-case match, which is what the
|        lookup uses. An id with any other character is NOT indexed: it is kept in `Other` and compared with
|        `-eq` itself (Get-SILedgerKeysOfId), so nothing is matched differently for it.
|    #>
|    param([Parameter()][AllowNull()][hashtable]$Ledger)
|    $byId  = New-Object 'System.Collections.Generic.Dictionary[string,System.Collections.Generic.List[int]]' ([StringComparer]::OrdinalIgnoreCase)
|    $other = New-Object System.Collections.Generic.List[int]
|    $keys  = @()
|    if ($null -ne $Ledger) { $keys = @($Ledger.Keys) }
|    for ($i = 0; $i -lt $keys.Count; $i++) {
|        $c = [string]$Ledger[$keys[$i]].CorrelationId
|        # \z, not $: a trailing line break is not plain text
|        if ([regex]::IsMatch($c, '^[\x20-\x7E]*\z')) {
|            $list = $null
|            if (-not $byId.TryGetValue($c, [ref]$list)) { $list = New-Object System.Collections.Generic.List[int]; $byId[$c] = $list }
|            [void]$list.Add($i)
|        } else { [void]$other.Add($i) }
|    }
|    [pscustomobject]@{ LedgerKeys = $keys; ById = $byId; Other = $other }
|}
|
|function Get-SILedgerKeysOfId {
|    <#
|        PURE. The ledger keys that point at -CorrelationId, in the ledger's own order -- what a scan of
|        every key with `[string]$Ledger[$k].CorrelationId -eq $CorrelationId` answers (Get-SILedgerKeysById).
|    #>
|    param([Parameter(Mandatory)]$Index, [Parameter()][AllowNull()][hashtable]$Ledger, [Parameter()][AllowNull()][AllowEmptyString()][string]$CorrelationId)
|    $keys = $Index.LedgerKeys
|    $pos  = New-Object System.Collections.Generic.List[int]
|    if ([regex]::IsMatch([string]$CorrelationId, '^[\x20-\x7E]*\z')) {
|        $list = $null
|        if ($Index.ById.TryGetValue($CorrelationId, [ref]$list)) { foreach ($i in $list) { [void]$pos.Add($i) } }
|        # ids that are not plain text: compared exactly as before, and put back in the ledger's order
|        if ($Index.Other.Count -gt 0) {
|            foreach ($i in $Index.Other) { if ([string]$Ledger[$keys[$i]].CorrelationId -eq $CorrelationId) { [void]$pos.Add($i) } }
|            $pos.Sort()
|        }
|    } else {
|        # the id asked for is not plain text: the scan, as before
|        for ($i = 0; $i -lt $keys.Count; $i++) { if ([string]$Ledger[$keys[$i]].CorrelationId -eq $CorrelationId) { [void]$pos.Add($i) } }
|    }
|    foreach ($i in $pos) { $keys[$i] }
|}
|
|function Get-SISupersededRowValue {
|    <# PURE. One value of a row (a dictionary or an object), without case. #>
|    param($Row, [string]$Name)
|    if ($null -eq $Row) { return $null }
|    if ($Row -is [System.Collections.IDictionary]) { foreach ($k in $Row.Keys) { if ([string]$k -ieq $Name) { return $Row[$k] } }; return $null }
|    $p = $Row.PSObject.Properties[$Name]; if ($p) { return $p.Value }
|    $null
|}
|
|function ConvertTo-SISupersededMap {
|    <#
|        PURE. THE MERGED-AWAY IDS (owner 2026-11-05: "ci object must be the stable id"): rows { OldId; NewId; At } -> a
|        case-insensitive map old id -> the id it was merged into. Sources (the CI build reads them): the identity ledger's
|        si.ObjectIdentitySuperseded, sidata.AssetIdHistory's CI->CI 'merge' events (both ids are CIs) and every retired CI
|        that names si_merged_into.
|        ONE ANSWER PER OLD ID, deterministic: the NEWEST event (At) wins; equal times -> the ordinally lowest new id. A row
|        whose old and new id are the same is ignored.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @())
|    $map = New-Object 'System.Collections.Hashtable' ([StringComparer]::OrdinalIgnoreCase)
|    $at = New-Object 'System.Collections.Hashtable' ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($r in @($Rows)) {
|        if ($null -eq $r) { continue }
|        $o = ([string](Get-SISupersededRowValue $r 'OldId')).Trim(); $n = ([string](Get-SISupersededRowValue $r 'NewId')).Trim()
|        if (-not $o -or -not $n -or $o -ieq $n) { continue }
|        $t = [datetime]::MinValue
|        $tv = Get-SISupersededRowValue $r 'At'
|        if ($tv -is [datetime]) { $t = ([datetime]$tv).ToUniversalTime() }
|        elseif ($tv) { $p = [datetime]::MinValue; if ([datetime]::TryParse([string]$tv, [Globalization.CultureInfo]::InvariantCulture, ([Globalization.DateTimeStyles]::AssumeUniversal -bor [Globalization.DateTimeStyles]::AdjustToUniversal), [ref]$p)) { $t = $p } }
|        if (-not $map.ContainsKey($o) -or $t -gt $at[$o] -or ($t -eq $at[$o] -and [string]::CompareOrdinal($n.ToLowerInvariant(), ([string]$map[$o]).ToLowerInvariant()) -lt 0)) {
|            $map[$o] = $n.ToLowerInvariant(); $at[$o] = $t
|        }
|    }
|    $map
|}
|
|function Resolve-SISupersededId {
|    <#
|        PURE. The id -Id stands for NOW: the merge chain followed to its end (a -> b -> c answers c). A merged-away id is
|        never an id of its own again. A cycle (a -> b -> a, two contradicting merges) ends on the ordinally lowest id of the
|        cycle, so every batch and every host answers the same. No map, or an id that was never merged: the id itself.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Id, [hashtable]$Map)
|    if (-not $Id -or $null -eq $Map -or $Map.Count -eq 0) { return $Id }
|    $cur = $Id
|    $path = New-Object System.Collections.Generic.List[string]
|    $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    while ($Map.ContainsKey($cur)) {
|        if (-not $seen.Add($cur)) {
|            # a cycle: the ordinally lowest id of the cycle
|            $start = $path.IndexOf(($path | Where-Object { $_ -ieq $cur } | Select-Object -First 1))
|            $low = $null
|            for ($i = $start; $i -lt $path.Count; $i++) { $c = $path[$i].ToLowerInvariant(); if ($null -eq $low -or [string]::CompareOrdinal($c, $low) -lt 0) { $low = $c } }
|            return $low
|        }
|        $path.Add($cur)
|        $cur = [string]$Map[$cur]
|    }
|    $cur
|}
|
|function Resolve-SIObjectIdentity {
|    <#
|        Decide each group's SI_CorrelationId against the existing ledger, and say what the ledger must
|        become. Returns decisions; it does not write anything.
|
|        Ledger is a hashtable: "type|value" -> @{ CorrelationId; FirstSeen }.
|        Absent or empty means a first run, in which case everything mints -- which is correct, and is
|        also the disaster-recovery path.
|
|          MINT   no identifier is known         -> derive a v5 id from the birth anchor
|          REUSE  all known identifiers agree    -> take the existing id, record any new identifiers
|          MERGE  identifiers name 2+ ids        -> keep the OLDEST, supersede the rest, emit old->new
|
|        🔒 THE OLDEST SURVIVES, not the "best". Any other rule (lowest tier, most members, newest) makes
|        the surviving id depend on this run's data, which is the exact property being removed. FirstSeen
|        decides; an ordinal id compare breaks ties so two hosts never disagree.
|
|        ◻ SPLIT DETECTION IS DEFERRED, AND DELIBERATELY NOT GUESSED. A genuine split -- one object whose
|        identifiers stop co-occurring -- cannot be told apart from "a source failed and half the
|        identifiers are missing this run" by looking at one run. Getting that wrong RETIRES A LIVE CI,
|        which is worse than a late one. It needs either two consecutive runs agreeing or an explicit
|        operator action, and that is a separate decision. What this DOES do is report the shrink
|        (`ShrunkObjects`) so it is visible rather than silent.
|        🔑 THE ONE EXCEPTION, #642: a group that PROVABLY is another object than the rest of its id (Test-SILedgerWrongMerge
|        -- two or more types an object holds once, each with another value written in the same run) is split off: a source
|        that failed cannot produce that, a fused group can. The object the id was minted from keeps it (Action 'split',
|        Splits Kind 'wrong-merge', counted in WrongMergeSplit).
|
|        🔴 -AmbiguousIdKeys (#61.4, added 2026-08-20 after a LIVE failure). Ledger keys carried by more
|        than one object this run, which happens only when an operator never-merge kept two groups
|        apart. Such a key identifies NEITHER group any more, so it is excluded from three places --
|        and ALL THREE are required, or the fix does not survive to the next run:
|
|          1. the `$known` LOOKUP   -- or the shared anchor drags both halves back onto one id
|          2. the BIRTH ANCHOR      -- or both halves mint the SAME v5 id from the shared value
|          3. the ledger WRITE-BACK -- or the re-minted half claims the shared anchor, and next run the
|                                      other half follows it and they MERGE again
|
|        Measured before the fix: `distinct durable ids: 1 for 2 objects`. The derived seed was already
|        correct by then, so the published map looked right while the LEDGER re-fused them -- and a
|        durable id is exactly the one a connector is permitted to create CIs from.
|    #>
|    param(
|        # AllowNull as well as AllowEmptyCollection: a caller flattening several sources can hand us an
|        # array with a null element, and binding must not refuse it. The loop skips nulls itself.
|        [Parameter(Mandatory)][AllowNull()][AllowEmptyCollection()][object[]]$Groups,
|        [Parameter()][hashtable]$Ledger,
|        [Parameter()][datetime]$Now = ([datetime]'2000-01-01T00:00:00Z'),
|        [Parameter()][AllowNull()][hashtable]$AmbiguousIdKeys,
|        # THE MERGED-AWAY IDS (ConvertTo-SISupersededMap: old id -> the id it was merged into). An id the ledger still
|        # names for an identifier but that was merged away is NEVER used again: it resolves to the end of its merge chain
|        # (Resolve-SISupersededId) and EVERY anchor it still holds is re-pointed there (owner 2026-11-05, a ring 1 install:
|        # an old Exposure Graph node id of a VM still pointed at the merged twin, and the build brought the twin back)
|        [Parameter()][AllowNull()][hashtable]$MergedAway
|    )
|
|    if ($null -eq $Ledger) { $Ledger = @{} }
|    # the ledger keys of this call, each made once (Get-SILedgerKey); dropped at the end of the call
|    $script:SILedgerKeyMemo = New-Object 'System.Collections.Generic.Dictionary[string,string]' ([StringComparer]::Ordinal)
|    $hasAmbiguous = ($null -ne $AmbiguousIdKeys -and $AmbiguousIdKeys.Keys.Count -gt 0)
|
|    $decisions   = New-Object System.Collections.Generic.List[object]
|    $superseded  = New-Object System.Collections.Generic.List[object]
|    $shrunk      = New-Object System.Collections.Generic.List[object]
|    $splits      = New-Object System.Collections.Generic.List[object]
|    $unkeyable   = 0
|    $keysById    = $null   # the ledger's keys by id, built when the first object that is not new needs it
|    $keeperKeys  = @{}      # #642 per ledger id: the key of the anchor whose object keeps the id
|
|    foreach ($g in @($Groups)) {
|        if ($null -eq $g) { continue }
|
|        # Every identifier the group carries, across all members, canonicalised.
|        $idsAll = New-Object System.Collections.Generic.List[object]
|        foreach ($m in @($g.Members)) {
|            foreach ($id in (Get-SIMemberIdentifiers -Member $m)) {
|                [void]$idsAll.Add([pscustomobject]@{
|                    Type  = (Get-SICanonicalIdType -Type ([string]$id.Type))
|                    Value = ([string]$id.Value).ToLowerInvariant()
|                })
|            }
|        }
|
|        # Identity is decided on the UNAMBIGUOUS subset. A group whose ONLY anchors are contested falls
|        # back to the full set rather than being declared unkeyable -- it still needs an id, and the
|        # collision pass below reports what could not be separated.
|        $ids = $idsAll
|        if ($hasAmbiguous) {
|            $filtered = New-Object System.Collections.Generic.List[object]
|            foreach ($id in $idsAll) {
|                if (-not $AmbiguousIdKeys.ContainsKey((Get-SILedgerKey -Type $id.Type -Value $id.Value))) {
|                    [void]$filtered.Add($id)
|                }
|            }
|            if ($filtered.Count -gt 0) { $ids = $filtered }
|        }
|
|        if ($ids.Count -eq 0) {
|            # No anchor at all -- nothing to remember it by, so it cannot be given a durable identity.
|            # Counted, never invented: minting for an unkeyable object would create a new id every run.
|            $unkeyable++
|            [void]$decisions.Add([pscustomobject]@{
|                Group = $g; CorrelationId = $null; Action = 'unkeyable'
|                BirthAnchor = $null; NewIdentifiers = @(); PriorIds = @()
|            })
|            continue
|        }
|
|        # Which existing ids do this group's identifiers already point at?
|        $known = @{}
|        # every id the ledger names for these identifiers, as written (before the merge chain is followed)
|        $rawIds = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|        foreach ($id in $ids) {
|            # (a value longer than the ledger's column is held under its short form -- Get-SILedgerEntryKey finds both)
|            $k = Get-SILedgerEntryKey -Ledger $Ledger -Type $id.Type -Value $id.Value
|            if ($null -ne $k) {
|                $e = $Ledger[$k]
|                $cid = [string]$e.CorrelationId
|                if ([string]::IsNullOrWhiteSpace($cid)) { continue }
|                [void]$rawIds.Add($cid)
|                # a merged-away id stands for the id it was merged into -- never for itself
|                $cid = Resolve-SISupersededId -Id $cid -Map $MergedAway
|                if (-not $known.ContainsKey($cid)) { $known[$cid] = $e.FirstSeen }
|            }
|        }
|
|        $anchor = Get-SIObjectBirthAnchor -Identifiers $ids.ToArray()
|        $action = ''
|        $cid    = $null
|        $priors = @()
|
|        if ($known.Keys.Count -eq 0) {
|            $action = 'mint'
|            $cid = (New-SIObjectUuidV5 -Name (Get-SILedgerKey -Type $anchor.Type -Value $anchor.Value)).ToString()
|        }
|        elseif ($known.Keys.Count -eq 1) {
|            $action = 'reuse'
|            $cid = @($known.Keys)[0]
|        }
|        else {
|            # MERGE. Oldest FirstSeen wins; ordinal id compare breaks a tie deterministically.
|            $action = 'merge'
|            $ordered = @($known.Keys) | Sort-Object @{ Expression = { $known[$_] } }, @{ Expression = { $_ } }
|            $oldest  = $null
|            $oldestT = $null
|            foreach ($k in @($known.Keys)) {
|                $t = $known[$k]
|                if ($null -eq $oldestT -or $t -lt $oldestT -or
|                    ($t -eq $oldestT -and (@(Sort-SIOrdinal -Value @($k, $oldest))[0]) -eq $k)) {
|                    $oldest = $k; $oldestT = $t
|                }
|            }
|            $cid = $oldest
|            $priors = @(@($known.Keys) | Where-Object { $_ -ne $cid })
|            foreach ($old in $priors) {
|                [void]$superseded.Add([pscustomobject]@{ OldId = $old; NewId = $cid; At = $Now })
|            }
|        }
|
|        # Identifiers this object did not previously have under this id -- the ledger rows to add.
|        $newIds = New-Object System.Collections.Generic.List[object]
|        foreach ($id in $ids) {
|            $k = Get-SILedgerEntryKey -Ledger $Ledger -Type $id.Type -Value $id.Value
|            if ($null -eq $k -or [string]$Ledger[$k].CorrelationId -ne $cid) {
|                [void]$newIds.Add([pscustomobject]@{ Type = $id.Type; Value = $id.Value; CorrelationId = $cid })
|            }
|        }
|
|        # ON A MERGE (and on a merged-away id met again) EVERY ANCHOR OF THE OLD ID IS RE-POINTED to the survivor -- not
|        # only the anchors this group carries this run. An anchor left behind is how a merged-away id came back: at a ring 1
|        # install (2026-11-05) a VM's old Exposure Graph node id still pointed at the merged twin, and the next build that
|        # saw that node alone REUSED the twin. The old ids are recorded as superseded (never an id of their own again).
|        if ($action -ne 'mint') {
|            $oldIds = @(foreach ($r in $rawIds) { if ($r -ine $cid) { $r } })
|            if ($oldIds.Count -gt 0) {
|                if ($null -eq $keysById) { $keysById = Get-SILedgerKeysById -Ledger $Ledger }
|                $have = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|                foreach ($n in $newIds) { [void]$have.Add((Get-SILedgerKey -Type ([string]$n.Type) -Value ([string]$n.Value))) }
|                foreach ($old in $oldIds) {
|                    foreach ($ok in @(Get-SILedgerKeysOfId -Index $keysById -Ledger $Ledger -CorrelationId $old)) {
|                        if ($hasAmbiguous -and $AmbiguousIdKeys.ContainsKey([string]$ok)) { continue }
|                        if (-not $have.Add([string]$ok)) { continue }
|                        $cut = ([string]$ok).IndexOf('|'); if ($cut -lt 1) { continue }
|                        [void]$newIds.Add([pscustomobject]@{ Type = (Get-SICanonicalIdType -Type ([string]$ok).Substring(0, $cut)); Value = ([string]$ok).Substring($cut + 1); CorrelationId = $cid })
|                    }
|                    if ($action -ne 'merge' -or $priors -notcontains $old) {
|                        [void]$superseded.Add([pscustomobject]@{ OldId = $old; NewId = $cid; At = $Now })
|                    }
|                }
|                if ($action -eq 'reuse') { $priors = @($oldIds) }
|            }
|        }
|
|        # #642 A WRONG MERGE IN THE LEDGER: this group resolved to an id that, by proof, also holds ANOTHER object (two or
|        # more identifier types an object holds once, each with another value written in the same run -- Test-SILedgerWrongMerge).
|        # The object the id was minted from (else the oldest) keeps it; this group becomes its own object, minted from its
|        # own birth anchor, and its anchors are re-pointed -- so the next run reuses the new id and nothing splits again.
|        # Decided per group from the ledger alone: a CI build batch that holds one of the objects decides exactly what a
|        # batch holding all of them would.
|        $idKeys = $null
|        if ($action -eq 'reuse') {
|            if ($null -eq $keysById) { $keysById = Get-SILedgerKeysById -Ledger $Ledger }
|            $idKeys = @(Get-SILedgerKeysOfId -Index $keysById -Ledger $Ledger -CorrelationId $cid)
|            $wm = Test-SILedgerWrongMerge -Ids $ids.ToArray() -Ledger $Ledger -AnchorKeys $idKeys
|            if ($wm.Proven) {
|                if (-not $keeperKeys.ContainsKey($cid)) { $keeperKeys[$cid] = Get-SILedgerIdKeeperKey -CorrelationId $cid -Ledger $Ledger -AnchorKeys $idKeys }
|                $keeperKey = [string]$keeperKeys[$cid]
|                $holdsKeeper = $false
|                foreach ($id in $ids) {
|                    if ((Get-SILedgerEntryKey -Ledger $Ledger -Type $id.Type -Value $id.Value) -eq $keeperKey) { $holdsKeeper = $true; break }
|                }
|                $newCid = (New-SIObjectUuidV5 -Name (Get-SILedgerKey -Type $anchor.Type -Value $anchor.Value)).ToString()
|                if (-not $holdsKeeper -and $newCid -ne $cid) {
|                    $rewritten = New-Object System.Collections.Generic.List[object]
|                    foreach ($id in $ids) { [void]$rewritten.Add([pscustomobject]@{ Type = $id.Type; Value = $id.Value; CorrelationId = $newCid }) }
|                    [void]$splits.Add([pscustomobject]@{
|                        CorrelationId = $cid; NewId = $newCid; Objects = 2; Resolved = $true; Kind = 'wrong-merge'
|                        KeptBy = $keeperKey; Types = @($wm.Types)
|                        Reason = ('the ledger id held another object as well ({0} differ, written in the same run) -- the object it was minted from keeps the id and this one is its own object' -f (@($wm.Types) -join ', '))
|                    })
|                    [void]$decisions.Add([pscustomobject]@{
|                        Group = $g; CorrelationId = $newCid; Action = 'split'
|                        BirthAnchor = $anchor; NewIdentifiers = $rewritten.ToArray(); PriorIds = @($cid)
|                        Identifiers = $ids.ToArray()
|                    })
|                    continue
|                }
|            }
|        }
|
|        # Anchors the ledger holds for this id that did NOT appear this run. Reported, never acted on --
|        # see the split note in the docblock.
|        if ($action -ne 'mint') {
|            $present = @{}
|            foreach ($id in $ids) {
|                $present[(Get-SILedgerKey -Type $id.Type -Value $id.Value)] = $true
|                # a long value is in the ledger under its short form: it appeared this run all the same
|                if (([string]$id.Value).Length -gt 256) { $present[(Get-SILedgerKey -Type $id.Type -Value (ConvertTo-SILedgerStoredValue -Value ([string]$id.Value)))] = $true }
|            }
|            # 🔴 THE LEDGER'S KEYS BY THE ID THEY POINT AT, built once (Get-SILedgerKeysById). This report used to read
|            # EVERY ledger key for EVERY object: 28,822 objects against a ledger of well over 100,000 anchors was more
|            # than an hour of one correlation run (2026-10-12), and the same again in every batch of the CI build.
|            # The same keys are found, in the same order.
|            if ($null -eq $keysById) { $keysById = Get-SILedgerKeysById -Ledger $Ledger }
|            $missing = New-Object System.Collections.Generic.List[object]
|            if ($null -eq $idKeys) { $idKeys = @(Get-SILedgerKeysOfId -Index $keysById -Ledger $Ledger -CorrelationId $cid) }
|            foreach ($k in $idKeys) {
|                if (-not $present.ContainsKey($k)) { [void]$missing.Add($k) }
|            }
|            if ($missing.Count -gt 0) {
|                [void]$shrunk.Add([pscustomobject]@{ CorrelationId = $cid; MissingAnchors = $missing.ToArray() })
|            }
|        }
|
|        [void]$decisions.Add([pscustomobject]@{
|            Group = $g; CorrelationId = $cid; Action = $action
|            BirthAnchor = $anchor; NewIdentifiers = $newIds.ToArray(); PriorIds = $priors
|            Identifiers = $ids.ToArray()
|        })
|    }
|
|    # ---- ONE LEDGER ID CLAIMED BY TWO OBJECTS -------------------------------------------------------
|    #
|    # 🔴 THIS IS THE OTHER HALF OF THE 2026-08-20 LIVE FAILURE, and excluding the contested anchor above
|    # does NOT on its own fix it. Before a split every anchor of the original object points at that
|    # object's id, so on the FIRST run after an operator separates it, BOTH halves still resolve to the
|    # same id through their own perfectly unambiguous anchors. Measured: `1 distinct id for 2 objects`.
|    #
|    # 🔑 WHY IT IS SAFE TO ACT HERE AND NOWHERE ELSE. The docblock above refuses to auto-detect splits
|    # because one run cannot tell "this object split" from "a source failed". That reasoning is intact:
|    # this pass only reassigns when an OPERATOR never-merge produced the separation, which is exactly
|    # the missing fact. Two groups that collide WITHOUT one are reported and left alone -- the deferred
|    # case, now at least visible instead of silently sharing an id.
|    $byId = @{}
|    foreach ($d in $decisions) {
|        if ([string]::IsNullOrWhiteSpace([string]$d.CorrelationId)) { continue }
|        $k = [string]$d.CorrelationId
|        if (-not $byId.ContainsKey($k)) { $byId[$k] = New-Object System.Collections.Generic.List[object] }
|        [void]$byId[$k].Add($d)
|    }
|
|    foreach ($k in @($byId.Keys)) {
|        # 🪤 .ToArray(), NOT @(...). On PS 5.1 wrapping a List[object] of PSCustomObjects in @() throws
|        # "Argument types do not match" -- and it threw here on the very first call, before any
|        # collision existed, so it would have taken down every correlation run.
|        $claimants = $byId[$k].ToArray()
|        if ($claimants.Count -lt 2) { continue }
|
|        $separated = @($claimants | Where-Object { $_.Group -and $_.Group.PSObject.Properties['SeparatedByDecision'] -and $_.Group.SeparatedByDecision })
|        if ($separated.Count -lt 2) {
|            # Not operator-separated: the deferred split/reassign case. Report, never act.
|            [void]$splits.Add([pscustomobject]@{
|                CorrelationId = $k; Objects = $claimants.Count; Resolved = $false; Kind = 'collision'
|                Reason = 'two or more objects resolve to one ledger id and no operator decision separated them -- reported, not acted on (see V3-ARCHITECTURE 2.3a)'
|            })
|            continue
|        }
|
|        # WHICH HALF KEEPS THE EXISTING ID. Ordinal compare of each half's own birth-anchor ledger key.
|        #
|        # 🔑 It is a TIEBREAK, not a claim about which half is "really" the original -- nothing in one
|        # run can establish that. What it must be is DETERMINISTIC and STABLE: a rule that flipped
|        # between runs would move the CI back and forth, which is worse than either choice. Ordinal
|        # (never culture-sensitive) so two hosts cannot disagree.
|        # 📌 The operator overrides it with `pin-id`, which is precisely what that kind is for.
|        # 🪤 ORDINAL SCAN, not Sort-Object, and NO `u ESCAPE.
|        # Two host traps in one line, both found on a LIVE pwsh 7 run while the PS 5.1 Pester suite
|        # stayed green (framework finding HOST-1: the suites run on 5.1, the engines on 7):
|        #   * "`uffff" is a pwsh 7 escape. On 5.1 it is the literal text "uffff" and parses fine; on
|        #     pwsh 7 it is a PARSE ERROR, which took the whole ledger block down to
|        #     "identity ledger unavailable -- publishing with DERIVED, PROVISIONAL ids".
|        #   * Sort-Object is culture-sensitive, and this choice decides which CI keeps its identity.
|        #     A da-DK host must not keep a different half than an en-US one.
|        $keeper    = $null
|        $keeperKey = $null
|        foreach ($d in $claimants) {
|            if (-not $d.BirthAnchor) { continue }
|            $dk = Get-SILedgerKey -Type $d.BirthAnchor.Type -Value $d.BirthAnchor.Value
|            if ($null -eq $keeperKey -or [string]::CompareOrdinal($dk, $keeperKey) -lt 0) {
|                $keeper = $d; $keeperKey = $dk
|            }
|        }
|        # Every claimant lacks a birth anchor: nothing to re-mint from, so leave them reported.
|        if ($null -eq $keeper) {
|            [void]$splits.Add([pscustomobject]@{
|                CorrelationId = $k; Objects = $claimants.Count; Resolved = $false; Kind = 'operator'
|                Reason = 'operator-separated, but no half carries an unambiguous anchor to mint a new id from -- reported, not acted on'
|            })
|            continue
|        }
|        $ranked = $claimants
|
|        foreach ($d in $ranked) {
|            if ($d -eq $keeper) { continue }
|            if (-not $d.BirthAnchor) { continue }   # nothing of its own to mint from; leave it reported
|            $newCid = (New-SIObjectUuidV5 -Name (Get-SILedgerKey -Type $d.BirthAnchor.Type -Value $d.BirthAnchor.Value)).ToString()
|            if ($newCid -eq $k) { continue }
|
|            # Re-point this half's OWN anchors at the new id. The contested anchor is already absent
|            # from $d.Identifiers, so it stays with the keeper -- which is what stops the two halves
|            # merging again on the next run.
|            $rewritten = New-Object System.Collections.Generic.List[object]
|            foreach ($id in @($d.Identifiers)) {
|                [void]$rewritten.Add([pscustomobject]@{ Type = $id.Type; Value = $id.Value; CorrelationId = $newCid })
|            }
|            $d.NewIdentifiers = $rewritten.ToArray()
|            $d.CorrelationId  = $newCid
|            $d.Action         = 'split'
|
|            [void]$splits.Add([pscustomobject]@{
|                CorrelationId = $k; NewId = $newCid; Objects = $claimants.Count; Resolved = $true
|                KeptBy = $keeper.CorrelationId; Kind = 'operator'
|                Reason = 'an operator never-merge separated this object; the other half keeps the existing id and this half is a NEW object'
|            })
|        }
|    }
|
|    $script:SILedgerKeyMemo = $null
|    # the decisions counted by action in one pass (the same -eq comparison as before, without case)
|    $actionCount = @{ mint = 0; reuse = 0; merge = 0; split = 0 }
|    foreach ($d in $decisions) { foreach ($a in 'mint', 'reuse', 'merge', 'split') { if ($d.Action -eq $a) { $actionCount[$a]++ } } }
|    [pscustomobject]@{
|        Decisions     = $decisions.ToArray()
|        Superseded    = $superseded.ToArray()
|        ShrunkObjects = $shrunk.ToArray()
|        Splits        = $splits.ToArray()
|        Minted        = $actionCount['mint']
|        Reused        = $actionCount['reuse']
|        Merged        = $actionCount['merge']
|        Split         = $actionCount['split']
|        # #642 of them: the objects split off a ledger id that held another object as well (a wrong merge, repaired)
|        WrongMergeSplit = @($splits | Where-Object { [string]$_.Kind -eq 'wrong-merge' }).Count
|        Unkeyable     = $unkeyable
|    }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-SqlRetry.ps1'] = @{ Sha256 = '0e387c153b615f7d80a0ea1391e42b3d7b87c0723c4ab20e90818aa4f843f211'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE ONE SQL CONNECTION RETRY (owner 2026-10-22: "why not use shared everywhere" / "stability is prio
|    also"). Moved here from setup\_shared\SI-SetupArm.ps1 (Open-SISqlConnectionRetry, Test-SISqlNotYetAnswer) and
|    engine\data-model\identity\SI-ObjectLedgerStore.ps1 (Test-SISqlTransientError), so the engine, the updater and setup open
|    a database the same way.
|
|    ONLY THE OPEN IS RETRIED. A statement that may already have run is never sent again by this file: an Open that failed
|    sent nothing.
|
|    PURE except Open-SISqlConnectionRetry's default -Connect (System.Data.SqlClient). PS 5.1 safe. Community + Pro.
|#>
|
|function Test-SISqlTransientError {
|    <#
|        Azure SQL faults worth another attempt at OPENING the connection. Deliberately a short, named list rather than
|        "retry anything": retrying a permission or a syntax error just delays a real failure.
|          40613 database not currently available (a serverless resume, or a failover)
|          40197 / 40501 / 49918 / 49919 / 49920  service busy, throttled or moving
|          4060  cannot open database right now
|          10928 / 10929 resource limits
|        -2 / 258 client timeouts
|        -ErrorRecord: an ErrorRecord or an exception (inner exceptions are read too).
|    #>
|    param([Parameter(Mandatory)]$ErrorRecord)
|    $codes = @(40613, 40197, 40501, 49918, 49919, 49920, 4060, 10928, 10929, -2, 258)
|    $ex = if ($ErrorRecord -is [System.Management.Automation.ErrorRecord]) { $ErrorRecord.Exception } else { $ErrorRecord }
|    while ($ex) {
|        if ($ex -is [System.Data.SqlClient.SqlException] -and $codes -contains [int]$ex.Number) { return $true }
|        $ex = $ex.InnerException
|    }
|    $msg = [string]$ErrorRecord
|    if ($ErrorRecord -is [System.Exception]) { $msg = [string]$ErrorRecord.Message }
|    return ($msg -match 'is not currently available|Please retry the connection later|too busy|try again')
|}
|
|function Test-SISqlStatementTransient {
|    <#
|        PURE and SELF-CONTAINED (it travels as a value into connection closures: it calls nothing by name). Is a failed SQL
|        STATEMENT one of Azure SQL's platform answers, so the statement may be run again on a new connection? Live 2026-10-28:
|        one statement of the data sync got 9001 (the log is not available) + 3314 (a rollback during recovery) + "A severe
|        error occurred on the current command" after minutes of a saturated log, and a 52-hour run failed on it.
|          transient: 9001, 3314, 40613, 40501, 40197, 49918 / 49919 / 49920 (not available, busy, moving), 4060 (cannot open
|                     the database during a failover), 10928 / 10929 (resource limits), 1205 (chosen as a deadlock victim),
|                     -2 / 258 (a client timeout), 10053 / 10054 / 233 / 64 (a reset or closed connection), 4083 ("the
|                     connection was recovered and rowcount in the first query is not available": the driver re-made an idle
|                     connection under the statement -- live 2026-11-04, a correlation run's CI build failed on it), "a severe error
|                     occurred on the current command", a transport-level error, a broken pooled connection ("Internal .NET
|                     Framework Data Provider error 6").
|          never:     the database is full (1105 / 40544 / 1101), a query defect (syntax, a type mismatch), a permission -- they
|                     fail on the first attempt.
|        -ErrorRecord: an ErrorRecord, an exception (SqlException numbers and inner exceptions are read) or a text.
|    #>
|    param([AllowNull()]$ErrorRecord)
|    if ($null -eq $ErrorRecord) { return $false }
|    $codes = @(9001, 3314, 40613, 40501, 40197, 49918, 49919, 49920, 4060, 10928, 10929, 1205, -2, 258, 10053, 10054, 233, 64, 4083)
|    $full = @(1105, 40544, 1101)
|    $ex = if ($ErrorRecord -is [System.Management.Automation.ErrorRecord]) { $ErrorRecord.Exception } elseif ($ErrorRecord -is [System.Exception]) { $ErrorRecord } else { $null }
|    $nums = New-Object System.Collections.Generic.List[int]
|    $texts = New-Object System.Collections.Generic.List[string]
|    while ($ex) {
|        if ($ex -is [System.Data.SqlClient.SqlException]) {
|            foreach ($er in @($ex.Errors)) { $nums.Add([int]$er.Number) }
|            $nums.Add([int]$ex.Number)
|        }
|        try { if ($ex.Data -and $ex.Data.Contains('SISqlNumbers')) { foreach ($n in @($ex.Data['SISqlNumbers'])) { $nums.Add([int]$n) } } } catch { }
|        $texts.Add([string]$ex.Message); $ex = $ex.InnerException
|    }
|    if (-not $texts.Count) { $texts.Add([string]$ErrorRecord) }
|    $t = $texts -join ' | '
|    foreach ($n in $nums) { if ($full -contains $n) { return $false } }
|    if ($t -match '(?i)has reached its size quota|could not allocate (a new page|space)') { return $false }
|    foreach ($n in $nums) { if ($codes -contains $n) { return $true } }
|    [bool]($t -match '(?i)a severe error occurred on the current command|transport-level error|connection was forcibly closed|forcibly closed by the remote host|connection reset|Connection reset by peer|broken pipe|Internal \.NET Framework Data Provider error 6|is not currently available|log for database .* is not available|connection was recovered and rowcount|\b(9001|3314|40613|40501|40197|49918|49919|49920|4083)\b')
|}
|
|function Test-SISqlConnectTransient {
|    <#
|        PURE and SELF-CONTAINED (it travels as a value; it calls nothing by name). Did the CONNECTION fail at the network /
|        transport level, before anything was sent -- so opening it again a moment later is safe? Live 2026-11-07 (an install's
|        pipeline runner, its settings read): "A network-related or instance-specific error occurred while establishing a
|        connection to SQL Server ... (provider: TCP Provider, error: 40 - Could not open a connection to SQL Server)" stopped
|        the run; every wake-up after it read the settings fine.
|          transient: SqlException 40 / 53 / 10060 / 10061 / 10065 / 11001 / 1225 / 121 / 4060 / 40613 / 40197 / 40501 /
|                     49918-49920 / -2 / 258 / 233 / 64 / 10053 / 10054, and the texts "network-related or instance-specific",
|                     "Could not open a connection to SQL Server", "error: 40" / "error: 26" / "error: 0" of a provider, "semaphore
|                     timeout", "connection attempt failed", "actively refused", "No such host is known", "server was not found".
|          never:     a refused sign-in (18456 -- a grant, not the network), a permission, a missing database by name.
|        -ErrorRecord: an ErrorRecord, an exception (SqlException numbers and inner exceptions are read) or a text.
|    #>
|    param([AllowNull()]$ErrorRecord)
|    if ($null -eq $ErrorRecord) { return $false }
|    $codes = @(40, 53, 10060, 10061, 10065, 11001, 1225, 121, 4060, 40613, 40197, 40501, 49918, 49919, 49920, -2, 258, 233, 64, 10053, 10054)
|    $ex = if ($ErrorRecord -is [System.Management.Automation.ErrorRecord]) { $ErrorRecord.Exception } elseif ($ErrorRecord -is [System.Exception]) { $ErrorRecord } else { $null }
|    $nums = New-Object System.Collections.Generic.List[int]
|    $texts = New-Object System.Collections.Generic.List[string]
|    while ($ex) {
|        if ($ex -is [System.Data.SqlClient.SqlException]) { foreach ($er in @($ex.Errors)) { $nums.Add([int]$er.Number) }; $nums.Add([int]$ex.Number) }
|        $texts.Add([string]$ex.Message); $ex = $ex.InnerException
|    }
|    if (-not $texts.Count) { $texts.Add([string]$ErrorRecord) }
|    $t = $texts -join ' | '
|    # a refused sign-in is a grant, not the network (4060 "Cannot open database ... The login failed." IS the failover class)
|    if ($nums -contains 18456 -or $t -match '(?i)Login failed for user|\b18456\b') { return $false }
|    foreach ($n in $nums) { if ($codes -contains $n) { return $true } }
|    [bool]($t -match '(?i)network-related or instance-specific error|Could not open a connection to SQL Server|\(provider: [^,]+, error: (0|26|35|40)\b|semaphore timeout|connection attempt failed|actively refused|No such host is known|server was not found or was not accessible|transport-level error|forcibly closed by the remote host|connection was forcibly closed|\b(40613|40197|40501|10060|10061|4060)\b')
|}
|
|function Get-SISqlConnectRetryWaits {
|    <# #1147: the pauses before each new attempt to READ when the connection failed at the network level (Test-SISqlConnectTransient):
|       4 more attempts over about 1.5 minutes -- a short network blip or a gateway that moved passes in seconds. #>
|    @(5, 10, 20, 45)
|}
|
|function Get-SISqlStatementRetryWaits {
|    <# The pauses before each new attempt of a statement that met an Azure SQL platform answer: 6 more attempts over about
|       9 minutes (owner 2026-10-29). A failover or a resume passes in under a minute; a log that recovers after a rollback
|       under load (the live case) takes minutes. A bound on Microsoft's errors, never on SI's own work. #>
|    @(5, 15, 30, 60, 120, 300)
|}
|
|function Test-SISqlNotYetAnswer {
|    <# PURE. Is this the refusal a database gives for a moment after its server's administrator or firewall rule changed:
|       "Login failed" (18456) or "client with IP address ... is not allowed" (40615)? #>
|    param([AllowEmptyString()][AllowNull()][string]$Text)
|    [bool]("$Text" -match '(?i)Login failed|\b18456\b|\b40615\b|is not allowed to access the server')
|}
|
|function Open-SISqlConnectionRetry {
|    <#
|        Opens a database connection with an Entra token, and tries again -- a bounded number of times (Microsoft's errors),
|        with a NEW token each time -- when the database answers
|          * "Login failed" / 18456 / 40615: its administrator or firewall rule was changed a moment ago (Test-SISqlNotYetAnswer);
|          * a transient Azure SQL fault: a failover, a serverless resume, busy, a client timeout (Test-SISqlTransientError).
|        Any other failure is thrown at once. Only the OPEN is retried -- nothing has been sent yet.
|          -Token    { param([bool]$Fresh) } -> the access token for https://database.windows.net/ ($Fresh = ask for a new one)
|          -Waits    seconds between tries (default 6 x 20 s)
|          -Connect  { param($Server, $Database, $Token) } -> an OPEN connection (tests; default: System.Data.SqlClient)
|          -ConnectTimeoutSec  the driver's own connect timeout (default 30)
|        Returns the open connection; the caller disposes it.
|    #>
|    param([Parameter(Mandatory)][string]$Server, [Parameter(Mandatory)][string]$Database, [Parameter(Mandatory)][scriptblock]$Token,
|          [int[]]$Waits = @(20, 20, 20, 20, 20, 20), [scriptblock]$Sleep, [scriptblock]$Connect, [int]$ConnectTimeoutSec = 30)
|    if (-not $Connect) {
|        $cto = $ConnectTimeoutSec
|        $Connect = {
|            param($Server, $Database, $Token)
|            # BUILT, never formatted: a server or database value is always ONE value (a ';' in it never adds a keyword).
|            # Self-contained (no function called by name -- this block travels as a value, see below).
|            $csb = New-Object System.Data.SqlClient.SqlConnectionStringBuilder
|            $h = "$Server".Trim(); if ($h.StartsWith('tcp:', [StringComparison]::OrdinalIgnoreCase)) { $h = $h.Substring(4) }
|            $ci = $h.IndexOf(','); if ($ci -ge 0) { $h = $h.Substring(0, $ci) }
|            $csb['Data Source'] = ('tcp:{0},1433' -f $h.Trim()); $csb['Initial Catalog'] = "$Database".Trim()
|            $csb['Encrypt'] = $true; $csb['TrustServerCertificate'] = $false; $csb['Connect Timeout'] = $cto
|            $cn = New-Object System.Data.SqlClient.SqlConnection($csb.ConnectionString)
|            $cn.AccessToken = $Token
|            try { $cn.Open() } catch { $cn.Dispose(); throw }
|            $cn
|        }.GetNewClosure()
|    }
|    $try = 0; $cn = $null
|    while ($true) {
|        $tok = ([string](& $Token ($try -gt 0))).Trim()
|        if (-not $tok) { throw 'the sign-in could not issue an Azure SQL token for the caller.' }
|        try { $cn = & $Connect $Server $Database $tok; break }
|        catch {
|            # SELF-CONTAINED (review 2, S3): the classification is written out here, never called by name -- this function
|            # travels as a value into connection closures (SI-DataSql.ps1) that outlive the scope that loaded this file
|            # (SI-Guard keeps one globally), where Test-SISqlNotYetAnswer / Test-SISqlTransientError are not visible: the
|            # failed open then threw "not recognized", hid the real SQL error and lost the retry. The same rules as those two.
|            $msgText = [string]$_.Exception.Message
|            $notYet = [bool]($msgText -match '(?i)Login failed|\b18456\b|\b40615\b|is not allowed to access the server')
|            $transient = $false
|            if (-not $notYet) {
|                $ex = $_.Exception
|                while ($ex) {
|                    if ($ex -is [System.Data.SqlClient.SqlException] -and @(40613, 40197, 40501, 49918, 49919, 49920, 4060, 10928, 10929, -2, 258) -contains [int]$ex.Number) { $transient = $true; break }
|                    $ex = $ex.InnerException
|                }
|                if (-not $transient) { $transient = [bool]($msgText -match 'is not currently available|Please retry the connection later|too busy|try again') }
|            }
|            if ((-not $notYet -and -not $transient) -or $try -ge @($Waits).Count) { throw }
|            $w = [int]@($Waits)[$try]; $try++
|            $why = if ($notYet) { 'does not accept this sign-in yet (its administrator or firewall rule changed a moment ago)' } else { ('is not available for a moment ({0})' -f (([string]$_.Exception.Message -split "`n")[0].Trim())) }
|            Write-Host ('       the database {0} {1} -- waiting {2} s and trying again ({3}/{4}) ...' -f $Database, $why, $w, $try, @($Waits).Count) -ForegroundColor DarkYellow
|            if ($w -gt 0) { if ($Sleep) { & $Sleep $w } else { Start-Sleep -Seconds $w } }
|        }
|    }
|    $cn
|}
'@ }
$__siSupportFiles['engine/_shared/SI-OutboundTrust.ps1'] = @{ Sha256 = '34fe997008df9445c117d2c98cdf791cb808bf4acc3277a0543851b01d290217'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT -- WHERE A CREDENTIAL MAY GO. PURE checks, each returning '' (allowed) or the reason in plain words.
|    The engine uses them where it sends a token, a key or the install's own credential; a value one of them refuses is left
|    out of the run and said (a warning), never the end of the run. The web app checks the same rules when a person saves a
|    setting (pro-management/src/SI.Management.Web/Settings/OutboundHostPolicy.cs).
|
|      Test-SIAzureSqlHost            the SQL server the engine sends its Azure SQL access token to: an Azure SQL host
|      Test-SITelemetryEndpointHost   the uplink the install key goes to: https, invardia.com or a subdomain of it
|      Test-SIHttpsSameOrigin         a connector's request or next page: https, the same host and port as its own base address
|      Test-SISqlDatabaseName         a database name, never a connection-string fragment
|      New-SISqlConnectionString      the Azure SQL connection string, built (never formatted) from the server and database
|
|    Strict-mode safe; PS 5.1 and 7.
|#>
|
|function Get-SIAzureSqlHostSuffixes { @('.database.windows.net', '.database.usgovcloudapi.net', '.database.chinacloudapi.cn', '.database.cloudapi.de') }
|
|function Get-SISqlServerHostName {
|    <# PURE. 'tcp:<host>,<port>' / '<host>,<port>' / '<host>' -> '<host>' (lower case). #>
|    param([AllowEmptyString()][string]$Server = '')
|    $h = "$Server".Trim()
|    if ($h.StartsWith('tcp:', [StringComparison]::OrdinalIgnoreCase)) { $h = $h.Substring(4) }
|    $c = $h.IndexOf(','); if ($c -ge 0) { $h = $h.Substring(0, $c) }
|    $h.Trim().ToLowerInvariant()
|}
|
|function Test-SIAzureSqlHost {
|    <# PURE. '' = -Server is an Azure SQL server (public or sovereign cloud) the engine's SQL access token may go to. #>
|    param([AllowEmptyString()][string]$Server = '')
|    $h = Get-SISqlServerHostName -Server $Server
|    if (-not $h) { return 'no SQL server is named' }
|    if ($h -notmatch '^[a-z0-9.-]+$') { return ("'{0}' is not a SQL server name" -f "$Server".Trim()) }
|    foreach ($s in (Get-SIAzureSqlHostSuffixes)) { if ($h.EndsWith($s) -and $h.Length -gt $s.Length) { return '' } }
|    ("'{0}' is not an Azure SQL server (<name>.database.windows.net)" -f $h)
|}
|
|function Test-SISqlDatabaseName {
|    <# PURE. '' = -Database is a database name (1-128 characters, no ; = quote bracket brace or control character). #>
|    param([AllowEmptyString()][string]$Database = '')
|    $d = "$Database".Trim()
|    if (-not $d) { return 'no database is named' }
|    if ($d.Length -gt 128 -or $d -match '[;=''"\[\]{}\x00-\x1f]') { return ("'{0}' is not a database name" -f $d) }
|    ''
|}
|
|function New-SISqlConnectionString {
|    <#
|        PURE. The connection string for an Azure SQL database with an Entra token: built with SqlConnectionStringBuilder, so a
|        server or database value is always ONE value (a ';' in it can never add a keyword). Encrypted, the certificate checked.
|    #>
|    param([Parameter(Mandatory)][string]$Server, [Parameter(Mandatory)][string]$Database, [int]$ConnectTimeoutSec = 30)
|    $csb = New-Object System.Data.SqlClient.SqlConnectionStringBuilder
|    $csb['Data Source'] = ('tcp:{0},1433' -f (Get-SISqlServerHostName -Server $Server))
|    $csb['Initial Catalog'] = "$Database".Trim()
|    $csb['Encrypt'] = $true; $csb['TrustServerCertificate'] = $false; $csb['Connect Timeout'] = $ConnectTimeoutSec
|    $csb.ConnectionString
|}
|
|function Test-SITelemetryEndpointHost {
|    <# PURE. '' = -Endpoint is Invardia's own https address (invardia.com or a subdomain) -- the only place the install key goes. #>
|    param([AllowEmptyString()][string]$Endpoint = '')
|    $e = "$Endpoint".Trim()
|    if (-not $e) { return 'no endpoint is set' }
|    $u = $null
|    if (-not [Uri]::TryCreate($e, [UriKind]::Absolute, [ref]$u)) { return ("'{0}' is not an address" -f $e) }
|    if ($u.Scheme -ne 'https') { return ("'{0}' is not https" -f $e) }
|    if ($u.UserInfo) { return ("'{0}' carries a user name" -f $u.Host) }
|    $h = $u.Host.ToLowerInvariant()
|    if ($h -eq 'invardia.com' -or $h.EndsWith('.invardia.com')) { return '' }
|    ("'{0}' is not an Invardia address" -f $u.Host)
|}
|
|function Test-SIHttpsSameOrigin {
|    <# PURE. '' = -Url is https with the same host and port as -BaseUrl (which must be https itself). #>
|    param([AllowEmptyString()][string]$Url = '', [AllowEmptyString()][string]$BaseUrl = '')
|    $b = $null; $u = $null
|    if (-not [Uri]::TryCreate("$BaseUrl".Trim(), [UriKind]::Absolute, [ref]$b) -or $b.Scheme -ne 'https') { return 'the connector''s base address is not an https address' }
|    if (-not [Uri]::TryCreate("$Url".Trim(), [UriKind]::Absolute, [ref]$u)) { return ("'{0}' is not an address" -f $Url) }
|    if ($u.Scheme -ne 'https') { return ("'{0}' is not https" -f $u.GetLeftPart([UriPartial]::Authority)) }
|    if ($u.UserInfo) { return ("'{0}' carries a user name" -f $u.Host) }
|    if (-not [string]::Equals($u.Host, $b.Host, [StringComparison]::OrdinalIgnoreCase) -or $u.Port -ne $b.Port) {
|        return ("'{0}' is not the connector's own host ({1})" -f $u.Authority, $b.Authority)
|    }
|    ''
|}
'@ }
$__siSupportFiles['engine/asset-profiling/shared/Send-SIRunHealthRow.ps1'] = @{ Sha256 = 'a0f0c591fb7c9cc69951e3dca3bafaebc59369551b01ffb83a1f899b86373941'; Text = @'
|#Requires -Version 5.1
|<#
|    Per-shard heartbeat to LA. Emits one row to SI_RunHealth_CL at the
|    Start of every replica run, and a second row at End -- success or
|    failure. The MISSING end-row is itself the signal that a replica
|    OOM'd / got killed before it could finish (KQL: where Phase=='Start'
|    | join kind=leftanti (... where Phase=='End') on RunId, ShardIndex).
|
|    Best-effort: any failure to ship the heartbeat is swallowed (silent),
|    because telemetry must NEVER kill the run it's measuring.
|
|    Schema:
|      RunId, Engine, ShardIndex, ShardCount, Phase=Start|End,
|      AssetCount, PeakWorkingSetMB, DurationSec, ExitReason,
|      ErrorMessage, Computer, CollectionTime
|#>
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '../../_shared/SI-AzRest.ps1') }
|
|# SI's log-ingest wrappers (Send-SILogData, Update-SILogTableSchema, Get-SIDceList, ...): plain REST,
|# no PowerShell modules. Loaded once; a caller that already has them keeps its own.
|if (-not (Get-Command -Name Send-SILogData -ErrorAction SilentlyContinue)) {
|    . (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) '_shared/SI-LogIngest.ps1')
|}
|
|# #226 -- the telemetry run report goes out at this same END moment (Send-SITelemetryRunEnd, from the finally below).
|# Loading it must never break the run-health record: a missing or broken file only means no telemetry.
|if (-not (Get-Command -Name Send-SITelemetryRunEnd -ErrorAction SilentlyContinue)) {
|    try { . (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) '_shared/SI-TelemetrySend.ps1') } catch { }
|}
|# #277 -- the guard events (Send-SIGuardEvent): every engine that records its run health can report a tripped guard.
|if (-not (Get-Command -Name Send-SIGuardEvent -ErrorAction SilentlyContinue)) {
|    try { . (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) '_shared/SI-Guard.ps1') } catch { }
|}
|
|# #532 -- THROTTLE-IS-NORMAL (framework §12.18): a run that failed ONLY because Microsoft throttled it (429 / 5xx /
|# timeouts) and wrote nothing ends 'throttled', not 'error'; the one "stuck" alert. Loading it must never break the record.
|if (-not (Get-Command -Name Resolve-SIThrottledExitReason -ErrorAction SilentlyContinue)) {
|    try { . (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) '_shared/SI-Throttle.ps1') } catch { }
|}
|
|function Resolve-SIRunHealthExitReason {
|    <# PURE. The END record's ExitReason (#532): 'error' becomes 'throttled' when every failure the message names is
|       throttling / service-side, and the run wrote nothing:
|         * a COLLECTING engine (it reads Microsoft's services and writes its result in one output stage at the end:
|           the profilers, the tier classifier, schema discovery, the trend) that did not fail in a stage that writes
|           (RunContext.FailedStep) and did not say it wrote part of its result (RunContext.WrotePartial);
|         * any other engine (one that APPLIES changes -- SQL, ServiceNow, Defender, the data sync) ONLY when it says so
|           itself (RunContext.WroteNothing = $true): a partial apply is a real failure, so it is never assumed.
|       Risk Analysis is not in the list: it publishes report by report, and a throttled query already ends its run
|       'success-partial' (a warning, its findings unknown). Every other value is returned as given. #>
|    param([AllowNull()]$RunContext, [AllowEmptyString()][string]$ExitReason, [AllowEmptyString()][string]$ErrorMessage)
|    if (-not (Get-Command -Name Resolve-SIThrottledExitReason -ErrorAction SilentlyContinue)) { return $ExitReason }
|    $step = ''; $partial = $false; $nothing = $false; $engine = ''
|    if ($RunContext) {
|        if ($RunContext.PSObject.Properties['Engine']) { $engine = ([string]$RunContext.Engine).Trim().ToLowerInvariant() }
|        if ($RunContext.PSObject.Properties['FailedStep']) { $step = [string]$RunContext.FailedStep }
|        if ($RunContext.PSObject.Properties['WrotePartial']) { $partial = [bool]$RunContext.WrotePartial }
|        if ($RunContext.PSObject.Properties['WroteNothing']) { $nothing = [bool]$RunContext.WroteNothing }
|    }
|    $collecting = @('endpoint', 'identity', 'azure', 'publicip', 'privilege-tier-classifier', 'schema-discovery', 'asset-trend', 'trend') -contains $engine
|    if (-not $collecting -and -not $nothing) { return $ExitReason }
|    Resolve-SIThrottledExitReason -ExitReason $ExitReason -ErrorMessage $ErrorMessage -FailedStep $step -WrotePartial:$partial
|}
|
|# #276 -- the dry-run lines (Get-SIDryRunNoticeText). Loading it must never break the run-health record either.
|if (-not (Get-Command -Name Get-SIDryRunNoticeText -ErrorAction SilentlyContinue)) {
|    try { . (Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) '_shared/SI-FirstRun.ps1') } catch { }
|}
|
|function Get-SIRunHealthDryRunRow {
|    <#
|        PURE. #276: what a DRY RUN's run-health row says. A dry run publishes nothing, but its health row IS written so the
|        run-health views show that the run happened and was a dry run: the End record's ExitReason is 'dry-run' when the
|        run itself went well (success / success-partial / nothing given), and a failure keeps its own reason so a broken
|        dry run is still a failure. The message always starts with 'dry run'.
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Start', 'End')][string]$Phase, [AllowEmptyString()][string]$ExitReason, [AllowEmptyString()][string]$ErrorMessage)
|    $x = "$ExitReason".Trim()
|    $reason = $x
|    if ($Phase -eq 'End' -and ($x -eq '' -or $x -in @('success', 'success-partial'))) { $reason = 'dry-run' }
|    $msg = 'dry run -- nothing was published or sent'
|    if ("$ErrorMessage".Trim()) { $msg = $msg + '; ' + "$ErrorMessage".Trim() }
|    [pscustomobject]@{ ExitReason = $reason; ErrorMessage = $msg }
|}
|
|function Test-SIRunHealthDcrReachable {
|    <#
|        Pre-flight: verify the SI_RunHealth DCR's dataCollectionEndpointId
|        matches the DCE the engine is configured to use. Returns:
|
|          $true  -- safe to post (association OK, DCR not yet created,
|                    DCR uses workspace-default ingestion, or pre-flight
|                    inconclusive for any reason).
|          $false -- CONFIRMED mismatch; skip the post to avoid the
|                    PS>TerminatingError(...) transcript markers that the
|                    AzLogDcrIngestPS module's Invoke-WebRequest would
|                    otherwise emit when the Log Ingestion API rejects
|                    the post with "DCE FQDN is not associated with DCR".
|
|        v2.2.382 -- added because the actual post failure is caught
|        engine-side (Send-SIRunHealthRow has try/catch + Write-Verbose),
|        but PowerShell 7's transcript engine writes the terminating-error
|        marker BEFORE the catch handler runs, so it cannot be suppressed
|        from inside Send-SIRunHealthRow. Detecting the mismatch up-front
|        via Az.Accounts/Invoke-AzRestMethod (which never throws on non-2xx)
|        lets us skip the noisy call cleanly. Pre-flight failures
|        (network/auth/anything) return $true so we never suppress
|        telemetry for the wrong reason.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$SubscriptionId,
|        [Parameter(Mandatory)][string]$DcrResourceGroup,
|        [Parameter(Mandatory)][string]$DcrName,
|        [string]$DceResourceGroup,
|        [string]$DceName
|    )
|
|    # Engine config incomplete (no DCE known) -> can't compare. Proceed.
|    if ([string]::IsNullOrWhiteSpace($DceName) -or [string]::IsNullOrWhiteSpace($DceResourceGroup)) { return $true }
|
|    try {
|        $dcrPath = ('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Insights/dataCollectionRules/{2}?api-version=2023-03-11' -f `
|                        $SubscriptionId, $DcrResourceGroup, $DcrName)
|        $resp = Invoke-SIAzRestMethod -Path $dcrPath -Method GET -ErrorAction SilentlyContinue 4>$null 2>$null
|        if (-not $resp -or [int]$resp.StatusCode -ne 200) {
|            # DCR not reachable / does not exist yet / RBAC drift -- let the
|            # actual call attempt creation via CheckCreateUpdate-TableDcr-Structure.
|            return $true
|        }
|        $dcrBody = $null
|        try { $dcrBody = $resp.Content | ConvertFrom-Json -ErrorAction Stop } catch { return $true }
|        $boundDceId = [string]$dcrBody.properties.dataCollectionEndpointId
|        if ([string]::IsNullOrWhiteSpace($boundDceId)) {
|            # DCR uses workspace-default ingestion (no explicit DCE) -- post will work.
|            return $true
|        }
|        $expectedDceId = ('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Insights/dataCollectionEndpoints/{2}' -f `
|                            $SubscriptionId, $DceResourceGroup, $DceName)
|        if ($boundDceId -ieq $expectedDceId) { return $true }
|
|        # #198 -- SAID ONCE, OUT LOUD. This was Write-Verbose, so a mismatched rule dropped every run-health
|        # record silently: measured 2026-10-01, SI_RunHealth_CL held 0 rows in 30 days, and nothing that reads
|        # it (crash detection, "was the run complete") could work. The post is still skipped -- it would fail --
|        # but the run now says so, once, with the fix.
|        if (-not $global:SI_RunHealthMismatchWarned) {
|            $global:SI_RunHealthMismatchWarned = $true
|            Write-Warning ("Run-health records are not being saved: the data collection rule '{0}' sends to a different data collection endpoint ({1}) than this install uses ({2}). Point `$global:SI_RunHealth_DcrName at a rule on this install's endpoint (a new name is created automatically), or rebind the rule." -f `
|                            $DcrName, $boundDceId, $expectedDceId)
|        }
|        return $false
|    } catch {
|        # Pre-flight itself errored -- don't suppress telemetry on a false negative.
|        Write-Verbose ('Send-SIRunHealthRow: pre-flight error (proceeding anyway) -- {0}' -f $_.Exception.Message)
|        return $true
|    }
|}
|
|function Select-SIRunHealthIngestTarget {
|    <#
|    .SYNOPSIS
|        Narrows $global:AzDceDetails / $global:AzDcrDetails to THIS install's endpoint and rule (subscription +
|        resource group + name) before AzLogDcrIngestPS sees them.
|    .DESCRIPTION
|        #198. AzLogDcrIngestPS resolves the endpoint by NAME ONLY -- the first match in its cache, or in a
|        tenant-wide Resource Graph query when the cache is empty. With several endpoints sharing a name (measured
|        2026-10-01: three called dce-securityinsight in two subscriptions), CheckCreateUpdate-TableDcr-Structure
|        re-bound the run-health rule to the wrong one on every run, and every post after that was refused.
|        Returns $true when the endpoint is pinned AND, when a rule is named, the rule is in the cache too (the
|        caller may create/update/post); $false otherwise -- the caller rebuilds the cache rather than let the
|        module guess. -AllowMissingDcr accepts a pinned endpoint whose rule does not exist YET (first run: the
|        create step makes it).
|        🪤 The cache is SHARED with the engine's other publishers: SI-LogIngest's Select-SIIngestTarget narrows
|        $global:AzDcrDetails to ITS rule. Measured 2026-10-02: after the azure engine's Defender for Cloud publish
|        the run-health rule was gone from the cache, the post ran with an empty immutable id, and every azure run
|        left a Start with no End -- crash detection would call each one a crash.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$SubscriptionId,
|        [Parameter(Mandatory)][string]$DceResourceGroup,
|        [Parameter(Mandatory)][string]$DceName,
|        [string]$DcrResourceGroup,
|        [string]$DcrName,
|        [switch]$AllowMissingDcr
|    )
|    $dce = @($global:AzDceDetails | Where-Object {
|        $_ -and $_.name -eq $DceName -and
|        [string]$_.id -like "/subscriptions/$SubscriptionId/resourceGroups/$DceResourceGroup/*"
|    }) | Select-Object -First 1
|    if (-not $dce) {
|        # One endpoint of that name anywhere is unambiguous -- an endpoint outside the rules' resource group.
|        $same = @($global:AzDceDetails | Where-Object { $_ -and $_.name -eq $DceName })
|        if ($same.Count -ne 1) { return $false }
|        $dce = $same[0]
|    }
|    $global:AzDceDetails = @($dce)
|    if ($DcrName -and $DcrResourceGroup) {
|        $dcr = @($global:AzDcrDetails | Where-Object {
|            $_ -and $_.name -eq $DcrName -and
|            [string]$_.id -like "/subscriptions/$SubscriptionId/resourceGroups/$DcrResourceGroup/*"
|        }) | Select-Object -First 1
|        if ($dcr) { $global:AzDcrDetails = @($dcr) }
|        elseif (-not $AllowMissingDcr) { return $false }
|        else {
|            # #281 -- the rule does not exist HERE yet: a rule of the same name in another resource group or subscription
|            # (another install in the tenant; the module's rule list is tenant-wide) must not stand in for it. The
|            # module's create step looks the rule up by NAME in this cache, so with the foreign one left in, it reports
|            # "rule exists", creates nothing, and every post after it is lost. The other publishers' rules stay.
|            $global:AzDcrDetails = @($global:AzDcrDetails | Where-Object { $_ -and $_.name -ne $DcrName })
|        }
|    }
|    return $true
|}
|
|function Resolve-SIRunHealthSubscriptionId {
|    <#
|        #281. The subscription the run-health rule and endpoint are looked up in. The first that has one:
|        SI_AzSubscriptionId, the subscription in SI_WorkspaceResourceId, the job's SI_WORKSPACE_RESOURCEID,
|        SI_JOBS_SUBSCRIPTIONID / SI_FLOW_SUBSCRIPTIONID, the signed-in Az context. '' when none.
|        The container entry points set SI_AzSubscriptionId (Initialize-SIContainerIngestGlobals); this is the defensive
|        second line for any host or entry that did not -- live 2026-10-05 no container had it, and every profiler run lost
|        its record to "Cannot bind argument to parameter 'SubscriptionId' because it is an empty string".
|    #>
|    if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_AzSubscriptionId)) { return ([string]$global:SI_AzSubscriptionId).Trim() }
|    foreach ($w in @([string]$global:SI_WorkspaceResourceId, [string]$env:SI_WORKSPACE_RESOURCEID)) {
|        if ($w -match '/subscriptions/([^/]+)/') { return $Matches[1] }
|    }
|    foreach ($j in @([string]$env:SI_JOBS_SUBSCRIPTIONID, [string]$env:SI_FLOW_SUBSCRIPTIONID)) {
|        if (-not [string]::IsNullOrWhiteSpace($j)) { return $j.Trim() }
|    }
|    try {
|        if (Get-Command -Name Get-SIAzContext -ErrorAction SilentlyContinue) {
|            $s = [string](Get-SIAzContext -ErrorAction SilentlyContinue).Subscription.Id
|            if ($s) { return $s }
|        }
|    } catch { }
|    return ''
|}
|
|function Get-SIRunHealthDcrFromArm {
|    <#
|        #281. The run-health rule read straight from Azure (by its id: subscription + resource group + name), shaped as the
|        ingest module's rule cache holds it (name, id, location, properties) -- or $null. Used when the rule list does
|        not have it yet: the module's list is Azure Resource Graph, which shows a rule created seconds ago only after a
|        delay, so the first post after the create found nothing and was lost. Never throws.
|    #>
|    param([Parameter(Mandatory)][string]$SubscriptionId, [Parameter(Mandatory)][string]$ResourceGroup, [Parameter(Mandatory)][string]$Name)
|    try {
|        $p = ('/subscriptions/{0}/resourceGroups/{1}/providers/Microsoft.Insights/dataCollectionRules/{2}?api-version=2023-03-11' -f $SubscriptionId, $ResourceGroup, $Name)
|        $r = Invoke-SIAzRestMethod -Path $p -Method GET -ErrorAction SilentlyContinue 4>$null 2>$null
|        if (-not $r -or [int]$r.StatusCode -ne 200) { return $null }
|        $o = $r.Content | ConvertFrom-Json -ErrorAction Stop
|        if (-not $o -or -not $o.id) { return $null }
|        return $o
|    } catch { return $null }
|}
|
|function ConvertTo-SIRunHealthUtc {
|    <#
|        PURE. A run's CollectionTime as a [datetime] of kind Utc. The callers hand it over in UTC -- Risk Analysis and
|        the tier classifier as an un-zoned 'yyyy-MM-dd HH:mm:ss' string, the profiling engines as a Utc [datetime].
|        A plain [datetime] cast of the string gives kind Unspecified, which the serializer treats as LOCAL time and
|        converts again: measured 2026-10-02 on a UTC+2 host, every risk-analysis record was stamped 2 h early, so
|        no record covered its own snapshot and the vulnerability close-loop (#195) could never close anything.
|    #>
|    param([Parameter(Mandatory)][object]$Value)
|    if ($Value -is [datetime]) {
|        if ($Value.Kind -eq [DateTimeKind]::Local) { return $Value.ToUniversalTime() }
|        return [datetime]::SpecifyKind($Value, [DateTimeKind]::Utc)
|    }
|    $styles = [Globalization.DateTimeStyles]::AssumeUniversal -bor [Globalization.DateTimeStyles]::AdjustToUniversal
|    [datetime]::Parse([string]$Value, [Globalization.CultureInfo]::InvariantCulture, $styles)
|}
|
|function Get-SIRunHealthExecution {
|    <#
|        PURE over -RunContext / -Environment. The Container Apps job EXECUTION this run is (#269): the run context's
|        Execution when it carries one, else CONTAINER_APP_JOB_EXECUTION_NAME (Azure sets it in every job execution),
|        else '' (a VM). The flow runner reads it back from the START record to tell a container that never ran the engine
|        (an Azure platform failure, started again) from an engine that failed (never started again).
|    #>
|    param($RunContext, [System.Collections.IDictionary]$Environment)
|    if ($RunContext -and $RunContext.PSObject.Properties['Execution'] -and "$($RunContext.Execution)") { return [string]$RunContext.Execution }
|    $v = if ($Environment) { $Environment['CONTAINER_APP_JOB_EXECUTION_NAME'] } else { [Environment]::GetEnvironmentVariable('CONTAINER_APP_JOB_EXECUTION_NAME') }
|    if ($v) { [string]$v } else { '' }
|}
|
|function Get-SIRunHealthBuild {
|    <#
|        The build this run is (BUILD.json, stamped at build/package time -- engine\_shared\SI-BuildInfo.ps1): Version is
|        the display version ("3.0.0-rc.12", or the VERSION file when nothing was stamped), Build the short commit ('' when
|        unknown). -SolutionRoot is a test seam. Cached per process; never throws, never asks git.
|    #>
|    param([string]$SolutionRoot)
|    if (-not $SolutionRoot -and $script:SIRunHealthBuild) { return $script:SIRunHealthBuild }
|    $out = [pscustomobject]@{ Version = ''; Build = '' }
|    try {
|        $root = if ($SolutionRoot) { $SolutionRoot } else { Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) }
|        if (-not (Get-Command -Name Read-SIBuildInfo -ErrorAction SilentlyContinue)) {
|            . ([System.IO.Path]::Combine($root, 'engine', '_shared', 'SI-BuildInfo.ps1'))
|        }
|        $b = Read-SIBuildInfo -SolutionRoot $root
|        if ($b.source -ne 'none') { $out.Version = [string]$b.display }
|        $out.Build = [string]$b.shortCommit
|    } catch { }
|    if (-not $SolutionRoot) { $script:SIRunHealthBuild = $out }
|    $out
|}
|
|function Send-SIRunHealthRow {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][object]$RunContext,
|        # #277: 'Guard' = a tripped guard (Send-SIGuardEvent). Every reader of run health filters Phase == 'End'.
|        [Parameter(Mandatory)][ValidateSet('Start','End','Guard')][string]$Phase,
|        [int]$AssetCount = -1,
|        [string]$ExitReason = '',
|        [string]$ErrorMessage = '',
|        # #269: a flow STEP's record -- the flow reports one telemetry run for the whole flow, not one per step
|        [switch]$NoTelemetry
|    )
|
|    # UNCONDITIONAL silence of the AzLogDcrIngestPS / Az SDK VERBOSE
|    # storm for the duration of the heartbeat. Per-call -Verbose:$false isn't
|    # enough -- the module reads $global:VerbosePreference internally. Heartbeat
|    # call traces are never useful, so silence regardless of operator -Verbose.
|    $_savedVerbosePreference = $global:VerbosePreference
|    $global:VerbosePreference = 'SilentlyContinue'
|
|    # #532 THROTTLE-IS-NORMAL: an END that failed only because Microsoft throttled it is 'throttled' -- in the record, in the
|    # telemetry report (Outcome warning, no fix request) and for the stuck check below. Decided before anything is written.
|    if ($Phase -eq 'End') {
|        try {
|            $resolved = Resolve-SIRunHealthExitReason -RunContext $RunContext -ExitReason $ExitReason -ErrorMessage $ErrorMessage
|            if ($resolved -eq 'throttled' -and $ExitReason -ne 'throttled') {
|                $ExitReason = 'throttled'
|                # only a real throttling answer gets here (Get-SITransientKind via Resolve-SIThrottledExitReason): a timeout or an
|                # unreachable service stays 'error' with its own text
|                $why = Get-SIThrottleText
|                $ErrorMessage = '{0} | {1}' -f $why, $ErrorMessage
|                try { Write-Host (' [INFO] {0}' -f $why) -ForegroundColor Yellow } catch { }
|            }
|        } catch { }
|    }
|
|    try {
|        # A dry run (-WhatIfMode, #257) publishes no results -- but it is SAID, loudly, at its start and at its end, and
|        # its health row is written as a dry run so the run-health views show it (#276). Once per process per moment.
|        $rowExit = $ExitReason; $rowMsg = $ErrorMessage
|        if ([bool]$global:WhatIfMode) {
|            $flag = if ($Phase -eq 'Start') { 'SI_DryRunStartSaid' } else { 'SI_DryRunEndSaid' }
|            if (-not (Get-Variable -Name $flag -Scope Global -ValueOnly -ErrorAction SilentlyContinue)) {
|                Set-Variable -Name $flag -Scope Global -Value $true
|                $txt = if (Get-Command -Name Get-SIDryRunNoticeText -ErrorAction SilentlyContinue) { Get-SIDryRunNoticeText -Moment $Phase } else { 'DRY RUN -- nothing was published or sent.' }
|                try { Write-Host $txt -ForegroundColor Yellow -BackgroundColor DarkRed } catch { }
|            }
|            $dry = Get-SIRunHealthDryRunRow -Phase $Phase -ExitReason $ExitReason -ErrorMessage $ErrorMessage
|            $rowExit = $dry.ExitReason; $rowMsg = $dry.ErrorMessage
|        }
|
|        # Engine bootstrap may have failed before LA globals were set; bail silently
|        # if we don't have what we need to ship.
|        if (-not $global:SI_WorkspaceResourceId -or -not $global:SI_DceName -or -not $global:SI_DcrResourceGroup) {
|            # #198 -- said once, not silent: a run that never has these never records its health at all. Only when a
|            # workspace IS configured -- no workspace at all is a deliberate file-only setup, not a fault.
|            if ($global:SI_WorkspaceResourceId -and -not $global:SI_RunHealthFailWarned) {
|                $global:SI_RunHealthFailWarned = $true
|                Write-Warning 'Run-health record not saved: SI_WorkspaceResourceId, SI_DceName or SI_DcrResourceGroup is not set.'
|            }
|            return
|        }
|
|        # #281 -- the subscription, resolved in every host (a container had none: live 2026-10-05, every profiler and flow
|        # run failed here with "Cannot bind argument to parameter 'SubscriptionId' because it is an empty string").
|        # Filled back into SI_AzSubscriptionId so the rest of the run has it too. None at all: said once, not saved.
|        $subId = Resolve-SIRunHealthSubscriptionId
|        if (-not $subId) {
|            if (-not $global:SI_RunHealthFailWarned) {
|                $global:SI_RunHealthFailWarned = $true
|                Write-Warning 'Run-health record not saved: no subscription is known for the Log Analytics workspace (set SI_AzSubscriptionId, or a full SI_WorkspaceResourceId).'
|            }
|            return
|        }
|        if (-not $global:SI_AzSubscriptionId) { $global:SI_AzSubscriptionId = $subId }
|        # The endpoint lives with the rules unless the install says otherwise (an empty value failed the same way).
|        $dceRg = if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_DceResourceGroup)) { [string]$global:SI_DceResourceGroup } else { [string]$global:SI_DcrResourceGroup }
|
|        # Memory: PS 5.1 [System.Diagnostics.Process].WorkingSet64 is current process bytes.
|        # Use PeakWorkingSet64 so a brief peak isn't lost between heartbeat reads.
|        $peakMb = -1
|        try {
|            $proc = [System.Diagnostics.Process]::GetCurrentProcess()
|            $peakMb = [int]([Math]::Round($proc.PeakWorkingSet64 / 1MB))
|        } catch { }
|
|        $duration = if ($RunContext.StartedAt) {
|            [int]([datetime]::UtcNow - $RunContext.StartedAt).TotalSeconds
|        } else { 0 }
|
|        $hostName = $env:COMPUTERNAME
|        if (-not $hostName) { $hostName = [System.Net.Dns]::GetHostName() }
|
|        # v2.2.365 -- cast CollectionTime to [datetime] so AzLogDcrIngestPS derives
|        # the column as DateTime in BOTH the streamDeclarations + transformKql when
|        # auto-creating the DCR. Previously the runtime value was a string, which
|        # caused AzLogDcrIngestPS's schema derivation to pick DateTime for one
|        # side but String for the other -- the resulting DCR spec failed Azure's
|        # InvalidPayload validation ('CollectionTime [produced:String, output:DateTime]')
|        # and the DCR was never created. Engine-side cast forces consistent type.
|        $siBuild = Get-SIRunHealthBuild
|        $row = [pscustomobject]@{
|            CollectionTime    = ConvertTo-SIRunHealthUtc $RunContext.CollectionTime
|            RunId             = [string]$RunContext.RunId
|            Engine            = [string]$RunContext.Engine
|            ShardIndex        = [long]$RunContext.ShardIndex
|            ShardCount        = [long]$RunContext.ShardCount
|            Phase             = $Phase
|            AssetCount        = [long]$AssetCount
|            PeakWorkingSetMB  = [long]$peakMb
|            DurationSec       = [long]$duration
|            ExitReason        = $rowExit
|            ErrorMessage      = $rowMsg
|            Computer          = $hostName
|            # #269: the job execution (a container; '' on a VM) -- a NEW column, added to the table by the schema
|            # update below; readers that do not know it are unaffected (the flow reads it with column_ifexists)
|            Execution         = [string](Get-SIRunHealthExecution -RunContext $RunContext)
|            # the build that wrote this row (BUILD.json): additive columns, like Execution -- readers that do not know them
|            # are unaffected
|            SolutionVersion   = [string]$siBuild.Version
|            Build             = [string]$siBuild.Build
|            # the engine's own permission self-check (engine\_shared\SI-PermissionCheck.ps1), on its END record: the gaps and
|            # what could not be checked, as JSON ('' = no check ran in this process). Additive like the columns above;
|            # Get Started > Permissions reads it.
|            PermissionGaps    = [string]$(if (Get-Command -Name Get-SIRunHealthPermissionGaps -ErrorAction SilentlyContinue) { Get-SIRunHealthPermissionGaps -RunContext $RunContext -Phase $Phase } else { '' })
|        }
|
|        # Auth resolution mirrors Invoke-Output.ps1: MI / SPN+Cert / SPN+Secret.
|        # v2.2.237 -- cert path added (AzLogDcrIngestPS module accepts cert directly).
|        # #281 -- then Risk Analysis' own names (Spn*): its container entry point kept the identity only there, and an
|        # empty app id makes the ingest module skip the create SILENTLY (no rule, no error, every post lost).
|        $spnAppId      = if ($global:SI_SPN_AppId)    { $global:SI_SPN_AppId }    elseif ($global:SI_LogIngest_AppId)    { $global:SI_LogIngest_AppId }    else { $global:SpnClientId }
|        $spnSecret     = if ($global:SI_SPN_Secret)   { $global:SI_SPN_Secret }   elseif ($global:SI_LogIngest_Secret)   { $global:SI_LogIngest_Secret }   else { $global:SpnClientSecret }
|        $spnTenantId   = if ($global:SI_SPN_TenantId) { $global:SI_SPN_TenantId } elseif ($global:SI_LogIngest_TenantId) { $global:SI_LogIngest_TenantId } else { $global:SpnTenantId }
|        $spnObjectId   = if ($global:SI_SPN_ObjectId) { $global:SI_SPN_ObjectId } else { $global:SI_LogIngest_ObjectId }
|        $spnCertThumb  = [string]$global:SI_SPN_CertThumbprint
|        # v2.2.243 -- auto-detect cert store (LocalMachine vs CurrentUser).
|        $spnCertStore  = if ($global:SI_SPN_CertStoreLocation) { [string]$global:SI_SPN_CertStoreLocation }
|                         elseif ($spnCertThumb) {
|                             $_clean = $spnCertThumb -replace '\s',''
|                             if (Get-PSDrive -Name Cert -ErrorAction SilentlyContinue) {
|                                 $_resolved = 'LocalMachine'
|                                 foreach ($_s in 'LocalMachine','CurrentUser') {
|                                     $_c = Get-ChildItem "Cert:\$_s\My" -ErrorAction SilentlyContinue |
|                                           Where-Object { $_.Thumbprint -eq $_clean -and $_.HasPrivateKey } |
|                                           Select-Object -First 1
|                                     if ($_c) { $_resolved = $_s; break }
|                                 }
|                                 $_resolved
|                             } else {
|                                 # #209: no Cert: drive (a Linux container) -- read the X509Store instead.
|                                 if (-not (Get-Command Get-SICertStoreLocation -ErrorAction SilentlyContinue)) {
|                                     . (Join-Path (Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))) 'auth/Find-SICertificate.ps1')
|                                 }
|                                 Get-SICertStoreLocation -Thumbprint $_clean
|                             }
|                         } else { 'LocalMachine' }
|
|        $useMi   = $global:SI_PreferUami -and -not [string]::IsNullOrWhiteSpace($global:SI_UAMI_ClientId)
|        $useCert = -not $useMi -and -not [string]::IsNullOrWhiteSpace($spnCertThumb)
|        $authParams = if ($useMi) {
|            @{ UseManagedIdentity = $true; ManagedIdentityClientId = $global:SI_UAMI_ClientId }
|        } elseif ($useCert) {
|            @{
|                AzAppId                       = $spnAppId
|                AzAppCertificateThumbprint    = $spnCertThumb
|                AzAppCertificateStoreLocation = $spnCertStore
|                TenantId                      = $spnTenantId
|            }
|        } else {
|            @{ AzAppId = $spnAppId; AzAppSecret = $spnSecret; TenantId = $spnTenantId }
|        }
|        # #281 -- an identity the ingest module would refuse WITHOUT saying so (no app id, or neither a certificate nor a
|        # secret) is said once here instead of being found 30 days later as an empty table.
|        if (-not $useMi -and ([string]::IsNullOrWhiteSpace([string]$spnAppId) -or ((-not $useCert) -and [string]::IsNullOrWhiteSpace([string]$spnSecret)))) {
|            if (-not $global:SI_RunHealthFailWarned) {
|                $global:SI_RunHealthFailWarned = $true
|                Write-Warning 'Run-health record not saved: no sign-in identity for Log Analytics (an app id with a certificate or secret, or a managed identity).'
|            }
|            return
|        }
|
|        # Table is workspace-scoped (no cross-sub collision), so the name stays.
|        # DCR is name-looked-up across all subs the SPN sees, so it MUST be
|        # unique when one SPN spans internal + community tenants.
|        $tableName = 'SI_RunHealth'
|        $dcrName   = if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_RunHealth_DcrName)) { [string]$global:SI_RunHealth_DcrName } else { 'dcr-si-run-health' }
|
|        # v2.2.382 -- pre-flight check the DCR/DCE association before calling
|        # AzLogDcrIngestPS. The actual post failure is already caught by the
|        # outer try/catch in this function, but PowerShell 7's transcript
|        # engine writes PS>TerminatingError(...) markers BEFORE the catch
|        # handler runs, so they cannot be suppressed from inside the catch.
|        # Pre-flight via Invoke-AzRestMethod (non-throwing) lets us skip the
|        # noisy call cleanly when we can confirm the DCR is bound to a
|        # different DCE than the engine uses. ANY pre-flight failure (network,
|        # auth, 404, ...) returns $true so telemetry is never suppressed for
|        # the wrong reason.
|        if (-not (Test-SIRunHealthDcrReachable `
|                        -SubscriptionId   $subId `
|                        -DcrResourceGroup $global:SI_DcrResourceGroup `
|                        -DcrName          $dcrName `
|                        -DceResourceGroup $dceRg `
|                        -DceName          $global:SI_DceName)) {
|            return
|        }
|
|        # #198 -- pin the endpoint BEFORE the module touches the rule. The module resolves the endpoint by name
|        # only; unpinned, CheckCreateUpdate re-bound this rule to a same-named endpoint in another subscription.
|        # An empty or foreign cache is rebuilt from this subscription; if the endpoint is still not found, the
|        # module is not allowed to guess -- said once, and the post is skipped.
|        if (-not (Select-SIRunHealthIngestTarget -SubscriptionId $subId `
|                    -DceResourceGroup $dceRg -DceName $global:SI_DceName `
|                    -DcrResourceGroup $global:SI_DcrResourceGroup -DcrName $dcrName)) {
|            try { $global:AzDceDetails = Get-SIDceList @authParams -Verbose:$false 4>$null } catch { }
|            try { $global:AzDcrDetails = Get-SIDcrList @authParams -Verbose:$false 4>$null } catch { }
|            # After a rebuild a rule that does not exist yet is fine -- the create step below makes it.
|            if (-not (Select-SIRunHealthIngestTarget -SubscriptionId $subId `
|                        -DceResourceGroup $dceRg -DceName $global:SI_DceName `
|                        -DcrResourceGroup $global:SI_DcrResourceGroup -DcrName $dcrName -AllowMissingDcr)) {
|                if (-not $global:SI_RunHealthFailWarned) {
|                    $global:SI_RunHealthFailWarned = $true
|                    Write-Warning ("Run-health record not saved: the data collection endpoint '{0}' was not found in resource group '{1}' of subscription '{2}'." -f `
|                                    $global:SI_DceName, $dceRg, $subId)
|                }
|                return
|            }
|        }
|
|        # Provision/update DCR + table from the single-row schema sample. AzLogDcrIngestPS
|        # is idempotent so the per-replica overhead after first-run is just a cache hit.
|        # 4>$null on each call suppresses the AzLogDcrIngestPS / Az SDK VERBOSE storm
|        # (POST/GET URLs + byte counts). Stream-redirect is needed because the Az SDK
|        # writes via Write-Verbose internally and ignores the function-scoped preference
|        # when called in nested module contexts.
|        $null = Update-SILogTableSchema `
|            -AzLogWorkspaceResourceId                   $global:SI_WorkspaceResourceId `
|            @authParams `
|            -DceName                                    $global:SI_DceName `
|            -DcrName                                    $dcrName `
|            -DcrResourceGroup                           $global:SI_DcrResourceGroup `
|            -TableName                                  $tableName `
|            -Data                                       @($row) `
|            -LogIngestServicePricipleObjectId           $spnObjectId `
|            -AzDcrSetLogIngestApiAppPermissionsDcrLevel $false `
|            -AzLogDcrTableCreateFromAnyMachine          $true `
|            -AzLogDcrTableCreateFromReferenceMachine    @() 4>$null
|
|        # Re-sync the DCE/DCR cache so a freshly-created DCR's immutableId is in
|        # $global:AzDcrDetails before Post-* runs its name-only lookup. Without
|        # this, AzLogDcrIngestPS falls back to the DCE's location field as a
|        # bogus immutableId -> 404 'westeurope' from the Log Ingestion API.
|        # Same pattern as Invoke-Output.ps1 (v2.2.65) and Invoke-RiskAnalysis.ps1.
|        try {
|            $ensureFn = Get-Command -Name 'Ensure-SecurityInsightAzDceDcrCache' -ErrorAction SilentlyContinue
|            if ($ensureFn) {
|                & $ensureFn `
|                    @authParams `
|                    -SubscriptionId   $subId `
|                    -DceResourceGroup $dceRg `
|                    -DcrResourceGroup $global:SI_DcrResourceGroup `
|                    -Force 4>$null
|            }
|        } catch { }
|
|        # Collision guard again after the cache refresh: endpoint AND rule pinned to (sub + RG + name) before
|        # Post-* runs its name-only lookups. The refresh helper above lives with Risk Analysis and is absent in the
|        # profiling engines -- so when the rule is still not in the cache, re-read the rules here; a post with no
|        # rule in the cache goes out with an EMPTY immutable id and is lost.
|        if (-not (Select-SIRunHealthIngestTarget -SubscriptionId $subId `
|                    -DceResourceGroup $dceRg -DceName $global:SI_DceName `
|                    -DcrResourceGroup $global:SI_DcrResourceGroup -DcrName $dcrName)) {
|            try { $global:AzDceDetails = Get-SIDceList @authParams -Verbose:$false 4>$null } catch { }
|            try { $global:AzDcrDetails = Get-SIDcrList @authParams -Verbose:$false 4>$null } catch { }
|            $pinned = Select-SIRunHealthIngestTarget -SubscriptionId $subId `
|                        -DceResourceGroup $dceRg -DceName $global:SI_DceName `
|                        -DcrResourceGroup $global:SI_DcrResourceGroup -DcrName $dcrName
|            if (-not $pinned) {
|                # #281 -- the rule list (Azure Resource Graph) shows a rule created seconds ago only after a delay: read
|                # it straight from Azure by its id. The endpoint is already pinned by the call above.
|                $direct = Get-SIRunHealthDcrFromArm -SubscriptionId $subId -ResourceGroup $global:SI_DcrResourceGroup -Name $dcrName
|                if ($direct) {
|                    $global:AzDcrDetails = @($direct)
|                    $pinned = Select-SIRunHealthIngestTarget -SubscriptionId $subId `
|                                -DceResourceGroup $dceRg -DceName $global:SI_DceName `
|                                -DcrResourceGroup $global:SI_DcrResourceGroup -DcrName $dcrName
|                }
|            }
|            if (-not $pinned) {
|                if (-not $global:SI_RunHealthFailWarned) {
|                    $global:SI_RunHealthFailWarned = $true
|                    Write-Warning ("Run-health record not saved: the data collection rule '{0}' was not found in resource group '{1}' of subscription '{2}'." -f `
|                                    $dcrName, $global:SI_DcrResourceGroup, $subId)
|                }
|                return
|            }
|        }
|
|        $data = @($row)
|        $data = Repair-SILogColumnName -Data $data 4>$null
|        $data = Format-SILogRowsToSchema -Data $data 4>$null
|        $null = Send-SILogData `
|            -DceName     $global:SI_DceName `
|            -DcrName     $dcrName `
|            -Data        $data `
|            -TableName   $tableName `
|            @authParams 4>$null
|    }
|    catch {
|        # Telemetry must never kill the run -- and must never fail INVISIBLY (#198). This was Write-Verbose under a
|        # verbose preference this function itself forces off, so no failure here could ever be seen; the table
|        # stayed empty for 30 days. Once per run, as a warning; the run continues.
|        if (-not $global:SI_RunHealthFailWarned) {
|            $global:SI_RunHealthFailWarned = $true
|            Write-Warning ('Run-health record could not be saved: {0}' -f $_.Exception.Message)
|        }
|    }
|    finally {
|        # #226 -- the telemetry `run` report (and the daily heartbeat), at the run-health END moment. Independent of
|        # whether the Log Analytics record above could be saved. Send-SITelemetryRunEnd never throws and gives up after
|        # one short attempt; the extra try is so that even a missing function cannot reach the run.
|        if ($Phase -eq 'End' -and -not $NoTelemetry) {
|            try {
|                if (Get-Command -Name Send-SITelemetryRunEnd -ErrorAction SilentlyContinue) {
|                    $null = Send-SITelemetryRunEnd -RunContext $RunContext -ExitReason $ExitReason -ErrorMessage $ErrorMessage -AssetCount $AssetCount
|                }
|            } catch { }
|        }
|        # CR3 (#657) -- this run's components (collections per source, correlation, Risk Analysis, data out per channel) count
|        # a good daily run, or start their count again after a failed one, while they are Testing after a release. Only the
|        # engine's own END record (never a pipeline step record or a dry run), only with the Pro database the run has open.
|        # Independent of telemetry; never throws.
|        if ($Phase -eq 'End' -and -not [bool]$global:WhatIfMode -and -not ([string]$RunContext.Engine).StartsWith('flow', [System.StringComparison]::OrdinalIgnoreCase)) {
|            try {
|                if (Get-Command -Name Invoke-SIReleaseScopeRunEnd -ErrorAction SilentlyContinue) { $null = Invoke-SIReleaseScopeRunEnd -RunContext $RunContext -ExitReason $ExitReason }
|            } catch { }
|        }
|        # #532 -- the ONE throttling alert: only when this job has not succeeded for a long stretch because of throttling
|        # (SI_Throttle_StuckHours / SI_Throttle_StuckRuns). Once per episode; never throws; never for a flow record (the
|        # engine of the step reports its own) and never for a dry run.
|        if ($Phase -eq 'End' -and $ExitReason -eq 'throttled' -and -not [bool]$global:WhatIfMode -and [int]$RunContext.ShardIndex -eq 0 -and
|            -not ([string]$RunContext.Engine).StartsWith('flow', [System.StringComparison]::OrdinalIgnoreCase)) {
|            try {
|                if (Get-Command -Name Invoke-SIThrottleStuckCheck -ErrorAction SilentlyContinue) {
|                    $null = Invoke-SIThrottleStuckCheck -Engine ([string]$RunContext.Engine).ToLowerInvariant() -RunId ([string]$RunContext.RunId)
|                }
|            } catch { }
|        }
|        # Restore caller's verbose preference even on bail-out / exception.
|        if ($null -ne $_savedVerbosePreference) { $global:VerbosePreference = $_savedVerbosePreference }
|    }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-TelemetrySend.ps1'] = @{ Sha256 = '782f563e70bf1bf79afe3a1c798491b942b251fe230f2974c2036ef727b7afcd'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- SENDING the telemetry records (#226): one `heartbeat` a day and one `run` report per engine run,
|    through the framework uplink client (engine/_shared/AitUplink.ps1, a byte-identical copy of sync/_AitUplink.ps1 --
|    SecurityInsight containers and Pro installs have no sync/ folder; SIv3-Telemetry.Tests.ps1 compares the two).
|
|    WHEN: at the run-health END moment. Send-SIRunHealthRow calls Send-SITelemetryRunEnd from its `finally` for every
|    Phase 'End' record, so every engine that records its run health reports its run -- success, success-partial, error
|    and settings-error alike -- whether or not the Log Analytics record itself could be saved.
|
|    WHAT (built by SI-Telemetry.ps1, which checks every value against the agreed lists, then shaped for the wire by the
|    framework's New-AitUplinkReport, which drops anything the receiver would refuse):
|      heartbeat  product, edition, version, hosting, runtime identity kind, licence state -- once per UTC day; an
|                 IDENTIFIED (Pro / trial) heartbeat also carries Counts = users, guests, devices (#424,
|                 SI-TelemetryCounts.ps1 -- the exact definitions are there); an anonymous one carries none
|      run       the stable Job id, Outcome (ok / warning / failed from ExitReason), DurationMs, FailedStep, ErrorClass
|                 (SI-ErrorClass.ps1) and Counts
|
|    TWO MODES (Resolve-AitUplinkSender):
|      anonymous   Community, and a Pro install that has no install key yet: the public community code, a random install
|                  id kept on this machine, NO tenant, NO host name, NO error text -- the fields are never put in the
|                  record -- and counts only as buckets.
|      identified  Pro / trial with the install key from the install's Key Vault (SI-Invardia-InstallKey, the same key the
|                  updater uses), read as the runtime identity. The tenant and host are carried; the error text is
|                  redacted and shortened (here AND by the framework client AND by the receiver).
|
|    OFF: $global:SI_Telemetry_Enabled = $false (or the environment variable SI_TELEMETRY_ENABLED = false). Then nothing is
|    built, nothing is read, no file is written and no network call is made.
|
|    RULE: TELEMETRY NEVER FAILS OR SLOWS A RUN. One attempt per record from the run, a 5-second timeout, no retry in the run.
|    The first answer that is not 'ok' stops all telemetry for the rest of the process (no retry storm), and is said ONCE as
|    a warning. Nothing here throws to its caller.
|    THE OUTBOX (framework 8.4, agreed with Invardia 2026-11-05; SI-UplinkOutbox.ps1): a RUN record that was not taken --
|    no answer, a timeout, a 429, any answer that is not ok, or not sent at all because an earlier report of this process
|    was refused -- is kept in the install's own Pro database (cfg.UplinkOutbox) with ONE cheap insert (a 5-second lock
|    timeout); a failed insert is said once and the record dropped. Identified installs with the Pro database open only; an
|    install without SQL does nothing new. The heartbeat job sends the kept records again later (oldest first, in rounds,
|    after its own heartbeat) -- never an engine run. Heartbeats and setup reports are never kept: the next one replaces them.
|
|    PS 5.1 and 7.
|#>
|
|if (-not (Get-Command -Name New-SITelemetryRunRecord -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-Telemetry.ps1')) }
|if (-not (Get-Command -Name New-AitUplinkReport -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'AitUplink.ps1')) }
|if (-not (Get-Command -Name Get-SITelemetryHeartbeatCounts -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-TelemetryCounts.ps1')) }
|# the install key goes ONLY to Invardia's own address (Test-SITelemetryEndpointHost)
|if (-not (Get-Command -Name Test-SITelemetryEndpointHost -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-OutboundTrust.ps1')) }
|# CR4 (#654): the guard mode on the identified heartbeat (the stricter period after a release that changed engine code)
|if (-not (Get-Command -Name ConvertTo-SIGuardModeWire -ErrorAction SilentlyContinue) -and [System.IO.File]::Exists([System.IO.Path]::Combine($PSScriptRoot, 'SI-GuardStrict.ps1'))) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-GuardStrict.ps1')) }
|# CR3 (#657): release control -- the wave and release mode on the identified heartbeat, the 30-minute release-mode reports
|if (-not (Get-Command -Name Resolve-SIReleaseControlSwitch -ErrorAction SilentlyContinue) -and [System.IO.File]::Exists([System.IO.Path]::Combine($PSScriptRoot, 'SI-ReleaseControl.ps1'))) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-ReleaseControl.ps1')) }
|# the ring every report carries (Resolve-SIReportedRing) -- the same order the web app's header uses
|if (-not (Get-Command -Name Resolve-SIReportedRing -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-ReportedRing.ps1')) }
|# the setup report (Kind = setup, framework §8.7): the control list, once a day with the heartbeat (identified only)
|if (-not (Get-Command -Name New-SISetupReport -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-SetupUplink.ps1')) }
|# #517 / framework §12.6b: the installed licence's id on identified reports, and Invardia's "superseded by" answer
|if (-not (Get-Command -Name Get-SILicenceSupersededFromAnswer -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-LicenceSuperseded.ps1')) }
|# framework §8.9: the install's own links (endpoints) on the identified heartbeat -- behind SI_Telemetry_SendEndpoints (default off) -- and the deep Link on a failed run report
|if (-not (Get-Command -Name Get-SITelemetryInstallEndpoints -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-TelemetryEndpoints.ps1')) }
|# #709 / framework 8.16 UPLINK-CAUSES: the run record's Reports[] and the heartbeat's Capabilities / CiColumns / Licences
|if (-not (Get-Command -Name ConvertTo-SIUplinkReports -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-UplinkCauses.ps1')) }
|# #710 / framework 8.16: Invardia's answer names the install's environment (environmentId) -- kept for the customer mail's portal link
|if (-not (Get-Command -Name Get-SIInvardiaEnvironmentIdFromAnswer -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-InvardiaPortalLink.ps1')) }
|# Invardia S16: the install's LASTING id (SI-InstallId) as InstallId on every identified record (never the anonymous id)
|if (-not (Get-Command -Name Add-SIUplinkInstallId -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-InvardiaInstallId.ps1')) }
|# framework 8.4: a run record that was not taken is kept in the Pro database (cfg.UplinkOutbox); the heartbeat job sends it again
|if (-not (Get-Command -Name Add-SIUplinkOutboxRecord -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-UplinkOutbox.ps1')) }
|
|function Initialize-SIAitUplinkScope {
|    <# The framework client (AitUplink.ps1, kept as it is) holds its closed lists and the community endpoint at script scope.
|       When its functions were loaded by an outer script (a container entrypoint) and are called from an engine's own script,
|       those lists are empty there: the record lost its Edition and Outcome, and an anonymous report its endpoint. Read once
|       into the reading scope from the same file, before the client is used. Never throws. #>
|    if ($null -ne $script:AitUplinkEditions -and $null -ne $script:AitUplinkInvardiaEndpoint) { return }
|    try {
|        $f = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'engine', '_shared', 'AitUplink.ps1')
|        if ([System.IO.File]::Exists($f)) { . $f }
|    } catch { }
|}
|
|function New-SITelemetrySendState {
|    <# The sender's settings. Made when this file loads -- and again by the functions below when `$script:` is the scope
|       of a script started from the one that loaded this file (its own scope: the functions are visible there, this
|       table is not). The root comes from this function's own file, never from the caller. #>
|    $file = [string]$MyInvocation.MyCommand.ScriptBlock.File
|    $dir = if ($file) { [System.IO.Path]::GetDirectoryName($file) } else { $PSScriptRoot }
|    @{
|    SIRoot         = (Split-Path -Parent (Split-Path -Parent $dir))
|    TimeoutSec     = 5
|    InstallKeyName = 'SI-Invardia-InstallKey'
|    # Engine name (run-health Engine / launcher folder) -> the stable Job id agreed with the receiver (#226).
|    Jobs           = @{
|        'privilege-tier-classifier' = 'si-ptc'
|        'endpoint'                  = 'si-endpoint'
|        'identity'                  = 'si-identity'
|        'azure'                     = 'si-azure'
|        'publicip'                  = 'si-publicip'
|        'asset-trend'               = 'si-trend'
|        'trend'                     = 'si-trend'
|        'schema-discovery'          = 'si-schema-discovery'
|        'asset-tagging'             = 'si-asset-tagging'
|        'asset-correlation'         = 'si-correlation'
|        'correlation'               = 'si-correlation'
|        'asset-properties'          = 'si-asset-properties'
|        'asset-cmdb'                = 'si-cmdb'
|        'cmdb'                      = 'si-cmdb'
|        'asset-cmdb-sql'            = 'si-cmdb-sql'
|        'vuln-closeloop'            = 'si-vuln-closeloop'
|        'datasync'                  = 'si-datasync'
|        # UPLINK-FIX: the data sync records its runs as 'asset-datasync' (its job's name) -- unmapped, none of them was reported
|        'asset-datasync'            = 'si-datasync'
|        'updater'                   = 'si-updater'
|        'web'                       = 'si-web'
|        # #269: the daily job flow -- ONE run for the whole flow; FailedStep names the first step that did not succeed
|        'flow'                      = 'si-flow'
|        # #427: a failed step of the guided install (setup/_shared/SI-GuidedInstall.ps1) -- Send-SITelemetryFailure
|        'install'                   = 'si-install'
|    }
|    }
|}
|function Get-SITelemetrySendState {
|    <# The value of $script:SITelemetrySend, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SITelemetrySend) { $script:SITelemetrySend = New-SITelemetrySendState }
|    , $script:SITelemetrySend
|}
|$script:SITelemetrySend = $null; $null = Get-SITelemetrySendState
|
|# =====================================================================================================================
|#  Pure decisions
|# =====================================================================================================================
|function Test-SITelemetryEnabled {
|    <#
|        PURE. Is telemetry on? The setting wins when it is set, then the environment variable SI_TELEMETRY_ENABLED,
|        else ON (the owner's decision: on by default, one setting to turn it off). false / 0 / off / no turn it off.
|    #>
|    param([AllowNull()]$Value = $global:SI_Telemetry_Enabled, [AllowNull()][AllowEmptyString()][string]$EnvValue = $env:SI_TELEMETRY_ENABLED)
|    # #918: every test entry point sets SI_TELEMETRY_ENABLED=false (+ SI_TEST_GATE=1) for itself and every engine CHILD process
|    # it starts -- those never send. Inside a Pester session that variable is the gate's, not the test's: such a session never
|    # sends to Invardia anyway (Send-SITelemetryRunEnd needs its own -Transport there), and its suites test the sender with
|    # their own stub, so the gate's process-wide value is not read in it (a value passed with -EnvValue always is).
|    if (-not $PSBoundParameters.ContainsKey('EnvValue') -and "$env:SI_TEST_GATE" -eq '1' -and (Get-Module -Name Pester)) { $EnvValue = $null }
|    foreach ($v in @($Value, $EnvValue)) {
|        if ($null -eq $v) { continue }
|        if ($v -is [bool]) { return $v }
|        $s = ([string]$v).Trim().Trim('$').ToLowerInvariant()
|        if (-not $s) { continue }
|        return -not ($s -in @('false', '0', 'off', 'no', 'disabled'))
|    }
|    return $true
|}
|
|function Resolve-SITelemetryJob {
|    <# PURE. The stable Job id of an engine run, or $null (nothing is sent for an engine without one). Risk Analysis is
|       two jobs: the Summary template is si-ra-summary, every other template si-ra-detailed. #>
|    param([AllowEmptyString()][AllowNull()][string]$Engine, [AllowEmptyString()][AllowNull()][string]$ReportTemplate)
|    $e = "$Engine".Trim().ToLowerInvariant()
|    if (-not $e) { return $null }
|    if ($e -eq 'risk-analysis') {
|        if ("$ReportTemplate" -match '(?i)summary') { return 'si-ra-summary' }
|        return 'si-ra-detailed'
|    }
|    if ((Get-SITelemetrySendState).Jobs.ContainsKey($e)) { return (Get-SITelemetrySendState).Jobs[$e] }
|    return $null
|}
|
|function ConvertTo-SITelemetryExitReason {
|    <# PURE. Run health's ExitReason as one of the four the telemetry maps. The tier classifier writes 'failure' for
|       'error'; an empty or unknown value is $null (not reported rather than guessed). #>
|    param([AllowEmptyString()][AllowNull()][string]$ExitReason)
|    $x = "$ExitReason".Trim().ToLowerInvariant()
|    if ($x -in @('success', 'success-partial', 'throttled', 'error', 'settings-error')) { return $x }   # throttled: #532
|    if ($x -in @('failure', 'failed')) { return 'error' }
|    if ($x -eq 'dry-run') { return 'success' }   # #276: a dry run that went well (a failed dry run keeps its own reason)
|    return $null
|}
|
|function Get-SITelemetryHosting {
|    <# PURE (reads env only). container | arc | vm: Container Apps sets CONTAINER_APP_* and IDENTITY_ENDPOINT +
|       IDENTITY_HEADER; the Arc agent sets IDENTITY_ENDPOINT + IMDS_ENDPOINT; anything else is a VM. #>
|    param([scriptblock]$GetEnv)
|    if (-not $GetEnv) { $GetEnv = { param($n) [Environment]::GetEnvironmentVariable($n) } }
|    $ep = [string](& $GetEnv 'IDENTITY_ENDPOINT'); $hd = [string](& $GetEnv 'IDENTITY_HEADER'); $imds = [string](& $GetEnv 'IMDS_ENDPOINT')
|    if ([string](& $GetEnv 'CONTAINER_APP_JOB_NAME') -or [string](& $GetEnv 'CONTAINER_APP_NAME') -or ($ep -and $hd)) { return 'container' }
|    if ($ep -and $imds) { return 'arc' }
|    return 'vm'
|}
|
|function Get-SITelemetryRuntimeIdentity {
|    <# PURE over -Vars (default: the run's globals). The KIND of identity the engines sign in as -- never which one:
|       mi-<hosting> | spn-certificate | spn-secret. An SPN with a certificate thumbprint is spn-certificate; one with only
|       a secret is spn-secret; nothing known is spn-certificate (the internal sign-in, certificate only). #>
|    param([Parameter(Mandatory)][string]$Hosting, [System.Collections.IDictionary]$Vars)
|    if (-not $Vars) {
|        $Vars = @{ UseMi = $global:SI_UseManagedIdentity; PreferUami = $global:SI_PreferUami; UamiClientId = $global:SI_UAMI_ClientId
|                   Thumbprint = @($global:SI_SPN_CertThumbprint, $global:SpnCertificateThumbprint) -join ''
|                   Secret = @($global:SI_SPN_Secret, $global:SpnClientSecret) -join '' }
|    }
|    if ([bool]$Vars.UseMi -or ([bool]$Vars.PreferUami -and "$($Vars.UamiClientId)".Trim())) { return ('mi-' + $Hosting) }
|    if ("$($Vars.Thumbprint)".Trim()) { return 'spn-certificate' }
|    if ("$($Vars.Secret)".Trim()) { return 'spn-secret' }
|    return 'spn-certificate'
|}
|
|function Get-SITelemetryLicenceInfo {
|    <# PURE. A licence status (Get-SILicense) as Edition (community | pro | trial) + LicenceState (valid | grace |
|       expired | none). Only a valid or grace licence makes the edition pro (trial when its sku says so). #>
|    param([AllowNull()]$License)
|    $st = if ($License) { "$($License.Status)" } else { '' }
|    $state = switch ($st) { 'Valid' { 'valid' } 'Grace' { 'grace' } 'Expired' { 'expired' } default { 'none' } }
|    $edition = 'community'
|    # #510 (framework §12.6a): the sku names the edition -- a Community sku is community even while it verifies
|    if ($state -in @('valid', 'grace')) {
|        $sku = "$($License.Sku)".Trim()
|        if ($sku -match '(?i)trial') { $edition = 'trial' }
|        elseif ($sku -match '(?i)^(pro|trial)([^a-z]|$)|(^|[^a-z])msp([^a-z]|$)') { $edition = 'pro' }
|    }
|    [pscustomobject]@{ Edition = $edition; LicenceState = $state }
|}
|
|function Get-SITelemetryCounts {
|    <# PURE. The run's count under the name the receiver knows: identities for the identity engine, findings for Risk
|       Analysis, assets otherwise. A negative count means "not counted" and is not sent. #>
|    param([Parameter(Mandatory)][string]$Job, [long]$Count = -1)
|    if ($Count -lt 0) { return @{} }
|    $name = switch -Regex ($Job) { '^si-identity$' { 'identities' } '^si-ra-' { 'findings' } default { 'assets' } }
|    @{ $name = $Count }
|}
|
|function Get-SITelemetryFailedStep {
|    <# PURE. Which stage a run that did not end ok stopped in: the run context's FailedStep when the engine recorded it,
|       'settings' for a settings error, 'ra-query' for a partial Risk Analysis run, else nothing. #>
|    param([AllowNull()]$RunContext, [AllowEmptyString()][string]$ExitReason, [string]$Job)
|    if ($ExitReason -eq 'success') { return $null }
|    if ($ExitReason -eq 'settings-error') { return 'settings' }
|    if ($RunContext -and $RunContext.PSObject.Properties['FailedStep'] -and "$($RunContext.FailedStep)".Trim()) {
|        $s = ("$($RunContext.FailedStep)".Trim().ToLowerInvariant() -replace '[^a-z0-9\-]', '-') -replace '^[^a-z]+', ''
|        if ($s.Length -gt 32) { $s = $s.Substring(0, 32) }
|        if ($s -match '^[a-z][a-z0-9\-]{0,31}$') { return $s }
|    }
|    if ($ExitReason -eq 'success-partial' -and $Job -like 'si-ra-*') { return 'ra-query' }
|    return $null
|}
|
|function Get-SITelemetryStepsOk {
|    <#
|        PURE. The steps a run report lists as finished well (StepsOk): Invardia resolves a step's ticket when a later report of
|        the same job is ok and lists that step. -RunContext.StepsOk: the steps the engine finished (its stages, the pipeline's
|        steps that succeeded, the data sync's parts that did not fail ...), in their order. -FailedStep: the report's own.
|          ok        every listed step, and 'run' (the run as a whole -- the step a failure without a recorded step is reported under);
|          warning   the listed steps BEFORE the failed one when it is in the list, else every listed step; never 'run';
|          failed    none.
|        Ids in the FailedStep shape (lower-case letters, digits, dashes, at most 32), each once, at most 50.
|    #>
|    param([AllowNull()]$RunContext, [AllowEmptyString()][string]$ExitReason, [AllowEmptyString()][string]$FailedStep = '')
|    $out = New-Object System.Collections.Generic.List[string]
|    $outcome = try { Get-SITelemetryOutcome -ExitReason $ExitReason } catch { 'failed' }
|    if ($outcome -eq 'failed') { return }
|    $norm = { param($v) $s = ("$v".Trim().ToLowerInvariant() -replace '[^a-z0-9\-]', '-') -replace '^[^a-z]+', ''; if ($s.Length -gt 32) { $s = $s.Substring(0, 32) }; if ($s -cmatch '^[a-z][a-z0-9\-]{0,31}$') { $s } else { '' } }
|    $list = New-Object System.Collections.Generic.List[string]
|    if ($RunContext -and $RunContext.PSObject.Properties['StepsOk']) { foreach ($x in @($RunContext.StepsOk)) { $n = & $norm $x; if ($n -and -not $list.Contains($n)) { $list.Add($n) } } }
|    $failed = & $norm $FailedStep
|    if ($outcome -eq 'warning') {
|        $cut = if ($failed) { $list.IndexOf($failed) } else { -1 }
|        $take = if ($cut -ge 0) { $cut } else { $list.Count }
|        for ($i = 0; $i -lt $take; $i++) { if ($list[$i] -ne $failed -and $list[$i] -ne 'run') { $out.Add($list[$i]) } }
|    } else {
|        foreach ($x in $list) { $out.Add($x) }
|        if (-not $out.Contains('run')) { $out.Add('run') }
|    }
|    [string[]]@($out | Select-Object -First 50)
|}
|
|function Get-SITelemetryIncompleteReports {
|    <#
|        PURE. #641: the reports of a Risk Analysis run that are not complete, from its run context (ReportsExpected,
|        ReportsStored, ReportsIncomplete -- numbers; ReportsIncompleteLink -- the web app page that lists them).
|        $null when the run has none (or is not a Risk Analysis run that counted them).
|    #>
|    param([AllowNull()]$RunContext)
|    if ($null -eq $RunContext -or -not $RunContext.PSObject.Properties['ReportsIncomplete']) { return $null }
|    $n = 0L; if (-not [long]::TryParse([string]$RunContext.ReportsIncomplete, [ref]$n) -or $n -le 0) { return $null }
|    $num = { param($v) $x = 0L; if ([long]::TryParse([string]$v, [ref]$x) -and $x -ge 0) { $x } else { 0L } }
|    $link = ''
|    if ($RunContext.PSObject.Properties['ReportsIncompleteLink']) { $link = "$($RunContext.ReportsIncompleteLink)".Trim(); if ($link.Length -gt 400) { $link = '' } }
|    [pscustomobject]@{ Expected = (& $num $RunContext.ReportsExpected); Stored = (& $num $RunContext.ReportsStored); Incomplete = $n; Link = $link }
|}
|
|function Test-SITelemetryHeartbeatDue {
|    <# PURE. A heartbeat is due once per UTC day: when none was sent yet, or the last one was on an earlier UTC date. #>
|    param([AllowEmptyString()][AllowNull()][string]$LastSentDate, [Parameter(Mandatory)][datetime]$NowUtc)
|    $today = $NowUtc.ToUniversalTime().ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture)
|    return ("$LastSentDate".Trim() -ne $today)
|}
|
|function ConvertTo-SITelemetryWire {
|    <#
|        PURE. A record from SI-Telemetry.ps1 (heartbeat or run, already checked) as the framework's Schema 2 wire record
|        (New-AitUplinkReport). -Counts are the RAW counts: the framework buckets them itself in anonymous mode. In
|        anonymous mode the tenant, the host and the error text are not passed at all -- the SI record does not carry
|        them, and the framework would drop them anyway.
|    #>
|    param([Parameter(Mandatory)]$Record, [Parameter(Mandatory)][ValidateSet('anonymous', 'identified')][string]$Mode,
|          [System.Collections.IDictionary]$Counts, $Now,
|          # #517 / framework §12.6b: the installed licence's id -- on an IDENTIFIED report only, and only GUID-shaped (Invardia
|          # refuses the whole report for anything else)
|          [AllowEmptyString()][AllowNull()][string]$LicenceId,
|          # framework §8.9: the install's own links as `endpoints` -- on an IDENTIFIED heartbeat only, and only while the send
|          # gate is on (SI_Telemetry_SendEndpoints, default OFF; ConvertTo-SITelemetryEndpointList: kind + url (+ label),
|          # at most 12, https, no query string); never on an anonymous record
|          [AllowNull()][object[]]$Endpoints,
|          # the deep link of an IDENTIFIED run report that did not end ok (the web app's run-health page), https only
|          [AllowEmptyString()][AllowNull()][string]$Link,
|          # MAIL-3 (#653, framework §12.11a item 4): the environment's name as the web app's header shows it -- optional,
|          # on an IDENTIFIED heartbeat / run report only (a name says whose install it is: never anonymous)
|          [AllowEmptyString()][AllowNull()][string]$EnvironmentName,
|          # CR4 (#654, framework §12.11b item 5): the install's guard mode (ConvertTo-SIGuardModeWire) -- on an IDENTIFIED
|          # heartbeat only; $null (no fingerprint recorded: an older install) = left out
|          [AllowNull()]$GuardMode,
|          # CR3 (#657, framework 12.11e item 4): wave { name, version, ring } and releaseMode { version, sinceUtc, untilUtc,
|          # everyMinutes } -- on an IDENTIFIED heartbeat only, each as @{ Known; Value } (Get-SITelemetryReleaseFields):
|          # Known = the field is sent (Value $null = JSON null: no wave / not in release mode); $null = left out
|          [AllowNull()]$Wave, [AllowNull()]$ReleaseMode,
|          # CR3 (framework 12.11e items 3 + 5(a), 2026-10-18): components (Testing / Stable per component) and evidence (the daily
|          # counts and verdicts) -- identified heartbeat only, each @{ Known; Value } like wave; $null = left out
|          [AllowNull()]$Components, [AllowNull()]$Evidence,
|          # #709 / framework 8.16: the run record's Reports (ConvertTo-SIUplinkReports -- already shaped, at most 20, Detail only
|          # when identified) and the heartbeat's probe (Get-SICapabilityProbe: Capabilities, CiColumns; Licences identified only)
|          [AllowNull()][object[]]$Reports, [AllowNull()]$Probe,
|          # framework 4.1b (owner 2026-10-18): the Invardia Support app's database access, READ ONLY (SI-SupportSqlAccess.ps1,
|          # Get-SISupportSqlAccess .Wire: group, dbUser, checkedUtc, healedUtc -- healedUtc always null, SI never heals) -- on an
|          # IDENTIFIED heartbeat only; $null (no Support app recorded, or not read) = left out
|          [AllowNull()]$SupportSqlAccess,
|          # CR2: the build label (Get-SITelemetryVersion; default: read here) -- the field `build` on a heartbeat / run report when it
|          # differs from Version (the release); '' = no field. A test session reads no label of its own (pass -Build)
|          [AllowNull()][AllowEmptyString()][string]$Build)
|    $a = @{ Kind = [string]$Record.Kind; Mode = $Mode; Product = [string]$Record.Product; Version = [string]$Record.Version; Ring = $Record.Ring
|            Edition = [string]$Record.Edition; Hosting = [string]$Record.Hosting; RuntimeIdentity = [string]$Record.RuntimeIdentity
|            LicenceState = [string]$Record.LicenceState }
|    if ($Now) { $a.Now = $Now }
|    if ($Record.Kind -eq 'heartbeat' -and $Mode -eq 'identified' -and $Counts -and $Counts.Count) {
|        # #424: the tenant counts ride ONLY on an identified heartbeat; an anonymous one never carries them.
|        $h = @{}; foreach ($k in @($Counts.Keys)) { if ((Get-SITelemetryHeartbeatCountNames) -contains [string]$k) { $h[[string]$k] = $Counts[$k] } }
|        if ($h.Count) { $a.Counts = $h }
|    }
|    if ($Record.Kind -eq 'run') {
|        $a.Job = [string]$Record.Job; $a.Outcome = [string]$Record.Outcome; $a.DurationMs = $Record.DurationMs
|        $a.FailedStep = [string]$Record.FailedStep; $a.ErrorClass = [string]$Record.ErrorClass
|        if ($Counts -and $Counts.Count) { $h = @{}; foreach ($k in @($Counts.Keys)) { $h[[string]$k] = $Counts[$k] }; $a.Counts = $h }
|    }
|    if ($Mode -eq 'anonymous') {
|        $a.InstallId = [string]$Record.InstallId
|    } else {
|        $a.TenantId = [string]$Record.ClaimedTenantId
|        $a.HostName = [string]$Record.Host
|        if ($Record.PSObject.Properties['ErrorText']) { $a.ErrorText = [string]$Record.ErrorText }
|    }
|    Initialize-SIAitUplinkScope
|    $w = New-AitUplinkReport @a
|    # #719: the framework client keeps the first 40 Counts keys by name (10 before main's 2026-10-13 copy); Invardia takes up
|    # to 40 per record -- SI still shapes the identified
|    # heartbeat's Counts itself (SI-TelemetryCounts.ps1: the agreed names, whole numbers >= 0, at most 38)
|    if ($w -and $a.ContainsKey('Counts') -and $Record.Kind -eq 'heartbeat' -and (Get-Command -Name ConvertTo-SITelemetryCountsWire -ErrorAction SilentlyContinue)) {
|        $cw = ConvertTo-SITelemetryCountsWire -Counts $a.Counts
|        if ($cw) { $w | Add-Member -NotePropertyName 'Counts' -NotePropertyValue $cw -Force }
|    }
|    # framework §8.5 CLOSE-LOOP: a run report that did not end ok names WHO fixes it -- customer-config (the customer's
|    # permission, consent, licence or setting; Invardia shows "needs customer action" and opens no fix request) or
|    # product-defect. Decided from the error class only (Get-SIErrorFixKind); no class = no FixKind. Added here, beside the
|    # framework client, so AitUplink.ps1 stays as it is. Anonymous reports carry it too (an enum identifies nobody).
|    if ($w -and $Record.Kind -eq 'run' -and "$($w.ErrorClass)".Trim() -and "$($w.Outcome)" -ne 'ok' -and (Get-Command -Name Get-SIErrorFixKind -ErrorAction SilentlyContinue)) {
|        $fk = Get-SIErrorFixKind -ErrorClass ([string]$w.ErrorClass)
|        if ($fk) { $w | Add-Member -NotePropertyName 'FixKind' -NotePropertyValue $fk -Force }
|    }
|    # the steps the run finished well (StepsOk, the FailedStep shape, at most 50): on identified and anonymous reports alike
|    # (ids identify nobody) -- Invardia resolves a step's ticket on a later ok report that lists it
|    if ($w -and $Record.Kind -eq 'run' -and $Record.PSObject.Properties['StepsOk'] -and @($Record.StepsOk | Where-Object { $_ }).Count) {
|        $w | Add-Member -NotePropertyName 'StepsOk' -NotePropertyValue ([string[]]@($Record.StepsOk | Where-Object { $_ } | Select-Object -First 50)) -Force
|    }
|    if ($w -and $Mode -eq 'identified' -and $Record.Kind -in @('heartbeat', 'run') -and (Get-Command -Name ConvertTo-SILicenceIdOrEmpty -ErrorAction SilentlyContinue)) {
|        $lid = ConvertTo-SILicenceIdOrEmpty $LicenceId
|        if ($lid) { $w | Add-Member -NotePropertyName 'LicenceId' -NotePropertyValue $lid -Force }
|    }
|    # REMOVE-ME gate: Invardia refuses the WHOLE report (422) for a list its validator does not accept, and that validator is
|    # not live yet -- the list rides only while SI_Telemetry_SendEndpoints is on (default off)
|    if ($w -and $Mode -eq 'identified' -and $Record.Kind -eq 'heartbeat' -and $Endpoints -and (Get-Command -Name ConvertTo-SITelemetryEndpointList -ErrorAction SilentlyContinue) -and (Test-SITelemetrySendEndpoints)) {
|        $eps = @(ConvertTo-SITelemetryEndpointList -Items $Endpoints)
|        if ($eps.Count) { $w | Add-Member -NotePropertyName 'endpoints' -NotePropertyValue $eps -Force }
|    }
|    if ($w -and $Mode -eq 'identified' -and $Record.Kind -eq 'run' -and "$($w.Outcome)" -ne 'ok' -and "$Link".Trim() -and (Get-Command -Name ConvertTo-SITelemetryEndpointUrl -ErrorAction SilentlyContinue)) {
|        $lk = ConvertTo-SITelemetryEndpointUrl $Link
|        if ($lk) { $w | Add-Member -NotePropertyName 'Link' -NotePropertyValue $lk -Force }
|    }
|    # Invardia accepts the field since 2026-10-14 (it reads environmentName and EnvironmentName); no name, no field
|    if ($w -and $Mode -eq 'identified' -and $Record.Kind -in @('heartbeat', 'run')) {
|        $en = ConvertTo-SITelemetryEnvironmentName $EnvironmentName
|        if ($en) { $w | Add-Member -NotePropertyName 'environmentName' -NotePropertyValue $en -Force }
|    }
|    # Invardia 1.0.445 reads guardMode on an identified heartbeat (lenient: a value it does not understand is ignored, the
|    # report is still taken); never on an anonymous one
|    if ($w -and $Mode -eq 'identified' -and $Record.Kind -eq 'heartbeat' -and $GuardMode) {
|        $gmMode = if ($GuardMode -is [System.Collections.IDictionary]) { [string]$GuardMode['mode'] } elseif ($GuardMode.PSObject.Properties['mode']) { [string]$GuardMode.mode } else { '' }
|        if ($gmMode -in @('strict', 'normal')) { $w | Add-Member -NotePropertyName 'guardMode' -NotePropertyValue ([pscustomobject]$GuardMode) -Force }
|    }
|    # CR3 (#657): the release fields -- behind SI_Telemetry_ReleaseControl (Get-SITelemetryReleaseFields decides); never anonymous
|    if ($w -and $Mode -eq 'identified' -and $Record.Kind -eq 'heartbeat') {
|        foreach ($f in @(@{ N = 'wave'; V = $Wave }, @{ N = 'releaseMode'; V = $ReleaseMode }, @{ N = 'components'; V = $Components }, @{ N = 'evidence'; V = $Evidence })) {
|            $fv = $f.V
|            if ($null -eq $fv -or -not $fv.Known) { continue }
|            $val = if ($null -ne $fv.Value) { [pscustomobject]$fv.Value } else { $null }
|            $w | Add-Member -NotePropertyName $f.N -NotePropertyValue $val -Force
|        }
|    }
|    # CR2 (Invardia 2026-10-18): Version is the release; the build label rides as `build` -- only when it says something else
|    if ($w -and $Record.Kind -in @('heartbeat', 'run')) {
|        $bl = if ($PSBoundParameters.ContainsKey('Build')) { [string]$Build } elseif (Get-Module -Name Pester) { '' } else { try { [string](Get-SITelemetryVersion) } catch { '' } }
|        $bl = $bl.Trim()
|        if ($bl -and $bl -ne [string]$w.Version -and $bl.Length -le 100) { $w | Add-Member -NotePropertyName 'build' -NotePropertyValue $bl -Force }
|    }
|    # framework 4.1b: supportSqlAccess { group, dbUser, checkedUtc, healedUtc } -- identified heartbeat only; group / dbUser are
|    # true / false, or null when they could not be checked (never claimed); healedUtc is always null (Invardia heals, not SI)
|    if ($w -and $Mode -eq 'identified' -and $Record.Kind -eq 'heartbeat' -and $SupportSqlAccess) {
|        $sv = ConvertTo-SITelemetrySupportSqlAccessWire $SupportSqlAccess
|        if ($sv) { $w | Add-Member -NotePropertyName 'supportSqlAccess' -NotePropertyValue $sv -Force }
|    }
|    # #709 / framework 8.16 UPLINK-CAUSES (Invardia 1.0.477). A problem here never costs the record: anything that fails is
|    # left out, and the sender sends the record again without these fields when Invardia refuses it.
|    if ($w -and $Record.Kind -eq 'run' -and $Reports -and @($Reports).Count) {
|        try {
|            $items = @(@($Reports) | Where-Object { $_ -and "$($_.Code)".Trim() -and "$($_.CauseClass)".Trim() } | Select-Object -First 20)
|            if ($Mode -ne 'identified') { $items = @($items | ForEach-Object { $c = $_.PSObject.Copy(); if ($c.PSObject.Properties['Detail']) { $c.PSObject.Properties.Remove('Detail') }; $c }) }
|            if ($items.Count) { $w | Add-Member -NotePropertyName 'Reports' -NotePropertyValue $items -Force; $w = Limit-SIUplinkRecordSize -Record $w }
|        } catch { if ($w.PSObject.Properties['Reports']) { $w.PSObject.Properties.Remove('Reports') } }
|    }
|    if ($w -and $Record.Kind -eq 'heartbeat' -and $Probe) {
|        try {
|            if ($Probe.Capabilities -and @($Probe.Capabilities.Keys).Count) { $w | Add-Member -NotePropertyName 'Capabilities' -NotePropertyValue ([pscustomobject]$Probe.Capabilities) -Force }
|            if (@($Probe.CiColumns).Count) { $w | Add-Member -NotePropertyName 'CiColumns' -NotePropertyValue @(@($Probe.CiColumns) | Select-Object -First 40) -Force }
|            # the tenant's licences say whose tenant it is: an identified heartbeat only
|            if ($Mode -eq 'identified' -and @($Probe.Licences).Count) { $w | Add-Member -NotePropertyName 'Licences' -NotePropertyValue @(@($Probe.Licences) | Select-Object -First 40) -Force }
|        } catch { foreach ($n in 'Capabilities', 'CiColumns', 'Licences') { if ($w.PSObject.Properties[$n]) { $w.PSObject.Properties.Remove($n) } } }
|    }
|    $w
|}
|
|# the fields a record carries that Invardia may refuse; a refused record goes again ONCE without them (#657 release fields,
|# #709 report causes and the capability probe; #718 the hourly heartbeat's collection state and pipeline progress; #719 the
|# hourly heartbeat's eight further fields, SI-HeartbeatFields.ps1)
|function Get-SITelemetryOptionalFields { @('wave', 'releaseMode', 'components', 'evidence', 'Reports', 'Capabilities', 'CiColumns', 'Licences', 'Collections', 'runProgress',
|                                          'Pipeline', 'Jobs', 'Sources', 'Database', 'Update', 'Mail', 'Warnings', 'Security', 'Published', 'DataOut', 'supportSqlAccess', 'build',
|                                          # #1065 (3.0.30): in Invardia's closed list and taken leniently -- here only so a refusal never costs the record
|                                          'setupSteps',
|                                          # framework rule 11g: a private install's image build pool -- behind its own switch, off until Invardia confirms
|                                          'BuildPool',
|                                          # framework 8.4: the run records kept unsent (the outbox) -- behind its own switch (on: Invardia deployed it 2026-11-05)
|                                          'UplinkBacklog') }
|
|function ConvertTo-SITelemetrySupportSqlAccessWire {
|    <# PURE. The heartbeat's supportSqlAccess, exactly { group, dbUser, checkedUtc, healedUtc }: group / dbUser true, false or
|       null; checkedUtc an ISO UTC time (required -- none = $null, the field is left out); healedUtc always null (SecurityInsight
|       never heals: Invardia does). Anything else in the input is dropped. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $null }
|    $get = { param($k) if ($Value -is [System.Collections.IDictionary]) { if ($Value.Contains($k)) { $Value[$k] } else { $null } } elseif ($Value.PSObject.Properties[$k]) { $Value.$k } else { $null } }
|    $tri = { param($v) if ($null -eq $v) { $null } elseif ($v -is [bool]) { $v } else { $null } }
|    $c = & $get 'checkedUtc'
|    if ($null -eq $c -or -not "$c".Trim()) { return $null }
|    try { $iso = ([datetime]$c).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture) } catch { return $null }
|    $o = [ordered]@{ group = (& $tri (& $get 'group')); dbUser = (& $tri (& $get 'dbUser')); checkedUtc = $iso; healedUtc = $null }
|    # #1021 (agreed with Invardia 2026-11-01): the support grant's keys are ADDED -- never in place of the four above -- and
|    # only when the heartbeat put them there (its switch SI_Uplink_SendSupportSqlAccessJit): readOnly true / false / null,
|    # jitOpen true / false, jitUntil an ISO UTC time or null
|    $has = { param($k) if ($Value -is [System.Collections.IDictionary]) { $Value.Contains($k) } else { [bool]$Value.PSObject.Properties[$k] } }
|    if ((& $has 'readOnly') -or (& $has 'jitOpen') -or (& $has 'jitUntil')) {
|        $o['readOnly'] = (& $tri (& $get 'readOnly'))
|        $o['jitOpen'] = [bool](& $tri (& $get 'jitOpen'))
|        $ju = & $get 'jitUntil'; $o['jitUntil'] = $null
|        if ($null -ne $ju -and "$ju".Trim()) { try { $o['jitUntil'] = ([datetime]$ju).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture) } catch { $o['jitUntil'] = $null } }
|    }
|    [pscustomobject]$o
|}
|
|function Get-SITelemetryReleaseFields {
|    <#
|        CR3 (#657): the release fields of an IDENTIFIED heartbeat -- @{ On; Wave; ReleaseMode; Invoke; Rows; Reason }; Wave /
|        ReleaseMode are @{ Known; Value } for ConvertTo-SITelemetryWire, or $null (left out). Nothing at all when:
|        anonymous; SI_Telemetry_ReleaseControl does not allow it for this ring (Resolve-SIReleaseControlSwitch); held for 24
|        hours after Invardia refused a heartbeat with them; no Pro database; a test session without -Rows. NEVER throws.
|          -Rows    the cfg.InstallState rows (Read-SIReleaseControlRows) -- or the context's ReleaseRows (tests)
|          -Invoke  the Pro database seam (default: the one the job has open, Get-SIReleaseControlInvoke)
|    #>
|    param([Parameter(Mandatory)]$Context, [Parameter(Mandatory)][datetime]$NowUtc, [scriptblock]$Invoke, $Rows)
|    $out = [pscustomobject]@{ On = $false; Wave = $null; ReleaseMode = $null; Components = $null; Evidence = $null; Invoke = $Invoke; Rows = $null; Reason = '' }
|    try {
|        if (-not (Get-Command -Name Resolve-SIReleaseControlSwitch -ErrorAction SilentlyContinue)) { $out.Reason = 'this release does not carry release control'; return $out }
|        if ($Context.Mode -eq 'anonymous') { $out.Reason = 'anonymous: never'; return $out }
|        $sw = Resolve-SIReleaseControlSwitch -Ring $(if ($Context.PSObject.Properties['Ring']) { $Context.Ring } else { $null })
|        if (-not $sw.On) { $out.Reason = $sw.Reason; return $out }
|        if (-not $Rows -and $Context.PSObject.Properties['ReleaseRows']) { $Rows = $Context.ReleaseRows }
|        if (-not $Rows) {
|            if (-not $Invoke) {
|                if (Get-Module -Name Pester) { $out.Reason = 'a test session never reads a database'; return $out }
|                $Invoke = Get-SIReleaseControlInvoke
|            }
|            if (-not $Invoke) { $out.Reason = 'no Pro database is open in this run'; return $out }
|            $Rows = Read-SIReleaseControlRows -Invoke $Invoke
|        }
|        $out.Invoke = $Invoke; $out.Rows = $Rows
|        if (Test-SIReleaseControlHold -Hold ([string]$Rows.ReleaseControlHold) -NowUtc $NowUtc) { $out.Reason = 'held for 24 hours: Invardia refused a heartbeat that carried them'; return $out }
|        $m = Get-SIReleaseModeFromFingerprint -Fingerprint ([string]$Rows.EngineFingerprint) -NowUtc $NowUtc
|        if ($m.Known) { $out.ReleaseMode = [pscustomobject]@{ Known = $true; Value = $m.Wire } }
|        $wv = Get-SIReleaseWaveFromUpdateState -Json ([string]$Rows.UpdateState)
|        if ($wv.Known) { $out.Wave = [pscustomobject]@{ Known = $true; Value = $wv.Wave } }
|        # framework 12.11e items 3 + 5(a): Testing / Stable per component and the daily evidence -- a failed read leaves
|        # only these two out (the context's ReleaseEvidence in tests: @{ Components; Evidence })
|        try {
|            $ef = if ($Context.PSObject.Properties['ReleaseEvidence']) { $Context.ReleaseEvidence } elseif ($Invoke -and (Get-Command -Name Read-SIReleaseEvidenceFields -ErrorAction SilentlyContinue)) { Read-SIReleaseEvidenceFields -Invoke $Invoke -Rows $Rows -NowUtc $NowUtc } else { $null }
|            if ($ef -and $ef.Components) { $out.Components = [pscustomobject]@{ Known = $true; Value = $ef.Components } }
|            if ($ef -and $ef.Evidence) { $out.Evidence = [pscustomobject]@{ Known = $true; Value = $ef.Evidence } }
|        } catch { $out.Components = $null; $out.Evidence = $null }
|        $out.On = [bool]($out.ReleaseMode -or $out.Wave -or $out.Components -or $out.Evidence)
|        $out.Reason = $sw.Reason
|    } catch { $out.On = $false; $out.Wave = $null; $out.ReleaseMode = $null; $out.Reason = ("not read: {0}" -f $_.Exception.Message) }
|    $out
|}
|
|function Get-SITelemetryGuardModeWire {
|    <#
|        CR4 (#654): the identified heartbeat's guardMode (ConvertTo-SIGuardModeWire), from the FIRST of:
|          -Context.GuardMode       (tests, or a caller that has it)
|          -Rows                    the cfg.InstallState rows already read (Read-SIReleaseControlRows: EngineFingerprint, GuardStrictEnd)
|          -Invoke                  the Pro database the sender has open (Read-SIGuardModeState)
|          Get-SIGuardModeNow       the guard code's own database (an engine run; never in a test session)
|        LIVE 2026-10-18: the half-hourly heartbeat job has the Pro database open but not the guard code that finds it by
|        itself, so it read "nothing recorded" and sent NO guardMode while the install was strict. $null = no fingerprint is
|        recorded (an older install) or nothing could be read -- the field is left out. NEVER throws.
|    #>
|    param($Context, [scriptblock]$Invoke, $Rows, [Parameter(Mandatory)][datetime]$NowUtc)
|    try {
|        if ($Context -and $Context.PSObject.Properties['GuardMode']) { return $Context.GuardMode }
|        if (-not (Get-Command -Name ConvertTo-SIGuardModeWire -ErrorAction SilentlyContinue)) { return $null }
|        if ($Rows -and $Rows.PSObject.Properties['EngineFingerprint'] -and "$($Rows.EngineFingerprint)".Trim()) {
|            return (ConvertTo-SIGuardModeWire -Mode (Get-SIGuardModeFromState -Fingerprint ([string]$Rows.EngineFingerprint) -StrictEnd ([string]$Rows.GuardStrictEnd) -NowUtc $NowUtc))
|        }
|        if ($Invoke) { return (ConvertTo-SIGuardModeWire -Mode (Read-SIGuardModeState -Invoke $Invoke -NowUtc $NowUtc)) }
|        if (Get-Module -Name Pester) { return $null }
|        ConvertTo-SIGuardModeWire -Mode (Get-SIGuardModeNow -NowUtc $NowUtc)
|    } catch { $null }
|}
|
|function Test-SITelemetryHasReleaseFields {
|    <# PURE. Does a wire record carry a release field (wave / releaseMode)? #>
|    param($Record)
|    [bool]($Record -and ($Record.PSObject.Properties['wave'] -or $Record.PSObject.Properties['releaseMode'] -or $Record.PSObject.Properties['components'] -or $Record.PSObject.Properties['evidence']))
|}
|
|function Send-SITelemetryRecordWithFallback {
|    <#
|        CR3 (#657, framework 12.22 3(b)): one record through -Transport; a heartbeat with the release fields that is NOT taken
|        is sent again ONCE without them -- when that one is taken, the fields are held back for 24 hours (-Invoke:
|        cfg.InstallState 'ReleaseControlHold') and said once. Returns @{ Result; Record; Held }. Never throws past the transport.
|    #>
|    param([Parameter(Mandatory)]$Record, [Parameter(Mandatory)][scriptblock]$Transport, [Parameter(Mandatory)]$Context, [int]$TimeoutSec = 5,
|          [scriptblock]$Invoke, [datetime]$NowUtc = [datetime]::UtcNow)
|    # Invardia S16: every IDENTIFIED record (heartbeat, run -- not the setup report) carries the install's LASTING id as
|    # InstallId; an anonymous record keeps only its own random id, and no lasting id (none / unreadable) = no field
|    if ($Record -and [string]$Context.Mode -eq 'identified' -and $Context.PSObject.Properties['LastingInstallId']) {
|        $Record = Add-SIUplinkInstallId -Record $Record -InstallId ([string]$Context.LastingInstallId)
|    }
|    $r = & $Transport $Record $Context.Endpoint $Context.AccessCode $TimeoutSec
|    # #902: a record with HOLD items (class held-last-good / held-too-long, or the hold fields) that is NOT taken goes again
|    # first WITHOUT those items only -- a validator that does not know the hold contract yet never costs the real failures
|    if ("$($r.Status)" -ne 'ok' -and $Record -and $Record.PSObject.Properties['Reports'] -and (Get-Command -Name Get-SIUplinkCausesContract -ErrorAction SilentlyContinue)) {
|        $hc = Get-SIUplinkCausesContract
|        $isHold = { param($i) $i -and (([string]$i.CauseClass -in @([string]$hc.HoldClassInfo, [string]$hc.HoldClassEscalated)) -or $i.PSObject.Properties[[string]$hc.HoldFieldHeld]) }
|        $all = @($Record.Reports)
|        $keep = @($all | Where-Object { -not (& $isHold $_) })
|        if ($keep.Count -lt $all.Count) {
|            if ($keep.Count) { $Record.Reports = $keep } else { $Record.PSObject.Properties.Remove('Reports') }
|            if (-not $global:SI_UplinkHoldsWarned) { $global:SI_UplinkHoldsWarned = $true; Write-SIUplinkDiag ("Invardia did not take the run report with the held reports ({0}) -- it goes again without them" -f "$($r.Reason)") }
|            $r = & $Transport $Record $Context.Endpoint $Context.AccessCode $TimeoutSec
|        }
|    }
|    $opt = @(Get-SITelemetryOptionalFields | Where-Object { $Record -and $Record.PSObject.Properties[$_] })
|    if ("$($r.Status)" -eq 'ok' -or -not $opt.Count) { return [pscustomobject]@{ Result = $r; Record = $Record; Held = $false } }
|    $first = "$($r.Reason)"
|    $hadRelease = [bool](Test-SITelemetryHasReleaseFields $Record)
|    # #709: a record with Reports[] / the capability probe that is NOT taken goes again without them -- the run record matters
|    # more than its causes (framework 8.16: send without Reports rather than fail)
|    foreach ($n in $opt) { $Record.PSObject.Properties.Remove($n) }
|    $r2 = & $Transport $Record $Context.Endpoint $Context.AccessCode $TimeoutSec
|    if ("$($r2.Status)" -ne 'ok') { return [pscustomobject]@{ Result = $r2; Record = $Record; Held = $false } }
|    if (@($opt | Where-Object { $_ -notin @('wave', 'releaseMode', 'components', 'evidence', 'Collections', 'runProgress', 'Pipeline', 'Jobs', 'Sources', 'Database', 'Update', 'Mail', 'Warnings', 'Security', 'Published', 'DataOut', 'supportSqlAccess', 'build', 'setupSteps', 'UplinkBacklog') }).Count) {
|        if (-not $global:SI_UplinkCausesWarned) { $global:SI_UplinkCausesWarned = $true; Write-SIUplinkDiag ("Invardia did not take the status report with the report causes / capability fields ({0}) -- it was sent without them" -f (ConvertTo-AitUplinkRedacted -Text $first)) }
|    }
|    if (-not $hadRelease) { return [pscustomobject]@{ Result = $r2; Record = $Record; Held = $false } }
|    $held = $false
|    if (Get-Command -Name Save-SIReleaseControlHold -ErrorAction SilentlyContinue) { $held = Save-SIReleaseControlHold -Invoke $Invoke -NowUtc $NowUtc -Why (ConvertTo-AitUplinkRedacted -Text $first) }
|    if (-not $global:SI_ReleaseControlWarned) {
|        $global:SI_ReleaseControlWarned = $true
|        try { Write-Warning ("Invardia did not take the status report with the release fields (wave, release mode) -- it was sent without them{0}. To turn them off: SI_Telemetry_ReleaseControl = off." -f $(if ($held) { ', and they are held back for 24 hours' } else { '' })) } catch { }
|    }
|    [pscustomobject]@{ Result = $r2; Record = $Record; Held = $held }
|}
|
|function ConvertTo-SITelemetryEnvironmentName {
|    <# PURE. The environment's name for the uplink: trimmed, one line, without a ring / edition it carries itself
|       ('Internal (ring 1, PRO)' -> 'Internal', the same name the mail subjects use), at most 100 characters; '' = left out. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    $v = ("$Value" -replace '[\r\n\t]+', ' ').Trim()
|    $v = ($v -replace '(?i)\s*\([^()]*\b(ring\s*\d|pro|community)\b[^()]*\)\s*$', '').Trim()
|    if ($v.Length -gt 100) { $v = $v.Substring(0, 100).TrimEnd() }
|    $v
|}
|
|function Get-SITelemetryEnvironmentName {
|    <#
|        The environment's name as the web app's header shows it (MAIL-3 / #653: the same name the mail subjects carry):
|        SIWeb_EnvironmentName, else SI_EnvironmentName. Not set = '' (left out -- the install id is not a name). -Globals
|        is the test seam.
|    #>
|    param([System.Collections.IDictionary]$Globals)
|    foreach ($n in @('SIWeb_EnvironmentName', 'SI_EnvironmentName')) {
|        $v = if ($Globals) { if ($Globals.Contains($n)) { $Globals[$n] } else { $null } } else { Get-Variable -Name $n -Scope Global -ValueOnly -ErrorAction SilentlyContinue }
|        $v = ConvertTo-SITelemetryEnvironmentName ([string]$v)
|        if ($v) { return $v }
|    }
|    ''
|}
|
|# =====================================================================================================================
|#  This install: where state is kept, the install id, the install key, the endpoint
|# =====================================================================================================================
|function Get-SITelemetryStateDirectory {
|    <# Where the install id and the last heartbeat date are kept: SI_TELEMETRY_STATE_DIR, else
|       %ProgramData%\SecurityInsight\telemetry on Windows, else ~/.securityinsight/telemetry. #>
|    param([scriptblock]$GetEnv)
|    if (-not $GetEnv) { $GetEnv = { param($n) [Environment]::GetEnvironmentVariable($n) } }
|    $d = [string](& $GetEnv 'SI_TELEMETRY_STATE_DIR')
|    if ($d.Trim()) { return $d.Trim() }
|    if ([Environment]::OSVersion.Platform -eq [PlatformID]::Win32NT) {
|        return [System.IO.Path]::Combine([Environment]::GetFolderPath('CommonApplicationData'), 'SecurityInsight', 'telemetry')
|    }
|    $h = [Environment]::GetFolderPath('UserProfile'); if (-not $h) { $h = [System.IO.Path]::GetTempPath() }
|    [System.IO.Path]::Combine($h, '.securityinsight', 'telemetry')
|}
|
|function Test-SITelemetryProInstall {
|    <# PURE (with -GetEnv). Does this install have a Pro database (the setting, or the container's SI_CFG_ variable)? #>
|    param([scriptblock]$GetEnv)
|    if (-not $GetEnv) { $GetEnv = { param($n) [Environment]::GetEnvironmentVariable($n) } }
|    if ("$($global:SI_ProSqlServer)".Trim() -and "$($global:SI_ProSqlDatabase)".Trim()) { return $true }
|    return [bool]("$(& $GetEnv 'SI_CFG_SI_ProSqlServer')".Trim() -and "$(& $GetEnv 'SI_CFG_SI_ProSqlDatabase')".Trim())
|}
|
|function Get-SITelemetryInstallId {
|    <#
|        The anonymous install id: a random GUID created ONCE and kept in <state>\install-id. It identifies nothing but
|        "the same install as last time". When the file cannot be written (a read-only disk) a fresh id is used for this
|        process. Never throws.
|    #>
|    param([Parameter(Mandatory)][string]$StateDirectory, [scriptblock]$GetEnv)
|    # A CONTAINER keeps no file between runs: every run was a "new install" (6 installs reported for 3 -- fix request
|    # 85bd728f). There the id is derived from the install's own storage account name (one per install, the same every
|    # run); it still identifies nothing but "the same install as last time".
|    if (-not $GetEnv) { $GetEnv = { param($n) [Environment]::GetEnvironmentVariable($n) } }
|    $stg = "$(& $GetEnv 'SI_STORAGE_ACCOUNT')".Trim().ToLowerInvariant()
|    if ($stg -and "$(& $GetEnv 'SI_ENGINE')".Trim()) {
|        $sha = [System.Security.Cryptography.SHA256]::Create()
|        try { $h = $sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes('securityinsight-install:' + $stg)) } finally { $sha.Dispose() }
|        $b = New-Object byte[] 16; [Array]::Copy($h, $b, 16)
|        $b[7] = [byte](($b[7] -band 0x0F) -bor 0x50); $b[8] = [byte](($b[8] -band 0x3F) -bor 0x80)   # a version-5 shaped GUID
|        return ([guid]$b).ToString()
|    }
|    $guidRe = '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
|    $f = [System.IO.Path]::Combine($StateDirectory, 'install-id')
|    $damaged = $false
|    try {
|        if ([System.IO.File]::Exists($f)) {
|            $v = ([System.IO.File]::ReadAllText($f)).Trim().ToLowerInvariant()
|            if ($v -match $guidRe) { return $v }
|            $damaged = $true
|        }
|    } catch { }
|    $new = [guid]::NewGuid().ToString()
|    if ($damaged) {
|        # A damaged file is replaced once, so the install keeps ONE id from here on.
|        try { [System.IO.File]::WriteAllText($f, $new) } catch { }
|        return $new
|    }
|    try {
|        $null = [System.IO.Directory]::CreateDirectory($StateDirectory)
|        # CreateNew: two engines starting together must not overwrite each other's id. The loser reads the winner's.
|        $fs = New-Object System.IO.FileStream($f, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write)
|        try { $b = [System.Text.Encoding]::ASCII.GetBytes($new); $fs.Write($b, 0, $b.Length) } finally { $fs.Dispose() }
|    } catch {
|        try {
|            $v = ([System.IO.File]::ReadAllText($f)).Trim().ToLowerInvariant()
|            if ($v -match $guidRe) { return $v }
|        } catch { }
|    }
|    return $new
|}
|
|function Get-SITelemetryLastHeartbeat {
|    param([Parameter(Mandatory)][string]$StateDirectory)
|    try {
|        $f = [System.IO.Path]::Combine($StateDirectory, 'last-heartbeat')
|        if ([System.IO.File]::Exists($f)) { return ([System.IO.File]::ReadAllText($f)).Trim() }
|    } catch { }
|    return ''
|}
|
|function Set-SITelemetryLastHeartbeat {
|    param([Parameter(Mandatory)][string]$StateDirectory, [Parameter(Mandatory)][datetime]$NowUtc)
|    try {
|        $null = [System.IO.Directory]::CreateDirectory($StateDirectory)
|        [System.IO.File]::WriteAllText([System.IO.Path]::Combine($StateDirectory, 'last-heartbeat'),
|            $NowUtc.ToUniversalTime().ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture))
|    } catch { }
|}
|
|function Get-SITelemetryEndpoint {
|    <# The report address: SI_Telemetry_Endpoint, else SI_TELEMETRY_ENDPOINT, else '' (= the framework default, Invardia's). #>
|    $e = @([string]$global:SI_Telemetry_Endpoint, [string]$env:SI_TELEMETRY_ENDPOINT) | Where-Object { "$_".Trim() } | Select-Object -First 1
|    return "$e".Trim()
|}
|
|function Get-SITelemetryInstallKey {
|    <# Pro / trial only: the install key from the install's Key Vault (SI-Invardia-InstallKey), read as the runtime
|       identity. '' when there is none or it cannot be read -- the install then reports anonymously. Never throws, never
|       prints the value.
|       -WithReason: @{ Key; Reason } -- Reason says in plain words why there is no key ('' when there is one); it names
|       the secret and the vault, never a value.
|       -Name: another secret read the same way (Invardia S16: SI-InstallId, the install's lasting id); default the install key. #>
|    param([switch]$WithReason, [string]$Name)
|    if ($null -eq (Get-SITelemetrySendState)) { $script:SITelemetrySend = New-SITelemetrySendState }
|    $name = if ("$Name".Trim()) { "$Name".Trim() } else { (Get-SITelemetrySendState).InstallKeyName }
|    $why = ''
|    $key = ''
|    try {
|        # an internal install: the platform Key Vault (signed in by SecurityInsight itself -- auth/SI-PlatformConnect.ps1)
|        if ($global:Context -and $global:KV_HighPriv_KeyVaultName) {
|            try {
|                if (-not (Get-Command -Name Get-SIPlatformSecret -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'auth', 'SI-PlatformConnect.ps1')) }
|                $v = [string](Get-SIPlatformSecret -Context $global:Context -Name $name -AsPlainText -ErrorAction Stop 3>$null); if ($v.Trim()) { $key = $v.Trim() }
|                else { $why = ('{0} is empty or missing in the platform Key Vault {1}' -f $name, [string]$global:KV_HighPriv_KeyVaultName) }
|            } catch { $why = ('{0} could not be read from the platform Key Vault {1}: {2}' -f $name, [string]$global:KV_HighPriv_KeyVaultName, $_.Exception.Message) }
|        }
|        if (-not $key) {
|            if (-not (Get-Command -Name Get-SIVaultName -ErrorAction SilentlyContinue)) {
|                $h = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'auth', 'Get-SIVaultName.ps1'); if (Test-Path -LiteralPath $h) { . $h }
|            }
|            $vault = $null
|            if (Get-Command -Name Get-SIVaultName -ErrorAction SilentlyContinue) { try { $vault = Get-SIVaultName -AllowMissing } catch { } }
|            elseif ($global:SI_KeyVaultName) { $vault = [string]$global:SI_KeyVaultName }
|            if (-not $vault) {
|                if (-not $why) { $why = 'the install''s Key Vault is not known to this job (SI_KeyVaultName is not set)' }
|            } else {
|                if (-not (Get-Command -Name Get-SIKvSecret -ErrorAction SilentlyContinue)) {
|                    $h = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'auth', 'Get-SIKvSecret.ps1'); if (Test-Path -LiteralPath $h) { . $h }
|                }
|                if (Get-Command -Name Get-SIKvSecret -ErrorAction SilentlyContinue) {
|                    $kvWarn = $null
|                    $v = [string](Get-SIKvSecret -VaultName $vault -SecretName $name -WarningVariable kvWarn -WarningAction SilentlyContinue)
|                    $key = $v.Trim()
|                    if (-not $key) {
|                        $w = (@($kvWarn) | ForEach-Object { [string]$_ } | Select-Object -First 1)
|                        $why = $(if ($w) { ('{0} could not be read from the Key Vault {1}: {2}' -f $name, $vault, ($w -replace '^Get-SIKvSecret:\s*', '')) }
|                                 else { ('{0} is not in the Key Vault {1}, or this job''s identity may not read secrets there' -f $name, $vault) })
|                    }
|                } elseif (-not $why) { $why = 'the Key Vault reader (auth\Get-SIKvSecret.ps1) is not available in this job' }
|            }
|        }
|    } catch { $key = ''; if (-not $why) { $why = ('{0} could not be read: {1}' -f $name, $_.Exception.Message) } }
|    if ($key) { $why = '' }
|    if ($WithReason) { return [pscustomobject]@{ Key = $key; Reason = $why } }
|    return $key
|}
|
|function Get-SITelemetryVersion {
|    <#
|        The BUILD LABEL of this install: the stamped build (BUILD.json) as "<display>+<shortCommit>" -- e.g.
|        "3.0.0-rc.12+0dc9062" -- so a fleet view tells the builds of one release apart. No BUILD.json: the VERSION file.
|        CR2 (Invardia 2026-10-18): this is NOT what Version says on the uplink -- Version is the RELEASE the install runs
|        (Get-SITelemetryReleaseVersion; Invardia matches installs to releases by it: the health hold, "who runs V"); the
|        label rides as its own field `build` (heartbeat and run report; an optional field, resent without when refused).
|    #>
|    if ($null -eq (Get-SITelemetrySendState)) { $script:SITelemetrySend = New-SITelemetrySendState }
|    try {
|        $bj = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'BUILD.json')
|        if ([System.IO.File]::Exists($bj)) {
|            $j = [System.IO.File]::ReadAllText($bj) | ConvertFrom-Json
|            $d = ([string]$j.display).Trim(); $sc = ([string]$j.shortCommit).Trim()
|            if ($d) { return $(if ($sc) { '{0}+{1}' -f $d, $sc } else { $d }) }
|        }
|    } catch { }
|    try {
|        $f = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'VERSION')
|        if ([System.IO.File]::Exists($f)) { return ([System.IO.File]::ReadAllText($f)).Trim() }
|    } catch { }
|    return ''
|}
|
|function Get-SITelemetryReleaseVersion {
|    <# The RELEASE this install runs (BUILD.json 'release', stamped by Publish-SIRelease: 3.0.0.<build number>) -- what the
|       error catalogue's fixedIn is compared with (#709). Not stamped (an older or a local package): the reported version,
|       which never reads as newer than a fix. #>
|    if ($null -eq (Get-SITelemetrySendState)) { $script:SITelemetrySend = New-SITelemetrySendState }
|    try {
|        $bj = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'BUILD.json')
|        if ([System.IO.File]::Exists($bj)) {
|            $j = [System.IO.File]::ReadAllText($bj) | ConvertFrom-Json
|            if ($j.PSObject.Properties['release'] -and "$($j.release)".Trim()) { return ([string]$j.release).Trim() }
|        }
|    } catch { }
|    Get-SITelemetryVersion
|}
|
|function Test-SITelemetryReleasedLabel {
|    <# PURE. #918 / #919: is -Release (BUILD.json 'release') the label of a RELEASED build? Digits and dots only, 3 or 4 parts --
|       3.0.1 (#919, from the next release on) and 3.0.0.202610272235 (before). Empty, a dev / rc / local label, or any letter
|       is not. Decided by BUILD.json's release field, never by the number of parts of VERSION. @{ Released; Reason }. #>
|    param([AllowNull()][AllowEmptyString()][string]$Release)
|    $r = "$Release".Trim()
|    if (-not $r) { return [pscustomobject]@{ Released = $false; Reason = 'BUILD.json carries no release (a dev tree, a test VM or a gate''s work folder)' } }
|    if ($r -match '^\d+\.\d+\.\d+(\.\d+)?$') { return [pscustomobject]@{ Released = $true; Reason = ('release {0}' -f $r) } }
|    [pscustomobject]@{ Released = $false; Reason = ("'{0}' is a dev or pre-release label" -f $r) }
|}
|
|function Test-SITelemetryReleasedBuild {
|    <# #918: does this install run a RELEASED build? Reads ONLY BUILD.json's 'release' under the solution root (-Root; default
|       the root of this file's tree) -- a dev tree has none, whatever its VERSION file says. @{ Released; Reason }. Never throws. #>
|    param([string]$Root)
|    try {
|        if (-not "$Root".Trim()) { if ($null -eq (Get-SITelemetrySendState)) { $script:SITelemetrySend = New-SITelemetrySendState }; $Root = (Get-SITelemetrySendState).SIRoot }
|        $bj = [System.IO.Path]::Combine($Root, 'BUILD.json')
|        if (-not [System.IO.File]::Exists($bj)) { return [pscustomobject]@{ Released = $false; Reason = 'no BUILD.json (a dev tree, a test VM or a gate''s work folder)' } }
|        $j = [System.IO.File]::ReadAllText($bj).TrimStart([char]0xFEFF) | ConvertFrom-Json -ErrorAction Stop
|        Test-SITelemetryReleasedLabel -Release $(if ($j.PSObject.Properties['release']) { [string]$j.release } else { '' })
|    } catch { [pscustomobject]@{ Released = $false; Reason = ('BUILD.json could not be read ({0})' -f $_.Exception.Message) } }
|}
|
|function Test-SITelemetryCommunitySendAllowed {
|    <# #918 (2026-10-27: 210 "installs" on version 3.0.0 were test runs and dev runs): may a record go out with -AccessCode? Only
|       the PUBLIC community code is gated -- an identified install's own key is never refused here. The community code needs a
|       RELEASED build (Test-SITelemetryReleasedBuild; -Released overrides it, tests). @{ Allowed; Reason }. #>
|    param([AllowNull()][AllowEmptyString()][string]$AccessCode, $Released)
|    $community = if (Get-Variable -Name AitUplinkCommunityCode -Scope Script -ErrorAction SilentlyContinue) { [string]$script:AitUplinkCommunityCode } else { 'invardia-community-telemetry-v1' }
|    if ("$AccessCode" -ne $community) { return [pscustomobject]@{ Allowed = $true; Reason = 'not the community code' } }
|    $rel = if ($null -ne $Released) { [pscustomobject]@{ Released = [bool]$Released; Reason = $(if ($Released) { 'released' } else { 'not a released build' }) } } else { Test-SITelemetryReleasedBuild }
|    if ($rel.Released) { return [pscustomobject]@{ Allowed = $true; Reason = $rel.Reason } }
|    [pscustomobject]@{ Allowed = $false; Reason = ('not a released build ({0}) -- nothing is sent to the public community uplink' -f $rel.Reason) }
|}
|
|function Get-SITelemetryContext {
|    <#
|        Who and what this install reports as, once per process (cached in $global:SI_TelemetryContext). Every input can be
|        injected (tests): -License (a Get-SILicense status), -InstallKey, -GetEnv, -StateDirectory, -Vars (runtime
|        identity), -TenantId, -Version. Returns Mode (anonymous | identified), Endpoint, AccessCode, Edition, LicenceState,
|        Version, Hosting, RuntimeIdentity, InstallId (anonymous only), TenantId (identified only), StateDirectory.
|        The install key is looked up ONLY for a Pro / trial licence: a Community install never touches a Key Vault here.
|    #>
|    param([AllowNull()]$License, [AllowNull()][AllowEmptyString()][string]$InstallKey, [scriptblock]$GetEnv, [string]$StateDirectory,
|          [System.Collections.IDictionary]$Vars, [AllowEmptyString()][string]$TenantId, [string]$Version, [switch]$Refresh,
|          # #427: the edition when the caller knows it better than a licence status (the guided install, the updater)
|          [ValidateSet('', 'community', 'pro', 'trial')][string]$Edition = '',
|          # the ring (Resolve-SIReportedRing): -UpdaterRing = what the updater resolved in this process; -RingFacts = the
|          # cfg.InstallState rows (default $global:SI_InstallRingFacts, read by the Pro settings layer at run start);
|          # -RingSetting = SI_UpdateRing (default the global); -CommunityRing = config\update.custom.json's ring
|          [AllowNull()]$UpdaterRing, [AllowNull()]$RingFacts, [AllowNull()]$RingSetting, [AllowNull()]$CommunityRing,
|          # framework §8.4: the install's own links (default: Get-SITelemetryInstallEndpoints) -- identified installs only
|          [AllowNull()][object[]]$Endpoints,
|          # MAIL-3 (#653): the environment's name (default: Get-SITelemetryEnvironmentName) -- identified installs only
|          [AllowNull()][AllowEmptyString()][string]$EnvironmentName,
|          # Invardia S16: the install's LASTING id (SI-InstallId) -- identified installs only. Not given: read (only) from the
|          # Key Vault the install key comes from -- unless the caller gave -InstallKey, then it gives this too ('' = none)
|          [AllowNull()][AllowEmptyString()][string]$LastingInstallId)
|    $injected = @($PSBoundParameters.Keys | Where-Object { $_ -ne 'Refresh' }).Count -gt 0
|    if (-not $injected -and -not $Refresh -and $global:SI_TelemetryContext) { return $global:SI_TelemetryContext }
|    if ($null -eq (Get-SITelemetrySendState)) { $script:SITelemetrySend = New-SITelemetrySendState }
|
|    if (-not $PSBoundParameters.ContainsKey('License')) {
|        $License = $null
|        if (-not (Get-Command -Name Get-SILicense -ErrorAction SilentlyContinue)) {
|            $cat = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'engine', 'SI-FeatureCatalog.ps1')
|            # Loaded here for this call only (functions dot-sourced in a function vanish when it returns) -- enough: the
|            # result is cached.
|            if (Test-Path -LiteralPath $cat) { try { . $cat } catch { } }
|        }
|        if (Get-Command -Name Get-SILicense -ErrorAction SilentlyContinue) { try { $License = Get-SILicense 3>$null } catch { $License = $null } }
|    }
|    $li = Get-SITelemetryLicenceInfo -License $License
|    if ($Edition) { $li = [pscustomobject]@{ Edition = $Edition; LicenceState = $li.LicenceState } }
|    elseif ($li.Edition -eq 'community' -and (Test-SITelemetryProInstall -GetEnv $GetEnv)) {
|        # An install WITH a Pro database is Pro even when this run could not read its licence (it failed before, or its
|        # identity cannot read the vault): reported as Pro with the licence state as found -- never as an anonymous
|        # Community install (fix request 85bd728f: three Pro installs reported as six Community ones).
|        $li = [pscustomobject]@{ Edition = 'pro'; LicenceState = $li.LicenceState }
|    }
|    $hosting = Get-SITelemetryHosting -GetEnv $GetEnv
|    $rt = Get-SITelemetryRuntimeIdentity -Hosting $hosting -Vars $Vars
|    $key = ''
|    # why this install reports anonymously (plain words; never a secret value) -- '' when it is identified
|    $anonWhy = ''
|    if ($li.Edition -ne 'community') {
|        if ($PSBoundParameters.ContainsKey('InstallKey')) { $key = "$InstallKey".Trim(); if (-not $key) { $anonWhy = 'no install key was given' } }
|        else {
|            $kr = Get-SITelemetryInstallKey -WithReason
|            if ($kr -is [string]) { $key = $kr.Trim() } else { $key = "$($kr.Key)".Trim(); $anonWhy = [string]$kr.Reason }
|            if (-not $key -and -not $anonWhy) { $anonWhy = 'the install key (SI-Invardia-InstallKey) could not be read' }
|        }
|        if ($key -and $key -notmatch '^inv-[^\s]{8,}$') { $anonWhy = 'the value stored as the install key (SI-Invardia-InstallKey) is not an Invardia install key' }
|        if ($key -notmatch '^inv-[^\s]{8,}$') { $key = '' }   # not an Invardia install key: report anonymously, never with it
|    } else {
|        $anonWhy = $(if ($null -eq $License) { 'no SecurityInsight Pro licence could be read in this run, and this install has no Pro database set' }
|                     else { ('no SecurityInsight Pro licence is in force (licence: {0}{1})' -f $(if ("$($License.Status)".Trim()) { [string]$License.Status } else { 'unknown' }), $(if ("$($License.Reason)".Trim()) { ' -- ' + [string]$License.Reason } else { '' })) })
|    }
|    Initialize-SIAitUplinkScope
|    # THE INSTALL KEY GOES ONLY TO INVARDIA (https, invardia.com or a subdomain): a report address set to anything else is
|    # used ANONYMOUSLY -- the key never leaves for it -- and said once per process
|    $ep = Get-SITelemetryEndpoint
|    if ($key -and $ep) {
|        $epWhy = Test-SITelemetryEndpointHost -Endpoint $ep
|        if ($epWhy) {
|            if (-not [bool](Get-Variable -Name SI_TelemetryEndpointWarned -Scope Global -ValueOnly -ErrorAction SilentlyContinue)) {
|                Write-Warning ('[telemetry] the report address is not Invardia''s ({0}) -- this install reports to it anonymously; its install key is sent only to Invardia' -f $epWhy)
|                $global:SI_TelemetryEndpointWarned = $true
|            }
|            $key = ''; $anonWhy = 'the report address is not Invardia''s -- the install key is sent only to Invardia'
|        }
|    }
|    $sender = Resolve-AitUplinkSender -Enabled $true -InstallKey $key -Endpoint $ep
|    if ($sender.Mode -ne 'anonymous') { $anonWhy = '' }
|    $dir = if ("$StateDirectory".Trim()) { $StateDirectory } else { Get-SITelemetryStateDirectory -GetEnv $GetEnv }
|    $iid = ''; $tid = ''; $lasting = ''
|    if ($sender.Mode -eq 'anonymous') { $iid = Get-SITelemetryInstallId -StateDirectory $dir -GetEnv $GetEnv }
|    else {
|        $tid = if ($PSBoundParameters.ContainsKey('TenantId')) { $TenantId }
|               elseif (Get-Command -Name Get-SIRunTenantId -ErrorAction SilentlyContinue) { try { [string](Get-SIRunTenantId) } catch { '' } } else { '' }
|        # Invardia S16: the install's LASTING id (SI-InstallId, made once by the licence knock) -- never the anonymous id
|        # above; read only, and '' (no field) when there is none, it cannot be read or it is not a GUID
|        $lasting = if ($PSBoundParameters.ContainsKey('LastingInstallId')) { ConvertTo-SIInvardiaInstallId $LastingInstallId }
|                   elseif ($PSBoundParameters.ContainsKey('InstallKey')) { '' }
|                   else { try { ConvertTo-SIInvardiaInstallId ([string](Get-SITelemetryInstallKey -Name 'SI-InstallId')) } catch { '' } }
|    }
|    # CR2: Version = the RELEASE this install runs (BUILD.json 'release', 3.0.0.<build number>); not known (a dev run) = the build
|    # label, as before. The label itself rides as Build (the wire field `build`).
|    $build = Get-SITelemetryVersion
|    $ver = if ($PSBoundParameters.ContainsKey('Version')) { $Version } else { Get-SITelemetryReleaseVersion }
|    $ring = Get-SITelemetryRing -Edition $li.Edition -BoundParameters $PSBoundParameters -UpdaterRing $UpdaterRing -RingFacts $RingFacts -RingSetting $RingSetting -CommunityRing $CommunityRing
|    $ctx = [pscustomobject]@{
|        Mode = $sender.Mode; Endpoint = $sender.Endpoint; AccessCode = $sender.AccessCode
|        Edition = $li.Edition; LicenceState = $li.LicenceState; Version = $ver; Build = $build; Hosting = $hosting; RuntimeIdentity = $rt
|        InstallId = $iid; TenantId = $tid; StateDirectory = $dir; Ring = $ring.Ring; RingSource = $ring.Source
|        # Invardia S16: the install's LASTING id (identified only; '' = none -> no field). InstallId above stays the anonymous one.
|        LastingInstallId = $lasting
|        # why the install reports anonymously ('' when identified) -- said in the run's log by a caller that needs identified
|        # (the data health record); never sent
|        AnonymousReason = $anonWhy
|        # #517: the installed licence's id (identified only; '' when it has no GUID-shaped id)
|        LicenceId = $(if ($sender.Mode -ne 'anonymous' -and $License -and (Get-Command -Name ConvertTo-SILicenceIdOrEmpty -ErrorAction SilentlyContinue)) { ConvertTo-SILicenceIdOrEmpty ([string]$License.LicenseId) } else { '' })
|        # framework §8.4: the install's own links -- identified only (an anonymous install never names its addresses)
|        Endpoints = $(if ($sender.Mode -eq 'anonymous') { , @() }
|                      elseif ($PSBoundParameters.ContainsKey('Endpoints')) { , @(ConvertTo-SITelemetryEndpointList -Items $Endpoints) }
|                      else { , @(Get-SITelemetryInstallEndpoints) })
|        # MAIL-3 (#653): the web app header's name -- identified only (a name says whose install it is)
|        EnvironmentName = $(if ($sender.Mode -eq 'anonymous') { '' }
|                            elseif ($PSBoundParameters.ContainsKey('EnvironmentName')) { ConvertTo-SITelemetryEnvironmentName $EnvironmentName }
|                            else { Get-SITelemetryEnvironmentName })
|    }
|    if (-not $injected) { $global:SI_TelemetryContext = $ctx }
|    $ctx
|}
|
|function Initialize-SITelemetryLastingInstallId {
|    <#
|        Invardia 2026-11-01 (S16, answer 2): THE UPLINK JOB MAKES THE LASTING ID WHEN IT IS MISSING, so every identified install
|        sends one -- also one whose licence never needed a knock. Called by the heartbeat job (Send-SIHeartbeatTick) on a tick
|        it sends. -Context: an IDENTIFIED Get-SITelemetryContext without a LastingInstallId; anything else is returned as it is.
|        The id is made by the licence knock's own code (Resolve-SIInvardiaInstallId: a GUID, written to SI-InstallId, read
|        back -- an existing value is never rewritten; when the knock and this job make it at once, the kept one wins for both).
|        FIRST WRITE WINS: with -ReadVersions { param($Name) } (the versions of SI-InstallId; default: the vault's, over REST)
|        the id is the oldest version that holds a GUID, whichever side wrote it.
|        Seams: -ReadSecret { param($Name) } / -WriteSecret { param($Name, $Value) }; default: the install's Key Vault (the
|        reader the install key comes through; Set-SIAzKeyVaultSecret for the one write) -- never in a test session.
|        A vault that cannot be read or written = no id THIS tick (said once per process), never a failure. Returns the context.
|    #>
|    param($Context, [scriptblock]$ReadSecret, [scriptblock]$WriteSecret, [scriptblock]$ReadVersions)
|    try {
|        if ($null -eq $Context -or [string]$Context.Mode -ne 'identified') { return $Context }
|        # FIRST WRITE WINS: with the vault's versions the id is resolved every tick (the oldest GUID version), so a context
|        # that read the newest value is corrected; without them a context that has an id keeps it
|        if (-not $ReadVersions -and $ReadSecret -and $WriteSecret -and $Context.PSObject.Properties['LastingInstallId'] -and "$($Context.LastingInstallId)".Trim()) { return $Context }
|        if (-not $ReadSecret -or -not $WriteSecret) {
|            if (Get-Module -Name Pester) { return $Context }   # a test session never touches a vault without its seams
|            # ONE vault for the read and the write: the install's own (the one the knock keeps SI-InstallId in). The read
|            # THROWS on anything but "there is none" (Get-SIAzKeyVaultSecret: 404 = $null, 403 / network = an error), so a
|            # vault this job cannot read is never taken for an empty one -- an existing id is never overwritten
|            if (-not (Get-Command -Name Get-SIVaultName -ErrorAction SilentlyContinue)) {
|                $h = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'auth', 'Get-SIVaultName.ps1'); if (Test-Path -LiteralPath $h) { . $h }
|            }
|            $vault = $null
|            if (Get-Command -Name Get-SIVaultName -ErrorAction SilentlyContinue) { try { $vault = Get-SIVaultName -AllowMissing } catch { $vault = $null } }
|            if (-not $vault -and $global:SI_KeyVaultName) { $vault = [string]$global:SI_KeyVaultName }
|            if (-not $vault -or -not (Get-Command -Name Get-SIAzKeyVaultSecret -ErrorAction SilentlyContinue) -or -not (Get-Command -Name Set-SIAzKeyVaultSecret -ErrorAction SilentlyContinue)) { return $Context }
|            $kvGet = ${function:Get-SIAzKeyVaultSecret}; $kvSet = ${function:Set-SIAzKeyVaultSecret}; $kvVers = ${function:Get-SIInvardiaKvInstallIdVersions}
|            if (-not $ReadVersions -and $kvVers) { $ReadVersions = { param($n) & $kvVers -VaultName $vault -Name $n }.GetNewClosure() }
|            if (-not $ReadSecret) {
|                $ReadSecret = { param($n) $s = & $kvGet -VaultName $vault -Name $n -ErrorAction Stop; if (-not $s) { return $null }; [System.Net.NetworkCredential]::new('', $s.SecretValue).Password }.GetNewClosure()
|            }
|            if (-not $WriteSecret) {
|                $WriteSecret = { param($n, $v) $null = & $kvSet -VaultName $vault -Name $n -SecretValue (ConvertTo-SecureString -String $v -AsPlainText -Force) -ErrorAction Stop }.GetNewClosure()
|            }
|        }
|        $id = Resolve-SIInvardiaInstallId -ReadSecret $ReadSecret -WriteSecret $WriteSecret -ReadVersions $ReadVersions
|        if (-not $id -and -not [bool](Get-Variable -Name SI_LastingInstallIdWarned -Scope Global -ValueOnly -ErrorAction SilentlyContinue)) {
|            $global:SI_LastingInstallIdWarned = $true
|            Write-Host '  [telemetry] the install''s lasting id (SI-InstallId) could not be read or kept in the Key Vault -- the status reports go without it this time'
|        }
|        $Context | Add-Member -NotePropertyName LastingInstallId -NotePropertyValue $id -Force
|    } catch { }
|    return $Context
|}
|
|function Get-SITelemetryRing {
|    <#
|        The ring this install reports (Resolve-SIReportedRing, the order the web app's header uses): the updater's ring in
|        this process > the updater's recorded state > the ring recorded for the install > SI_UpdateRing > (Community) the
|        ring in config\update.custom.json. Each input the caller did not pass is read from where the product keeps it.
|        NEVER throws; returns @{ Ring; Source } (Ring $null = not known, left out of the report).
|    #>
|    param([string]$Edition, [System.Collections.IDictionary]$BoundParameters = @{}, [AllowNull()]$UpdaterRing, [AllowNull()]$RingFacts,
|          [AllowNull()]$RingSetting, [AllowNull()]$CommunityRing)
|    try {
|        $bound = @($BoundParameters.Keys); $has = { param($n) $bound -contains $n }
|        if (-not (& $has 'RingFacts')) { $RingFacts = $global:SI_InstallRingFacts }
|        if (-not (& $has 'RingSetting')) { $RingSetting = $global:SI_UpdateRing }
|        if (-not (& $has 'CommunityRing')) {
|            $CommunityRing = $null
|            if ($Edition -eq 'community') {
|                $file = [System.IO.Path]::Combine((Get-SITelemetrySendState).SIRoot, 'config', 'update.custom.json')
|                if (Test-Path -LiteralPath $file) { try { $CommunityRing = ([IO.File]::ReadAllText($file).TrimStart([char]0xFEFF) | ConvertFrom-Json -ErrorAction Stop).ring } catch { $CommunityRing = $null } }
|            }
|        }
|        $us = ''; $ir = ''
|        if ($RingFacts) {
|            $p = { param($n) if ($RingFacts -is [System.Collections.IDictionary]) { if ($RingFacts.Contains($n)) { [string]$RingFacts[$n] } else { '' } } elseif ($RingFacts.PSObject.Properties[$n]) { [string]$RingFacts.$n } else { '' } }
|            $us = & $p 'UpdateState'; $ir = & $p 'Ring'
|        }
|        Resolve-SIReportedRing -UpdaterRing $UpdaterRing -UpdateStateJson $us -InstallRingJson $ir -Setting $RingSetting -CommunityRing $CommunityRing
|    } catch { [pscustomobject]@{ Ring = $null; Source = '' } }
|}
|
|# =====================================================================================================================
|#  The one call: at the run-health END moment
|# =====================================================================================================================
|function Send-SITelemetryUplink {
|    <#
|        #517: the default transport. EXACTLY the framework client's post (Send-AitUplink: https only, a credential, the
|        X-Ait-Uplink-Code header, one attempt, never throws) -- and it keeps Invardia's answer: a 202 {"supersededBy": "<id>"}
|        (framework §12.6b) comes back as SupersededBy, and (#710, Invardia 1.0.488) a 202 {"environmentId": "<id>"} as
|        EnvironmentId. Refusals without a network call are Send-AitUplink's own.
|        Returns @{ Status; Reason; Sent; SupersededBy; EnvironmentId }.
|    #>
|    param([Parameter(Mandatory)][object]$Record, [AllowNull()][string]$Endpoint, [AllowNull()][string]$AccessCode, [int]$TimeoutSec = 5)
|    # #918: a build that is not a RELEASE never sends to the PUBLIC community uplink (identified installs are unchanged)
|    Initialize-SIAitUplinkScope
|    $gate = Test-SITelemetryCommunitySendAllowed -AccessCode $AccessCode
|    if (-not $gate.Allowed) { return [pscustomobject]@{ Status = 'skipped'; Reason = $gate.Reason; Sent = $false; SupersededBy = ''; EnvironmentId = '' } }
|    if ("$Endpoint" -notmatch '^https://' -or -not "$AccessCode".Trim()) { return (Send-AitUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec) }
|    try {
|        $body = $Record | ConvertTo-Json -Depth 6 -Compress
|        $answer = Invoke-RestMethod -Uri $Endpoint -Method Post -Headers @{ 'X-Ait-Uplink-Code' = $AccessCode; 'Content-Type' = 'application/json' } -Body $body -TimeoutSec $TimeoutSec -UseBasicParsing -ErrorAction Stop
|        [pscustomobject]@{ Status = 'ok'; Reason = 'uplink accepted'; Sent = $true; SupersededBy = (Get-SILicenceSupersededFromAnswer $answer); EnvironmentId = (Get-SIInvardiaEnvironmentIdFromAnswer $answer) }
|    } catch {
|        [pscustomobject]@{ Status = 'failed'; Reason = "uplink POST failed: $($_.Exception.Message)"; Sent = $false; SupersededBy = ''; EnvironmentId = '' }
|    }
|}
|
|function Invoke-SILicenceSupersededNotice {
|    <#
|        #517: Invardia says the installed licence was re-issued (-LicenceId = the newest one). Recorded for the updater's
|        licence step, which knocks with currentLicenceId on its next run: -OnSuperseded (tests), else the Pro database this
|        run opened ($global:SI_ProSettingsStore, set by the Pro settings layer) -- no second sign-in. One plain line in the
|        run's log. NEVER throws; $true when recorded.
|    #>
|    param([Parameter(Mandatory)][string]$LicenceId, [scriptblock]$OnSuperseded, $NowUtc)
|    $done = $false
|    try {
|        if ($OnSuperseded) { $null = & $OnSuperseded $LicenceId; $done = $true }
|        elseif ($global:SI_ProSettingsStore -and (Get-Command -Name Save-SILicenceSupersededMark -ErrorAction SilentlyContinue)) {
|            Save-SILicenceSupersededMark -Store $global:SI_ProSettingsStore -LicenceId $LicenceId -NowUtc $NowUtc; $done = $true
|        }
|    } catch { $done = $false }
|    try {
|        if ($done) { Write-Host (" [INFO] Invardia has issued a newer licence for this install ({0}); the updater fetches and installs it on its next run." -f $LicenceId) }
|        else { Write-Host (" [INFO] Invardia has issued a newer licence for this install ({0}), but this run could not record it for the updater. The installed licence keeps working; the next run tries again." -f $LicenceId) }
|    } catch { }
|    $done
|}
|
|function Get-SITelemetryLogTail {
|    <# The lines of this run's own transcript ($global:SI_TranscriptPath, or -Path), read while it is still open (shared
|       read) -- the last -Tail lines. Never throws: @() when there is none. #>
|    param([string]$Path = [string]$global:SI_TranscriptPath, [int]$Tail = 400)
|    try {
|        if (-not "$Path".Trim() -or -not [System.IO.File]::Exists($Path)) { return @() }
|        $fs = New-Object System.IO.FileStream($Path, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, ([System.IO.FileShare]::ReadWrite -bor [System.IO.FileShare]::Delete))
|        try { $sr = New-Object System.IO.StreamReader($fs, $true); $text = $sr.ReadToEnd() } finally { $fs.Dispose() }
|        $all = @($text -split "`r?`n")
|        if ($all.Count -gt $Tail) { $all = @($all[($all.Count - $Tail)..($all.Count - 1)]) }
|        return $all
|    } catch { return @() }
|}
|
|function Resolve-SITelemetryFailureDetail {
|    <#
|        The words and the class a run report that did not end ok carries (owner 2026-10-10: most failed reports reached
|        Invardia as 'unknown' with the pipeline's summary only, some with no text at all):
|          1. the failing STEP's own words + class when the run context carries them (FailedStepError / FailedStepErrorClass
|             -- the pipeline runner sets them from the failed step's run log), the summary kept after them;
|          2. else the run's own message;
|          3. no message -> the run's last log lines (-LogLines, else this run's transcript: Get-SITelemetryLogTail), the
|             first error lines of it (Get-SIErrorLines).
|        Returns @{ Text; ErrorClass ('' = classify the text); Source = step | message | log | '' }. Never throws.
|    #>
|    param([AllowNull()]$RunContext, [AllowEmptyString()][string]$ErrorMessage, [AllowEmptyString()][string]$ExitReason, [AllowNull()][string[]]$LogLines)
|    $out = [pscustomobject]@{ Text = ''; ErrorClass = ''; Source = '' }
|    try {
|        $has = { param($n) $RunContext -and $RunContext.PSObject.Properties[$n] -and "$($RunContext.$n)".Trim() }
|        $msg = "$ErrorMessage".Trim()
|        if (& $has 'FailedStepError') {
|            $out.Text = "$($RunContext.FailedStepError)".Trim()
|            if ($msg -and $msg -ne $out.Text) { $out.Text = "{0}`n({1})" -f $out.Text, $msg }
|            $out.Source = 'step'
|            if (& $has 'FailedStepErrorClass') {
|                $c = "$($RunContext.FailedStepErrorClass)".Trim().ToLowerInvariant()
|                if ((Get-SIErrorClasses) -contains $c -and $c -ne 'unknown') { $out.ErrorClass = $c }
|            }
|            if (-not $out.ErrorClass) { $out.ErrorClass = Get-SIErrorClass -Message "$($RunContext.FailedStepError)" -ExitReason $ExitReason }
|            if ($out.ErrorClass -eq 'unknown' -and $msg) { $c2 = Get-SIErrorClass -Message $msg -ExitReason $ExitReason; if ($c2 -ne 'unknown') { $out.ErrorClass = $c2 } }
|            return $out
|        }
|        if ($msg) { $out.Text = $msg; $out.Source = 'message'; return $out }
|        $lines = if ($null -ne $LogLines) { @($LogLines) } else { @(Get-SITelemetryLogTail) }
|        $t = Get-SIErrorLines -Lines $lines
|        if ($t) { $out.Text = $t; $out.Source = 'log' }
|    } catch { }
|    $out
|}
|
|function Send-SITelemetryRunEnd {
|    <#
|        Report one engine run (and, once per UTC day, the heartbeat before it). NEVER throws; returns
|        @{ Status; Sent; Reason } -- Status: disabled | skipped | halted | ok | failed | error.
|          -RunContext    the run-health context (Engine, StartedAt, ShardIndex, FailedStep when the engine recorded it)
|          -ExitReason / -ErrorMessage / -AssetCount   what Send-SIRunHealthRow was given
|          -Context       a Get-SITelemetryContext result (default: this install's, cached)
|          -Transport     { param($Record, $Endpoint, $AccessCode, $TimeoutSec) } -> @{ Status } (default: the framework's
|                         Send-AitUplink). The test seam.
|          -Now           the clock (tests)
|          -HeartbeatCounts { } -> @{ users; guests; devices } for an IDENTIFIED heartbeat (default:
|                         Get-SITelemetryHeartbeatCounts, #424). Never called for an anonymous one. The test seam.
|        A shard other than the first reports only a run that did not end ok, so a sharded run is one report, not N.
|    #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][AllowNull()]$RunContext, [AllowEmptyString()][string]$ExitReason, [AllowEmptyString()][string]$ErrorMessage,
|          [long]$AssetCount = -1, $Context, [scriptblock]$Transport, $Now, [scriptblock]$HeartbeatCounts,
|          # #427: a failure report from outside an engine run (the install, the updater) carries no heartbeat
|          [switch]$NoHeartbeat,
|          # #491: the setup report's closed list (default config\setup-catalog.locked.json) -- the test seam
|          $SetupCatalog,
|          # #517: { param($LicenceId) } when Invardia answers that the installed licence was re-issued (default: recorded for
|          # the updater's licence step, Save-SILicenceSupersededMark on the Pro database the run has open) -- the test seam
|          [scriptblock]$OnSuperseded,
|          # #709: { } -> the capability probe (Get-SICapabilityProbe's shape) for the heartbeat (default: Get-SICapabilityProbe,
|          # never in a test session) -- the test seam
|          [scriptblock]$CapabilityProbe,
|          # #710: { param($EnvironmentId) } when Invardia's answer names an environment id this install has not recorded yet
|          # (default: Save-SIInvardiaEnvironmentMark on the Pro database the run has open) -- the test seam
|          [scriptblock]$OnEnvironment,
|          # framework 8.4: the Pro database a run record that is NOT taken is kept in (cfg.UplinkOutbox; default: the Pro
|          # settings store the run has open -- never in a test session) -- the test seam
|          [scriptblock]$OutboxInvoke)
|    $supSeen = ''
|    $envSeen = $false
|    $keptRun = $false
|    $out = { param($s, $sent, $why) [pscustomobject]@{ Status = $s; Sent = @($sent); Reason = $why; SupersededBy = $supSeen; Kept = [bool]$keptRun } }
|    try {
|        if (-not (Test-SITelemetryEnabled)) { return (& $out 'disabled' @() 'telemetry is switched off (SI_Telemetry_Enabled)') }
|        # an earlier report of this process was not taken: nothing more is SENT from it -- the run record is still built and
|        # KEPT in the outbox where the Pro database is open (framework 8.4); without one, nothing is built
|        $halted = [bool]$global:SI_TelemetryHalted
|        if ($halted -and -not $OutboxInvoke -and -not (Get-SIUplinkOutboxInvoke)) { return (& $out 'halted' @() 'an earlier report in this process was not accepted -- nothing more is sent from it') }
|        # A TEST SESSION NEVER SENDS. ~60 suites run engine code that reaches the run-health END record; none of them
|        # may report to Invardia or write an install id on the test machine. Pester is never loaded by an engine run.
|        # Only a test that hands in its own -Transport (a stub) gets past this line.
|        if (-not $Transport -and (Get-Module -Name Pester)) { return (& $out 'skipped' @() 'a test session (Pester is loaded) never sends; pass -Transport to test the sender') }
|        if ($null -eq $RunContext) { return (& $out 'skipped' @() 'no run context') }
|        $job = Resolve-SITelemetryJob -Engine ([string]$RunContext.Engine) -ReportTemplate ([string]$global:ReportTemplate)
|        if (-not $job) { return (& $out 'skipped' @() ("no telemetry job id for engine '{0}'" -f $RunContext.Engine)) }
|        $exit = ConvertTo-SITelemetryExitReason $ExitReason
|        if (-not $exit) { return (& $out 'skipped' @() ("run-health ExitReason '{0}' is not reported" -f $ExitReason)) }
|        $shard = 0; if ($RunContext.PSObject.Properties['ShardIndex']) { $shard = [int]$RunContext.ShardIndex }
|        if ($shard -gt 0 -and $exit -eq 'success') { return (& $out 'skipped' @() 'a successful shard other than the first is not reported separately') }
|        # a part of a run in parts (a collection's producer before its hand-over, a part's worker) does not report the job's
|        # ok: only the execution that knows the whole result does (the one that publishes the collection's records). Its
|        # failures and warnings are still reported.
|        if ($exit -eq 'success' -and $RunContext.PSObject.Properties['SuppressJobOk'] -and [bool]$RunContext.SuppressJobOk) { return (& $out 'skipped' @() 'a part of a run in parts does not report the job''s ok -- the execution that publishes the whole result does') }
|
|        $nowUtc = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|        if (-not $Context) { $Context = Get-SITelemetryContext }
|        if (-not $Transport) {
|            # #918: a build that is not a RELEASE (no BUILD.json release, a dev or rc label) never sends to the PUBLIC community
|            # uplink -- test runs, gate suites, the test VM and dev runs were counted as Community installs. Identified installs
|            # (their own key) are unchanged. Said here, before anything is built, so it is never a "not sent" warning.
|            $cg = Test-SITelemetryCommunitySendAllowed -AccessCode ([string]$Context.AccessCode)
|            if (-not $cg.Allowed) { return (& $out 'skipped' @() $cg.Reason) }
|            # #517: SI's sender (Send-SITelemetryUplink) -- the framework client's post, plus Invardia's answer (supersededBy)
|            $Transport = { param($Record, $Endpoint, $AccessCode, $TimeoutSec) Send-SITelemetryUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec }
|        }
|        $anon = ($Context.Mode -eq 'anonymous')
|        # framework 8.4: where a run record that is not taken is kept -- identified installs with the Pro database open only
|        $obInvoke = $null
|        if (-not $anon) { $obInvoke = if ($OutboxInvoke) { $OutboxInvoke } else { Get-SIUplinkOutboxInvoke } }
|        if ($halted -and -not $obInvoke) { return (& $out 'halted' @() 'an earlier report in this process was not accepted -- nothing more is sent from it') }
|        $lid = if (-not $anon -and $Context.PSObject.Properties['LicenceId']) { [string]$Context.LicenceId } else { '' }
|        # framework §8.4: the install's own links (identified heartbeat) and the run-health deep link (identified failed run)
|        $eps = @()
|        if (-not $anon) { $eps = @(if ($Context.PSObject.Properties['Endpoints']) { @($Context.Endpoints) } else { @(Get-SITelemetryInstallEndpoints) }) }
|        $runLink = if ($eps.Count) { Get-SITelemetryRunLink -Endpoints $eps } else { '' }
|        # MAIL-3 (#653): the environment's name (identified only; a context built without it carries none)
|        $envName = if (-not $anon -and $Context.PSObject.Properties['EnvironmentName']) { [string]$Context.EnvironmentName } else { '' }
|        $base = @{ Edition = $Context.Edition; Version = $Context.Version; Hosting = $Context.Hosting; RuntimeIdentity = $Context.RuntimeIdentity
|                   LicenceState = $Context.LicenceState; Now = $nowUtc
|                   # framework §8.4 / §8.7: EVERY heartbeat and run report carries the install's ring (Invardia judges the update
|                   # level against the version approved for it). Not known = left out, never guessed.
|                   Ring = $(if ($Context.PSObject.Properties['Ring']) { $Context.Ring } else { $null }) }
|        if ($anon) { $base.Anonymous = $true; $base.InstallId = $Context.InstallId } else { $base.TenantId = $Context.TenantId }
|
|        $durMs = 0L
|        if ($RunContext.PSObject.Properties['StartedAt'] -and $RunContext.StartedAt) {
|            try { $durMs = [long][Math]::Max(0, ($nowUtc - ([datetime]$RunContext.StartedAt).ToUniversalTime()).TotalMilliseconds) } catch { $durMs = 0L }
|        }
|        $counts = Get-SITelemetryCounts -Job $job -Count $AssetCount
|        $runArgs = @{} + $base
|        $runArgs.Job = $job; $runArgs.ExitReason = $exit; $runArgs.DurationMs = $durMs; $runArgs.Counts = $counts
|        $step = Get-SITelemetryFailedStep -RunContext $RunContext -ExitReason $exit -Job $job
|        if ($exit -ne 'success') {
|            # UPLINK-FIX (Invardia, 2026-10-07): a report that did not end ok ALWAYS carries FailedStep + ErrorClass (+ the
|            # ErrorText when identified) -- Invardia's signature is built from the three, and an empty one cannot be acted on
|            # (customer G 2026-10-07: two fix requests with none of them). No recorded step = 'run' (the run as a whole); no
|            # message = a sentence that says so, never an empty text.
|            if (-not $step) { $step = 'run' }
|            # Telemetry quality (owner 2026-10-10, "use telemetry from si"): the report carries the FAILING STEP's own words
|            # and class -- for the pipeline the step's (RunContext.FailedStepError / FailedStepErrorClass, set by the flow
|            # runner from the step's own run log), never the pipeline's summary line. No text = the run's last log lines.
|            $d = Resolve-SITelemetryFailureDetail -RunContext $RunContext -ErrorMessage $ErrorMessage -ExitReason $exit
|            $msg = [string]$d.Text
|            if (-not $msg) { $msg = ('{0} ended {1} without an error message (step {2})' -f $job, $exit, $step) }
|            # The class is computed from the text here; in anonymous mode the TEXT itself never leaves this function.
|            $runArgs.ErrorClass = if ($d.ErrorClass) { [string]$d.ErrorClass } else { Get-SIErrorClass -Message $msg -ExitReason $exit }
|            # #532 (framework §12.18): a throttled run is ErrorClass 'throttled', Outcome 'warning' -- never a fix request
|            if ($exit -eq 'throttled') { $runArgs.ErrorClass = 'throttled' }
|            if (-not $anon) { $runArgs.ErrorMessage = $msg }
|        }
|        if ($step) { $runArgs.FailedStep = $step }
|        # #641: a Risk Analysis run with a report that is NOT COMPLETE (Risk Analysis sets the numbers on its run context):
|        # FailedStep ra-report, ErrorClass report-incomplete, the three report counts (numbers only -- the report NAMES stay
|        # in the run's log and the database, never in the record) and, identified, the link to the web app's page of the run
|        $incN = Get-SITelemetryIncompleteReports -RunContext $RunContext
|        if ($null -ne $incN -and $exit -ne 'success') {
|            $c2 = @{}; foreach ($k in @($counts.Keys)) { $c2[$k] = $counts[$k] }
|            $c2['reportsExpected'] = $incN.Expected; $c2['reportsStored'] = $incN.Stored; $c2['reportsIncomplete'] = $incN.Incomplete
|            $counts = $c2; $runArgs.Counts = $counts
|            $runArgs.FailedStep = (Get-SITelemetryState).ReportIncompleteStep
|            $runArgs.ErrorClass = (Get-SITelemetryState).ReportIncompleteClass
|            if ($incN.Link) { $runLink = $incN.Link }
|            # the text says how many, the names are on the page and in the run's log; #709 (identified only): the most severe
|            # one's cause in plain words follows -- the report's id already travels in Reports[] (framework 8.16)
|            if (-not $anon) {
|                $runArgs.ErrorMessage = ('{0} of {1} Risk Analysis report(s) are not complete in this run -- the run''s page lists them' -f $incN.Incomplete, $incN.Expected)
|                $head = ''
|                try { if ($RunContext.PSObject.Properties['ReportCauses'] -and $RunContext.ReportCauses -and (Get-Command -Name Get-SIReportCauseHeadline -ErrorAction SilentlyContinue)) { $head = Get-SIReportCauseHeadline -Facts @($RunContext.ReportCauses) } } catch { $head = '' }
|                if ($head) { $runArgs.ErrorMessage += ('. First cause: {0}' -f $head) }
|            }
|        }
|        # the steps this run finished well (StepsOk): a later ok report closes the tickets of the steps it lists
|        $sok = @(Get-SITelemetryStepsOk -RunContext $RunContext -ExitReason $exit -FailedStep $(if ($runArgs.ContainsKey('FailedStep')) { [string]$runArgs.FailedStep } else { '' }))
|        if ($sok.Count) { $runArgs.StepsOk = [string[]]$sok }
|        $runRec = New-SITelemetryRunRecord @runArgs
|        # #709 / framework 8.16: every report that failed, did not apply or deviated, with its code and cause (Risk Analysis
|        # puts the facts on its run context as ReportCauses). Built here, never fatal: nothing = no Reports.
|        $causeItems = @()
|        try {
|            if ($RunContext.PSObject.Properties['ReportCauses'] -and $RunContext.ReportCauses) {
|                # #902: a report held on purpose goes with the hold contract only once Invardia takes it for this ring (REMOVE-ME switch)
|                $holdOn = $false
|                try { $holdOn = [bool](Resolve-SIUplinkHoldFieldsSwitch -Ring $(if ($Context.PSObject.Properties['Ring']) { $Context.Ring } else { $null })).On } catch { $holdOn = $false }
|                $causeItems = @(ConvertTo-SIUplinkReports -Facts @($RunContext.ReportCauses) -Identified:(-not $anon) -Version (Get-SITelemetryReleaseVersion) -Region (Get-SIUplinkRegion) -HoldFields:$holdOn)
|                # #902: the reports held on purpose (information only) -- a number on the run record, the names stay in the log
|                $nHeld = @(@($RunContext.ReportCauses) | Where-Object { (Test-SIUplinkFactHeld -Fact $_) -eq 'info' }).Count
|                if ($nHeld -gt 0) { $c3 = @{}; foreach ($k in @($counts.Keys)) { $c3[$k] = $counts[$k] }; $c3['reportsHeld'] = [long]$nHeld; $counts = $c3 }
|            }
|        } catch { $causeItems = @() }
|        # SUP-2026-00198: a failure outside a report whose catalogue code is known (Send-SITelemetryFailure -Code: the
|        # updater's roll / restore) is its own item, so the record names the code
|        try {
|            if ($RunContext.PSObject.Properties['FailureCode'] -and "$($RunContext.FailureCode)".Trim()) {
|                $causeItems = @($causeItems) + @(ConvertTo-SIUplinkFailureItem -Code ([string]$RunContext.FailureCode) -Job ([string]$RunContext.Engine) -Step ([string]$RunContext.FailedStep) `
|                                                   -Text $ErrorMessage -Identified:(-not $anon) -Version (Get-SITelemetryReleaseVersion) -Region (Get-SIUplinkRegion))
|            }
|        } catch { }
|        # a COMPLETE report with more rows than the source counted is a note, not a failure: never in Reports, kept on the
|        # run's own record (RunContext.ReportNotes) and said once in the run log
|        try {
|            if ($RunContext.PSObject.Properties['ReportCauses'] -and $RunContext.ReportCauses) {
|                $notes = @(Get-SIUplinkReportNotes -Facts @($RunContext.ReportCauses))
|                if ($notes.Count) {
|                    $RunContext | Add-Member -NotePropertyName 'ReportNotes' -NotePropertyValue $notes -Force
|                    Write-Host ('  Note: {0} complete report(s) returned more rows than the source counted -- nothing is missing, no action ({1}).' -f $notes.Count, ((@($notes | Select-Object -First 5) | ForEach-Object { $_.Report }) -join ', '))
|                }
|            }
|        } catch { }
|
|        $queue = New-Object System.Collections.Generic.List[object]
|        $relF = $null
|        $hbDue =Test-SITelemetryHeartbeatDue -LastSentDate (Get-SITelemetryLastHeartbeat -StateDirectory $Context.StateDirectory) -NowUtc $nowUtc
|        # a halted process sends nothing: no heartbeat and no setup report are built (only the run record, for the outbox)
|        if ($halted) { $hbDue = $false }
|        if ($hbDue -and -not $NoHeartbeat) {
|            # #424: users / guests / devices, Pro (identified) only. A count that cannot be computed is left out.
|            $hbCounts = $null
|            if (-not $anon) {
|                # a test session never queries a workspace for them: only a handed-in -HeartbeatCounts stub runs there
|                try { $hbCounts = if ($HeartbeatCounts) { & $HeartbeatCounts } elseif (-not (Get-Module -Name Pester)) { Get-SITelemetryHeartbeatCounts -NowUtc $nowUtc } }
|                catch { $hbCounts = $null }
|            }
|            # CR3 (#657): the wave and release mode (identified only, behind SI_Telemetry_ReleaseControl) -- never fails the heartbeat
|            $relF = $null
|            if (-not $anon) { try { $relF = Get-SITelemetryReleaseFields -Context $Context -NowUtc $nowUtc } catch { $relF = $null } }
|            # CR4 (#654): the guard mode (identified only): the context's when it carries one (tests), else the rows release
|            # control read, else the database it has open, else the guard code's own read (Get-SITelemetryGuardModeWire) --
|            # never fails the heartbeat (nothing recorded / not readable = left out)
|            $gmWire = $null
|            if (-not $anon) { $gmWire = Get-SITelemetryGuardModeWire -Context $Context -Invoke $(if ($relF) { $relF.Invoke } else { $null }) -Rows $(if ($relF) { $relF.Rows } else { $null }) -NowUtc $nowUtc }
|            # #709: the capability probe (Capabilities, CiColumns; Licences identified only) -- once per process, never in a
|            # test session without -CapabilityProbe, never fails the heartbeat
|            $probe = $null
|            try { $probe = if ($CapabilityProbe) { & $CapabilityProbe } elseif (-not (Get-Module -Name Pester)) { Get-SICapabilityProbe } } catch { $probe = $null }
|            $queue.Add((ConvertTo-SITelemetryWire -Record (New-SITelemetryHeartbeat @base) -Mode $Context.Mode -Counts $hbCounts -Now $nowUtc -Endpoints $eps -LicenceId $lid -EnvironmentName $envName -GuardMode $gmWire `
|                            -Wave $(if ($relF) { $relF.Wave } else { $null }) -ReleaseMode $(if ($relF) { $relF.ReleaseMode } else { $null }) -Components $(if ($relF) { $relF.Components } else { $null }) -Evidence $(if ($relF) { $relF.Evidence } else { $null }) -Probe $probe -Build $(if ($Context.PSObject.Properties['Build']) { [string]$Context.Build } else { '' })))
|        }
|        $runWire = ConvertTo-SITelemetryWire -Record $runRec -Mode $Context.Mode -Counts $counts -Now $nowUtc -Link $runLink -LicenceId $lid -EnvironmentName $envName -Reports $causeItems -Build $(if ($Context.PSObject.Properties['Build']) { [string]$Context.Build } else { '' })
|        $queue.Add($runWire)
|        # framework 8.4: the run record as it would be sent, taken BEFORE the send (a refused send may strip fields from it) --
|        # kept in the outbox when it is not taken. Only where an outbox applies (identified, the Pro database open).
|        $runJson = ''
|        if ($obInvoke -and $null -ne $runWire) { try { $runJson = ConvertTo-SIUplinkOutboxJson -Record $runWire } catch { $runJson = '' } }
|        $runTaken = $false
|        $keepRun = { param([string]$Why)
|            if ($runTaken -or -not $runJson) { return $false }
|            [bool](Add-SIUplinkOutboxRecord -Invoke $obInvoke -Job $job -Json $runJson -Answer $Why -NowUtc $nowUtc) }
|        if ($halted) {
|            $keptRun = & $keepRun 'not sent: an earlier report of this process was not taken'
|            return (& $out 'halted' @() ('an earlier report in this process was not accepted -- nothing more is sent from it{0}' -f $(if ($keptRun) { '; the run report is kept and goes with a later status report' } else { '' })))
|        }
|        # #491 / framework §8.7: the setup report (the control list) once a day with the heartbeat -- identified installs only,
|        # LAST in the queue so a refused setup report never costs the heartbeat or the run report. SI_Telemetry_SetupControls:
|        # all (default, owner 2026-10-18: "telemetry must be on") = every control in the catalog, and when Invardia refuses
|        # that report it goes again once with only the minimum list; minimum = only the framework's minimum controls; off = none. Anything that fails here leaves the setup report out, nothing else.
|        $setupMinimum = $null
|        if ($hbDue -and -not $NoHeartbeat -and -not $anon) {
|            try {
|                $scope = Resolve-SISetupControlScope -Value $global:SI_Telemetry_SetupControls
|                if ($scope -ne 'off') {
|                    $cat = if ($SetupCatalog) { $SetupCatalog } else { Get-SISetupCatalog }
|                    $us = ''; if ($global:SI_InstallRingFacts -and $global:SI_InstallRingFacts.PSObject.Properties['UpdateState']) { $us = [string]$global:SI_InstallRingFacts.UpdateState }
|                    $ps = ''; if ($global:SI_InstallRingFacts -and $global:SI_InstallRingFacts.PSObject.Properties['PipelineSchedule']) { $ps = [string]$global:SI_InstallRingFacts.PipelineSchedule }
|                    $states = Get-SISetupControlStates -Context $Context -ExitReason $exit -UpdateStateJson $us -NowUtc $nowUtc -PipelineScheduleJson $ps -SecretHandoverJson $(if ($global:SI_InstallRingFacts -and $global:SI_InstallRingFacts.PSObject.Properties['SecretHandover']) { [string]$global:SI_InstallRingFacts.SecretHandover } else { '' })
|                    $setup = New-SISetupReport -Context $Context -Catalog $cat -States $states -Scope $scope -Now $nowUtc
|                    if ($setup) { $queue.Add($setup) }
|                    # 'all' (the default) refused by Invardia goes again ONCE with only the minimum list (below)
|                    if ($setup -and $scope -eq 'all') { $setupMinimum = New-SISetupReport -Context $Context -Catalog $cat -States $states -Scope 'minimum' -Now $nowUtc }
|                }
|            } catch { }
|        }
|
|        $sent = New-Object System.Collections.Generic.List[string]
|        foreach ($w in $queue) {
|            if ($null -eq $w) { throw 'the report could not be built (an anonymous report needs its install id)' }
|            # CR3: a heartbeat refused WITH the release fields goes again once without them (Send-SITelemetryRecordWithFallback)
|            $r = (Send-SITelemetryRecordWithFallback -Record $w -Transport $Transport -Context $Context -TimeoutSec (Get-SITelemetrySendState).TimeoutSec `
|                    -Invoke $(if ($relF) { $relF.Invoke } else { $null }) -NowUtc $nowUtc).Result
|            # the setup report with every control (SI_Telemetry_SetupControls = all, the default) that Invardia does not take
|            # goes again ONCE with only the framework's minimum list -- said once per process; the minimum one decides
|            if ("$($r.Status)" -ne 'ok' -and [string]$w.Kind -eq 'setup' -and $setupMinimum) {
|                $firstWhy = ConvertTo-AitUplinkRedacted -Text ("$($r.Reason)")
|                $r = & $Transport $setupMinimum $Context.Endpoint $Context.AccessCode (Get-SITelemetrySendState).TimeoutSec
|                if ("$($r.Status)" -eq 'ok' -and -not $global:SI_SetupControlsFallbackSaid) {
|                    $global:SI_SetupControlsFallbackSaid = $true
|                    Write-Host ("  Invardia did not take the setup report with every SecurityInsight control ({0}) -- it was sent with the minimum control list instead." -f $firstWhy)
|                }
|                $setupMinimum = $null
|            }
|            if ("$($r.Status)" -ne 'ok') {
|                # STOP at the first answer that is not ok -- for the rest of this process. No retry in the run. The RUN record,
|                # when it was not taken (this one, or the one after a refused heartbeat), is kept in the outbox (framework 8.4)
|                $global:SI_TelemetryHalted = $true
|                $why = ConvertTo-AitUplinkRedacted -Text ("$($r.Reason)")
|                $keptRun = & $keepRun $why
|                if (-not $global:SI_TelemetryWarned) {
|                    $global:SI_TelemetryWarned = $true
|                    Write-Warning ("The status report to Invardia was not sent ({0}). The run is not affected; nothing more is sent from this run{1}. To turn these reports off, set `$global:SI_Telemetry_Enabled = `$false." -f $why, $(if ($keptRun) { ' -- the run report is kept in this install''s database and goes with a later status report' } else { '' }))
|                }
|                return (& $out 'failed' $sent $why)
|            }
|            if ([object]::ReferenceEquals($w, $runWire)) { $runTaken = $true }
|            $sent.Add([string]$w.Kind)
|            # #517: Invardia re-issued the installed licence -> recorded ONCE per process for the updater's licence step
|            if (-not $supSeen -and $r.PSObject.Properties['SupersededBy']) {
|                $sup = ConvertTo-SILicenceIdOrEmpty ([string]$r.SupersededBy)
|                if ($sup -and $sup -ne $lid) { $supSeen = $sup; $null = Invoke-SILicenceSupersededNotice -LicenceId $sup -OnSuperseded $OnSuperseded -NowUtc $nowUtc }
|            }
|            # #710: Invardia names the install's environment (identified only) -> recorded once per process, and only when it
|            # is not the id already recorded, for the customer mail's portal link (Send-SIMail)
|            if (-not $anon -and -not $envSeen -and $r.PSObject.Properties['EnvironmentId']) {
|                try {
|                    $eid = ConvertTo-SIInvardiaEnvironmentIdOrEmpty ([string]$r.EnvironmentId)
|                    if ($eid) {
|                        $envSeen = $true
|                        if ($eid -ne (Get-SIInvardiaEnvironmentIdKnown)) { $null = Invoke-SIInvardiaEnvironmentNotice -EnvironmentId $eid -OnEnvironment $OnEnvironment -NowUtc $nowUtc }
|                    }
|                } catch { }
|            }
|            if ($w.Kind -eq 'heartbeat') {
|                Set-SITelemetryLastHeartbeat -StateDirectory $Context.StateDirectory -NowUtc $nowUtc
|                try {
|                    $how = if ($anon) { 'anonymous: no tenant, host name or error text' } else { 'identified by this install''s key' }
|                    Write-Host (" [INFO] Sent today's status report to Invardia ({0}). To turn these reports off, set `$global:SI_Telemetry_Enabled = `$false." -f $how)
|                } catch { }
|            }
|        }
|        return (& $out 'ok' $sent ("sent {0} report(s) ({1})" -f $sent.Count, $Context.Mode))
|    } catch {
|        # #702 (customer B 2026-10-15): a run that ran out of memory could not even build its report, so Invardia never
|        # heard of the failure. Out of memory while preparing: let go of what can be let go and try ONCE more with the run
|        # report alone (no heartbeat counts, no setup report -- the smallest report there is). Once per process.
|        $prepErr = $_
|        $isOom = $false; try { $isOom = [bool]((Get-Command -Name Test-SIOutOfMemoryText -ErrorAction SilentlyContinue) -and (Test-SIOutOfMemoryText $prepErr)) } catch { $isOom = $true }
|        if ($isOom -and -not $script:SITelemetryOomRetried) {
|            $script:SITelemetryOomRetried = $true
|            try { [System.GC]::Collect(); [System.GC]::WaitForPendingFinalizers(); [System.GC]::Collect() } catch { }
|            $again = @{}; foreach ($k in @($PSBoundParameters.Keys)) { $again[$k] = $PSBoundParameters[$k] }
|            $again['NoHeartbeat'] = $true
|            try { return (Send-SITelemetryRunEnd @again) } catch { $prepErr = $_ }
|        }
|        $global:SI_TelemetryHalted = $true
|        if (-not $global:SI_TelemetryWarned) {
|            $global:SI_TelemetryWarned = $true
|            # si-upl-0601: the run record could not be built (data-model/errors.locked.json)
|            try { Write-Warning ("The status report to Invardia could not be prepared (si-upl-0601: {0}). The run is not affected." -f (ConvertTo-AitUplinkRedacted -Text $prepErr.Exception.Message)) } catch { }
|        }
|        return (& $out 'error' @() ("si-upl-0601: $($prepErr.Exception.Message)"))
|    }
|}
|
|# =====================================================================================================================
|#  #427: failures OUTSIDE an engine run -- the guided install's failed steps and the updater's failures
|# =====================================================================================================================
|function Send-SITelemetryFailure {
|    <#
|        Report ONE failure that happened outside an engine run (framework UPLINK-FIX, owner 2026-10-07: every failure a
|        product can observe reaches the uplink): -Job install (a guided install step, Job si-install), updater (Job
|        si-updater) or datasync (#904: a PART of the data sync that failed while the job completed, Job si-datasync), -Step the step id (FailedStep: the install step id, or download / verify / database / build / roll /
|        restore / claim / licence / ...), -ErrorMessage the error. It is a `run` report with Outcome failed, ErrorClass from
|        the text, the version, no heartbeat. The SAME rules as an engine run: the telemetry switch is honoured, identified
|        with the install key where one is known (the text redacted), anonymous otherwise (no tenant, no host, no text). A
|        test session never sends without -Transport. NEVER throws; returns the Send-SITelemetryRunEnd result.
|          -Context   a Get-SITelemetryContext result (default: this process's)
|    #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][ValidateSet('install', 'updater', 'datasync')][string]$Job, [Parameter(Mandatory)][AllowEmptyString()][string]$Step,
|          [AllowEmptyString()][string]$ErrorMessage, $StartedAt, $Context, [scriptblock]$Transport, $Now,
|          # the class when the caller KNOWS it (a value of the closed list; anything else is classified from the text)
|          [AllowEmptyString()][string]$ErrorClass,
|          # ring 1 2026-10-10: something the CUSTOMER must do (a role grant to re-run) -- Outcome warning, never 'failed':
|          # the update did not fail. With a customer-config class Invardia shows "needs customer action", no fix request.
|          [switch]$CustomerAction,
|          # #904: a PART of a job that failed while the job completed (-Job datasync: a part of the data sync) -- Outcome
|          # warning, the class and FailedStep of that part; with a product-defect class Invardia opens a fix request
|          [switch]$Partial,
|          # SUP-2026-00198: the failure's error-catalogue code when the caller KNOWS it (si-upd-0803 a refused roll,
|          # si-upd-0804 a failed restore, si-upd-0805 a roll that did not verify) -- sent as the record's Reports[] item
|          # (ConvertTo-SIUplinkFailureItem), so Invardia files it under that code and never as 'unknown'
|          [AllowEmptyString()][string]$Code)
|    try {
|        $st = ("$Step".Trim().ToLowerInvariant() -replace '[^a-z0-9\-]', '-') -replace '^[^a-z]+', ''
|        if (-not $st) { $st = 'unknown' }
|        $rc = [pscustomobject]@{ Engine = $Job; ShardIndex = 0; StartedAt = $StartedAt; FailedStep = $st }
|        if ("$Code".Trim()) {
|            $rc | Add-Member -NotePropertyName FailureCode -NotePropertyValue "$Code".Trim().ToLowerInvariant()
|            # a registry / platform that did not answer Azure is the platform's, not 'unknown' (the 400 of 2026-10-19)
|            if (-not "$ErrorClass".Trim() -and "$ErrorMessage" -match '(?i)connection refused|connection reset|i/o timeout|TLS handshake timeout|no such host|context deadline exceeded|Service Unavailable|Bad Gateway') { $ErrorClass = 'platform-5xx' }
|        }
|        if ("$ErrorClass".Trim()) { $rc | Add-Member -NotePropertyName FailedStepError -NotePropertyValue "$ErrorMessage"; $rc | Add-Member -NotePropertyName FailedStepErrorClass -NotePropertyValue "$ErrorClass".Trim() }
|        $a = @{ RunContext = $rc; ExitReason = $(if ($CustomerAction -or $Partial) { 'success-partial' } else { 'error' }); ErrorMessage = "$ErrorMessage"; NoHeartbeat = $true }
|        if ($Context) { $a.Context = $Context }
|        if ($Transport) { $a.Transport = $Transport }
|        if ($Now) { $a.Now = $Now }
|        Send-SITelemetryRunEnd @a
|    } catch { [pscustomobject]@{ Status = 'error'; Sent = @(); Reason = "$($_.Exception.Message)" } }
|}
|
|
|# =====================================================================================================================
|#  CR3 (#657): RELEASE MODE -- the identified heartbeat every 30 minutes for 12 hours after a release that changed engine code
|# =====================================================================================================================
|function Send-SIReleaseModeReport {
|    <#
|        One release-mode report, when one is due: an IDENTIFIED heartbeat (users, guests, devices, the guard mode, the wave)
|        with releaseMode { version, sinceUtc, untilUtc, everyMinutes } -- counts only, never a name. Due = this install is in
|        release mode (the engine fingerprint changed less than 12 hours ago, Get-SIReleaseModeFromFingerprint) AND no report
|        of this half hour was sent: the half hour is CLAIMED in the Pro database first (cfg.InstallState 'ReleaseModeReport',
|        one statement), so two processes never both send it. The same rules as every report: the telemetry switch, a test
|        session never sends without -Transport, the first answer that is not ok stops telemetry for the process. Behind
|        SI_Telemetry_ReleaseControl (auto = the confirmed rings only). NEVER throws; returns @{ Status; Reason }:
|        sent | disabled | halted | skipped | not-due | failed | error.
|          -Invoke          the Pro database seam (required: no database = nothing to read, nothing sent)
|          -Context         a Get-SITelemetryContext result (default: this install's)
|          -Transport       the test seam (default Send-SITelemetryUplink)
|          -HeartbeatCounts { } -> @{ users; guests; devices } (default Get-SITelemetryHeartbeatCounts; never in a test session)
|          -Rows            the cfg.InstallState rows (tests; default read through -Invoke)
|    #>
|    [CmdletBinding()]
|    param([scriptblock]$Invoke, $Context, [scriptblock]$Transport, $Now, [scriptblock]$HeartbeatCounts, $Rows)
|    $out = { param($s, $why) [pscustomobject]@{ Status = $s; Reason = $why } }
|    try {
|        if (-not (Test-SITelemetryEnabled)) { return (& $out 'disabled' 'telemetry is switched off (SI_Telemetry_Enabled)') }
|        if ($global:SI_TelemetryHalted) { return (& $out 'halted' 'an earlier report in this process was not accepted') }
|        if (-not $Transport -and (Get-Module -Name Pester)) { return (& $out 'skipped' 'a test session (Pester is loaded) never sends; pass -Transport to test the sender') }
|        if (-not $Invoke -and -not $Rows) { return (& $out 'skipped' 'no Pro database') }
|        $nowUtc = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|        if (-not $Context) { $Context = Get-SITelemetryContext }
|        if ($Context.Mode -eq 'anonymous') { return (& $out 'skipped' 'an anonymous install sends no release-mode reports') }
|        $rel = Get-SITelemetryReleaseFields -Context $Context -NowUtc $nowUtc -Invoke $Invoke -Rows $Rows
|        if (-not $rel.Rows) { return (& $out 'skipped' $rel.Reason) }
|        if (-not $rel.ReleaseMode -or $null -eq $rel.ReleaseMode.Value) {
|            return (& $out 'not-due' $(if ($rel.ReleaseMode) { 'not in release mode' } elseif ($rel.Reason) { $rel.Reason } else { 'no engine fingerprint is recorded' }))
|        }
|        $mode = Get-SIReleaseModeFromFingerprint -Fingerprint ([string]$rel.Rows.EngineFingerprint) -NowUtc $nowUtc
|        $slot = Get-SIReleaseModeSlot -Mode $mode -NowUtc $nowUtc
|        if ($slot -lt 0) { return (& $out 'not-due' 'not in release mode') }
|        $claimInvoke = if ($Invoke) { $Invoke } else { $rel.Invoke }
|        if (-not $claimInvoke) { return (& $out 'skipped' 'no Pro database to claim the half hour in') }
|        if (-not (Invoke-SIReleaseModeClaim -Invoke $claimInvoke -Mode $mode -Slot $slot -NowUtc $nowUtc)) { return (& $out 'not-due' ("the report of this half hour (slot {0}) was sent already" -f $slot)) }
|        if (-not $Transport) { $Transport = { param($Record, $Endpoint, $AccessCode, $TimeoutSec) Send-SITelemetryUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec } }
|
|        $base = @{ Edition = $Context.Edition; Version = $Context.Version; Hosting = $Context.Hosting; RuntimeIdentity = $Context.RuntimeIdentity
|                   LicenceState = $Context.LicenceState; Now = $nowUtc; Ring = $(if ($Context.PSObject.Properties['Ring']) { $Context.Ring } else { $null }); TenantId = $Context.TenantId }
|        $hbCounts = $null
|        try { $hbCounts = if ($HeartbeatCounts) { & $HeartbeatCounts } elseif (-not (Get-Module -Name Pester)) { Get-SITelemetryHeartbeatCounts -NowUtc $nowUtc } } catch { $hbCounts = $null }
|        $gmWire = $null
|        try { if (Get-Command -Name ConvertTo-SIGuardModeWire -ErrorAction SilentlyContinue) { $gmWire = ConvertTo-SIGuardModeWire -Mode (Get-SIGuardModeFromState -Fingerprint ([string]$rel.Rows.EngineFingerprint) -StrictEnd ([string]$rel.Rows.GuardStrictEnd) -NowUtc $nowUtc) } } catch { $gmWire = $null }
|        $eps = @(if ($Context.PSObject.Properties['Endpoints']) { @($Context.Endpoints) })
|        $lid = if ($Context.PSObject.Properties['LicenceId']) { [string]$Context.LicenceId } else { '' }
|        $envName = if ($Context.PSObject.Properties['EnvironmentName']) { [string]$Context.EnvironmentName } else { '' }
|        $w = ConvertTo-SITelemetryWire -Record (New-SITelemetryHeartbeat @base) -Mode $Context.Mode -Counts $hbCounts -Now $nowUtc -Endpoints $eps -LicenceId $lid -EnvironmentName $envName `
|                -GuardMode $gmWire -Wave $rel.Wave -ReleaseMode $rel.ReleaseMode -Components $rel.Components -Evidence $rel.Evidence -Build $(if ($Context.PSObject.Properties['Build']) { [string]$Context.Build } else { '' })
|        if ($null -eq $w) { return (& $out 'error' 'the report could not be built') }
|        $s = Send-SITelemetryRecordWithFallback -Record $w -Transport $Transport -Context $Context -TimeoutSec (Get-SITelemetrySendState).TimeoutSec -Invoke $claimInvoke -NowUtc $nowUtc
|        if ("$($s.Result.Status)" -ne 'ok') {
|            $global:SI_TelemetryHalted = $true
|            $why = ConvertTo-AitUplinkRedacted -Text ("$($s.Result.Reason)")
|            if (-not $global:SI_TelemetryWarned) {
|                $global:SI_TelemetryWarned = $true
|                Write-Warning ("The release-mode status report to Invardia was not sent ({0}). The run is not affected; nothing more is sent from this run." -f $why)
|            }
|            return (& $out 'failed' $why)
|        }
|        try { Write-Host (" [INFO] Sent a release-mode status report to Invardia (release {0}: every {1} minutes until {2}; counts only)." -f $(if ($mode.Version) { $mode.Version } else { 'with engine changes' }), $script:SIReleaseControl.EveryMinutes, (Format-SIGuardStrictUntil $mode.Until)) } catch { }
|        & $out 'sent' ("slot {0} of release {1}" -f $slot, $mode.Version)
|    } catch {
|        & $out 'error' ("$($_.Exception.Message)")
|    }
|}
|
|function Invoke-SIReleaseModeReportTick {
|    <#
|        The pipeline runner's call (engine\flow\Invoke-SIJobFlowRun.ps1): at every wake-up (every 5 minutes) and from its
|        lock heartbeat during a long run. Asks Send-SIReleaseModeReport at most once every 4 minutes per process. NEVER
|        throws; returns its result, or $null when it did not ask.
|    #>
|    param([scriptblock]$Invoke, [scriptblock]$Transport, $Now, [switch]$Force)
|    try {
|        $nowUtc = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|        $last = $global:SI_ReleaseModeTickAt
|        if (-not $Force -and $last -and ($nowUtc - [datetime]$last).TotalMinutes -lt $script:SIReleaseControl.CheckMinutes -and $nowUtc -ge [datetime]$last) { return $null }
|        $global:SI_ReleaseModeTickAt = $nowUtc
|        # #882 -- A RUN OF MANY HOURS: the pipeline runner is ONE process that may live a whole day (it drains the queue and
|        # follows each long run). A report that was not accepted halts telemetry for the process (built for a short engine
|        # run), so one refused or lost half hour silenced every later release-mode report until the runner ended. In the
|        # runner the halt lasts until the NEXT half hour: then the report of that half hour is asked again (the warning is
|        # not said again). Still at most one report per half hour (the slot is claimed in the database first).
|        $every = [Math]::Max(1, [int]$script:SIReleaseControl.EveryMinutes)
|        $slotNow = [long][Math]::Floor(($nowUtc - [datetime]::new(2000, 1, 1, 0, 0, 0, [DateTimeKind]::Utc)).TotalMinutes / $every)
|        if ($global:SI_TelemetryHalted) {
|            if ($null -eq $global:SI_ReleaseModeHaltSlot) { $global:SI_ReleaseModeHaltSlot = $slotNow }
|            elseif ($slotNow -gt [long]$global:SI_ReleaseModeHaltSlot) { $global:SI_TelemetryHalted = $false; $global:SI_ReleaseModeHaltSlot = $null }
|        } else { $global:SI_ReleaseModeHaltSlot = $null }
|        $a = @{ Invoke = $Invoke; Now = $nowUtc }
|        if ($Transport) { $a.Transport = $Transport }
|        $res = Send-SIReleaseModeReport @a
|        if ($global:SI_TelemetryHalted -and $null -eq $global:SI_ReleaseModeHaltSlot) { $global:SI_ReleaseModeHaltSlot = $slotNow }
|        $res
|    } catch { $null }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-Telemetry.ps1'] = @{ Sha256 = '40ac7968d4e8cd01c43356cdaf3820a02778af8d416fd32d9e2823620ea7685c'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- the TELEMETRY RECORDS SecurityInsight would send through the framework uplink (Schema 2).
|
|    Two kinds, as agreed with the receiving side:
|      heartbeat  once a day: product, edition, version, ring, hosting, runtime identity, licence state
|      run        once per engine run, at the run-health END moment: the stable Job id, Outcome (from ExitReason),
|                 DurationMs, FailedStep, ErrorClass (SI-ErrorClass.ps1), Counts
|
|    Two modes:
|      anonymous   (Community, the default there) -- a random InstallId; NO tenant, NO host name, NO error text, and
|                  counts only as buckets (0, 1-100, 100-1k, 1k-10k, 10k-100k, 100k+). Data that is never put in the
|                  record cannot leak, so the fields are absent, not empty.
|      identified  (Pro / trial) -- the install key proves who sends; the tenant and host are carried, error text is
|                  shortened to 4000 characters and redacted (tokens, secrets, connection strings, SAS signatures).
|
|    NOTHING IS SENT FROM HERE. These are pure builders: values in, one record out, no network, no file, no clock
|    unless -Now is omitted. SI-TelemetrySend.ps1 calls them at the run-health END moment, shapes the record for the wire
|    with the framework client's New-AitUplinkReport (engine/_shared/AitUplink.ps1, a copy of sync/_AitUplink.ps1) and
|    sends it with Send-AitUplink. Every enum is checked here, so a record that would be refused by the receiver is
|    refused at the source instead.
|
|    PS 5.1 safe.
|#>
|
|if (-not (Get-Command -Name Get-SIErrorClass -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-ErrorClass.ps1'))
|}
|
|function Get-SITelemetryState {
|    <# The value of $script:SITelemetry, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SITelemetry) { $script:SITelemetry = @{
|    Product          = 'securityinsight'
|    Solution         = 'SecurityInsight'
|    Schema           = 2
|    Editions         = @('community', 'pro', 'trial')
|    Hostings         = @('container', 'vm', 'arc')
|    RuntimeIdentities = @('mi-container', 'mi-arc', 'mi-vm', 'spn-certificate', 'spn-secret')
|    LicenceStates    = @('valid', 'grace', 'expired', 'none')
|    Outcomes         = @('ok', 'warning', 'failed')
|    # One `run` per engine run. Community engines first, then Pro.
|    Jobs             = @('si-ptc', 'si-endpoint', 'si-identity', 'si-azure', 'si-publicip', 'si-ra-summary', 'si-ra-detailed', 'si-trend',
|                         'si-schema-discovery', 'si-asset-tagging', 'si-correlation', 'si-asset-properties', 'si-cmdb', 'si-vuln-closeloop',
|                         'si-datasync', 'si-updater', 'si-web', 'si-cmdb-sql', 'si-flow', 'si-install')
|    # #641: a Risk Analysis run's reports -- how many the template has, how many are stored complete, how many are not
|    CountNames       = @('assets', 'findings', 'identities', 'reportsExpected', 'reportsStored', 'reportsIncomplete')
|    # Invardia's receiver DROPS a record with more than 40 Counts keys (raised from 10, Invardia 2026-10-13) (numbers only, keys ^[a-z][A-Za-z0-9]{0,30}$)
|    MaxCounts        = 40
|    CountKeyPattern  = '^[a-z][A-Za-z0-9]{0,30}$'
|    # #641: the step and the class of a run with a report that is not complete
|    ReportIncompleteStep  = 'ra-report'
|    ReportIncompleteClass = 'report-incomplete'
|    ErrorTextMax     = 4000   # Invardia UPLINK-FIX 2026-10-07: run ErrorText max 4000
|} }
|    , $script:SITelemetry
|}
|$script:SITelemetry = $null; $null = Get-SITelemetryState
|
|function Get-SITelemetryContract { (Get-SITelemetryState) }
|
|function Get-SITelemetryOutcome {
|    <# PURE. ExitReason -> Outcome: success = ok, success-partial = warning, throttled = warning (#532, framework §12.18
|       THROTTLE-IS-NORMAL: never failed, never a fix request), error / settings-error = failed. Anything else is refused
|       (a new ExitReason must be mapped on purpose, not guessed). #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$ExitReason)
|    switch ($ExitReason) {
|        'success'         { return 'ok' }
|        'success-partial' { return 'warning' }
|        'throttled'       { return 'warning' }   # #532: Microsoft throttled the run; it runs again -- information, not a problem
|        'dry-run'         { return 'ok' }        # #276: a dry run that went well; a failed one keeps its own reason
|        'error'           { return 'failed' }
|        'settings-error'  { return 'failed' }
|    }
|    throw ("'{0}' is not a run-health ExitReason (success, success-partial, throttled, error, settings-error)" -f $ExitReason)
|}
|
|function Get-SITelemetryCountBucket {
|    <# PURE. A count as its anonymous bucket: 0 | 1-100 | 100-1k | 1k-10k | 10k-100k | 100k+ (UPPER bound inclusive:
|       100 is '1-100', 1000 is '100-1k' -- the same boundaries as the framework client, Get-AitUplinkCountBucket, and the
|       receiver; the wire record is bucketed by the framework, and the two must never disagree).
|       $null for an unknown count (run health uses -1 for "not counted"). #>
|    param([AllowNull()]$Count)
|    if ($null -eq $Count -or [string]::IsNullOrWhiteSpace([string]$Count)) { return $null }
|    $n = 0L
|    if (-not [long]::TryParse([string]$Count, [System.Globalization.NumberStyles]::Integer, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$n) -or $n -lt 0) { return $null }
|    if ($n -eq 0) { return '0' }
|    if ($n -le 100) { return '1-100' }
|    if ($n -le 1000) { return '100-1k' }
|    if ($n -le 10000) { return '1k-10k' }
|    if ($n -le 100000) { return '10k-100k' }
|    '100k+'
|}
|
|function ConvertTo-SITelemetryErrorText {
|    <# PURE. Error text an IDENTIFIED record may carry: secrets redacted, then shortened to 4000 characters (the receiver's limit). #>
|    param([AllowEmptyString()][AllowNull()][string]$Text)
|    if ([string]::IsNullOrEmpty($Text)) { return '' }
|    $t = $Text
|    $t = [regex]::Replace($t, 'eyJ[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}', '[jwt]')
|    $t = [regex]::Replace($t, '(?i)\bBearer\s+[A-Za-z0-9_\-\.=~+/]+', 'Bearer [redacted]')
|    $t = [regex]::Replace($t, '(?i)\b(client_secret|password|pwd|accountkey|sharedaccesskey|apikey|api-key|x-api-key|access_token|refresh_token)\s*[=:]\s*("[^"]*"|''[^'']*''|[^;&\s,]+)', '$1=[redacted]')
|    $t = [regex]::Replace($t, '(?i)\bsig=[A-Za-z0-9%+/=]+', 'sig=[redacted]')
|    if ($t.Length -gt (Get-SITelemetryState).ErrorTextMax) { $t = $t.Substring(0, (Get-SITelemetryState).ErrorTextMax) }
|    $t
|}
|
|function Test-SITelemetryValue {
|    param([string]$Name, [AllowEmptyString()][AllowNull()][string]$Value, [string[]]$Allowed, [switch]$Optional)
|    if ($Optional -and [string]::IsNullOrEmpty($Value)) { return }
|    if ($Allowed -notcontains $Value) { throw ("telemetry: '{0}' is not a valid {1} ({2})" -f $Value, $Name, ($Allowed -join ', ')) }
|}
|
|function New-SITelemetryBase {
|    param([string]$Kind, [string]$Edition, [string]$Version, $Ring, [string]$Hosting, [string]$RuntimeIdentity, [string]$LicenceState,
|          [bool]$Anonymous, [string]$InstallId, [string]$TenantId, [string]$HostName, $Now)
|    Test-SITelemetryValue -Name 'Edition' -Value $Edition -Allowed (Get-SITelemetryState).Editions
|    Test-SITelemetryValue -Name 'Hosting' -Value $Hosting -Allowed (Get-SITelemetryState).Hostings
|    Test-SITelemetryValue -Name 'RuntimeIdentity' -Value $RuntimeIdentity -Allowed (Get-SITelemetryState).RuntimeIdentities
|    Test-SITelemetryValue -Name 'LicenceState' -Value $LicenceState -Allowed (Get-SITelemetryState).LicenceStates
|    if ($Anonymous -and $InstallId -notmatch '^[A-Za-z0-9\-]{16,64}$') { throw 'telemetry: an anonymous record needs its random InstallId (16-64 letters, digits or dashes)' }
|    $ts = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|    $r = [ordered]@{
|        Schema          = (Get-SITelemetryState).Schema
|        Kind            = $Kind
|        Product         = (Get-SITelemetryState).Product
|        Solution        = (Get-SITelemetryState).Solution
|        Edition         = $Edition
|        Version         = [string]$Version
|        Ring            = $(if ($null -ne $Ring -and [string]$Ring -ne '') { [int]$Ring } else { $null })
|        Hosting         = $Hosting
|        RuntimeIdentity = $RuntimeIdentity
|        LicenceState    = $LicenceState
|        WriterSource    = $(if ($Anonymous) { 'anonymous' } else { 'install-key' })
|    }
|    if ($Anonymous) { $r.InstallId = $InstallId }
|    else {
|        $r.ClaimedTenantId = [string]$TenantId
|        $r.Host = $(if ($HostName) { $HostName } else { [string][System.Environment]::MachineName })
|    }
|    $r.LastSeenUtc = $ts.ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture)
|    $r
|}
|
|function New-SITelemetryHeartbeat {
|    <#
|        PURE. The daily `heartbeat` record. -Anonymous drops the tenant and the host and carries -InstallId instead.
|    #>
|    param([Parameter(Mandatory)][string]$Edition, [Parameter(Mandatory)][string]$Version, $Ring,
|          [Parameter(Mandatory)][string]$Hosting, [Parameter(Mandatory)][string]$RuntimeIdentity, [Parameter(Mandatory)][string]$LicenceState,
|          [switch]$Anonymous, [string]$InstallId, [string]$TenantId, [string]$HostName, $Now)
|    [pscustomobject](New-SITelemetryBase -Kind 'heartbeat' -Edition $Edition -Version $Version -Ring $Ring -Hosting $Hosting -RuntimeIdentity $RuntimeIdentity `
|        -LicenceState $LicenceState -Anonymous ([bool]$Anonymous) -InstallId $InstallId -TenantId $TenantId -HostName $HostName -Now $Now)
|}
|
|function New-SITelemetryRunRecord {
|    <#
|        PURE. The `run` record of one engine run, built at the run-health END moment.
|          -Job          the stable job id (si-ptc, si-ra-detailed, ...)
|          -ExitReason   run health's ExitReason -> Outcome (ok / warning / failed)
|          -DurationMs   the run's duration
|          -FailedStep   the stage that failed (collect, classify, ingest, ra-query, mail, ...) -- failed / warning only
|          -ErrorClass   given, or classified here from -ErrorRecord / -ErrorMessage (Get-SIErrorClass) for a run that did
|                        not end ok
|          -Counts       @{ assets; findings; identities } -- exact when identified, bucketed when anonymous
|          -ErrorMessage the error text: carried (redacted, max 8 KB) ONLY in an identified record
|        -Anonymous drops the tenant, the host and the error text and buckets the counts.
|    #>
|    param([Parameter(Mandatory)][string]$Job, [Parameter(Mandatory)][AllowEmptyString()][string]$ExitReason,
|          [Parameter(Mandatory)][string]$Edition, [Parameter(Mandatory)][string]$Version, $Ring,
|          [Parameter(Mandatory)][string]$Hosting, [Parameter(Mandatory)][string]$RuntimeIdentity, [Parameter(Mandatory)][string]$LicenceState,
|          [long]$DurationMs = 0, [string]$FailedStep, [string]$ErrorClass, $ErrorRecord, [AllowEmptyString()][string]$ErrorMessage,
|          [System.Collections.IDictionary]$Counts, [switch]$Anonymous, [string]$InstallId, [string]$TenantId, [string]$HostName, $Now,
|          # the steps this run finished well (Get-SITelemetryStepsOk) -- ids in the FailedStep shape, at most 50; ok and
|          # warning runs only: a later ok report that lists a step closes the ticket that step's failure opened
|          [string[]]$StepsOk)
|    Test-SITelemetryValue -Name 'Job' -Value $Job -Allowed (Get-SITelemetryState).Jobs
|    $outcome = Get-SITelemetryOutcome -ExitReason $ExitReason
|    if ($DurationMs -lt 0) { throw 'telemetry: DurationMs cannot be negative' }
|    if ($FailedStep -and $FailedStep -notmatch '^[a-z][a-z0-9\-]{0,31}$') { throw ("telemetry: '{0}' is not a step name (lower-case letters, digits and dashes)" -f $FailedStep) }
|    $cls = $null
|    if ($outcome -ne 'ok') {
|        $cls = if ($ErrorClass) { $ErrorClass } else { Get-SIErrorClass -ErrorRecord $ErrorRecord -Message $ErrorMessage -ExitReason $ExitReason }
|        # #532 (framework §12.18): a throttled run reports ErrorClass 'throttled' -- platform-5xx / platform-timeout as the
|        # only cause map the same way
|        if ($ExitReason -eq 'throttled') { $cls = 'throttled' }
|        Test-SITelemetryValue -Name 'ErrorClass' -Value $cls -Allowed (Get-SITelemetryErrorClassList)
|    }
|    $c = [ordered]@{}
|    if ($Counts) {
|        foreach ($k in @($Counts.Keys)) {
|            if ((Get-SITelemetryState).CountNames -notcontains [string]$k) { throw ("telemetry: '{0}' is not a count ({1})" -f $k, ((Get-SITelemetryState).CountNames -join ', ')) }
|            if ([string]$k -cnotmatch (Get-SITelemetryState).CountKeyPattern) { throw ("telemetry: '{0}' is not a count name the receiver accepts" -f $k) }
|        }
|        if (@($Counts.Keys).Count -gt (Get-SITelemetryState).MaxCounts) { throw ("telemetry: {0} counts -- the receiver drops a record with more than {1}" -f @($Counts.Keys).Count, (Get-SITelemetryState).MaxCounts) }
|        foreach ($k in (Get-SITelemetryState).CountNames) {
|            if (-not $Counts.Contains($k)) { continue }
|            if ($Anonymous) { $c[$k] = Get-SITelemetryCountBucket $Counts[$k] }
|            else { $n = 0L; $c[$k] = $(if ([long]::TryParse([string]$Counts[$k], [ref]$n) -and $n -ge 0) { $n } else { $null }) }
|        }
|    }
|    $r = New-SITelemetryBase -Kind 'run' -Edition $Edition -Version $Version -Ring $Ring -Hosting $Hosting -RuntimeIdentity $RuntimeIdentity `
|        -LicenceState $LicenceState -Anonymous ([bool]$Anonymous) -InstallId $InstallId -TenantId $TenantId -HostName $HostName -Now $Now
|    $last = $r.LastSeenUtc; $r.Remove('LastSeenUtc')
|    $r.Job = $Job
|    $r.Outcome = $outcome
|    $r.DurationMs = $DurationMs
|    $r.FailedStep = $(if ($outcome -ne 'ok' -and $FailedStep) { $FailedStep } else { $null })
|    if ($outcome -ne 'failed') {
|        $so = New-Object System.Collections.Generic.List[string]
|        foreach ($s in @($StepsOk)) {
|            $id = ([string]$s).Trim().ToLowerInvariant()
|            if ($id -cmatch '^[a-z][a-z0-9\-]{0,31}$' -and -not $so.Contains($id) -and $so.Count -lt 50) { $so.Add($id) }
|        }
|        if ($so.Count) { $r.StepsOk = [string[]]$so.ToArray() }
|    }
|    $r.ErrorClass = $cls
|    $r.Counts = [pscustomobject]$c
|    if (-not $Anonymous) {
|        $txt = ''
|        if ($outcome -ne 'ok') {
|            $raw = if ($ErrorMessage) { $ErrorMessage } elseif ($null -ne $ErrorRecord) { Get-SIKqlErrorSummary -ErrorRecord $ErrorRecord } else { '' }
|            $txt = ConvertTo-SITelemetryErrorText $raw
|        }
|        $r.ErrorText = $txt
|    }
|    $r.Ok = ($outcome -eq 'ok')
|    $r.LastSeenUtc = $last
|    [pscustomobject]$r
|}
|
|# the closed ErrorClass list, from the classifier (one definition)
|function Get-SITelemetryErrorClassList {
|    <# The value of $script:SITelemetry_ErrorClasses, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SITelemetry_ErrorClasses) { $script:SITelemetry_ErrorClasses = @(Get-SIErrorClasses) }
|    , $script:SITelemetry_ErrorClasses
|}
|$script:SITelemetry_ErrorClasses = $null; $null = Get-SITelemetryErrorClassList
'@ }
$__siSupportFiles['engine/_shared/AitUplink.ps1'] = @{ Sha256 = 'e4ed93e29a6a372bf0aeb40de94afea418506c79691d0135b55fe40193aad4d4'; Text = @'
|#Requires -Version 5.1
|<#
|.SYNOPSIS
|    §8 -- the uplink client. Turns a sync outcome into a record, and decides when to retry.
|
|.DESCRIPTION
|    **This is the gate.** RING-1: "the uplink must exist before the FIRST real customer is
|    assigned." Until it does, "nothing happened" and "nothing needed to happen" are
|    indistinguishable, which is why no real customer is on a ring today.
|
|    🔒 THE API IS THE ONLY TRANSPORT (operator, 2026-09-08: "drop email"). Each customer sends
|    its state up; nothing is ever sent down. §8 had named email a secondary channel and that is
|    now dropped rather than left half-built -- a transport nobody maintains is a transport
|    nobody trusts, and two half-wired paths would make "did it report?" ambiguous.
|
|    🔒 AND EMAIL COULD NEVER HAVE BEEN THE MECHANISM ANYWAY. A customer whose sync never ran
|    sends no mail, so absence of failure mail is indistinguishable from health -- the same
|    defect as `[sync] done` printed after doing nothing, `built=True deployed=False`, and
|    RING-8's green board. Only a stored record carrying a LAST-SEEN timestamp makes silence
|    visible, and that lives in the API's store (uplink.vSilentTargets).
|
|    🔒 WHY NOT A STORAGE ACCOUNT (operator decision, 2026-08-08). Granting ~30 customer SPNs
|    write access to a storage account is an inbound data-plane grant from every customer into
|    the operator tenant; one compromised customer would own the whole fleet store. The chosen
|    transport is an Entra-authenticated, append-only API that fronts SQL and exposes no reads.
|
|    🔒 IDENTITY COMES FROM THE TOKEN, NEVER THE BODY. New-AitUplinkRecord stamps TenantId for
|    the LOCAL record and the email path only. The server must establish the writer from the
|    access token and ignore the field entirely -- otherwise any authenticated customer could
|    write another customer's row by editing one JSON value. The field is named
|    ClaimedTenantId to make that impossible to forget at the API end.
|
|    🔒 INERT BY CONSTRUCTION. With no endpoint configured, Send-AitUplink returns 'disabled'
|    and performs no network call. sync/ auto-deploys from main to ~30 customers with no review
|    step, so this ships doing nothing until an operator configures a target.
|#>
|
|Set-StrictMode -Off
|
|<#
|.SYNOPSIS
|    PURE. Build the §8 uplink record from a sync plan. No disk, no network, no clock of its own.
|
|.DESCRIPTION
|    §8 fixes the payload: Action, Ring, Version, Run/Held/Blocked/Refused, a last-seen
|    timestamp, and the FULL error message (open item 4 -- "yes, the full error message"),
|    which is what makes the uplink actionable rather than merely a status board.
|
|    🔑 IT MUST REPORT CAPABILITIES, NOT JUST VERSIONS. Otherwise "held by policy" and "failed
|    to apply" are identical, which is precisely the ambiguity ring gating introduces. That is
|    also why Held / Blocked / Refused travel separately rather than collapsed into one list:
|    a stalled rollout and a healthy customer opt-out must never look the same.
|
|.PARAMETER Plan
|    A Get-AitSyncPlan result. Its shape is the contract: Solution, Action, Ring, Version,
|    Capabilities{Run,Held,Blocked,Refused}, Reason.
|
|.PARAMETER ErrorText
|    The FULL error, verbatim. Truncating it here would recreate the problem the uplink exists
|    to solve -- a status without a cause.
|#>
|function New-AitUplinkRecord {
|    [CmdletBinding()]
|    param(
|        [Parameter()][AllowNull()][object]$Plan,
|        [Parameter()][AllowNull()][string]$TenantId,
|        [Parameter()][AllowNull()][string]$Solution,
|        [Parameter()][AllowNull()][string]$DeployedVersion,
|        [Parameter()][AllowNull()][string]$ErrorText,
|        [Parameter()][AllowNull()][object]$Now,
|        # 🪤 NOT $Host. That is a read-only automatic variable: a parameter named $Host PARSES
|        # CLEAN on 5.1 and 7, then fails at BIND time with "Cannot overwrite variable Host",
|        # and every field of the record comes back empty. Found by running it, 2026-09-08 --
|        # a parse check would have shipped it.
|        [Parameter()][AllowNull()][string]$HostName
|    )
|
|    $ts = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { (Get-Date).ToUniversalTime() }
|    $caps = if ($Plan) { $Plan.Capabilities } else { $null }
|
|    # 🪤 PLAIN ASSIGNMENTS, NOT AN INLINE `(if ...)` IN ARGUMENT POSITION. `& $f (if ($x) {…})`
|    # PARSES CLEAN and then fails at runtime with "The term 'if' is not recognized as a name of
|    # a cmdlet" -- because in argument position `if` is read as a COMMAND, not an expression.
|    # Every field silently came back empty. This is RING-7's landmine 2 in a new costume, and
|    # its own lesson is exactly this: prefer plain assignments before the call.
|    # (`Key = if (...) {...}` inside the hashtable below IS valid -- that is assignment
|    # position, not argument position. The distinction is the whole trap.)
|    $runCaps = @(); $heldCaps = @(); $blockedCaps = @(); $refusedCaps = @()
|    if ($caps) {
|        if ($caps.Run)     { $runCaps     = @($caps.Run     | Where-Object { $_ }) }
|        if ($caps.Held)    { $heldCaps    = @($caps.Held    | Where-Object { $_ }) }
|        if ($caps.Blocked) { $blockedCaps = @($caps.Blocked | Where-Object { $_ }) }
|        if ($caps.Refused) { $refusedCaps = @($caps.Refused | Where-Object { $_ }) }
|    }
|
|    return [pscustomobject]@{
|        Schema          = 1
|        # Named ClaimedTenantId on purpose: the API MUST take identity from the token and
|        # ignore this. See the header. Kept because the local record and the email path have
|        # no token to read.
|        ClaimedTenantId = "$TenantId"
|        Solution        = if ($Solution) { "$Solution" } elseif ($Plan) { "$($Plan.Solution)" } else { '' }
|        Action          = if ($Plan) { "$($Plan.Action)" } else { 'unknown' }
|        Ring            = if ($Plan -and $null -ne $Plan.Ring) { [int]$Plan.Ring } else { $null }
|        Version         = if ($Plan) { "$($Plan.Version)" } else { '' }
|        DeployedVersion = "$DeployedVersion"
|        Run             = $runCaps
|        Held            = $heldCaps
|        Blocked         = $blockedCaps
|        Refused         = $refusedCaps
|        Reason          = if ($Plan) { "$($Plan.Reason)" } else { '' }
|        ErrorText       = "$ErrorText"
|        Ok              = (-not "$ErrorText".Trim())
|        Host            = if ("$HostName".Trim()) { "$HostName" } else { "$env:COMPUTERNAME" }
|        LastSeenUtc     = $ts.ToString('yyyy-MM-ddTHH:mm:ssZ')
|    }
|}
|
|<#
|.SYNOPSIS
|    PURE. Should this target retry, and should somebody be told?
|
|.DESCRIPTION
|    §8: "Retry policy is part of observability." _SyncDeploy.ps1 already does not advance its
|    marker on a failed deploy, so the next cycle retries -- a good pattern. What is MISSING is
|    a ceiling and backoff: without them a permanently broken deploy retries nightly forever
|    and nobody is told, which is the same silence failure wearing different clothes.
|
|    🔑 EXHAUSTING THE CEILING IS AN ALERTABLE EVENT, not a quiet stop. A retry loop that gives
|    up silently is strictly worse than one that never stops, because it also stops producing
|    the failures somebody might have noticed.
|
|.OUTPUTS
|    Retry   -- try again on the next cycle
|    Backoff -- skip this cycle; DelayCycles says how many to wait
|    Alert   -- ceiling exhausted. Stop retrying AND tell a human.
|#>
|function Get-AitUplinkRetryDecision {
|    [CmdletBinding()]
|    param(
|        [Parameter()][int]$ConsecutiveFailures = 0,
|        [Parameter()][int]$Ceiling = 5
|    )
|
|    if ($ConsecutiveFailures -le 0) {
|        return [pscustomobject]@{ Action = 'Retry'; DelayCycles = 0; Alert = $false; Reason = 'no failures recorded' }
|    }
|    if ($ConsecutiveFailures -ge $Ceiling) {
|        return [pscustomobject]@{
|            Action = 'Alert'; DelayCycles = 0; Alert = $true
|            Reason = "retry ceiling reached ($ConsecutiveFailures of $Ceiling consecutive failures) -- stopping automatic retries and raising this, because a loop that gives up QUIETLY also stops producing the failures somebody might notice"
|        }
|    }
|    # Exponential: 1,2,4,8... cycles. CAPPED, because [Math]::Pow(2, 98) overflows the [int]
|    # cast and throws -- turning a retry-policy helper into the thing that breaks the sync.
|    # Unreachable while the ceiling check above stands; capped anyway, because a guard that
|    # only holds while a DIFFERENT guard holds is not a guard.
|    $exp = [Math]::Min([double]($ConsecutiveFailures - 1), 16.0)
|    $delay = [Math]::Pow(2, $exp)
|    return [pscustomobject]@{
|        Action = 'Backoff'; DelayCycles = [int]$delay; Alert = $false
|        Reason = "failure $ConsecutiveFailures of $Ceiling -- backing off $([int]$delay) cycle(s) before the next attempt"
|    }
|}
|
|<#
|.SYNOPSIS
|    Send a record to the uplink API. INERT unless an endpoint is configured.
|
|.DESCRIPTION
|    🔒 NO ENDPOINT => NO NETWORK CALL, and the result says 'disabled' rather than 'ok'. This
|    file ships to ~30 customers from main with no review step, so the resting state must be
|    provably nothing, and a disabled uplink must never be mistaken for a healthy one.
|
|    🔒 A FAILED UPLINK MUST NEVER FAIL THE SYNC. Observability that can break the thing it
|    observes is worse than none: a customer would stop updating because telemetry was down.
|    Every transport failure returns a result and is reported by the caller; nothing throws.
|
|.PARAMETER Endpoint
|    HTTPS URL of the append-only API. Absent => disabled.
|
|.PARAMETER AccessToken
|    Entra token for the SPN the customer already holds. The server derives identity from the
|    token and ignores the body's ClaimedTenantId.
|
|.PARAMETER AccessCode
|    Shared access code (operator decision, 2026-09-08). Chosen over per-tenant Entra consent
|    because this is telemetry: append-only, no read surface, nothing to steal or escalate, and
|    ~30 admin consents is real cost against a threat that does not exist here.
|
|    🔑 THE CONSEQUENCE, AND IT IS UNAVOIDABLE RATHER THAN AN OVERSIGHT: a shared code proves
|    that SOME customer is calling, never WHICH. So with a code the tenant necessarily comes
|    from the BODY, and the server records `WriterSource = 'shared-code'` on the row to say so.
|    Rows are then honest about their own provenance instead of implying a proof that was not
|    performed -- and if per-customer credentials arrive later, the old rows still say what they
|    were.
|
|    🪤 The realistic failure this leaves open is NOT forgery, it is a CLONED CONFIG: a VM imaged
|    from another customer's reports as that customer, and with one shared code every caller
|    looks identical. `HostName` is on every record precisely so two hosts under one identity are
|    still visible.
|
|    Exactly one of -AccessToken / -AccessCode is used; the token wins if both are supplied,
|    because a proven identity should never be silently downgraded to an asserted one.
|#>
|function Send-AitUplink {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][object]$Record,
|        [Parameter()][AllowNull()][string]$Endpoint,
|        [Parameter()][AllowNull()][string]$AccessToken,
|        [Parameter()][AllowNull()][string]$AccessCode,
|        [Parameter()][int]$TimeoutSec = 20
|    )
|
|    if (-not "$Endpoint".Trim()) {
|        return [pscustomobject]@{ Status = 'disabled'; Reason = 'no uplink endpoint configured -- nothing was sent (this is the shipped resting state)'; Sent = $false }
|    }
|    if ("$Endpoint" -notmatch '^https://') {
|        # Still refused with a shared code -- arguably MORE so. A bearer code in a plaintext
|        # request is readable by anything on the path, and unlike a token it does not expire.
|        return [pscustomobject]@{ Status = 'refused'; Reason = "uplink endpoint must be https -- refusing to post run data over '$Endpoint'"; Sent = $false }
|    }
|    if (-not "$AccessToken".Trim() -and -not "$AccessCode".Trim()) {
|        return [pscustomobject]@{ Status = 'refused'; Reason = 'no access token and no access code -- there is deliberately no anonymous path'; Sent = $false }
|    }
|
|    try {
|        $body = $Record | ConvertTo-Json -Depth 6 -Compress
|        # Token WINS when both are present: a proven identity must never be silently downgraded
|        # to an asserted one just because a code happens to be configured alongside it.
|        $headers = if ("$AccessToken".Trim()) { @{ Authorization = "Bearer $AccessToken"; 'Content-Type' = 'application/json' } }
|                   else                       { @{ 'X-Ait-Uplink-Code' = $AccessCode;     'Content-Type' = 'application/json' } }
|        $null = Invoke-RestMethod -Uri $Endpoint -Method Post -Headers $headers -Body $body -TimeoutSec $TimeoutSec -UseBasicParsing -ErrorAction Stop
|        return [pscustomobject]@{ Status = 'ok'; Reason = 'uplink accepted'; Sent = $true }
|    } catch {
|        # Never rethrow: see the header. The sync must survive a broken uplink.
|        return [pscustomobject]@{ Status = 'failed'; Reason = "uplink POST failed: $($_.Exception.Message)"; Sent = $false }
|    }
|}
|
|# =====================================================================================================
|# SCHEMA 2 -- product heartbeat + run reports (Invardia-hosted uplink, owner decisions 2026-10-03;
|# Invardia docs/design/TELEMETRY-UPLINK.md section 7, framework DOCS/REQUIREMENTS.md section 8.4).
|#
|# ADDITIVE ONLY. The sync engine does not call anything below; a PRODUCT (PIM, SI) calls it from its own
|# jobs behind its own switch. Nothing here reads config, touches disk or the network except
|# Send-AitUplink, which is unchanged and still refuses without an https endpoint + a credential.
|#
|# Two senders, one endpoint (POST https://invardia.com/api/uplink/v1/report, header X-Ait-Uplink-Code):
|#   anonymous   -- the PUBLIC community code; the record carries NO ClaimedTenantId, NO Host, NO ErrorText,
|#                  only an ErrorClass and BUCKETED counts, plus a random InstallId the product keeps.
|#                  Data that is never sent cannot leak: the server drops these fields too, but we do not
|#                  rely on that.
|#   identified  -- a per-install key Invardia issued (Pro / trial). The KEY proves the environment; the
|#                  body's ClaimedTenantId is only compared for mismatch. ErrorText is shortened + redacted
|#                  here as well as on the server.
|# The server refuses unknown fields and checks closed value lists, so the lists below mirror Invardia's
|# packages/core/src/uplink.ts exactly; a value outside them is dropped here rather than failing the POST.
|# =====================================================================================================
|
|$script:AitUplinkCommunityCode   = 'invardia-community-telemetry-v1'   # public by design: "a Community install", nothing more
|$script:AitUplinkInvardiaEndpoint = 'https://invardia.com/api/uplink/v1/report'
|$script:AitUplinkKinds     = @('heartbeat', 'run', 'install')
|$script:AitUplinkOutcomes  = @('ok', 'warning', 'failed')
|$script:AitUplinkEditions  = @('community', 'pro', 'trial')
|$script:AitUplinkHosting   = @('container', 'vm', 'arc')
|$script:AitUplinkRuntime   = @('mi-container', 'mi-vm', 'mi-arc', 'spn-certificate', 'spn-secret')
|$script:AitUplinkLicence   = @('valid', 'grace', 'expired', 'none')
|
|function ConvertTo-AitUplinkRedacted {
|    <# PURE. Removes secrets from free text before it can leave the install (same rules as Invardia's redact()). #>
|    [CmdletBinding()]
|    param([AllowNull()][string]$Text)
|    $t = "$Text"
|    if (-not $t) { return '' }
|    $t = [regex]::Replace($t, 'eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*', '[jwt]')
|    $t = [regex]::Replace($t, '(?i)\b(Bearer)\s+[A-Za-z0-9._~+/=-]{10,}', '$1 [redacted]')
|    $t = [regex]::Replace($t, '(?i)\b(client_secret|password|pwd|secret|apikey|api_key|accountkey|sharedaccesskey)\s*[=:]\s*("[^"]*"|''[^'']*''|[^\s;&,]+)', '$1=[redacted]')
|    $t = [regex]::Replace($t, '(?i)([?&](sig|se|sv|sp|skoid|sktid)=)[^&\s]+', '$1[redacted]')
|    $t = [regex]::Replace($t, '-----BEGIN [A-Z ]+-----[\s\S]*?-----END [A-Z ]+-----', '[pem]')
|    # An X-Ait-Uplink-Code / install key that ends up in an error message (e.g. a proxy echoing headers).
|    $t = [regex]::Replace($t, 'inv-[A-Za-z0-9_-]{20,}', '[install-key]')
|    return $t
|}
|
|function Get-AitUplinkCountBucket {
|    <# PURE. Anonymous mode never sends an exact count: 0, 1-100, 100-1k, 1k-10k, 10k-100k, 100k+. #>
|    param([double]$Count)
|    if ($Count -le 0) { return '0' }
|    if ($Count -le 100) { return '1-100' }
|    if ($Count -le 1000) { return '100-1k' }
|    if ($Count -le 10000) { return '1k-10k' }
|    if ($Count -le 100000) { return '10k-100k' }
|    return '100k+'
|}
|
|function New-AitUplinkReport {
|    <#
|    .SYNOPSIS
|        PURE. Build a Schema 2 record (Kind heartbeat | run | install) for -Mode anonymous | identified.
|    .DESCRIPTION
|        Only fields with a value are emitted (the server refuses unknown fields and checks enums; an empty
|        string where an enum is expected would be refused). An enum value outside the closed list is
|        DROPPED, never sent. Job / FailedStep are normalised to the server's id shape (lower-case,
|        [a-z0-9.-], 60 chars). ErrorClass is lower-cased (PIM's failure codes are upper-case).
|        Anonymous: ClaimedTenantId, Host and ErrorText are never put in the record, counts are bucketed,
|        and an InstallId (GUID) is REQUIRED -- without one the result is $null and nothing should be sent.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][ValidateSet('heartbeat', 'run', 'install')][string]$Kind,
|        [Parameter(Mandatory)][ValidateSet('anonymous', 'identified')][string]$Mode,
|        [Parameter(Mandatory)][string]$Product,
|        [AllowNull()][string]$Version,
|        [AllowNull()][object]$Ring,
|        [AllowNull()][string]$Edition,
|        [AllowNull()][string]$Hosting,
|        [AllowNull()][string]$RuntimeIdentity,
|        [AllowNull()][string]$LicenceState,
|        [AllowNull()][string]$Job,
|        [AllowNull()][string]$Outcome,
|        [AllowNull()][object]$DurationMs,
|        [AllowNull()][string]$FailedStep,
|        [AllowNull()][string]$ErrorClass,
|        [AllowNull()][string]$ErrorText,
|        [AllowNull()][hashtable]$Counts,
|        [AllowNull()][string]$InstallId,
|        [AllowNull()][string]$TenantId,
|        [AllowNull()][string]$HostName,
|        [AllowNull()][object]$Now
|    )
|    $anon = ($Mode -eq 'anonymous')
|    $iid = "$InstallId".Trim().ToLowerInvariant()
|    if ($anon -and $iid -notmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$') { return $null }
|    $ts = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { (Get-Date).ToUniversalTime() }
|    $idOf = { param($v) $s = ("$v".Trim().ToLowerInvariant() -replace '[^a-z0-9.-]', '-') -replace '^[^a-z0-9]+', ''; if ($s.Length -gt 60) { $s = $s.Substring(0, 60) }; $s }
|    $o = [ordered]@{ Schema = 2; Kind = $Kind; Product = "$Product".Trim().ToLowerInvariant() }
|    $ver = "$Version".Trim(); if ($ver -match '^[0-9A-Za-z.+-]{1,50}$') { $o['Version'] = $ver }
|    $rp = 0; if ($null -ne $Ring -and "$Ring" -ne '' -and [int]::TryParse("$Ring", [ref]$rp) -and $rp -ge 0 -and $rp -le 10) { $o['Ring'] = $rp }
|    foreach ($pair in @(@('Edition', $Edition, $script:AitUplinkEditions), @('Hosting', $Hosting, $script:AitUplinkHosting),
|                        @('RuntimeIdentity', $RuntimeIdentity, $script:AitUplinkRuntime), @('LicenceState', $LicenceState, $script:AitUplinkLicence),
|                        @('Outcome', $Outcome, $script:AitUplinkOutcomes))) {
|        $v = "$($pair[1])".Trim().ToLowerInvariant()
|        if ($v -and ($pair[2] -contains $v)) { $o[$pair[0]] = $v }
|    }
|    $j = & $idOf $Job; if ($j) { $o['Job'] = $j }
|    $fs = & $idOf $FailedStep; if ($fs) { $o['FailedStep'] = $fs }
|    $ec = ("$ErrorClass".Trim().ToLowerInvariant() -replace '[^a-z0-9-]', '-'); if ($ec.Length -gt 40) { $ec = $ec.Substring(0, 40) }; if ($ec) { $o['ErrorClass'] = $ec }
|    $d = [int64]0; if ($null -ne $DurationMs -and [int64]::TryParse("$DurationMs", [ref]$d) -and $d -ge 0) { $o['DurationMs'] = [int][Math]::Min($d, [int64]2147483646) }
|    if ($Counts -and $Counts.Count) {
|        $c = [ordered]@{}
|        foreach ($k in @($Counts.Keys | Sort-Object | Select-Object -First 40)) {   # 40 keys: agreed by SI + PIM + Invardia, owner yes 2026-10-13 (Invardia accepts 40 since 1.0.413)
|            if ("$k" -notmatch '^[a-z][A-Za-z0-9]{0,30}$') { continue }
|            $n = 0.0; if (-not [double]::TryParse("$($Counts[$k])", [ref]$n) -or $n -lt 0) { continue }
|            $c["$k"] = if ($anon) { Get-AitUplinkCountBucket -Count $n } else { [int64][Math]::Floor($n) }
|        }
|        if ($c.Count) { $o['Counts'] = [pscustomobject]$c }
|    }
|    if ($anon) {
|        $o['InstallId'] = $iid
|    } else {
|        if ("$TenantId".Trim()) { $o['ClaimedTenantId'] = "$TenantId".Trim() }
|        $h = if ("$HostName".Trim()) { "$HostName".Trim() } else { "$env:COMPUTERNAME" }
|        if ($h) { $o['Host'] = $(if ($h.Length -gt 100) { $h.Substring(0, 100) } else { $h }) }
|        $et = ConvertTo-AitUplinkRedacted -Text "$ErrorText".Trim()
|        if ($et) { $o['ErrorText'] = $(if ($et.Length -gt 8000) { $et.Substring(0, 8000) } else { $et }) }
|    }
|    $o['LastSeenUtc'] = $ts.ToString('yyyy-MM-ddTHH:mm:ssZ')
|    return [pscustomobject]$o
|}
|
|function Resolve-AitUplinkSender {
|    <#
|    .SYNOPSIS
|        PURE. Which credential + mode this install sends with, or 'disabled'.
|    .DESCRIPTION
|        -Enabled $false (the product's opt-out)  -> disabled; nothing is sent.
|        an install key (Pro / trial, issued by Invardia) -> identified, the key in X-Ait-Uplink-Code.
|        no key                                    -> anonymous with the public community code -- also for a Pro
|                                                     install that has no key yet: it then reports like a
|                                                     Community install (no tenant, no host, no text) rather
|                                                     than inventing an identity it cannot prove.
|        -Endpoint overrides Invardia's (a private estate); it must still be https (Send-AitUplink refuses
|        anything else).
|    #>
|    param([bool]$Enabled, [AllowNull()][string]$InstallKey, [AllowNull()][string]$Endpoint)
|    if (-not $Enabled) { return [pscustomobject]@{ Mode = 'disabled'; Endpoint = ''; AccessCode = ''; Reason = 'telemetry is switched off' } }
|    $ep = if ("$Endpoint".Trim()) { "$Endpoint".Trim() } else { $script:AitUplinkInvardiaEndpoint }
|    $key = "$InstallKey".Trim()
|    if ($key) { return [pscustomobject]@{ Mode = 'identified'; Endpoint = $ep; AccessCode = $key; Reason = 'install key' } }
|    return [pscustomobject]@{ Mode = 'anonymous'; Endpoint = $ep; AccessCode = $script:AitUplinkCommunityCode; Reason = 'no install key -- anonymous (community code)' }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-TelemetryCounts.ps1'] = @{ Sha256 = 'cbf2d2c4d9a1933ab15ad1518dbcb07695db8826c75e34a74c12d3448a61b935'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- the TENANT COUNTS on the daily heartbeat (#424, owner 2026-10-07: "we need a counter in the telemetry
|    by tenant from both pro, users for stat purpose"). Invardia stores Counts per environment (= per tenant); PIM sends
|    the same three keys with the same definitions, so the two products can be added up and compared.
|
|    THE DEFINITIONS (identical in PIM -- change them in both products or in neither; the one exception is users' AD part):
|      users    ENABLED MEMBER users, CLOUD AND ON-PREM AD (owner 2026-10-10: "users include both cloud and ad local",
|               "from exposuregraph"), each real person once:
|                 Entra part   Entra user objects with accountEnabled = true AND userType = Member (cloud-only AND
|                              AD-synced users -- a synced user is one Entra object);
|                 + AD part    AD-ONLY enabled user accounts from the Exposure Graph: 'user' nodes with rawData
|                              primaryProvider = ActiveDirectory AND identityType = User (AD service accounts and
|                              computers are NOT users) AND enabled (rawData accountEnabled, else isEnabled -- the two
|                              names SI's EG mapping reads for si_account_enabled -- else isActive when EG carries
|                              neither), whose adSid is NOT the OnPremSid of ANY Entra user in the latest identity
|                              collection (a synced user is already in the Entra part and counts once).
|               The AD part runs through Advanced Hunting (Invoke-SIHuntingQueryRest, the run's Graph token). When it
|               cannot be read (no permission, no Defender, an error, a truncated answer) users = the Entra part only and
|               the run log says so once, plainly -- never a guessed number, never 0 for the AD part. No Entra part = no
|               users key at all (the AD part is never sent alone). PIM's users is Entra-only; SI's adds AD-only accounts
|               because SI sees AD through the Exposure Graph.
|      guests   GUEST users: Entra user objects with userType = Guest, ENABLED OR NOT (a disabled guest is still a guest
|               object in the tenant; the stat is "how many guests does this tenant carry").
|      devices  the 7-DAY MAXIMUM of the daily count of unique CORRELATED devices: endpoints and servers (Defender machines
|               and Entra devices), ONE per real machine however many sources see it (the correlation object id, so a
|               machine seen by Defender and by Entra counts once). IoT and network devices are not devices here. Per UTC
|               day the latest correlation run of that day is counted; the heartbeat carries the highest of the last 7
|               days. This is also the unit of the future Pro Business device cap -- Get-SIDeviceCount is the one place
|               it is computed.
|
|    WHERE THE NUMBERS COME FROM: only what SecurityInsight already reads -- no new permission.
|      users / guests  the latest collection in SI_Identity_Profile_CL (AccountEnabled, UserType, IdentityType = User,
|                      OnPremSid); users' AD part from ExposureGraphNodes over Advanced Hunting -- the same read the
|                      identity engine's Exposure Graph discovery already makes with the same Graph identity
|      devices         SI_ObjectMap_CL (the correlation map: SI_CorrelationId per endpoint member), with the device
|                      category from SI_Endpoint_Profile_CL
|
|    A COUNT THAT CANNOT BE COMPUTED IS OMITTED, never sent as 0 by guess: no table, no rows, a failed query, no UserType
|    column filled at all, no correlation run in the last 7 days -- each leaves its key out.
|
|    PRO ONLY: Send-SITelemetryRunEnd asks for these counts only for an IDENTIFIED heartbeat (a Pro / trial install with
|    its install key). Community and an anonymous Pro install send nothing new. Telemetry switched off computes nothing.
|
|    PS 5.1 and 7. Never throws to its caller.
|#>
|
|function Get-SITelemetryCountNamesState {
|    <# The value of $script:SITelemetryCountNames, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SITelemetryCountNames) { $script:SITelemetryCountNames = @('users', 'guests', 'devices', 'sqlUsedMb', 'sqlMaxMb', 'servicePrincipals', 'azureResources', 'servers', 'clientDevices',
|    # #719 (owner 2026-10-16 via Invardia: "add relevant. i want data") -- the Risk Analysis result and the CI estate, from the
|    # Pro database (Get-SIRaTelemetryCounts; each key's definition in data-model/telemetry-counts.locked.json)
|    'raReportsTotal', 'raReportsComplete', 'raRowsDetailed', 'cveDevicePairs', 'cveDevices', 'cves', 'cvesCritical', 'cvesHigh',
|    # owner 2026-10-16 ("Yes, change the report"): the distinct CVE ids with a known exploit, from the CVE Summary rows
|    'cvesExploited',
|    'recommendations', 'recommendationDevicePairs', 'eosSoftwareDevices', 'azureRecommendations', 'attackPaths', 'usersWithoutMfa',
|    'staleUsers180d', 'privilegedPermanent', 'guestsPrivileged', 'spnsExpiringCredentials', 'cis', 'cisTier0',
|    # owner 2026-10-16 ("Add, permission REQUIRED"): Microsoft Secure Score and the Defender exposure score (Get-SISecurityScoreCounts)
|    'secureScore', 'secureScoreMax', 'exposureScore',
|    # owner 2026-10-13 ("si must send objects for each of the security domains"; Invardia's adoption dashboard): the current
|    # CIs per security domain and the close-loop's real remediations -- same read (Get-SIRaTelemetryCountSql)
|    'domainEndpoint', 'domainIdentity', 'domainAzure', 'domainPublicIp', 'fixedLast30Days') }
|    , $script:SITelemetryCountNames
|}
|$script:SITelemetryCountNames = $null; $null = Get-SITelemetryCountNamesState
|
|# #719: Invardia refuses the WHOLE record above 40 Counts keys; SI stays at or under 38 (two spare), every value a whole number
|# >= 0. The framework client (AitUplink.ps1, byte-identical to sync/) keeps the first 40 keys by name (it kept 10 before
|# main's 2026-10-13 copy) -- SI still shapes the heartbeat's Counts itself, by priority, at most 38
|# (ConvertTo-SITelemetryCountsWire, called by ConvertTo-SITelemetryWire) -- the safe path.
|function Get-SITelemetryCountMaxKeysState {
|    <# The value of $script:SITelemetryCountMaxKeys, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SITelemetryCountMaxKeys) { $script:SITelemetryCountMaxKeys = 38 }
|    , $script:SITelemetryCountMaxKeys
|}
|$script:SITelemetryCountMaxKeys = $null; $null = Get-SITelemetryCountMaxKeysState
|
|<#
|    THE ASSET INVENTORY (owner 2026-10-10, via Invardia: "updated numbers both total and per customer and per tenant of
|    users, spns, azure objects, servers, client devices"), each from the LATEST collection of its profile table:
|      servicePrincipals  service principals + managed identities (SI_Identity_Profile_CL, IdentityType)
|      azureResources     distinct Azure resources in the scopes SI covers (SI_Azure_Profile_CL, AzureResourceId)
|      servers            endpoints whose DeviceType is Server or whose OS is a server OS (SI_Endpoint_Profile_CL)
|      clientDevices      workstations / mobile devices (DeviceType or a client OS); IoT, network devices and unknown
|                         devices are neither
|    The OS is the profile's column OsPlatform (the name the endpoint profile writes; column names are case-sensitive in
|    KQL), OSPlatform only as a fallback: reading only 'OSPlatform' made the OS fallback dead, so an endpoint collection
|    whose rows carried no DeviceType counted 0 servers and 0 clients (a large school 2026-10-18 / 10-19: "servers fell to
|    0", "client devices fell to 0" while 1,977 devices were profiled).
|    A table with no collection in the last 8 days leaves its keys OUT (never a guessed 0).
|#>
|function Get-SIInventoryCountQuery {
|    # #712 (Invardia watcher 2026-10-16, customer C: clientDevices 26 -> 618, servers 0 -> 23 between two heartbeats
|    # while the collection itself was identical): the NEWEST collection was counted while Log Analytics was still taking it
|    # in (rows arrive over 10-20 minutes). Only a collection whose rows stopped arriving 30 minutes ago is counted; a newer
|    # one still arriving waits for the next heartbeat, the one before it is counted meanwhile.
|    # A collection IN PARTS publishes part by part under one collection time, its parts' rows minutes or hours apart: a
|    # quiet half hour between two parts is not its end. So where the install's database says when each source last
|    # collected COMPLETELY (sidata.SourceState, Get-SICountCompleteBy), a newer collection is never counted.
|    param([System.Collections.IDictionary]$CompleteBy = (Get-SICountCompleteByState))
|    $q = @'
|let idt = SI_Identity_Profile_CL | where TimeGenerated > ago(8d);
|let idl = toscalar(idt{{IDB}} | summarize _in = max(ingestion_time()) by CollectionTime | where _in < ago(30m) | summarize max(CollectionTime));
|let azt = SI_Azure_Profile_CL | where TimeGenerated > ago(8d);
|let azl = toscalar(azt{{AZB}} | summarize _in = max(ingestion_time()) by CollectionTime | where _in < ago(30m) | summarize max(CollectionTime));
|let ept = SI_Endpoint_Profile_CL | where TimeGenerated > ago(8d);
|let epl = toscalar(ept{{EPB}} | summarize _in = max(ingestion_time()) by CollectionTime | where _in < ago(30m) | summarize max(CollectionTime));
|union isfuzzy=true
| (idt | where CollectionTime == idl | extend _id = tostring(column_ifexists("SI_AssetId", "")), _t = tostring(column_ifexists("IdentityType", ""))
|      | where isnotempty(_id) | summarize Spns = dcountif(_id, _t in~ ("ServicePrincipal", "ManagedIdentity")), IdRows = count()),
| (azt | where CollectionTime == azl | extend _r = tolower(tostring(column_ifexists("AzureResourceId", "")))
|      | summarize Azure = dcountif(_r, isnotempty(_r)), AzRows = count()),
| (ept | where CollectionTime == epl | extend _a = tostring(column_ifexists("SI_AssetId", "")), _c = tolower(tostring(column_ifexists("DeviceCategory", ""))),
|        _d = tolower(tostring(column_ifexists("DeviceType", ""))), _o = tolower(coalesce(tostring(column_ifexists("OsPlatform", "")), tostring(column_ifexists("OSPlatform", ""))))
|      | where isnotempty(_a) | summarize arg_max(CollectionTime, _c, _d, _o) by _a
|      | extend _srv = (_d == "server" or _o contains "server")
|      | extend _cli = (not(_srv) and not(_c in ("iot", "networkdevice")) and (_d in ("workstation", "mobile", "tablet", "smartphone") or _o matches regex @"^(windows(10|11)?|macos.*|ios|ipados|android)$"))
|      | summarize Servers = countif(_srv), Clients = countif(_cli), EpRows = count())
|| summarize Spns = max(Spns), IdRows = max(IdRows), Azure = max(Azure), AzRows = max(AzRows), Servers = max(Servers), Clients = max(Clients), EpRows = max(EpRows)
|'@
|    $q.Replace('{{IDB}}', (Get-SICountCompleteFilter -Source identity -CompleteBy $CompleteBy)).Replace('{{AZB}}', (Get-SICountCompleteFilter -Source azure -CompleteBy $CompleteBy)).Replace('{{EPB}}', (Get-SICountCompleteFilter -Source endpoint -CompleteBy $CompleteBy))
|}
|
|# source -> when it last collected completely, for the counts of ONE heartbeat (Get-SITelemetryHeartbeatCounts sets it)
|function Get-SICountCompleteByState {
|    <# The value of $script:SICountCompleteBy, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SICountCompleteBy) { $script:SICountCompleteBy = @{} }
|    , $script:SICountCompleteBy
|}
|$script:SICountCompleteBy = $null; $null = Get-SICountCompleteByState
|
|function Get-SICountCompleteFilter {
|    <# PURE. The KQL filter that keeps a source's counts off a collection newer than its last COMPLETE one:
|       ' | where CollectionTime <= datetime(<last complete + 10 minutes>)' (the minutes absorb the difference between the
|       database's and Log Analytics' stamp of one collection; the next collection starts hours later). '' when not known.
|       A source the database knows but that has NEVER collected completely ('never', Get-SICountCompleteBy): no collection
|       of it is counted ('| where false') -- its keys are left out until its first complete collection, never a part's
|       number (a large install 2026-10-19: identity never ended well, so the heartbeat counted a part -- 6,827 users,
|       115 service principals -- for two days, then the real 107,441 / 1,604 arrived as a "3x jump"). #>
|    param([Parameter(Mandatory)][string]$Source, [System.Collections.IDictionary]$CompleteBy)
|    if (-not $CompleteBy -or -not $CompleteBy.Contains($Source) -or $null -eq $CompleteBy[$Source]) { return '' }
|    if ($CompleteBy[$Source] -is [string] -and [string]$CompleteBy[$Source] -eq 'never') { return ' | where false' }
|    $t = $null; try { $t = ([datetime]$CompleteBy[$Source]).ToUniversalTime().AddMinutes(10) } catch { return '' }
|    ' | where todatetime(CollectionTime) <= datetime({0})' -f $t.ToString('yyyy-MM-ddTHH:mm:ss.fffZ', [Globalization.CultureInfo]::InvariantCulture)
|}
|
|function Get-SICountCompleteSql {
|    <# READS ONLY. When each collecting source last collected COMPLETELY (sidata.SourceState.LastGoodAt, written by the
|       pipeline when a collection -- every part of it -- ended well). No table = no rows. #>
|    "IF OBJECT_ID(N'sidata.SourceState') IS NULL SELECT CAST(NULL AS NVARCHAR(32)) AS Source, CAST(NULL AS DATETIME2(3)) AS LastGoodAt WHERE 1 = 0; ELSE SELECT Source, LastGoodAt FROM sidata.SourceState WHERE Source IN (N'identity', N'azure', N'endpoint');"
|}
|
|function Get-SICountCompleteBy {
|    <# source -> when it last collected completely (UTC), from Get-SICountCompleteSql through -SqlRows { param($Sql) rows }
|       (default Invoke-SITelemetrySqlRows). A source with a row but no LastGoodAt has never collected completely: 'never'
|       (Get-SICountCompleteFilter counts none of its collections). A source without a row is not known: absent (the
|       settled rule alone). Empty when it cannot be read: the counts then use the settled rule alone, as before. Never
|       throws. #>
|    param([scriptblock]$SqlRows)
|    $out = @{}
|    try {
|        if (-not $SqlRows) { $SqlRows = { param($Sql) Invoke-SITelemetrySqlRows -Sql $Sql } }
|        foreach ($r in @(& $SqlRows (Get-SICountCompleteSql))) {
|            if ($null -eq $r) { continue }
|            $src = ''; $at = $null
|            if ($r -is [System.Collections.IDictionary]) { $src = [string]$r['Source']; $at = $r['LastGoodAt'] } else { $src = [string]$r.Source; $at = $r.LastGoodAt }
|            $src = $src.Trim().ToLowerInvariant()
|            if (-not $src) { continue }
|            if ($null -eq $at -or $at -is [System.DBNull] -or "$at".Trim() -eq '') { $out[$src] = 'never'; continue }
|            $t = $null
|            if ($at -is [datetime]) { $t = [datetime]::SpecifyKind($at, [DateTimeKind]::Utc) }
|            else {
|                $p = [datetime]::MinValue
|                if ([datetime]::TryParse([string]$at, [Globalization.CultureInfo]::InvariantCulture, ([Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal), [ref]$p)) { $t = $p }
|            }
|            if ($null -ne $t) { $out[$src] = $t }
|        }
|    } catch { return @{} }
|    $out
|}
|
|function Get-SIInventoryCounts {
|    <# PURE. The inventory query's one row -> the keys whose table HAD a collection (its row count > 0). #>
|    param([AllowNull()]$Row)
|    $out = [ordered]@{}
|    if ($null -eq $Row) { return $out }
|    $has = { param($n) $v = ConvertTo-SITelemetryCount $Row.$n; $null -ne $v -and $v -gt 0 }
|    if (& $has 'IdRows') { $v = ConvertTo-SITelemetryCount $Row.Spns; if ($null -ne $v) { $out['servicePrincipals'] = $v } }
|    if (& $has 'AzRows') { $v = ConvertTo-SITelemetryCount $Row.Azure; if ($null -ne $v) { $out['azureResources'] = $v } }
|    if (& $has 'EpRows') {
|        $v = ConvertTo-SITelemetryCount $Row.Servers; if ($null -ne $v) { $out['servers'] = $v }
|        $v = ConvertTo-SITelemetryCount $Row.Clients; if ($null -ne $v) { $out['clientDevices'] = $v }
|    }
|    $out
|}
|
|function Get-SITelemetryHeartbeatCountNames { (Get-SITelemetryCountNamesState) }
|
|function Get-SITelemetryCountMaxKeys { (Get-SITelemetryCountMaxKeysState) }
|
|function ConvertTo-SITelemetryCountsWire {
|    <#
|        PURE. The heartbeat's Counts as they go on the wire (#719): only the agreed names, each key ^[a-z][A-Za-z0-9]{0,30}$,
|        each value a whole number >= 0 ([long]), at most 38 keys (the agreed order). $null when nothing is left.
|    #>
|    param([AllowNull()][System.Collections.IDictionary]$Counts)
|    if ($null -eq $Counts -or $Counts.Count -eq 0) { return $null }
|    $o = [ordered]@{}
|    foreach ($k in (Get-SITelemetryCountNamesState)) {
|        if ($o.Count -ge (Get-SITelemetryCountMaxKeysState)) { break }
|        if ($k -cnotmatch '^[a-z][A-Za-z0-9]{0,30}$' -or -not $Counts.Contains($k)) { continue }
|        $v = ConvertTo-SITelemetryCount $Counts[$k]
|        if ($null -ne $v) { $o[$k] = [long]$v }
|    }
|    if ($o.Count -eq 0) { return $null }
|    [pscustomobject]$o
|}
|
|<#
|    THE RISK ANALYSIS RESULT AND THE CI ESTATE (#719, owner 2026-10-16: "add relevant. i want data"; the names agreed with
|    Invardia). Read from the Pro database in ONE batch (Get-SIRaTelemetryCountSql), each key from the LATEST COMPLETE
|    Detailed collection (sidata.Collection Kind 'Detailed' Status 'Complete'), and only when ITS report's verdict there
|    (sidata.RaReportStatus) is Complete. A report that is not Complete leaves its key OUT, never 0.
|    #636 (owner 2026-10-19: "i prefer to switch so detailed becomes the engine default and summary is optional"): the counts
|    came from the Summary report's rows (sidata.SummaryRow / SummaryAsset); the Summary step is now off by default, so every
|    count comes from the DETAILED findings -- through the stored groupings the data sync writes per collection
|    (sidata.SummaryGroup, grouping 'report': per report its distinct assets, distinct recommendations / CVEs, of them Very High
|    / High / with a known exploit -- engine\_shared\SI-SummaryGroupings.ps1). #871 (found 2026-10-21: five installs whose
|    run stopped before the data sync sent no grouped keys for a day, and the dashboard's users without MFA fell from 22,136
|    to 3,444): those keys come from the NEWEST complete collection that HAS its groupings, decided by that collection's own
|    verdicts; its date goes out as Security.collectionUtc and the heartbeat's Warnings say si-data-1402 while the newest
|    collection is not grouped yet (SI-HeartbeatFields.ps1). Only an install that has never grouped a collection leaves them
|    out. Cheap by design: sidata.RaReportStatus (one row per report), the 'report' grouping of ONE
|    collection (by its index) and sidata.Ci. sidata.Finding is NEVER read (30 GB at a large install).
|    The definitions -- one line each -- are in data-model/telemetry-counts.locked.json (handed to Invardia with the release).
|    Every "how many assets" key counts the DISTINCT assets of the report's findings; every "how many recommendations / CVEs"
|    key the distinct configuration ids.
|    THE SECURITY DOMAINS (owner 2026-10-13: "si must send objects for each of the security domains"; built 2026-10-13 on
|    si-v3-scale/telemetry-counts-from-sql, ported onto rc11): the CURRENT CIs (not retired, as cis) of each class -- the
|    web app's domain of a CI is its class (device = Endpoint, identity = Identity, cloud_resource = Azure, public_ip =
|    PublicIP). Sent once sidata.Ci holds any CI (as cis); a domain without a CI is then a real 0.
|      domainEndpoint / domainIdentity / domainAzure / domainPublicIp
|    THE CLOSE-LOOP'S REAL REMEDIATIONS (the 2026-10-13 adoption numbers, Invardia's adoption dashboard):
|      fixedLast30Days  vuln.VulnerabilityItem items CLOSED in the last 30 days with reason Remediated (the reason's first
|                       word -- never AssetRetired / NoLongerMonitored / an engineer's other reason). Read on the Pro database
|                       through IX_VulnerabilityItem_UpdatedAt (a close sets UpdatedAt); left out when the close-loop holds
|                       no item there (not in use, or its own database elsewhere).
|    The other 2026-10-13 adoption numbers are covered here already or by the heartbeat's own fields: assetsProfiled = cis;
|    findingsOpen / Critical / High = Security.domains[].findings / findingsCritical / findingsHigh (the Detailed findings'
|    domain grouping -- sidata.Finding is never read); vulnerabilitiesOpen = cves + recommendations + azureRecommendations;
|    dataSources = Sources.
|#>
|function Get-SIRaCountAssetReportsState {
|    <# The value of $script:SIRaCountAssetReports, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIRaCountAssetReports) { $script:SIRaCountAssetReports = [ordered]@{
|    cveDevices              = 'Device_Missing_CVEs_Detailed'
|    eosSoftwareDevices      = 'Device_EndOfSupport_Software_Detailed'
|    usersWithoutMfa         = 'Identity_NoMFA_Detailed'
|    staleUsers180d          = 'Identity_StaleUser_NoLogin180Days_Detailed'
|    privilegedPermanent     = 'Identity_PermanentPrivilegedRole_Detailed'
|    guestsPrivileged        = 'Identity_GuestWithPrivilegedRole_Detailed'
|    spnsExpiringCredentials = 'Identity_SPN_ExpiringCredentials_Detailed'
|} }
|    , $script:SIRaCountAssetReports
|}
|$script:SIRaCountAssetReports = $null; $null = Get-SIRaCountAssetReportsState
|# the distinct recommendations / CVEs of a report (the 'report' grouping's Recommendations and its Very High / High / exploited twins)
|function Get-SIRaCountRecommendationReportsState {
|    <# The value of $script:SIRaCountRecommendationReports, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIRaCountRecommendationReports) { $script:SIRaCountRecommendationReports = [ordered]@{
|    cves                 = @('Device_Missing_CVEs_Detailed', 'recs')
|    cvesCritical         = @('Device_Missing_CVEs_Detailed', 'recsCritical')
|    cvesHigh             = @('Device_Missing_CVEs_Detailed', 'recsHigh')
|    cvesExploited        = @('Device_Missing_CVEs_Detailed', 'recsExploited')
|    recommendations      = @('Device_Recommendations_Detailed', 'recs')
|    azureRecommendations = @('Azure_DefenderRecommendations_Detailed', 'recs')
|} }
|    , $script:SIRaCountRecommendationReports
|}
|$script:SIRaCountRecommendationReports = $null; $null = Get-SIRaCountRecommendationReportsState
|# sidata.Ci Class -> the Counts key of its security domain (the web app: device = Endpoint, identity = Identity,
|# cloud_resource = Azure, public_ip = PublicIP)
|function Get-SITelemetryDomainKeysState {
|    <# The value of $script:SITelemetryDomainKeys, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SITelemetryDomainKeys) { $script:SITelemetryDomainKeys = [ordered]@{ device = 'domainEndpoint'; identity = 'domainIdentity'; cloud_resource = 'domainAzure'; public_ip = 'domainPublicIp' } }
|    , $script:SITelemetryDomainKeys
|}
|$script:SITelemetryDomainKeys = $null; $null = Get-SITelemetryDomainKeysState
|function Get-SIRaCountDetailedPairsState {
|    <# The value of $script:SIRaCountDetailedPairs, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIRaCountDetailedPairs) { $script:SIRaCountDetailedPairs = [ordered]@{
|    cveDevicePairs            = 'Device_Missing_CVEs_Detailed'
|    recommendationDevicePairs = 'Device_Recommendations_Detailed'
|} }
|    , $script:SIRaCountDetailedPairs
|}
|$script:SIRaCountDetailedPairs = $null; $null = Get-SIRaCountDetailedPairsState
|
|function Get-SIRaTelemetryCountSql {
|    <#
|        The one read: a result set of (K, R, G, S, N) rows --
|          status       R = report, G = grain, S = verdict, N = StoredRows   (sidata.RaReportStatus, the latest Detailed collection)
|          assets / recs / recsCritical / recsHigh / recsExploited
|                       R = report, N = its distinct assets / distinct recommendations (configuration ids) / of them Very High /
|                       High / with a known exploit -- the 'report' grouping of the Detailed findings (sidata.SummaryGroup)
|                       of the newest complete collection whose groupings are written (sidata.SummaryGroupState, #871)
|          groupedOlder N = 1 when that collection is OLDER than the newest complete one
|          gstatus      as status, for that older collection (its verdicts decide its grouped figures)
|          cis / cisTier0                    N = current CIs (not retired) / of them tier 0   (sidata.Ci)
|          domain       R = class (device / identity / cloud_resource / public_ip), N = current CIs of that class (sidata.Ci)
|          vulnItems    N = 1 when the close-loop holds any item (vuln.VulnerabilityItem), else 0
|          fixedLast30Days                   N = close-loop items closed Remediated in the last 30 days
|        Every part guarded: a database without a table / column answers without that part.
|    #>
|@"
|SET NOCOUNT ON;
|DECLARE @o TABLE (K nvarchar(32) NOT NULL, R nvarchar(256) NULL, G nvarchar(16) NULL, S nvarchar(16) NULL, N bigint NULL);
|DECLARE @dt datetime2(3), @dc int, @gt datetime2(3), @gc int;
|IF OBJECT_ID(N'sidata.Collection') IS NOT NULL
|    SELECT TOP (1) @dt = CollectionTime, @dc = CollectionId FROM sidata.Collection WHERE Kind = N'Detailed' AND Status = N'Complete' ORDER BY CollectionTime DESC;
|IF OBJECT_ID(N'sidata.RaReportStatus') IS NOT NULL AND @dt IS NOT NULL
|    INSERT @o (K, R, G, S, N)
|    SELECT N'status', ReportName, Grain, State, StoredRows FROM sidata.RaReportStatus
|    WHERE Grain = N'Detailed' AND CollectionTime = @dt;
|-- #871: the grouped figures come from the NEWEST complete collection that HAS its groupings -- a run that stopped before the
|-- data sync never drops them; that collection's own verdicts decide them (gstatus) when it is not the newest
|IF @dc IS NOT NULL AND OBJECT_ID(N'sidata.SummaryGroup') IS NOT NULL AND OBJECT_ID(N'sidata.SummaryGroupState') IS NOT NULL
|    EXEC sp_executesql N'SELECT TOP (1) @gt = c.CollectionTime, @gc = c.CollectionId FROM sidata.Collection AS c
|WHERE c.Kind = N''Detailed'' AND c.Status = N''Complete'' AND EXISTS (SELECT 1 FROM sidata.SummaryGroupState AS s WHERE s.CollectionId = c.CollectionId)
|ORDER BY c.CollectionTime DESC;', N'@gt datetime2(3) OUTPUT, @gc int OUTPUT', @gt = @gt OUTPUT, @gc = @gc OUTPUT;
|IF @gc IS NOT NULL AND @gc <> @dc
|BEGIN
|    INSERT @o (K, N) VALUES (N'groupedOlder', 1);
|    IF OBJECT_ID(N'sidata.RaReportStatus') IS NOT NULL
|        INSERT @o (K, R, G, S, N)
|        SELECT N'gstatus', ReportName, Grain, State, StoredRows FROM sidata.RaReportStatus
|        WHERE Grain = N'Detailed' AND CollectionTime = @gt;
|END
|IF @gc IS NOT NULL
|    INSERT @o (K, R, N)
|    EXEC sp_executesql N'
|IF EXISTS (SELECT 1 FROM sidata.SummaryGroupState WHERE CollectionId = @dc)
|SELECT N''grouped'', CONVERT(nvarchar(256), NULL), CONVERT(bigint, 1)
|UNION ALL
|SELECT x.K, g.Key1, x.N
|FROM sidata.SummaryGroup AS g
|CROSS APPLY (VALUES (N''assets'', CONVERT(bigint, g.Assets)), (N''recs'', CONVERT(bigint, g.Recommendations)), (N''recsCritical'', CONVERT(bigint, g.CriticalRecommendations)),
|                    (N''recsHigh'', CONVERT(bigint, g.HighRecommendations)), (N''recsExploited'', CONVERT(bigint, g.ExploitedRecommendations))) AS x(K, N)
|WHERE g.CollectionId = @dc AND g.GroupingId = ''report'';', N'@dc int', @dc = @gc;
|IF OBJECT_ID(N'sidata.Ci') IS NOT NULL
|    INSERT @o (K, N)
|    SELECT N'cis', COUNT_BIG(*) FROM sidata.Ci WHERE ISNULL(Lifecycle, N'') <> N'retired'
|    UNION ALL
|    SELECT N'cisTier0', COUNT_BIG(*) FROM sidata.Ci WHERE Tier = 0 AND ISNULL(Lifecycle, N'') <> N'retired';
|IF OBJECT_ID(N'sidata.Ci') IS NOT NULL AND COL_LENGTH(N'sidata.Ci', N'Class') IS NOT NULL
|    INSERT @o (K, R, N)
|    EXEC sp_executesql N'SELECT N''domain'', Class, COUNT_BIG(*) FROM sidata.Ci
|WHERE ISNULL(Lifecycle, N'''') <> N''retired'' AND Class IN (N''device'', N''identity'', N''cloud_resource'', N''public_ip'')
|GROUP BY Class;';
|IF OBJECT_ID(N'vuln.VulnerabilityItem') IS NOT NULL
|    INSERT @o (K, N)
|    SELECT N'vulnItems', CASE WHEN EXISTS (SELECT 1 FROM vuln.VulnerabilityItem) THEN 1 ELSE 0 END
|    UNION ALL
|    SELECT N'fixedLast30Days', COUNT_BIG(*) FROM vuln.VulnerabilityItem
|    WHERE UpdatedAt >= DATEADD(day, -30, SYSUTCDATETIME()) AND State = N'Closed' AND ClosedAt >= DATEADD(day, -30, SYSUTCDATETIME())
|      AND LEFT(ISNULL(CloseReason, N''), CHARINDEX(N':', ISNULL(CloseReason, N'') + N':') - 1) = N'Remediated';
|SELECT K, R, G, S, N FROM @o;
|"@
|}
|
|
|function ConvertFrom-SIRaTelemetryCountRows {
|    <#
|        PURE. The read's rows (K, R, G, S, N) -> the #719 keys that are KNOWN: a key whose report is not Complete in the
|        latest complete collection of its grain, or whose number is missing, is left out (never 0 by guess).
|    #>
|    param([AllowNull()][object[]]$Rows)
|    $out = [ordered]@{}
|    $status = @{}; $gstatus = @{}; $agg = @{}
|    foreach ($r in @($Rows)) {
|        if ($null -eq $r) { continue }
|        $k = [string]$r.K
|        if ($k -eq 'status') { $status[('{0}|{1}' -f $r.G, $r.R)] = @{ S = [string]$r.S; N = (ConvertTo-SITelemetryCount $r.N) } }
|        elseif ($k -eq 'gstatus') { $gstatus[('{0}|{1}' -f $r.G, $r.R)] = @{ S = [string]$r.S; N = (ConvertTo-SITelemetryCount $r.N) } }
|        elseif ($k) { $agg[('{0}|{1}' -f $k, [string]$r.R)] = ConvertTo-SITelemetryCount $r.N }
|    }
|    $done = { param($g, $n) $x = $status["$g|$n"]; ($null -ne $x -and $x.S -eq 'Complete') }
|    # #871: the grouped figures are decided by the verdicts of the collection they come from -- an OLDER one when the newest
|    # complete collection has no groupings yet (a run that stopped before the data sync); its date rides Security.collectionUtc
|    $older = ($null -ne $agg['groupedOlder|'] -and $agg['groupedOlder|'] -gt 0)
|    $gv = $status; if ($older) { $gv = $gstatus }
|    $gdone = { param($g, $n) $x = $gv["$g|$n"]; ($null -ne $x -and $x.S -eq 'Complete') }
|    if ($status.Count) {
|        $out['raReportsTotal'] = [long]$status.Count
|        $out['raReportsComplete'] = [long]@($status.Values | Where-Object { $_.S -eq 'Complete' }).Count
|        $det = @($status.Keys | Where-Object { $_ -like 'Detailed|*' } | ForEach-Object { $status[$_].N } | Where-Object { $null -ne $_ })
|        if ($det.Count) { $s = [long]0; foreach ($v in $det) { $s += [long]$v }; $out['raRowsDetailed'] = $s }
|    }
|    foreach ($key in (Get-SIRaCountDetailedPairsState).Keys) {
|        $rn = (Get-SIRaCountDetailedPairsState)[$key]
|        if ((& $done 'Detailed' $rn) -and $null -ne $status["Detailed|$rn"].N) { $out[$key] = [long]$status["Detailed|$rn"].N }
|    }
|    # #636: the distinct assets / CVEs / recommendations of a Complete report, from the Detailed findings' 'report' grouping; a
|    # report without a group row (no finding) is a real 0 once the collection's groupings were read
|    $grouped = [bool](@($agg.Keys | Where-Object { $_ -like 'recs|*' -or $_ -like 'assets|*' -or $_ -eq 'grouped|' }).Count)
|    foreach ($key in (Get-SIRaCountAssetReportsState).Keys) {
|        $rn = (Get-SIRaCountAssetReportsState)[$key]
|        if (-not (& $gdone 'Detailed' $rn)) { continue }
|        if ($agg.ContainsKey("assets|$rn") -and $null -ne $agg["assets|$rn"]) { $out[$key] = [long]$agg["assets|$rn"] }
|        elseif ($grouped) { $out[$key] = [long]0 }
|    }
|    foreach ($key in (Get-SIRaCountRecommendationReportsState).Keys) {
|        $rn = (Get-SIRaCountRecommendationReportsState)[$key][0]; $k = (Get-SIRaCountRecommendationReportsState)[$key][1]
|        if (-not (& $gdone 'Detailed' $rn)) { continue }
|        if ($agg.ContainsKey("$k|$rn") -and $null -ne $agg["$k|$rn"]) { $out[$key] = [long]$agg["$k|$rn"] }
|        elseif ($grouped) { $out[$key] = [long]0 }
|    }
|    # attack paths: every Attack_Paths_Detailed_* report of the run Complete, each with its stored rows (the path findings)
|    $ap = @($status.Keys | Where-Object { $_ -like 'Detailed|Attack_Paths_Detailed_*' })
|    if ($ap.Count -and -not @($ap | Where-Object { $status[$_].S -ne 'Complete' -or $null -eq $status[$_].N }).Count) {
|        $s = [long]0; foreach ($x in $ap) { $s += [long]$status[$x].N }; $out['attackPaths'] = $s
|    }
|    # the CI estate: a database without any CI yet has nothing to say (no key, not 0)
|    if ($null -ne $agg['cis|'] -and $agg['cis|'] -gt 0) {
|        $out['cis'] = [long]$agg['cis|']
|        if ($null -ne $agg['cisTier0|']) { $out['cisTier0'] = [long]$agg['cisTier0|'] }
|        # the security domains: once the class was read at all (a domain row came back), a domain without a CI is a real 0
|        if (@($agg.Keys | Where-Object { $_ -like 'domain|*' }).Count) {
|            foreach ($d in (Get-SITelemetryDomainKeysState).Keys) {
|                $v = $agg["domain|$d"]
|                $out[(Get-SITelemetryDomainKeysState)[$d]] = $(if ($null -ne $v) { [long]$v } else { [long]0 })
|            }
|        }
|    }
|    # the close-loop's real remediations: only where the close-loop holds items (none = not in use here: no key)
|    if ($null -ne $agg['vulnItems|'] -and $agg['vulnItems|'] -gt 0 -and $null -ne $agg['fixedLast30Days|']) {
|        $out['fixedLast30Days'] = [long]$agg['fixedLast30Days|']
|    }
|    $out
|}
|
|function Invoke-SITelemetrySqlRows {
|    <#
|        One read on the install's Pro database (SI_ProSqlServer / SI_ProSqlDatabase) as the job, closed after; the rows as
|        objects. $null when no database is configured or this is a test session (never a connection there). Throws on a
|        failed read (the caller leaves the keys out).
|    #>
|    param([Parameter(Mandatory)][string]$Sql, [string]$Server = [string]$global:SI_ProSqlServer, [string]$Database = [string]$global:SI_ProSqlDatabase)
|    if ([string]::IsNullOrWhiteSpace($Server) -or [string]::IsNullOrWhiteSpace($Database)) { return $null }
|    if (Get-Module -Name Pester) { return $null }
|    if (-not (Get-Command -Name Get-SIObjectLedgerConnection -ErrorAction SilentlyContinue)) {
|        . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'identity', 'SI-ObjectLedgerStore.ps1'))
|    }
|    $cn = Get-SIObjectLedgerConnection -Server $Server -Database $Database -MaxAttempts 2
|    if (-not $cn) { return $null }
|    $rows = New-Object System.Collections.Generic.List[object]
|    try {
|        $cmd = $cn.CreateCommand(); $cmd.CommandText = $Sql; $cmd.CommandTimeout = 0
|        $rd = $cmd.ExecuteReader()
|        try {
|            while ($rd.Read()) {
|                $o = [ordered]@{}
|                for ($i = 0; $i -lt $rd.FieldCount; $i++) { $o[$rd.GetName($i)] = $(if ($rd.IsDBNull($i)) { $null } else { $rd.GetValue($i) }) }
|                $rows.Add([pscustomobject]$o)
|            }
|        } finally { $rd.Dispose() }
|    } finally { $cn.Dispose() }
|    , $rows.ToArray()
|}
|
|function Get-SIRaTelemetryCounts {
|    <#
|        The #719 keys of this install (an ordered dictionary, possibly empty). -SqlRows { param($Sql) rows } is the seam
|        (default Invoke-SITelemetrySqlRows). A failed read leaves EVERY #719 key out and says so in ONE plain line per process
|        (-Log, default Write-Host). Never throws.
|    #>
|    param([scriptblock]$SqlRows, [scriptblock]$Log)
|    if (-not $SqlRows) { $SqlRows = { param($Sql) Invoke-SITelemetrySqlRows -Sql $Sql } }
|    try {
|        $rows = & $SqlRows (Get-SIRaTelemetryCountSql)
|        if ($null -eq $rows) { return [ordered]@{} }
|        return (ConvertFrom-SIRaTelemetryCountRows -Rows @($rows))
|    } catch {
|        if (-not $script:SIRaCountsWarned) {
|            $script:SIRaCountsWarned = $true
|            $m = ("$($_.Exception.Message)".Trim() -replace '\s+', ' '); if ($m.Length -gt 160) { $m = $m.Substring(0, 160) + '...' }
|            $line = (" [INFO] Today's status report leaves out the report and CI numbers -- the database could not be read ({0})." -f $m)
|            try { if ($Log) { & $Log $line } else { Write-Host $line } } catch { }
|        }
|        return [ordered]@{}
|    }
|}
|
|<#
|    SQL SPACE (#512, owner 2026-10-09: "telemetry must collect available sql db space remaining in health telemetry";
|    framework §8.10 SQL-SPACE, the same two keys PIM sends): the install's Pro database (SI_ProSqlServer /
|    SI_ProSqlDatabase), in MB --
|      sqlUsedMb  the space its data files USE (FILEPROPERTY SpaceUsed, 8 KB pages)
|      sqlMaxMb   its maximum size (DATABASEPROPERTYEX MaxSizeInBytes)
|    Both readable with data rights only. Invardia warns on space left; a maximum under 250 GB is flagged (#511).
|#>
|function Get-SISqlSpaceQuery {
|    # ONE value, 'used|max' -- read as a scalar
|    "SET NOCOUNT ON; SELECT CONCAT((SELECT SUM(CAST(FILEPROPERTY(name, 'SpaceUsed') AS bigint)) * 8 / 1024 FROM sys.database_files WHERE type_desc = 'ROWS'), '|', CAST(DATABASEPROPERTYEX(DB_NAME(), 'MaxSizeInBytes') AS bigint) / 1048576);"
|}
|
|function ConvertFrom-SISqlSpaceValue {
|    <# PURE. 'used|max' -> @{ sqlUsedMb; sqlMaxMb } with only the parts that are whole numbers >= 0 (sqlMaxMb > 0). #>
|    param($Value)
|    $c = @{}
|    if ($null -eq $Value -or $Value -is [System.DBNull]) { return $c }
|    $p = ([string]$Value).Split('|')
|    $n = [long]0
|    if ($p.Count -ge 1 -and [long]::TryParse($p[0].Trim(), [Globalization.NumberStyles]::Integer, [Globalization.CultureInfo]::InvariantCulture, [ref]$n) -and $n -ge 0) { $c['sqlUsedMb'] = $n }
|    if ($p.Count -ge 2 -and [long]::TryParse($p[1].Trim(), [Globalization.NumberStyles]::Integer, [Globalization.CultureInfo]::InvariantCulture, [ref]$n) -and $n -gt 0) { $c['sqlMaxMb'] = $n }
|    $c
|}
|
|function Get-SISqlSpaceCounts {
|    <#
|        sqlUsedMb / sqlMaxMb of the install's Pro database; an empty hashtable when there is no database or it could not be
|        read. -Scalar { param($Sql) } is the seam (default: one connection as the job, closed after). Never throws.
|    #>
|    param([scriptblock]$Scalar, [string]$Server = [string]$global:SI_ProSqlServer, [string]$Database = [string]$global:SI_ProSqlDatabase)
|    try {
|        if ($Scalar) { return (ConvertFrom-SISqlSpaceValue -Value (& $Scalar (Get-SISqlSpaceQuery))) }
|        if ([string]::IsNullOrWhiteSpace($Server) -or [string]::IsNullOrWhiteSpace($Database)) { return @{} }
|        # (no closure seam here: a GetNewClosure() runs in its own module scope and does not see the connection helper)
|        if (-not (Get-Command -Name Get-SIObjectLedgerConnection -ErrorAction SilentlyContinue)) {
|            . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'identity', 'SI-ObjectLedgerStore.ps1'))
|        }
|        $cn = Get-SIObjectLedgerConnection -Server $Server -Database $Database -MaxAttempts 2
|        if (-not $cn) { return @{} }
|        try { $cmd = $cn.CreateCommand(); $cmd.CommandText = (Get-SISqlSpaceQuery); $cmd.CommandTimeout = 0; $v = $cmd.ExecuteScalar() } finally { $cn.Dispose() }
|        ConvertFrom-SISqlSpaceValue -Value $v
|    } catch { @{} }
|}
|
|function Get-SIIdentityCountQuery {
|    <# The KQL for users / guests: the latest identity collection, one row per user object. Typed = how many users carry
|       a UserType at all -- 0 means the column is not filled, and then nothing is reported. #>
|    param([System.Collections.IDictionary]$CompleteBy = (Get-SICountCompleteByState))
|    $q = @'
|let t = SI_Identity_Profile_CL | where TimeGenerated > ago(8d);
|let lastColl = toscalar(t{{IDB}} | summarize _in = max(ingestion_time()) by CollectionTime | where _in < ago(30m) | summarize max(CollectionTime));
|t
|| where CollectionTime == lastColl
|| extend _id = tostring(column_ifexists("SI_AssetId", "")), _type = tostring(column_ifexists("IdentityType", "")), _ut = tostring(column_ifexists("UserType", "")), _en = tostring(column_ifexists("AccountEnabled", ""))
|| where isnotempty(_id) and _type =~ "User"
|| summarize _ut = take_any(_ut), _en = take_any(_en) by _id
|| summarize Users = countif(_ut =~ "Member" and _en =~ "true"), Guests = countif(_ut =~ "Guest"), Typed = countif(isnotempty(_ut)), Total = count()
|'@
|    $q.Replace('{{IDB}}', (Get-SICountCompleteFilter -Source identity -CompleteBy $CompleteBy))
|}
|
|function Get-SIAdOnlyUserHuntingQuery {
|    <# The Advanced Hunting KQL for users' AD part: the distinct adSid of every enabled AD USER account in the Exposure
|       Graph (field names as Get-DiscoveryFromIdentityExposureGraph and data-model/mappings/eg.locked.json read them).
|       Total = how many there are, so a truncated answer is detected (rows < Total) and never sent as a count. #>
|    @'
|let u = ExposureGraphNodes
|| where NodeLabel =~ "user"
|| extend _p = tostring(NodeProperties.rawData.primaryProvider), _t = tostring(NodeProperties.rawData.identityType), _sid = toupper(tostring(NodeProperties.rawData.adSid)), _en = tostring(NodeProperties.rawData.accountEnabled), _en2 = tostring(NodeProperties.rawData.isEnabled), _act = tostring(NodeProperties.rawData.isActive)
|| extend _enabled = iff(isnotempty(_en), _en, iff(isnotempty(_en2), _en2, _act))
|| where _p =~ "ActiveDirectory" and _t =~ "User" and isnotempty(_sid) and _enabled =~ "true"
|| distinct AdSid = _sid;
|u | extend Total = toscalar(u | count)
|'@
|}
|
|function Get-SIEntraOnPremSidQuery {
|    <# The KQL for the SIDs of every Entra user in the latest identity collection that came from on-prem AD (OnPremSid),
|       enabled or not -- a synced AD account belongs to the Entra part either way (counted there, or deliberately not
|       when disabled in Entra), so it is never added again from AD. #>
|    param([System.Collections.IDictionary]$CompleteBy = (Get-SICountCompleteByState))
|    $q = @'
|let t = SI_Identity_Profile_CL | where TimeGenerated > ago(8d);
|let lastColl = toscalar(t{{IDB}} | summarize _in = max(ingestion_time()) by CollectionTime | where _in < ago(30m) | summarize max(CollectionTime));
|t
|| where CollectionTime == lastColl
|| extend _type = tostring(column_ifexists("IdentityType", "")), _sid = toupper(tostring(column_ifexists("OnPremSid", "")))
|| where _type =~ "User" and isnotempty(_sid)
|| distinct OnPremSid = _sid
|'@
|    $q.Replace('{{IDB}}', (Get-SICountCompleteFilter -Source identity -CompleteBy $CompleteBy))
|}
|
|function Get-SIAdOnlyUserCountFromRows {
|    <#
|        PURE. users' AD part from the hunting rows (AdSid, Total) and the Entra OnPremSids. Returns @{ Count; Reason }:
|        Count = the AD-only enabled users (a SID that is an Entra user's OnPremSid is not counted), or $null with a plain
|        Reason when the hunting answer was cut short (fewer rows than its Total).
|    #>
|    param([AllowNull()][object[]]$EgRows, [AllowNull()][object[]]$EntraSids)
|    $ad = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $total = $null
|    foreach ($r in @($EgRows)) {
|        if ($null -eq $r) { continue }
|        $sid = "$($r.AdSid)".Trim()
|        if ($sid) { [void]$ad.Add($sid) }
|        $t = ConvertTo-SITelemetryCount $r.Total
|        if ($null -ne $t -and ($null -eq $total -or $t -gt $total)) { $total = $t }
|    }
|    if ($null -ne $total -and $ad.Count -lt $total) {
|        return @{ Count = $null; Reason = ('the Exposure Graph answer was cut short ({0} of {1} AD users)' -f $ad.Count, $total) }
|    }
|    $n = [long]0
|    if ($ad.Count -gt 0) {
|        $entra = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|        foreach ($e in @($EntraSids)) {
|            if ($null -eq $e) { continue }
|            $v = if ($e -is [string]) { $e } else { "$($e.OnPremSid)" }
|            if ($v.Trim()) { [void]$entra.Add($v.Trim()) }
|        }
|        foreach ($s in $ad) { if (-not $entra.Contains($s)) { $n++ } }
|    }
|    @{ Count = $n; Reason = '' }
|}
|
|function Invoke-SITelemetryHuntingQuery {
|    <#
|        One Advanced Hunting query for the counts, as the run's Graph identity (Get-SIGraphToken -Resource Graph -- the token
|        the identity engine's Exposure Graph discovery uses) through Invoke-SIHuntingQueryRest (v1.0, 120 s, -AsResult).
|        Returns the rows as plain objects; throws a plain reason when it cannot be read. A test session never calls out.
|    #>
|    param([Parameter(Mandatory)][string]$Query)
|    if (Get-Module -Name Pester) { throw 'a test session does not query Advanced Hunting' }
|    if (-not (Get-Command -Name Invoke-SIHuntingQueryRest -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-GraphRest.ps1')) }
|    if (-not (Get-Command -Name Get-SIGraphToken -ErrorAction SilentlyContinue)) {
|        . ([System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'auth', 'Get-SIGraphToken.ps1'))
|    }
|    $token = Get-SIGraphToken -Resource Graph
|    if ([string]::IsNullOrWhiteSpace([string]$token)) { throw 'no Graph token for Advanced Hunting' }
|    $r = Invoke-SIHuntingQueryRest -Query $Query -Token $token -TimeoutSec 120 -ApiVersion 'v1.0' -AsResult
|    if (-not $r.Ok) { throw ([string]$r.Error) }
|    $rows = New-Object System.Collections.Generic.List[object]
|    foreach ($x in @($r.Results)) { if ($null -ne $x) { $rows.Add([pscustomobject]$x.AdditionalProperties) } }
|    , $rows.ToArray()
|}
|
|function Get-SIAdOnlyUserCount {
|    <#
|        users' AD part: @{ Count; Reason } -- Count $null (with a plain Reason) when it cannot be read. -RunHunting
|        { param($Kql) rows } and -RunQuery { param($Kql) rows } are the seams (defaults: Invoke-SITelemetryHuntingQuery /
|        Invoke-SITelemetryLaQuery). Never throws.
|    #>
|    param([scriptblock]$RunHunting, [scriptblock]$RunQuery)
|    if (-not $RunHunting) { $RunHunting = { param($Kql) Invoke-SITelemetryHuntingQuery -Query $Kql } }
|    if (-not $RunQuery) { $RunQuery = { param($Kql) Invoke-SITelemetryLaQuery -Query $Kql } }
|    $why = { param($e) $m = ("$e".Trim() -replace '\s+', ' '); if ($m.Length -gt 160) { $m = $m.Substring(0, 160) + '...' }; $m }
|    try {
|        $eg = & $RunHunting (Get-SIAdOnlyUserHuntingQuery)
|        if ($null -eq $eg) { return @{ Count = $null; Reason = 'the Exposure Graph could not be read' } }
|        $eg = @($eg)
|        $sids = @()
|        if ($eg.Count -gt 0) {
|            # the dedupe needs the Entra SIDs; without them an AD number could count synced users twice, so none is sent
|            try { $sids = & $RunQuery (Get-SIEntraOnPremSidQuery) }
|            catch { return @{ Count = $null; Reason = ('the Entra on-prem SIDs to match synced users could not be read: {0}' -f (& $why $_.Exception.Message)) } }
|            if ($null -eq $sids) { return @{ Count = $null; Reason = 'the Entra on-prem SIDs to match synced users could not be read' } }
|        }
|        return (Get-SIAdOnlyUserCountFromRows -EgRows $eg -EntraSids @($sids))
|    } catch { return @{ Count = $null; Reason = ('the Exposure Graph could not be read: {0}' -f (& $why $_.Exception.Message)) } }
|}
|
|function Get-SIDeviceCountQuery {
|    <# The KQL for devices: per UTC day of the last 7, the latest correlation run of that day, the number of distinct
|       correlation objects with an endpoint member that is not an IoT or network device. #>
|    @'
|let rows = SI_ObjectMap_CL
|| where TimeGenerated > ago(8d)
|| where CollectionTime > ago(7d)
|| where tostring(SI_MemberEngine) == "endpoint"
|| extend Day = startofday(CollectionTime);
|let lastPerDay = rows | summarize CollectionTime = max(CollectionTime) by Day;
|let cats = SI_Endpoint_Profile_CL
|| where TimeGenerated > ago(8d)
|| extend _aid = tostring(column_ifexists("SI_AssetId", "")), _cat = tolower(tostring(column_ifexists("DeviceCategory", "")))
|| where isnotempty(_aid)
|| summarize arg_max(CollectionTime, _cat) by _aid
|| project SI_AssetId = _aid, _cat;
|rows
|| join kind=inner (lastPerDay) on Day, CollectionTime
|| join kind=leftouter (cats) on SI_AssetId
|| where not(_cat in ("iot", "networkdevice"))
|| summarize Devices = count_distinct(SI_CorrelationId) by Day
|| order by Day asc
|'@
|}
|
|function ConvertTo-SITelemetryCount {
|    <# PURE. A non-negative whole number, or $null (unknown). #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or [string]::IsNullOrWhiteSpace([string]$Value)) { return $null }
|    $d = 0.0
|    if (-not [double]::TryParse([string]$Value, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $null }
|    if ($d -lt 0 -or [double]::IsNaN($d) -or [double]::IsInfinity($d)) { return $null }
|    [long][Math]::Floor($d)
|}
|
|function Get-SIIdentityCounts {
|    <#
|        PURE. users / guests from the identity query's one result row (Users, Guests, Typed, Total). Returns an ordered
|        dictionary with the keys it could compute -- EMPTY when there are no users or no UserType was collected at all.
|    #>
|    param([AllowNull()]$Row)
|    $out = [ordered]@{}
|    if ($null -eq $Row) { return $out }
|    $total = ConvertTo-SITelemetryCount $Row.Total
|    $typed = ConvertTo-SITelemetryCount $Row.Typed
|    if ($null -eq $total -or $total -eq 0 -or $null -eq $typed -or $typed -eq 0) { return $out }
|    $u = ConvertTo-SITelemetryCount $Row.Users
|    $g = ConvertTo-SITelemetryCount $Row.Guests
|    if ($null -ne $u) { $out['users'] = $u }
|    if ($null -ne $g) { $out['guests'] = $g }
|    $out
|}
|
|function Get-SIDeviceCountMax {
|    <#
|        PURE. The 7-day maximum of daily device counts. -DailyCounts: rows with Day (a date) and Devices. Only the UTC days
|        from (today - 6) to today count; an older or future day, or a row without a number, is ignored. $null when no day
|        is left (no correlation run in the last 7 days) -- never 0 by guess.
|    #>
|    param([AllowNull()][object[]]$DailyCounts, [datetime]$NowUtc = [datetime]::UtcNow)
|    $today = $NowUtc.ToUniversalTime().Date
|    $first = $today.AddDays(-6)
|    $max = $null
|    foreach ($r in @($DailyCounts)) {
|        if ($null -eq $r) { continue }
|        $n = ConvertTo-SITelemetryCount $r.Devices
|        if ($null -eq $n) { continue }
|        $day = $null
|        try {
|            $dv = $r.Day
|            $day = if ($dv -is [datetime]) { $dv.ToUniversalTime().Date }
|                   else { ([datetime]::Parse([string]$dv, [System.Globalization.CultureInfo]::InvariantCulture, [System.Globalization.DateTimeStyles]'AdjustToUniversal, AssumeUniversal')).Date }
|        } catch { continue }
|        if ($day -lt $first -or $day -gt $today) { continue }
|        if ($null -eq $max -or $n -gt $max) { $max = $n }
|    }
|    $max
|}
|
|function Invoke-SITelemetryLaQuery {
|    <#
|        One KQL query on the install's workspace, for the counts: the Log Analytics resource-centric data plane
|        (api.loganalytics.io/v1<workspace resource id>/query) as the run's identity, through the run's own REST helper.
|        Short: 2 attempts, 60 s. Returns the primary table as objects, or $null when the REST helper is not loaded in this
|        process (no signed-in engine) or there is no workspace. Throws on a refused query (the caller omits the count).
|    #>
|    # -MayBeMissing: tables of the query this workspace may not have (Test-SILaAnswerWhole): their legs answer nothing, the rest is whole
|    param([Parameter(Mandatory)][string]$Query, [AllowEmptyString()][string]$WorkspaceResourceId = [string]$global:SI_WorkspaceResourceId, [string[]]$MayBeMissing = @())
|    $ws = "$WorkspaceResourceId".Trim().TrimEnd('/')
|    if ($ws -notmatch '^/subscriptions/[^/]+/resourceGroups/[^/]+/providers/Microsoft\.OperationalInsights/workspaces/[^/]+$') { return $null }
|    if (-not (Get-Command -Name Invoke-SIAzRestRequest -ErrorAction SilentlyContinue) -or
|        -not (Get-Command -Name ConvertFrom-SILaQueryJson -ErrorAction SilentlyContinue)) { return $null }
|    $uri = 'https://api.loganalytics.io/v1{0}/query' -f $ws
|    $r = Invoke-SIAzRestRequest -Method POST -Uri $uri -Audience LaQuery -Body (@{ query = $Query } | ConvertTo-Json -Compress) `
|             -TimeoutSec 60 -MaxAttempts 2 -What 'telemetry count query'
|    $parsed = ConvertFrom-SILaQueryJson -Json ([string]$r.Content)
|    # #639 lane 4: a count from an answer the service CUT (a part that timed out) is a wrong count -- refused like every
|    # Log Analytics read (Test-SILaAnswerWhole); the caller omits the count, never sends a short one
|    if ($null -ne $parsed.Error -and (Get-Command -Name Test-SILaAnswerWhole -ErrorAction SilentlyContinue)) {
|        $v = Test-SILaAnswerWhole -ErrorObject $parsed.Error -Rows 0 -MayBeMissing $MayBeMissing
|        if (-not $v.Whole) { throw (New-SILaCutAnswerError -Verdict $v -ErrorObject $parsed.Error) }
|    }
|    $t = @($parsed.Tables) | Select-Object -First 1
|    $rows = New-Object System.Collections.Generic.List[object]
|    if ($t) {
|        $names = @($t.Columns | ForEach-Object { [string]$_.name })
|        foreach ($row in @($t.Rows)) {
|            $o = [ordered]@{}
|            for ($i = 0; $i -lt $names.Count; $i++) { $o[$names[$i]] = $row[$i] }
|            $rows.Add([pscustomobject]$o)
|        }
|    }
|    , $rows.ToArray()
|}
|
|function Get-SIDeviceCount {
|    <#
|        THE device count of this install: the 7-day maximum of unique correlated devices (endpoints + servers, one per
|        real machine). $null when it cannot be computed. The reusable unit for the heartbeat AND the future Pro Business
|        device cap. -RunQuery { param($Kql) rows } is the test seam (default: Invoke-SITelemetryLaQuery). Never throws.
|    #>
|    param([scriptblock]$RunQuery, [datetime]$NowUtc = [datetime]::UtcNow)
|    if (-not $RunQuery) { $RunQuery = { param($Kql) Invoke-SITelemetryLaQuery -Query $Kql } }
|    try {
|        $rows = & $RunQuery (Get-SIDeviceCountQuery)
|        if ($null -eq $rows) { return $null }
|        return (Get-SIDeviceCountMax -DailyCounts @($rows) -NowUtc $NowUtc)
|    } catch { return $null }
|}
|
|<#
|    THE SECURITY SCORES (owner 2026-10-16: "Add, permission REQUIRED"), three Counts keys, whole numbers >= 0 (rounded):
|      secureScore / secureScoreMax  Microsoft Secure Score, the LATEST daily score of the tenant: Graph
|                                    GET /v1.0/security/secureScores?$top=1 -> currentScore / maxScore
|                                    (application permission Microsoft Graph SecurityEvents.Read.All, read only)
|      exposureScore                 the Defender for Endpoint exposure score: GET https://api.securitycenter.microsoft.com/api/exposureScore
|                                    -> score (application permission WindowsDefenderATP Score.Read.All, read only)
|    Both permissions are REQUIRED (config/permissions.locked.json): setup grants them on a new install, an existing install's
|    update names them (setup/_shared/SI-PermissionNote.ps1). Until granted, a 401 / 403 leaves the keys OUT and the heartbeat's
|    Warnings carry si-perm-1004 (Get-SISecurityScoreState -> SI-HeartbeatFields.ps1, Get-SIHeartbeatWarnings). Any other
|    failure (no Defender for Endpoint, a timeout, a 5xx, no token) leaves the keys out, says one line, raises no warning.
|    CHEAP: one call each, at most once an hour per process (the answer is kept for -CacheMinutes), and only in the hourly
|    status report job (SI_ENGINE heartbeat) unless -WithScores says otherwise. Never throws.
|#>
|function Get-SISecurityScoreTable {
|    <# The value of $script:SISecurityScore, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SISecurityScore) { $script:SISecurityScore = @{
|    GraphUri     = 'https://graph.microsoft.com/v1.0/security/secureScores?$top=1'
|    DefenderUri  = 'https://api.securitycenter.microsoft.com/api/exposureScore'
|    GraphRole    = 'SecurityEvents.Read.All'
|    DefenderRole = 'Score.Read.All'
|    TimeoutSec   = 30
|    CacheMinutes = 55
|} }
|    , $script:SISecurityScore
|}
|$script:SISecurityScore = $null; $null = Get-SISecurityScoreTable
|
|function Get-SISecurityScoreContract { (Get-SISecurityScoreTable) }
|
|function Invoke-SISecurityScoreGet {
|    <#
|        One GET as the run's identity (Get-SIGraphToken -Resource Graph | Defender). Returns @{ Status (int; 0 = no answer);
|        Body; Error } and NEVER throws. A test session never calls out (Status 0).
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Graph', 'Defender')][string]$Resource, [Parameter(Mandatory)][string]$Uri)
|    if (Get-Module -Name Pester) { return @{ Status = 0; Body = $null; Error = 'a test session does not read the security scores' } }
|    try {
|        if (-not (Get-Command -Name Get-SIGraphToken -ErrorAction SilentlyContinue)) {
|            . ([System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'auth', 'Get-SIGraphToken.ps1'))
|        }
|        $token = Get-SIGraphToken -Resource $Resource
|        if ([string]::IsNullOrWhiteSpace([string]$token)) { return @{ Status = 0; Body = $null; Error = ('no {0} token' -f $Resource) } }
|        $body = Invoke-RestMethod -Method Get -Uri $Uri -Headers @{ Authorization = ('Bearer ' + $token) } -TimeoutSec (Get-SISecurityScoreTable).TimeoutSec -ErrorAction Stop
|        return @{ Status = 200; Body = $body; Error = '' }
|    } catch {
|        $code = 0
|        try { if ($_.Exception.Response) { $code = [int]$_.Exception.Response.StatusCode } } catch { $code = 0 }
|        $m = ("$($_.Exception.Message)".Trim() -replace '\s+', ' '); if ($m.Length -gt 160) { $m = $m.Substring(0, 160) + '...' }
|        return @{ Status = $code; Body = $null; Error = $m }
|    }
|}
|
|function ConvertFrom-SISecurityScoreAnswers {
|    <#
|        PURE. The two answers (@{ Status; Body; Error }, or $null = not asked) -> @{ Counts (ordered); Refused (the permissions a
|        401 / 403 names); Problems (plain reasons, not a permission) }. A value that is not a number >= 0 is left out.
|    #>
|    param([AllowNull()]$Graph, [AllowNull()]$Defender)
|    $c = (Get-SISecurityScoreTable)
|    $counts = [ordered]@{}; $refused = New-Object System.Collections.Generic.List[string]; $problems = New-Object System.Collections.Generic.List[string]
|    $num = { param($v) if ($null -eq $v) { return $null }; $d = 0.0
|        if (-not [double]::TryParse([string]$v, [Globalization.NumberStyles]::Float, [Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $null }
|        if ([double]::IsNaN($d) -or [double]::IsInfinity($d) -or $d -lt 0) { return $null }
|        [long][Math]::Round($d, [MidpointRounding]::AwayFromZero) }
|    $prop = { param($o, $n) if ($null -eq $o) { return $null }; if ($o -is [System.Collections.IDictionary]) { return $o[$n] }; $p = $o.PSObject.Properties[$n]; if ($p) { $p.Value } else { $null } }
|    if ($null -ne $Graph) {
|        $s = [int]$Graph.Status
|        if ($s -in 401, 403) { $refused.Add($c.GraphRole) }
|        elseif ($s -ge 200 -and $s -lt 300) {
|            $latest = @(& $prop $Graph.Body 'value') | Where-Object { $null -ne $_ } | Select-Object -First 1
|            if ($null -eq $latest) { $problems.Add('Microsoft Secure Score has no score yet') }
|            else {
|                $cur = & $num (& $prop $latest 'currentScore'); $max = & $num (& $prop $latest 'maxScore')
|                if ($null -ne $cur) { $counts['secureScore'] = $cur }
|                if ($null -ne $max) { $counts['secureScoreMax'] = $max }
|                if ($null -eq $cur -and $null -eq $max) { $problems.Add('Microsoft Secure Score answered without a score') }
|            }
|        } else { $problems.Add(('Microsoft Secure Score could not be read ({0})' -f $(if ("$($Graph.Error)".Trim()) { "$($Graph.Error)".Trim() } else { "status $s" }))) }
|    }
|    if ($null -ne $Defender) {
|        $s = [int]$Defender.Status
|        if ($s -in 401, 403) { $refused.Add($c.DefenderRole) }
|        elseif ($s -ge 200 -and $s -lt 300) {
|            $sc = & $num (& $prop $Defender.Body 'score')
|            if ($null -ne $sc) { $counts['exposureScore'] = $sc } else { $problems.Add('the Defender exposure score answered without a score') }
|        } else { $problems.Add(('the Defender exposure score could not be read ({0})' -f $(if ("$($Defender.Error)".Trim()) { "$($Defender.Error)".Trim() } else { "status $s" }))) }
|    }
|    @{ Counts = $counts; Refused = $refused.ToArray(); Problems = $problems.ToArray() }
|}
|
|function Reset-SISecurityScoreCache { $global:SI_SecurityScoreCache = $null; $global:SI_SecurityScoreState = $null; $global:SI_SecurityScoreSaid = $false }
|
|function Get-SISecurityScoreState {
|    <# The permission state of the last score read in this process: @{ Refused = string[]; SinceUtc } -- $null when nothing was
|       read, or nothing was refused. Read by the heartbeat's Warnings (si-perm-1004). #>
|    $s = $global:SI_SecurityScoreState
|    if ($null -eq $s -or -not @($s.Refused).Count) { return $null }
|    $s
|}
|
|function Get-SISecurityScoreCounts {
|    <#
|        The three score keys of this install (an ordered dictionary, possibly empty). -GraphGet / -DefenderGet
|        { param($Uri) } -> @{ Status; Body; Error } are the seams (default Invoke-SISecurityScoreGet). The answer is kept for
|        -CacheMinutes (55): a second call within the hour reads nothing. Sets the permission state (Get-SISecurityScoreState)
|        and says ONE plain line per process when a score could not be read (-Log, default Write-Host). Never throws.
|    #>
|    param([scriptblock]$GraphGet, [scriptblock]$DefenderGet, [datetime]$NowUtc = [datetime]::UtcNow, [int]$CacheMinutes = (Get-SISecurityScoreTable).CacheMinutes,
|          [scriptblock]$Log)
|    try {
|        $now = $NowUtc.ToUniversalTime()
|        $cache = $global:SI_SecurityScoreCache
|        if ($null -ne $cache -and $CacheMinutes -gt 0 -and ($now - [datetime]$cache.AtUtc).TotalMinutes -lt $CacheMinutes -and ($now -ge [datetime]$cache.AtUtc)) {
|            $o = [ordered]@{}; foreach ($k in @($cache.Counts.Keys)) { $o[$k] = $cache.Counts[$k] }; return $o
|        }
|        if (-not $GraphGet) { $GraphGet = { param($Uri) Invoke-SISecurityScoreGet -Resource Graph -Uri $Uri } }
|        if (-not $DefenderGet) { $DefenderGet = { param($Uri) Invoke-SISecurityScoreGet -Resource Defender -Uri $Uri } }
|        $g = $null; $d = $null
|        try { $g = & $GraphGet (Get-SISecurityScoreTable).GraphUri } catch { $g = @{ Status = 0; Body = $null; Error = "$($_.Exception.Message)" } }
|        try { $d = & $DefenderGet (Get-SISecurityScoreTable).DefenderUri } catch { $d = @{ Status = 0; Body = $null; Error = "$($_.Exception.Message)" } }
|        $r = ConvertFrom-SISecurityScoreAnswers -Graph $g -Defender $d
|        $prev = $global:SI_SecurityScoreState
|        $since = if ($prev -and @($prev.Refused).Count -and $prev.SinceUtc) { $prev.SinceUtc } else { $now }
|        $global:SI_SecurityScoreState = @{ Refused = @($r.Refused); SinceUtc = $(if (@($r.Refused).Count) { $since } else { $null }) }
|        $global:SI_SecurityScoreCache = @{ AtUtc = $now; Counts = $r.Counts }
|        $why = @(@($r.Refused | ForEach-Object { 'the permission {0} is not granted' -f $_ }) + @($r.Problems))
|        if ($why.Count -and -not $global:SI_SecurityScoreSaid) {
|            $global:SI_SecurityScoreSaid = $true
|            $line = (" [INFO] The status report leaves out a security score -- {0}." -f ($why -join '; '))
|            try { if ($Log) { & $Log $line } else { Write-Host $line } } catch { }
|        }
|        $o = [ordered]@{}; foreach ($k in @($r.Counts.Keys)) { $o[$k] = $r.Counts[$k] }
|        return $o
|    } catch { return [ordered]@{} }
|}
|
|function Get-SITelemetryHeartbeatCounts {
|    <#
|        The Counts of an identified heartbeat: users, guests, devices -- each only when it could be computed. Returns a
|        hashtable (possibly empty). -RunQuery as Get-SIDeviceCount; -RunHunting as Get-SIAdOnlyUserCount; -Log
|        { param($Line) } gets the one plain line when users carries the Entra part only (default: Write-Host). Never throws.
|    #>
|    # -SqlRows: the #719 read's seam (Get-SIRaTelemetryCounts)
|    # -WithScores: read the security scores (default: only in the hourly status report job, SI_ENGINE heartbeat -- an engine's
|    # end-of-run heartbeat never calls the score APIs); -GraphGet / -DefenderGet: their seams (Get-SISecurityScoreCounts)
|    param([scriptblock]$RunQuery, [datetime]$NowUtc = [datetime]::UtcNow, [scriptblock]$SqlScalar, [scriptblock]$RunHunting, [scriptblock]$Log, [scriptblock]$SqlRows,
|          [AllowNull()]$WithScores, [scriptblock]$GraphGet, [scriptblock]$DefenderGet)
|    if (-not $RunQuery) { $RunQuery = { param($Kql) Invoke-SITelemetryLaQuery -Query $Kql } }
|    $c = @{}
|    $s = Get-SISqlSpaceCounts -Scalar $SqlScalar
|    foreach ($k in @($s.Keys)) { $c[$k] = $s[$k] }
|    # #712: a collection newer than its source's last COMPLETE one (a collection in parts, still running) is never counted
|    $script:SICountCompleteBy = Get-SICountCompleteBy -SqlRows $SqlRows
|    try {
|        $rows = & $RunQuery (Get-SIIdentityCountQuery)
|        if ($null -ne $rows) {
|            $ic = Get-SIIdentityCounts -Row (@($rows) | Select-Object -First 1)
|            foreach ($k in @($ic.Keys)) { $c[$k] = $ic[$k] }
|        }
|    } catch { }
|    if ($c.ContainsKey('users')) {
|        # users' AD part (AD-only enabled user accounts from the Exposure Graph); unreadable = Entra only + one plain line
|        $ad = $null
|        try { $ad = Get-SIAdOnlyUserCount -RunHunting $RunHunting -RunQuery $RunQuery } catch { $ad = $null }
|        if ($null -ne $ad -and $null -ne $ad.Count) { $c['users'] = [long]$c['users'] + [long]$ad.Count }
|        else {
|            $why = if ($ad -and $ad.Reason) { $ad.Reason } else { 'the Exposure Graph could not be read' }
|            $line = (" [INFO] Today's status report counts Entra users only -- on-prem AD users are not included ({0})." -f $why)
|            try { if ($Log) { & $Log $line } else { Write-Host $line } } catch { }
|        }
|    }
|    $d =Get-SIDeviceCount -RunQuery $RunQuery -NowUtc $NowUtc
|    if ($null -ne $d) { $c['devices'] = $d }
|    try {
|        $inv = & $RunQuery (Get-SIInventoryCountQuery)
|        if ($null -ne $inv) { $ic = Get-SIInventoryCounts -Row (@($inv) | Select-Object -First 1); foreach ($k in @($ic.Keys)) { $c[$k] = $ic[$k] } }
|    } catch { }
|    try { $ra = Get-SIRaTelemetryCounts -SqlRows $SqlRows -Log $Log; foreach ($k in @($ra.Keys)) { $c[$k] = $ra[$k] } } catch { }
|    $scores = if ($null -ne $WithScores) { [bool]$WithScores } else { "$([Environment]::GetEnvironmentVariable('SI_ENGINE'))".Trim() -eq 'heartbeat' }
|    if ($scores) {
|        try { $sc = Get-SISecurityScoreCounts -GraphGet $GraphGet -DefenderGet $DefenderGet -NowUtc $NowUtc -Log $Log; foreach ($k in @($sc.Keys)) { $c[$k] = $sc[$k] } } catch { }
|    }
|    foreach ($k in @($c.Keys)) { if ((Get-SITelemetryCountNamesState) -notcontains $k) { $c.Remove($k) } }
|    $c
|}
'@ }
$__siSupportFiles['engine/_shared/SI-GraphRest.ps1'] = @{ Sha256 = 'c95ce8adf3e42b7095b8c257003e7aeccc3a806168b3db4fc551edfc6abf9701'; Text = @'
|#Requires -Version 5.1
|<#
|    THE GRAPH REST CLIENT FOR ENGINES MIGRATING OFF THE Microsoft.Graph SDK (#113).
|
|    🔑 WHY THIS EXISTS. Operator, 2026-09-08: *"do we need graph in image. can we use pure rest api"*.
|    Measured answer: no, and REST was already the house style -- the four asset-profiling engines use
|    ZERO `-Mg*` cmdlets, and every Graph call the remaining engines make already had a working REST
|    implementation somewhere in this solution. The SDK was carrying no capability, only a dependency:
|    enormous modules baked into every image for a handful of calls, a second auth path, and the
|    mixed-module-version hazard where a bundled `Azure.Core` poisons `Connect-MgGraph` and cmdlets
|    return SILENT NULLS.
|
|    🔒 AUTH IS NOT DUPLICATED HERE. Tokens come from `auth/Get-SIGraphToken.ps1`, the solution's one
|    token path (SPN secret or certificate, with its own cache). This file is transport only. Copying
|    auth logic is how two paths drift into disagreeing about which identity is in use.
|
|    📌 THERE IS AN OLDER PRIVATE COPY OF THIS PAGER, and it is deliberately left alone for now:
|    `engine/asset-profiling/shared/IdentityRoleFetcher.ps1` defines its own `Invoke-SIGraphPaged` +
|    `Get-SIGraphHttpStatus`. That engine is working, shipped and heavily tested; refactoring it in the
|    same change that migrates two OTHER engines would put unrelated blast radius into one commit.
|    ◻ Convergence is recorded as follow-up in `#113`. The behaviour here is modelled on that copy on
|    purpose, so converging later is a deletion rather than a reconciliation.
|
|    🔴 RETRY POLICY, and the distinction that matters most in this solution: TRANSIENT failures are
|    retried; PERMANENT ones propagate immediately. A platform failure retried is a few seconds lost; a
|    query defect retried burns a whole run and fails identically. That rule is `CLAUDE.md` working rule
|    4, and findings `#99` and `#106` are both cases of it being got wrong in the other direction --
|    a cancellation and a service-side resolution failure each reported as *"fix your query"*.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope (measured 2026-08-12), and the shipped
|# engines deliberately run without it.
|
|function New-SIGraphJsonBody {
|    <#
|        Serialise a request body to UTF-8 BYTES. Every POST in this file goes through here.
|
|        🔴 THIS EXISTS BECAUSE A STRING BODY IS SILENTLY CORRUPTED ON PS 5.1, WHICH IS THE SHELL
|        CUSTOMERS RUN. `Invoke-RestMethod -Body <string>` transcodes to a single-byte encoding, so
|        every non-ASCII character is destroyed before it reaches the wire. MEASURED against a local
|        HttpListener, capturing the actual received bytes:
|
|            payload, correct UTF-8 : 47 bytes
|            -Body <string>         : 35 bytes received, content mangled
|            -Body <utf8 bytes>     : 47 bytes received, byte-exact
|
|        🪤 IT FAILS AS A JSON ERROR, WHICH POINTS AT THE WRONG HALF. The service answers
|        `400 BadRequest -- "Unable to read JSON request payload. Please ensure Content-Type header is
|        set and payload is of valid JSON format."` The Content-Type *is* set and the JSON *was* valid
|        when built; the bytes were broken in transit. Risk Analysis then classified it as a QUERY
|        DEFECT and reported "re-running will fail identically" -- correct advice about the wrong cause.
|
|        🔑 WHY IT SURVIVED THE OFFLINE SUITE AND ONLY APPEARED ON A LIVE RUN. It needs a non-ASCII
|        character in the request. Plain KQL is ASCII; RA is the first caller to inline hundreds of real
|        device and user names into the query body, and this estate is Danish -- æ, ø and å in a
|        customer's own asset names are what broke it. No amount of offline testing would have produced
|        that byte.
|
|        📌 The charset must ALSO be declared on the Content-Type, or the service is entitled to guess.
|    #>
|    param(
|        [Parameter(Mandatory)]$Object,
|        [int]$Depth = 10
|    )
|    $json = ConvertTo-Json $Object -Depth $Depth -Compress
|    # 🪤 THE LEADING COMMA IS LOAD-BEARING. PowerShell UNROLLS an array on return, so without it the
|    # caller receives an Object[] of boxed bytes rather than a byte[] -- and Invoke-RestMethod then
|    # does not treat the body as raw bytes at all, which reintroduces the very corruption this
|    # function exists to prevent. Caught by `serialises to a byte array, not a string` before it
|    # shipped; the failure is otherwise invisible until a live call with a non-ASCII character.
|    # 📌 Note this is the OPPOSITE of the `,$x.ToArray()` trap warned about below: there the comma
|    # wraps an empty result into a phantom single element, here it stops a real array being scattered.
|    return ,[System.Text.Encoding]::UTF8.GetBytes($json)
|}
|
|function Invoke-SIGraphHttp {
|    <#
|        The transport. Returns status + body and NEVER throws on an HTTP status code.
|
|        🔴 THIS EXISTS BECAUSE `Invoke-RestMethod` THROWS ON EVERY NON-2xx, AND A THROWN ERROR IS
|        WRITTEN TO THE TRANSCRIPT EVEN WHEN IT IS CAUGHT. The first live run after the REST migration
|        took `PS>TerminatingError` lines from **2 to 16** -- the exact noise
|        `tests/pester/SI-TranscriptNoise.Tests.ps1` exists to prevent, and the operator's own
|        complaint: *"it looks very amateur"*. The SDK path avoided it with
|        `-ErrorAction SilentlyContinue`; there is no such switch for a REST client that throws by
|        design, so the transport has to stop throwing instead.
|
|        🪤 AND THE PROBE IS THE COMMON CASE, NOT THE RARE ONE. `Test-AdvancedHuntingHasTable` asks
|        whether a custom LA table is mirrored into XDR, and the ANSWER IS NORMALLY NO -- arriving as a
|        400. Every SI_*_Profile_CL table produces one, every run. That is a routing decision working
|        correctly, and it was being written to the transcript as a terminating error.
|
|        📌 `HttpClient` returns a response object for 4xx/5xx rather than raising, and it exists on
|        PS 5.1 (.NET 4.5+). It still throws on a genuine transport failure or timeout, which is
|        correct -- that is the TaskCanceled signal RA's bucket escalation depends on.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$Uri,
|        [Parameter(Mandatory)][string]$Token,
|        [ValidateSet('Get','Post')][string]$Method = 'Get',
|        [byte[]]$BodyBytes,
|        [string]$ContentType = 'application/json; charset=utf-8',
|        [int]$TimeoutSec = 300,
|        [hashtable]$ExtraHeaders
|    )
|
|    Add-Type -AssemblyName System.Net.Http -ErrorAction SilentlyContinue
|
|    $client = New-SIGraphHttpClient
|    try {
|        $client.Timeout = [TimeSpan]::FromSeconds($TimeoutSec)
|        $req = New-Object System.Net.Http.HttpRequestMessage(
|                    [System.Net.Http.HttpMethod]::$Method, $Uri)
|        [void]$req.Headers.TryAddWithoutValidation('Authorization', ('Bearer ' + $Token))
|        if ($ExtraHeaders) {
|            foreach ($k in $ExtraHeaders.Keys) { [void]$req.Headers.TryAddWithoutValidation([string]$k, [string]$ExtraHeaders[$k]) }
|        }
|        if ($BodyBytes) {
|            $content = New-Object System.Net.Http.ByteArrayContent(,$BodyBytes)
|            # Set on the CONTENT, not the request: charset lives with the payload it describes.
|            $content.Headers.Remove('Content-Type') | Out-Null
|            [void]$content.Headers.TryAddWithoutValidation('Content-Type', $ContentType)
|            $req.Content = $content
|        }
|
|        # PS 5.1 has no await, and this call is synchronous by design -- so the task is waited on here.
|        # 🔴 GetAwaiter().GetResult(), NEVER .Result. `.Result` is a PROPERTY GETTER, and PowerShell
|        # swallows an exception raised inside a getter: a timed-out request returned $null instead of
|        # throwing, reached the caller as "0 HTTP error", and RA's AutoBucket escalation -- which keys
|        # on the TaskCanceledException text -- never fired on the 900s ceiling. Measured on PS 5.1 and
|        # pwsh 7 (#117). A method call throws: MethodInvocationException wrapping TaskCanceledException,
|        # which the catch in Invoke-SIHuntingQueryRest already inspects (exception AND inner).
|        $resp = $client.SendAsync($req).GetAwaiter().GetResult()
|        $body = ''
|        if ($resp.Content) { $body = $resp.Content.ReadAsStringAsync().GetAwaiter().GetResult() }
|
|        return [pscustomobject]@{
|            StatusCode    = [int]$resp.StatusCode
|            Body          = $body
|            Ok            = $resp.IsSuccessStatusCode
|            RetryAfterSec = (Get-SIHttpRetryAfterSeconds -Response $resp)
|        }
|    } finally {
|        if ($client) { $client.Dispose() }
|    }
|}
|
|function New-SIGraphHttpClient {
|    <# One HttpClient for one request. $script:SIGraphHttpHandler is a seam for tests only (an HttpMessageHandler that
|       answers in-process); unset -- always, in a run -- it is the plain client. #>
|    Add-Type -AssemblyName System.Net.Http -ErrorAction SilentlyContinue
|    if ($null -ne $script:SIGraphHttpHandler) { return (New-Object System.Net.Http.HttpClient -ArgumentList $script:SIGraphHttpHandler, $false) }
|    New-Object System.Net.Http.HttpClient
|}
|
|function Get-SIHttpRetryAfterSeconds {
|    <# The seconds a 429 / 503 answer's Retry-After header asks for (a delay or a date); 0 when it says nothing. #>
|    param($Response)
|    try {
|        if ($null -eq $Response -or $null -eq $Response.Headers -or $null -eq $Response.Headers.RetryAfter) { return 0 }
|        $ra = $Response.Headers.RetryAfter
|        if ($null -ne $ra.Delta) { return [int][Math]::Ceiling($ra.Delta.TotalSeconds) }
|        if ($null -ne $ra.Date) { return [int][Math]::Max(0, [Math]::Ceiling(($ra.Date.UtcDateTime - [datetime]::UtcNow).TotalSeconds)) }
|    } catch { }
|    0
|}
|
|# ---- PARTS ASKED AHEAD (Risk Analysis: several query parts at a time) -----------------------------------------------
|# Risk Analysis asks its parts one by one and processes each (scoring, the database) before it asks the next. With
|# $script:SIHuntingPrefetch set (engine/risk-analysis/_shared/RA-PartsInParallel.ps1), the hunting request of a part
|# further ahead is SENT now and its answer waits here, keyed by the exact request body: when the part's turn comes, its
|# own call (Invoke-SIHuntingQueryRest, from the unchanged Invoke-GraphHuntingQuery) finds the answer instead of sending
|# the same request again. Everything else -- the retries, the error classification, the order the parts are processed
|# in -- is the one-at-a-time path, on the main thread. Only HttpClient runs in the background: no PowerShell code ever
|# runs on another thread, so no engine state is shared between threads. Unset (every other engine, and RA with
|# SI_RA_PartsInParallel_Max = 1): nothing here is used.
|# (functions, not file-level variables: the same text wherever a file is loaded from)
|function Get-SIHuntingAheadStartedText { 'the hunting request of this part was sent ahead -- its answer is read when the part runs' }
|function Get-SIHuntingNotAheadText { 'this part is not asked ahead -- it is not answered by advanced hunting' }
|
|function New-SIHuntingPrefetchStore {
|    [pscustomobject]@{
|        Capture = $false                                                                      # on while a part is being asked ahead
|        Entries = (New-Object 'System.Collections.Generic.Dictionary[string,object]' ([System.StringComparer]::Ordinal))
|        Answers = (New-Object System.Collections.Generic.List[object])                       # what each answer read here was like
|        Part    = -1                                                                          # the part being asked ahead
|    }
|}
|
|function Get-SIHuntingBodyKey {
|    <# PURE. The key of one request: the SHA-256 of its exact body bytes. #>
|    param([Parameter(Mandatory)][byte[]]$BodyBytes)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { [System.BitConverter]::ToString($sha.ComputeHash($BodyBytes)) -replace '-', '' } finally { $sha.Dispose() }
|}
|
|function Start-SIHuntingPrefetch {
|    <# Sends one hunting request now and keeps its pending answer in the store. Returns the request's key. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$Uri, [Parameter(Mandatory)][string]$Token, [Parameter(Mandatory)][byte[]]$BodyBytes, [int]$TimeoutSec = 900)
|    $key = Get-SIHuntingBodyKey -BodyBytes $BodyBytes
|    if ($Store.Entries.ContainsKey($key)) { return $key }     # the same request is already on its way
|    $client = New-SIGraphHttpClient
|    $client.Timeout = [TimeSpan]::FromSeconds($TimeoutSec)
|    $req = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Post, $Uri)
|    [void]$req.Headers.TryAddWithoutValidation('Authorization', ('Bearer ' + $Token))
|    $content = New-Object System.Net.Http.ByteArrayContent(, $BodyBytes)
|    $content.Headers.Remove('Content-Type') | Out-Null
|    [void]$content.Headers.TryAddWithoutValidation('Content-Type', 'application/json; charset=utf-8')
|    $req.Content = $content
|    # the default completion (ResponseContentRead): the task completes with the answer's body already read
|    $task = $client.SendAsync($req)
|    $Store.Entries[$key] = [pscustomobject]@{ Key = $key; Part = [int]$Store.Part; Task = $task; Client = $client; Request = $req; Watch = [System.Diagnostics.Stopwatch]::StartNew(); Peeked = $false }
|    $key
|}
|
|function Receive-SIHuntingPrefetch {
|    <# The answer of a request sent ahead, in the shape Invoke-SIGraphHttp returns -- waiting for it if it is still on its
|       way. A transport failure (the 900 s ceiling included) is thrown exactly as Invoke-SIGraphHttp throws it. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)]$Entry)
|    $wait = [System.Diagnostics.Stopwatch]::StartNew()
|    $status = 0; $ra = 0
|    try {
|        # GetAwaiter().GetResult(), never .Result (see Invoke-SIGraphHttp: a getter swallows the timeout)
|        $resp = $Entry.Task.GetAwaiter().GetResult()
|        $body = ''
|        if ($resp.Content) { $body = $resp.Content.ReadAsStringAsync().GetAwaiter().GetResult() }
|        $status = [int]$resp.StatusCode
|        $ra = Get-SIHttpRetryAfterSeconds -Response $resp
|        return [pscustomobject]@{ StatusCode = $status; Body = $body; Ok = $resp.IsSuccessStatusCode; RetryAfterSec = $ra }
|    } finally {
|        $wait.Stop()
|        $Store.Answers.Add([pscustomobject]@{ Part = [int]$Entry.Part; Status = $status; RetryAfterSec = $ra; WaitedSec = [double]$wait.Elapsed.TotalSeconds; Seconds = [double]$Entry.Watch.Elapsed.TotalSeconds; Peeked = [bool]$Entry.Peeked })
|        try { $Entry.Client.Dispose() } catch { }
|    }
|}
|
|function Remove-SIHuntingPrefetch {
|    <# Drops answers sent ahead that no part will read (the report ended, ran again with more parts, or a part's request
|       came out different): an answer still on its way is cancelled. Returns how many were dropped. #>
|    param($Store, [string]$Key)
|    if ($null -eq $Store) { return 0 }
|    $keys = if ($Key) { @($Key) } else { @($Store.Entries.Keys) }
|    $n = 0
|    foreach ($k in $keys) {
|        if (-not $Store.Entries.ContainsKey($k)) { continue }
|        $e = $Store.Entries[$k]; [void]$Store.Entries.Remove($k); $n++
|        try { $e.Client.CancelPendingRequests() } catch { }
|        try { $e.Client.Dispose() } catch { }
|    }
|    $n
|}
|
|function Get-SIHuntingPrefetchThrottle {
|    <# Looks at the answers sent ahead that have already come back, WITHOUT reading them for their part: the highest
|       Retry-After of a 429 / 503 / 504 among them (-1: none was throttled). Each answer is looked at once. #>
|    param($Store)
|    $worst = -1
|    if ($null -eq $Store) { return $worst }
|    foreach ($e in @($Store.Entries.Values)) {
|        if ($e.Peeked -or -not $e.Task.IsCompleted) { continue }
|        $e.Peeked = $true
|        if ($e.Task.Status -ne [System.Threading.Tasks.TaskStatus]::RanToCompletion) { continue }
|        $r = $e.Task.GetAwaiter().GetResult()
|        if ([int]$r.StatusCode -in 429, 503, 504) { $worst = [Math]::Max($worst, [int](Get-SIHttpRetryAfterSeconds -Response $r)) }
|    }
|    $worst
|}
|
|function Get-SIGraphRestStatus {
|    <#
|        Pull the HTTP status code out of an ErrorRecord across BOTH PowerShell editions.
|
|        🪤 PS 5.1 and PS 7 do not agree here, and getting it wrong silently disables the retry policy:
|        5.1 raises WebException with .Response.StatusCode, 7 raises HttpResponseException with
|        .Response.StatusCode as an enum. A miss returns 0, which this treats as transient (a network
|        reset produces no status at all), so a wrong read fails toward retrying rather than toward
|        declaring a permanent defect.
|    #>
|    param([Parameter(Mandatory)]$ErrorRecord)
|
|    $r = $ErrorRecord.Exception.Response
|    if ($null -eq $r) { return 0 }
|    try {
|        $code = $r.StatusCode
|        if ($null -eq $code) { return 0 }
|        return [int]$code
|    } catch { return 0 }
|}
|
|function Test-SIGraphRestTransient {
|    <#
|        429 throttle, 502/503/504 gateway, and 0 (no response at all -- a reset or timeout).
|
|        🔒 408 and 409 are NOT here. A request timeout and a conflict both mean "this specific call
|        will not succeed by repeating it unchanged", and quietly retrying them is how a run burns its
|        budget looking busy.
|    #>
|    param([int]$Status)
|    return ($Status -in 429, 502, 503, 504) -or ($Status -eq 0)
|}
|
|function Get-SIGraphRestRetryAfter {
|    <# #882 (A2): the wait Graph asks for (Retry-After: seconds or an HTTP date), read on both editions; $null when absent. #>
|    param([Parameter(Mandatory)][System.Management.Automation.ErrorRecord]$ErrorRecord)
|    try {
|        $resp = $ErrorRecord.Exception.Response
|        if (-not $resp) { return $null }
|        if ($resp.Headers -and $resp.Headers.PSObject.Properties['RetryAfter'] -and $null -ne $resp.Headers.RetryAfter) {
|            $t = $resp.Headers.RetryAfter
|            if ($null -ne $t.Delta) { return [int][Math]::Max(0, [Math]::Ceiling($t.Delta.TotalSeconds)) }
|            if ($null -ne $t.Date) { $d = [int][Math]::Ceiling(($t.Date.UtcDateTime - [datetime]::UtcNow).TotalSeconds); if ($d -gt 0) { return $d } }
|            return $null
|        }
|        $raw = $null; try { $raw = $resp.Headers['Retry-After'] } catch { $raw = $null }
|        $s = 0; if ($raw -and [int]::TryParse([string]$raw, [ref]$s)) { return [Math]::Max(0, $s) }
|    } catch { }
|    $null
|}
|
|function Invoke-SIGraphRest {
|    <#
|        One Graph call, with the transient-retry policy applied. GET, POST or PATCH.
|
|          -Uri        absolute, or a /v1.0-relative path ('/servicePrincipals?...')
|          -Token      from Get-SIGraphToken
|          -Method     Get (default) | Post | Patch (asset tagging writes custom security attributes)
|          -Body       hashtable, sent as JSON, POST / PATCH only
|          -TimeoutSec per-attempt ceiling
|
|        Returns the deserialised response object. Throws on permanent failure, after retries on
|        transient failure -- so a caller that gets a return value knows the call actually worked.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$Uri,
|        [Parameter(Mandatory)][string]$Token,
|        [ValidateSet('Get','Post','Patch')][string]$Method = 'Get',
|        [hashtable]$Body,
|        [int]$TimeoutSec = 300,
|        # #882 (A2): 6 attempts (was 3 in ~3 s -- data sync, asset tagging and the close-loop mail failed under ordinary
|        # Graph throttling), the wait Graph asks for (Retry-After) honoured, a 500 temporary for a read or a PATCH (never for
|        # a POST, which may not be safe to repeat), and an expired token renewed once
|        [int]$MaxAttempts = 6,
|        [string]$ApiVersion = 'v1.0',
|        # test seam: { param($Seconds) }
|        [scriptblock]$Sleep
|    )
|
|    $url = if ($Uri -match '^https?://') { $Uri } else { ('https://graph.microsoft.com/{0}{1}' -f $ApiVersion, $Uri) }
|    $headers = @{ Authorization = ('Bearer ' + $Token); 'ConsistencyLevel' = 'eventual' }
|    if (-not $Sleep) { $Sleep = { param($s) Start-Sleep -Seconds $s } }
|    $renewed = $false
|
|    $attempt = 0
|    while ($true) {
|        $attempt++
|        try {
|            $irmArgs = @{
|                Method      = $Method
|                Uri         = $url
|                Headers     = $headers
|                TimeoutSec  = $TimeoutSec
|                ErrorAction = 'Stop'
|            }
|            if ($Method -eq 'Post' -or $Method -eq 'Patch') {
|                # -Depth 10: the default of 2 silently truncates nested request bodies into the string
|                # "System.Collections.Hashtable", which the service rejects with a message about the
|                # payload rather than about the serialisation -- an error naming the wrong half.
|                # 🔴 UTF-8 BYTES, NOT A STRING -- see New-SIGraphJsonBody. A string body is silently
|                # transcoded to a single-byte encoding by PS 5.1 and every non-ASCII character is
|                # destroyed.
|                $irmArgs['Body']        = (New-SIGraphJsonBody -Object $Body -Depth 10)
|                $irmArgs['ContentType'] = 'application/json; charset=utf-8'
|            }
|            return Invoke-RestMethod @irmArgs
|        } catch {
|            $status = Get-SIGraphRestStatus -ErrorRecord $_
|            if ($status -eq 401 -and -not $renewed -and $url -match '^https://graph\.microsoft\.com/' -and (Get-Command -Name Get-SIGraphToken -ErrorAction SilentlyContinue)) {
|                $renewed = $true; $attempt--
|                $tk = $null; try { $tk = [string](Get-SIGraphToken -Resource Graph -ForceRefresh) } catch { $tk = $null }
|                if ($tk) { $headers['Authorization'] = 'Bearer ' + $tk; continue }
|            }
|            $temp = (Test-SIGraphRestTransient -Status $status) -or ($status -eq 500 -and $Method -ne 'Post')
|            if (-not $temp -or $attempt -ge $MaxAttempts) { throw }
|            $delay = Get-SIGraphRestRetryAfter -ErrorRecord $_
|            if ($null -eq $delay) { $delay = [int][Math]::Min(60, [Math]::Pow(2, $attempt)) }   # 2, 4, 8, 16, 32 s
|            Write-Verbose ('Graph transient error (HTTP {0}) on {1} -- retry {2}/{3} in {4}s' -f $status, $url, $attempt, $MaxAttempts, $delay)
|            & $Sleep $delay
|        }
|    }
|}
|
|function Invoke-SIGraphRestPaged {
|    <#
|        GET with `@odata.nextLink` paging. Returns the combined `.value` array.
|
|        🪤 RETURNS A REAL ARRAY, ALWAYS. `,$list.ToArray()` is the shape that has defeated guards in
|        this codebase repeatedly -- with zero results a `@(...)` wrapper yields an array CONTAINING an
|        empty array, so `.Count` reads 1 and "nothing found" becomes "found one thing". Emitting the
|        ArrayList's ToArray() directly keeps an empty result empty.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$RelativeUrl,
|        [Parameter(Mandatory)][string]$Token,
|        [int]$TimeoutSec = 300,
|        [string]$ApiVersion = 'v1.0'
|    )
|
|    $all = New-Object System.Collections.ArrayList
|    $url = $RelativeUrl
|    while ($url) {
|        $resp = Invoke-SIGraphRest -Uri $url -Token $Token -Method Get -TimeoutSec $TimeoutSec -ApiVersion $ApiVersion
|        if ($null -ne $resp -and $resp.PSObject.Properties['value'] -and $null -ne $resp.value) {
|            foreach ($item in @($resp.value)) { [void]$all.Add($item) }
|        }
|        # The nextLink is absolute and already carries the query + skiptoken.
|        $url = if ($resp -and $resp.PSObject.Properties['@odata.nextLink']) { [string]$resp.'@odata.nextLink' } else { $null }
|    }
|    return $all.ToArray()
|}
|
|function Invoke-SIHuntingQueryRest {
|    <#
|        Advanced Hunting over REST -- the replacement for `Start-MgBetaSecurityHuntingQuery` (#113b).
|
|        🔑 IT IS THE SAME ENDPOINT THE SDK CALLED. `POST /security/runHuntingQuery`, which
|        `engine/asset-profiling/shared/HuntingQuery.ps1:136` has been calling directly all along, and
|        which Risk Analysis' own comments name while debugging the nginx in front of it
|        (`RA-GraphHunting.ps1:593,659`). The SDK was a wrapper over this URL, not a capability.
|
|        🔒 THIS RETURNS THE SDK'S RESPONSE SHAPE ON PURPOSE, and that is the whole design of the port.
|        `Invoke-RiskAnalysis.ps1` reads `$resp.Results.AdditionalProperties` in FOUR places, and
|        `RA-ExcelReport.ps1` documents that bag as the row source. Returning raw Graph JSON would have
|        meant changing every one of those and the tests around them. Emitting
|        `Results[].AdditionalProperties` confines the change to the transport, so nothing downstream
|        moves.
|
|        🔴 NO RETRY HERE, DELIBERATELY, AND IT IS NOT AN OVERSIGHT. `Invoke-SIGraphRest` retries
|        429/502/503/504 -- correct for ordinary reads, WRONG for hunting. Risk Analysis records why:
|        a 502 from the nginx in front of the AH backend is the deterministic "response too large to
|        proxy" signal, and "retrying the identical query just burns 4 more attempts (each up to 900s)
|        on the same fail". The bucket-escalation loop OWNS retry for this call; a second retry policy
|        underneath it would silently multiply a 15-minute failure by four.
|
|        🪤 THE TWO ERROR SIGNALS MUST SURVIVE THE TRANSPORT CHANGE, or AutoBucket escalation stops and
|        nothing says so. Downstream classification matches on TEXT:
|          * the 900s ceiling must still read as `TaskCanceledException` -- under the SDK it arrived as
|            that type; over REST a client timeout is a WebException on 5.1 and a TaskCanceled/
|            HttpRequestException on 7, so it is NORMALISED to text containing 'TaskCanceledException'.
|          * a 502 must still read as `502 Bad Gateway`. Invoke-RestMethod's own message is
|            "(502) Bad Gateway" -- parenthesised -- which does NOT match the existing
|            `-match '502 Bad Gateway'`. The status line is therefore composed explicitly.
|        Getting either wrong does not throw; it silently stops the ramp on exactly the reports that
|        need it, which is the failure this comment exists to prevent.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$Query,
|        [Parameter(Mandatory)][string]$Token,
|        [int]$TimeoutSec  = 900,          # matches the old Set-MgRequestContext -ClientTimeout 900
|        [string]$ApiVersion = 'beta',     # the SDK cmdlet was the BETA one; endpoint kept identical
|
|        # 🔒 Return a result object instead of throwing. Used by the advanced-hunting PROBE, whose
|        # expected answer is a 400 -- once per SI_*_Profile_CL table, every run. See the comment at
|        # the throw site: this is what keeps a working routing decision out of the transcript.
|        [switch]$AsResult
|    )
|
|    $url  = ('https://graph.microsoft.com/{0}/security/runHuntingQuery' -f $ApiVersion)
|    # 🔴 UTF-8 BYTES. RA inlines real device and user names into the query, so this body carries
|    # customer data, not just KQL -- and on PS 5.1 a STRING body loses every non-ASCII character.
|    # That is not theoretical: it is what a live run produced on 2026-09-08, as 400 BadRequest
|    # "Unable to read JSON request payload" on 18 buckets. See New-SIGraphJsonBody.
|    $body = New-SIGraphJsonBody -Object @{ Query = $Query } -Depth 5
|
|    $errText = $null
|    $http    = $null
|    # PARTS ASKED AHEAD (see Start-SIHuntingPrefetch): while a part is asked ahead its request is sent now and left on its
|    # way; when the part runs, its own request finds that answer. The probe (-AsResult) is never asked ahead.
|    $__pf = $null
|    if (-not $AsResult -and $null -ne $script:SIHuntingPrefetch) {
|        if ($script:SIHuntingPrefetch.Capture) {
|            $null = Start-SIHuntingPrefetch -Store $script:SIHuntingPrefetch -Uri $url -Token $Token -BodyBytes $body -TimeoutSec $TimeoutSec
|            throw (Get-SIHuntingAheadStartedText)
|        }
|        if ($script:SIHuntingPrefetch.Entries.Count -gt 0) {
|            $__pfKey = Get-SIHuntingBodyKey -BodyBytes $body
|            if ($script:SIHuntingPrefetch.Entries.ContainsKey($__pfKey)) { $__pf = $script:SIHuntingPrefetch.Entries[$__pfKey]; [void]$script:SIHuntingPrefetch.Entries.Remove($__pfKey) }
|        }
|    }
|    # a request sent here and now while parts are asked ahead is measured too (the engine waited for all of it): how quickly
|    # Defender answers -- and whether it throttles -- is learned from every answer, not only from the parts asked ahead
|    $__direct = if ($null -eq $__pf -and -not $AsResult -and $null -ne $script:SIHuntingPrefetch) { [System.Diagnostics.Stopwatch]::StartNew() } else { $null }
|    try {
|        $http = if ($null -ne $__pf) { Receive-SIHuntingPrefetch -Store $script:SIHuntingPrefetch -Entry $__pf }
|                else { Invoke-SIGraphHttp -Uri $url -Token $Token -Method Post -BodyBytes $body -TimeoutSec $TimeoutSec }
|        if ($null -ne $__direct) {
|            $__direct.Stop()
|            $script:SIHuntingPrefetch.Answers.Add([pscustomobject]@{ Part = -1; Status = [int]$http.StatusCode; RetryAfterSec = [int]$http.RetryAfterSec; WaitedSec = [double]$__direct.Elapsed.TotalSeconds; Seconds = [double]$__direct.Elapsed.TotalSeconds; Peeked = $false })
|        }
|    } catch {
|        # Only a genuine TRANSPORT failure reaches here now -- HTTP status codes come back as data.
|        # A timeout arrives as TaskCanceledException wrapped in the MethodInvocationException that
|        # GetResult() raises through PowerShell, so both the exception and its inner are inspected.
|        $ex = $_.Exception
|        $inner = $ex.InnerException
|        $isTimeout = ($ex -is [System.Threading.Tasks.TaskCanceledException]) -or
|                     ($inner -is [System.Threading.Tasks.TaskCanceledException]) -or
|                     ($ex -is [System.Net.WebException] -and $ex.Status -eq [System.Net.WebExceptionStatus]::Timeout) -or
|                     ($ex.Message -match 'timed out' -or $ex.Message -match 'canceled' -or $ex.Message -match 'cancelled')
|        if ($isTimeout) {
|            $errText = ("TaskCanceledException: the request was canceled due to the configured timeout of {0} seconds elapsing." -f $TimeoutSec)
|        } else {
|            $errText = [string]$ex.Message
|        }
|    }
|
|    if (-not $errText -and $http -and -not $http.Ok) {
|        # ---- compose the status line the classifiers already match on -------------------------------
|        # 🪤 The BODY is appended because the AH backend puts the real reason there -- including the
|        # "Query cancelled on creation" text that #99/#106 turn on, and the "Failed to resolve table"
|        # text the advanced-hunting probe reads. The status line alone does not carry it.
|        $reason = switch ($http.StatusCode) {
|            502 { 'Bad Gateway' }
|            503 { 'Service Unavailable' }
|            504 { 'Gateway Timeout' }
|            413 { 'Request Entity Too Large' }
|            429 { 'Too Many Requests' }
|            400 { 'Bad Request' }
|            default { 'HTTP error' }
|        }
|        # the service's Retry-After, when it sent one, in the words Get-RABucketRetryDelaySeconds reads
|        $__ra = if ($http.PSObject.Properties['RetryAfterSec'] -and [int]$http.RetryAfterSec -gt 0) { (' (retry-after {0}s)' -f [int]$http.RetryAfterSec) } else { '' }
|        $errText = ("{0} {1} -- {2}" -f $http.StatusCode, ($reason + $__ra), $http.Body)
|    }
|
|    if ($errText) {
|        # 🔒 -AsResult IS WHAT KEEPS THE TRANSCRIPT CLEAN, and it is not a convenience. The
|        # advanced-hunting PROBE asks whether a custom LA table is mirrored into XDR and the answer is
|        # normally NO, arriving as a 400 -- once per SI_*_Profile_CL table, every run. Throwing there
|        # writes a terminating error to the transcript for a routing decision that worked perfectly.
|        # The QUERY path still throws, because RA's bucket-escalation loop is built around catching it.
|        if ($AsResult) { return [pscustomobject]@{ Ok = $false; Error = $errText; Results = @(); Schema = $null } }
|        throw $errText
|    }
|
|    $resp = $null
|    if ($http -and $http.Body) {
|        try { $resp = $http.Body | ConvertFrom-Json } catch {
|            $msg = ('advanced hunting returned a body that is not JSON: {0}' -f $_.Exception.Message)
|            if ($AsResult) { return [pscustomobject]@{ Ok = $false; Error = $msg; Results = @(); Schema = $null } }
|            throw $msg
|        }
|    }
|
|    # ---- adapt to the SDK's shape ------------------------------------------------------------------
|    # Each row becomes an object carrying an AdditionalProperties dictionary, because that is exactly
|    # what `Results[].AdditionalProperties` broadcasts over downstream.
|    $rows = New-Object System.Collections.ArrayList
|    if ($null -ne $resp -and $resp.PSObject.Properties['results'] -and $null -ne $resp.results) {
|        foreach ($r in @($resp.results)) {
|            $bag = [ordered]@{}
|            foreach ($p in $r.PSObject.Properties) { $bag[$p.Name] = $p.Value }
|            [void]$rows.Add([pscustomobject]@{ AdditionalProperties = $bag })
|        }
|    }
|    $schema = if ($resp -and $resp.PSObject.Properties['schema']) { $resp.schema } else { $null }
|    # 📌 Ok/Error are present on the SUCCESS shape too, so an -AsResult caller can test one property
|    # either way rather than distinguishing two different object shapes.
|    return [pscustomobject]@{ Schema = $schema; Results = $rows.ToArray(); Ok = $true; Error = $null }
|}
'@ }
$__siSupportFiles['auth/Get-SIGraphToken.ps1'] = @{ Sha256 = 'c4992331c6c2dcef693fdea79948cdc75c0f1b6d728b22cf0ce95bc3713225bb'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight v2.2 -- Microsoft Graph / MDE / Defender token helper.
|
|    Three paths, tried in order:
|      1. User Assigned Managed Identity (production / Container App Job)
|         -- when $env:IDENTITY_ENDPOINT and $env:IDENTITY_HEADER are set
|         (Container Apps injects these), we hit the local IMDS endpoint
|         to mint a token. No secrets, no rotation overhead.
|      2. SPN with secret (production / dev VM)
|         -- pulls from $global:SI_Graph_AppId + $global:SI_Graph_TenantId
|         + $global:SI_Graph_Secret. Uses the v2 token endpoint directly.
|      3. The run's own sign-in (last resort)
|         -- Get-SIAzAccessToken, over REST (no PowerShell module).
|
|    Bootstrap-Auth.ps1 populates the SI_Graph_* globals from the customer's
|    Key Vault (Modern-ApplicationId-O365 / Modern-Secret-O365).
|    Bootstrap-ContainerAppJob.ps1 -UseManagedIdentity assigns ONE user-assigned
|    identity to every engine job (#209); the container entry point then sets
|    $global:SI_UseManagedIdentity + SI_UAMI_ClientId and this helper takes the
|    identity endpoint (auth/SI-ManagedIdentity.ps1) before anything else.
|
|    Tokens are cached for 50 minutes (Graph token TTL is 60-90 minutes;
|    50-minute cache leaves a safety margin).
|#>
|
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot '../engine/_shared/SI-AzRest.ps1') }
|
|if (-not (Get-Variable -Name SIGraphTokenCache -Scope Script -ErrorAction SilentlyContinue)) {
|    $script:SIGraphTokenCache = @{}    # resourceUrl -> @{ Token; ExpiresAt }
|}
|
|function Get-SIGraphToken {
|    [CmdletBinding()]
|    param(
|        [ValidateSet('Graph','MDE','Defender','SentinelDataLake')]
|        [string]$Resource = 'Graph',
|
|        [switch]$ForceRefresh
|    )
|
|    $resourceUrl = switch ($Resource) {
|        'Graph'            { 'https://graph.microsoft.com' }
|        'MDE'              { 'https://api.security.microsoft.com' }
|        'Defender'         { 'https://api.securitycenter.microsoft.com' }
|        'SentinelDataLake' { 'https://api.securityplatform.microsoft.com' }
|    }
|
|    # The cache is created HERE, not only when this file loads: `$script:` is the scope of the SCRIPT that is running, and
|    # a script started from another one (the data health check, started by the verification engine) has its own -- this
|    # function is visible there, the file-level cache is not. Measured live 2026-10-15 (the first data health run): "You
|    # cannot call a method on a null-valued expression" on every Graph and Defender read. (auth\SI-ManagedIdentity.ps1
|    # has the same guard for the same reason.)
|    if ($null -eq $script:SIGraphTokenCache) { $script:SIGraphTokenCache = @{} }
|    if (-not $ForceRefresh -and $script:SIGraphTokenCache.ContainsKey($resourceUrl)) {
|        $cached = $script:SIGraphTokenCache[$resourceUrl]
|        if ($cached.ExpiresAt -gt [datetime]::UtcNow) {
|            return $cached.Token
|        }
|    }
|
|    # #209/#222 -- the MANAGED IDENTITY, first, and ONLY when the run's one switch is on ($global:SI_UseManagedIdentity,
|    # set by the container entry point, or on a VM by the sign-in decision in the config loader). The client id is
|    # optional; auth/SI-ManagedIdentity.ps1 picks the host's endpoint (container, Azure VM, Azure Arc server). When the
|    # helper is not loaded, Test-SIUseManagedIdentity does not exist and nothing below this block changes.
|    if ((Get-Command -Name Test-SIUseManagedIdentity -ErrorAction SilentlyContinue) -and (Test-SIUseManagedIdentity)) {
|        # The data lake's resource is its app id (see the SPN branch below for why).
|        $miResource = if ($Resource -eq 'SentinelDataLake') { '4500ebfb-89b6-4b14-a480-7f749797bfcd' } else { $resourceUrl }
|        $tokenStr = Get-SIManagedIdentityToken -Resource $miResource -ForceRefresh:$ForceRefresh
|        $script:SIGraphTokenCache[$resourceUrl] = @{ Token = $tokenStr; ExpiresAt = [datetime]::UtcNow.AddMinutes(30) }
|        return $tokenStr
|    }
|
|    # SPN-secret is the primary path. Read SI_SPN_* (new names)
|    # with backwards-compat fallback to SI_Graph_*.
|    # UAMI/IMDS is now opt-in (only when $global:SI_PreferUami = $true) --
|    # SPN replication across tenants is more flexible than UAMI.
|    $spnAppId    = if ($global:SI_SPN_AppId)    { $global:SI_SPN_AppId }    else { $global:SI_Graph_AppId }
|    $spnSecret   = if ($global:SI_SPN_Secret)   { $global:SI_SPN_Secret }   else { $global:SI_Graph_Secret }
|    $spnTenantId = if ($global:SI_SPN_TenantId) { $global:SI_SPN_TenantId } else { $global:SI_Graph_TenantId }
|
|    # Certificate, resolved the same way every other SI engine resolves it. Also accept the
|    # AutomationFramework's HighPriv_* name, because on an internal install that is the ONLY place the
|    # thumbprint exists -- which is exactly how a cert customer ended up with no first-class token path.
|    $spnCertThumb = if ($global:SI_SPN_CertThumbprint) { [string]$global:SI_SPN_CertThumbprint }
|                    else { [string]$global:HighPriv_Modern_CertificateThumbprint_Azure }
|
|    # SPN with secret (PRIMARY path ).
|    if ($spnAppId -and $spnSecret -and $spnTenantId) {
|        # SentinelDataLake's resource principal isn't registered under a URI in
|        # most tenants -- AADSTS500011 if you ask for the URL. Microsoft docs the
|        # data-lake service principal as the GUID below; use it as the v2 scope
|        # identifier. Other resources still resolve fine via their URL.
|        $scope = if ($Resource -eq 'SentinelDataLake') {
|                     '4500ebfb-89b6-4b14-a480-7f749797bfcd/.default'
|                 } else {
|                     ($resourceUrl + '/.default')
|                 }
|        $body = @{
|            client_id     = $spnAppId
|            scope         = $scope
|            client_secret = $spnSecret
|            grant_type    = 'client_credentials'
|        }
|        $resp = Invoke-RestMethod -Method Post `
|            -Uri ('https://login.microsoftonline.com/{0}/oauth2/v2.0/token' -f $spnTenantId) `
|            -Body $body -ContentType 'application/x-www-form-urlencoded'
|        $tokenStr = $resp.access_token
|        $expiresAt = [datetime]::UtcNow.AddSeconds(($resp.expires_in - 600))
|    }
|    elseif ($spnAppId -and $spnCertThumb -and $spnTenantId) {
|        # SPN with CERTIFICATE -- first-class, same client_credentials grant as the secret path above,
|        # signed with a JWT client assertion instead of a shared secret.
|        #
|        # WHY THIS EXISTS. Before this, a certificate-authenticated customer had no SPN path at all: the
|        # secret branch was skipped (no secret) and the run fell through to the interactive-Az fallback,
|        # which failed with the opaque "ClientCertificateCredential authentication failed:" -- no AADSTS
|        # code, no scope, nothing to act on. Observed live on a customer whose Sentinel data lake route
|        # died on that line, which then forced every RA query onto advanced hunting, the one path that
|        # HAS a 900s ceiling.
|        #
|        # NOTE ON SCOPE, so this is not misread: making the certificate path first-class does not by
|        # itself grant the SPN anything. If the app registration is not consented for the resource, this
|        # branch now returns a real AADSTS error naming the missing grant, instead of the opaque
|        # credential failure above. Diagnosable rather than silent -- that is the improvement.
|        $scope = if ($Resource -eq 'SentinelDataLake') {
|                     '4500ebfb-89b6-4b14-a480-7f749797bfcd/.default'
|                 } else {
|                     ($resourceUrl + '/.default')
|                 }
|
|        $clean = ($spnCertThumb -replace '\s','').ToUpperInvariant()
|        $cert  = $null
|
|        # 🔴 THE `Cert:` PROVIDER IS THE CONVENIENCE; `X509Store` IS THE AUTHORITY. This is framework
|        # finding AUTH-1, and until 2026-08-31 this function only used the provider.
|        #
|        # 🪤 THE PROVIDER IS NOT ALWAYS THERE. A Windows PowerShell 5.1 child that inherits a pwsh 7
|        # parent's PSModulePath resolves Microsoft.PowerShell.Security to the PS7 build, fails to load
|        # it, and LOSES THE `Cert:` DRIVE WITH IT -- so `Get-ChildItem Cert:\LocalMachine\My` returns
|        # nothing for a certificate that is installed, readable and has a private key. The failure then
|        # reads as "the certificate is missing", which sends someone to re-issue a certificate that was
|        # never gone.
|        #
|        # 📌 MEASURED HERE 2026-08-31: the identity profiler failed with
|        # `certificate '78E4…' was not found with a private key`, while the SAME thumbprint resolved
|        # via BOTH paths from a directly-invoked shell in the same session. The difference was only how
|        # the process was launched. `SI-ObjectLedgerStore.ps1` already carried this workaround; the auth
|        # path every engine depends on did not.
|        foreach ($store in 'LocalMachine','CurrentUser') {
|            if (Get-PSDrive -Name Cert -ErrorAction SilentlyContinue) {
|                $cert = Get-ChildItem "Cert:\$store\My" -ErrorAction SilentlyContinue |
|                        Where-Object { $_.Thumbprint -eq $clean -and $_.HasPrivateKey } |
|                        Select-Object -First 1
|            }
|            if (-not $cert) {
|                try {
|                    $x = New-Object System.Security.Cryptography.X509Certificates.X509Store('My', $store)
|                    $x.Open('ReadOnly')
|                    $cert = @($x.Certificates | Where-Object { $_.Thumbprint -eq $clean -and $_.HasPrivateKey })[0]
|                    $x.Close()
|                } catch { }
|            }
|            if ($cert) { break }
|        }
|        if (-not $cert) {
|            # 🪤 THE MESSAGE USED TO PRINT THE LITERAL `{0}`, AND THAT COST A DIAGNOSIS.
|            # `"A" + "B" -f $x` parses as `"A" + ("B" -f $x)`, so the placeholder in the FIRST literal
|            # was never substituted and the error named no thumbprint at all -- on the one failure
|            # whose entire question is "which thumbprint?". Parenthesise the concatenation before -f.
|            # 🔑 And distinguish the case that actually bit: an EMPTY thumbprint is not a missing
|            # certificate, it is a missing CONFIGURATION, and sending someone to the certificate store
|            # to look for '' wastes the trip.
|            if ([string]::IsNullOrWhiteSpace($clean)) {
|                throw ("Get-SIGraphToken: no certificate thumbprint is configured, so there is nothing to look for. " +
|                       "On the internal-vm flavour this comes from Connect-Platform / Initialize-PlatformAutomationFramework " +
|                       "(HighPriv_Modern_CertificateThumbprint_Azure); on community installs from " +
|                       "config\SecurityInsight.custom.ps1 (SI_SPN_CertThumbprint). Running an engine standalone, " +
|                       "without the platform connect, reaches here.")
|            }
|            throw (("Get-SIGraphToken: certificate '{0}' was not found with a private key in LocalMachine\My or CurrentUser\My. " +
|                    "Note that a sandboxed or restricted-profile shell can report BOTH stores as empty.") -f $clean)
|        }
|
|        $tokenUri = 'https://login.microsoftonline.com/{0}/oauth2/v2.0/token' -f $spnTenantId
|        $now      = [DateTimeOffset]::UtcNow.ToUnixTimeSeconds()
|
|        # base64url, per RFC 7515: standard base64 with +/ swapped for -_ and the padding stripped.
|        $b64url = {
|            param([byte[]]$Bytes)
|            [Convert]::ToBase64String($Bytes).TrimEnd('=').Replace('+','-').Replace('/','_')
|        }
|
|        # x5t is the cert's SHA-1 thumbprint as base64url BYTES -- not the hex string. Passing the hex
|        # yields AADSTS700027 with no hint that the encoding is what is wrong.
|        $x5t = & $b64url $cert.GetCertHash()
|
|        $header = @{ alg = 'RS256'; typ = 'JWT'; x5t = $x5t } | ConvertTo-Json -Compress
|        # aud/iss/sub/jti/nbf/exp per the client-assertion spec. 10-minute life: the assertion is used
|        # once, immediately, so a short window costs nothing and limits replay.
|        $claims = @{
|            aud = $tokenUri
|            iss = $spnAppId
|            sub = $spnAppId
|            jti = [guid]::NewGuid().ToString()
|            nbf = $now
|            exp = $now + 600
|        } | ConvertTo-Json -Compress
|
|        $enc         = [System.Text.Encoding]::UTF8
|        $signingInput = ('{0}.{1}' -f (& $b64url $enc.GetBytes($header)), (& $b64url $enc.GetBytes($claims)))
|
|        # GetRSAPrivateKey (not the legacy .PrivateKey property): CNG-stored keys return $null from
|        # .PrivateKey on PS 5.1, and most modern certs are CNG. Do NOT reach for ImportFromPem here --
|        # it is .NET Core 3.0+ / PS 7 only and these engines run on Windows PowerShell 5.1.
|        $rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
|        if (-not $rsa) {
|            throw (("Get-SIGraphToken: certificate '{0}' has no usable RSA private key (GetRSAPrivateKey returned null). " +
|                    "If the key is CNG-stored, confirm this account has read access to it.") -f $clean)
|        }
|        $sig = $rsa.SignData($enc.GetBytes($signingInput),
|                             [System.Security.Cryptography.HashAlgorithmName]::SHA256,
|                             [System.Security.Cryptography.RSASignaturePadding]::Pkcs1)
|        $assertion = '{0}.{1}' -f $signingInput, (& $b64url $sig)
|
|        $body = @{
|            client_id             = $spnAppId
|            scope                 = $scope
|            client_assertion_type = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
|            client_assertion      = $assertion
|            grant_type            = 'client_credentials'
|        }
|        $resp = Invoke-RestMethod -Method Post -Uri $tokenUri -Body $body -ContentType 'application/x-www-form-urlencoded'
|        $tokenStr  = $resp.access_token
|        $expiresAt = [datetime]::UtcNow.AddSeconds(($resp.expires_in - 600))
|    }
|    else {
|        # Last resort -- the run's own sign-in, over REST.
|        $azTok = Get-SIAzAccessToken -ResourceUrl $resourceUrl
|        if ($azTok.Token -is [System.Security.SecureString]) {
|            $tokenStr = [System.Net.NetworkCredential]::new('', $azTok.Token).Password
|        } else {
|            $tokenStr = $azTok.Token
|        }
|        # Cache until the token's OWN expiry less a margin. A flat 50 minutes outlived tokens a
|        # token cache handed back part-used (e.g. 10 minutes left), and every call for the next ~40
|        # minutes then sent an expired token.
|        $expiresAt = [datetime]::UtcNow.AddMinutes(50)
|        try {
|            if ($azTok.ExpiresOn) {
|                $tokExp = ([DateTimeOffset]$azTok.ExpiresOn).UtcDateTime.AddMinutes(-5)
|                if ($tokExp -lt $expiresAt) { $expiresAt = $tokExp }
|            }
|        } catch {}
|    }
|
|    $script:SIGraphTokenCache[$resourceUrl] = @{
|        Token     = $tokenStr
|        ExpiresAt = $expiresAt
|    }
|    return $tokenStr
|}
'@ }
$__siSupportFiles['engine/_shared/SI-GuardStrict.ps1'] = @{ Sha256 = '616e34c03123322f8bef8d6700169ef37f1224bd91a746b7a37e585bec405a05'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- STRICTER SAFETY CHECKS FOR 24 HOURS AFTER A RELEASE THAT CHANGED ENGINE CODE (CR4, SI #654; framework
|    DOCS/REQUIREMENTS.md §12.11b GUARD-STRICT; approved by the owner 2026-10-14).
|
|    THE TRIGGER -- the engine fingerprint. The updater computes a SHA-256 fingerprint over the engine folders of the release
|    it has just installed (Get-SIEngineFingerprint: engine/, launcher/, risk-analysis-detection/ -- the same folders the
|    publish call judges `engineChanged` by) and records it in the Pro database (cfg.InstallState 'EngineFingerprint'). A
|    fingerprint that DIFFERS from the one recorded starts the stricter period; the same fingerprint (a template / text /
|    web-only release) keeps it as it is. The FIRST fingerprint an install records starts nothing: an install that never
|    recorded one (every install before this) behaves exactly as before -- no stricter period is invented.
|
|    THE RULE -- every numbered damage brake (the limit a customer configures) is halved while the period lasts:
|    effective = max(1, floor(configured x 0.5)), never above the configured value (a limit of 1 stays 1; 0 = "no limit"
|    stays 0). Never lower than a limit a SuperAdmin approved for one run. The brakes (Resolve-SIGuardLimit at each one):
|      vuln.connector.close-ceiling       SI_VulnSync_MaxClosePercent, SI_VulnSync_MaxCloseAbsolute
|      asset.properties.collection-change SI_AssetProperties_ChangeGuardPercent
|      cmdb.handoff.mass-change           the hand-off connector's changeGuardPercent (default the same setting)
|      collection.source.asset-drop       SI_Pro_DataQuality_AssetDropPercent
|      exemption.bulk.refused             SIWeb_Exemption_BulkMax (the web app, Guards\GuardMode.cs)
|
|    THE PERIOD -- 24 hours from the time the updater recorded the changed fingerprint. A SuperAdmin may end it early with
|    a reason (the web app, Operations > Guards (safety checks); audited guard.strict.end-early) -- cfg.InstallState 'GuardStrictEnd'.
|
|    A STRICT TRIP is a normal trip: it holds as always and mails when its check mails (a check the catalog marks "mail": "never" does not); its numbers say the limit is halved, worded calmly
|    ("stricter period after release X until <time>"), and its report to Invardia carries Strict, ConfiguredLimit and
|    EffectiveLimit. The identified heartbeat carries guardMode { mode, until, startedBy, version, endedEarlyAt, endedBy }.
|
|    NEVER THROWS where a job calls it: anything that cannot be read means Normal (the limits as configured -- as today).
|    PS 5.1 and 7.
|#>
|
|function Get-SIGuardStrictState {
|    <# The value of $script:SIGuardStrict, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIGuardStrict) { $script:SIGuardStrict = @{
|    Hours          = 24
|    Folders        = @('engine', 'launcher', 'risk-analysis-detection')
|    FingerprintRow = 'EngineFingerprint'
|    EndRow         = 'GuardStrictEnd'
|    CacheMinutes   = 5
|} }
|    , $script:SIGuardStrict
|}
|$script:SIGuardStrict = $null; $null = Get-SIGuardStrictState
|
|# =====================================================================================================================
|#  The engine fingerprint -- deterministic
|# =====================================================================================================================
|function Get-SIEngineFingerprintFolders {
|    <# PURE. The engine folders (relative to the solution root), the same as the publish call's Get-SIEngineFolders. #>
|    @((Get-SIGuardStrictState).Folders)
|}
|
|function Get-SIEngineFingerprint {
|    <#
|        The engine fingerprint of the code under -SIRoot: SHA-256 (lower-case hex) over one line pair per file of the engine
|        folders -- "<path>`n<sha256 of the file's bytes>`n" -- with <path> relative to -SIRoot, '/' as separator, the list
|        sorted ordinally. The same files give the same fingerprint on every machine; a renamed, added, removed or changed
|        file gives another. '' when no engine folder exists under -SIRoot (nothing to judge).
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $root = [System.IO.Path]::GetFullPath($SIRoot)
|    $files = New-Object System.Collections.Generic.List[object]
|    foreach ($f in (Get-SIEngineFingerprintFolders)) {
|        $dir = [System.IO.Path]::Combine($root, $f)
|        if (-not [System.IO.Directory]::Exists($dir)) { continue }
|        foreach ($p in [System.IO.Directory]::GetFiles($dir, '*', [System.IO.SearchOption]::AllDirectories)) {
|            $rel = $p.Substring($root.Length).TrimStart('\', '/') -replace '\\', '/'
|            $files.Add([pscustomobject]@{ Rel = $rel; Path = $p })
|        }
|    }
|    if ($files.Count -eq 0) { return '' }
|    $sorted = $files.ToArray()
|    $keys = [string[]]@($sorted | ForEach-Object { [string]$_.Rel })
|    [Array]::Sort($keys, $sorted, [StringComparer]::Ordinal)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try {
|        $sb = New-Object System.Text.StringBuilder
|        foreach ($x in $sorted) {
|            $bytes = [System.IO.File]::ReadAllBytes($x.Path)
|            $h = -join @($sha.ComputeHash($bytes) | ForEach-Object { $_.ToString('x2') })
|            [void]$sb.Append($x.Rel).Append("`n").Append($h).Append("`n")
|        }
|        return (-join @($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($sb.ToString())) | ForEach-Object { $_.ToString('x2') }))
|    } finally { $sha.Dispose() }
|}
|
|function ConvertTo-SIGuardStrictUtc {
|    <# PURE. A stored time as UTC, or $null. A text without a zone is read AS UTC. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or $Value -is [System.DBNull] -or "$Value".Trim() -eq '') { return $null }
|    if ($Value -is [datetime]) { if ($Value.Kind -eq [DateTimeKind]::Local) { return $Value.ToUniversalTime() }; return [datetime]::SpecifyKind($Value, [DateTimeKind]::Utc) }
|    $d = [datetime]::MinValue
|    $styles = [System.Globalization.DateTimeStyles]::AssumeUniversal -bor [System.Globalization.DateTimeStyles]::AdjustToUniversal
|    if ([datetime]::TryParse("$Value", [System.Globalization.CultureInfo]::InvariantCulture, $styles, [ref]$d)) { return $d }
|    $null
|}
|
|function ConvertTo-SIGuardStrictIso {
|    param([AllowNull()]$Value)
|    $u = ConvertTo-SIGuardStrictUtc $Value
|    if ($null -eq $u) { return $null }
|    $u.ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture)
|}
|
|function ConvertFrom-SIGuardStrictJson {
|    <# PURE. A stored JSON row as an object; $null for nothing / not JSON / not an object. #>
|    param([AllowNull()][AllowEmptyString()][string]$Json)
|    if ([string]::IsNullOrWhiteSpace($Json)) { return $null }
|    try { $o = ConvertFrom-Json -InputObject $Json -ErrorAction Stop } catch { return $null }
|    if ($null -eq $o -or $o -is [string] -or $o -is [System.ValueType] -or $o -is [array]) { return $null }
|    $o
|}
|
|function Get-SIGuardStrictField {
|    param($Object, [string]$Name)
|    if ($null -eq $Object) { return $null }
|    if ($Object -is [System.Collections.IDictionary]) { if ($Object.Contains($Name)) { return $Object[$Name] }; return $null }
|    if ($Object.PSObject.Properties[$Name]) { return $Object.$Name }
|    $null
|}
|
|function New-SIEngineFingerprintRecord {
|    <#
|        PURE. The updater's record after installing code with -Hash (version -Version) at -NowUtc, given the record before
|        (-Previous: its JSON). Returns @{ Record (ordered: hash, version, since, strictFrom, strictVersion); Changed; First }
|        -- $null when -Hash is empty (nothing is recorded).
|          no record before (or not readable)  recorded, NO stricter period (First = $true) -- an older install never gets
|                                              one invented
|          the same fingerprint                the record as it was (its period, if any, unchanged); the version updated
|          another fingerprint                 strictFrom = -NowUtc, strictVersion = -Version: the stricter period starts
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Previous, [AllowEmptyString()][string]$Hash, [AllowEmptyString()][string]$Version, [Parameter(Mandatory)][datetime]$NowUtc)
|    $h = "$Hash".Trim().ToLowerInvariant()
|    if ($h -notmatch '^[0-9a-f]{64}$') { return $null }
|    $now = ConvertTo-SIGuardStrictIso $NowUtc.ToUniversalTime()
|    $ver = "$Version".Trim(); if ($ver.Length -gt 50) { $ver = $ver.Substring(0, 50) }
|    $p = ConvertFrom-SIGuardStrictJson $Previous
|    $ph = ([string](Get-SIGuardStrictField $p 'hash')).Trim().ToLowerInvariant()
|    if ($ph -notmatch '^[0-9a-f]{64}$') {
|        return [pscustomobject]@{ Record = [ordered]@{ hash = $h; version = $ver; since = $now; strictFrom = $null; strictVersion = '' }; Changed = $false; First = $true }
|    }
|    if ($ph -eq $h) {
|        $rec = [ordered]@{ hash = $h; version = $(if ($ver) { $ver } else { [string](Get-SIGuardStrictField $p 'version') })
|                           since = (ConvertTo-SIGuardStrictIso (Get-SIGuardStrictField $p 'since'))
|                           strictFrom = (ConvertTo-SIGuardStrictIso (Get-SIGuardStrictField $p 'strictFrom'))
|                           strictVersion = [string](Get-SIGuardStrictField $p 'strictVersion') }
|        return [pscustomobject]@{ Record = $rec; Changed = $false; First = $false }
|    }
|    [pscustomobject]@{ Record = [ordered]@{ hash = $h; version = $ver; since = $now; strictFrom = $now; strictVersion = $ver }; Changed = $true; First = $false }
|}
|
|# =====================================================================================================================
|#  The guard mode -- PURE over the two rows
|# =====================================================================================================================
|function Get-SIGuardModeFromState {
|    <#
|        PURE. The install's guard mode from its fingerprint record (-Fingerprint) and a SuperAdmin's early end (-StrictEnd),
|        both JSON (or objects). Returns @{ Mode ('strict' | 'normal'); Recorded (a fingerprint is recorded); Until;
|        Version (the release that started the period); StrictFrom; Hash; EndedEarlyAt; EndedBy; EndedByRole; Reason }.
|        Strict = a period started (strictFrom), -NowUtc before its end (strictFrom + -Hours), and no early end OF THIS
|        PERIOD (the end names the same fingerprint and start). An early end of an older period ends nothing.
|    #>
|    param([AllowNull()]$Fingerprint, [AllowNull()]$StrictEnd, [Parameter(Mandatory)][datetime]$NowUtc, [int]$Hours = (Get-SIGuardStrictState).Hours)
|    $fp = if ($Fingerprint -is [string]) { ConvertFrom-SIGuardStrictJson $Fingerprint } else { $Fingerprint }
|    $en = if ($StrictEnd -is [string]) { ConvertFrom-SIGuardStrictJson $StrictEnd } else { $StrictEnd }
|    $now = $NowUtc.ToUniversalTime()
|    $out = [ordered]@{ Mode = 'normal'; Recorded = $false; Until = $null; Version = ''; StrictFrom = $null; Hash = ''; EndedEarlyAt = $null; EndedBy = ''; EndedByRole = ''; Reason = '' }
|    $hash = ([string](Get-SIGuardStrictField $fp 'hash')).Trim().ToLowerInvariant()
|    if ($hash -notmatch '^[0-9a-f]{64}$') { return [pscustomobject]$out }
|    $out.Recorded = $true; $out.Hash = $hash
|    $from = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $fp 'strictFrom')
|    if ($null -eq $from) { return [pscustomobject]$out }
|    $until = $from.AddHours($Hours)
|    if ($now -ge $until -or $now -lt $from.AddMinutes(-5)) { return [pscustomobject]$out }
|    $out.StrictFrom = $from; $out.Until = $until; $out.Version = [string](Get-SIGuardStrictField $fp 'strictVersion')
|    if ($en) {
|        $eh = ([string](Get-SIGuardStrictField $en 'hash')).Trim().ToLowerInvariant()
|        $ef = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $en 'strictFrom')
|        $ea = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $en 'endedAt')
|        if ($eh -eq $hash -and $ef -and [Math]::Abs(($ef - $from).TotalSeconds) -lt 1 -and $ea) {
|            $out.EndedEarlyAt = $ea; $out.EndedBy = [string](Get-SIGuardStrictField $en 'by')
|            $out.EndedByRole = $(if ([string](Get-SIGuardStrictField $en 'role')) { [string](Get-SIGuardStrictField $en 'role') } else { 'SuperAdmin' })
|            $out.Reason = [string](Get-SIGuardStrictField $en 'reason')
|            return [pscustomobject]$out
|        }
|    }
|    $out.Mode = 'strict'
|    [pscustomobject]$out
|}
|
|function ConvertTo-SIGuardModeWire {
|    <#
|        PURE. The heartbeat's guardMode (framework §12.11b item 5; Invardia's parseGuardMode): { mode ('strict' | 'normal'),
|        until, startedBy (the release that started it), version (the same), endedEarlyAt, endedBy (a ROLE, never a person) }.
|        $null when no fingerprint is recorded -- an older install sends nothing new.
|    #>
|    param([AllowNull()]$Mode)
|    if ($null -eq $Mode -or -not $Mode.Recorded) { return $null }
|    $v = "$($Mode.Version)".Trim()
|    if ($v -and $v -notmatch '^[0-9A-Za-z.+-]{1,50}$') { $v = '' }
|    $role = "$($Mode.EndedByRole)".Trim()
|    if ($role -and $role -notmatch '^[A-Za-z][A-Za-z0-9 ._-]{0,39}$') { $role = 'SuperAdmin' }
|    [ordered]@{
|        mode         = [string]$Mode.Mode
|        until        = (ConvertTo-SIGuardStrictIso $Mode.Until)
|        startedBy    = $(if ($v) { $v } else { $null })
|        version      = $(if ($v) { $v } else { $null })
|        endedEarlyAt = (ConvertTo-SIGuardStrictIso $Mode.EndedEarlyAt)
|        endedBy      = $(if ($Mode.EndedEarlyAt -and $role) { $role } else { $null })
|    }
|}
|
|# =====================================================================================================================
|#  The limit -- PURE
|# =====================================================================================================================
|function Get-SIGuardStrictLimit {
|    <#
|        PURE. One numbered limit while -Strict: effective = max(1, floor(-Configured x 0.5)), never above -Configured (a
|        limit of 1 stays 1; 0 or less = "no limit" stays as it is); never below -ApprovedForRun (a limit a SuperAdmin
|        approved for one run). Not strict = the configured value. Returns @{ Configured; Effective; Halved; Text }.
|    #>
|    param([AllowNull()]$Configured, [bool]$Strict, [AllowNull()]$ApprovedForRun)
|    $c = 0.0
|    $ok = ($null -ne $Configured) -and [double]::TryParse(("$Configured").Trim(), [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$c) -and -not [double]::IsNaN($c) -and -not [double]::IsInfinity($c)
|    if (-not $ok) { return [pscustomobject]@{ Configured = $Configured; Effective = $Configured; Halved = $false; Text = '' } }
|    $e = $c
|    if ($Strict -and $c -gt 0) {
|        $e = [Math]::Max(1.0, [Math]::Floor($c * 0.5))
|        if ($e -gt $c) { $e = $c }
|        $a = 0.0
|        if ($null -ne $ApprovedForRun -and [double]::TryParse(("$ApprovedForRun").Trim(), [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$a) -and $a -gt $e) { $e = $a }
|    }
|    $num = { param($d) if ($d -eq [Math]::Floor($d) -and [Math]::Abs($d) -lt 9e15) { [long]$d } else { [Math]::Round($d, 4) } }
|    $cv = & $num $c; $ev = & $num $e
|    $halved = ($ev -ne $cv)
|    [pscustomobject]@{ Configured = $cv; Effective = $ev; Halved = [bool]$halved; Text = $(if ($halved) { '{0} -> {1} while strict' -f $cv, $ev } else { '' }) }
|}
|
|# =====================================================================================================================
|#  The guard mode NOW -- read once per process (5 minutes), never throws
|# =====================================================================================================================
|function Get-SIGuardModeSql {
|    "IF OBJECT_ID(N'cfg.InstallState') IS NOT NULL SELECT Name, Value FROM cfg.InstallState WHERE Name IN (N'EngineFingerprint', N'GuardStrictEnd');"
|}
|
|function Read-SIGuardModeState {
|    <# The two rows from the Pro database (-Invoke: the (sql, params, mode) seam) -> Get-SIGuardModeFromState. Throws on a
|       failed read (the caller decides). #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][datetime]$NowUtc)
|    $fp = $null; $en = $null
|    foreach ($r in @(& $Invoke (Get-SIGuardModeSql) @{} 'reader' | ForEach-Object { $_ } | Where-Object { $_ })) {
|        $n = [string](Get-SIGuardStrictField $r 'Name'); $v = [string](Get-SIGuardStrictField $r 'Value')
|        if ($n -eq (Get-SIGuardStrictState).FingerprintRow) { $fp = $v } elseif ($n -eq (Get-SIGuardStrictState).EndRow) { $en = $v }
|    }
|    Get-SIGuardModeFromState -Fingerprint $fp -StrictEnd $en -NowUtc $NowUtc
|}
|
|function Get-SIGuardModeNow {
|    <#
|        The install's guard mode now. $global:SI_GuardModeOverride (a test's, or a run's own) wins; a test session (Pester
|        loaded) never reads a database; else the Pro database (the guard seam $global:SI_GuardInvoke, else
|        Get-SIGuardProInvoke), remembered for 5 minutes. Anything that cannot be read = normal. Never throws.
|    #>
|    param([switch]$Refresh, [scriptblock]$Invoke, $NowUtc)
|    $now = if ($NowUtc) { ([datetime]$NowUtc).ToUniversalTime() } else { [datetime]::UtcNow }
|    $normal = [pscustomobject]@{ Mode = 'normal'; Recorded = $false; Until = $null; Version = ''; StrictFrom = $null; Hash = ''; EndedEarlyAt = $null; EndedBy = ''; EndedByRole = ''; Reason = '' }
|    try {
|        if ($null -ne $global:SI_GuardModeOverride) { return $global:SI_GuardModeOverride }
|        if (-not $Invoke -and (Get-Module -Name Pester)) { return $normal }
|        $c = $script:SIGuardModeCache
|        if (-not $Refresh -and -not $Invoke -and $c -and ($now - $c.At).TotalMinutes -lt (Get-SIGuardStrictState).CacheMinutes -and $now -ge $c.At) { return $c.Mode }
|        $inv = $Invoke
|        if (-not $inv -and $global:SI_GuardInvoke -is [scriptblock]) { $inv = $global:SI_GuardInvoke }
|        if (-not $inv -and (Get-Command -Name Get-SIGuardProInvoke -ErrorAction SilentlyContinue)) { $inv = Get-SIGuardProInvoke }
|        $m = if ($inv) { Read-SIGuardModeState -Invoke $inv -NowUtc $now } else { $normal }
|        if (-not $Invoke) { $script:SIGuardModeCache = [pscustomobject]@{ At = $now; Mode = $m } }
|        return $m
|    } catch { return $normal }
|}
|
|function Format-SIGuardStrictUntil {
|    <# PURE. "2026-10-15 14:00 UTC". #>
|    param([AllowNull()]$Until)
|    $u = ConvertTo-SIGuardStrictUtc $Until
|    if ($null -eq $u) { return '' }
|    '{0:yyyy-MM-dd HH:mm} UTC' -f $u
|}
|
|function Format-SIGuardStrictSentence {
|    <# PURE. The calm sentence: "Stricter period after release 3.0.1 until 2026-10-15 14:00 UTC: ...". '' when not strict. #>
|    param([AllowNull()]$Strict)
|    if ($null -eq $Strict) { return '' }
|    $after = if ("$($Strict.Version)".Trim()) { ' after release ' + "$($Strict.Version)".Trim() } else { ' after a recent release' }
|    $until = Format-SIGuardStrictUntil $Strict.Until
|    $u = if ("$($Strict.Unit)".Trim()) { ' ' + "$($Strict.Unit)".Trim() } else { '' }
|    $nums = if ($null -ne $Strict.Effective -and $null -ne $Strict.Configured) { (' Here the limit is {0}{2} (normally {1}{2}).' -f $Strict.Effective, $Strict.Configured, $u) } else { '' }
|    ('This safety check is in its stricter period{0}{1}: its limit is halved for 24 hours after a release that changed the engine, as planned.{2} After the period the normal limit applies again by itself.' -f `
|        $after, $(if ($until) { ' until ' + $until } else { '' }), $nums)
|}
|
|function Resolve-SIGuardLimit {
|    <#
|        The limit a brake uses NOW: the configured value, halved while the install is in its stricter period
|        (Get-SIGuardStrictLimit over Get-SIGuardModeNow). A halved limit is remembered for the guard's event
|        ($global:SI_GuardStrictApplied[<guard id>]: the trip's report then carries strict + configured + effective) and
|        said once per process and guard in one calm line. -Mode: a mode handed in (tests). Never throws: the configured
|        value on any problem. Returns @{ Configured; Effective; Halved; Text; Strict (the remembered entry or $null) }.
|    #>
|    param([Parameter(Mandatory)][string]$GuardId, [string]$Name, [string]$Label, [AllowNull()]$Configured, [string]$Unit, [AllowNull()]$ApprovedForRun, $Mode, [scriptblock]$Log)
|    try {
|        $m = if ($Mode) { $Mode } else { Get-SIGuardModeNow }
|        $strict = [string]$m.Mode -eq 'strict'
|        $l = Get-SIGuardStrictLimit -Configured $Configured -Strict $strict -ApprovedForRun $ApprovedForRun
|        $entry = $null
|        if ($l.Halved) {
|            $entry = [pscustomobject]@{ GuardId = $GuardId; Name = $Name; Label = $(if ($Label) { $Label } else { $Name }); Configured = $l.Configured; Effective = $l.Effective
|                                        Unit = $Unit; Until = $m.Until; Version = [string]$m.Version }
|            if ($null -eq $global:SI_GuardStrictApplied) { $global:SI_GuardStrictApplied = @{} }
|            $first = -not $global:SI_GuardStrictApplied.ContainsKey(('{0}|{1}' -f $GuardId, $Name))
|            $global:SI_GuardStrictApplied[('{0}|{1}' -f $GuardId, $Name)] = $entry
|            $global:SI_GuardStrictApplied[$GuardId] = $entry
|            if ($first) {
|                $u = if ($Unit) { ' ' + $Unit } else { '' }
|                $line = 'stricter period{0}{1}: {2} {3}{5} -> {4}{5} while it lasts (safety check {6})' -f `
|                    $(if ("$($m.Version)".Trim()) { ' after release ' + "$($m.Version)".Trim() } else { '' }), $(if ($m.Until) { ' until ' + (Format-SIGuardStrictUntil $m.Until) } else { '' }),
|                    $entry.Label, $l.Configured, $l.Effective, $u, $GuardId
|                # the caller's -Log failing never drops the halved limit (it was caught below: the configured value)
|                try { if ($Log) { & $Log 'INFO' $line } else { Write-Host (' [INFO] ' + $line) } } catch { Write-Host (' [INFO] ' + $line) }
|            }
|        }
|        return [pscustomobject]@{ Configured = $l.Configured; Effective = $l.Effective; Halved = $l.Halved; Text = $l.Text; Strict = $entry }
|    } catch {
|        return [pscustomobject]@{ Configured = $Configured; Effective = $Configured; Halved = $false; Text = ''; Strict = $null }
|    }
|}
|
|function Add-SIGuardStrictToEvent {
|    <#
|        PURE over the remembered entries. A guard event whose limit was halved by Resolve-SIGuardLimit in this process gets
|        Strict = @{ Configured; Effective; Unit; Until; Version; Label } and, on its value with the same name, Configured
|        (the configured limit beside the effective one -- a negative limit, the asset drop's, keeps its sign). -Applied: the
|        remembered entries (default $global:SI_GuardStrictApplied). Returns the event.
|    #>
|    param([Parameter(Mandatory)]$Event, [System.Collections.IDictionary]$Applied = $global:SI_GuardStrictApplied)
|    $gid = [string]$Event.GuardId
|    if (-not $Applied -or -not $Applied.Contains($gid)) { return $Event }
|    $first = $null
|    foreach ($v in @($Event.Values)) {
|        if ($null -eq $v -or $null -eq $v.Limit) { continue }
|        $k = '{0}|{1}' -f $gid, [string]$v.Name
|        if (-not $Applied.Contains($k)) { continue }
|        $s = $Applied[$k]
|        $cfg = if ([double]$v.Limit -lt 0) { -1 * [double]$s.Configured } else { [double]$s.Configured }
|        if ($cfg -eq [Math]::Floor($cfg)) { $cfg = [long]$cfg }
|        $v | Add-Member -NotePropertyName Configured -NotePropertyValue $cfg -Force
|        if (-not $first) { $first = $s }
|    }
|    $Event | Add-Member -NotePropertyName Strict -NotePropertyValue $(if ($first) { $first } else { $Applied[$gid] }) -Force
|    $Event
|}
'@ }
$__siSupportFiles['engine/_shared/SI-ReleaseControl.ps1'] = @{ Sha256 = 'ff065e5e15161b1e416b60d95a7508bf32251d9eded63fb9a9a25a25c29b8164'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- RELEASE CONTROL (CR3, SI #657; framework DOCS/REQUIREMENTS.md 12.11e RELEASE-CONTROL; approved by the
|    owner 2026-10-14). SecurityInsight's part:
|
|    1. THE WAVE. Invardia may serve an install that the owner put in a pre-release wave a version already released to a lower
|       ring, early, with no ring move; the signed manifest then carries "wave": "<name>". The updater keeps the wave of the
|       release it applied (SI-InvardiaUpdate.ps1: appliedWave); the web app's header says "Ring 2 - Pre-release (<name>)" and
|       the identified heartbeat carries wave { name, version, ring } (null = no wave). Leaving or stopping a wave NEVER moves
|       the install back: it keeps its version until its ring reaches it.
|
|    2. RELEASE MODE. After a release that changed engine code (the same trigger as the stricter safety checks, CR4: the
|       engine fingerprint the updater records changed -- SI-GuardStrict.ps1) SecurityInsight reports every 30 minutes for
|       12 hours, counts only: the identified heartbeat (users, guests, devices, the guard mode, the wave) with
|       releaseMode { version, sinceUtc, untilUtc, everyMinutes } (null = not in release mode). The pipeline runner, which
|       wakes every 5 minutes, sends it (Send-SIReleaseModeReport, SI-TelemetrySend.ps1); one report per half hour, claimed
|       in the Pro database (cfg.InstallState 'ReleaseModeReport') so two processes never both send it.
|
|    3. COMPONENTS: TESTING / STABLE. SecurityInsight's components are the collections per source, the correlation, Risk
|       Analysis per report and data out per channel (config\release-scopes.locked.json maps each to its engine files; a core
|       file belongs to every component). Each component has a fingerprint of its code:
|         * the publish call says which components a release changed (changedScopes -- Get-SIReleaseChangedScopesFromGit);
|         * the updater fingerprints the code it installed (Save-SIReleaseScopeRecords): a component whose fingerprint
|           changed is TESTING from then;
|         * a component is STABLE again after 3 good daily runs with no code change (Update-SIReleaseScopeRun, at the end of
|           every engine run: a good run counts once per UTC day; a failed run starts the count again while it is Testing).
|       The first fingerprints an install records mark nothing Testing (an older install never gets a state invented).
|       The identified heartbeat carries them as components { total, testing, stable, testingIds, since, version }.
|
|    4. THE EVIDENCE (framework 12.11e item 5(a), rule D): every identified heartbeat -- so at least daily, every ring -- carries
|       evidence { day, version, sinceUtc, health { state, sinceUtc }, guardTrips { sinceRelease, before, windowHours,
|       verdict }, components { total, testing, stable }, verdict ok | attention }: counts and verdicts only, read with the
|       install's own (read-only) database access. NOT in it yet: the audit of changes made by SecurityInsight's own
|       identities (a Graph audit read the heartbeat path does not have) -- see SI REQUIREMENTS #657.
|
|    THE SWITCH (framework 12.22 3(b), owner 2026-10-14): wave and releaseMode are NEW FIELDS on the heartbeat. They go out
|    only while SI_Telemetry_ReleaseControl (setting) / SI_TELEMETRY_RELEASECONTROL (job variable) allows it:
|      on    always            off   never (the heartbeat is exactly as before; no release-mode reports)
|      auto  (the default)     only on the rings in $script:SIReleaseControl.ConfirmedRings -- ring 0 first; every ring
|                              since 2026-10-18 (Invardia's intake is live; PIM sends them on every ring).
|    A heartbeat refused WITH the new fields is sent again once WITHOUT them; when that one is taken, the fields are held back
|    for 24 hours (cfg.InstallState 'ReleaseControlHold').
|
|    NEVER THROWS where a job calls it. PS 5.1 and 7. No PowerShell modules.
|#>
|
|if (-not (Get-Command -Name ConvertFrom-SIGuardStrictJson -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-GuardStrict.ps1')) }
|
|function Get-SIReleaseControlState {
|    <# The value of $script:SIReleaseControl, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIReleaseControl) { $script:SIReleaseControl = @{
|    ReleaseModeHours = 12
|    EveryMinutes     = 30
|    # framework 12.22 3(a): the new heartbeat fields went to ring 0 first; Invardia's wave / releaseMode intake is live and
|    # PIM sends them on every ring (2.4.641) -- every ring takes them now (2026-10-18). A refused heartbeat is still resent
|    # once without them and they are held 24 h; SI_Telemetry_ReleaseControl = off turns them off without a release.
|    ConfirmedRings   = @(0, 1, 2, 3)
|    StableGoodDays   = 3
|    HoldHours        = 24
|    CheckMinutes     = 4
|    MaxScopesListed  = 30
|    ScopeMapFile     = 'config/release-scopes.locked.json'
|    ReportRow        = 'ReleaseModeReport'
|    HoldRow          = 'ReleaseControlHold'
|    SIRoot           = (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))
|    WaveName         = '^[A-Za-z0-9][A-Za-z0-9 ._()+-]{0,59}$'
|    VersionText      = '^[0-9A-Za-z.+-]{1,50}$'
|} }
|    , $script:SIReleaseControl
|}
|$script:SIReleaseControl = $null; $null = Get-SIReleaseControlState
|
|# =====================================================================================================================
|#  The switch -- PURE
|# =====================================================================================================================
|function Resolve-SIReleaseControlSwitch {
|    <#
|        PURE. Do wave + releaseMode go out from this install? The setting wins when set (SI_Telemetry_ReleaseControl), then
|        the job variable SI_TELEMETRY_RELEASECONTROL, else 'auto'. on / true / 1 / yes = on; off / false / 0 / no = off;
|        anything else = auto. auto = on only for a ring in ConfirmedRings (-Ring; not known = off).
|        Returns @{ On; Setting (on | off | auto); Reason }.
|    #>
|    param([AllowNull()]$Value = $global:SI_Telemetry_ReleaseControl, [AllowNull()][AllowEmptyString()][string]$EnvValue = $env:SI_TELEMETRY_RELEASECONTROL,
|          [AllowNull()]$Ring, [int[]]$ConfirmedRings = @((Get-SIReleaseControlState).ConfirmedRings))
|    $set = ''
|    foreach ($v in @($Value, $EnvValue)) {
|        if ($null -eq $v) { continue }
|        if ($v -is [bool]) { $set = $(if ($v) { 'on' } else { 'off' }); break }
|        $s = ([string]$v).Trim().Trim('$').ToLowerInvariant()
|        if (-not $s) { continue }
|        $set = if ($s -in @('on', 'true', '1', 'yes', 'enabled')) { 'on' } elseif ($s -in @('off', 'false', '0', 'no', 'disabled')) { 'off' } else { 'auto' }
|        break
|    }
|    if (-not $set) { $set = 'auto' }
|    if ($set -eq 'on') { return [pscustomobject]@{ On = $true; Setting = 'on'; Reason = 'switched on (SI_Telemetry_ReleaseControl)' } }
|    if ($set -eq 'off') { return [pscustomobject]@{ On = $false; Setting = 'off'; Reason = 'switched off (SI_Telemetry_ReleaseControl)' } }
|    $rn = -1
|    if ($null -ne $Ring -and "$Ring".Trim() -ne '') { if (-not [int]::TryParse("$Ring", [ref]$rn)) { $rn = -1 } }
|    $on = ($rn -ge 0 -and @($ConfirmedRings) -contains $rn)
|    [pscustomobject]@{ On = $on; Setting = 'auto'
|        Reason = $(if ($on) { "ring $rn takes the release fields" } elseif ($rn -lt 0) { 'the ring is not known -- the release fields wait' } else { "ring $rn takes the release fields once Invardia has confirmed them through ring 0" }) }
|}
|
|function ConvertTo-SIReleaseControlRing {
|    <# PURE. 0..3 or -1. #>
|    param([AllowNull()]$Ring)
|    $n = -1
|    if ($null -ne $Ring -and [int]::TryParse("$Ring", [ref]$n) -and $n -ge 0 -and $n -le 3) { return $n }
|    -1
|}
|
|# =====================================================================================================================
|#  The wave -- PURE over the update state the updater records
|# =====================================================================================================================
|function ConvertTo-SIReleaseWaveName {
|    <# PURE. A wave name as the manifest gives it: trimmed, one line, at most 60 characters of the safe set; '' = none. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return '' }
|    if (-not ($Value -is [string]) -and -not ($Value -is [System.ValueType])) {
|        # an object { name } is read for its name (a manifest that carries more than the name)
|        $n = Get-SIGuardStrictField $Value 'name'
|        if ($null -eq $n) { return '' }
|        $Value = $n
|    }
|    $v = ("$Value" -replace '[\r\n\t]+', ' ').Trim()
|    if ($v -notmatch (Get-SIReleaseControlState).WaveName) { return '' }
|    $v
|}
|
|function Get-SIReleaseWaveFromUpdateState {
|    <#
|        PURE. The wave of the code this install runs, from the update state (-Json: the compact row cfg.InstallState
|        'UpdateState', or the full Key Vault state). Returns @{ Known; Wave }:
|          Known  $true when the state could be read (then Wave is the wave or $null = none); $false = nothing recorded / not
|                 readable -> the heartbeat leaves the field out (an older install sends nothing new)
|          Wave   [ordered]@{ name; version; ring } or $null
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Json)
|    $none = [pscustomobject]@{ Known = $false; Wave = $null }
|    $o = ConvertFrom-SIGuardStrictJson $Json
|    if ($null -eq $o) { return $none }
|    $code = Get-SIGuardStrictField $o 'code'
|    $name = ''; $ver = ''; $ring = $null
|    if ($code) {
|        $w = Get-SIGuardStrictField $code 'wave'
|        if ($null -ne $w -and -not ($w -is [string])) {
|            $name = ConvertTo-SIReleaseWaveName (Get-SIGuardStrictField $w 'name')
|            $ver = [string](Get-SIGuardStrictField $w 'version'); $ring = Get-SIGuardStrictField $w 'ring'
|        } elseif ($w -is [string]) {
|            $name = ConvertTo-SIReleaseWaveName $w
|        }
|        if (-not $name) {
|            # the full state (Key Vault): appliedWave + appliedVersion + appliedRing
|            $name = ConvertTo-SIReleaseWaveName (Get-SIGuardStrictField $code 'appliedWave')
|            if ($name) { $ver = [string](Get-SIGuardStrictField $code 'appliedVersion'); $ring = Get-SIGuardStrictField $code 'appliedRing' }
|        }
|    }
|    if (-not $name) { return [pscustomobject]@{ Known = $true; Wave = $null } }
|    $ver = "$ver".Trim(); if ($ver -notmatch (Get-SIReleaseControlState).VersionText) { $ver = '' }
|    $rn = ConvertTo-SIReleaseControlRing $ring
|    [pscustomobject]@{ Known = $true; Wave = [ordered]@{ name = $name; version = $(if ($ver) { $ver } else { $null }); ring = $(if ($rn -ge 0) { $rn } else { $null }) } }
|}
|
|function Format-SIReleaseRingLabel {
|    <# PURE. The header's words: "Ring 2 - Pre-release (Pre1)" in a wave, else "ring 2" (as today). #>
|    param([AllowNull()]$Ring, [AllowEmptyString()][string]$Wave)
|    $rn = ConvertTo-SIReleaseControlRing $Ring
|    $w = ConvertTo-SIReleaseWaveName $Wave
|    if ($rn -lt 0) { return '' }
|    if ($w) { return ('Ring {0} - Pre-release ({1})' -f $rn, $w) }
|    'ring {0}' -f $rn
|}
|
|# =====================================================================================================================
|#  Release mode -- PURE over the engine fingerprint record (cfg.InstallState 'EngineFingerprint', CR4)
|# =====================================================================================================================
|function Get-SIReleaseModeFromFingerprint {
|    <#
|        PURE. Release mode from the fingerprint record the updater keeps: a release that CHANGED engine code sets strictFrom
|        + strictVersion; release mode lasts -Hours (12) from strictFrom, reports every -EveryMinutes (30). A SuperAdmin ending
|        the stricter safety checks early does NOT end release mode (it is about reporting, not about the limits).
|        Returns @{ Known; Active; Since; Until; Version; Wire }:
|          Known   a fingerprint is recorded (else: an older install -- the field is left out)
|          Wire    [ordered]@{ version; sinceUtc; untilUtc; everyMinutes } while Active, else $null
|    #>
|    param([AllowNull()]$Fingerprint, [Parameter(Mandatory)][datetime]$NowUtc, [int]$Hours = (Get-SIReleaseControlState).ReleaseModeHours,
|          [int]$EveryMinutes = (Get-SIReleaseControlState).EveryMinutes)
|    $out = [ordered]@{ Known = $false; Active = $false; Since = $null; Until = $null; Version = ''; Wire = $null }
|    $fp = if ($Fingerprint -is [string]) { ConvertFrom-SIGuardStrictJson $Fingerprint } else { $Fingerprint }
|    $hash = ([string](Get-SIGuardStrictField $fp 'hash')).Trim().ToLowerInvariant()
|    if ($hash -notmatch '^[0-9a-f]{64}$') { return [pscustomobject]$out }
|    $out.Known = $true
|    $from = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $fp 'strictFrom')
|    if ($null -eq $from) { return [pscustomobject]$out }
|    $now = $NowUtc.ToUniversalTime()
|    $until = $from.AddHours($Hours)
|    if ($now -ge $until -or $now -lt $from.AddMinutes(-5)) { return [pscustomobject]$out }
|    $v = ([string](Get-SIGuardStrictField $fp 'strictVersion')).Trim()
|    if ($v -notmatch (Get-SIReleaseControlState).VersionText) { $v = '' }
|    $out.Active = $true; $out.Since = $from; $out.Until = $until; $out.Version = $v
|    $out.Wire = [ordered]@{ version = $(if ($v) { $v } else { $null }); sinceUtc = (ConvertTo-SIGuardStrictIso $from); untilUtc = (ConvertTo-SIGuardStrictIso $until); everyMinutes = $EveryMinutes }
|    [pscustomobject]$out
|}
|
|function Get-SIReleaseModeSlot {
|    <# PURE. Which half hour of release mode -NowUtc is in (0 = the first); -1 when not in release mode. #>
|    param([AllowNull()]$Mode, [Parameter(Mandatory)][datetime]$NowUtc, [int]$EveryMinutes = (Get-SIReleaseControlState).EveryMinutes)
|    if ($null -eq $Mode -or -not $Mode.Active -or $null -eq $Mode.Since) { return -1 }
|    $m = ($NowUtc.ToUniversalTime() - ([datetime]$Mode.Since)).TotalMinutes
|    if ($m -lt 0) { return 0 }
|    [int][Math]::Floor($m / [Math]::Max(1, $EveryMinutes))
|}
|
|function Test-SIReleaseControlHold {
|    <# PURE. Is the hold (a refused heartbeat with the release fields) still on at -NowUtc? -Hold: the row's JSON. #>
|    param([AllowNull()]$Hold, [Parameter(Mandatory)][datetime]$NowUtc)
|    $h = if ($Hold -is [string]) { ConvertFrom-SIGuardStrictJson $Hold } else { $Hold }
|    $u = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $h 'untilUtc')
|    [bool]($null -ne $u -and $NowUtc.ToUniversalTime() -lt $u)
|}
|
|# =====================================================================================================================
|#  The rows (cfg.InstallState) -- through the (sql, params, mode) seam
|# =====================================================================================================================
|function Get-SIReleaseControlRowsSql {
|    "IF OBJECT_ID(N'cfg.InstallState') IS NOT NULL SELECT Name, Value FROM cfg.InstallState WHERE Name IN (N'EngineFingerprint', N'GuardStrictEnd', N'ReleaseControlHold', N'UpdateState');"
|}
|
|function Read-SIReleaseControlRows {
|    <# The rows release control reads, as @{ EngineFingerprint; GuardStrictEnd; ReleaseControlHold; UpdateState } (text or
|       $null). Throws on a failed read (the caller decides). #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke)
|    $h = [ordered]@{ EngineFingerprint = $null; GuardStrictEnd = $null; ReleaseControlHold = $null; UpdateState = $null }
|    # the Pro store's reader answers ONE array of rows (New-SIProSettingsStore: , $out.ToArray()) -- flattened here, so the
|    # rows are read whatever the seam's shape (live 2026-10-16: the same shape made the hourly heartbeat's claim read as 0)
|    foreach ($r in @(& $Invoke (Get-SIReleaseControlRowsSql) @{} 'reader' | ForEach-Object { $_ } | Where-Object { $_ })) {
|        $n = [string](Get-SIGuardStrictField $r 'Name')
|        if ($h.Contains($n)) { $h[$n] = [string](Get-SIGuardStrictField $r 'Value') }
|    }
|    [pscustomobject]$h
|}
|
|function Get-SIReleaseModeClaimSql {
|    <#
|        ONE statement: claim the half hour's report (-Slot of release mode -Since) in cfg.InstallState 'ReleaseModeReport' --
|        taken only when no report of this slot (or a later one) of this release mode was claimed before. Returns Claimed 1/0.
|    #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.InstallState') IS NULL
|    SELECT CAST(0 AS int) AS Claimed;
|ELSE
|BEGIN
|    SET XACT_ABORT ON;
|    BEGIN TRAN;
|    DECLARE @cur NVARCHAR(400) = NULL, @ok int = 0;
|    SELECT @cur = Value FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = N'ReleaseModeReport';
|    IF @cur IS NULL AND NOT EXISTS (SELECT 1 FROM cfg.InstallState WHERE Name = N'ReleaseModeReport')
|    BEGIN
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N'ReleaseModeReport', @Value, @Version, @By);
|        SET @ok = 1;
|    END
|    ELSE IF ISNULL(CASE WHEN ISJSON(@cur) = 1 THEN JSON_VALUE(@cur, '$.since') END, N'') <> @Since
|         OR ISNULL(CASE WHEN ISJSON(@cur) = 1 THEN TRY_CAST(JSON_VALUE(@cur, '$.slot') AS int) END, -1) < @Slot
|    BEGIN
|        UPDATE cfg.InstallState SET Value = @Value, [Version] = @Version, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = N'ReleaseModeReport';
|        SET @ok = 1;
|    END
|    COMMIT;
|    SELECT @ok AS Claimed;
|END
|'@
|}
|
|function Invoke-SIReleaseModeClaim {
|    <# Claim this half hour's release-mode report. $true = this process sends it. Throws on a failed write. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)]$Mode, [Parameter(Mandatory)][int]$Slot, [Parameter(Mandatory)][datetime]$NowUtc, [string]$By = 'release-mode report')
|    $since = ConvertTo-SIGuardStrictIso $Mode.Since
|    $value = ([ordered]@{ since = $since; slot = $Slot; sentUtc = (ConvertTo-SIGuardStrictIso $NowUtc) } | ConvertTo-Json -Compress)
|    $ver = "$($Mode.Version)"; if ($ver.Length -gt 32) { $ver = $ver.Substring(0, 32) }
|    $rows = @(& $Invoke (Get-SIReleaseModeClaimSql) ([ordered]@{ Value = $value; Version = $(if ($ver) { $ver } else { $null }); By = $By; Since = $since; Slot = $Slot }) 'reader' | ForEach-Object { $_ } | Where-Object { $_ })
|    if (-not $rows.Count) { return $false }
|    [int](Get-SIGuardStrictField $rows[0] 'Claimed') -eq 1
|}
|
|function Get-SIReleaseControlHoldSql {
|    @'
|IF OBJECT_ID(N'cfg.InstallState') IS NOT NULL
|BEGIN
|    SET XACT_ABORT ON;
|    BEGIN TRAN;
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = N'ReleaseControlHold')
|        UPDATE cfg.InstallState SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = N'ReleaseControlHold';
|    ELSE
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N'ReleaseControlHold', @Value, NULL, @By);
|    COMMIT;
|END
|'@
|}
|
|function Save-SIReleaseControlHold {
|    <# Hold the release fields back for 24 hours (Invardia refused a heartbeat that carried them). Never throws. #>
|    param([scriptblock]$Invoke, [Parameter(Mandatory)][datetime]$NowUtc, [string]$Why = '')
|    if (-not $Invoke) { return $false }
|    try {
|        $w = ("$Why" -replace '[\r\n\t]+', ' ').Trim(); if ($w.Length -gt 200) { $w = $w.Substring(0, 197) + '...' }
|        $v = ([ordered]@{ untilUtc = (ConvertTo-SIGuardStrictIso $NowUtc.AddHours((Get-SIReleaseControlState).HoldHours)); why = $w } | ConvertTo-Json -Compress)
|        $null = & $Invoke (Get-SIReleaseControlHoldSql) ([ordered]@{ Value = $v; By = 'telemetry' }) 'nonquery'
|        $true
|    } catch { $false }
|}
|
|function Get-SIReleaseControlInvoke {
|    <# The Pro database seam a job already has: the settings layer's store, else the guard seam. $null = none (nothing read). #>
|    try {
|        if ($global:SI_ProSettingsStore -and $global:SI_ProSettingsStore.PSObject.Properties['Invoke'] -and $global:SI_ProSettingsStore.Invoke -is [scriptblock]) { return $global:SI_ProSettingsStore.Invoke }
|        if ($global:SI_GuardInvoke -is [scriptblock]) { return $global:SI_GuardInvoke }
|        if (Get-Command -Name Get-SIGuardProInvoke -ErrorAction SilentlyContinue) { $i = Get-SIGuardProInvoke; if ($i -is [scriptblock]) { return $i } }
|    } catch { }
|    $null
|}
|
|# =====================================================================================================================
|#  Components: the scope map and the per-component fingerprints
|# =====================================================================================================================
|function Get-SIReleaseScopeMap {
|    <# The component map (config\release-scopes.locked.json under -SIRoot, or -Json). Throws when it cannot be read. #>
|    param([string]$SIRoot = (Get-SIReleaseControlState).SIRoot, [AllowEmptyString()][string]$Json)
|    if (-not "$Json".Trim()) { $Json = [System.IO.File]::ReadAllText([System.IO.Path]::Combine($SIRoot, (Get-SIReleaseControlState).ScopeMapFile)) }
|    $m = $Json.TrimStart([char]0xFEFF) | ConvertFrom-Json
|    if (-not $m.scopes -or -not $m.raReports) { throw 'the component map has no scopes' }
|    $m
|}
|
|function ConvertTo-SIReleaseGlobRegex {
|    <# PURE. A map pattern as an anchored, case-blind regex: '**' any levels, '*' text inside one level. #>
|    param([Parameter(Mandatory)][string]$Pattern)
|    $p = $Pattern.Trim().Replace('\', '/')
|    $sb = New-Object System.Text.StringBuilder
|    [void]$sb.Append('^(?i)')
|    for ($i = 0; $i -lt $p.Length; $i++) {
|        $c = $p[$i]
|        if ($c -eq '*') {
|            if ($i + 1 -lt $p.Length -and $p[$i + 1] -eq '*') {
|                $i++
|                if ($i + 1 -lt $p.Length -and $p[$i + 1] -eq '/') { $i++; [void]$sb.Append('(?:.*/)?') } else { [void]$sb.Append('.*') }
|            } else { [void]$sb.Append('[^/]*') }
|        } else { [void]$sb.Append([regex]::Escape([string]$c)) }
|    }
|    [void]$sb.Append('$')
|    $sb.ToString()
|}
|
|function Resolve-SIReleaseFileTarget {
|    <#
|        PURE. Where one engine file belongs: @{ Kind = none | scope | group | core | ra; Id }. Order: the Risk Analysis
|        report file, 'none', 'scopes', 'groups', 'core'; nothing matched = core.
|    #>
|    param([Parameter(Mandatory)][string]$Rel, [Parameter(Mandatory)]$Map)
|    $r = $Rel.Replace('\', '/').TrimStart('/')
|    if ($r -ieq [string]$Map.raReports.file) { return [pscustomobject]@{ Kind = 'ra'; Id = [string]$Map.raReports.group } }
|    $hit = { param($list) foreach ($p in @($list)) { if ($p -and $r -match (ConvertTo-SIReleaseGlobRegex $p)) { return $true } }; $false }
|    if (& $hit $Map.none) { return [pscustomobject]@{ Kind = 'none'; Id = '' } }
|    foreach ($s in @($Map.scopes)) { if (& $hit $s.patterns) { return [pscustomobject]@{ Kind = 'scope'; Id = [string]$s.id } } }
|    foreach ($g in @($Map.groups)) { if (& $hit $g.patterns) { return [pscustomobject]@{ Kind = 'group'; Id = [string]$g.id } } }
|    [pscustomobject]@{ Kind = 'core'; Id = '' }
|}
|
|function Split-SIReleaseRaReports {
|    <#
|        PURE. The Risk Analysis report file's text as its report blocks: @{ Reports = ordered name -> block text; Rest = the
|        text outside every report block }. Inside the top-level section "Reports:" only, a block starts at a line
|        "    - ReportName: <name>" (any indent) and runs until the next such line or a line that starts in column 0. The
|        report TEMPLATES (section "ReportTemplates:") are not reports: they stay in Rest (they belong to every report).
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Text)
|    $reports = [ordered]@{}; $rest = New-Object System.Text.StringBuilder
|    $cur = $null; $buf = $null; $section = ''
|    foreach ($line in @("$Text" -split "`r?`n")) {
|        $sm = [regex]::Match($line, '^(?<s>[A-Za-z_][\w-]*)\s*:')
|        if ($sm.Success) { $section = $sm.Groups['s'].Value }
|        $m = [regex]::Match($line, '^\s+-\s+ReportName:\s*(?<n>\S.*?)\s*$')
|        if ($m.Success -and $section -ceq 'Reports') {
|            if ($cur) { $reports[$cur] = $buf.ToString() }
|            $cur = $m.Groups['n'].Value.Trim('''', '"'); $buf = New-Object System.Text.StringBuilder; [void]$buf.Append($line).Append("`n"); continue
|        }
|        if ($cur -and $line -match '^[^\s#]') { $reports[$cur] = $buf.ToString(); $cur = $null; $buf = $null }
|        if ($cur) { [void]$buf.Append($line).Append("`n") } else { [void]$rest.Append($line).Append("`n") }
|    }
|    if ($cur) { $reports[$cur] = $buf.ToString() }
|    [pscustomobject]@{ Reports = $reports; Rest = $rest.ToString() }
|}
|
|function Get-SIReleaseTextSha256 {
|    param([AllowNull()][AllowEmptyString()][string]$Text)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { -join @($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes("$Text")) | ForEach-Object { $_.ToString('x2') }) } finally { $sha.Dispose() }
|}
|
|function Get-SIReleaseScopeHashes {
|    <#
|        PURE. The fingerprint of every component: -Entries = one @{ Rel; Id } per engine file (Id = the file's content id: a
|        SHA-256 of its bytes on an install, its git blob id in the publish tooling -- only ever compared with the same kind),
|        -RaText = the Risk Analysis report file's text, -Map = the component map. Returns an ordered map component id ->
|        SHA-256 (lower-case hex), sorted ordinally. A component's fingerprint covers its own files, its group's files and
|        the core files -- so a core change changes every component, a group change every component of the group.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Entries, [AllowNull()][AllowEmptyString()][string]$RaText, [Parameter(Mandatory)]$Map)
|    $bucket = @{}
|    $add = { param($k, $line) if (-not $bucket.ContainsKey($k)) { $bucket[$k] = New-Object System.Collections.Generic.List[string] }; $bucket[$k].Add($line) }
|    foreach ($e in @($Entries | Where-Object { $_ })) {
|        $rel = ([string]$e.Rel).Replace('\', '/').TrimStart('/')
|        $t = Resolve-SIReleaseFileTarget -Rel $rel -Map $Map
|        $line = '{0}|{1}' -f $rel, ([string]$e.Id).ToLowerInvariant()
|        switch ($t.Kind) {
|            'none' { }
|            'scope' { & $add ('s:' + $t.Id) $line }
|            'group' { & $add ('g:' + $t.Id) $line }
|            'ra' { }
|            default { & $add 'core' $line }
|        }
|    }
|    $ra = Split-SIReleaseRaReports -Text $RaText
|    $prefix = [string]$Map.raReports.prefix; $raGroup = [string]$Map.raReports.group
|    & $add ('g:' + $raGroup) ('{0}#rest|{1}' -f [string]$Map.raReports.file, (Get-SIReleaseTextSha256 $ra.Rest))
|    $ids = New-Object System.Collections.Generic.List[string]
|    foreach ($s in @($Map.scopes)) { $ids.Add([string]$s.id) }
|    foreach ($n in @($ra.Reports.Keys)) {
|        $id = $prefix + [string]$n
|        $ids.Add($id)
|        & $add ('s:' + $id) ('{0}#{1}|{2}' -f [string]$Map.raReports.file, $n, (Get-SIReleaseTextSha256 $ra.Reports[$n]))
|    }
|    $joined = { param($k) if ($bucket.ContainsKey($k)) { $l = $bucket[$k].ToArray(); [Array]::Sort($l, [StringComparer]::Ordinal); ($l -join "`n") } else { '' } }
|    $core = & $joined 'core'
|    $groups = @(@($Map.groups) | ForEach-Object { [string]$_.id }) + @($raGroup) | Select-Object -Unique
|    $arr = $ids.ToArray() | Select-Object -Unique
|    $arr = [string[]]@($arr); [Array]::Sort($arr, [StringComparer]::Ordinal)
|    $out = [ordered]@{}
|    foreach ($id in $arr) {
|        $g = @($groups | Where-Object { $_ -and $id.StartsWith($_, [StringComparison]::Ordinal) } | ForEach-Object { 'g ' + $_ + "`n" + (& $joined ('g:' + $_)) })
|        $out[$id] = Get-SIReleaseTextSha256 ("core`n{0}`n--`n{1}`n--`nown`n{2}" -f $core, ($g -join "`n"), (& $joined ('s:' + $id)))
|    }
|    $out
|}
|
|function Get-SIReleaseScopeHashesFromDisk {
|    <# The component fingerprints of the code under -SIRoot (an install: the release the updater just extracted). #>
|    param([Parameter(Mandatory)][string]$SIRoot, $Map)
|    if (-not $Map) { $Map = Get-SIReleaseScopeMap -SIRoot $SIRoot }
|    $root = [System.IO.Path]::GetFullPath($SIRoot)
|    $entries = New-Object System.Collections.Generic.List[object]
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try {
|        foreach ($f in @($Map.folders)) {
|            $dir = [System.IO.Path]::Combine($root, [string]$f)
|            if (-not [System.IO.Directory]::Exists($dir)) { continue }
|            foreach ($p in [System.IO.Directory]::GetFiles($dir, '*', [System.IO.SearchOption]::AllDirectories)) {
|                $rel = $p.Substring($root.Length).TrimStart('\', '/') -replace '\\', '/'
|                $id = -join @($sha.ComputeHash([System.IO.File]::ReadAllBytes($p)) | ForEach-Object { $_.ToString('x2') })
|                $entries.Add([pscustomobject]@{ Rel = $rel; Id = $id })
|            }
|        }
|    } finally { $sha.Dispose() }
|    $raPath = [System.IO.Path]::Combine($root, ([string]$Map.raReports.file).Replace('/', [System.IO.Path]::DirectorySeparatorChar))
|    $raText = if ([System.IO.File]::Exists($raPath)) { [System.IO.File]::ReadAllText($raPath) } else { '' }
|    Get-SIReleaseScopeHashes -Entries $entries.ToArray() -RaText $raText -Map $Map
|}
|
|function Invoke-SIReleaseGitText {
|    <# #917: git text (show / log) read as UTF-8 whatever the console's encoding -- setup\_shared\SI-GitText.ps1's
|       Invoke-SIGitText when this tree carries it (the release tooling), else git as before (an install's tree). #>
|    param([Parameter(Mandatory)][string]$RepoRoot, [Parameter(Mandatory)][string[]]$Arguments)
|    if (-not (Get-Command -Name Invoke-SIGitText -ErrorAction SilentlyContinue)) {
|        $gt = [System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'setup', '_shared', 'SI-GitText.ps1')
|        if ([System.IO.File]::Exists($gt)) { . $gt }
|    }
|    if (Get-Command -Name Invoke-SIGitText -ErrorAction SilentlyContinue) { return (Invoke-SIGitText -RepoRoot $RepoRoot -Arguments $Arguments) }
|    & git -C $RepoRoot @Arguments 2>$null
|}
|
|function Get-SIReleaseScopeHashesFromGit {
|    <# The component fingerprints of SOLUTIONS/SecurityInsight at -Ref of the clone -RepoRoot (git blob ids as content ids). Throws when git cannot read it. #>
|    param([Parameter(Mandatory)][string]$RepoRoot, [Parameter(Mandatory)][string]$Ref, [Parameter(Mandatory)]$Map, [string]$SolutionPath = 'SOLUTIONS/SecurityInsight')
|    $global:LASTEXITCODE = 0
|    $paths = @(@($Map.folders) | ForEach-Object { '{0}/{1}' -f $SolutionPath, $_ })
|    $lines = @(& git -C $RepoRoot ls-tree -r --full-tree $Ref -- @($paths) 2>&1)
|    if ($LASTEXITCODE -ne 0) { throw ("cannot list the engine files of '{0}': {1}" -f $Ref, ($lines -join ' ')) }
|    $entries = New-Object System.Collections.Generic.List[object]
|    foreach ($l in $lines) {
|        $m = [regex]::Match([string]$l, '^\d+\s+blob\s+(?<id>[0-9a-f]{40,64})\t(?<p>.+)$')
|        if (-not $m.Success) { continue }
|        $p = $m.Groups['p'].Value.Trim('"')
|        if (-not $p.StartsWith($SolutionPath + '/', [StringComparison]::Ordinal)) { continue }
|        $entries.Add([pscustomobject]@{ Rel = $p.Substring($SolutionPath.Length + 1); Id = $m.Groups['id'].Value })
|    }
|    $global:LASTEXITCODE = 0
|    $ra = @(Invoke-SIReleaseGitText -RepoRoot $RepoRoot -Arguments @('show', ('{0}:{1}/{2}' -f $Ref, $SolutionPath, [string]$Map.raReports.file)))
|    $raText = if ($LASTEXITCODE -eq 0) { $ra -join "`n" } else { '' }
|    $global:LASTEXITCODE = 0
|    Get-SIReleaseScopeHashes -Entries $entries.ToArray() -RaText $raText -Map $Map
|}
|
|function Compare-SIReleaseScopeHashes {
|    <#
|        PURE. Which components changed from -Previous to -Current (both: component id -> fingerprint). A component that is
|        new counts as changed; one that is gone is listed in Removed. No previous fingerprints at all = nothing changed
|        (First = $true). Returns @{ First; Changed (sorted ids); Removed; All (every component changed); Total }.
|    #>
|    param([AllowNull()][System.Collections.IDictionary]$Previous, [Parameter(Mandatory)][System.Collections.IDictionary]$Current)
|    $cur = @($Current.Keys | ForEach-Object { [string]$_ })
|    if ($null -eq $Previous -or $Previous.Count -eq 0) { return [pscustomobject]@{ First = $true; Changed = @(); Removed = @(); All = $false; Total = $cur.Count } }
|    $changed = New-Object System.Collections.Generic.List[string]
|    foreach ($k in $cur) { if (-not $Previous.Contains($k) -or [string]$Previous[$k] -ne [string]$Current[$k]) { $changed.Add($k) } }
|    $removed = @($Previous.Keys | ForEach-Object { [string]$_ } | Where-Object { -not $Current.Contains($_) })
|    $c = $changed.ToArray(); [Array]::Sort($c, [StringComparer]::Ordinal)
|    [pscustomobject]@{ First = $false; Changed = @($c); Removed = @($removed); All = ($cur.Count -gt 0 -and $c.Count -eq $cur.Count); Total = $cur.Count }
|}
|
|function Format-SIReleaseChangedScopes {
|    <#
|        PURE. The changedScopes value of a publish call: '*' when every component changed (a core file) or more than
|        -Max did, else the ids joined with ','. '' when none changed. As a list for a JSON body: -AsList.
|    #>
|    param([Parameter(Mandatory)]$Comparison, [int]$Max = (Get-SIReleaseControlState).MaxScopesListed, [switch]$AsList)
|    $c = @($Comparison.Changed)
|    if (-not $c.Count) { if ($AsList) { return , @() } else { return '' } }
|    $all = [bool]$Comparison.All -or $c.Count -gt $Max
|    if ($AsList) { if ($all) { return , @('*') } else { return , @($c) } }
|    if ($all) { return '*' }
|    $c -join ','
|}
|
|function Get-SIReleaseChangedScopesFromGit {
|    <#
|        The publish tooling: the components a release changed between -SinceRef (the previous release's commit) and -Ref,
|        judged with the component map of -Ref. Returns the Compare-SIReleaseScopeHashes result. Throws when git cannot compare
|        them -- an unknown answer is never sent as "nothing changed".
|    #>
|    param([Parameter(Mandatory)][string]$RepoRoot, [Parameter(Mandatory)][string]$SinceRef, [Parameter(Mandatory)][string]$Ref, $Map, [string]$SolutionPath = 'SOLUTIONS/SecurityInsight')
|    if (-not $Map) {
|        $global:LASTEXITCODE = 0
|        $mj = @(Invoke-SIReleaseGitText -RepoRoot $RepoRoot -Arguments @('show', ('{0}:{1}/{2}' -f $Ref, $SolutionPath, (Get-SIReleaseControlState).ScopeMapFile)))
|        $Map = if ($LASTEXITCODE -eq 0 -and $mj.Count) { Get-SIReleaseScopeMap -Json ($mj -join "`n") } else { Get-SIReleaseScopeMap }
|        $global:LASTEXITCODE = 0
|    }
|    $before = Get-SIReleaseScopeHashesFromGit -RepoRoot $RepoRoot -Ref $SinceRef -Map $Map -SolutionPath $SolutionPath
|    $after = Get-SIReleaseScopeHashesFromGit -RepoRoot $RepoRoot -Ref $Ref -Map $Map -SolutionPath $SolutionPath
|    $cmp = Compare-SIReleaseScopeHashes -Previous $before -Current $after
|    # a commit before the components existed is still compared: its fingerprints are computed with today's map
|    if ($cmp.First -and $after.Count) { $cmp = [pscustomobject]@{ First = $false; Changed = @($after.Keys); Removed = @(); All = $true; Total = $after.Count } }
|    $cmp
|}
|
|function Resolve-SIPublishChangedScopesSwitch {
|    <#
|        PURE. framework 12.22 3(b): does the publish call carry changedScopes? SI_PUBLISH_CHANGEDSCOPES = off (never, the
|        switch that turns the field off without a release) / on / auto (the default). auto = EVERY publish and ring call
|        (owner 2026-10-18 "build pending"; Invardia's changedScopes intake is live and PIM sends it on every call since
|        2026-10-16) -- -Ring only words the reason.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$EnvValue = $env:SI_PUBLISH_CHANGEDSCOPES, [int]$Ring = -1)
|    $s = "$EnvValue".Trim().ToLowerInvariant()
|    if ($s -in @('on', 'true', '1', 'yes')) { return [pscustomobject]@{ On = $true; Reason = 'SI_PUBLISH_CHANGEDSCOPES is on' } }
|    if ($s -in @('off', 'false', '0', 'no')) { return [pscustomobject]@{ On = $false; Reason = 'SI_PUBLISH_CHANGEDSCOPES is off' } }
|    [pscustomobject]@{ On = $true; Reason = $(if ($Ring -ge 0) { "ring $Ring call" } else { 'the publish call (registered only)' }) }
|}
|
|# =====================================================================================================================
|#  Components on the install: Testing / Stable (cfg.ReleaseScope)
|# =====================================================================================================================
|function Get-SIReleaseScopeReadSql {
|    "IF OBJECT_ID(N'cfg.ReleaseScope') IS NOT NULL SELECT Scope, Hash, ChangedUtc, ChangedVersion, GoodDays, LastGoodDay FROM cfg.ReleaseScope;"
|}
|
|function Get-SIReleaseScopeState {
|    <# PURE. One component row's state: Testing (its code changed and it has fewer than -GoodDays good daily runs since), else Stable. #>
|    param([Parameter(Mandatory)]$Row, [int]$GoodDays = (Get-SIReleaseControlState).StableGoodDays)
|    $ch = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $Row 'ChangedUtc')
|    if ($null -eq $ch) { return 'Stable' }
|    $n = 0; [void][int]::TryParse("$(Get-SIGuardStrictField $Row 'GoodDays')", [ref]$n)
|    if ($n -ge $GoodDays) { 'Stable' } else { 'Testing' }
|}
|
|function New-SIReleaseScopePlan {
|    <#
|        PURE. What the updater writes after installing code whose component fingerprints are -Current, given the stored rows
|        -Stored (Scope, Hash, ...). Returns @{ First; Rows (one @{ s; h; changed } per component of -Current); Changed (ids);
|        Removed (ids) }. First = nothing stored before: every component is recorded with no change (Stable) -- an install that
|        never recorded components gets no Testing state invented.
|    #>
|    param([AllowNull()][object[]]$Stored, [Parameter(Mandatory)][System.Collections.IDictionary]$Current)
|    $prev = [ordered]@{}
|    foreach ($r in @($Stored | Where-Object { $_ })) { $s = [string](Get-SIGuardStrictField $r 'Scope'); if ($s) { $prev[$s] = ([string](Get-SIGuardStrictField $r 'Hash')).Trim().ToLowerInvariant() } }
|    $cmp = Compare-SIReleaseScopeHashes -Previous $prev -Current $Current
|    $rows = New-Object System.Collections.Generic.List[object]
|    foreach ($k in @($Current.Keys)) { $rows.Add([ordered]@{ s = [string]$k; h = [string]$Current[$k]; changed = [bool](@($cmp.Changed) -contains [string]$k) }) }
|    [pscustomobject]@{ First = [bool]$cmp.First; Rows = $rows.ToArray(); Changed = @($cmp.Changed); Removed = @($cmp.Removed) }
|}
|
|function Get-SIReleaseScopeSaveSql {
|    <# ONE transaction: the component rows of -Json ([{ s, h, changed }]) -- a changed one is Testing from @Now (good runs 0),
|       an unchanged one keeps its state, a gone one is removed. #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.ReleaseScope') IS NOT NULL
|BEGIN
|    SET XACT_ABORT ON;
|    BEGIN TRAN;
|    DECLARE @j TABLE (Scope NVARCHAR(200) NOT NULL PRIMARY KEY, Hash CHAR(64) NOT NULL, Changed bit NOT NULL);
|    INSERT @j (Scope, Hash, Changed) SELECT s, h, c FROM OPENJSON(@Json) WITH (s NVARCHAR(200) '$.s', h CHAR(64) '$.h', c bit '$.changed');
|    DELETE r FROM cfg.ReleaseScope r WHERE NOT EXISTS (SELECT 1 FROM @j j WHERE j.Scope = r.Scope);
|    UPDATE r SET Hash = j.Hash, ChangedUtc = @Now, ChangedVersion = @Version, GoodDays = 0, LastGoodDay = NULL, UpdatedAt = SYSUTCDATETIME()
|      FROM cfg.ReleaseScope r JOIN @j j ON j.Scope = r.Scope WHERE j.Changed = 1;
|    INSERT cfg.ReleaseScope (Scope, Hash, ChangedUtc, ChangedVersion, GoodDays)
|      SELECT j.Scope, j.Hash, CASE WHEN j.Changed = 1 THEN @Now END, CASE WHEN j.Changed = 1 THEN @Version END, 0
|      FROM @j j WHERE NOT EXISTS (SELECT 1 FROM cfg.ReleaseScope r WHERE r.Scope = j.Scope);
|    COMMIT;
|END
|'@
|}
|
|function Save-SIReleaseScopeRecords {
|    <#
|        The UPDATER, after installing a release (-SIRoot: the extracted, verified code): the component fingerprints into
|        cfg.ReleaseScope -- a changed component is Testing from now. Never throws: @{ Ok; First; Changed; Removed; Reason }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$SIRoot, [string]$Version = '', $NowUtc)
|    try {
|        $now = if ($NowUtc) { ([datetime]$NowUtc).ToUniversalTime() } else { [datetime]::UtcNow }
|        $cur = Get-SIReleaseScopeHashesFromDisk -SIRoot $SIRoot
|        if (-not $cur.Count) { return [pscustomobject]@{ Ok = $false; First = $false; Changed = @(); Removed = @(); Reason = 'no component found in this release' } }
|        $stored = @(& $Invoke (Get-SIReleaseScopeReadSql) @{} 'reader' | ForEach-Object { $_ } | Where-Object { $_ })
|        $plan = New-SIReleaseScopePlan -Stored $stored -Current $cur
|        $ver = "$Version".Trim(); if ($ver.Length -gt 50) { $ver = $ver.Substring(0, 50) }
|        $json = ConvertTo-Json -InputObject @($plan.Rows) -Compress -Depth 3
|        $null = & $Invoke (Get-SIReleaseScopeSaveSql) ([ordered]@{ Json = $json; Now = $now; Version = $(if ($ver) { $ver } else { $null }) }) 'nonquery'
|        $why = if ($plan.First) { '{0} components recorded (the first time: none is marked Testing)' -f $cur.Count }
|               elseif (@($plan.Changed).Count) { '{0} of {1} components changed and are Testing until 3 good daily runs: {2}' -f @($plan.Changed).Count, $cur.Count, (Format-SIReleaseScopeList @($plan.Changed)) }
|               else { 'no component changed ({0} recorded)' -f $cur.Count }
|        [pscustomobject]@{ Ok = $true; First = $plan.First; Changed = @($plan.Changed); Removed = @($plan.Removed); Reason = $why }
|    } catch { [pscustomobject]@{ Ok = $false; First = $false; Changed = @(); Removed = @(); Reason = ("the components could not be recorded: {0}" -f $_.Exception.Message) } }
|}
|
|function Format-SIReleaseScopeList {
|    <# PURE. A short plain list: the first 8 ids and "and N more". #>
|    param([AllowNull()][object[]]$Ids)
|    $a = @($Ids | Where-Object { $_ })
|    if ($a.Count -le 8) { return ($a -join ', ') }
|    '{0} and {1} more' -f (($a | Select-Object -First 8) -join ', '), ($a.Count - 8)
|}
|
|function Get-SIReleaseScopesForEngine {
|    <# PURE. The components an engine run counts for: @{ Ids; Prefix } from the map's 'engines' lists (a group: every
|       component whose id starts with its prefix). Empty = the engine is no component's. #>
|    param([AllowEmptyString()][string]$Engine, [Parameter(Mandatory)]$Map)
|    $e = "$Engine".Trim().ToLowerInvariant()
|    $ids = @(); $prefix = ''
|    if (-not $e -or $e.StartsWith('flow')) { return [pscustomobject]@{ Ids = @(); Prefix = '' } }
|    foreach ($s in @($Map.scopes)) { if (@($s.engines | ForEach-Object { "$_".ToLowerInvariant() }) -contains $e) { $ids += [string]$s.id } }
|    foreach ($g in @($Map.groups)) { if (@($g.engines | ForEach-Object { "$_".ToLowerInvariant() }) -contains $e) { $prefix = [string]$g.id } }
|    [pscustomobject]@{ Ids = @($ids); Prefix = $prefix }
|}
|
|function Get-SIReleaseScopeRunSql {
|    <#
|        ONE statement for one engine run's components (-Count ids @s0..@sN and/or the prefix @Prefix):
|          good   a run that started after the change counts once per UTC day while the component is Testing
|          bad    a failed run starts the count again while it is Testing
|    #>
|    param([Parameter(Mandatory)][ValidateSet('good', 'bad')][string]$Kind, [int]$Count = 0, [switch]$HasPrefix)
|    $parts = @()
|    if ($Count -gt 0) { $parts += ('Scope IN ({0})' -f ((0..($Count - 1) | ForEach-Object { '@s' + $_ }) -join ', ')) }
|    if ($HasPrefix) { $parts += "Scope LIKE @Prefix + N'%'" }
|    $where = '(' + ($parts -join ' OR ') + ') AND ChangedUtc IS NOT NULL AND GoodDays < @Need'
|    if ($Kind -eq 'good') {
|        return ("IF OBJECT_ID(N'cfg.ReleaseScope') IS NOT NULL UPDATE cfg.ReleaseScope SET GoodDays = GoodDays + 1, LastGoodDay = @Today, UpdatedAt = SYSUTCDATETIME() WHERE {0} AND ChangedUtc <= @StartedAt AND (LastGoodDay IS NULL OR LastGoodDay < @Today);" -f $where)
|    }
|    "IF OBJECT_ID(N'cfg.ReleaseScope') IS NOT NULL UPDATE cfg.ReleaseScope SET GoodDays = 0, LastGoodDay = NULL, UpdatedAt = SYSUTCDATETIME() WHERE {0};" -f $where
|}
|
|function Update-SIReleaseScopeRun {
|    <#
|        One engine run ended (-Engine, -ExitReason success | error | ...): its components count a good daily run, or start
|        their count again. Other outcomes (partial, throttled, skipped) change nothing. A Risk Analysis run with a report
|        that is not complete (-ReportsIncomplete > 0) is not a good run. Returns $true when a statement ran. Throws on a
|        failed write (the caller decides).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [AllowEmptyString()][string]$Engine, [AllowEmptyString()][string]$ExitReason, $StartedAt, $NowUtc,
|          [long]$ReportsIncomplete = 0, $Map)
|    if (-not $Map) { $Map = Get-SIReleaseScopeMap }
|    $x = "$ExitReason".Trim().ToLowerInvariant()
|    $kind = if ($x -eq 'success' -and $ReportsIncomplete -le 0) { 'good' } elseif ($x -in @('error', 'failure', 'failed', 'settings-error')) { 'bad' } else { '' }
|    if (-not $kind) { return $false }
|    $sc = Get-SIReleaseScopesForEngine -Engine $Engine -Map $Map
|    $ids = @($sc.Ids)
|    if (-not $ids.Count -and -not $sc.Prefix) { return $false }
|    $now = if ($NowUtc) { ([datetime]$NowUtc).ToUniversalTime() } else { [datetime]::UtcNow }
|    $start = if ($StartedAt) { try { ([datetime]$StartedAt).ToUniversalTime() } catch { $now } } else { $now }
|    $p = [ordered]@{ Need = [int](Get-SIReleaseControlState).StableGoodDays }
|    for ($i = 0; $i -lt $ids.Count; $i++) { $p[('s' + $i)] = [string]$ids[$i] }
|    if ($sc.Prefix) { $p['Prefix'] = [string]$sc.Prefix }
|    if ($kind -eq 'good') { $p['Today'] = $now.Date; $p['StartedAt'] = $start }
|    $null = & $Invoke (Get-SIReleaseScopeRunSql -Kind $kind -Count $ids.Count -HasPrefix:([bool]$sc.Prefix)) $p 'nonquery'
|    $true
|}
|
|function Invoke-SIReleaseScopeRunEnd {
|    <#
|        The run-health END moment (Send-SIRunHealthRow): this run's components count it. Only the engine's own END record
|        (not a pipeline step record, not a shard other than the first), only with a Pro database the run has open, never in
|        a test session (Pester) without -Invoke. NEVER throws; $true when counted.
|    #>
|    param([AllowNull()]$RunContext, [AllowEmptyString()][string]$ExitReason, [scriptblock]$Invoke, $NowUtc)
|    try {
|        if ($null -eq $RunContext) { return $false }
|        $shard = 0; if ($RunContext.PSObject.Properties['ShardIndex']) { [void][int]::TryParse("$($RunContext.ShardIndex)", [ref]$shard) }
|        if ($shard -gt 0) { return $false }
|        if (-not $Invoke) {
|            if (Get-Module -Name Pester) { return $false }
|            $Invoke = Get-SIReleaseControlInvoke
|        }
|        if (-not $Invoke) { return $false }
|        $inc = 0L
|        if ($RunContext.PSObject.Properties['ReportsIncomplete']) { [void][long]::TryParse("$($RunContext.ReportsIncomplete)", [ref]$inc) }
|        $st = if ($RunContext.PSObject.Properties['StartedAt']) { $RunContext.StartedAt } else { $null }
|        Update-SIReleaseScopeRun -Invoke $Invoke -Engine ([string]$RunContext.Engine) -ExitReason $ExitReason -StartedAt $st -NowUtc $NowUtc -ReportsIncomplete $inc
|    } catch { $false }
|}
|
|# =====================================================================================================================
|#  The heartbeat's components + the daily evidence (framework 12.11e items 3 and 5(a); 2026-10-18)
|# =====================================================================================================================
|function ConvertTo-SIReleaseComponentWireId {
|    <#
|        PURE. One component id in the spelling Invardia's heartbeat takes for components.testingIds (its STABILITY_ID:
|        ^[a-z][a-z0-9.-]{0,59}$): lower case, '_' and spaces as '-', anything else left out, at most 60 characters, never
|        ending in '.' or '-'. '' when nothing is left (the id is then not listed; the counts still count it). The
|        changedScopes of a publish call keep the component's own spelling (Invardia takes ^[A-Za-z0-9._-]{1,80}$ there).
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Id)
|    $t = ("$Id".Trim().ToLowerInvariant() -replace '[_\s]+', '-') -replace '[^a-z0-9.-]', ''
|    $t = $t -replace '^[^a-z]+', ''
|    if ($t.Length -gt 60) { $t = $t.Substring(0, 60) }
|    $t = $t.TrimEnd('.', '-')
|    if ($t -notmatch '^[a-z][a-z0-9.-]{0,59}$') { return '' }
|    $t
|}
|
|function ConvertTo-SIReleaseComponentsWire {
|    <#
|        PURE. Testing / Stable per component for the identified heartbeat (framework 12.11e item 3), counts + the ids of the
|        components that are Testing (component ids are SecurityInsight's own names -- never a customer value):
|          { total, testing, stable, testingIds: [ id, ... ] (at most MaxScopesListed, sorted), since, version }
|        since / version: the newest code change of a component (cfg.ReleaseScope ChangedUtc / ChangedVersion); null when
|        none was ever recorded. $null when no component is recorded (an older install: the field is left out).
|    #>
|    param([AllowNull()][object[]]$Rows)
|    $rows = @($Rows | Where-Object { $_ })
|    if (-not $rows.Count) { return $null }
|    $s = Get-SIReleaseScopeSummary -Rows $rows
|    # LIVE 2026-10-18: Invardia takes a testingIds entry only as ^[a-z][a-z0-9.-]{0,59}$ and drops the WHOLE components field
|    # for one entry it does not take (only evidence.components arrived) -- a Risk Analysis report id carries capitals and
|    # underscores, so every id goes in Invardia's spelling (ConvertTo-SIReleaseComponentWireId)
|    $ids = [string[]]@(@($s.TestingIds | Where-Object { $_ } | ForEach-Object { ConvertTo-SIReleaseComponentWireId $_ } | Where-Object { $_ }) | Select-Object -Unique)
|    [Array]::Sort($ids, [StringComparer]::Ordinal)
|    $newest = $null; $ver = ''
|    foreach ($r in $rows) {
|        $c = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $r 'ChangedUtc')
|        if ($null -ne $c -and ($null -eq $newest -or $c -gt $newest)) { $newest = $c; $ver = ([string](Get-SIGuardStrictField $r 'ChangedVersion')).Trim() }
|    }
|    if ($ver -notmatch (Get-SIReleaseControlState).VersionText) { $ver = '' }
|    [ordered]@{ total = [int]$s.Total; testing = [int]$s.Testing; stable = [int]$s.Stable
|        testingIds = @($ids | Select-Object -First (Get-SIReleaseControlState).MaxScopesListed)
|        since = $(if ($newest) { ConvertTo-SIGuardStrictIso $newest } else { $null }); version = $(if ($ver) { $ver } else { $null }) }
|}
|
|function Get-SIReleaseEvidenceSql {
|    <# ONE read: the data-health state and the guard trips (halted / held / refused -- a warning or a clear is no trip) in two windows ([@Before, @From) and [@From, now]). Read-only. #>
|    @'
|SET NOCOUNT ON;
|SELECT
|    (SELECT TOP (1) [State] FROM cfg.DataHealthState WHERE OBJECT_ID(N'cfg.DataHealthState') IS NOT NULL) AS HealthState,
|    (SELECT TOP (1) Since FROM cfg.DataHealthState WHERE OBJECT_ID(N'cfg.DataHealthState') IS NOT NULL) AS HealthSince,
|    (SELECT COUNT_BIG(*) FROM cfg.GuardEvent WHERE TsUtc >= @From AND Outcome IN (N'halted', N'held', N'refused')) AS TripsSince,
|    (SELECT COUNT_BIG(*) FROM cfg.GuardEvent WHERE TsUtc >= @Before AND TsUtc < @From AND Outcome IN (N'halted', N'held', N'refused')) AS TripsBefore;
|'@
|}
|
|function Get-SIReleaseEvidenceWindow {
|    <#
|        PURE. The release the evidence is about and its two windows: -Fingerprint (cfg.InstallState 'EngineFingerprint': the
|        last release that changed engine code -- strictFrom / strictVersion), else the newest component change (-Components:
|        ConvertTo-SIReleaseComponentsWire). @{ Known; Since; Version; Before; Hours } -- Before = Since minus the same length
|        as Since -> now (at least 1 h, at most 30 days). Known $false = no release recorded: no evidence is sent.
|    #>
|    param([AllowNull()]$Fingerprint, [AllowNull()]$Components, [Parameter(Mandatory)][datetime]$NowUtc)
|    $fp = if ($Fingerprint -is [string]) { ConvertFrom-SIGuardStrictJson $Fingerprint } else { $Fingerprint }
|    $since = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $fp 'strictFrom')
|    $ver = ([string](Get-SIGuardStrictField $fp 'strictVersion')).Trim()
|    if ($null -eq $since -and $Components -and $Components['since']) { $since = ConvertTo-SIGuardStrictUtc $Components['since']; $ver = [string]$Components['version'] }
|    if ($null -eq $since) { return [pscustomobject]@{ Known = $false; Since = $null; Version = ''; Before = $null; Hours = 0 } }
|    if ("$ver" -notmatch (Get-SIReleaseControlState).VersionText) { $ver = '' }
|    $now = $NowUtc.ToUniversalTime()
|    $h = [Math]::Min(720.0, [Math]::Max(1.0, ($now - $since).TotalHours))
|    [pscustomobject]@{ Known = $true; Since = $since; Version = $ver; Before = $since.AddHours(-$h); Hours = [int][Math]::Ceiling($h) }
|}
|
|function New-SIReleaseEvidence {
|    <#
|        PURE. The daily evidence of framework 12.11e item 5(a) -- counts and verdicts only, never a name, id or value:
|          { day, version, sinceUtc, health: { state, sinceUtc } | null, guardTrips: { sinceRelease, before, windowHours,
|            verdict: ok | more }, components: { total, testing, stable } | null, verdict: ok | attention }
|        -Window: Get-SIReleaseEvidenceWindow; -Row: the Get-SIReleaseEvidenceSql row; -Components:
|        ConvertTo-SIReleaseComponentsWire. verdict 'attention' = data health Unhealthy, or more guard trips since the release
|        than in the same time before it. $null when -Window is not Known.
|    #>
|    param([Parameter(Mandatory)]$Window, [AllowNull()]$Row, [AllowNull()]$Components, [Parameter(Mandatory)][datetime]$NowUtc)
|    if (-not $Window.Known) { return $null }
|    $hs = ([string](Get-SIGuardStrictField $Row 'HealthState')).Trim()
|    $health = $null
|    if ($hs -in @('Healthy', 'Unhealthy')) {
|        $hsi = ConvertTo-SIGuardStrictUtc (Get-SIGuardStrictField $Row 'HealthSince')
|        $health = [ordered]@{ state = $hs; sinceUtc = $(if ($hsi) { ConvertTo-SIGuardStrictIso $hsi } else { $null }) }
|    }
|    $n = { param($v) $x = 0L; if ($null -ne $v) { [void][long]::TryParse("$v", [ref]$x) }; [Math]::Max(0L, $x) }
|    $ts = & $n (Get-SIGuardStrictField $Row 'TripsSince'); $tb = & $n (Get-SIGuardStrictField $Row 'TripsBefore')
|    $tripsVerdict = if ($ts -gt $tb) { 'more' } else { 'ok' }
|    $comp = $null
|    if ($Components) { $comp = [ordered]@{ total = [int]$Components['total']; testing = [int]$Components['testing']; stable = [int]$Components['stable'] } }
|    [ordered]@{
|        day        = $NowUtc.ToUniversalTime().ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture)
|        version    = $(if ($Window.Version) { $Window.Version } else { $null })
|        sinceUtc   = ConvertTo-SIGuardStrictIso $Window.Since
|        health     = $health
|        guardTrips = [ordered]@{ sinceRelease = $ts; before = $tb; windowHours = [int]$Window.Hours; verdict = $tripsVerdict }
|        components = $comp
|        verdict    = $(if (($health -and $health.state -eq 'Unhealthy') -or $tripsVerdict -eq 'more') { 'attention' } else { 'ok' })
|    }
|}
|
|function Read-SIReleaseEvidenceFields {
|    <#
|        The heartbeat's components + evidence from the Pro database (-Invoke), given the release-control rows (-Rows:
|        Read-SIReleaseControlRows). Returns @{ Components; Evidence } (each $null = left out). Throws on a failed read (the
|        caller leaves both out).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, $Rows, [Parameter(Mandatory)][datetime]$NowUtc)
|    $scopeRows = @(& $Invoke (Get-SIReleaseScopeReadSql) @{} 'reader' | ForEach-Object { $_ } | Where-Object { $_ })
|    $comp = ConvertTo-SIReleaseComponentsWire -Rows $scopeRows
|    $win = Get-SIReleaseEvidenceWindow -Fingerprint $(if ($Rows) { [string]$Rows.EngineFingerprint } else { $null }) -Components $comp -NowUtc $NowUtc
|    $ev = $null
|    if ($win.Known) {
|        $row = @(& $Invoke (Get-SIReleaseEvidenceSql) ([ordered]@{ From = $win.Since; Before = $win.Before }) 'reader' | ForEach-Object { $_ } | Where-Object { $_ }) | Select-Object -First 1
|        $ev = New-SIReleaseEvidence -Window $win -Row $row -Components $comp -NowUtc $NowUtc
|    }
|    [pscustomobject]@{ Components = $comp; Evidence = $ev }
|}
|
|function Get-SIReleaseScopeSummary {
|    <# PURE. The component rows as @{ Testing; Stable; Total; TestingIds } (for the log and the web app's view). #>
|    param([AllowNull()][object[]]$Rows)
|    $t = @(); $s = 0
|    foreach ($r in @($Rows | Where-Object { $_ })) { if ((Get-SIReleaseScopeState -Row $r) -eq 'Testing') { $t += [string](Get-SIGuardStrictField $r 'Scope') } else { $s++ } }
|    [pscustomobject]@{ Testing = $t.Count; Stable = $s; Total = $t.Count + $s; TestingIds = @($t) }
|}
'@ }
$__siSupportFiles['setup/_shared/SI-GitText.ps1'] = @{ Sha256 = '5e98e9881da0ea67c11b53f7ad388bacf621abaf7ac518d26a94eb7e573df637'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight (vendor tooling) -- GIT TEXT AS UTF-8, WHATEVER THE CONSOLE (#917).
|
|    Found 2026-10-27 (the ring 0 release 3.0.0.202610272235): Release-SI step 3e read REQUIREMENTS with `& git show
|    <commit>:...` in a detached PowerShell (Start-Process, output redirected) whose console encoding was IBM437. PowerShell
|    decodes a native command's output with [Console]::OutputEncoding, so every status mark (the open, built, paused, done and closed marks) came back
|    garbled, the parser saw 0 open items, and the backlog push removed all 500 from Invardia's backlog.
|
|    Invoke-SIGitText runs git as a process of its own and reads its standard output as UTF-8 BYTES decoded as UTF-8 -- the
|    console's encoding is never used. Every `git show` / `git log` of text in SI's release and support tooling goes through
|    it. Returns the lines (as `& git` would, without the line ends) and sets $global:LASTEXITCODE to git's exit code. Never
|    prints git's standard error (it is returned on -ErrorText when asked). PS 5.1 and 7.
|#>
|
|function ConvertTo-SIGitArgumentString {
|    <# PURE. The arguments as one command line (Windows rules: a part with a space or a quote is quoted, a quote doubled
|       with a backslash) -- for Windows PowerShell 5.1, whose ProcessStartInfo has no ArgumentList. #>
|    param([string[]]$Arguments)
|    (@($Arguments) | ForEach-Object {
|        $a = [string]$_
|        if ($a -eq '') { '""' }
|        elseif ($a -match '[\s"]') { '"' + ($a -replace '(\\*)"', '$1$1\"' -replace '(\\+)$', '$1$1') + '"' }
|        else { $a }
|    }) -join ' '
|}
|
|function Invoke-SIGitText {
|    <#
|        git -C <RepoRoot> <Arguments>, its output read as UTF-8 whatever the console encoding. Returns string[] (one per line).
|        -RepoRoot: the repository (omitted = the current folder). -Git: the git executable (default 'git'). -ErrorText
|        [ref]: git's standard error. Sets $global:LASTEXITCODE.
|    #>
|    param([string]$RepoRoot, [Parameter(Mandatory)][string[]]$Arguments, [string]$Git = 'git', [ref]$ErrorText)
|    $all = New-Object System.Collections.Generic.List[string]
|    if ("$RepoRoot".Trim()) { $all.Add('-C'); $all.Add($RepoRoot) }
|    foreach ($a in @($Arguments)) { $all.Add([string]$a) }
|    $psi = New-Object System.Diagnostics.ProcessStartInfo
|    $psi.FileName = $Git
|    $psi.UseShellExecute = $false
|    $psi.RedirectStandardOutput = $true
|    $psi.RedirectStandardError = $true
|    $psi.CreateNoWindow = $true
|    $utf8 = New-Object System.Text.UTF8Encoding($false)
|    $psi.StandardOutputEncoding = $utf8
|    $psi.StandardErrorEncoding = $utf8
|    if ($psi.PSObject.Properties['ArgumentList'] -and $null -ne $psi.ArgumentList) { foreach ($a in $all) { $psi.ArgumentList.Add($a) } }
|    else { $psi.Arguments = ConvertTo-SIGitArgumentString -Arguments $all.ToArray() }
|    $p = [System.Diagnostics.Process]::Start($psi)
|    try {
|        $errTask = $p.StandardError.ReadToEndAsync()
|        $text = $p.StandardOutput.ReadToEnd()
|        $p.WaitForExit()
|        $err = $errTask.GetAwaiter().GetResult()
|        $global:LASTEXITCODE = $p.ExitCode
|    } finally { $p.Dispose() }
|    if ($ErrorText) { $ErrorText.Value = $err }
|    if (-not $text) { return @() }
|    $text = $text.TrimStart([char]0xFEFF)
|    if ($text.EndsWith("`n")) { $text = $text.Substring(0, $text.Length - 1) }
|    [string[]]($text -split "`r?`n")
|}
|
|function Get-SIGitFileText {
|    <# The text of <Ref>:<Path> (git show), decoded as UTF-8 whatever the console; lines joined with "`n". '' when git
|       could not show it ($global:LASTEXITCODE says why). #>
|    param([string]$RepoRoot, [Parameter(Mandatory)][string]$Ref, [Parameter(Mandatory)][string]$Path)
|    $l = @(Invoke-SIGitText -RepoRoot $RepoRoot -Arguments @('show', ('{0}:{1}' -f $Ref, $Path)))
|    if ($global:LASTEXITCODE -ne 0) { return '' }
|    (@($l) -join "`n")
|}
'@ }
$__siSupportFiles['config/release-scopes.locked.json'] = @{ Sha256 = '437593be3495b4ce842f0c50948705e26aed6a6631618db6ecc4fd29afa7a5d3'; Text = @'
|{
|  "_": "THE COMPONENTS OF A RELEASE (CR3, SI #657; framework DOCS/REQUIREMENTS.md 12.11e item 3). SecurityInsight's components -- the collections per source, the correlation, Risk Analysis per report and data out per channel -- each with the engine files that are its code. engine/_shared/SI-ReleaseControl.ps1 reads this file: (1) the publish call says which components a release changed (changedScopes), (2) the updater fingerprints each component of the code it installed and marks a changed one 'Testing' (cfg.ReleaseScope), (3) a component is 'Stable' again after 3 good daily runs with no code change. Matching: a path is relative to the solution root with '/' separators; '*' is any text inside one folder level, '**' any number of levels. The FIRST list that matches wins, in this order: 'none' (not code of any component: samples, read-me files, and the jobs that are not one of the components -- verification, trend, schema discovery, the hourly status report), 'scopes' (one component), 'groups' (every component whose id starts with the group's prefix), 'core'. A file in the engine folders that matches nothing counts as CORE: a change to it marks EVERY component Testing (the same rule as PIM's: a core file = all scopes). Risk Analysis per report: each report block of 'raReports.file' is its own component '<prefix><ReportName>'; the rest of that file belongs to the group 'raReports.group'.",
|  "schema": 1,
|  "folders": [ "engine", "launcher", "risk-analysis-detection" ],
|  "raReports": { "file": "risk-analysis-detection/RiskAnalysis_Queries_Locked.yaml", "prefix": "risk-analysis.", "group": "risk-analysis." },
|  "none": [
|    "**/*.sample",
|    "**/*.sample.*",
|    "**/*.custom.sample.*",
|    "**/README.md",
|    "**/*.md",
|    "engine/verification/**",
|    "engine/heartbeat/**",
|    "engine/_shared/SI-HeartbeatJob.ps1",
|    "engine/index-build/**",
|    "engine/asset-trend/**",
|    "launcher/asset-trend/**",
|    "engine/asset-profiling/stages/Invoke-Schema*.ps1",
|    "engine/asset-profiling/lint/**"
|  ],
|  "scopes": [
|    {
|      "id": "collection.identity",
|      "label": "Collection: identities (Entra ID)",
|      "engines": [ "identity" ],
|      "patterns": [
|        "launcher/identity/**",
|        "engine/asset-profiling/discovery/Get-DiscoveryFromEntra*.ps1",
|        "engine/asset-profiling/discovery/Get-DiscoveryFromIdentityExposureGraph.ps1",
|        "engine/asset-profiling/discovery/Get-SIEntraContext.ps1",
|        "engine/asset-profiling/shared/Build-IdentityProfileRow.ps1",
|        "engine/asset-profiling/shared/IdentityCatalogTierComputer.ps1",
|        "engine/asset-profiling/shared/IdentityRoleFetcher.ps1",
|        "engine/asset-profiling/shared/SI-AuthMethodsRead.ps1",
|        "engine/asset-profiling/shared/SI-SignInMethodsChoice.ps1",
|        "engine/signin-methods/**",
|        "engine/asset-profiling/shared/SI-IdentityPublishScope.ps1"
|      ]
|    },
|    {
|      "id": "collection.endpoint",
|      "label": "Collection: devices (Defender for Endpoint, Intune)",
|      "engines": [ "endpoint" ],
|      "patterns": [
|        "launcher/endpoint/**",
|        "engine/asset-profiling/discovery/Get-DiscoveryFromMDE.ps1",
|        "engine/asset-profiling/discovery/Get-DiscoveryFromEndpointViaEG.ps1",
|        "engine/asset-profiling/discovery/Get-SIDefender*.ps1",
|        "engine/asset-profiling/discovery/Get-SIIntuneContext.ps1",
|        "engine/asset-profiling/shared/Build-EndpointProfileRow.ps1",
|        "engine/asset-profiling/shared/EndpointCatalogTierComputer.ps1",
|        "engine/asset-profiling/shared/EndpointAzureCorrelationCache.ps1",
|        "engine/asset-profiling/shared/endpoint-tiering.json",
|        "engine/asset-profiling/shared/server-applications.json"
|      ]
|    },
|    {
|      "id": "collection.azure",
|      "label": "Collection: Azure resources and Defender for Cloud",
|      "engines": [ "azure" ],
|      "patterns": [
|        "launcher/azure/**",
|        "engine/asset-profiling/discovery/*Azure*.ps1",
|        "engine/asset-profiling/discovery/Get-DiscoveryFromARG.ps1",
|        "engine/asset-profiling/discovery/Invoke-SIArgPaged.ps1",
|        "engine/asset-profiling/discovery/Get-SIMdc*.ps1",
|        "engine/asset-profiling/shared/Build-AzureProfileRow.ps1",
|        "engine/asset-profiling/shared/AzureParentScopeCache.ps1",
|        "engine/data-model/SI-AzureChildren.ps1"
|      ]
|    },
|    {
|      "id": "collection.publicip",
|      "label": "Collection: public IP addresses",
|      "engines": [ "publicip" ],
|      "patterns": [
|        "launcher/publicip/**",
|        "engine/asset-profiling/discovery/Get-DiscoveryFromShodan.ps1",
|        "engine/asset-profiling/shared/Build-PublicIpProfileRow.ps1",
|        "engine/asset-profiling/storage/ShodanCache.ps1"
|      ]
|    },
|    {
|      "id": "collection.privilege-tier",
|      "label": "Collection: privilege tiers",
|      "engines": [ "privilege-tier-classifier" ],
|      "patterns": [
|        "launcher/privilege-tier-classifier/**",
|        "engine/privilege-tier-classifier/**"
|      ]
|    },
|    {
|      "id": "collection.asset-properties",
|      "label": "Collection: asset properties",
|      "engines": [ "asset-properties" ],
|      "patterns": [
|        "launcher/asset-properties/**",
|        "engine/asset-properties/**"
|      ]
|    },
|    {
|      "id": "correlation",
|      "label": "Correlation",
|      "engines": [ "asset-correlation", "correlation" ],
|      "patterns": [
|        "launcher/asset-correlation/**",
|        "engine/asset-correlation/**",
|        "engine/data-model/SI-Ci*.ps1",
|        "engine/data-model/identity/**"
|      ]
|    },
|    {
|      "id": "data-out.cmdb",
|      "label": "Data out: CMDB hand-off",
|      "engines": [ "asset-cmdb", "cmdb", "asset-cmdb-sql" ],
|      "patterns": [
|        "launcher/asset-cmdb/**",
|        "engine/asset-cmdb/Invoke-SICmdb*.ps1",
|        "engine/asset-cmdb/_shared/SI-Cmdb*.ps1",
|        "engine/asset-cmdb/_shared/SI-ServiceNowClient.ps1",
|        "engine/asset-cmdb/_shared/SI-SnowImportSet.ps1",
|        "engine/asset-cmdb/_shared/SI-SnowTestPack.ps1",
|        "engine/asset-cmdb/_shared/SI-ServiceModel.ps1",
|        "engine/asset-cmdb/_shared/SI-AssetLifecycle.ps1",
|        "engine/asset-cmdb/_shared/SI-CollectionSend.ps1",
|        "engine/asset-cmdb/_shared/SI-ReconcileGuards.ps1"
|      ]
|    },
|    {
|      "id": "data-out.vulnerabilities",
|      "label": "Data out: vulnerability tickets",
|      "engines": [ "vuln-closeloop", "asset-vulnerabilities", "asset-vulnerabilities-servicenow" ],
|      "patterns": [
|        "engine/asset-cmdb/Invoke-SIVulnLoop.ps1",
|        "engine/asset-cmdb/_shared/SI-Vuln*.ps1"
|      ]
|    },
|    {
|      "id": "data-out.mail",
|      "label": "Data out: mail (close-loop, exemptions, governance, digests)",
|      "engines": [ "close-loop-mail" ],
|      "patterns": [
|        "engine/asset-cmdb/Invoke-SICloseLoopMail.ps1",
|        "engine/asset-cmdb/_shared/SI-CloseLoopMail.ps1",
|        "engine/asset-cmdb/_shared/SI-ExemptionMail.ps1",
|        "engine/pro-data/Invoke-SIGovernanceMail.ps1",
|        "engine/pro-data/Invoke-SITaskDigest.ps1",
|        "engine/pro-data/Invoke-SIDepartmentReport.ps1",
|        "engine/pro-data/_shared/SI-GovernanceMail.ps1",
|        "engine/pro-data/_shared/SI-TaskDigest.ps1",
|        "engine/pro-data/_shared/SI-DepartmentReport.ps1"
|      ]
|    },
|    {
|      "id": "data-out.sql",
|      "label": "Data out: the data sync to SQL",
|      "engines": [ "datasync", "asset-datasync" ],
|      "patterns": [
|        "engine/pro-data/Invoke-SIDataSync.ps1",
|        "engine/pro-data/_shared/SI-Data*.ps1",
|        "engine/pro-data/_shared/SI-ExemptedView.ps1"
|      ]
|    },
|    {
|      "id": "data-out.outputs",
|      "label": "Data out: listed outputs (workbooks, ServiceNow import sets)",
|      "engines": [ "data-out" ],
|      "patterns": [
|        "engine/data-out/**",
|        "engine/data-model/SI-OutputMapper.ps1"
|      ]
|    },
|    {
|      "id": "data-out.tagging",
|      "label": "Data out: asset tags",
|      "engines": [ "asset-tagging" ],
|      "patterns": [
|        "launcher/asset-tagging/**",
|        "engine/asset-tagging/**",
|        "engine/asset-profiling/stages/Invoke-Tagging.ps1"
|      ]
|    }
|  ],
|  "groups": [
|    {
|      "id": "risk-analysis.",
|      "label": "Risk Analysis (every report)",
|      "engines": [ "risk-analysis", "risk-analysis-detailed" ],
|      "patterns": [
|        "launcher/risk-analysis/**",
|        "engine/risk-analysis/**",
|        "risk-analysis-detection/**"
|      ]
|    }
|  ],
|  "core": [
|    "engine/_shared/**",
|    "engine/asset-profiling/**",
|    "engine/data-model/**",
|    "engine/pro-settings/**",
|    "engine/pro-data/**",
|    "engine/flow/**",
|    "launcher/_lib/**",
|    "engine/SI-FeatureCatalog.ps1"
|  ]
|}
'@ }
$__siSupportFiles['engine/_shared/SI-ReportedRing.ps1'] = @{ Sha256 = 'cc4938cf08721e6a53224eb74278fc381ff71b5ae414593941c6f5cc37b5140d'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE RING THIS INSTALL REPORTS (framework §8.4 / §8.7): every heartbeat and run report carries it, so
|    Invardia can judge the install's update level against the version approved for its ring. The SAME order the web app's
|    header uses (HeaderContext.RingOf): the updater's state > the ring recorded for the install > the setting SI_UpdateRing.
|
|    PURE, both editions (the telemetry sender ships in Community too). The two Pro database rows it reads are fetched by
|    Read-SIInstallRingFacts (engine\_shared\SI-InstallRing.ps1, Pro). Rings are the framework's: 0 dev, 1 internal,
|    2 early release, 3 broad. PS 5.1 and 7.
|#>
|
|function ConvertTo-SIReportedRing {
|    <# PURE. A ring as the product writes it -- 0..3 (number or text), 'r0'..'r3', 'ring 1', 'prod' (= 3) -- or $null. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or $Value -is [bool]) { return $null }
|    $t = ("$Value").Trim().ToLowerInvariant()
|    if (-not $t) { return $null }
|    if ($t -eq 'prod') { return 3 }
|    $t = $t -replace '^(ring\s*|r)', ''
|    $n = 0
|    if (-not [int]::TryParse($t, [System.Globalization.NumberStyles]::Integer, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$n)) { return $null }
|    if ($n -lt 0 -or $n -gt 3) { return $null }
|    [int]$n
|}
|
|function Get-SIRingFromUpdateState {
|    <#
|        PURE. The ring in the updater's state: the compact cfg.InstallState 'UpdateState' row ({ code: { ring } }) or the
|        full SI-Update-State ({ code: { lastRing, appliedRing } }). Code first, then templates -- as the header reads it.
|        $null when the updater has recorded no ring.
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Json)
|    if ([string]::IsNullOrWhiteSpace($Json)) { return $null }
|    try { $o = $Json | ConvertFrom-Json -ErrorAction Stop } catch { return $null }
|    if (-not $o) { return $null }
|    foreach ($kind in 'code', 'templates') {
|        if (-not $o.PSObject.Properties[$kind] -or $null -eq $o.$kind) { continue }
|        $k = $o.$kind
|        foreach ($f in 'ring', 'lastRing', 'appliedRing') {
|            if ($k.PSObject.Properties[$f] -and $null -ne $k.$f) { $r = ConvertTo-SIReportedRing $k.$f; if ($null -ne $r) { return $r } }
|        }
|    }
|    $null
|}
|
|function Get-SIRingFromInstallRow {
|    <# PURE. The ring in the install's recorded row (cfg.InstallState 'Ring': { "ring": 1, ... }), or $null. #>
|    param([AllowNull()][AllowEmptyString()][string]$Json)
|    if ([string]::IsNullOrWhiteSpace($Json)) { return $null }
|    try { $o = $Json | ConvertFrom-Json -ErrorAction Stop } catch { return $null }
|    if (-not $o -or -not $o.PSObject.Properties['ring']) { return $null }
|    ConvertTo-SIReportedRing $o.ring
|}
|
|function Resolve-SIReportedRing {
|    <#
|        PURE. The ring an uplink report carries, and where it came from. In order:
|          1. -UpdaterRing      the ring the updater resolved in THIS process (the updater's own reports;
|                               the guided install passes the ring it installs with)                  source 'updater'
|          2. -UpdateStateJson  the updater's recorded state (cfg.InstallState 'UpdateState')          source 'updater-state'
|          3. -InstallRingJson  the ring recorded for the install (cfg.InstallState 'Ring')            source 'install'
|          4. -Setting          SI_UpdateRing (the Pro database, else the configuration)              source 'setting'
|          5. -CommunityRing    a Community install's ring from config\update.custom.json             source 'community'
|        Returns @{ Ring (0..3 or $null); Source }. A value that is not a ring is skipped, never guessed.
|    #>
|    param([AllowNull()]$UpdaterRing, [AllowNull()][AllowEmptyString()][string]$UpdateStateJson, [AllowNull()][AllowEmptyString()][string]$InstallRingJson,
|          [AllowNull()]$Setting, [AllowNull()]$CommunityRing)
|    $r = ConvertTo-SIReportedRing $UpdaterRing
|    if ($null -ne $r) { return [pscustomobject]@{ Ring = $r; Source = 'updater' } }
|    $r = Get-SIRingFromUpdateState -Json $UpdateStateJson
|    if ($null -ne $r) { return [pscustomobject]@{ Ring = $r; Source = 'updater-state' } }
|    $r = Get-SIRingFromInstallRow -Json $InstallRingJson
|    if ($null -ne $r) { return [pscustomobject]@{ Ring = $r; Source = 'install' } }
|    $r = ConvertTo-SIReportedRing $Setting
|    if ($null -ne $r) { return [pscustomobject]@{ Ring = $r; Source = 'setting' } }
|    $r = ConvertTo-SIReportedRing $CommunityRing
|    if ($null -ne $r) { return [pscustomobject]@{ Ring = $r; Source = 'community' } }
|    [pscustomobject]@{ Ring = $null; Source = '' }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-SetupUplink.ps1'] = @{ Sha256 = '1469eccdafbdbfdd5593137aefe8dc2b553d25b0d24464550ec02ffcf6832730'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- the SETUP status report (uplink Kind = setup, framework §8.7 UPLINK-SETUP, #491): the control list of
|    critical parameters, so Invardia's customer health dashboard can show what is set and what is not.
|
|    THE CLOSED LIST is config\setup-catalog.locked.json ({ product, steps[], findings[], controls[] }; every item { id, title,
|    why, fix, docUrl? } + required (steps), productDefect (findings), enum + critical (controls), retired). Ids are stable
|    and lower-case and never removed. The release hands it over to Invardia as
|    <handover>\docs\securityinsight\<version>\setup-catalog.json (setup\Release-SI.ps1) with the released version added.
|
|    WHICH CONTROLS ARE SENT -- the setting SI_Telemetry_SetupControls:
|      all (default)      every control in the catalog (the framework minimum + SecurityInsight's extras). Invardia refuses the
|                         WHOLE report when it carries an id it does not know, so a refused 'all' report is sent again ONCE
|                         with only the minimum list, and said once (SI-TelemetrySend.ps1).
|      minimum            only the framework's minimum control set (Get-SISetupMinimumControlIds).
|      off                no setup report (the heartbeat and run reports are not affected).
|    The telemetry switch SI_Telemetry_Enabled = $false turns this off too.
|
|    WHAT IS SENT: identified installs only (an install key); an anonymous install never sends a setup report. Every control
|    in scope is in every report -- a control that could not be checked is 'unknown', never left out. `value` only for a
|    control declared with an enum, and only one of its values (the ring 1|2|3, the updater schedule, ...). Never a secret,
|    a user or group name, or error text.
|
|    PURE builders + one state reader; SI-TelemetrySend.ps1 queues the report with the daily heartbeat. PS 5.1 and 7.
|#>
|
|if (-not (Get-Command -Name ConvertTo-SIReportedRing -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-ReportedRing.ps1')) }
|
|function Get-SISetupUplinkState {
|    <# The value of $script:SISetupUplink, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SISetupUplink) { $script:SISetupUplink = @{
|    SIRoot      = (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))
|    CatalogFile = 'setup-catalog.locked.json'
|    Product     = 'securityinsight'
|    # The framework's minimum control set as Invardia's closed list holds it today (data/setup/securityinsight.json, seed).
|    # Every catalog control is sent by default (SI_Telemetry_SetupControls = all); this minimum list is the fallback when Invardia refuses that report.
|    Minimum     = @('updater-deployed', 'updater-schedule', 'update-ring', 'uplink-key', 'licence-valid', 'mail-sender',
|                    'alert-recipients', 'identity-permissions', 'last-run-24h', 'backup-configured', 'update-pinned')
|    States      = @('ok', 'missing', 'wrong', 'unknown')
|    Scopes      = @('minimum', 'all', 'off')
|    IdPattern   = '^[a-z0-9][a-z0-9.-]{0,59}$'
|} }
|    , $script:SISetupUplink
|}
|$script:SISetupUplink = $null; $null = Get-SISetupUplinkState
|
|function Get-SISetupMinimumControlIds { @((Get-SISetupUplinkState).Minimum) }
|
|function Get-SISetupCatalog {
|    <# The closed list (config\setup-catalog.locked.json) as an object. Throws when it cannot be read -- a release must not hand over a broken list. #>
|    param([string]$SIRoot = (Get-SISetupUplinkState).SIRoot)
|    $f = [System.IO.Path]::Combine($SIRoot, 'config', (Get-SISetupUplinkState).CatalogFile)
|    [IO.File]::ReadAllText($f).TrimStart([char]0xFEFF) | ConvertFrom-Json -ErrorAction Stop
|}
|
|function ConvertTo-SISetupCatalogHandover {
|    <#
|        PURE. The hand-over file for Invardia: { product, version, steps, findings, controls } -- exactly the fields Invardia's
|        import accepts (no note, no other field), the version the release published. Returns the JSON text.
|    #>
|    param([Parameter(Mandatory)]$Catalog, [Parameter(Mandatory)][string]$Version)
|    $o = [ordered]@{ product = [string]$Catalog.product; version = $Version.Trim()
|                     steps = @($Catalog.steps); findings = @($Catalog.findings); controls = @($Catalog.controls) }
|    ConvertTo-Json -InputObject $o -Depth 6
|}
|
|function Resolve-SISetupControlScope {
|    <# PURE. SI_Telemetry_SetupControls -> minimum | all | off. Not set or not one of them = all (the default, owner
|       2026-10-18: "telemetry must be on"); a report Invardia refuses with 'all' goes again once with the minimum list
|       (Send-SITelemetryRunEnd). #>
|    param([AllowNull()]$Value)
|    $v = "$Value".Trim().Trim('$').ToLowerInvariant()
|    if ($v -in @('false', 'none', 'disabled')) { $v = 'off' }
|    if ((Get-SISetupUplinkState).Scopes -contains $v) { return $v }
|    'all'
|}
|
|function Get-SISetupControlIds {
|    <# PURE. The control ids a report carries for -Scope: minimum = the framework minimum; all = every catalog control not retired. #>
|    param([Parameter(Mandatory)]$Catalog, [Parameter(Mandatory)][ValidateSet('minimum', 'all', 'off')][string]$Scope)
|    if ($Scope -eq 'off') { return @() }
|    $live = @(@($Catalog.controls) | Where-Object { $_ -and -not ($_.PSObject.Properties['retired'] -and $_.retired) } | ForEach-Object { [string]$_.id })
|    if ($Scope -eq 'all') { return $live }
|    @((Get-SISetupUplinkState).Minimum | Where-Object { $live -contains $_ })
|}
|
|function Get-SISetupControlStates {
|    <#
|        PURE. What this process can tell about the controls, from the telemetry context and the run that is ending:
|          update-ring       the reported ring (value 1|2|3; ring 0 = development: ok without a value); none = missing
|          uplink-key        identified (an install key) = ok, else missing
|          licence-valid     valid = ok, grace / expired = wrong, none = missing
|          licence-edition   the edition (value)
|          last-run-24h      this run ended ok = ok (another outcome says nothing about the last 24 hours: unknown)
|          updater-deployed / updater-schedule   the updater checked within 3 days (its recorded state) = ok / enabled
|        Everything else stays unknown (the report says 'unknown', never leaves it out). Returns id -> @{ State; Value }.
|    #>
|    param([Parameter(Mandatory)]$Context, [AllowEmptyString()][string]$ExitReason = '', [AllowNull()][AllowEmptyString()][string]$UpdateStateJson,
|          [datetime]$NowUtc = [datetime]::UtcNow,
|          # job-layout: the update's pipeline-schedule check (cfg.InstallState 'PipelineSchedule', within 3 days): ok / repaired
|          # = ok; would-repair / failed = wrong ("neither mode": the pipeline not scheduled and no job of it on its own timer)
|          [AllowNull()][AllowEmptyString()][string]$PipelineScheduleJson,
|          # secret-handover: the updater's hand-over key check (cfg.InstallState 'SecretHandover', within 3 days): ok, or missing =
|          # the updater may not use its Key Vault key until the updater setup is re-run with its role grants
|          [AllowNull()][AllowEmptyString()][string]$SecretHandoverJson)
|    $s = @{}
|    $prop = { param($n) if ($Context.PSObject.Properties[$n]) { $Context.$n } else { $null } }
|    $ring = ConvertTo-SIReportedRing (& $prop 'Ring')
|    $s['update-ring'] = if ($null -eq $ring) { @{ State = 'missing' } } elseif ($ring -ge 1) { @{ State = 'ok'; Value = [string]$ring } } else { @{ State = 'ok' } }
|    $s['uplink-key'] = @{ State = $(if ("$(& $prop 'Mode')" -eq 'identified') { 'ok' } else { 'missing' }) }
|    switch ("$(& $prop 'LicenceState')") { 'valid' { $s['licence-valid'] = @{ State = 'ok' } } 'grace' { $s['licence-valid'] = @{ State = 'wrong' } }
|                                         'expired' { $s['licence-valid'] = @{ State = 'wrong' } } 'none' { $s['licence-valid'] = @{ State = 'missing' } } }
|    $ed = "$(& $prop 'Edition')"; if ($ed) { $s['licence-edition'] = @{ State = 'ok'; Value = $ed } }
|    if ("$ExitReason" -eq 'success') { $s['last-run-24h'] = @{ State = 'ok' } }
|    if (-not [string]::IsNullOrWhiteSpace($UpdateStateJson)) {
|        try {
|            $o = $UpdateStateJson | ConvertFrom-Json -ErrorAction Stop
|            $last = $null
|            if ($o -and $o.PSObject.Properties['lastCheckUtc'] -and $o.lastCheckUtc) {
|                $d = [datetime]::MinValue
|                if ($o.lastCheckUtc -is [datetime]) { $last = $o.lastCheckUtc.ToUniversalTime() }
|                elseif ([datetime]::TryParse("$($o.lastCheckUtc)", [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]'AdjustToUniversal, AssumeUniversal', [ref]$d)) { $last = $d }
|            }
|            if ($last -and ($NowUtc.ToUniversalTime() - $last).TotalDays -le 3) {
|                $s['updater-deployed'] = @{ State = 'ok' }; $s['updater-schedule'] = @{ State = 'ok'; Value = 'enabled' }
|            }
|        } catch { }
|    }
|    if (-not [string]::IsNullOrWhiteSpace($PipelineScheduleJson)) {
|        try {
|            $p = $PipelineScheduleJson | ConvertFrom-Json -ErrorAction Stop
|            $at = [datetime]::MinValue
|            $fresh = $p.PSObject.Properties['checkedUtc'] -and [datetime]::TryParse("$($p.checkedUtc)", [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]'AdjustToUniversal, AssumeUniversal', [ref]$at) -and ($NowUtc.ToUniversalTime() - $at).TotalDays -le 3
|            if ($fresh) {
|                switch ("$($p.state)") { 'ok' { $s['job-layout'] = @{ State = 'ok' } } 'repaired' { $s['job-layout'] = @{ State = 'ok' } }
|                                         'would-repair' { $s['job-layout'] = @{ State = 'wrong' } } 'failed' { $s['job-layout'] = @{ State = 'wrong' } } }
|            }
|        } catch { }
|    }
|    if (-not [string]::IsNullOrWhiteSpace($SecretHandoverJson)) {
|        try {
|            $h = $SecretHandoverJson | ConvertFrom-Json -ErrorAction Stop
|            $at2 = [datetime]::MinValue
|            $fresh2 = $h.PSObject.Properties['checkedUtc'] -and [datetime]::TryParse("$($h.checkedUtc)", [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]'AdjustToUniversal, AssumeUniversal', [ref]$at2) -and ($NowUtc.ToUniversalTime() - $at2).TotalDays -le 3
|            if ($fresh2 -and "$($h.state)" -in @('ok', 'missing')) { $s['secret-handover'] = @{ State = "$($h.state)" } }
|        } catch { }
|    }
|    $s
|}
|
|function New-SISetupReport {
|    <#
|        PURE. The Kind=setup record for the uplink, or $null when nothing is to be sent (not identified, or -Scope off).
|        Every control of -Scope is in it (Get-SISetupControlIds); a control without a state in -States is 'unknown'. A state
|        outside the closed list becomes 'unknown'; a value is kept only for a control declared with an enum and only when
|        it is one of the enum's values. Ids in -States outside the scope are NOT sent (an unknown id rejects the report).
|        Fields: Schema, Kind, Product, Version, Ring, Edition, LastSeenUtc, Controls -- nothing else (Invardia refuses any
|        other field on a setup report).
|    #>
|    param([Parameter(Mandatory)]$Context, [Parameter(Mandatory)]$Catalog, [System.Collections.IDictionary]$States = @{},
|          [ValidateSet('minimum', 'all', 'off')][string]$Scope = 'minimum', $Now)
|    if ($Scope -eq 'off') { return $null }
|    if ("$($Context.Mode)" -ne 'identified') { return $null }
|    $ts = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|    $defs = @{}; foreach ($c in @($Catalog.controls)) { if ($c) { $defs[[string]$c.id] = $c } }
|    $controls = New-Object System.Collections.Generic.List[object]
|    foreach ($id in @(Get-SISetupControlIds -Catalog $Catalog -Scope $Scope)) {
|        if ($id -notmatch (Get-SISetupUplinkState).IdPattern) { continue }
|        $st = $States[$id]
|        $state = if ($st -and (Get-SISetupUplinkState).States -contains "$($st.State)") { "$($st.State)" } else { 'unknown' }
|        $item = [ordered]@{ id = $id; state = $state }
|        $def = $defs[$id]
|        if ($st -and $null -ne $st.Value -and "$($st.Value)" -ne '' -and $def -and $def.PSObject.Properties['enum'] -and (@($def.enum) -contains "$($st.Value)")) { $item['value'] = "$($st.Value)" }
|        $controls.Add([pscustomobject]$item)
|    }
|    $o = [ordered]@{ Schema = 2; Kind = 'setup'; Product = (Get-SISetupUplinkState).Product }
|    $ver = "$($Context.Version)".Trim(); if ($ver -match '^[0-9A-Za-z.+-]{1,50}$') { $o['Version'] = $ver }
|    $ring = $null; if ($Context.PSObject.Properties['Ring']) { $ring = ConvertTo-SIReportedRing $Context.Ring }
|    if ($null -ne $ring) { $o['Ring'] = [int]$ring }
|    $ed = "$($Context.Edition)".Trim().ToLowerInvariant(); if (@('community', 'pro', 'trial') -contains $ed) { $o['Edition'] = $ed }
|    $o['LastSeenUtc'] = $ts.ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture)
|    $o['Controls'] = $controls.ToArray()
|    [pscustomobject]$o
|}
'@ }
$__siSupportFiles['engine/_shared/SI-LicenceSuperseded.ps1'] = @{ Sha256 = '5da16885e4d22cddd570e1036645e9781a59c301218738c9f61aa6991ccb2ac9'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- A RE-ISSUED LICENCE REACHES THE INSTALL BY ITSELF (#517; framework DOCS/REQUIREMENTS.md §12.6b,
|    Invardia live 1.0.230).
|
|    HOW: every IDENTIFIED status report carries the installed licence's id (LicenceId, a lower-case GUID -- left out when
|    the licence has no GUID-shaped id, else Invardia refuses the whole report). When Invardia has re-issued that licence it
|    answers 202 {"supersededBy": "<newest id>"}. The engine run that hears it records the id here, in the Pro database
|    (cfg.InstallState 'LicenceSupersededBy', on the connection the run already has); the updater's licence step reads it on
|    its next run and knocks at once with currentLicenceId -- Invardia then approves the successor by itself and the normal
|    pull installs it (verified offline as every licence is). The same id is knocked for only once.
|
|    The marker only says "ask now"; nothing is trusted from it -- the licence itself is verified as always. PS 5.1 + 7.
|#>
|
|function Get-SILicenceSupersededNameState {
|    <# The value of $script:SILicenceSupersededName, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SILicenceSupersededName) { $script:SILicenceSupersededName = 'LicenceSupersededBy' }
|    , $script:SILicenceSupersededName
|}
|$script:SILicenceSupersededName = $null; $null = Get-SILicenceSupersededNameState
|function Get-SILicenceSupersededGuidState {
|    <# The value of $script:SILicenceSupersededGuid, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SILicenceSupersededGuid) { $script:SILicenceSupersededGuid = '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$' }
|    , $script:SILicenceSupersededGuid
|}
|$script:SILicenceSupersededGuid = $null; $null = Get-SILicenceSupersededGuidState
|
|function ConvertTo-SILicenceIdOrEmpty {
|    <# PURE. A licence id as the lower-case GUID Invardia takes, or '' when it is not GUID-shaped. #>
|    param([AllowNull()][AllowEmptyString()][string]$LicenceId)
|    $v = "$LicenceId".Trim()
|    if ($v -match (Get-SILicenceSupersededGuidState)) { return $v.ToLowerInvariant() }
|    ''
|}
|
|function Get-SILicenceSupersededFromAnswer {
|    <# PURE. The supersededBy id of an uplink answer (a parsed body, or its text), '' when none / not a GUID. #>
|    param([AllowNull()]$Answer)
|    if ($null -eq $Answer) { return '' }
|    $o = $Answer
|    if ($Answer -is [string]) { if (-not $Answer.Trim()) { return '' }; try { $o = $Answer | ConvertFrom-Json -ErrorAction Stop } catch { return '' } }
|    $v = ''
|    if ($o -is [System.Collections.IDictionary]) { if ($o.Contains('supersededBy')) { $v = [string]$o['supersededBy'] } }
|    elseif ($o.PSObject.Properties['supersededBy']) { $v = [string]$o.supersededBy }
|    ConvertTo-SILicenceIdOrEmpty $v
|}
|
|function Save-SILicenceSupersededMark {
|    <# Records the newest licence id Invardia named (cfg.InstallState 'LicenceSupersededBy') on -Store. Throws on failure. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$LicenceId, $NowUtc)
|    $id = ConvertTo-SILicenceIdOrEmpty $LicenceId
|    if (-not $id) { throw "not a licence id: '$LicenceId'" }
|    $at = if ($NowUtc) { ([datetime]$NowUtc).ToUniversalTime() } else { [datetime]::UtcNow }
|    $v = ([ordered]@{ licenceId = $id; seenUtc = $at.ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture) } | ConvertTo-Json -Compress)
|    $sql = @'
|IF OBJECT_ID('cfg.InstallState') IS NOT NULL
|BEGIN
|    SET XACT_ABORT ON;
|    BEGIN TRAN;
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @Name)
|        UPDATE cfg.InstallState SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @Name;
|    ELSE
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@Name, @Value, NULL, @By);
|    COMMIT;
|END
|'@
|    $null = & $Store.Invoke $sql ([ordered]@{ Name = (Get-SILicenceSupersededNameState); Value = $v; By = 'si-engine (Invardia uplink)' }) 'nonquery'
|}
|
|function Read-SILicenceSupersededMark {
|    <# The licence id the last report heard (cfg.InstallState 'LicenceSupersededBy') on -Store, '' when none. NEVER throws. #>
|    param([Parameter(Mandatory)]$Store)
|    try {
|        $rows = @(& $Store.Invoke "IF OBJECT_ID('cfg.InstallState') IS NOT NULL SELECT Value FROM cfg.InstallState WHERE Name = N'LicenceSupersededBy'" @{} 'reader' | ForEach-Object { $_ })
|        foreach ($row in $rows) {
|            if (-not $row) { continue }
|            $v = if ($row -is [System.Collections.IDictionary]) { $row['Value'] } else { $row.Value }
|            if ($null -eq $v -or $v -is [System.DBNull]) { continue }
|            return (Get-SILicenceSupersededFromAnswer ([string]$v -replace '"licenceId"', '"supersededBy"'))
|        }
|    } catch { }
|    ''
|}
'@ }
$__siSupportFiles['engine/_shared/SI-TelemetryEndpoints.ps1'] = @{ Sha256 = '5f4871e9760be3a64ed613dbb82f77a46a3cdeca2b63676fceaf86b60aa589ec'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- the INSTALL'S OWN LINKS on the identified heartbeat, and the deep Link on a failed run report
|    (framework §8.9 ENDPOINTS, Invardia: "Open SecurityInsight" buttons in every mail about the environment).
|
|    THE FIELD (identified heartbeat only -- an anonymous record never carries it), Invardia's contract (§8.9):
|        endpoints: [ { kind, url, label? } ]
|          - the property is `endpoints` (lower case); each entry has kind and url, optionally label -- NO other key (one
|            other key makes Invardia refuse the whole list);
|          - kind: ^[a-z][a-z0-9-]{1,30}$: web = the Pro web app, mcp = its MCP server; each kind once. 3.0.30 (Invardia's
|            alignment gap no-endpoint): Invardia's delivery check reads SI's web app as role `web` (Invardia DESIGN ch 9
|            "Customer endpoints": "SI: `web`, `mcp`"), so the kind earlier releases sent, `webapp` (framework §8.9's list),
|            was stored but never counted as the web app. `webapp` from an older row or caller is read as `web`;
|          - url: https only, no user name / password, no query string, no fragment, at most 400 characters;
|          - label: plain text, at most 60 characters (optional);
|          - at most 12 entries; the field is left out when nothing is known.
|
|    THE SEND GATE: a list Invardia's validator does not accept makes it refuse the WHOLE report (422), so the heartbeat
|    carries `endpoints` only while SI_Telemetry_SendEndpoints is on -- ON by default since Invardia's validator is live
|    (2026-10-10); a customer can switch it off. The run report's deep Link is not gated.
|
|    WHERE THE ADDRESSES COME FROM -- the install's own hosting and settings, never a hard-coded name:
|        1. the hosting record the updater keeps (cfg.InstallState 'Endpoints'): it reads the Container App FQDN of the web
|           app (ca-si-management) and the MCP server (ca-si-mcp) over ARM on every run (Save-SIInstallEndpointsRow); an
|           engine run reads the row at run start with the ring facts ($global:SI_InstallRingFacts.Endpoints); the updater
|           itself also keeps what it just read in $global:SI_InstallEndpoints. A row written before §8.9 (entries with
|           `role`: web / mcp) is read as kind (webapp / mcp);
|        2. the web app's public address setting (SIWeb_PublicBaseUrl) when the hosting record has no webapp entry.
|
|    THE DEEP LINK: an identified run report that did not end ok carries Link = <web app>/Admin/RunHealth (the run-health
|    page); guard records already carry <web app>/Admin/Guards (SI-Guard.ps1). No web app known = no Link.
|
|    PURE except Save-SIInstallEndpointsRow (one SQL write on a store the caller opened), Get-SITelemetryInstallEndpoints
|    and Test-SITelemetrySendEndpoints (read the run's globals). Nothing here throws to a telemetry caller: a bad value is
|    dropped, never sent.
|#>
|
|function Get-SITelemetryEndpointRulesState {
|    <# The value of $script:SITelemetryEndpointRules, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SITelemetryEndpointRules) { $script:SITelemetryEndpointRules = @{
|    Max           = 12
|    KindPattern   = '^[a-z][a-z0-9-]{1,30}$'
|    UrlMax        = 400
|    LabelMax      = 60
|    Keys          = @('kind', 'url', 'label')
|    # the web app's kind on the wire: Invardia's role for SI's main address (3.0.30, alignment gap no-endpoint)
|    WebKind       = 'web'
|    # older names (a row or caller before 3.0.30: kind webapp) -> the kind sent
|    KindAliases   = @{ webapp = 'web' }
|    Labels        = @{ web = 'SecurityInsight web app'; mcp = 'SecurityInsight MCP server' }
|    StateName     = 'Endpoints'      # cfg.InstallState row
|    StateMax      = 400              # cfg.InstallState.Value is NVARCHAR(400)
|    RunHealthPath = '/Admin/RunHealth'
|} }
|    , $script:SITelemetryEndpointRules
|}
|$script:SITelemetryEndpointRules = $null; $null = Get-SITelemetryEndpointRulesState
|
|function Get-SITelemetryEndpointRules { (Get-SITelemetryEndpointRulesState) }
|
|function Test-SITelemetrySendEndpoints {
|    <# The send gate: $global:SI_Telemetry_SendEndpoints, else the environment variable SI_TELEMETRY_SENDENDPOINTS; ON
|       when neither is set (Invardia accepts install links), otherwise on only for true / 1 / on / yes. #>
|    param([AllowNull()]$Value = $global:SI_Telemetry_SendEndpoints, [AllowNull()][AllowEmptyString()][string]$EnvValue = [Environment]::GetEnvironmentVariable('SI_TELEMETRY_SENDENDPOINTS'))
|    $v = if ($null -ne $Value -and "$Value".Trim() -ne '') { "$Value" } else { "$EnvValue" }
|    if (-not $v.Trim()) { return $true }
|    return ($v.Trim().ToLowerInvariant() -in @('true', '1', 'on', 'yes', '$true'))
|}
|
|function ConvertTo-SITelemetryEndpointUrl {
|    <# PURE. One address as Invardia accepts it: https://host[:port][/path], no query, no fragment, no credentials, no
|       trailing slash, at most 400 characters. A bare host name (a Container App FQDN) becomes https://<host>. '' for
|       anything else. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    $v = "$Value".Trim()
|    if (-not $v) { return '' }
|    if ($v -notmatch '^[a-zA-Z][a-zA-Z0-9+.-]*://') {
|        if ($v -match '^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?)+(:\d{1,5})?(/[^?#]*)?$') { $v = 'https://' + $v }
|        else { return '' }
|    }
|    $u = $null
|    if (-not [System.Uri]::TryCreate($v, [System.UriKind]::Absolute, [ref]$u)) { return '' }
|    if ($u.Scheme -ne 'https') { return '' }
|    if ($u.Query -or $u.Fragment -or $v.Contains('?') -or $v.Contains('#')) { return '' }
|    if ($u.UserInfo -or $v -match '^https://[^/]*@') { return '' }
|    if (-not $u.Host -or $u.Host -notmatch '\.') { return '' }
|    $out = 'https://' + $u.Authority.ToLowerInvariant() + $u.AbsolutePath.TrimEnd('/')
|    if ($out.Length -gt (Get-SITelemetryEndpointRulesState).UrlMax) { return '' }
|    $out
|}
|
|function ConvertTo-SITelemetryEndpointLabel {
|    <# PURE. A label as plain text: control characters and markup characters removed, spaces collapsed, at most 60
|       characters. '' when nothing is left. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    $t = [regex]::Replace("$Value", '[\x00-\x1F\x7F<>]', ' ')
|    $t = [regex]::Replace($t, '\s+', ' ').Trim()
|    if ($t.Length -gt (Get-SITelemetryEndpointRulesState).LabelMax) { $t = $t.Substring(0, (Get-SITelemetryEndpointRulesState).LabelMax).TrimEnd() }
|    $t
|}
|
|function ConvertTo-SITelemetryEndpointList {
|    <# PURE. Items (hashtables or objects, in priority order) as the §8.9 wire list: each entry exactly kind + url (+ label
|       when one is given), valid entries only, each kind once (the first wins), at most 12. An item with `role` instead of
|       `kind` (a row written before §8.9) is read as kind; webapp (the kind before 3.0.30) is read as web. Writes the entries one by one (none = nothing to send),
|       so every caller collects them with @(...) and the list is never wrapped in a second array. #>
|    param([AllowNull()][object[]]$Items)
|    $r = (Get-SITelemetryEndpointRulesState)
|    $out = New-Object System.Collections.Generic.List[object]
|    $seen = @{}
|    foreach ($it in @($Items)) {
|        if ($null -eq $it -or $out.Count -ge $r.Max) { continue }
|        $get = { param($n) if ($it -is [System.Collections.IDictionary]) { if ($it.Contains($n)) { $it[$n] } else { $null } } elseif ($it.PSObject.Properties[$n]) { $it.$n } else { $null } }
|        $kind = "$(& $get 'kind')".Trim().ToLowerInvariant()
|        if (-not $kind) { $kind = "$(& $get 'role')".Trim().ToLowerInvariant() }
|        if ($r.KindAliases.ContainsKey($kind)) { $kind = $r.KindAliases[$kind] }
|        if ($kind -notmatch $r.KindPattern -or $seen.ContainsKey($kind)) { continue }
|        $url = ConvertTo-SITelemetryEndpointUrl ([string](& $get 'url'))
|        if (-not $url) { continue }
|        $seen[$kind] = $true
|        $e = [ordered]@{ kind = $kind; url = $url }
|        $label = ConvertTo-SITelemetryEndpointLabel ([string](& $get 'label'))
|        if ($label) { $e['label'] = $label }
|        $out.Add([pscustomobject]$e)
|    }
|    $out.ToArray()
|}
|
|function ConvertTo-SIInstallEndpointsValue {
|    <# PURE. The list as the cfg.InstallState 'Endpoints' value (compact JSON, kind + url only -- labels are added when the
|       report is built -- at most 400 characters: entries that would pass the limit are left out, in order). '' for an
|       empty list. #>
|    param([AllowNull()][object[]]$Endpoints)
|    $list = @(ConvertTo-SITelemetryEndpointList -Items $Endpoints | ForEach-Object { [pscustomobject][ordered]@{ kind = $_.kind; url = $_.url } })
|    $keep = New-Object System.Collections.Generic.List[object]
|    foreach ($e in $list) {
|        $keep.Add($e)
|        $json = ConvertTo-Json -InputObject @($keep.ToArray()) -Compress -Depth 3
|        if ($json.Length -gt (Get-SITelemetryEndpointRulesState).StateMax) { $keep.RemoveAt($keep.Count - 1) }
|    }
|    if (-not $keep.Count) { return '' }
|    ConvertTo-Json -InputObject @($keep.ToArray()) -Compress -Depth 3
|}
|
|function ConvertFrom-SIInstallEndpointsValue {
|    <# PURE. The cfg.InstallState 'Endpoints' value back as the checked list (an old row with `role` reads as kind).
|       Damaged JSON = an empty list. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    if (-not "$Value".Trim()) { return }
|    try { $j = "$Value".Trim() | ConvertFrom-Json -ErrorAction Stop } catch { return }
|    ConvertTo-SITelemetryEndpointList -Items @($j)
|}
|
|function Resolve-SITelemetryEndpoints {
|    <# PURE. The heartbeat's list: the hosting record first (-Hosting: what the updater read, or the recorded row), then the
|       web app's public address setting as 'webapp' when the hosting record has none; each known kind gets its plain
|       label. #>
|    param([AllowNull()][object[]]$Hosting, [AllowNull()][AllowEmptyString()][string]$PublicBaseUrl)
|    $items = New-Object System.Collections.Generic.List[object]
|    foreach ($h in @(ConvertTo-SITelemetryEndpointList -Items $Hosting)) { $items.Add($h) }
|    if ("$PublicBaseUrl".Trim()) { $items.Add([pscustomobject]@{ kind = (Get-SITelemetryEndpointRulesState).WebKind; url = "$PublicBaseUrl".Trim() }) }
|    $labels = (Get-SITelemetryEndpointRulesState).Labels
|    $withLabels = @(ConvertTo-SITelemetryEndpointList -Items $items.ToArray() | ForEach-Object {
|        $e = [ordered]@{ kind = $_.kind; url = $_.url }
|        if ($_.PSObject.Properties['label'] -and "$($_.label)") { $e['label'] = $_.label } elseif ($labels.ContainsKey($_.kind)) { $e['label'] = $labels[$_.kind] }
|        $e })
|    ConvertTo-SITelemetryEndpointList -Items $withLabels
|}
|
|function Get-SITelemetryRunLink {
|    <# PURE. The deep link of a run report that did not end ok: the web app's run-health page. '' without a web app.
|       (An old entry with role 'web' counts as the web app.) #>
|    param([AllowNull()][object[]]$Endpoints)
|    $web = @(ConvertTo-SITelemetryEndpointList -Items $Endpoints | Where-Object { "$($_.kind)" -eq (Get-SITelemetryEndpointRulesState).WebKind } | Select-Object -First 1)
|    if (-not $web.Count) { return '' }
|    $web[0].url + (Get-SITelemetryEndpointRulesState).RunHealthPath
|}
|
|function Get-SITelemetryInstallEndpoints {
|    <# This install's links from the run's globals (never throws; an empty list when nothing is known):
|       $global:SI_InstallEndpoints (the updater, this run) > $global:SI_InstallRingFacts.Endpoints (the recorded row) and
|       $global:SIWeb_PublicBaseUrl (the web app's address setting). #>
|    try {
|        $hosting = @()
|        if ($global:SI_InstallEndpoints) { $hosting = @($global:SI_InstallEndpoints) }
|        elseif ($global:SI_InstallRingFacts -and $global:SI_InstallRingFacts.PSObject.Properties['Endpoints']) {
|            $hosting = @(ConvertFrom-SIInstallEndpointsValue ([string]$global:SI_InstallRingFacts.Endpoints))
|        }
|        Resolve-SITelemetryEndpoints -Hosting $hosting -PublicBaseUrl ([string]$global:SIWeb_PublicBaseUrl)
|    } catch { }
|}
|
|function Save-SIInstallEndpointsRow {
|    <# The install's links into cfg.InstallState 'Endpoints' (the updater, after it read the Container Apps). Nothing to
|       write (an empty list) leaves the row as it is. Never throws: $true written, $false not. #>
|    param([Parameter(Mandatory)]$Store, [AllowNull()][object[]]$Endpoints, [string]$By = 'caj-si-updater')
|    $v = ConvertTo-SIInstallEndpointsValue -Endpoints $Endpoints
|    if (-not $v) { return $false }
|    $sql = @'
|IF OBJECT_ID('cfg.InstallState') IS NOT NULL
|BEGIN
|    SET XACT_ABORT ON;
|    BEGIN TRAN;
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = N'Endpoints')
|        UPDATE cfg.InstallState SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = N'Endpoints' AND Value <> @Value;
|    ELSE
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N'Endpoints', @Value, NULL, @By);
|    COMMIT;
|END
|'@
|    try { $null = & $Store.Invoke $sql ([ordered]@{ Value = $v; By = $By }) 'nonquery'; $true } catch { $false }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-UplinkCauses.ps1'] = @{ Sha256 = '25aa44ed7614251cf67e67e28bab4e22ce339e54204adcb1bc6bb51e658add87'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- REPORT-FAILURE CAUSES, CAPABILITIES AND LICENCES IN THE UPLINK (#709; framework DOCS/REQUIREMENTS.md
|    8.16 UPLINK-CAUSES, the contract -- this file is SecurityInsight's own probe, catalogue and mapping).
|
|    WHAT IT BUILDS (pure builders; the sender, SI-TelemetrySend.ps1, puts them on the records):
|      run record  `Reports` -- at most 20 items, the most severe first, ONLY for reports that failed, were not applicable or
|                  deviated. Every item carries Report (an id, never a title), Code (si-<area>-<nnnn>, from
|                  data-model/errors.locked.json), CauseClass (the closed list), MissingName / MissingLicence / Bucket,
|                  FixedIn + Action (from the catalogue), the context numbers (RunMs, Rows, LastGoodRunMs, LastGoodRows,
|                  SourceCount, Buckets, Retries {429, 502, 504}, QueryHash, QueryChanged, Region, StartedUtc) and -- on an
|                  IDENTIFIED record only -- Detail: the engine's first error line, through SecurityInsight's secret scrub, at
|                  most 500 characters. A value that is not known is null, never guessed.
|      heartbeat   `Capabilities` (the closed keys, booleans -- a key that could not be measured is LEFT OUT, never sent as
|                  false by guess), `CiColumns` (the optional SI_CI_CL columns present, at most 40 ids) and `Licences` (the
|                  tenant's SKU part numbers from Graph subscribedSkus -- only when the run's identity may read them; no
|                  permission is ever added for it).
|
|    THE RULES:
|      * A Reports problem never costs the run record: ConvertTo-SIUplinkReports never throws (an item it cannot map gets
|        the generic code of its class; an item it cannot build at all is left out; nothing at all = no Reports), and the
|        sender sends the record again WITHOUT the optional fields when Invardia refuses it (Send-SITelemetryRecordWithFallback).
|      * Code and CauseClass are ALWAYS on an item (Invardia refuses the whole record, 422, for an item without them).
|      * Detail never carries a secret: SecurityInsight's own scrub (ConvertTo-SITelemetryErrorText) and the framework's
|        (ConvertTo-AitUplinkRedacted), then any long token-shaped run is cut; a Detail that still looks like a secret is
|        dropped (Invardia refuses the whole record for one).
|      * Ids: lower case, letters, digits and dashes, at most 60 (`Identity_SPN_OwnerMismatch` -> `identity-spn-ownermismatch`,
|        `si_cmdb_id` -> `si-cmdb-id`).
|
|    PS 5.1 and 7. Nothing here touches the network except the probe readers (Get-SICapabilityProbe's defaults), which a
|    test session never calls.
|#>
|
|function Get-SIUplinkCausesState {
|    <# The value of $script:SIUplinkCauses, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIUplinkCauses) { $script:SIUplinkCauses = @{
|    CauseClasses   = @('no-data-source', 'missing-column', 'query-defect', 'platform-timeout', 'too-large', 'count-more', 'count-less',
|                       'settings-unreachable', 'permission', 'missing-licence', 'out-of-memory', 'held-last-good', 'held-too-long')
|    Actions        = @('none', 'fixed-in', 'support', 'customer')
|    # most severe first: a run that could not read its settings, rows that are missing, SecurityInsight's own defects, a
|    # permission, the platform; then what does not apply (licence, data source) and last a count that was only higher
|    # #711: out of memory is SecurityInsight's own defect (the run held more than it needed) -- ranked with the query defects
|    # #902: a hold held too long ranks with the missing rows (count-less), a hold that is information only comes last
|    Severity       = @{ 'settings-unreachable' = 1; 'count-less' = 2; 'held-too-long' = 2; 'out-of-memory' = 3; 'query-defect' = 4; 'permission' = 5; 'platform-timeout' = 6
|                        'too-large' = 7; 'missing-column' = 8; 'missing-licence' = 9; 'no-data-source' = 10; 'count-more' = 11; 'held-last-good' = 12 }
|    MaxReports     = 20
|    DetailMax      = 500
|    IdMax          = 60
|    CodePattern    = '^si-[a-z]{2,8}-\d{4}$'
|    DocsBase       = 'https://invardia.com/docs/si/errors/'
|    CapabilityKeys = @('defenderXdr', 'defenderVulnMgmt', 'mdi', 'intune', 'entraP2Pim', 'cmdb', 'sentinel', 'dataLake')
|    MaxCiColumns   = 40
|    MaxLicences    = 40
|    # the SI_CI_CL columns that exist only where their source does (a CMDB, ServiceNow) -- the CMDB-less install lesson
|    OptionalCiColumnPattern = '^si_(cmdb|servicenow|snow)_[a-z0-9_]+$'
|    # service plans that say what a report needs (Graph subscribedSkus servicePlans[].servicePlanName)
|    PlanCapabilities = @{ 'INTUNE_A' = 'intune'; 'AAD_PREMIUM_P2' = 'entraP2Pim'; 'TVM_PREMIUM_1' = 'defenderVulnMgmt' }
|    # the generic code of each class: an unknown failure gets it until it is given its own (framework 8.16)
|    GenericCodes   = @{ 'no-data-source' = 'si-ra-0901'; 'missing-column' = 'si-ra-0902'; 'query-defect' = 'si-ra-0903'; 'platform-timeout' = 'si-ra-0904'
|                        'too-large' = 'si-ra-0905'; 'count-more' = 'si-ra-0906'; 'count-less' = 'si-ra-0907'; 'settings-unreachable' = 'si-ra-0908'
|                        'permission' = 'si-ra-0909'; 'missing-licence' = 'si-ra-0910'
|                        # #711: a report that ran Risk Analysis out of memory has its own code from the start (support, a ticket)
|                        'out-of-memory' = 'si-ra-0303'
|                        # #902: a hold's code always comes from the hold list (data-model/hold-kinds.locked.json); these are only
|                        # the classes' generic codes for the catalogue's rule "every class has one"
|                        'held-last-good' = 'si-ra-0911'; 'held-too-long' = 'si-ra-0913' }
|    # a failure whose cause is not recognised at all (the support worker escalates these for a human)
|    UnknownCode    = 'si-ra-0900'
|    # =================================================================================================================
|    # #902 THE HOLD CONTRACT WITH INVARDIA (framework 8.16 on main) -- every name of it is HERE, so a rename is one edit.
|    #   a report held ON PURPOSE (it keeps its last complete result, nothing of it closes) is an item of class
|    #   HoldClassInfo (information only at Invardia: no alert, no fix request); the same report held
|    #   escalateAfterDetailedRuns Detailed runs in a row is an item of class HoldClassEscalated (a normal failure at Invardia:
|    #   run alert, fix request, ticket). Both carry the HoldFields: Held (true), KeptAgeHours (whole hours from the kept
|    #   result's collection time to this run's; null = none), HeldRuns (runs of this grain in a row, this one included).
|    HoldClassInfo      = 'held-last-good'
|    HoldClassEscalated = 'held-too-long'
|    HoldFieldHeld      = 'Held'
|    HoldFieldAge       = 'KeptAgeHours'
|    HoldFieldRuns      = 'HeldRuns'
|    # REMOVE-ME (#902): Invardia's validator refuses an unknown item field (422 on Reports.Held) until its version is live.
|    # Until then the two classes and the three fields are NOT sent: an information hold is left OUT of Reports[], an
|    # escalated hold goes as a normal failure -- its escalation code, class HoldOffEscalatedClass, without the fields.
|    # Switch: setting SI_Uplink_SendHoldFields (job variable SI_UPLINK_SENDHOLDFIELDS): on / off / a ring list / auto =
|    # the rings in HoldFieldsRings -- confirmed for NO ring yet. When Invardia's version is live on every ring: send always,
|    # drop the switch, HoldFieldsRings and HoldOffEscalatedClass.
|    HoldFieldsSwitch      = 'SI_Uplink_SendHoldFields'
|    # Invardia's validator takes them since 1.0.592 (716b371, 2026-10-26): RING 0 FIRST (internal), the other rings once
|    # Invardia has checked internal's first held item on its environment page
|    HoldFieldsRings       = @(0)
|    HoldOffEscalatedClass = 'count-less'
|} }
|    , $script:SIUplinkCauses
|}
|$script:SIUplinkCauses = $null; $null = Get-SIUplinkCausesState
|
|# #902: the one list of hold kinds (the code of each hold)
|if (-not (Get-Command -Name Get-SIHoldKindCode -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-HoldKinds.ps1')) }
|
|function Get-SIUplinkCausesContract { (Get-SIUplinkCausesState) }
|
|function Resolve-SIUplinkHoldFieldsSwitch {
|    <#
|        PURE (with -Value / -EnvValue). REMOVE-ME (#902): do the hold classes and fields go out from this install?
|        SI_Uplink_SendHoldFields (setting) > SI_UPLINK_SENDHOLDFIELDS (job variable) > auto (the rings in HoldFieldsRings --
|        none yet). on / true / yes = on; off / false / no = off; a ring list ("0", "0,1") = on for those rings. -Ring not
|        known = off unless 'on'. @{ On; Setting; Reason } (the same rule as Resolve-SIUplinkFieldSwitch).
|    #>
|    param([AllowNull()]$Ring, $Value = '__read__', $EnvValue = '__read__', [int[]]$ConfirmedRings = @((Get-SIUplinkCausesState).HoldFieldsRings))
|    $name = [string](Get-SIUplinkCausesState).HoldFieldsSwitch
|    if ("$Value" -eq '__read__') { $Value = Get-Variable -Name $name -Scope Global -ValueOnly -ErrorAction SilentlyContinue }
|    if ("$EnvValue" -eq '__read__') { $EnvValue = [Environment]::GetEnvironmentVariable($name.ToUpperInvariant()) }
|    $rn = -1
|    if ($null -ne $Ring -and "$Ring".Trim() -ne '') { if (-not [int]::TryParse("$Ring", [ref]$rn)) { $rn = -1 } }
|    $set = ''
|    foreach ($v in @($Value, $EnvValue)) {
|        if ($null -eq $v) { continue }
|        if ($v -is [bool]) { $set = $(if ($v) { 'on' } else { 'off' }); break }
|        $s = ([string]$v).Trim().Trim('$').ToLowerInvariant()
|        if (-not $s) { continue }
|        $set = $s; break
|    }
|    if ($set -in @('on', 'true', 'yes', 'enabled')) { return [pscustomobject]@{ On = $true; Setting = 'on'; Reason = "$name is on" } }
|    if ($set -in @('off', 'false', 'no', 'disabled')) { return [pscustomobject]@{ On = $false; Setting = 'off'; Reason = "$name is off" } }
|    if ($set -match '^(ring\s*)?[0-3](\s*[,;]\s*(ring\s*)?[0-3])*$') {
|        $rings = @([regex]::Matches($set, '[0-3]') | ForEach-Object { [int]$_.Value })
|        return [pscustomobject]@{ On = ($rn -ge 0 -and $rings -contains $rn); Setting = 'rings'; Reason = ("$name is on for ring(s) {0}" -f ($rings -join ', ')) }
|    }
|    $on = ($rn -ge 0 -and @($ConfirmedRings) -contains $rn)
|    [pscustomobject]@{ On = $on; Setting = 'auto'; Reason = $(if ($on) { "ring $rn takes the hold fields" } else { 'the hold fields wait until Invardia has confirmed them' }) }
|}
|
|function Get-SIUplinkFactValue {
|    <# PURE. One value of a report fact (a hashtable or an object); $null when it has none. #>
|    param([AllowNull()]$Fact, [string]$Name)
|    if ($null -eq $Fact) { return $null }
|    if ($Fact -is [System.Collections.IDictionary]) { if ($Fact.Contains($Name)) { return $Fact[$Name] } else { return $null } }
|    if ($Fact.PSObject.Properties[$Name]) { return $Fact.$Name }
|    $null
|}
|
|function Test-SIUplinkFactHeld {
|    <# PURE. #902: is the fact a report held ON PURPOSE (a HoldKind of the list)? 'escalated' when it is held too long, 'info'
|       when it is information only, '' when it is not a hold (every other fact -- mapped exactly as before). #>
|    param([AllowNull()]$Fact)
|    $k = [string](Get-SIUplinkFactValue $Fact 'HoldKind')
|    if (-not $k -or -not (Test-SIHoldKind -Kind $k)) { return '' }
|    if ([bool](Get-SIUplinkFactValue $Fact 'Escalated')) { return 'escalated' }
|    'info'
|}
|
|function Add-SIReportCauseHoldFacts {
|    <#
|        PURE. #902: the run's report facts with each held report's hold added (-Held: Split-RAReportFailures .Held -- Report,
|        Kind, Names, HeldRuns, KeptResultAt, Escalated): HoldKind, HoldNames, HeldRuns, Escalated, KeptResultUtc and
|        KeptAgeHours (whole hours from the kept result to -RunUtc, this run's collection time; $null when either is not
|        known). A fact of a report that is not held is returned as it is. Never throws.
|    #>
|    param([AllowNull()][object[]]$Facts, [AllowNull()][object[]]$Held, $RunUtc)
|    $out = New-Object System.Collections.Generic.List[object]
|    try {
|        $byName = @{}
|        foreach ($h in @($Held | Where-Object { $_ -and [string]$_.Report })) { $byName[[string]$h.Report] = $h }
|        foreach ($f in @($Facts | Where-Object { $null -ne $_ })) {
|            $r = [string](Get-SIUplinkFactValue $f 'Report')
|            $h = $byName[$r]
|            if ($null -ne $h -and $f -isnot [System.Collections.IDictionary]) {
|                $kept = $null; if ($h.KeptResultAt) { try { $kept = ([datetime]$h.KeptResultAt).ToUniversalTime() } catch { $kept = $null } }
|                $age = $null
|                if ($null -ne $kept -and $null -ne $RunUtc) { try { $hrs = ([datetime]$RunUtc).ToUniversalTime() - $kept; if ($hrs.TotalHours -ge 0) { $age = [long][Math]::Floor($hrs.TotalHours) } } catch { $age = $null } }
|                foreach ($kv in @(@('HoldKind', [string]$h.Kind), @('HoldNames', [string[]]@($h.Names | Where-Object { $_ })), @('HeldRuns', [int]$(if ($h.HeldRuns) { $h.HeldRuns } else { 1 })),
|                                  @('Escalated', [bool]$h.Escalated), @('KeptResultUtc', $kept), @('KeptAgeHours', $age))) {
|                    Add-Member -InputObject $f -NotePropertyName $kv[0] -NotePropertyValue $kv[1] -Force
|                }
|            }
|            $out.Add($f)
|        }
|    } catch { return @($Facts) }
|    $out.ToArray()
|}
|
|function Write-SIUplinkDiag {
|    param([string]$Line)
|    try { if (Get-Command -Name Write-Diag -ErrorAction SilentlyContinue) { Write-Diag $Line } else { Write-Verbose $Line } } catch { }
|}
|
|function ConvertTo-SIUplinkId {
|    <# PURE. An id for the uplink: lower case, a-z 0-9 and dashes, no leading / trailing / double dash, at most 60. '' = none. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value, [int]$Max = 60)
|    $v = ("$Value".Trim().ToLowerInvariant() -replace '[^a-z0-9]+', '-').Trim('-')
|    if ($v.Length -gt $Max) { $v = $v.Substring(0, $Max).TrimEnd('-') }
|    $v
|}
|
|function Get-SIErrorCatalogue {
|    <# The error catalogue (data-model/errors.locked.json), read once per process. -Path is the test seam. @() when it cannot
|       be read -- every mapping then falls back to the generic codes, which are known here too. #>
|    param([string]$Path)
|    if (-not $Path -and $null -ne $script:SIErrorCatalogueCache) { return $script:SIErrorCatalogueCache }
|    $p = $Path
|    if (-not $p) { $p = [System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'data-model', 'errors.locked.json') }
|    $out = @()
|    try { $out = @([System.IO.File]::ReadAllText($p).TrimStart([char]0xFEFF) | ConvertFrom-Json -ErrorAction Stop) } catch { $out = @() }
|    if (-not $Path) { $script:SIErrorCatalogueCache = $out }
|    # emitted item by item (a ', $out' would reach a caller's @() as ONE nested array)
|    $out
|}
|
|function Get-SIErrorCodeUrl {
|    <# PURE. The public page of an error code: https://invardia.com/docs/si/errors/<code>/ -- '' for a value that is not a code. #>
|    param([AllowNull()][AllowEmptyString()][string]$Code)
|    $c = "$Code".Trim().ToLowerInvariant()
|    if ($c -notmatch (Get-SIUplinkCausesState).CodePattern) { return '' }
|    (Get-SIUplinkCausesState).DocsBase + $c + '/'
|}
|
|function Get-SIReportCause {
|    <#
|        PURE. The cause of ONE report that failed, did not apply or deviated, from what the engine knows: -State (Failed |
|        NotComplete | NotApplicable | Deviated) and -Text (the engine's own reason / error). Returns @{ CauseClass;
|        MissingName } -- CauseClass is ALWAYS a value of the closed list; MissingName the missing table / column / keyword as an
|        id, else ''. Recognised = Known $true; a text no rule recognises = Known $false (the caller gives it si-ra-0900).
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$State, [AllowEmptyString()][AllowNull()][string]$Text)
|    $t = [string]$Text
|    $r = { param($c, $n, $k = $true) [pscustomobject]@{ CauseClass = $c; MissingName = (ConvertTo-SIUplinkId $n); Known = [bool]$k } }
|    # ---- the settings database ------------------------------------------------------------------------------------------
|    if ($t -match '(?i)SQL error 40\b|error: 40 -|settings database (cannot|could not) be reached|could not reach (its|the) (own )?settings database|settings database is not reachable') { return (& $r 'settings-unreachable' '') }
|    # ---- #711: the process ran out of memory (before the other rules: its text can carry any other words) ------------------
|    if ($t -match '(?i)OutOfMemoryException|\bOOMKilled\b|\bout of memory\b|\bsi-ra-0303\b') { return (& $r 'out-of-memory' '') }
|    # ---- a data source / licence this tenant does not have ---------------------------------------------------------------
|    if ($t -match "(?i)Failed to resolve (?:table or column )?expression named '(DeviceTvm[A-Za-z]+)'") { return (& $r 'missing-licence' $Matches[1]) }
|    if ($t -match '(?i)Account is not provisioned|advanced hunting is not provisioned') { return (& $r 'no-data-source' 'defender-xdr') }
|    if ($t -match "(?i)Failed to resolve (?:table or column )?expression named '(SI_[A-Za-z0-9_]+_CL)'") { return (& $r 'no-data-source' $Matches[1]) }
|    if ($t -match "(?i)Failed to resolve (?:table or column )?expression named '((?:Device|Identity|Email|Cloud|Alert|Url|Exposure|Aad|Behavior)[A-Za-z]+)'") { return (& $r 'no-data-source' $Matches[1]) }
|    # ---- a column that is not there (an optional CI column at an install without its source) -----------------------------
|    if ($t -match "(?i)Failed to resolve scalar expression named '([^']+)'") { return (& $r 'missing-column' $Matches[1]) }
|    if ($t -match "(?i)Failed to resolve (?:table or column )?expression named '([^']+)'") { return (& $r 'missing-column' $Matches[1]) }
|    if ("$State" -eq 'NotApplicable') { return (& $r 'no-data-source' '') }
|    # ---- the count against the source --------------------------------------------------------------------------------------
|    if ($t -match '(?i)more than the source''s count') { return (& $r 'count-more' '') }
|    if ($t -match '(?i)the source holds (\d+) row\(s\)[^|]*retrieved (\d+)') {
|        if ([long]$Matches[2] -gt [long]$Matches[1]) { return (& $r 'count-more' '') }
|        return (& $r 'count-less' '')
|    }
|    if ($t -match '(?i)neither stored nor accounted for|far fewer findings|fewer (rows|findings) than|lost (a )?bucket|could not be read \(a query that timed out') { return (& $r 'count-less' '') }
|    # ---- too large ------------------------------------------------------------------------------------------------------
|    if ($t -match '(?i)413 Request Entity Too Large|Query body (EXCEEDED|is being tuned)|request body .*too large') { return (& $r 'too-large' 'query-body') }
|    if ($t -match '(?i)502 Bad Gateway|exceeded the allowed (result size|limits)|its row limit|OutOfMemory|out of memory|too large') { return (& $r 'too-large' '') }
|    # ---- SecurityInsight's own query -------------------------------------------------------------------------------------
|    if ($t -match '(?i)\bSYN0002\b') { return (& $r 'query-defect' 'syn0002') }
|    # ---- everything else through the run classifier ----------------------------------------------------------------------
|    $cls = 'unknown'
|    try { if (Get-Command -Name Get-SIErrorClass -ErrorAction SilentlyContinue) { $cls = Get-SIErrorClass -Message $t } } catch { $cls = 'unknown' }
|    switch -Regex ($cls) {
|        '^(graph-401|graph-403|defender-403|arm-403|kv-403|storage-403)$' { return (& $r 'permission' '') }
|        '^licence-invalid$' { return (& $r 'missing-licence' '') }
|        '^(sql-login|settings-error)$' { return (& $r 'settings-unreachable' '') }
|        '^table-missing$' { return (& $r 'no-data-source' '') }
|        '^kql-query-defect$' { return (& $r 'query-defect' '') }
|        # 3.0.30: a temporary Azure SQL answer that outlasted the statement's own retry (SI-SqlRetry.ps1) is the platform's
|        '^(platform-timeout|platform-5xx|throttled|mi-unavailable|transient-sql)$' { return (& $r 'platform-timeout' '') }
|        # 3.0.30: a FULL database is its own cause -- the closed class too-large with MissingName 'database', code si-data-1404
|        # (the catalogue's "The database is full", the same code the data sync sends; Resolve-SIReportCauseCode). Before, it fell
|        # through to the unknown si-ra-0900 and support was asked to find a cause that was already known.
|        '^database-full$' { return (& $r 'too-large' 'database') }
|        '^ingest-' { return (& $r 'count-less' '') }
|    }
|    # not recognised: a product defect until it is given its own code (framework 8.16: a failure without a cause is a defect)
|    & $r 'query-defect' '' $false
|}
|
|function Resolve-SIReportCauseCode {
|    <#
|        PURE. The stable code of a cause: the catalogue's own code when one fits (si-ra-0101 DeviceTvm* absent, si-ra-0102 a
|        missing optional CI column, si-ra-0103 a KQL reserved word, si-ra-0201 more rows than the count, si-ra-0302 the report
|        query too large, si-ra-0303 Risk Analysis out of memory (its generic code), si-set-0401 the settings database, si-data-1404 the
|        database is full -- too-large with MissingName 'database'), else the GENERIC code of its class, else -- a cause nothing
|        recognised -- si-ra-0900. NEVER throws, never returns ''.
|    #>
|    param([Parameter(Mandatory)]$Cause)
|    try {
|        $cc = [string]$Cause.CauseClass; $mn = [string]$Cause.MissingName
|        if ($Cause.PSObject.Properties['Known'] -and -not $Cause.Known) { return (Get-SIUplinkCausesState).UnknownCode }
|        switch ($cc) {
|            'missing-licence'      { if ($mn -like 'devicetvm*') { return 'si-ra-0101' } }
|            'no-data-source'       { if ($mn -like 'devicetvm*') { return 'si-ra-0101' } }
|            'missing-column'       { if ($mn -match ('^' + ((Get-SIUplinkCausesState).OptionalCiColumnPattern.Trim('^', '$') -replace '_', '-') + '$')) { return 'si-ra-0102' } }
|            'query-defect'         { if ($mn -eq 'syn0002') { return 'si-ra-0103' } }
|            'count-more'           { return 'si-ra-0201' }
|            'too-large'            { if ($mn -eq 'query-body') { return 'si-ra-0302' }; if ($mn -eq 'database') { return 'si-data-1404' } }
|            'settings-unreachable' { return 'si-set-0401' }
|        }
|        $g = (Get-SIUplinkCausesState).GenericCodes[$cc]
|        if ($g) { return $g }
|    } catch { }
|    (Get-SIUplinkCausesState).UnknownCode
|}
|
|function ConvertTo-SIUplinkDetail {
|    <#
|        PURE. The bounded free text of one item (framework 8.16 Detail): the FIRST line of the engine's error, through
|        SecurityInsight's secret scrub (ConvertTo-SITelemetryErrorText) and the framework's (ConvertTo-AitUplinkRedacted),
|        every long token-shaped run cut, at most 500 characters. $null when there is no text, or when what is left still
|        looks like a secret (Invardia refuses the whole record for one -- the record matters more than the Detail).
|    #>
|    param([AllowNull()][AllowEmptyString()][string]$Text)
|    try {
|        $line = @("$Text" -split "`r?`n" | ForEach-Object { $_.Trim() } | Where-Object { $_ }) | Select-Object -First 1
|        if (-not $line) { return $null }
|        if (Get-Command -Name ConvertTo-SITelemetryErrorText -ErrorAction SilentlyContinue) { $line = ConvertTo-SITelemetryErrorText $line }
|        if (Get-Command -Name ConvertTo-AitUplinkRedacted -ErrorAction SilentlyContinue) { $line = ConvertTo-AitUplinkRedacted -Text $line }
|        # connection strings and SAS-style keys the two scrubs do not name
|        $line = [regex]::Replace($line, '(?i)\b(Server|Data Source|User ID|Uid|Initial Catalog)\s*=\s*[^;]+;', '$1=[redacted];')
|        $line = [regex]::Replace($line, '(?i)\b(token|key|credential|secret)\s*[=:]\s*\S+', '$1=[redacted]')
|        # a long run of token characters with letters AND digits (a key, a token, a hash) is cut whatever it is
|        $line = [regex]::Replace($line, '[A-Za-z0-9+/_=\-]{32,}', { param($m) if ($m.Value -match '[A-Za-z]' -and $m.Value -match '\d') { '[redacted]' } else { $m.Value } })
|        if ($line.Length -gt (Get-SIUplinkCausesState).DetailMax) { $line = $line.Substring(0, (Get-SIUplinkCausesState).DetailMax) }
|        if (Test-SIUplinkLooksSecret $line) { return $null }
|        return $line
|    } catch { return $null }
|}
|
|function Test-SIUplinkLooksSecret {
|    <# PURE. Does a text still look like it carries a secret (the shapes Invardia's check refuses)? #>
|    param([AllowNull()][AllowEmptyString()][string]$Text)
|    $t = "$Text"
|    if (-not $t) { return $false }
|    if ($t -match 'eyJ[A-Za-z0-9_-]{8,}\.') { return $true }
|    if ($t -match '-----BEGIN ') { return $true }
|    if ($t -match '(?i)\b(password|pwd|client_secret|accountkey|sharedaccesskey|apikey|api_key)\s*[=:]\s*(?!\[redacted\])\S') { return $true }
|    if ($t -match '(?i)[?&]sig=(?!\[redacted\])') { return $true }
|    if ($t -match 'inv-[A-Za-z0-9_-]{20,}') { return $true }
|    $false
|}
|
|function Compare-SIUplinkVersion {
|    <# PURE. -1 / 0 / 1 for two dotted versions (each part a whole number -- 3.0.0.202610151821 has a part too large for
|       [version]); $null when either cannot be read. Only the leading dotted digits count ('3.0.0.2026...+abc' reads). #>
|    param([AllowNull()][AllowEmptyString()][string]$A, [AllowNull()][AllowEmptyString()][string]$B)
|    $pa = if ("$A" -match '^\s*(\d+(?:\.\d+)*)') { @($Matches[1] -split '\.') } else { return $null }
|    $pb = if ("$B" -match '^\s*(\d+(?:\.\d+)*)') { @($Matches[1] -split '\.') } else { return $null }
|    $n = [Math]::Max($pa.Count, $pb.Count)
|    for ($i = 0; $i -lt $n; $i++) {
|        $x = if ($i -lt $pa.Count) { [decimal]$pa[$i] } else { [decimal]0 }
|        $y = if ($i -lt $pb.Count) { [decimal]$pb[$i] } else { [decimal]0 }
|        if ($x -lt $y) { return -1 }
|        if ($x -gt $y) { return 1 }
|    }
|    0
|}
|
|function Get-SIUplinkCatalogueAction {
|    <# PURE. Action + FixedIn of a code for THIS version: the catalogue's; a 'fixed-in' whose fix this version already has
|       (the cause came back) is 'support' with no FixedIn -- never a promise the release already broke. #>
|    param([AllowNull()]$Entry, [AllowEmptyString()][string]$Version)
|    $act = 'support'; $fix = $null
|    if ($Entry) {
|        $a = "$($Entry.action)".Trim().ToLowerInvariant(); if ((Get-SIUplinkCausesState).Actions -contains $a) { $act = $a }
|        if ("$($Entry.fixedIn)".Trim()) { $fix = "$($Entry.fixedIn)".Trim() }
|    }
|    if ($act -eq 'fixed-in') {
|        $cmp = Compare-SIUplinkVersion -A $Version -B $fix
|        if (-not $fix -or ($null -ne $cmp -and $cmp -ge 0)) { $act = 'support'; $fix = $null }
|    } elseif ($act -ne 'none') { $fix = $null }   # 'none' keeps the version since which the report is simply not applicable
|    [pscustomobject]@{ Action = $act; FixedIn = $fix }
|}
|
|function ConvertTo-SIUplinkNumber {
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or "$Value".Trim() -eq '') { return $null }
|    $d = 0.0
|    if (-not [double]::TryParse("$Value", [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $null }
|    if ($d -lt 0 -or [double]::IsNaN($d) -or [double]::IsInfinity($d)) { return $null }
|    [long][Math]::Floor($d)
|}
|
|function ConvertTo-SIUplinkReports {
|    <#
|        PURE. The run record's `Reports` from the run's report facts (-Facts: what Risk Analysis put on its run context as
|        ReportCauses -- Report, State, Why, StartedUtc, RunMs, Rows, SourceCount, Buckets, QueryHash, Retries, LastGoodRows,
|        LastGoodRunMs, LastGoodQueryHash, Bucket). -Identified adds Detail (anonymous: no text ever leaves). -Version decides
|        Action / FixedIn; -Region the install's Azure region; -Catalogue the error catalogue (default the shipped one).
|        At most 20 items, the most severe first. NEVER throws: an item that cannot be built is left out, nothing = @().
|        #902: a fact of a report held ON PURPOSE (HoldKind of the list, Add-SIReportCauseHoldFacts) is never mapped by its
|        text: its code is the hold list's (the escalation code once Escalated). With -HoldFields (the hold contract is live
|        for this install, Resolve-SIUplinkHoldFieldsSwitch) it is class held-last-good / held-too-long with Held, KeptAgeHours
|        and HeldRuns; without it an information hold is left OUT and an escalated hold goes as a normal failure (its code,
|        class count-less, no hold fields). An information hold sorts after every real failure. Every other fact: as before.
|    #>
|    param([AllowNull()][object[]]$Facts, [switch]$Identified, [AllowEmptyString()][string]$Version, [AllowEmptyString()][string]$Region,
|          [AllowNull()][object[]]$Catalogue, [switch]$HoldFields)
|    $items = New-Object System.Collections.Generic.List[object]
|    try {
|        if ($null -eq $Facts -or @($Facts).Count -eq 0) { return @() }
|        $cat = if ($PSBoundParameters.ContainsKey('Catalogue')) { @($Catalogue) } else { @(Get-SIErrorCatalogue) }
|        $byCode = @{}; foreach ($e in $cat) { if ($e -and "$($e.code)".Trim()) { $byCode["$($e.code)".Trim().ToLowerInvariant()] = $e } }
|        $reg = ConvertTo-SIUplinkId $Region
|        $seen = @{}
|        foreach ($f in @($Facts)) {
|            try {
|                if ($null -eq $f) { continue }
|                $get = { param($n) if ($f -is [System.Collections.IDictionary]) { if ($f.Contains($n)) { $f[$n] } else { $null } } elseif ($f.PSObject.Properties[$n]) { $f.$n } else { $null } }
|                $rid = ConvertTo-SIUplinkId ([string](& $get 'Report'))
|                if (-not $rid -or $seen.ContainsKey($rid)) { continue }
|                $state = [string](& $get 'State'); $why = [string](& $get 'Why')
|                $hold = Test-SIUplinkFactHeld -Fact $f
|                $cause = $null
|                if ($hold) {
|                    # #902: a report held ON PURPOSE -- its code from the hold list, never from its text (never si-ra-0900)
|                    if ($hold -eq 'info' -and -not $HoldFields) { continue }   # information only: left out until Invardia takes the class
|                    $hn = @(& $get 'HoldNames' | Where-Object { "$_".Trim() })
|                    $hc = $(if ($hold -eq 'escalated') { $(if ($HoldFields) { [string](Get-SIUplinkCausesState).HoldClassEscalated } else { [string](Get-SIUplinkCausesState).HoldOffEscalatedClass }) } else { [string](Get-SIUplinkCausesState).HoldClassInfo })
|                    $cause = [pscustomobject]@{ CauseClass = $hc; MissingName = $(if ($hn.Count) { ConvertTo-SIUplinkId ([string]$hn[0]) } else { '' }); Known = $true }
|                    $code = Get-SIHoldKindCode -Kind ([string](& $get 'HoldKind')) -Escalated:($hold -eq 'escalated')
|                } else {
|                try { $cause = Get-SIReportCause -State $state -Text $why } catch { $cause = $null }
|                if ($null -eq $cause -or (Get-SIUplinkCausesState).CauseClasses -notcontains [string]$cause.CauseClass) { $cause = [pscustomobject]@{ CauseClass = 'query-defect'; MissingName = ''; Known = $false } }
|                # a COMPLETE report with more rows than the source counted (nothing is missing) is not a report problem at
|                # all: it is never put in Reports -- Invardia made even an Action = none item a fix request (telemetry
|                # si-ra-0201). It stays visible as a note (Get-SIUplinkReportNotes: the run's own log and run record).
|                if ($state -eq 'Complete' -and [string]$cause.CauseClass -eq 'count-more') { continue }
|                $code = Resolve-SIReportCauseCode -Cause $cause
|                }
|                if ($code -notmatch (Get-SIUplinkCausesState).CodePattern) { $code = (Get-SIUplinkCausesState).UnknownCode }
|                $act = Get-SIUplinkCatalogueAction -Entry $byCode[$code] -Version $Version
|                $qh =ConvertTo-SIUplinkId ([string](& $get 'QueryHash')) -Max 16
|                $lgq = ConvertTo-SIUplinkId ([string](& $get 'LastGoodQueryHash')) -Max 16
|                $ret = & $get 'Retries'
|                $rv = [ordered]@{ '429' = 0L; '502' = 0L; '504' = 0L }
|                if ($ret) { foreach ($k in @('429', '502', '504')) { $x = $null; if ($ret -is [System.Collections.IDictionary]) { if ($ret.Contains($k)) { $x = $ret[$k] } } elseif ($ret.PSObject.Properties[$k]) { $x = $ret.$k }; $n = ConvertTo-SIUplinkNumber $x; if ($null -ne $n) { $rv[$k] = $n } } }
|                $st = & $get 'StartedUtc'; $stText = $null
|                if ($st) { try { $stText = ([datetime]$st).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture) } catch { $stText = $null } }
|                $bk = ConvertTo-SIUplinkId ([string](& $get 'Bucket'))
|                $it = [ordered]@{
|                    Report         = $rid
|                    Code           = $code
|                    CauseClass     = [string]$cause.CauseClass
|                    MissingName    = $(if ($cause.MissingName) { [string]$cause.MissingName } else { $null })
|                    MissingLicence = $null
|                    Bucket         = $(if ($bk) { $bk } else { $null })
|                    FixedIn        = $act.FixedIn
|                    Action         = $act.Action
|                    RunMs          = (ConvertTo-SIUplinkNumber (& $get 'RunMs'))
|                    Rows           = (ConvertTo-SIUplinkNumber (& $get 'Rows'))
|                    LastGoodRunMs  = (ConvertTo-SIUplinkNumber (& $get 'LastGoodRunMs'))
|                    LastGoodRows   = (ConvertTo-SIUplinkNumber (& $get 'LastGoodRows'))
|                    SourceCount    = (ConvertTo-SIUplinkNumber (& $get 'SourceCount'))
|                    Buckets        = (ConvertTo-SIUplinkNumber (& $get 'Buckets'))
|                    Retries        = [pscustomobject]$rv
|                    QueryHash      = $(if ($qh) { $qh } else { $null })
|                    QueryChanged   = $(if ($qh -and $lgq) { [bool]($qh -ne $lgq) } else { $null })
|                    Region         = $(if ($reg) { $reg } else { $null })
|                    StartedUtc     = $stText
|                }
|                if ($hold -and $HoldFields) {
|                    # #902: the hold contract's three fields (names in $script:SIUplinkCauses, one place)
|                    $it[[string](Get-SIUplinkCausesState).HoldFieldHeld] = $true
|                    $it[[string](Get-SIUplinkCausesState).HoldFieldAge] = (ConvertTo-SIUplinkNumber (& $get 'KeptAgeHours'))
|                    $hr = ConvertTo-SIUplinkNumber (& $get 'HeldRuns'); if ($null -eq $hr -or $hr -lt 1) { $hr = 1L }
|                    $it[[string](Get-SIUplinkCausesState).HoldFieldRuns] = $hr
|                }
|                # #709: the cause in plain words FIRST ("<report>, <step>: <why>."), then the engine's own first error line
|                if ($Identified) {
|                    if ($hold) { $it.Detail = Join-SIUplinkCauseDetail -Sentence (Get-SIHoldCauseSentence -Fact $f) -Raw '' } else { $it.Detail = Join-SIUplinkCauseDetail -Sentence (Get-SIReportCauseSentence -Fact $f -Cause $cause) -Raw (ConvertTo-SIUplinkDetail $why) }
|                }
|                $seen[$rid] = $true
|                # #902: an information hold sorts after every real failure (it never pushes a real item out of the 20)
|                $failed = [int]($state -in @('Failed', 'NotComplete')); if ($hold -eq 'info') { $failed = 0 }
|                $items.Add([pscustomobject]@{ Sev = [int](Get-SIUplinkCausesState).Severity[[string]$cause.CauseClass]; Failed = $failed; Item = [pscustomobject]$it })
|            } catch { continue }
|        }
|        # most severe first (a failure before a not-applicable report), then the report id -- the same order every run
|        $sorted = @($items | Sort-Object -Property @{ Expression = { $_.Failed }; Descending = $true }, @{ Expression = { $_.Sev } }, @{ Expression = { $_.Item.Report } })
|        $out = @($sorted | Select-Object -First (Get-SIUplinkCausesState).MaxReports | ForEach-Object { $_.Item })
|        return $out
|    } catch { return @() }
|}
|
|function ConvertTo-SIUplinkFailureItem {
|    <#
|        PURE. SUP-2026-00198 (2026-10-19): ONE Reports[] item for a failure OUTSIDE a Risk Analysis report -- the updater's
|        roll / restore -- whose catalogue code the caller KNOWS (-Code, e.g. si-upd-0803). The item has the shape of a report
|        item (ConvertTo-SIUplinkReports): Report = '<job>-<step>' (an id, e.g. updater-roll), Code, CauseClass and
|        FixedIn / Action from the catalogue entry, the context numbers null (not known, never guessed), Detail (-Text,
|        scrubbed, at most 500) on an IDENTIFIED record only. @() for a code that is not in the catalogue -- an item never
|        carries a code Invardia cannot look up. NEVER throws.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Code, [AllowEmptyString()][string]$Job = 'updater', [AllowEmptyString()][string]$Step = '',
|          [AllowEmptyString()][string]$Text = '', [switch]$Identified, [AllowEmptyString()][string]$Version, [AllowEmptyString()][string]$Region,
|          [AllowNull()][object[]]$Catalogue)
|    try {
|        $c = "$Code".Trim().ToLowerInvariant()
|        if ($c -notmatch (Get-SIUplinkCausesState).CodePattern) { return @() }
|        $cat = if ($PSBoundParameters.ContainsKey('Catalogue')) { @($Catalogue) } else { @(Get-SIErrorCatalogue) }
|        $e = @($cat | Where-Object { $_ -and "$($_.code)".Trim().ToLowerInvariant() -eq $c })[0]
|        if (-not $e -or (Get-SIUplinkCausesState).CauseClasses -notcontains [string]$e.causeClass) { return @() }
|        $act = Get-SIUplinkCatalogueAction -Entry $e -Version $Version
|        $rid = ConvertTo-SIUplinkId ((@("$Job".Trim(), "$Step".Trim()) | Where-Object { $_ }) -join '-')
|        if (-not $rid) { $rid = 'updater' }
|        $reg = ConvertTo-SIUplinkId $Region
|        $it = [ordered]@{
|            Report = $rid; Code = $c; CauseClass = [string]$e.causeClass; MissingName = $null; MissingLicence = $null; Bucket = $null
|            FixedIn = $act.FixedIn; Action = $act.Action; RunMs = $null; Rows = $null; LastGoodRunMs = $null; LastGoodRows = $null
|            SourceCount = $null; Buckets = $null; Retries = [pscustomobject][ordered]@{ '429' = 0L; '502' = 0L; '504' = 0L }
|            QueryHash = $null; QueryChanged = $null; Region = $(if ($reg) { $reg } else { $null }); StartedUtc = $null
|        }
|        if ($Identified) { $d = ConvertTo-SIUplinkDetail $Text; if ($d) { $it.Detail = $d } }
|        [pscustomobject]$it
|    } catch { @() }
|}
|
|function Get-SIReportCauseFacts {
|    <#
|        PURE. The facts of every report of a Risk Analysis run that FAILED, is NOT COMPLETE, did NOT APPLY or DEVIATED (more
|        rows than the source's count) -- what ConvertTo-SIUplinkReports maps. From what the run already keeps:
|          -Notes       report -> @{ StartedUtc; EndedUtc; State (NotApplicable | Complete | NotComplete | Unverified); Why; Rows;
|                       SourceCount; Buckets; QueryHash }   (Risk Analysis' $script:RAReportNotes)
|          -Failures    @{ Report; Why } -- Add-RAReportFailure's list
|          -Incomplete  @{ Report; Why } -- the row-count guard's reports
|          -Done        report -> the verdict (Complete | NotComplete | Unverified)
|          -Retries     report -> @{ '429'; '502'; '504' } (Add-SIReportRetryAnswer)
|          -LastGood    report -> @{ Rows; QueryHash } (the report's last complete run, Read-RAStreamLastGood)
|        Returns a list of objects; a report that ran clean is not in it. Never throws.
|    #>
|    param([System.Collections.IDictionary]$Notes, [AllowNull()][object[]]$Failures, [AllowNull()][object[]]$Incomplete,
|          [System.Collections.IDictionary]$Done, [System.Collections.IDictionary]$Retries, [System.Collections.IDictionary]$LastGood)
|    $out = New-Object System.Collections.Generic.List[object]
|    try {
|        $why = { param($list, $n) @(@($list) | Where-Object { $_ -and [string]$_.Report -eq $n } | ForEach-Object { [string]$_.Why }) | Select-Object -First 1 }
|        $names = New-Object System.Collections.Generic.List[string]
|        foreach ($n in @(@($Failures) + @($Incomplete) | Where-Object { $_ } | ForEach-Object { [string]$_.Report })) { if ($n -and -not $names.Contains($n)) { $names.Add($n) } }
|        if ($Notes) { foreach ($n in @($Notes.Keys)) { if (-not $names.Contains([string]$n)) { $names.Add([string]$n) } } }
|        foreach ($n in $names) {
|            $note = if ($Notes -and $Notes.Contains($n)) { $Notes[$n] } else { $null }
|            $nv = { param($k) if ($null -eq $note) { $null } elseif ($note -is [System.Collections.IDictionary]) { if ($note.Contains($k)) { $note[$k] } else { $null } } elseif ($note.PSObject.Properties[$k]) { $note.$k } else { $null } }
|            $state = ''; $text = ''
|            $fw = & $why $Failures $n; $iw = & $why $Incomplete $n
|            $verdict = if ($Done -and $Done.Contains($n)) { [string]$Done[$n] } else { '' }
|            if ($fw) { $state = $(if ($verdict -eq 'NotComplete' -and $fw -match '^not complete: ') { 'NotComplete' } else { 'Failed' }); $text = $fw }
|            elseif ($iw) { $state = 'NotComplete'; $text = $iw }
|            elseif ([string](& $nv 'State') -eq 'NotApplicable') { $state = 'NotApplicable'; $text = [string](& $nv 'Why') }
|            # #814: more rows than the source's count on a COMPLETE report keeps its verdict -- nothing is missing, so it is a
|            # note (Get-SIUplinkReportNotes), never a report item. Labelled Deviated for every report, a Complete Summary's
|            # count-more reached Invardia as si-ra-0201 with Action = support (fix request e394f927, rc13 and later).
|            elseif ([string](& $nv 'Why') -match '(?i)more than the source''s count') {
|                $state = $(if ([string](& $nv 'State') -eq 'Complete' -or $verdict -eq 'Complete') { 'Complete' } else { 'Deviated' }); $text = [string](& $nv 'Why')
|            }
|            else { continue }
|            $runMs = $null
|            try { $s = & $nv 'StartedUtc'; $e = & $nv 'EndedUtc'; if ($s -and $e) { $runMs = [long][Math]::Max(0, (([datetime]$e) - ([datetime]$s)).TotalMilliseconds) } } catch { $runMs = $null }
|            $lg = if ($LastGood -and $LastGood.Contains($n)) { $LastGood[$n] } else { $null }
|            $out.Add([pscustomobject]@{
|                Report = $n; State = $state; Why = $text; StartedUtc = (& $nv 'StartedUtc'); RunMs = $runMs
|                Rows = (& $nv 'Rows'); SourceCount = (& $nv 'SourceCount'); Buckets = (& $nv 'Buckets'); QueryHash = [string](& $nv 'QueryHash')
|                Retries = $(if ($Retries -and $Retries.Contains($n)) { $Retries[$n] } else { $null })
|                LastGoodRows = $(if ($lg) { $lg.Rows } else { $null }); LastGoodRunMs = $null
|                LastGoodQueryHash = $(if ($lg) { [string]$lg.QueryHash } else { '' })
|            })
|        }
|    } catch { }
|    $out.ToArray()
|}
|
|# =====================================================================================================================
|#  #709 -- THE CAUSE IN PLAIN WORDS: which report, which step, and why
|# =====================================================================================================================
|# A class ("kql-query-defect", "report-incomplete") took a session reading logs to explain. Each failed / not complete /
|# not applicable report gets ONE short sentence built from what the engine already wrote (the reason Risk Analysis keeps in
|# sidata.RaReportStatus, the error of a failed query, the retries it counted): "<report>, <step>: <why>". The numbers in
|# it are the report's own (rows, sizes, retries) -- never a secret, never a ticket number. It travels on the fields
|# Invardia already takes: the item's Detail (identified installs; first, before the engine's own first error line) and the
|# run record's ErrorMessage of a run with reports that are not complete (identified). Anonymous installs send no text.
|
|function Get-SIReportCauseStep {
|    <# PURE. The step of the report the text is about, in plain words. #>
|    param([AllowEmptyString()][AllowNull()][string]$State, [AllowEmptyString()][AllowNull()][string]$Text, [AllowEmptyString()][AllowNull()][string]$CauseClass)
|    $t = [string]$Text
|    if ($CauseClass -eq 'settings-unreachable') { return 'reading its settings' }
|    if ($CauseClass -eq 'out-of-memory') { return 'holding its rows in memory' }
|    if ($t -match '(?i)^\s*its query could not be sent') { return 'sending its query to Microsoft Defender' }
|    if ($t -match '(?i)lookup (this report needs|it needs) could not be read|^\s*it was not run: a lookup') { return 'reading a lookup it needs' }
|    if ($t -match '(?i)^\s*it was not run|it is not in this run|not in this worker''s template') { return 'starting the report' }
|    if ($t -match '(?i)could not collect it from its worker') { return 'collecting it from its worker' }
|    if ($t -match '(?i)^\s*its result could not be read') { return 'reading its result' }
|    if ($t -match '(?i)neither stored nor accounted for|\bstored \d+') { return 'storing its rows' }
|    if ($t -match '(?i)quer(y|ies) slice\(s\)|slice\(s\) of the report could not be read|bucket\(s\) could not be read') { return 'reading the parts of its query' }
|    if ($t -match '(?i)the source holds \d+ row\(s\)|more than the source''s count|count the report''s rows') { return 'checking its rows against the source' }
|    if ($CauseClass -in @('count-less', 'count-more')) { return 'checking its rows against the source' }
|    if ($t -match '(?i)^\s*its query failed') { return 'running its query' }
|    if ("$State" -eq 'NotApplicable' -or $CauseClass -in @('no-data-source', 'missing-licence')) { return 'checking its data source' }
|    if ($CauseClass -in @('platform-timeout', 'too-large', 'query-defect', 'missing-column', 'permission')) { return 'running its query' }
|    'running the report'
|}
|
|function Get-SIReportCauseWhy {
|    <# PURE. Why, in plain words, from the cause and the engine's own text (its numbers kept). Never '' -- a text no rule
|       reads says that the cause was not recognised. #>
|    param([AllowEmptyString()][AllowNull()][string]$State, [AllowEmptyString()][AllowNull()][string]$Text, $Cause, $Retries)
|    $t = [string]$Text
|    $cc = if ($Cause) { [string]$Cause.CauseClass } else { '' }
|    $mn = if ($Cause) { [string]$Cause.MissingName } else { '' }
|    $rv = @{ '429' = 0L; '502' = 0L; '504' = 0L }
|    if ($Retries) { foreach ($k in @('429', '502', '504')) { $x = $null; if ($Retries -is [System.Collections.IDictionary]) { if ($Retries.Contains($k)) { $x = $Retries[$k] } } elseif ($Retries.PSObject.Properties[$k]) { $x = $Retries.$k }; $n = ConvertTo-SIUplinkNumber $x; if ($null -ne $n) { $rv[$k] = $n } } }
|    $times = { param($n) if ([long]$n -eq 1) { 'once' } else { '{0} times' -f $n } }
|    # ---- too large: the lookup that has to travel whole, against what one Defender query carries ----------------------------
|    if ($t -match '(?i)the lookups? (?<names>.+?) (is|are) needed whole in every part of the query') {
|        $first = [regex]::Match($Matches['names'], '(?<n>[A-Za-z_][A-Za-z0-9_]*) \((?<r>[\d,\.]+) rows, (?<s>[\d\.]+ (MB|KB|bytes))\)')
|        $cap = [regex]::Match($t, '(?i)can carry \((?<c>[\d\.]+ (MB|KB|bytes))\)')
|        $qs = [regex]::Match($t, '(?i)that is (?<q>[\d\.]+ (MB|KB|bytes)) in every part')
|        $s = if ($first.Success) { 'the lookup {0} is {1}' -f $first.Groups['n'].Value, $first.Groups['s'].Value } else { 'a lookup has to travel whole in every part of the query' }
|        if ($qs.Success) { $s += (' (the query {0} in every part)' -f $qs.Groups['q'].Value) }
|        if ($cap.Success) { $s += (', over the {0} one Microsoft Defender query can carry -- more parts cannot make it fit' -f $cap.Groups['c'].Value) }
|        else { $s += ', more than one Microsoft Defender query can carry' }
|        return $s
|    }
|    if ($t -match '(?i)lookup (this report needs|it needs) could not be read') {
|        $why = [regex]::Match($t, '(?i)could not be read(?: from Log Analytics)?\s*(\([^)]*\))?\s*--\s*(?<w>[^|]{1,160})')
|        if ($why.Success) { $w = ConvertTo-SIUplinkDetail ($why.Groups['w'].Value.Trim().TrimEnd('.')); if ($w) { return ('a lookup it needs could not be read -- {0}' -f $w) } }
|        return 'a lookup it needs could not be read'
|    }
|    # ---- the count against the source / storage (the reasons Risk Analysis keeps in sidata.RaReportStatus) ----------------
|    $m = [regex]::Match($t, '(?i)the source holds (?<e>\d+) row\(s\)[^|]*?retrieved (?<r>\d+)')
|    if ($m.Success) { return ('the source holds {0} rows, the run retrieved {1}' -f $m.Groups['e'].Value, $m.Groups['r'].Value) }
|    $m = [regex]::Match($t, '(?i)retrieved (?<r>\d+) row\(s\), more than the source''s count of (?<e>\d+)')
|    if ($m.Success) { return ('the run retrieved {0} rows, more than the source''s count of {1} -- nothing is missing' -f $m.Groups['r'].Value, $m.Groups['e'].Value) }
|    $m = [regex]::Match($t, '(?i)retrieved (?<r>\d+) row\(s\) and stored (?<s>\d+): (?<l>\d+) row\(s\)')
|    if ($m.Success) { return ('{0} rows were retrieved and {1} stored -- {2} are neither stored nor accounted for' -f $m.Groups['r'].Value, $m.Groups['s'].Value, $m.Groups['l'].Value) }
|    $m = [regex]::Match($t, '(?i)(?<n>\d+) query slice\(s\) of the report could not be read')
|    if ($m.Success) { return ('{0} part(s) of its query could not be read -- their rows are unknown, not resolved' -f $m.Groups['n'].Value) }
|    if ($t -match '(?i)far fewer findings') { return 'it returned far fewer findings than its last run' }
|    if ($t -match '(?i)could not collect it from its worker') { return 'its worker did not hand its result back' }
|    if ($t -match '(?i)it is not in this run|not in this worker''s template') { return 'it is not in this run' }
|    switch ($cc) {
|        'settings-unreachable' { return 'the settings database could not be reached' }
|        'out-of-memory'        { return 'Risk Analysis ran out of memory' }
|        'permission'           { return 'the run''s identity was refused access -- a permission is missing' }
|        'missing-licence'      {
|            if ($mn -like 'devicetvm*') { return ('the tenant has no Defender vulnerability management (the table {0} is not there)' -f $mn) }
|            return 'a licence this report needs is not in the tenant'
|        }
|        'no-data-source'       {
|            if ($mn -eq 'defender-xdr') { return 'advanced hunting (Microsoft Defender XDR) is not set up in this tenant' }
|            if ($mn) { return ('the data source {0} is not in this tenant' -f $mn) }
|            return 'the data source it reads is not in this tenant'
|        }
|        'missing-column'       { if ($mn) { return ('the column {0} is not there -- its source is not set up at this install' -f $mn) }; return 'a column it reads is not there' }
|        'platform-timeout'     {
|            $parts = @()
|            if ($rv['504'] -gt 0) { $parts += ('Microsoft Defender timed out {0}' -f (& $times $rv['504'])) }
|            if ($rv['429'] -gt 0) { $parts += ('it was throttled {0}' -f (& $times $rv['429'])) }
|            if ($rv['502'] -gt 0) { $parts += ('the gateway refused it {0}' -f (& $times $rv['502'])) }
|            if ($parts.Count) { return ($parts -join ', ') }
|            return 'the platform did not answer in time'
|        }
|        'too-large'            {
|            if ($mn -eq 'query-body') { return 'the query is larger than Microsoft Defender accepts' }
|            if ($rv['502'] -gt 0) { return ('the answer was too large for one Microsoft Defender query (refused {0})' -f (& $times $rv['502'])) }
|            return 'the answer was too large for one query'
|        }
|        'query-defect'         {
|            $at = [regex]::Match($t, "(?i)could not be parsed at '(?<tok>[^']{1,40})' on line \[(?<l>\d+),\s*(?<c>\d+)\]")
|            if ($at.Success) { return ('the query has a syntax error at ''{0}'' (line {1}, position {2})' -f $at.Groups['tok'].Value, $at.Groups['l'].Value, $at.Groups['c'].Value) }
|            if ($mn -eq 'syn0002' -or $t -match '(?i)\bSYN0002\b|syntax error') { return 'the query has a syntax error' }
|            if ($Cause -and $Cause.PSObject.Properties['Known'] -and -not $Cause.Known) { return 'the cause was not recognised -- the run''s log has the error' }
|            return 'the query failed'
|        }
|    }
|    if ($cc -eq 'count-less') { return 'fewer rows were stored than the source holds' }
|    if ($cc -eq 'count-more') { return 'more rows than the source''s count -- nothing is missing' }
|    if ("$State" -eq 'NotApplicable') { return 'it does not apply at this install' }
|    'the cause was not recognised -- the run''s log has the error'
|}
|
|function Get-SIReportCauseSentence {
|    <#
|        PURE. "<report>, <step>: <why>." -- one short sentence a person can act on, from a report fact (Report, State, Why,
|        Retries). -Cause: Get-SIReportCause's answer when the caller has it. At most 300 characters. Never throws ('' only for
|        a fact with no report).
|    #>
|    param([AllowNull()]$Fact, $Cause)
|    try {
|        if ($null -eq $Fact) { return '' }
|        $get = { param($n) if ($Fact -is [System.Collections.IDictionary]) { if ($Fact.Contains($n)) { $Fact[$n] } else { $null } } elseif ($Fact.PSObject.Properties[$n]) { $Fact.$n } else { $null } }
|        # the report's uplink id (the one Reports[] already carries) -- never its display name (#641: no report name leaves
|        # the install)
|        $rep = ConvertTo-SIUplinkId ([string](& $get 'Report'))
|        if (-not $rep) { return '' }
|        $state = [string](& $get 'State'); $text = [string](& $get 'Why')
|        # the reason Risk Analysis kept starts "not complete: <reason>" -- the reason is what explains it
|        $plain = ($text -replace '(?i)^\s*not complete:\s*', '')
|        if ($null -eq $Cause) { try { $Cause = Get-SIReportCause -State $state -Text $text } catch { $Cause = $null } }
|        $cc = if ($Cause) { [string]$Cause.CauseClass } else { '' }
|        $step = Get-SIReportCauseStep -State $state -Text $plain -CauseClass $cc
|        $why = Get-SIReportCauseWhy -State $state -Text $plain -Cause $Cause -Retries (& $get 'Retries')
|        $s = ('{0}, {1}: {2}.' -f $rep, $step, $why) -replace '\.\.$', '.'
|        if ($s.Length -gt 300) { $s = $s.Substring(0, 297).TrimEnd() + '...' }
|        # built from SecurityInsight's own words, the report's numbers and names -- still never sent when it looks like a secret
|        if (Test-SIUplinkLooksSecret $s) { return '' }
|        return $s
|    } catch { return '' }
|}
|
|function Join-SIUplinkCauseDetail {
|    <# PURE. An item's Detail: the plain sentence, then " | " and the engine's own first error line (already scrubbed), at
|       most 500 characters; $null when there is neither. #>
|    param([AllowNull()][AllowEmptyString()][string]$Sentence, [AllowNull()][AllowEmptyString()][string]$Raw)
|    $s = "$Sentence".Trim(); $r = "$Raw".Trim()
|    $d = if ($s -and $r) { '{0} | {1}' -f $s, $r } elseif ($s) { $s } elseif ($r) { $r } else { '' }
|    if (-not $d) { return $null }
|    if ($d.Length -gt (Get-SIUplinkCausesState).DetailMax) { $d = $d.Substring(0, (Get-SIUplinkCausesState).DetailMax) }
|    $d
|}
|
|function Get-SIUplinkReportNotes {
|    <#
|        PURE. The reports of a run that are COMPLETE but returned more rows than the source counted -- information, never a
|        failure (ConvertTo-SIUplinkReports leaves them out). Each @{ Report; Rows; SourceCount; Note }. Never throws.
|    #>
|    param([AllowNull()][object[]]$Facts)
|    try {
|        foreach ($f in @($Facts | Where-Object { $_ })) {
|            $get = { param($n) if ($f -is [System.Collections.IDictionary]) { if ($f.Contains($n)) { $f[$n] } else { $null } } elseif ($f.PSObject.Properties[$n]) { $f.$n } else { $null } }
|            $st = [string](& $get 'State'); if ($st -ne 'Complete') { continue }
|            $c = $null; try { $c = Get-SIReportCause -State $st -Text ([string](& $get 'Why')) } catch { $c = $null }
|            if (-not $c -or [string]$c.CauseClass -ne 'count-more') { continue }
|            [pscustomobject][ordered]@{ Report = [string](& $get 'Report'); Rows = (ConvertTo-SIUplinkNumber (& $get 'Rows')); SourceCount = (ConvertTo-SIUplinkNumber (& $get 'SourceCount'))
|                                        Note = 'complete -- more rows than the source counted, nothing is missing (no action)' }
|        }
|    } catch { }
|}
|
|function Get-SIHoldCauseSentence {
|    <# PURE. #902: a report held ON PURPOSE in plain words -- "<report>, held at its last complete result for <n> run(s) in a
|       row: <why>." At most 300 characters; '' when it would look like a secret or the fact has no report. #>
|    param([AllowNull()]$Fact)
|    try {
|        $rid = ConvertTo-SIUplinkId ([string](Get-SIUplinkFactValue $Fact 'Report'))
|        if (-not $rid) { return '' }
|        $n = ConvertTo-SIUplinkNumber (Get-SIUplinkFactValue $Fact 'HeldRuns'); if ($null -eq $n -or $n -lt 1) { $n = 1L }
|        $why = (([string](Get-SIUplinkFactValue $Fact 'Why')) -replace '(?i)^\s*not complete:\s*', '').Trim().TrimEnd('.')
|        $s = ('{0}, held at its last complete result for {1} run(s) in a row: {2}.' -f $rid, $n, $why)
|        if ($s.Length -gt 300) { $s = $s.Substring(0, 297).TrimEnd() + '...' }
|        if (Test-SIUplinkLooksSecret $s) { return '' }
|        $s
|    } catch { '' }
|}
|
|function Get-SIReportCauseHeadline {
|    <# PURE. The sentence of the most severe report that FAILED or is NOT COMPLETE (ConvertTo-SIUplinkReports' order), for
|       the run record's message. '' when there is none. #902: a report held ON PURPOSE that is information only is never
|       the headline; an escalated hold is, as a held report (held-too-long). #>
|    param([AllowNull()][object[]]$Facts)
|    try {
|        $best = $null; $bestSev = [int]::MaxValue
|        foreach ($f in @($Facts | Where-Object { $_ })) {
|            $st = [string]$(if ($f -is [System.Collections.IDictionary]) { $f['State'] } else { $f.State })
|            if ($st -notin @('Failed', 'NotComplete')) { continue }
|            $hold = Test-SIUplinkFactHeld -Fact $f
|            if ($hold -eq 'info') { continue }
|            if ($hold -eq 'escalated') {
|                $sevH = [int](Get-SIUplinkCausesState).Severity[[string](Get-SIUplinkCausesState).HoldClassEscalated]
|                if ($sevH -lt $bestSev) { $best = @{ F = $f; C = $null; H = $true }; $bestSev = $sevH }
|                continue
|            }
|            $wt = [string]$(if ($f -is [System.Collections.IDictionary]) { $f['Why'] } else { $f.Why })
|            $c = $null; try { $c = Get-SIReportCause -State $st -Text $wt } catch { $c = $null }
|            $sev = if ($c -and (Get-SIUplinkCausesState).Severity.ContainsKey([string]$c.CauseClass)) { [int](Get-SIUplinkCausesState).Severity[[string]$c.CauseClass] } else { 99 }
|            if ($sev -lt $bestSev) { $best = @{ F = $f; C = $c }; $bestSev = $sev }
|        }
|        if ($null -eq $best) { return '' }
|        if ($best.H) { return (Get-SIHoldCauseSentence -Fact $best.F) }
|        Get-SIReportCauseSentence -Fact $best.F -Cause $best.C
|    } catch { '' }
|}
|
|function Get-SIReportStatusReasonsSql {
|    <# The reasons Risk Analysis kept for the reports of ONE collection and grain that are NOT COMPLETE (sidata.RaReportStatus). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.RaReportStatus') IS NULL BEGIN SELECT CAST(NULL AS NVARCHAR(256)) AS ReportName, CAST(NULL AS NVARCHAR(2000)) AS Reason WHERE 1 = 0; RETURN; END
|DECLARE @t datetime2(3) = CONVERT(datetime2(3), @CollectionTime, 126);
|SELECT ReportName, Reason FROM sidata.RaReportStatus WHERE CollectionTime = @t AND Grain = @Grain AND State = N'NotComplete' AND NULLIF(Reason, N'') IS NOT NULL;
|'@
|}
|
|function Add-SIReportCauseStoredReasons {
|    <#
|        PURE. The run's report facts, completed with the NotComplete reasons kept in sidata.RaReportStatus (-Stored: rows of
|        ReportName + Reason): a fact without a reason takes the stored one; a report the database holds as NOT COMPLETE that
|        has no fact in this process (a queue worker's report) is added as NotComplete with its reason. Never throws.
|    #>
|    param([AllowNull()][object[]]$Facts, [AllowNull()][object[]]$Stored)
|    $out = New-Object System.Collections.Generic.List[object]
|    try {
|        $byName = @{}
|        foreach ($r in @($Stored | Where-Object { $_ })) {
|            $n = [string]$(if ($r -is [System.Collections.IDictionary]) { $r['ReportName'] } else { $r.ReportName }); $w = [string]$(if ($r -is [System.Collections.IDictionary]) { $r['Reason'] } else { $r.Reason })
|            if ($n -and $w -and -not $byName.ContainsKey($n)) { $byName[$n] = $w }
|        }
|        $seen = @{}
|        foreach ($f in @($Facts | Where-Object { $_ })) {
|            $n = [string]$f.Report; $seen[$n] = $true
|            if (-not "$($f.Why)".Trim() -and $byName.ContainsKey($n)) { $f.Why = $byName[$n]; if (-not "$($f.State)".Trim()) { $f.State = 'NotComplete' } }
|            $out.Add($f)
|        }
|        foreach ($n in @($byName.Keys | Sort-Object)) {
|            if ($seen.ContainsKey($n)) { continue }
|            $out.Add([pscustomobject]@{ Report = $n; State = 'NotComplete'; Why = $byName[$n]; StartedUtc = $null; RunMs = $null; Rows = $null; SourceCount = $null; Buckets = $null
|                                        QueryHash = ''; Retries = $null; LastGoodRows = $null; LastGoodRunMs = $null; LastGoodQueryHash = '' })
|        }
|    } catch { return @($Facts) }
|    $out.ToArray()
|}
|
|function Add-SIReportRetryAnswer {
|    <# Counts one platform answer (429 / 502 / 504) for the report that is running ($global:SI_UplinkCurrentReport) --
|       Risk Analysis' hunting call reports each failed attempt here. Never throws. #>
|    param([AllowNull()][AllowEmptyString()][string]$Message, [string]$Report = [string]$global:SI_UplinkCurrentReport)
|    try {
|        if (-not "$Report".Trim() -or -not "$Message".Trim()) { return }
|        $k = if ($Message -match '(?i)\b429\b|Too ?Many ?Requests|throttl') { '429' } elseif ($Message -match '(?i)\b502\b|Bad Gateway') { '502' } elseif ($Message -match '(?i)\b504\b|Gateway Time-?out|TaskCanceledException|A task was canceled|timed? ?out') { '504' } else { '' }
|        if (-not $k) { return }
|        if ($null -eq $global:SI_UplinkRetryAnswers -or $global:SI_UplinkRetryAnswers -isnot [hashtable]) { $global:SI_UplinkRetryAnswers = @{} }
|        if (-not $global:SI_UplinkRetryAnswers.ContainsKey($Report)) { $global:SI_UplinkRetryAnswers[$Report] = @{ '429' = 0L; '502' = 0L; '504' = 0L } }
|        $global:SI_UplinkRetryAnswers[$Report][$k] = [long]$global:SI_UplinkRetryAnswers[$Report][$k] + 1
|    } catch { }
|}
|
|function Get-SIUplinkRegion {
|    <# The install's Azure region: SI_Location, else the container's SI_CFG_SI_Location / SI_LOCATION. '' = not known. #>
|    param([scriptblock]$GetEnv)
|    if (-not $GetEnv) { $GetEnv = { param($n) [Environment]::GetEnvironmentVariable($n) } }
|    foreach ($v in @([string]$global:SI_Location, [string](& $GetEnv 'SI_CFG_SI_Location'), [string](& $GetEnv 'SI_LOCATION'))) { if ("$v".Trim()) { return (ConvertTo-SIUplinkId $v) } }
|    ''
|}
|
|function Limit-SIUplinkRecordSize {
|    <#
|        The uplink's body limit is 16 KB. A record whose Reports make it larger is cut down -- never refused, never dropped:
|        the Details are shortened to 200 characters, then left out, then the least severe items are left out (the list is
|        already most severe first). Works on the record in place and returns it. Never throws.
|    #>
|    param([Parameter(Mandatory)]$Record, [int]$MaxBytes = 15000)
|    try {
|        if (-not $Record.PSObject.Properties['Reports']) { return $Record }
|        $size = { [System.Text.Encoding]::UTF8.GetByteCount(($Record | ConvertTo-Json -Depth 8 -Compress)) }
|        if ((& $size) -le $MaxBytes) { return $Record }
|        foreach ($i in @($Record.Reports)) { if ($i.PSObject.Properties['Detail'] -and "$($i.Detail)".Length -gt 200) { $i.Detail = "$($i.Detail)".Substring(0, 200) } }
|        if ((& $size) -le $MaxBytes) { return $Record }
|        foreach ($i in @($Record.Reports)) { if ($i.PSObject.Properties['Detail']) { $i.PSObject.Properties.Remove('Detail') } }
|        $list = New-Object System.Collections.Generic.List[object]; foreach ($i in @($Record.Reports)) { $list.Add($i) }
|        while ($list.Count -gt 0 -and (& $size) -gt $MaxBytes) { $list.RemoveAt($list.Count - 1); $Record.Reports = @($list.ToArray()) }
|        if ($list.Count -eq 0) { $Record.PSObject.Properties.Remove('Reports') }
|    } catch { try { $Record.PSObject.Properties.Remove('Reports') } catch { } }
|    $Record
|}
|
|# =====================================================================================================================
|#  The capability probe (heartbeat): Capabilities, CiColumns, Licences
|# =====================================================================================================================
|function Get-SICapabilityProbeLaQuery {
|    <# The ONE Log Analytics query of the probe: the CI table's columns, and whether Sentinel has incidents or alerts. #>
|    @'
|union isfuzzy=true
| (SI_CI_CL | getschema | project Kind = "col", Name = tolower(ColumnName)),
| (SecurityIncident | where TimeGenerated > ago(90d) | take 1 | project Kind = "sentinel", Name = ""),
| (SecurityAlert | where TimeGenerated > ago(90d) | take 1 | project Kind = "sentinel", Name = ""),
| (print Kind = "ok", Name = "")
|| distinct Kind, Name
|'@
|}
|
|function Get-SICapabilityProbeLaMayBeMissing {
|    <# The tables of the probe's Log Analytics query a workspace may not have (2026-10-23: in a workspace without Sentinel
|       the whole answer was refused as cut, so the status report left out the Sentinel, CMDB and CI-column details). #>
|    @('SecurityIncident', 'SecurityAlert')
|}
|
|function Get-SICapabilityProbeHuntingQuery {
|    <# The ONE advanced hunting query of the probe: Defender XDR, Defender vulnerability management, Defender for Identity,
|       and whether SecurityInsight's own table is visible there (Sentinel data lake mirroring). #>
|    @'
|union isfuzzy=true
| (DeviceInfo | take 1 | project T = "xdr"),
| (DeviceTvmSoftwareVulnerabilities | take 1 | project T = "tvm"),
| (IdentityDirectoryEvents | take 1 | project T = "mdi"),
| (SI_CI_CL | take 1 | project T = "lake")
|| distinct T
|'@
|}
|
|function ConvertFrom-SICapabilityProbe {
|    <#
|        PURE. The probe's answers as the heartbeat's three fields. -LaRows (the LA query's rows, $null = not read), -HuntRows
|        (the hunting query's rows, $null = not read), -HuntNotProvisioned (no Defender XDR at all), -Skus (Graph
|        subscribedSkus .value, $null = not read). A key whose answer was not read is LEFT OUT.
|        Returns @{ Capabilities (ordered); CiColumns (ids); Licences (ids) }.
|    #>
|    param([AllowNull()][object[]]$LaRows, [AllowNull()][object[]]$HuntRows, [switch]$HuntNotProvisioned, [AllowNull()][object[]]$Skus, [switch]$SkusRead)
|    $cap = [ordered]@{}
|    $ci = New-Object System.Collections.Generic.List[string]
|    $lic = New-Object System.Collections.Generic.List[string]
|    if ($null -ne $LaRows) {
|        $okRow = @($LaRows | Where-Object { $_ -and [string]$_.Kind -eq 'ok' }).Count -gt 0
|        if ($okRow) {
|            $cols = @($LaRows | Where-Object { $_ -and [string]$_.Kind -eq 'col' } | ForEach-Object { ([string]$_.Name).ToLowerInvariant() })
|            if ($cols.Count) {
|                $opt = @($cols | Where-Object { $_ -match (Get-SIUplinkCausesState).OptionalCiColumnPattern } | Sort-Object -Unique)
|                foreach ($c in ($opt | Select-Object -First (Get-SIUplinkCausesState).MaxCiColumns)) { $id = ConvertTo-SIUplinkId $c; if ($id) { $ci.Add($id) } }
|                $cap['cmdb'] = [bool](@($opt | Where-Object { $_ -like 'si_cmdb_*' }).Count -gt 0)
|            }
|            $cap['sentinel'] = [bool](@($LaRows | Where-Object { $_ -and [string]$_.Kind -eq 'sentinel' }).Count -gt 0)
|        }
|    }
|    if ($HuntNotProvisioned) { $cap['defenderXdr'] = $false; $cap['defenderVulnMgmt'] = $false; $cap['mdi'] = $false }
|    elseif ($null -ne $HuntRows) {
|        $ts = @($HuntRows | Where-Object { $_ } | ForEach-Object { [string]$_.T })
|        $cap['defenderXdr'] = [bool]($ts -contains 'xdr'); $cap['defenderVulnMgmt'] = [bool]($ts -contains 'tvm'); $cap['mdi'] = [bool]($ts -contains 'mdi')
|        $cap['dataLake'] = [bool]($ts -contains 'lake')
|    }
|    if ($SkusRead -and $null -ne $Skus) {
|        $plans = @{}
|        foreach ($s in @($Skus)) {
|            if ($null -eq $s) { continue }
|            $status = [string]$s.capabilityStatus
|            if ($status -and $status -notin @('Enabled', 'Warning')) { continue }
|            $id = ConvertTo-SIUplinkId ([string]$s.skuPartNumber)
|            if ($id -and -not $lic.Contains($id) -and $lic.Count -lt (Get-SIUplinkCausesState).MaxLicences) { $lic.Add($id) }
|            foreach ($p in @($s.servicePlans)) { if ($p -and [string]$p.servicePlanName) { $plans[[string]$p.servicePlanName] = $true } }
|        }
|        foreach ($pn in @((Get-SIUplinkCausesState).PlanCapabilities.Keys)) {
|            $k = (Get-SIUplinkCausesState).PlanCapabilities[$pn]
|            if ($k -eq 'defenderVulnMgmt') { continue }   # measured from the data itself (DeviceTvm*), the licence only adds to it
|            $cap[$k] = [bool]($plans.ContainsKey($pn) -or ($cap.Contains($k) -and $cap[$k]))
|        }
|    }
|    # the closed keys only, in the agreed order
|    $closed = [ordered]@{}; foreach ($k in (Get-SIUplinkCausesState).CapabilityKeys) { if ($cap.Contains($k)) { $closed[$k] = [bool]$cap[$k] } }
|    [pscustomobject]@{ Capabilities = $closed; CiColumns = @($ci.ToArray()); Licences = @($lic.ToArray()) }
|}
|
|function Get-SICapabilityProbe {
|    <#
|        THE PROBE, once per process ($global:SI_CapabilityProbe): one Log Analytics query, one advanced hunting query and --
|        only when the run's identity may read them -- Graph subscribedSkus. -RunQuery { param($Kql) rows }, -RunHunting
|        { param($Kql) rows }, -GraphGet { param($Uri) response } are the seams (defaults: SI-TelemetryCounts.ps1's readers and
|        SI-GraphRest.ps1). A test session never reads anything without a seam. Licences that cannot be read (no permission,
|        no Graph sign-in) are left out and said in ONE Write-Diag line; no permission is ever added for them. Never throws.
|    #>
|    param([scriptblock]$RunQuery, [scriptblock]$RunHunting, [scriptblock]$GraphGet, [switch]$Refresh)
|    if (-not $Refresh -and -not ($RunQuery -or $RunHunting -or $GraphGet) -and $null -ne $global:SI_CapabilityProbe) { return $global:SI_CapabilityProbe }
|    $test = [bool](Get-Module -Name Pester)
|    $la = $null; $hunt = $null; $notProv = $false; $skus = $null; $skusRead = $false
|    try {
|        if (-not $RunQuery -and -not $test -and (Get-Command -Name Invoke-SITelemetryLaQuery -ErrorAction SilentlyContinue)) { $RunQuery = { param($Kql) Invoke-SITelemetryLaQuery -Query $Kql -MayBeMissing @(Get-SICapabilityProbeLaMayBeMissing) } }
|        if ($RunQuery) { try { $la = & $RunQuery (Get-SICapabilityProbeLaQuery); if ($null -ne $la) { $la = @($la) } } catch { $la = $null; Write-SIUplinkDiag ("capability probe: the workspace could not be read ({0})" -f $_.Exception.Message) } }
|    } catch { $la = $null }
|    try {
|        if (-not $RunHunting -and -not $test -and (Get-Command -Name Invoke-SITelemetryHuntingQuery -ErrorAction SilentlyContinue)) { $RunHunting = { param($Kql) Invoke-SITelemetryHuntingQuery -Query $Kql } }
|        if ($RunHunting) {
|            try { $hunt = @(& $RunHunting (Get-SICapabilityProbeHuntingQuery)) }
|            catch {
|                $hunt = $null
|                if ("$($_.Exception.Message)" -match 'Account is not provisioned') { $notProv = $true }
|                else { Write-SIUplinkDiag ("capability probe: advanced hunting could not be read ({0})" -f $_.Exception.Message) }
|            }
|        }
|    } catch { $hunt = $null }
|    try {
|        if (-not $GraphGet -and -not $test -and (Get-Command -Name Get-SIGraphToken -ErrorAction SilentlyContinue) -and (Get-Command -Name Invoke-SIGraphRest -ErrorAction SilentlyContinue)) {
|            $GraphGet = { param($Uri) $tok = Get-SIGraphToken -Resource Graph; Invoke-SIGraphRest -Uri $Uri -Token $tok -TimeoutSec 30 -MaxAttempts 1 }
|        }
|        if ($GraphGet) {
|            # Directory.Read.All (config\permissions.locked.json, collection identity) covers GET /subscribedSkus; an identity
|            # that was not granted it answers 403 -- then there are no Licences, said once, and nothing is granted
|            try { $resp = & $GraphGet '/subscribedSkus?$select=skuPartNumber,capabilityStatus,servicePlans'; $skus = @(if ($resp -and $resp.PSObject.Properties['value']) { $resp.value } else { $resp }); $skusRead = $true }
|            catch { $skus = $null; Write-SIUplinkDiag ("capability probe: no Licences in the status report -- the tenant's licences (Graph subscribedSkus) could not be read with this identity ({0}); it needs Directory.Read.All, which SecurityInsight's permission list already names -- nothing is granted here" -f $_.Exception.Message) }
|        } else { Write-SIUplinkDiag 'capability probe: no Licences in the status report -- no Microsoft Graph sign-in is loaded in this job' }
|    } catch { $skus = $null; $skusRead = $false }
|    $p = $null
|    try { $p = ConvertFrom-SICapabilityProbe -LaRows $la -HuntRows $hunt -HuntNotProvisioned:$notProv -Skus $skus -SkusRead:$skusRead } catch { $p = [pscustomobject]@{ Capabilities = [ordered]@{}; CiColumns = @(); Licences = @() } }
|    if (-not ($PSBoundParameters.ContainsKey('RunQuery') -or $PSBoundParameters.ContainsKey('RunHunting') -or $PSBoundParameters.ContainsKey('GraphGet'))) { $global:SI_CapabilityProbe = $p }
|    $p
|}
|
|# =====================================================================================================================
|#  Customer mails: the reference codes of a failure, each linked to its page
|# =====================================================================================================================
|function Get-SIUplinkMailCodes {
|    <# PURE. The distinct codes of a run's report facts (ConvertTo-SIUplinkReports' mapping), in its order, at most 20. #>
|    param([AllowNull()][object[]]$Facts)
|    try { @(@(ConvertTo-SIUplinkReports -Facts $Facts) | ForEach-Object { [string]$_.Code } | Select-Object -Unique) } catch { @() }
|}
|
|function ConvertTo-SIErrorCodeMailHtml {
|    <# PURE. One paragraph for a failure mail: 'Reference: <code> (linked to its page), ...' -- '' when there is none. #>
|    param([AllowNull()][string[]]$Codes)
|    $links = @(@($Codes) | Where-Object { Get-SIErrorCodeUrl $_ } | Select-Object -Unique | ForEach-Object {
|        $u = Get-SIErrorCodeUrl $_
|        '<a href="{0}" style="color:#0969da;">{1}</a>' -f [System.Net.WebUtility]::HtmlEncode($u), [System.Net.WebUtility]::HtmlEncode(([string]$_).ToLowerInvariant())
|    })
|    if (-not $links.Count) { return '' }
|    '<p style="margin:0 0 10px 0;">Reference: {0} &mdash; each code''s page says what it means and what to do.</p>' -f ($links -join ', ')
|}
'@ }
$__siSupportFiles['engine/_shared/SI-HoldKinds.ps1'] = @{ Sha256 = '21fb034a309b3b7fdb084db0dc80553755d2af0432b50df9604d5e3505e5348d'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE ONE LIST OF REPORTS HELD ON PURPOSE (#902; owner 2026-10-26: "Approve, next release").
|
|    A report SI holds back ON PURPOSE keeps its last complete result and closes nothing (#900 a source that went silent,
|    #899 an incomplete Entra role read, #901 the run publishes). WHICH reasons exist, and the stable code of each, is ONE
|    list: data-model/hold-kinds.locked.json. Every reader goes through this file -- the stored sidata.RaReportStatus.HoldKind
|    (Add-RADeliberateHold, Set-RAStreamReportNotComplete), the uplink item (SI-UplinkCauses.ps1), the mail (RA-ReportMail.ps1)
|    and the heartbeat Warnings -- and the web app reads the same file (SI.Management.Core/Holds/HoldKinds.cs). A test fails
|    when code emits a kind that is not in the list (SIv3-HoldKinds.Tests.ps1).
|
|    The safe direction everywhere: a list that cannot be read has NO kinds, so every report is a real failure (nothing is
|    hidden as "held"). Whether a report IS held stays Get-RADeliberateHoldKind's rule (RA-SilentSource.ps1) -- not here.
|    PS 5.1 and 7. No modules, no network.
|#>
|
|$script:SIHoldKindsCache = $null
|
|function Get-SIHoldKinds {
|    <# The list, read once per process (-Path: the test seam, never cached). @{ Version; EscalateAfterDetailedRuns; Kinds =
|       @(@{ Kind; Code; EscalationCode; AcceptEmpty }) }. No kinds when the file cannot be read. #>
|    param([string]$Path)
|    if (-not $Path -and $null -ne $script:SIHoldKindsCache) { return $script:SIHoldKindsCache }
|    $p = $Path
|    if (-not $p) { $p = [System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'data-model', 'hold-kinds.locked.json') }
|    $out = [pscustomobject]@{ Version = 0; EscalateAfterDetailedRuns = 3; Kinds = @() }
|    try {
|        $j = [System.IO.File]::ReadAllText($p).TrimStart([char]0xFEFF) | ConvertFrom-Json -ErrorAction Stop
|        $n = 3; if ($j.PSObject.Properties['escalateAfterDetailedRuns'] -and [int]$j.escalateAfterDetailedRuns -ge 1) { $n = [int]$j.escalateAfterDetailedRuns }
|        $kinds = @(@($j.kinds) | Where-Object { $_ -and "$($_.kind)".Trim() -and "$($_.code)" -match '^si-[a-z]{2,8}-\d{4}$' -and "$($_.escalationCode)" -match '^si-[a-z]{2,8}-\d{4}$' } | ForEach-Object {
|            [pscustomobject]@{ Kind = "$($_.kind)".Trim(); Code = "$($_.code)".Trim().ToLowerInvariant(); EscalationCode = "$($_.escalationCode)".Trim().ToLowerInvariant(); AcceptEmpty = [bool]$_.acceptEmpty }
|        })
|        $out = [pscustomobject]@{ Version = [int]$j.version; EscalateAfterDetailedRuns = $n; Kinds = $kinds }
|    } catch { }
|    if (-not $Path) { $script:SIHoldKindsCache = $out }
|    $out
|}
|
|function Get-SIHoldKind {
|    <# The list entry of -Kind ($null when the kind is not in the list). #>
|    param([AllowNull()][AllowEmptyString()][string]$Kind)
|    if (-not "$Kind".Trim()) { return $null }
|    @((Get-SIHoldKinds).Kinds | Where-Object { $_.Kind -eq "$Kind".Trim() })[0]
|}
|
|function Test-SIHoldKind {
|    <# Is -Kind a kind of the list? ('' and an unknown kind: no -- the report is then a real failure.) #>
|    param([AllowNull()][AllowEmptyString()][string]$Kind)
|    [bool](Get-SIHoldKind -Kind $Kind)
|}
|
|function Get-SIHoldKindCode {
|    <# The catalogue code of -Kind: its information code, or its escalation code with -Escalated. '' for an unknown kind. #>
|    param([AllowNull()][AllowEmptyString()][string]$Kind, [switch]$Escalated)
|    $k = Get-SIHoldKind -Kind $Kind
|    if (-not $k) { return '' }
|    if ($Escalated) { return [string]$k.EscalationCode }
|    [string]$k.Code
|}
|
|function Test-SIHoldKindAcceptEmpty {
|    <# May an Admin accept the source of a report held for -Kind as empty for good? Only a kind of the list that says so. #>
|    param([AllowNull()][AllowEmptyString()][string]$Kind)
|    $k = Get-SIHoldKind -Kind $Kind
|    [bool]($k -and $k.AcceptEmpty)
|}
|
|function Test-SIHoldEscalated {
|    <# PURE. Is a hold escalated -- a real problem? Only a DETAILED run's hold, held -HeldRuns runs in a row (this run
|       included), at least escalateAfterDetailedRuns of the list. #>
|    param([AllowNull()]$HeldRuns, [AllowNull()][AllowEmptyString()][string]$Grain)
|    if ("$Grain" -ne 'Detailed') { return $false }
|    $n = 0
|    if ($null -eq $HeldRuns -or $HeldRuns -is [System.DBNull] -or -not [int]::TryParse("$HeldRuns", [ref]$n)) { return $false }
|    $n -ge [int](Get-SIHoldKinds).EscalateAfterDetailedRuns
|}
|
|function Get-RAHoldStreak {
|    <#
|        PURE. #902 (4): how many runs of this grain in a row a report is held for -Kind, this run included. -Previous: the
|        report's previous verdict row of the same grain (HoldKind, HeldRuns; $null = none). Held for the SAME kind before ->
|        its HeldRuns + 1; anything else (Complete, a real failure, another kind, no row, a row from before the column) -> 1.
|    #>
|    param([Parameter(Mandatory)][string]$Kind, [AllowNull()]$Previous)
|    if ($null -eq $Previous) { return 1 }
|    $pk = $null; $pr = $null
|    if ($Previous -is [System.Collections.IDictionary]) { $pk = $Previous['HoldKind']; $pr = $Previous['HeldRuns'] }
|    else { if ($Previous.PSObject.Properties['HoldKind']) { $pk = $Previous.HoldKind }; if ($Previous.PSObject.Properties['HeldRuns']) { $pr = $Previous.HeldRuns } }
|    if ($null -eq $pk -or $pk -is [System.DBNull] -or "$pk" -ne $Kind) { return 1 }
|    $n = 0
|    if ($null -eq $pr -or $pr -is [System.DBNull] -or -not [int]::TryParse("$pr", [ref]$n) -or $n -lt 1) { return 1 }
|    $n + 1
|}
'@ }
$__siSupportFiles['data-model/hold-kinds.locked.json'] = @{ Sha256 = '4c9885b896cf44f7879f50593e00f7b2bdd6d65e36e06427036cc3c99ed71a4a'; Text = @'
|{
|  "_comment": "THE ONE LIST of the reasons SecurityInsight holds a report back ON PURPOSE at its last complete result (#902). Every reader goes through it: the engine (engine/_shared/SI-HoldKinds.ps1 -- the stored sidata.RaReportStatus.HoldKind, the uplink item, the mail, the heartbeat Warnings) and the web app (SI.Management.Core/Holds/HoldKinds.cs, embedded). A new kind = one entry here + its two codes in errors.locked.json (code: information, cause class held-last-good; escalationCode: the same report held escalateAfterDetailedRuns Detailed runs in a row, cause class held-too-long). acceptEmpty: an Admin may accept the source as empty for good, per report (only a kind that means a SUCCESSFUL read of zero rows). A test fails when code emits a kind that is not here.",
|  "version": 1,
|  "escalateAfterDetailedRuns": 3,
|  "kinds": [
|    { "kind": "silent-source", "code": "si-ra-0911", "escalationCode": "si-ra-0913", "acceptEmpty": true },
|    { "kind": "role-read", "code": "si-ra-0912", "escalationCode": "si-ra-0914", "acceptEmpty": false }
|  ]
|}
'@ }
$__siSupportFiles['data-model/errors.locked.json'] = @{ Sha256 = '733aa319f6fe48cf8a6c7bb497dbc2cb782deaae8ee36c8e3d4f8ca63d3bc31e'; Text = @'
|[
|  {
|    "code": "si-ra-0101",
|    "title": "Defender Vulnerability Management is not in this tenant",
|    "causeClass": "missing-licence",
|    "appliesTo": {
|      "capabilities": [
|        "defenderVulnMgmt"
|      ],
|      "licences": [
|        "MDE P2 or the Defender Vulnerability Management add-on"
|      ]
|    },
|    "customerText": "Your tenant does not have Microsoft Defender Vulnerability Management, so the reports about missing security updates and device recommendations do not apply. Nothing is wrong and nothing is missing.",
|    "internalNote": "Tenant lacks DeviceTvm* tables (no MDE P2 / Defender Vulnerability Management add-on). Seen at customer A 2026-10-15. Reports: Device_Missing_CVEs_*, Device_Recommendations_*.",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": "3.0.0.202610151821",
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. If you add Defender Vulnerability Management later, these reports start on their own with the next run."
|      }
|    ],
|    "lesson": null,
|    "since": "3.0.0.202610151821"
|  },
|  {
|    "code": "si-ra-0102",
|    "title": "An optional asset field is not in this install (for example no CMDB)",
|    "causeClass": "missing-column",
|    "appliesTo": {
|      "capabilities": [
|        "cmdb"
|      ],
|      "licences": []
|    },
|    "customerText": "Your install has no CMDB data, so one asset field SecurityInsight can use does not exist yet. Earlier versions then scored findings without the asset's tier and exposure; this version reads the field only when it exists.",
|    "internalNote": "SI_CI_CL has no si_cmdb_* (or other optional) column at an install without that source; 1701 and older failed the CI context read (Failed to resolve scalar expression si_cmdb_id) -> findings scored without tier/exposure. Seen at customer G 2026-10-15.",
|    "whoActs": "nobody",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "fixed-in",
|    "fixedIn": "3.0.0.202610151840",
|    "waitForFix": true,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The fix arrives with the update; the next run scores every finding with its asset's tier and exposure."
|      }
|    ],
|    "lesson": null,
|    "since": "3.0.0.202610151840"
|  },
|  {
|    "code": "si-ra-0103",
|    "title": "A report query used a reserved word and could not run",
|    "causeClass": "query-defect",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report could not run because of an error in SecurityInsight's own query, so it returned no rows. This was SecurityInsight's fault, not your environment's.",
|    "internalNote": "Identity_SPN_OwnerMismatch read _ow.of (of is a KQL keyword) -> Log Analytics SYN0002, 0 rows. Internal 2026-10-15.",
|    "whoActs": "nobody",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "fixed-in",
|    "fixedIn": "3.0.0.202610151701",
|    "waitForFix": true,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The fix arrives with the update; the next run fills the report."
|      }
|    ],
|    "lesson": null,
|    "since": "3.0.0.202610151701"
|  },
|  {
|    "code": "si-ra-0201",
|    "title": "A report returned more rows than the source's count",
|    "causeClass": "count-more",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "A report returned slightly more rows than the source counted (the two are read a moment apart). Nothing is missing; earlier versions wrongly called the report incomplete.",
|    "internalNote": "Retrieved > source count was marked NotComplete before 1821 (customer G 2026-10-15, Attack_Paths_Summary_Credential_Based_Lateral_Movement 4 vs 3).",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "fixed-in",
|    "fixedIn": "3.0.0.202610151821",
|    "waitForFix": true,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do."
|      }
|    ],
|    "lesson": null,
|    "since": "3.0.0.202610151821"
|  },
|  {
|    "code": "si-ra-0302",
|    "title": "A report's data is more than Log Analytics can answer at once",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report needs more data from Log Analytics than one answer can carry. SecurityInsight reads it again in smaller parts; only when even the smallest parts cannot be answered is the report left out of this run. Its findings are then unknown for this run, not resolved, and SecurityInsight's team looks at it.",
|    "internalNote": "Log Analytics PartialError for a limit (result over the row / size limit, a part out of time or memory) on a report's own query or a lookup it needs. The read is repeated in 2, 4, 8 ... parts (a hash of the whole result row) until every part is whole; it stops (this code) only when two part counts in a row were refused with no row at all -- the query's own work is the limit, which every part repeats. A short answer is never stored as whole. NOT the cause at customer A 2026-10-15 (19:22Z / 19:28Z, Azure_Recommendations_* and Azure_DefenderRecommendations_*): there SI_AzureRecommendation_CL did not exist, a union isfuzzy leg over it is answered PartialError (severity Warning, 'Failed to resolve table'), and the engine refused every partial answer as 'exceeded the allowed limits' -- that answer is now taken as the whole result (#690 (37)).",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Read the run log for the report: it names the query or lookup and the part count it reached. The query itself has to be made lighter (fewer columns, an earlier filter) -- more parts cannot help."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0303",
|    "title": "Risk Analysis ran out of memory on a report",
|    "causeClass": "out-of-memory",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "Risk Analysis ran out of memory while it read the data one report needs, so that report was left out of this run. Its findings are unknown for this run, not resolved, and nothing is closed because of it. The other reports ran. The next update gives the Risk Analysis job more memory, and SecurityInsight's team looks at it.",
|    "internalNote": "An OutOfMemoryException while a report's lookups (its let-bindings over SI_CI_CL / SI_*_Profile_CL) were read from Log Analytics or inlined. Seen at the large ring-1 install 2026-10-15 23:27Z (rc.1247 / 1701): Identity_Admin_LogonTo_InternetExposedDevice_Summary, two hours into the run -- every report's lookups were cached for the whole run and never let go. Since this code: a lookup is kept only while the current or the previous report uses it, an out-of-memory lets go of every cached lookup (the run goes on), and the run health END says 'out of memory', which raises the Risk Analysis job one size band at the next update. Before this code the same failure was reported as too-large (si-ra-0905).",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Read the run log for the report: the lookup it read, its rows and the job's size. Check that the next update raised the Risk Analysis job one size band (the update log says 'job size: ... raised'); at 4 CPU / 8 GiB the report's lookup itself has to be made smaller."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-set-0401",
|    "title": "The settings database cannot be reached",
|    "causeClass": "settings-unreachable",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "SecurityInsight could not reach its own settings database, so the run stopped before it collected anything. Your existing data is unchanged.",
|    "internalNote": "SQL error 40 on the settings database (sql-si-*): firewall / public network access or a paused server; check the server network settings with the Support app (needs its role on the SI subscription). Seen at customer E (a test install) 2026-10-15.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "params": {
|          "ResourceGroup": "resourceGroup",
|          "SubscriptionId": "subscriptionId"
|        },
|        "who": "customer",
|        "script": "Grant-SISupportAccess.ps1"
|      }
|    ],
|    "lesson": null,
|    "since": "3.0.0.202610151854"
|  },
|  {
|    "code": "si-col-0501",
|    "title": "A collection ran out of memory",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One collection needed more memory than its job has and stopped before it finished. It is marked not complete, so nothing in it is read as removed and the last complete collection stays in use until the next run finishes.",
|    "internalNote": "Identity producer at customer B 2026-10-15 (3.0.0.202610151701, 1,195 subscriptions): the Azure RBAC read kept the whole role-definition list per subscription; OutOfMemoryException from the 6th minute, both identity sources then threw and were \"continued with 0\". Fixed: role names only (built-ins once per run), the Exposure Graph identity nodes / service principal index / MFA registration read page by page, a failed source stops the collection (NOT COMPLETE), class out-of-memory (#702). The job-size rule raises the job one band after an out-of-memory run at the next update.",
|    "whoActs": "nobody",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "fixed-in",
|    "fixedIn": null,
|    "waitForFix": true,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The fix arrives with the update; the update also gives the job more memory when its last run ran out."
|      }
|    ],
|    "lesson": "A lookup kept per subscription / per page multiplies by the tenant: keep names and ids, never whole answers.",
|    "since": null
|  },
|  {
|    "code": "si-upl-0601",
|    "title": "The run record could not be built",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "A run could not prepare its status report for the support service, so support did not hear how the run ended. The run itself is not affected; its result is in the run log.",
|    "internalNote": "customer B 2026-10-15 19:11Z: \"The status report to Invardia could not be prepared (OutOfMemoryException)\" -- no run record / heartbeat after 15:25Z, the failure never reached Invardia. Fixed: a failed run lets go of its caches before the end record; an out-of-memory while preparing tries once more with the run record alone; the warning and the result carry si-upl-0601 (#702).",
|    "whoActs": "nobody",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "fixed-in",
|    "fixedIn": null,
|    "waitForFix": true,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The next run reports as usual."
|      }
|    ],
|    "lesson": "The end-of-run report must not need the memory the run used up: free first, then build the smallest report.",
|    "since": null
|  },
|  {
|    "code": "si-ra-0900",
|    "title": "A report failed for a cause SecurityInsight does not recognise yet",
|    "causeClass": "query-defect",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report could not be completed this run for a reason SecurityInsight does not recognise yet. SecurityInsight support has been told and looks into it; nothing has to be done in your environment.",
|    "internalNote": "No rule recognised the engine's error text (Get-SIReportCause Known = false). Read the item's Detail; give the cause its own code when it is understood.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Read the Detail on the environment's page and the run's log for the report; add a code for the cause."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0901",
|    "title": "A report has no data source in this tenant",
|    "causeClass": "no-data-source",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report reads data your tenant does not have (for example a Microsoft Defender product that is not in use), so the report does not apply. Nothing is wrong and nothing is missing.",
|    "internalNote": "Generic code of no-data-source: a table the report reads is not in this tenant (MissingName names it).",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The report starts on its own when the data source is added."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0902",
|    "title": "A column a report reads is not in this install",
|    "causeClass": "missing-column",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report reads a field that does not exist in your install, so the report could not be completed this run. SecurityInsight support has been told; nothing has to be done in your environment.",
|    "internalNote": "Generic code of missing-column: the column named in MissingName is not in the table the report reads (an optional CI column is si-ra-0102).",
|    "whoActs": "support",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Check whether the column is optional at this install; the report must read it only when it exists."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0903",
|    "title": "A report's query has an error",
|    "causeClass": "query-defect",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report could not run because of an error in SecurityInsight's own query, so it returned no rows this run. This is SecurityInsight's fault, not your environment's.",
|    "internalNote": "Generic code of query-defect: Log Analytics / advanced hunting refused the query (syntax or semantic error). Re-running fails identically; the query must be fixed.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Fix the report's query and release the fix; the next run fills the report."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0904",
|    "title": "A report timed out or Microsoft's service failed",
|    "causeClass": "platform-timeout",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "Microsoft's service did not answer one report in time this run (or answered with a temporary error). The report is read again on the next run; nothing has to be done in your environment.",
|    "internalNote": "Generic code of platform-timeout: a timeout, a 5xx, throttling or a cancelled query after the run's retries. Retries holds the answers.",
|    "whoActs": "support",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Compare the report's run time and retries with its last good run; if it repeats, raise its slice count."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0905",
|    "title": "A report's answer was too large",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report's answer was larger than Microsoft's service returns at once, so it could not be read in full this run. SecurityInsight reads it in smaller parts on its own; nothing has to be done in your environment.",
|    "internalNote": "Generic code of too-large: 502 Bad Gateway from the hunting front end, the 100,000-row limit, the allowed result size, or out of memory.",
|    "whoActs": "support",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Check the report's slice count against its rows; if it repeats, raise the slice count."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0906",
|    "title": "A report returned more rows than the source counted",
|    "causeClass": "count-more",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "A report returned slightly more rows than the source counted (the two are read a moment apart). Nothing is missing.",
|    "internalNote": "Generic code of count-more (the known case is si-ra-0201).",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0907",
|    "title": "A report returned fewer rows than the source holds",
|    "causeClass": "count-less",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report returned fewer rows than the source holds, so it is not complete this run. The findings that are missing are kept as they were (not closed); SecurityInsight support has been told.",
|    "internalNote": "Generic code of count-less: retrieved below the source's count, rows lost between retrieval and storage, a lost slice, or far fewer findings than the previous run.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Compare SourceCount, Rows and LastGoodRows; read the Detail for the slice that was lost."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0908",
|    "title": "A report could not reach the settings database",
|    "causeClass": "settings-unreachable",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "SecurityInsight could not reach its own settings database while running one report. Your existing data is unchanged; SecurityInsight support has been told.",
|    "internalNote": "Generic code of settings-unreachable (the known case is si-set-0401).",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Check the server's network settings with the Support app."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0909",
|    "title": "SecurityInsight's identity may not read what a report needs",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "SecurityInsight's identity is not allowed to read the data one report needs, so the report could not be completed. Get Started > Permissions names the missing permission; grant it with the setup script.",
|    "internalNote": "Generic code of permission: a 401 / 403 from Graph, Defender, ARM, Key Vault or storage while the report ran.",
|    "whoActs": "customer",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Open Get Started > Permissions and grant what it lists with the setup script."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0910",
|    "title": "A report needs a licence this tenant does not have",
|    "causeClass": "missing-licence",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report needs a Microsoft licence your tenant does not have, so the report does not apply. Nothing is wrong and nothing is missing.",
|    "internalNote": "Generic code of missing-licence (the known case is si-ra-0101, Defender Vulnerability Management).",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. If the licence is added later, the report starts on its own with the next run."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0911",
|    "title": "A report kept its last complete result: a source it reads returned no rows",
|    "causeClass": "held-last-good",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report reads a Microsoft source that had rows before and returned none this run. SecurityInsight kept the report's last complete result and closed nothing in it. The report updates again as soon as the source has rows. If you turned that feature off on purpose, an Admin can accept the empty source on the Run reports page.",
|    "internalNote": "#900 / #902: a held report, kind silent-source (data-model/hold-kinds.locked.json) -- a source table the report reads counted 0 rows (a successful count) after it had rows (sidata.RaSourceCount). Information only: the report keeps its last complete result and nothing of it closes. MissingName names the table. Held 3 Detailed runs in a row = si-ra-0913.",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The report updates on its own when the source has rows again."
|      },
|      {
|        "who": "customer",
|        "text": "Only if the feature behind the source was turned off for good: an Admin opens Run health > Risk Analysis reports and accepts the empty source for that report."
|      }
|    ],
|    "lesson": "A source that goes silent is not a fix: the findings it showed never close because of it.",
|    "since": null
|  },
|  {
|    "code": "si-ra-0912",
|    "title": "A report kept its last complete result: the Entra role read was not complete",
|    "causeClass": "held-last-good",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The list of Entra role assignments came back incomplete this run. The reports that read role lists kept their last complete result and closed nothing. The next run reads the list again.",
|    "internalNote": "#899 / #902: a held report, kind role-read (data-model/hold-kinds.locked.json) -- the identity run could not read the Entra role assignments completely. Information only: the report keeps its last complete result and nothing of it closes. Held 3 Detailed runs in a row = si-ra-0914.",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The next run reads the role assignments again."
|      }
|    ],
|    "lesson": "A role list that was not read is never an empty role list.",
|    "since": null
|  },
|  {
|    "code": "si-ra-0913",
|    "title": "A report has kept its last complete result for 3 Detailed runs in a row: a source it reads still returns no rows",
|    "causeClass": "held-too-long",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "One report has kept its last complete result for three Detailed runs in a row, because a source it reads still returns no rows. SecurityInsight support has been told and is looking into it. Nothing in the report was closed. If you turned that feature off on purpose, an Admin can accept the empty source on the Run reports page.",
|    "internalNote": "#902 (4): si-ra-0911 for the same report escalateAfterDetailedRuns (3) Detailed runs in a row (sidata.RaReportStatus.HeldRuns). The data is still the last complete result; nothing closes. Check the source table (MissingName) in the tenant: a connector or a licence that stopped, or a feature the customer retired (then the Admin accepts it as empty).",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Read the run's WARNING line for the source (its last non-zero count and date) and check that table in the tenant; ask the customer whether the feature was turned off."
|      },
|      {
|        "who": "customer",
|        "text": "Only if the feature behind the source was turned off for good: an Admin opens Run health > Risk Analysis reports and accepts the empty source for that report."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-ra-0914",
|    "title": "A report has kept its last complete result for 3 Detailed runs in a row: the Entra role read is still not complete",
|    "causeClass": "held-too-long",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The list of Entra role assignments has come back incomplete for three Detailed runs in a row. The reports that read it still show their last complete result and nothing was closed. SecurityInsight support has been told and is looking into it.",
|    "internalNote": "#902 (4): si-ra-0912 for the same report escalateAfterDetailedRuns (3) Detailed runs in a row (sidata.RaReportStatus.HeldRuns). The data is still the last complete result; nothing closes. Read the identity run's role-read lines (pages, rows, the second read).",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Read the identity run's log for the role assignment read (each read's pages and rows) and the Graph answers it got."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-cmdb-0701",
|    "title": "No endpoints to send to the CMDB: the tenant has no active devices",
|    "causeClass": "no-data-source",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The endpoint collection ran and found no active devices in your tenant, so the CMDB connector had nothing to send. Nothing is wrong and nothing is missing. When devices are added, they reach the CMDB with the next run.",
|    "internalNote": "The endpoint profile table never held a row, but the endpoint collection ended well in the window: it found no active devices (customer A 2026-10-15: 1 Entra device, stale; 0 from MDE, Exposure Graph and Resource Graph), so SI_Endpoint_Profile_CL is never created. Before this code the CMDB SQL connector said every run \"no endpoint profile snapshot yet -- the first collection has not published one\" (success-partial, class unknown at Invardia). Now the run is a success with this code; a collection that never ran, or failed, stays \"not yet\".",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. If devices are added to the tenant, the next run sends them to the CMDB."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-upd-0801",
|    "title": "The updater may not store secrets in Key Vault (secure hand-over)",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "Secrets you paste in the SecurityInsight web app are handed to the updater, which stores them in your Key Vault. The updater's identity is not allowed to use its hand-over key there yet, so pasted secrets wait and are not stored. Run the updater setup again with its role grants.",
|    "internalNote": "cfg.InstallState 'SecretHandover' state 'missing' (checked by the updater within 3 days): the updater's hand-over key read / unwrap was refused with a 403 on the install's Key Vault (error class kv-403). Raised by the hourly heartbeat's Warnings (#719). The same check feeds the setup report's secret-handover control.",
|    "whoActs": "customer",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Run the updater setup again with its role grants: .\\setup\\Install-SIUpdaterJob.ps1 -SubscriptionId <subscription id> -ResourceGroupName <resource group> -GrantSpnRoles"
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-upd-0802",
|    "title": "The updater may not change the SecurityInsight database",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The last update stopped before it changed anything, because the updater's identity is missing its rights on the SecurityInsight database. Nothing was rolled and the install keeps running on its current version. A database administrator grants the rights once with the setup script.",
|    "internalNote": "cfg.InstallState 'UpdateState' error names a database permission (db_ddladmin / db_securityadmin / 'permission was denied'): the updater's database step (container/updater/_shared/SI-UpdaterDatabase.ps1) was refused -- typically the updater was taken out of the server's SQL admin group without setup\\Grant-SIUpdaterDatabase.ps1 having granted its own roles. Raised by the hourly heartbeat's Warnings (#719).",
|    "whoActs": "customer",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Let a member of the database server's Entra admin group run .\\setup\\Grant-SIUpdaterDatabase.ps1 once; the next update applies itself."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-upd-0803",
|    "title": "Azure refused the new version for a SecurityInsight job, so the update was rolled back",
|    "causeClass": "platform-timeout",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The update built the new version, but Azure refused to put it on one or more SecurityInsight jobs. Usually Azure could not reach your container registry at that moment. Every job that had already changed was put back on the version it ran before, so your install keeps working on its current version and no data was lost. The update is tried again.",
|    "internalNote": "ROLL step of setup/Invoke-SIContainerUpdate.ps1 (Invoke-SIJobImageRoll): the job's ARM PATCH was answered 400 InvalidParameterValueInContainerTemplate \"Field 'template.containers.<job>.image' is invalid ... Get https://<acr>/v2/: dial tcp <ip>:443: connect: connection refused\" -- Container Apps validates the image against the registry while it takes the PATCH. Seen at customer D 2026-10-19 14:09Z (rc13, 2 of 22 PATCHes; SUP-2026-00198/00199/00200; Basic ACR, public, no firewall). Since this code the PATCH is sent again for that transient registry answer (Test-SIArmRegistryTransient, up to 18 passes of 10 s) before the update fails. Not transient (never retried): MANIFEST_UNKNOWN / NAME_UNKNOWN / 401 / 403. Reported by the updater as step 'roll'.",
|    "whoActs": "support",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Check the update log: every job reads back its previous image and the installed version did not move. Read the 400's details: a registry network answer (connection refused, i/o timeout) is transient -- start the same update again. An image that does not exist or a registry that refuses the identity is not -- fix that first."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-upd-0804",
|    "title": "A SecurityInsight job could not be put back on its previous version after a failed update",
|    "causeClass": "platform-timeout",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "An update failed, and SecurityInsight could not put one or more of its jobs back on the version they ran before. Those jobs may now run a different version than the rest. SecurityInsight's support team puts them back for you.",
|    "internalNote": "ROLLBACK step of setup/Invoke-SIContainerUpdate.ps1: the restore PATCH (to the PreviousImage DETECT read BEFORE the roll, Get-SIContainerRollbackPlan) was refused or did not read back. Reported by the updater as step 'restore' ONLY for such a job -- before SUP-2026-00198 (2026-10-19) a clean rollback was reported as 'restore' with the roll's own 400. The update log names each job and the image it must run.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Read the update log for the jobs that 'could NOT be restored' and the image each must run; put each back on it (one PATCH of its template image), read it back, then start the update again."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-upd-0805",
|    "title": "A SecurityInsight job did not confirm the new version, so the update was rolled back",
|    "causeClass": "platform-timeout",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "Azure took the new version for a SecurityInsight job, but the job did not confirm it in time, or more than the version changed. Every job that had changed was put back on the version it ran before, so your install keeps working on its current version. SecurityInsight's support team looks at it.",
|    "internalNote": "VERIFY step of setup/Invoke-SIContainerUpdate.ps1 (Invoke-SIJobImageRoll read-back): the PATCH was accepted but the job ended Failed, reads back another image, changed more than the image (fingerprint), or was still provisioning after 8 minutes. Reported by the updater as step 'roll'.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Read the update log's VERIFY line for the job (failed / reads back / more than the image changed / still provisioning) and the job's ARM state; when the cause is cleared, start the update again."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-upd-0806",
|    "title": "An update has waited more than 24 hours for a pipeline run to end",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "A new SecurityInsight version is never installed while a pipeline run is going, so a run always finishes on the version it started with. This update has waited more than 24 hours for the current run to end. Nothing is stopped or lost: the update is installed as soon as the run ends, before the next run starts.",
|    "internalNote": "cfg.InstallState 'UpdateState' compact field waits.since older than 24 hours: the updater's run gate (container/updater/_shared/SI-UpdaterRunGate.ps1, owner decision 2026-10-23) found a pipeline run or step still going at every try since then. Warning only: the gate never cancels a run and never blocks one. The run itself (Operations > Jobs) says why it is long; a person may cancel it there (#700) -- the updater never does.",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Look at the running pipeline run on Operations > Jobs (its steps, how long each has run). A long run on a large install is expected; the update lands when it ends. Only when the run is stuck, decide with the customer whether to cancel it there."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-perm-1001",
|    "title": "SecurityInsight's identity is missing a Microsoft Graph permission",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "Microsoft Graph refused SecurityInsight's identity, so the collections that read Entra ID could not complete and their data is from the last good run. Get Started > Permissions names the missing permission; grant it with the setup script.",
|    "internalNote": "Run health (SI_RunHealth_CL): the newest failed run in 24 hours that read Microsoft Graph has error class graph-401 / graph-403, and no run of a Graph-reading engine succeeded since. Raised by the hourly heartbeat's Warnings (#719).",
|    "whoActs": "customer",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Open Get Started > Permissions and grant what it lists with the setup script; the next run collects again."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-perm-1002",
|    "title": "SecurityInsight's identity is missing a Microsoft Defender permission",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [
|        "defenderXdr"
|      ],
|      "licences": []
|    },
|    "customerText": "Microsoft Defender refused SecurityInsight's identity, so the device data and the reports that read Defender could not complete; the data is from the last good run. Get Started > Permissions names the missing permission; grant it with the setup script.",
|    "internalNote": "Run health (SI_RunHealth_CL): the newest failed run in 24 hours that read Defender (machines, advanced hunting) has error class defender-403, and no run of a Defender-reading engine succeeded since. Raised by the hourly heartbeat's Warnings (#719).",
|    "whoActs": "customer",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Open Get Started > Permissions and grant what it lists with the setup script; the next run collects again."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-perm-1003",
|    "title": "SecurityInsight's identity may not read Azure",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "Azure refused SecurityInsight's identity, so the Azure collection could not complete and its data is from the last good run. SecurityInsight needs Reader on the subscriptions or management groups it covers; grant it with the setup script.",
|    "internalNote": "Run health (SI_RunHealth_CL): the newest failed run in 24 hours that read Azure Resource Manager / Resource Graph has error class arm-403, and no run of an Azure-reading engine succeeded since. Raised by the hourly heartbeat's Warnings (#719).",
|    "whoActs": "customer",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Open Get Started > Permissions and grant what it lists with the setup script; the next run collects again."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-perm-1004",
|    "title": "SecurityInsight may not read the security scores",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "SecurityInsight may not read your tenant's Microsoft Secure Score or Defender exposure score yet, so the status report carries no scores. Nothing SecurityInsight collects is affected. Grant the two read-only permissions with the setup script.",
|    "internalNote": "The heartbeat reads Graph /security/secureScores?$top=1 (SecurityEvents.Read.All) and Defender /api/exposureScore (WindowsDefenderATP Score.Read.All), once per process per hour. One of them answered 401 / 403 -- Counts secureScore / secureScoreMax / exposureScore are then left out. Required permissions since 2026-10-16 (owner: \"Add, permission REQUIRED\"): granted on every new install; an existing install's update names them (the permission note). Raised by the hourly heartbeat's Warnings.",
|    "whoActs": "customer",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Open Get Started > Permissions: it lists Microsoft Graph SecurityEvents.Read.All and WindowsDefenderATP Score.Read.All with the two lines to run (Grant-SIIdentity.ps1 for the managed identity, Grant-SIIdentity.ps1 -AppId for an app registration)."
|      },
|      {
|        "who": "customer",
|        "text": "An admin who can give admin consent (Privileged Role Administrator or Global Administrator) runs them; the next hourly status report carries the scores."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-mail-1101",
|    "title": "The mail send right is not limited to the shared mailbox",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "SecurityInsight's identity could send mail as other mailboxes than its shared mailbox, so SecurityInsight refuses to send any mail until the send right is limited. Limit it with the mail setup script.",
|    "internalNote": "cfg.InstallState 'MailRestriction' state 'unrestricted' (Get-SIMailRestrictionVerdict: a tenant-wide Mail.Send, or an Exchange role assignment not scoped to the shared mailbox). Raised by the hourly heartbeat's Warnings (#719).",
|    "whoActs": "customer",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Run .\\setup\\Set-SIMail.ps1 -Apply: it removes the tenant-wide Mail.Send and limits the send right to the shared mailbox (Exchange RBAC for Applications)."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-mail-1102",
|    "title": "SecurityInsight may not send as its shared mailbox yet",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "SecurityInsight's identity may not send mail as its shared mailbox yet, so reports and alerts are not mailed. Exchange's role assignment is missing or not active yet (it can take up to two hours after it is made).",
|    "internalNote": "cfg.InstallState 'MailRestriction' state 'not-granted' (the send probe as the shared mailbox was refused, or the mailbox does not exist). Raised by the hourly heartbeat's Warnings (#719).",
|    "whoActs": "customer",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Run .\\setup\\Set-SIMail.ps1 -Apply for the shared mailbox, wait up to two hours, then send a test mail from the Settings page."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-mail-1103",
|    "title": "The mail send right is not verified as limited to the shared mailbox",
|    "causeClass": "permission",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "SecurityInsight could not verify that its send right is limited to the shared mailbox: there is no other mailbox to test it with, and no Exchange administrator has confirmed it. Set a test mailbox, or let an Exchange administrator confirm the restriction on the Settings page.",
|    "internalNote": "cfg.InstallState 'MailRestriction' state 'unverified' and no 'MailRestrictionAttestation' row. Raised by the hourly heartbeat's Warnings (#719).",
|    "whoActs": "customer",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Set SI_Mail_ProbeMailbox to a mailbox outside the shared mailbox's scope, or let an Exchange administrator confirm the restriction (Settings > Mail)."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-flow-1201",
|    "title": "The pipeline runner is not scheduled",
|    "causeClass": "settings-unreachable",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The job that starts SecurityInsight's daily pipeline has no timer, so the pipeline does not start by itself and a run you start from the web app waits. Your existing data is unchanged. The next update puts the job back on its schedule; support can do it at once.",
|    "internalNote": "caj-si-flow triggerType is not Schedule (no '*/5 * * * *' wake-up) and no job of the pipeline runs on its own timer (Get-SIFlowRunnerScheduleState 'not-scheduled'). Found live 2026-10-17 at one ring-2 install: caj-si-flow Manual since its install on 15 Oct, a queued run waited 6 h (#732). Every update now patches it to Schedule '*/5 * * * *' (Invoke-SIFlowRunnerSchedule, step 9b) and reads it back. Raised by the heartbeat's Warnings; since = the job's last change (systemData.lastModifiedAt). Support: put caj-si-flow on Schedule '*/5 * * * *' through the Support app, or start the update now.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The next update puts the pipeline job back on its schedule; support can do it at once."
|      }
|    ],
|    "lesson": "A job an install depends on to start anything must be checked by every update and by the heartbeat, not only created right once.",
|    "since": null
|  },
|  {
|    "code": "si-flow-1202",
|    "title": "A scheduled collection waited for or skipped a pipeline run",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "A collection that starts on its own daily timer found the pipeline running. It never runs beside the pipeline, so the two do not compete for the database: when the pipeline collects the same data itself, the scheduled collection did nothing; otherwise it waited for the run to end and then ran. Nothing is lost: the pipeline's own collection and the next scheduled one collect as usual.",
|    "internalNote": "cfg.InstallState 'CollectionHeld' {job, exec, run, action = skipped | waiting | waited | limit, atUtc} within the last 24 hours: a Collect-stage job's own execution (a producer, or the one job of an engine collected without queue scaling) found cfg.PipelineLock held by a live run (engine/_shared/SI-CollectionRunGate.ps1, 2026-10-25: a daily identity collection on its own timer rewrote 2.39 M CI records for 10-12 hours beside the pipeline on a 100 DTU database). skipped = the run includes that job's step; waiting / waited = it does not, so the collection waited (no cap of its own); limit = the job's own run limit ended the wait, nothing was collected. The pipeline's own step is never held. Information only; since = the time of that collection.",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. If it shows every day, the collection's own timer falls inside the pipeline's usual run; support may move that timer outside it on Operations > Jobs."
|      }
|    ],
|    "lesson": "A collection on its own timer and the pipeline's collection are two writers of the same tables: the one that is not the pipeline's must look before it writes.",
|    "since": null
|  },
|  {
|    "code": "si-flow-1203",
|    "title": "A pipeline run or step has run much longer than usual",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The pipeline run going on now, or one of its steps, has run much longer than it usually takes on this installation. Nothing is stopped: the run goes on and may still finish normally, for example after much more data than usual. Support looks at the run to see whether it is still making progress.",
|    "internalNote": "The newest cfg.FlowRun is Running and it, or a Running / Starting cfg.FlowStepRun of it, has run longer than max(2 x usual, usual + 2 h). Usual = the median of the install's own lengths among the newest 10 run records (a run: full runs that succeeded -- Scope pipeline, no FromStep; a step: that job's successful steps), at least 3 measured; without them the floor applies: 24 h for a run, 12 h for a step (Get-SIPipelineLongRun, engine/_shared/SI-JobFlow.ps1). Found 2026-10-26: four large installs had one run going for ~79 h (a data sync ~45 h, a correlation ~65 h) that looked Running and healthy. Warning only: nothing is stopped or held, no cap. since = when the first of them crossed its threshold; the run and step are Pipeline.runId / step; the runner's log, the run's note and the step's RetryReason say the age and the usual length. A person may cancel the run on Operations > Jobs (#700) -- SecurityInsight never does.",
|    "whoActs": "support",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Open the run on Operations > Jobs: which step runs, for how long, and whether its log still moves. A step that still makes progress on much more data is left to finish. A step that stands still: decide with the customer whether to cancel the run there."
|      }
|    ],
|    "lesson": "A run that only looks Running is not proof it is healthy: compare its age with how long it usually takes on that installation.",
|    "since": null
|  },
|  {
|    "code": "si-flow-1204",
|    "title": "A pipeline step runs far past its usual time and shows no progress",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "A step of the pipeline run going on now has run far longer than its last run took on this installation, and it has shown no sign of progress for an hour. Nothing is stopped: the run goes on. Support looks at the step to see whether it is stuck.",
|    "internalNote": "The newest cfg.FlowRun is Running and a Running / Starting cfg.FlowStepRun of it has run longer than max(2 x its last run's time, its last run's time + 60 min) -- its last run's time = that job's newest successful step among the newest 10 run records; none known: 6 h -- AND shows no progress for 60 minutes: its newest mark in cfg.StepProgress (its own execution's or its job's workers', moved by every batch a step writes, at most every 5 minutes) or phase row in cfg.StepPhaseTime is older than that, or, for a step that writes neither, the runner's log check found no sign of progress (its RetryReason). Get-SIPipelineStalledSteps, engine/_shared/SI-JobFlow.ps1. Found 2026-10-29: a correlation ran 55 h and two data syncs 35 h+ before anyone acted. Warning only: nothing is stopped or held. since = when it became stuck; the steps are named in Pipeline.stalledSteps (step, sinceUtc, lastProgressUtc); the runner's log and the step's RetryReason say it once. A person may cancel the run on Operations > Jobs -- SecurityInsight never does.",
|    "whoActs": "support",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Open the run on Operations > Jobs and the step named on the heartbeat: read its log and its database load. A step that stands still: decide with the customer whether to cancel the run there."
|      }
|    ],
|    "lesson": "Time alone does not tell a long step from a stuck one: a step that writes nothing for an hour, far past its usual time, is the one to look at.",
|    "since": null
|  },
|  {
|    "code": "si-flow-1205",
|    "title": "A job of the pipeline ran outside the pipeline",
|    "causeClass": "settings-unreachable",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The jobs of this installation run as one pipeline, but a job of the pipeline also ran on its own -- not started by a pipeline run and not by a person. Such a run collects or writes the same data a second time and belongs to no run. Nothing is lost; the next update takes such a job off its own timer.",
|    "internalNote": "#1096 (found live 2026-11-04: a collect producer caj-si-<engine>-producer kept its own daily cron beside the pipeline -- every install collected twice a day, the extra collection belonged to no run). The verification job's pipeline check (engine/_shared/SI-OutsidePipeline.ps1 Invoke-SIOutsidePipelineCheck) reads, in pipeline mode only, every execution of a pipeline step's job (caj-si-<key>, or the producer of a collection in parts; workers count through their producer) of the last 48 h from ARM and compares them with the step records of the runs (cfg.FlowStepRun.Execution, or a start inside that step's window -- an attempt started again) and the people's starts (cfg.JobTriggerRequest.ExecutionName). Any other execution = 'ran outside the pipeline: <job> <execution> <start>' in the job's log; cfg.InstallState 'OutsidePipeline' { checkedUtc, count, firstUtc, sample } within 30 h raises this warning. since = the first such execution. Warning only; the producer's own timer is taken away by the update (Invoke-SICollectProducerTrigger) and a scheduled producer execution in pipeline mode is skipped by the collection gate.",
|    "whoActs": "support",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Read the verification job's log (the 'ran outside the pipeline' lines name the job, the execution and its start). A job with its own timer in pipeline mode: let the next update take it off, or take it off on Operations > Jobs. A start by hand in the Azure portal: none needed."
|      }
|    ],
|    "lesson": "A job that is a step of the pipeline must have no other way to start by itself -- and an install should prove it every day, not trust it.",
|    "since": null
|  },
|  {
|    "code": "si-snow-1301",
|    "title": "A ServiceNow output's check failed",
|    "causeClass": "settings-unreachable",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "SecurityInsight could not confirm that ServiceNow is ready for one of its outputs: the instance could not be reached, the key was refused or lacks a role, the Import Set table is missing, a column is missing or too short, or the table matches the columns by label. Nothing is sent to that table until it is fixed, so no row is lost or cut -- the rows go on the next run. Open the connector on Configuration > Connectors > Setup to see the check and run it again.",
|    "internalNote": "cfg.ServiceNowCheck: the newest row of an output (servicenow-ci / servicenow-vulnerable-item) has Outcome 'failed' (engine\\asset-cmdb\\_shared\\SI-SnowVerify.ps1: the data-out run before it sends, the daily check in the verification job, the web app's Verify on the mail job). The push of that output is held (Compare-SISnowSendColumns). Raised by the heartbeat's Warnings; since = the first not-ok check after the last ok one.",
|    "whoActs": "customer",
|    "priority": "P3",
|    "opensTicket": false,
|    "action": "customer",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "customer",
|        "text": "Open the ServiceNow connector (Configuration > Connectors > Setup), read the check, fix the instance address, the key, the role or the table in ServiceNow, and press Verify."
|      }
|    ],
|    "lesson": null,
|    "since": null
|  },
|  {
|    "code": "si-data-1401",
|    "title": "The asset pages show an older copy than the rest of the web app",
|    "causeClass": "query-defect",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The pages of the merged assets (CIs and assets) show a copy that is older than the run the rest of the web app shows, so their numbers can differ from the other pages. Your data is unchanged. SecurityInsight refreshes the copy by itself right after each run; support is told if it stays.",
|    "internalNote": "sidata.PublishedRun 'current' in the data database has CopiedAt NULL or older than PublishedAt, no refresher is writing the copies (the session lock si-published-copy-refresh is free), and the publish is older than twice the last refresh's own time (the sum of sidata.PublishedCopy.Milliseconds) plus 10 minutes (Test-SIHeartbeatCopyStaleTooLong). Every publish moves the pointer first and the copies (sidata.CiPub, AssetPub, ...) follow range by range right after it (Invoke-SIPublishedCopyRefresh; CopiedAt moves when every range is done -- 14 minutes on internal 2026-10-28), so a copy being written is the normal course and is not said. sidata.PublishedCopyCatchUp repairs a stale copy on every wake-up of the pipeline runner, after every publish attempt that did not publish, and in the update (step 9g); found live 2026-10-21 after a hand publish. Raised by the heartbeat's Warnings (Get-SIHeartbeatPublishedCopySql); since = PublishedAt. If it stays: read the runner's log for the catch-up line, or EXEC sidata.PublishedCopyCatchUp through the Support app.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. SecurityInsight refreshes the copy by itself; support looks into it if the warning stays."
|      }
|    ],
|    "lesson": "A copy that must match a pointer is refreshed by the same code that moves the pointer, in the same transaction -- never by one of its callers.",
|    "since": null
|  },
|  {
|    "code": "si-data-1402",
|    "title": "The report figures are from an earlier collection",
|    "causeClass": "query-defect",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The newest Risk Analysis run has not been prepared for the overview yet, so the report figures shown are those of the run before it, with that run's date. Your data is unchanged. The figures move to the newest run by themselves once it is prepared.",
|    "internalNote": "#871: the newest complete Detailed collection (sidata.Collection Kind Detailed Status Complete) has no row in sidata.SummaryGroupState: its run stopped before the data sync built the groupings, or the data sync is still running. The heartbeat then sends the grouped figures (Counts usersWithoutMfa, cves, ... and Security) from the newest collection that HAS its groupings, decided by that collection's own verdicts; Security.collectionUtc is that collection's time and this warning's since is the newest collection's time. Normal for the hours between the Risk Analysis and the data sync of one run; if it stays past the next run, the data sync is not reaching the groupings -- read the pipeline's run page for the data sync step.",
|    "whoActs": "nobody",
|    "priority": "P4",
|    "opensTicket": false,
|    "action": "none",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "nobody",
|        "text": "Nothing to do. The next pipeline run prepares the newest collection, and the figures move to it by themselves."
|      }
|    ],
|    "lesson": "A figure the install has had is sent with its date when a run did not renew it -- never left out, which reads as a fall.",
|    "since": null
|    },
|  {
|    "code": "si-data-1403",
|    "title": "The database is almost full",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The SecurityInsight database uses more than 85 % of its maximum size. When it is full, parts of the data sync cannot be written and the overview keeps older figures until they are. Support raises the maximum size or checks what the database keeps.",
|    "internalNote": "#904: the heartbeat's Database field (usedMb / maxSizeMb: sys.database_files FILEPROPERTY SpaceUsed of the data files, DATABASEPROPERTYEX MaxSizeInBytes) shows usedMb at or above 85 % of maxSizeMb. Seen first on a large install 2026-10-26 when the data sync hit the size quota (1105 / 40544) and the groupings, remediations and key figures of a collection were not written. Raise the database's max size (Azure portal or ARM, the install's Pro database) or check the retention of the large tables (cfg.ConnectorChange, the collections' own retention). since = when the heartbeat first saw it.",
|    "whoActs": "support",
|    "priority": "P2",
|    "opensTicket": false,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Raise the maximum size of the SecurityInsight database, or check what it keeps, before it is full."
|      }
|    ],
|    "lesson": "A limit that stops writes is watched before it is reached, never found by the write it refuses.",
|    "since": null
|  },
|  {
|    "code": "si-data-1404",
|    "title": "The database is full",
|    "causeClass": "too-large",
|    "appliesTo": {
|      "capabilities": [],
|      "licences": []
|    },
|    "customerText": "The SecurityInsight database reached its maximum size, so a part of the data sync could not be written. The pages of that part show their last complete result until it is. Support raises the maximum size; the next run builds what is missing.",
|    "internalNote": "#904: a part of the data sync (engine/pro-data/_shared/SI-DataSync.ps1: groupings, remediations, key figures, narrow findings, ...) failed on Azure SQL's size quota (1105 / 40544 / 'has reached its size quota'). Sent by the data sync as a failure of that part (Job si-datasync, FailedStep = the part, ErrorClass database-full); the step ends success-partial with the part named. Raise the database's max size, then queue a run (or wait for the next): each part builds what it is missing. Check the retention of the large tables (cfg.ConnectorChange).",
|    "whoActs": "support",
|    "priority": "P1",
|    "opensTicket": true,
|    "action": "support",
|    "fixedIn": null,
|    "waitForFix": false,
|    "steps": [
|      {
|        "who": "support",
|        "text": "Raise the maximum size of the SecurityInsight database. The next run builds what is missing by itself."
|      },
|      {
|        "who": "customer",
|        "text": "Nothing is needed when support manages the database. If your organisation sets the database's size itself, raise its maximum size in the Azure portal (the database's Compute + storage page); the next run builds what is missing by itself."
|      }
|    ],
|    "lesson": "A part that fails on a full database is a failure of that part, sent to support -- never only a warning line in the log.",
|    "since": null
|  }
|]
'@ }
$__siSupportFiles['engine/_shared/SI-InvardiaPortalLink.ps1'] = @{ Sha256 = 'daec661ab7f163fe336030e4a899cda1dfa698b6b447661c0415d6f26896bb66'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE CUSTOMER MAIL LINKS STRAIGHT TO THE INSTALL'S PAGE IN THE INVARDIA PORTAL (#710; framework
|    DOCS/REQUIREMENTS.md 8.16 "Order and links"; Invardia 1.0.488).
|
|    HOW:
|      1. Every IDENTIFIED status report Invardia takes is answered 202 { environmentId } (+ supersededBy when relevant).
|         The engine run that hears an id it does not have yet records it in the Pro database (cfg.InstallState
|         'InvardiaEnvironment' = {"environmentId":"<guid>","seenUtc":"..."}), on the connection the run already has
|         ($global:SI_ProSettingsStore). An anonymous install never gets an id (Invardia returns none) and never a link.
|      2. The Pro settings layer reads the row at run start with the other install facts (Read-SIInstallRingFacts ->
|         $global:SI_InstallRingFacts.InvardiaEnvironment).
|      3. Send-SIMail (SI-MailTransport.ps1) puts ONE line directly under the mail's summary (owner 2026-10-16):
|             See details and history: https://portal.invardia.com/#/environments/<environmentId>
|         -- only when the id is known (a GUID), only in a mail that HAS a summary, never in a mail that carries a
|         one-time secret (-NoPdf: the sign-in mails). No id = no line (never a broken or a start-page link).
|         Two mails without a summary carry it at their TOP (owner 2026-10-16, "Add to both"): the daily close-loop mail
|         (a place-holder row under its banner) and the management summary (Add-SIInvardiaPortalLinkAnchor, set by the mail
|         job before it sends) -- same rules: only a known id, HTML-encoded, once.
|
|    The id is a lower-case GUID (Invardia's inv.SupportEnvironments.EnvironmentId). Anything else is ignored.
|    PS 5.1 + 7. No modules.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope.
|
|function Get-SIPortalLinkState {
|    <# The value of $script:SIPortalLink, made on first use in the scope that reads it: a function loaded by an outer script and called from an engine's script finds it set (the lists never depend on the caller's scope). #>
|    if ($null -eq $script:SIPortalLink) { $script:SIPortalLink = @{
|    StateName = 'InvardiaEnvironment'                                  # cfg.InstallState row
|    UrlFormat = 'https://portal.invardia.com/#/environments/{0}'       # framework 8.16, Invardia 1.0.488
|    Text      = 'See details and history:'                             # the owner's wording, 2026-10-16
|    Marker    = 'data-si-portal-link'
|    Anchor    = '<!-- SI portal link -->'                              # the top of a mail without a summary (flow content)
|    RowAnchor = '<!-- SI portal link row -->'                          # the same (kept for an older body; filled like Anchor)
|    Guid      = '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'
|} }
|    , $script:SIPortalLink
|}
|$script:SIPortalLink = $null; $null = Get-SIPortalLinkState
|
|function ConvertTo-SIInvardiaEnvironmentIdOrEmpty {
|    <# PURE. An Invardia environment id as the lower-case GUID it is, or '' when it is not GUID-shaped. #>
|    param([AllowNull()][AllowEmptyString()][string]$EnvironmentId)
|    $v = "$EnvironmentId".Trim()
|    if ($v -match (Get-SIPortalLinkState).Guid) { return $v.ToLowerInvariant() }
|    ''
|}
|
|function Get-SIInvardiaEnvironmentIdFromAnswer {
|    <# PURE. The environmentId of an uplink answer (a parsed body, or its text), '' when none / not a GUID. #>
|    param([AllowNull()]$Answer)
|    if ($null -eq $Answer) { return '' }
|    $o = $Answer
|    if ($Answer -is [string]) { if (-not $Answer.Trim()) { return '' }; try { $o = $Answer | ConvertFrom-Json -ErrorAction Stop } catch { return '' } }
|    if ($null -eq $o) { return '' }
|    $v = ''
|    if ($o -is [System.Collections.IDictionary]) { if ($o.Contains('environmentId')) { $v = [string]$o['environmentId'] } }
|    elseif ($o.PSObject.Properties['environmentId']) { $v = [string]$o.environmentId }
|    ConvertTo-SIInvardiaEnvironmentIdOrEmpty $v
|}
|
|function ConvertTo-SIInvardiaEnvironmentValue {
|    <# PURE. The cfg.InstallState 'InvardiaEnvironment' value for -EnvironmentId (compact JSON). Throws on a non-GUID. #>
|    param([Parameter(Mandatory)][string]$EnvironmentId, $NowUtc)
|    $id = ConvertTo-SIInvardiaEnvironmentIdOrEmpty $EnvironmentId
|    if (-not $id) { throw "not an Invardia environment id: '$EnvironmentId'" }
|    $at = if ($NowUtc) { ([datetime]$NowUtc).ToUniversalTime() } else { [datetime]::UtcNow }
|    ([ordered]@{ environmentId = $id; seenUtc = $at.ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture) } | ConvertTo-Json -Compress)
|}
|
|function Get-SIInvardiaEnvironmentIdFromValue {
|    <# PURE. The id in a cfg.InstallState 'InvardiaEnvironment' value (its JSON, or a bare GUID), '' when none. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    $v = "$Value".Trim()
|    if (-not $v) { return '' }
|    if ($v -match (Get-SIPortalLinkState).Guid) { return $v.ToLowerInvariant() }
|    Get-SIInvardiaEnvironmentIdFromAnswer $v
|}
|
|function Get-SIInvardiaPortalUrl {
|    <# PURE. The install's page in the Invardia customer portal, '' when the id is not a GUID. #>
|    param([AllowNull()][AllowEmptyString()][string]$EnvironmentId)
|    $id = ConvertTo-SIInvardiaEnvironmentIdOrEmpty $EnvironmentId
|    if (-not $id) { return '' }
|    (Get-SIPortalLinkState).UrlFormat -f $id
|}
|
|function Get-SIInvardiaPortalLinkHtml {
|    <# PURE. The one line, as HTML (every value encoded); '' when the id is not a GUID. #>
|    param([AllowNull()][AllowEmptyString()][string]$EnvironmentId)
|    $url = Get-SIInvardiaPortalUrl $EnvironmentId
|    if (-not $url) { return '' }
|    $u = [System.Net.WebUtility]::HtmlEncode($url)
|    ('<p {0}="1" style="font-family:Segoe UI,Arial,sans-serif;font-size:14px;line-height:1.5;color:#0B1633;margin:0 0 14px 0;">{1} <a href="{2}" style="color:#1B4FE4;text-decoration:underline;">{2}</a></p>' -f `
|        (Get-SIPortalLinkState).Marker, [System.Net.WebUtility]::HtmlEncode((Get-SIPortalLinkState).Text), $u)
|}
|
|function Test-SIInvardiaPortalLinkSummary {
|    <# PURE. $true when -BodyHtml has a summary the line goes under (the summary block, data-mail-summary: every SI mail's
|       summary since #728, the Risk Analysis mail's included; a <table> summary only in a mail queued by an older web app). #>
|    param([AllowNull()][AllowEmptyString()][string]$BodyHtml)
|    if (-not $BodyHtml) { return $false }
|    $BodyHtml -match '(?is)<(div|table)\b[^>]*\bdata-mail-summary\b'
|}
|
|function Add-SIInvardiaPortalLinkAnchor {
|    <#
|        PURE. Owner 2026-10-16 ("Add to both"): a mail WITHOUT a summary that still gets the line -- the daily close-loop
|        mail and the management summary -- carries it at the TOP. This marks the top of -BodyHtml (right after its <body>
|        tag, else at its start) with the place-holder Add-SIInvardiaPortalLink fills. A body that has a summary (the line
|        goes under it), already has a place-holder or the line, or is empty: unchanged. Invisible when no id is known
|        (an HTML comment; Send-SIMail removes it before sending).
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$BodyHtml)
|    if (-not $BodyHtml) { return $BodyHtml }
|    if ((Test-SIInvardiaPortalLinkSummary $BodyHtml) -or $BodyHtml -match (Get-SIPortalLinkState).Marker -or $BodyHtml.Contains((Get-SIPortalLinkState).Anchor) -or $BodyHtml.Contains((Get-SIPortalLinkState).RowAnchor)) { return $BodyHtml }
|    $b = [regex]::Match($BodyHtml, '(?i)<body\b[^>]*>')
|    if ($b.Success) { $at = $b.Index + $b.Length; return $BodyHtml.Substring(0, $at) + (Get-SIPortalLinkState).Anchor + $BodyHtml.Substring($at) }
|    (Get-SIPortalLinkState).Anchor + $BodyHtml
|}
|
|function Remove-SIInvardiaPortalLinkAnchor {
|    <# PURE. -BodyHtml without the place-holders (an unused one is never sent). #>
|    param([AllowNull()][AllowEmptyString()][string]$BodyHtml)
|    if (-not $BodyHtml) { return $BodyHtml }
|    $BodyHtml.Replace((Get-SIPortalLinkState).RowAnchor, '').Replace((Get-SIPortalLinkState).Anchor, '')
|}
|
|function Add-SIInvardiaPortalLink {
|    <#
|        PURE. -BodyHtml with the one line directly UNDER its summary. The summary is found as:
|          1. the summary block (data-mail-summary, #728: every SI mail's summary, the Risk Analysis mail's included): the line
|             follows it;
|          2. a mail queued by an older web app: its <table data-mail-summary> box -- the line follows its table.
|        A mail without a summary that asks for the line at its top (owner 2026-10-16: the daily close-loop mail and the
|        management summary) carries a place-holder there:
|          3. "<!-- SI portal link row -->" (an older body): the line in its place;
|          4. "<!-- SI portal link -->" (Add-SIInvardiaPortalLinkAnchor): the line in its place.
|        No summary and no place-holder, no / not-a-GUID id, or the line already there = the body unchanged. Returns the body.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$BodyHtml, [AllowNull()][AllowEmptyString()][string]$EnvironmentId)
|    if (-not $BodyHtml -or $BodyHtml -match (Get-SIPortalLinkState).Marker) { return $BodyHtml }
|    $line = Get-SIInvardiaPortalLinkHtml $EnvironmentId
|    if (-not $line) { return $BodyHtml }
|    if (-not (Test-SIInvardiaPortalLinkSummary $BodyHtml)) {
|        # 3. / 4. the place-holder at the top (the first one only: the line is never there twice)
|        $r = $BodyHtml.IndexOf((Get-SIPortalLinkState).RowAnchor, [StringComparison]::Ordinal)
|        if ($r -ge 0) { return $BodyHtml.Substring(0, $r) + $line + $BodyHtml.Substring($r + (Get-SIPortalLinkState).RowAnchor.Length) }
|        $a = $BodyHtml.IndexOf((Get-SIPortalLinkState).Anchor, [StringComparison]::Ordinal)
|        if ($a -ge 0) { return $BodyHtml.Substring(0, $a) + $line + $BodyHtml.Substring($a + (Get-SIPortalLinkState).Anchor.Length) }
|        return $BodyHtml
|    }
|    # 1. the summary block: <div ... data-mail-summary ...> ... </div> (no div inside it); the line follows it
|    $m = [regex]::Match($BodyHtml, '(?is)<div\b[^>]*\bdata-mail-summary\b[^>]*>.*?</div>')
|    if ($m.Success) { $at = $m.Index + $m.Length; return $BodyHtml.Substring(0, $at) + $line + $BodyHtml.Substring($at) }
|    # 2. a mail queued by an older web app: its <table ... data-mail-summary ...> box (no table inside it)
|    $m = [regex]::Match($BodyHtml, '(?is)<table\b[^>]*\bdata-mail-summary\b[^>]*>.*?</table>')
|    if ($m.Success) { $at = $m.Index + $m.Length; return $BodyHtml.Substring(0, $at) + $line + $BodyHtml.Substring($at) }
|    $BodyHtml
|}
|
|function Get-SIInvardiaEnvironmentIdKnown {
|    <#
|        The id this process knows (never throws, '' when none): -Facts (default $global:SI_InstallRingFacts, read by the
|        Pro settings layer at run start) .InvardiaEnvironment.
|    #>
|    param($Facts = $global:SI_InstallRingFacts)
|    try {
|        if ($null -eq $Facts) { return '' }
|        $v = if ($Facts -is [System.Collections.IDictionary]) { if ($Facts.Contains((Get-SIPortalLinkState).StateName)) { [string]$Facts[(Get-SIPortalLinkState).StateName] } else { '' } }
|             elseif ($Facts.PSObject.Properties[(Get-SIPortalLinkState).StateName]) { [string]$Facts.((Get-SIPortalLinkState).StateName) } else { '' }
|        return (Get-SIInvardiaEnvironmentIdFromValue $v)
|    } catch { return '' }
|}
|
|function Save-SIInvardiaEnvironmentMark {
|    <# Records the environment id Invardia named (cfg.InstallState 'InvardiaEnvironment') on -Store. Throws on failure. #>
|    param([Parameter(Mandatory)]$Store, [Parameter(Mandatory)][string]$EnvironmentId, $NowUtc)
|    $v = ConvertTo-SIInvardiaEnvironmentValue -EnvironmentId $EnvironmentId -NowUtc $NowUtc
|    $sql = @'
|IF OBJECT_ID('cfg.InstallState') IS NOT NULL
|BEGIN
|    SET XACT_ABORT ON;
|    BEGIN TRAN;
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @Name)
|        UPDATE cfg.InstallState SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @Name;
|    ELSE
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@Name, @Value, NULL, @By);
|    COMMIT;
|END
|'@
|    $null = & $Store.Invoke $sql ([ordered]@{ Name = (Get-SIPortalLinkState).StateName; Value = $v; By = 'si-engine (Invardia uplink)' }) 'nonquery'
|}
|
|function Invoke-SIInvardiaEnvironmentNotice {
|    <#
|        #710: Invardia named this install's environment (-EnvironmentId). Recorded for the customer mails: -OnEnvironment
|        (tests), else the Pro database this run opened ($global:SI_ProSettingsStore). The in-process facts
|        ($global:SI_InstallRingFacts) carry it at once, so a later mail of the same process links it too. NEVER throws;
|        $true when recorded.
|    #>
|    param([Parameter(Mandatory)][string]$EnvironmentId, [scriptblock]$OnEnvironment, $NowUtc)
|    $id = ConvertTo-SIInvardiaEnvironmentIdOrEmpty $EnvironmentId
|    if (-not $id) { return $false }
|    $done = $false
|    try {
|        if ($OnEnvironment) { $null = & $OnEnvironment $id; $done = $true }
|        elseif ($global:SI_ProSettingsStore) { Save-SIInvardiaEnvironmentMark -Store $global:SI_ProSettingsStore -EnvironmentId $id -NowUtc $NowUtc; $done = $true }
|    } catch { $done = $false }
|    try {
|        $val = ConvertTo-SIInvardiaEnvironmentValue -EnvironmentId $id -NowUtc $NowUtc
|        $f = $global:SI_InstallRingFacts
|        if ($f -is [System.Collections.IDictionary]) { $f[(Get-SIPortalLinkState).StateName] = $val }
|        elseif ($null -ne $f) { $f | Add-Member -NotePropertyName (Get-SIPortalLinkState).StateName -NotePropertyValue $val -Force }
|    } catch { }
|    $done
|}
'@ }
$__siSupportFiles['engine/_shared/SI-InvardiaInstallId.ps1'] = @{ Sha256 = '9817b4a05b6021c91c6cd3bb75e61d25587364f0889a86801136e6f4270fe917'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE INSTALL'S LASTING ID ON ITS CALLS TO INVARDIA (Invardia S16, agreed 2026-11-01; the same contract
|    PIM 3.0.14 runs).
|
|    THE ID. One per install: the Key Vault secret SI-InstallId -- the GUID the licence request (SI-LicenceRequest.ps1)
|    created ONCE, at the install's first knock, kept next to the licence and sent as the knock body's installId on every knock
|    since. It is what Invardia already knows the install by. An update, a restart or a new container never replaces it (it
|    lives in the install's Key Vault, not in the image or on a disk; a reinstall that keeps the vault keeps the id). It is
|    CREATED ONCE when missing -- by the licence knock and (Invardia 2026-11-01) by the uplink heartbeat job -- with the same
|    code (Resolve-SIInvardiaInstallId: a GUID, written, read back), and never rewritten. Every other caller only READS it.
|    No id stored / not readable / not a GUID = NO header and NO field -- never an empty, a placeholder or a made-up value
|    (a wrong id would lock the install key at Invardia).
|
|    NOT the anonymous telemetry id (Get-SITelemetryInstallId: <state>\install-id, or derived from the storage account in a
|    container). That one identifies nothing but "the same Community install as last time"; the two are never joined.
|
|    WHERE IT GOES:
|      header X-Invardia-Install-Id (lower-case GUID) on the manifest pull (SI-InvardiaUpdate.ps1 Request-SIInvardiaManifest)
|                                     and the licence knock (SI-LicenceRequest.ps1, POST /api/licence-requests);
|      field  InstallId on every IDENTIFIED uplink record -- heartbeat, run, guard (SI-TelemetrySend.ps1,
|                                     SI-Guard.ps1, SI-GuardHeal.ps1; the health record's own installId, SI-DataHealth.ps1);
|      never on the setup report (Kind setup), an anonymous record, the key claim, the licence pull, the install-run tracking
|      or the update-now signal.
|
|    PURE helpers, no network. PS 5.1 and 7.
|#>
|
|# The names are LITERALS inside each function (no $script: state): these functions are loaded by one script and called from
|# another's scope (an engine's own script, the updater), where a file-level variable would be empty.
|
|function ConvertTo-SIInvardiaInstallId {
|    <# PURE. A GUID (any case, trimmed) -> its lower-case 8-4-4-4-12 text; anything else ($null, '', '-', not a GUID) -> ''. #>
|    param([AllowNull()][object]$Value)
|    if ($null -eq $Value) { return '' }
|    $t = "$Value".Trim().ToLowerInvariant()
|    if ($t -match '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$') { return $t }
|    return ''
|}
|
|function Select-SIInvardiaFirstInstallId {
|    <#
|        PURE. FIRST WRITE WINS (Invardia 2026-11-01): from the versions of SI-InstallId (-Versions: objects with Value, Enabled,
|        Created, Version), the OLDEST ENABLED version that holds a GUID is the install's id -- whichever side wrote it. Order:
|        Created ascending, then the version id (ordinal) so two versions made in the same second are ordered the same way by
|        every reader. Returns @{ First (the id, lower-cased, '' = none); Newest (the newest enabled version's value as stored);
|        Count (enabled versions) }.
|    #>
|    param([AllowNull()][object[]]$Versions)
|    # a seam that hands back its list as ONE object (a List, an array in an array) is read as its items
|    $flat = foreach ($x in @($Versions)) { if ($x -is [System.Collections.IEnumerable] -and $x -isnot [string] -and $x -isnot [System.Collections.IDictionary]) { foreach ($y in $x) { $y } } else { $x } }
|    $en = @(@($flat) | Where-Object { $null -ne $_ -and -not ($_.PSObject.Properties['Enabled'] -and $_.Enabled -eq $false) })
|    $key = { param($x) $c = $x.Created; if ($c -is [datetime]) { $c.ToUniversalTime().Ticks } elseif ($null -ne $c -and "$c" -match '^\d+$') { [datetime]::new(1970, 1, 1, 0, 0, 0, [DateTimeKind]::Utc).AddSeconds([double]"$c").Ticks } else { [long]::MaxValue } }
|    $sorted = @($en | Sort-Object -Property @{ Expression = { & $key $_ } }, @{ Expression = { [string]$_.Version } })
|    $first = ''
|    foreach ($x in $sorted) { $g = ConvertTo-SIInvardiaInstallId $x.Value; if ($g) { $first = $g; break } }
|    [pscustomobject]@{ First = $first; Newest = $(if ($sorted.Count) { [string]$sorted[-1].Value } else { $null }); Count = $sorted.Count }
|}
|
|function Get-SIInvardiaKvInstallIdVersions {
|    <#
|        The versions of a Key Vault secret over REST (engine\_shared\SI-AzRest.ps1, the run's own sign-in): GET
|        /secrets/<name>/versions (every page), then each enabled version's value (at most 50, oldest first, plus the newest).
|        Returns @(@{ Value; Enabled; Created; Version }); none (404) = @(). THROWS when the vault cannot be read -- a caller
|        never takes an unreadable vault for an empty one.
|    #>
|    param([Parameter(Mandatory)][string]$VaultName, [string]$Name = 'SI-InstallId')
|    $uri = 'https://{0}.vault.azure.net/secrets/{1}/versions?api-version=7.4&maxresults=25' -f $VaultName, [uri]::EscapeDataString($Name)
|    $items = New-Object System.Collections.Generic.List[object]
|    $pages = 0
|    while ($uri -and $pages -lt 20) {
|        $pages++
|        $r = Invoke-SIAzRestRequest -Method GET -Uri $uri -Audience KeyVault -AllowNotFound -What ("the versions of Key Vault secret '{0}' in '{1}'" -f $Name, $VaultName)
|        if (-not $r) { break }
|        $j = $r.Content | ConvertFrom-Json
|        foreach ($v in @($j.value)) { if ($v) { $items.Add($v) } }
|        $uri = if ($j.PSObject.Properties['nextLink'] -and "$($j.nextLink)" -match '^https://') { [string]$j.nextLink } else { $null }
|    }
|    $rows = @($items | ForEach-Object {
|        $ver = ([string]$_.id).TrimEnd('/').Split('/')[-1]
|        [pscustomobject]@{ Value = $null; Enabled = -not ($_.attributes -and $_.attributes.enabled -eq $false); Created = $(if ($_.attributes) { $_.attributes.created } else { $null }); Version = $ver }
|    } | Where-Object { $_.Enabled })
|    $order = @($rows | Sort-Object -Property @{ Expression = { if ("$($_.Created)" -match '^\d+$') { [double]"$($_.Created)" } else { [double]::MaxValue } } }, @{ Expression = { [string]$_.Version } })
|    $want = @($order | Select-Object -First 50) + @($order | Select-Object -Last 1)
|    $seen = @{}
|    foreach ($x in $want) {
|        if ($seen.ContainsKey([string]$x.Version)) { continue }; $seen[[string]$x.Version] = $true
|        # only the versions that can decide: the 50 oldest (the first GUID is among them) and the newest (the converge check)
|        $raw = Get-SIKeyVaultSecretRaw -VaultName $VaultName -Name $Name -Version $x.Version
|        if ($raw) { $x.Value = [string]$raw.value }
|    }
|    # one object per version (an empty vault returns nothing): callers wrap the call in @()
|    return $order
|}
|
|function Get-SIInvardiaInstallId {
|    <#
|        This install's lasting id, READ ONLY. With -ReadVersions { param($Name) } (the versions of SI-InstallId): the OLDEST
|        enabled version holding a GUID (first write wins); when the versions cannot be read, the current value through
|        -ReadSecret { param($Name) }. A GUID comes back lower-cased; none / not a GUID / the read failed -> ''. Never creates
|        it, never throws.
|    #>
|    param([scriptblock]$ReadSecret, [scriptblock]$ReadVersions)
|    if ($ReadVersions) {
|        try { $p = Select-SIInvardiaFirstInstallId -Versions @(& $ReadVersions 'SI-InstallId'); if ($p.First -or $p.Count) { return $p.First } } catch { }
|    }
|    if (-not $ReadSecret) { return '' }
|    $v = $null
|    try { $v = & $ReadSecret 'SI-InstallId' } catch { return '' }
|    return (ConvertTo-SIInvardiaInstallId $v)
|}
|
|function Resolve-SIInvardiaInstallId {
|    <#
|        Invardia 2026-11-01 (S16, answer 2): the lasting id, CREATED ONCE when it is missing -- by the licence knock and by the
|        uplink (heartbeat) job, with the same code and format: [guid]::NewGuid().ToString(), written to SI-InstallId.
|          * FIRST WRITE WINS (-ReadVersions): the id is the OLDEST enabled version of SI-InstallId that holds a GUID
|            (Select-SIInvardiaFirstInstallId), whichever side wrote it. A side that just wrote reads back the same way, so
|            when the knock and the uplink create at once both send the first value. When a later version holds ANOTHER GUID
|            (the losing write of such a race), the first value is written once more as the current version, so a plain read
|            (the engines' status reports) gives the same id -- the id itself never changes. One version (every install
|            before a race) behaves exactly as a plain read.
|          * without -ReadVersions, or when the versions cannot be read: the current value (-ReadSecret), as before;
|          * a stored GUID is KEPT (returned lower-cased) -- never replaced by another id;
|          * a stored value that is not a GUID is left as it is and '' comes back, unless -ReplaceNotGuid (the knock's rule
|            since #239: its body needs a GUID);
|          * the vault cannot be read or written -> '' (no id this time), never a throw.
|        -ReadSecret { param($Name) } / -WriteSecret { param($Name, $Value) } / -ReadVersions { param($Name) } -> @(@{ Value;
|        Enabled; Created; Version }).
|    #>
|    param([scriptblock]$ReadSecret, [scriptblock]$WriteSecret, [scriptblock]$ReadVersions, [switch]$ReplaceNotGuid)
|    if ($ReadVersions) {
|        $pick = { Select-SIInvardiaFirstInstallId -Versions @(& $ReadVersions 'SI-InstallId') }
|        $p = $null
|        try { $p = & $pick } catch { $p = $null }
|        if ($null -ne $p) {
|            $converge = {
|                param($sel)
|                $nw = ConvertTo-SIInvardiaInstallId $sel.Newest
|                if ($WriteSecret -and $sel.First -and $nw -and $nw -ne $sel.First) { try { $null = & $WriteSecret 'SI-InstallId' $sel.First } catch { } }
|            }
|            if ($p.First) { & $converge $p; return $p.First }
|            if ($null -ne $p.Newest -and "$($p.Newest)".Trim() -and -not $ReplaceNotGuid) { return '' }
|            if (-not $WriteSecret) { return '' }
|            $new = [guid]::NewGuid().ToString()
|            try { $null = & $WriteSecret 'SI-InstallId' $new } catch { return '' }
|            try { $p = & $pick } catch { return '' }
|            if ($p.First) { & $converge $p }
|            return [string]$p.First
|        }
|        # the versions could not be read: the plain read below (as before)
|    }
|    if (-not $ReadSecret) { return '' }
|    $v = $null
|    try { $v = & $ReadSecret 'SI-InstallId' } catch { return '' }
|    $have = ConvertTo-SIInvardiaInstallId $v
|    if ($have) { return $have }
|    if ($null -ne $v -and "$v".Trim() -and -not $ReplaceNotGuid) { return '' }
|    if (-not $WriteSecret) { return '' }
|    $new = [guid]::NewGuid().ToString()
|    try { $null = & $WriteSecret 'SI-InstallId' $new } catch { return '' }
|    $back = $null
|    try { $back = & $ReadSecret 'SI-InstallId' } catch { return '' }
|    return (ConvertTo-SIInvardiaInstallId $back)
|}
|function Add-SIInvardiaInstallIdHeader {
|    <# PURE. -Headers with X-Invardia-Install-Id = -InstallId added when it is a GUID (lower-case); unchanged otherwise. #>
|    param([AllowNull()][System.Collections.IDictionary]$Headers, [AllowNull()][AllowEmptyString()][string]$InstallId = '')
|    $h = if ($null -ne $Headers) { $Headers } else { @{} }
|    $iid = ConvertTo-SIInvardiaInstallId $InstallId
|    if ($iid) { $h['X-Invardia-Install-Id'] = $iid }
|    return $h
|}
|
|function Add-SIUplinkInstallId {
|    <#
|        PURE (sets one field). An IDENTIFIED uplink record with -FieldName (default InstallId, the name PIM 3.0.14 sends) =
|        -InstallId, lower-cased. Unchanged when the id is not a GUID, when the record is a setup report (Kind / kind 'setup'),
|        or when it is $null. The caller decides identified vs anonymous: an anonymous record is never passed here.
|    #>
|    param([AllowNull()][object]$Record, [AllowNull()][AllowEmptyString()][string]$InstallId = '', [string]$FieldName = 'InstallId')
|    if ($null -eq $Record) { return $Record }
|    $iid = ConvertTo-SIInvardiaInstallId $InstallId
|    if (-not $iid) { return $Record }
|    if ($Record -is [System.Collections.IDictionary]) {
|        foreach ($k in 'Kind', 'kind') { if ($Record.Contains($k) -and "$($Record[$k])" -eq 'setup') { return $Record } }
|        $Record[$FieldName] = $iid
|        return $Record
|    }
|    $kp = $Record.PSObject.Properties['Kind']
|    if ($kp -and "$($kp.Value)" -eq 'setup') { return $Record }
|    $Record | Add-Member -NotePropertyName $FieldName -NotePropertyValue $iid -Force
|    return $Record
|}
'@ }
$__siSupportFiles['engine/_shared/SI-UplinkOutbox.ps1'] = @{ Sha256 = '4b9eb1ca8b457ff4bafc976e93a7522e00e2dfe45d85252a436d0dd00cf1cf7c'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight Pro -- THE UPLINK OUTBOX (framework 8.4, agreed with Invardia 2026-11-05).
|
|    WHY. A run report is sent ONCE, at the end of its job (Send-SITelemetryRunEnd, SI-TelemetrySend.ps1). Until now a report
|    Invardia did not take -- no answer, a timeout, a 429, any answer that is not ok -- was lost: Invardia never heard of that
|    run. Now such a report is kept in the install's own Pro database (cfg.UplinkOutbox, sql\si-pro-settings.sql) and sent
|    again later by the heartbeat job. The send at job end is unchanged.
|
|    THE THREE MOMENTS
|      1. JOB END (Add-SIUplinkOutboxRecord, called by Send-SITelemetryRunEnd): a run record that was NOT taken -- or not sent
|         at all because an earlier report of the same process was refused -- is ONE cheap insert (a 5-second lock timeout).
|         Identified installs only, and only where the run has the Pro database open; an install without SQL (Community)
|         does nothing new. A failed insert is said ONCE and dropped -- telemetry never fails or slows a run.
|      2. THE HEARTBEAT TICK (Invoke-SIUplinkOutboxTick, engine\heartbeat\Invoke-SIHeartbeat.ps1, LAST in the tick -- the
|         heartbeat itself goes FIRST): the rows are sent again OLDEST FIRST (by the time they were kept; so each job's runs
|         reach Invardia in the order they ran), in ROUNDS: at most 20 POSTs per round, at least 65 seconds between rounds, at
|         most 5 rounds per tick. A record taken is DELETED (it reached its target). The first answer that is not ok (a 429
|         or anything else) STOPS the drain for this tick -- the record stays, with its attempt counted. A tick whose own
|         heartbeat was not taken sends nothing from the outbox. Never in an engine job.
|      3. THE BOUND (Get-SIUplinkOutboxBoundSql, applied with every insert and at the start of every tick): at most 7 days
|         and at most 5,000 rows; beyond that the OLDEST rows go and are COUNTED in cfg.InstallState 'UplinkOutbox'
|         ({ dropped, said, drainUntilUtc }) -- the tick says the drops it has not said yet, once.
|    ONE DRAIN AT A TIME: the tick takes a 15-minute lease in the same state row (drainUntilUtc) -- a second execution of
|    the heartbeat job (a manual start) sends nothing from the outbox while the first drains.
|    THE HEARTBEAT FIELD UplinkBacklog { pending, oldestUtc, checkedUtc } (SI-HeartbeatFields.ps1) is read from this table
|    (Get-SIUplinkOutboxBacklogSql) -- on every ring (Invardia deployed it 2026-11-05), its own switch turns it off.
|
|    NOTHING HERE THROWS TO ITS CALLER. PS 5.1 and 7. No PowerShell modules. A test session never opens a database (every
|    reader is a seam).
|#>
|
|$script:SIUplinkOutbox = @{
|    Table          = 'cfg.UplinkOutbox'
|    StateName      = 'UplinkOutbox'
|    MaxDays        = 7
|    MaxRows        = 5000
|    RoundSize      = 20
|    RoundWaitSec   = 65
|    MaxRounds      = 5
|    LeaseMinutes   = 15
|    InsertLockMs   = 5000
|    AnswerMax      = 400
|    JsonDepth      = 6
|    Kinds          = @('run')
|    By             = 'si-engine (uplink outbox)'
|}
|
|function Get-SIUplinkOutboxContract { $script:SIUplinkOutbox }
|
|function Get-SIUplinkOutboxInvoke {
|    <# The Pro database seam the run has open (the Pro settings layer's store), or $null: none open, or a test session. #>
|    try {
|        if (Get-Module -Name Pester) { return $null }
|        if ($global:SI_ProSettingsStore -and $global:SI_ProSettingsStore.PSObject.Properties['Invoke'] -and $global:SI_ProSettingsStore.Invoke -is [scriptblock]) { return $global:SI_ProSettingsStore.Invoke }
|    } catch { }
|    $null
|}
|
|function ConvertTo-SIUplinkOutboxJson {
|    <# PURE. A wire record as the JSON the uplink client sends (the same depth, compressed). #>
|    param([Parameter(Mandatory)]$Record)
|    $Record | ConvertTo-Json -Depth ([int]$script:SIUplinkOutbox.JsonDepth) -Compress
|}
|
|function ConvertFrom-SIUplinkOutboxJsonElement {
|    param($Element)
|    switch ([string]$Element.ValueKind) {
|        'Object' {
|            $o = [ordered]@{}
|            foreach ($p in $Element.EnumerateObject()) { $o[$p.Name] = ConvertFrom-SIUplinkOutboxJsonElement $p.Value }
|            return [pscustomobject]$o
|        }
|        'Array' {
|            $a = New-Object System.Collections.Generic.List[object]
|            foreach ($e in $Element.EnumerateArray()) { $a.Add((ConvertFrom-SIUplinkOutboxJsonElement $e)) }
|            return , $a.ToArray()
|        }
|        'String' { return $Element.GetString() }
|        'Number' { $l = 0L; if ($Element.TryGetInt64([ref]$l)) { return $l }; return $Element.GetDouble() }
|        'True' { return $true }
|        'False' { return $false }
|        default { return $null }
|    }
|}
|
|function ConvertFrom-SIUplinkOutboxJson {
|    <#
|        PURE. A kept record back as an object that the uplink client serialises to the SAME JSON: on PowerShell 7 through
|        System.Text.Json (ConvertFrom-Json there turns ISO time strings into dates, and the record would leave in another
|        form); on 5.1 ConvertFrom-Json (it keeps strings as they are).
|    #>
|    param([Parameter(Mandatory)][string]$Json)
|    $t = 'System.Text.Json.JsonDocument' -as [type]
|    if ($t) {
|        $doc = [System.Text.Json.JsonDocument]::Parse($Json)
|        try { return (ConvertFrom-SIUplinkOutboxJsonElement $doc.RootElement) } finally { $doc.Dispose() }
|    }
|    $Json | ConvertFrom-Json
|}
|
|function ConvertTo-SIUplinkOutboxAnswer {
|    <# PURE. The uplink's answer as one short line (at most 400 characters), redacted when the framework client is loaded. #>
|    param([AllowNull()][AllowEmptyString()][string]$Text)
|    $t = ("$Text" -replace '[\r\n\t]+', ' ').Trim()
|    if (-not $t) { $t = 'no answer' }
|    try { if (Get-Command -Name ConvertTo-AitUplinkRedacted -ErrorAction SilentlyContinue) { $t = ConvertTo-AitUplinkRedacted -Text $t } } catch { }
|    $max = [int]$script:SIUplinkOutbox.AnswerMax
|    if ($t.Length -gt $max) { $t = $t.Substring(0, $max - 3) + '...' }
|    $t
|}
|
|# =====================================================================================================================
|#  The statements (fixed text, every value a parameter)
|# =====================================================================================================================
|function Get-SIUplinkOutboxBoundSql {
|    <#
|        The BOUND (a fragment of a batch; needs @NowUtc, @MaxDays, @MaxRows, @StateName, @By): rows older than @MaxDays, then
|        the oldest rows beyond @MaxRows, are deleted; their number is added to cfg.InstallState @StateName 'dropped'. Leaves
|        @dropNow (int) set.
|    #>
|    @'
|    DECLARE @dropNow int = 0, @cut DATETIME2(3) = DATEADD(DAY, -@MaxDays, @NowUtc), @rowsNow bigint;
|    DELETE FROM cfg.UplinkOutbox WHERE CreatedUtc < @cut;
|    SET @dropNow = @@ROWCOUNT;
|    SELECT @rowsNow = COUNT_BIG(*) FROM cfg.UplinkOutbox;
|    IF @rowsNow > @MaxRows
|    BEGIN
|        DELETE FROM cfg.UplinkOutbox WHERE OutboxId IN (SELECT TOP (CAST(@rowsNow - @MaxRows AS int)) OutboxId FROM cfg.UplinkOutbox ORDER BY CreatedUtc, OutboxId);
|        SET @dropNow = @dropNow + @@ROWCOUNT;
|    END
|    IF @dropNow > 0 AND OBJECT_ID(N'cfg.InstallState') IS NOT NULL
|    BEGIN
|        IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @StateName)
|            UPDATE cfg.InstallState
|               SET Value = JSON_MODIFY(CASE WHEN ISJSON(Value) = 1 THEN Value ELSE N'{}' END, '$.dropped',
|                                       CAST(CASE WHEN ISJSON(Value) = 1 THEN ISNULL(TRY_CONVERT(bigint, JSON_VALUE(Value, '$.dropped')), 0) ELSE 0 END + @dropNow AS bigint)),
|                   UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By
|             WHERE Name = @StateName;
|        ELSE
|            INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@StateName, CONCAT(N'{"dropped":', @dropNow, N',"said":0}'), NULL, @By);
|    END
|'@
|}
|
|function Get-SIUplinkOutboxInsertSql {
|    <# ONE record kept (@Job, @Kind, @Json, @Answer, @NowUtc), then the bound. Answers ONE row: Kept (1 / 0 = no table yet). #>
|    $bound = Get-SIUplinkOutboxBoundSql
|    @"
|SET NOCOUNT ON;
|SET LOCK_TIMEOUT $([int]$script:SIUplinkOutbox.InsertLockMs);
|IF OBJECT_ID(N'cfg.UplinkOutbox') IS NULL
|    SELECT CAST(0 AS int) AS Kept;
|ELSE
|BEGIN
|    INSERT cfg.UplinkOutbox (Job, Kind, RecordJson, CreatedUtc, Attempts, LastAttemptUtc, LastAnswer)
|    VALUES (@Job, @Kind, @Json, @NowUtc, 1, @NowUtc, @Answer);
|$bound
|    SELECT CAST(1 AS int) AS Kept;
|END
|"@
|}
|
|function Get-SIUplinkOutboxBeginSql {
|    <#
|        The tick's start: the bound, then the drain lease (cfg.InstallState @StateName 'drainUntilUtc': taken when none is
|        set or it has run out). Answers ONE row: HasTable, Taken, Dropped, Said.
|    #>
|    $bound = Get-SIUplinkOutboxBoundSql
|    @"
|SET NOCOUNT ON;
|SET XACT_ABORT ON;
|IF OBJECT_ID(N'cfg.UplinkOutbox') IS NULL OR OBJECT_ID(N'cfg.InstallState') IS NULL
|    SELECT CAST(0 AS int) AS HasTable, CAST(0 AS int) AS Taken, CAST(0 AS bigint) AS Dropped, CAST(0 AS bigint) AS Said;
|ELSE
|BEGIN
|$bound
|    BEGIN TRAN;
|    DECLARE @v NVARCHAR(400) = NULL, @has int = 0;
|    SELECT @v = Value, @has = 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = @StateName;
|    IF ISNULL(ISJSON(@v), 0) <> 1 SET @v = N'{"dropped":0,"said":0}';
|    DECLARE @until DATETIME2(0) = TRY_CONVERT(DATETIME2(0), JSON_VALUE(@v, '$.drainUntilUtc'), 127);
|    DECLARE @taken int = CASE WHEN @until IS NULL OR @until <= @NowUtc THEN 1 ELSE 0 END;
|    IF @taken = 1
|    BEGIN
|        SET @v = JSON_MODIFY(@v, '$.drainUntilUtc', CONVERT(NVARCHAR(19), DATEADD(MINUTE, @LeaseMinutes, @NowUtc), 126) + N'Z');
|        IF @has = 1 UPDATE cfg.InstallState SET Value = @v, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = @StateName;
|        ELSE INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (@StateName, @v, NULL, @By);
|    END
|    COMMIT;
|    SELECT CAST(1 AS int) AS HasTable, @taken AS Taken,
|           ISNULL(TRY_CONVERT(bigint, JSON_VALUE(@v, '$.dropped')), 0) AS Dropped, ISNULL(TRY_CONVERT(bigint, JSON_VALUE(@v, '$.said')), 0) AS Said;
|END
|"@
|}
|
|function Get-SIUplinkOutboxEndSql {
|    <# The tick's end: the drops said so far recorded (@Said); the lease released only by the execution that holds it (@Release = 1). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.InstallState') IS NOT NULL
|    UPDATE cfg.InstallState
|       SET Value = CASE WHEN @Release = 1
|                        THEN JSON_MODIFY(JSON_MODIFY(CASE WHEN ISJSON(Value) = 1 THEN Value ELSE N'{}' END, '$.drainUntilUtc', NULL), '$.said', CAST(@Said AS bigint))
|                        ELSE JSON_MODIFY(CASE WHEN ISJSON(Value) = 1 THEN Value ELSE N'{}' END, '$.said', CAST(@Said AS bigint)) END,
|           UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By
|     WHERE Name = @StateName;
|'@
|}
|
|function Get-SIUplinkOutboxReadSql {
|    <# The next @Take rows, OLDEST first (by the time kept, then the row id). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.UplinkOutbox') IS NOT NULL
|    SELECT TOP (@Take) OutboxId, Job, Kind, RecordJson, CONVERT(NVARCHAR(23), CreatedUtc, 126) AS CreatedUtc, Attempts
|    FROM cfg.UplinkOutbox ORDER BY CreatedUtc, OutboxId;
|'@
|}
|
|function Get-SIUplinkOutboxTakenSql { 'DELETE FROM cfg.UplinkOutbox WHERE OutboxId = @Id;' }
|
|function Get-SIUplinkOutboxNotTakenSql {
|    'UPDATE cfg.UplinkOutbox SET Attempts = Attempts + 1, LastAttemptUtc = @NowUtc, LastAnswer = @Answer WHERE OutboxId = @Id;'
|}
|
|function Get-SIUplinkOutboxBacklogSql {
|    <# What is still to send: Pending (rows) and OldestUtc -- both NULL when the table is not there yet (not known). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.UplinkOutbox') IS NULL
|    SELECT CAST(NULL AS bigint) AS Pending, CAST(NULL AS DATETIME2(3)) AS OldestUtc;
|ELSE
|    SELECT COUNT_BIG(*) AS Pending, MIN(CreatedUtc) AS OldestUtc FROM cfg.UplinkOutbox;
|'@
|}
|
|function ConvertTo-SIUplinkOutboxRows {
|    <# PURE. Whatever a database seam answers (ONE array of rows, rows one by one, a single row) as rows. #>
|    param($Answer)
|    foreach ($x in @($Answer)) {
|        if ($null -eq $x -or $x -is [DBNull]) { continue }
|        if ($x -is [array]) { foreach ($y in $x) { if ($null -ne $y -and -not ($y -is [DBNull])) { $y } } } else { $x }
|    }
|}
|
|function Get-SIUplinkOutboxValue {
|    param($Row, [string]$Name)
|    if ($null -eq $Row) { return $null }
|    $v = $null
|    if ($Row -is [System.Collections.IDictionary]) { if ($Row.Contains($Name)) { $v = $Row[$Name] } }
|    elseif ($Row.PSObject.Properties[$Name]) { $v = $Row.$Name }
|    if ($v -is [DBNull]) { return $null }
|    $v
|}
|
|function Get-SIUplinkOutboxParams {
|    <# The parameters every statement here shares. #>
|    param([Parameter(Mandatory)][datetime]$NowUtc)
|    $c = $script:SIUplinkOutbox
|    [ordered]@{ NowUtc = $NowUtc.ToUniversalTime(); MaxDays = [int]$c.MaxDays; MaxRows = [int]$c.MaxRows; StateName = [string]$c.StateName; By = [string]$c.By }
|}
|
|# =====================================================================================================================
|#  1. JOB END -- one cheap insert
|# =====================================================================================================================
|function Add-SIUplinkOutboxRecord {
|    <#
|        Keep ONE record that Invardia did not take (-Json: the record as it would have been sent; -Answer: what the uplink
|        said). $true = kept. NEVER throws: no database, no table yet (an install one update behind) or a failed insert is
|        $false -- a failure is said ONCE per process and the record is dropped.
|    #>
|    param([scriptblock]$Invoke, [AllowEmptyString()][string]$Job, [AllowEmptyString()][string]$Json, [AllowNull()][AllowEmptyString()][string]$Answer,
|          [string]$Kind = 'run', [datetime]$NowUtc = [datetime]::UtcNow)
|    try {
|        if (-not $Invoke -or -not "$Job".Trim() -or -not "$Json".Trim()) { return $false }
|        if ($script:SIUplinkOutbox.Kinds -notcontains $Kind) { return $false }
|        $p = Get-SIUplinkOutboxParams -NowUtc $NowUtc
|        $p.Job = ("$Job".Trim()); if ($p.Job.Length -gt 64) { $p.Job = $p.Job.Substring(0, 64) }
|        $p.Kind = $Kind; $p.Json = $Json; $p.Answer = (ConvertTo-SIUplinkOutboxAnswer $Answer)
|        $rows = @(ConvertTo-SIUplinkOutboxRows (& $Invoke (Get-SIUplinkOutboxInsertSql) $p 'reader'))
|        if (-not $rows.Count) { return $true }
|        return ([int](Get-SIUplinkOutboxValue $rows[0] 'Kept') -eq 1)
|    } catch {
|        if (-not $global:SI_UplinkOutboxWarned) {
|            $global:SI_UplinkOutboxWarned = $true
|            try { Write-Warning ("The status report could not be kept for a later send either ({0}). The run is not affected." -f (ConvertTo-SIUplinkOutboxAnswer $_.Exception.Message)) } catch { }
|        }
|        return $false
|    }
|}
|
|# =====================================================================================================================
|#  The backlog -- what the heartbeat field UplinkBacklog says
|# =====================================================================================================================
|function ConvertTo-SIUplinkBacklog {
|    <#
|        PURE. UplinkBacklog { pending, oldestUtc, checkedUtc } from the backlog row (Pending, OldestUtc): EXACTLY these
|        three keys; pending a whole number >= 0, oldestUtc ISO-8601 UTC or null, checkedUtc ISO-8601 UTC (always). Caught up
|        = pending 0, oldestUtc null -- a value, never "empty". $null = not known (no table yet / not read): the field is left out.
|    #>
|    param($Row, [Parameter(Mandatory)][datetime]$NowUtc)
|    $n = Get-SIUplinkOutboxValue $Row 'Pending'
|    if ($null -eq $n -or "$n".Trim() -eq '') { return $null }
|    $cnt = 0L
|    if (-not [long]::TryParse("$n".Trim(), [Globalization.NumberStyles]::Integer, [Globalization.CultureInfo]::InvariantCulture, [ref]$cnt) -or $cnt -lt 0) { return $null }
|    $iso = { param($v)
|        if ($null -eq $v -or "$v".Trim() -eq '') { return $null }
|        $d = $null
|        if ($v -is [datetime]) { $d = $(if ($v.Kind -eq 'Unspecified') { [datetime]::SpecifyKind($v, 'Utc') } else { $v.ToUniversalTime() }) }
|        else { try { $d = [datetime]::Parse([string]$v, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal) } catch { return $null } }
|        $d.ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture) }
|    $old = if ($cnt -gt 0) { & $iso (Get-SIUplinkOutboxValue $Row 'OldestUtc') } else { $null }
|    [pscustomobject][ordered]@{ pending = [int][Math]::Min($cnt, [long][int]::MaxValue); oldestUtc = $old; checkedUtc = (& $iso $NowUtc) }
|}
|
|function Get-SIUplinkOutboxBacklog {
|    <# The backlog read through -Invoke (the Pro database). $null = no database, no table yet, or not readable. Never throws. #>
|    param([scriptblock]$Invoke, [Parameter(Mandatory)][datetime]$NowUtc)
|    try {
|        if (-not $Invoke) { return $null }
|        $rows = @(ConvertTo-SIUplinkOutboxRows (& $Invoke (Get-SIUplinkOutboxBacklogSql) @{} 'reader'))
|        if (-not $rows.Count) { return $null }
|        ConvertTo-SIUplinkBacklog -Row $rows[0] -NowUtc $NowUtc
|    } catch { $null }
|}
|
|# =====================================================================================================================
|#  2. THE HEARTBEAT TICK -- the drain, in rounds
|# =====================================================================================================================
|function Invoke-SIUplinkOutboxDrain {
|    <#
|        Send the kept records again: OLDEST first, at most -RoundSize POSTs per round, -RoundWaitSec (at least 65) between
|        rounds (-Sleep { param($Seconds) }, the test seam), at most -MaxRounds rounds. A record taken is deleted; the first
|        record NOT taken stops the drain (its attempt counted, the record kept). -Send { param($Record) } -> @{ Status; Reason }
|        (default: Send-SITelemetryRecordWithFallback through -Transport with -Context). Returns @{ Sent; Rounds; Stopped;
|        Why; Order }. Throws only when the database cannot be read (the tick says it).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][scriptblock]$Send, [Parameter(Mandatory)][datetime]$NowUtc,
|          [scriptblock]$Sleep, [int]$RoundSize = $script:SIUplinkOutbox.RoundSize, [int]$RoundWaitSec = $script:SIUplinkOutbox.RoundWaitSec,
|          [int]$MaxRounds = $script:SIUplinkOutbox.MaxRounds, [scriptblock]$Clock)
|    if ($RoundWaitSec -lt 65) { $RoundWaitSec = 65 }
|    if (-not $Sleep) { $Sleep = { param($Seconds) Start-Sleep -Seconds $Seconds } }
|    if (-not $Clock) { $Clock = { [datetime]::UtcNow } }
|    $out = [pscustomobject]@{ Sent = 0; Rounds = 0; Stopped = $false; Why = ''; Order = (New-Object System.Collections.Generic.List[long]) }
|    while ($out.Rounds -lt $MaxRounds) {
|        $rows = @(ConvertTo-SIUplinkOutboxRows (& $Invoke (Get-SIUplinkOutboxReadSql) ([ordered]@{ Take = [int]$RoundSize }) 'reader'))
|        if (-not $rows.Count) { break }
|        # the rounds keep Invardia's rate limit: a wait BEFORE every round but the first, and only when there is more to send
|        if ($out.Rounds -gt 0) { & $Sleep $RoundWaitSec }
|        $out.Rounds++
|        foreach ($row in $rows) {
|            $id = [long](Get-SIUplinkOutboxValue $row 'OutboxId')
|            $r = $null
|            try {
|                $rec = ConvertFrom-SIUplinkOutboxJson -Json ([string](Get-SIUplinkOutboxValue $row 'RecordJson'))
|                $r = & $Send $rec
|            } catch { $r = [pscustomobject]@{ Status = 'failed'; Reason = ('the kept record could not be sent: {0}' -f $_.Exception.Message) } }
|            $out.Order.Add($id)
|            $now = ([datetime](& $Clock)).ToUniversalTime()
|            if ($r -and "$($r.Status)" -eq 'ok') {
|                $null = & $Invoke (Get-SIUplinkOutboxTakenSql) ([ordered]@{ Id = $id }) 'nonquery'
|                $out.Sent++
|                continue
|            }
|            $why = ConvertTo-SIUplinkOutboxAnswer $(if ($r) { [string]$r.Reason } else { 'no answer' })
|            try { $null = & $Invoke (Get-SIUplinkOutboxNotTakenSql) ([ordered]@{ Id = $id; NowUtc = $now; Answer = $why }) 'nonquery' } catch { }
|            $out.Stopped = $true; $out.Why = $why
|            break
|        }
|        if ($out.Stopped) { break }
|        if ($rows.Count -lt $RoundSize) { break }
|    }
|    $out
|}
|
|function Invoke-SIUplinkOutboxTick {
|    <#
|        The outbox's part of ONE heartbeat tick -- called LAST in the tick, after the heartbeat itself. NEVER throws; returns
|        @{ Status; Sent; Left; Dropped; Lines } -- Status: disabled | skipped | no-table | busy | held | caught-up | drained |
|        stopped | error. Every input is a seam (tests):
|          -Invoke            the Pro database (required: no database = skipped)
|          -HeartbeatStatus   this tick's heartbeat (Send-SIHeartbeatTick's Status): failed / error = Invardia did not take
|                             it, nothing is sent from the outbox this tick (the bound and the drop count still run)
|          -Context / -Transport / -Send   the sender (default: this install's context, Send-SITelemetryUplink through
|                             Send-SITelemetryRecordWithFallback); a test session sends nothing without -Transport or -Send
|          -Sleep / -Now      the wait between rounds and the clock
|    #>
|    [CmdletBinding()]
|    param([scriptblock]$Invoke, [AllowEmptyString()][string]$HeartbeatStatus = '', $Context, [scriptblock]$Transport, [scriptblock]$Send,
|          [scriptblock]$Sleep, $Now, [hashtable]$Rounds = @{})
|    $lines = New-Object System.Collections.Generic.List[string]
|    $out = { param($s, $sent, $left, $dropped) [pscustomobject]@{ Status = $s; Sent = [int]$sent; Left = $left; Dropped = [long]$dropped; Lines = $lines.ToArray() } }
|    $nowUtc = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|    $leased = $false; $said = $null; $c = $script:SIUplinkOutbox
|    try {
|        if ((Get-Command -Name Test-SITelemetryEnabled -ErrorAction SilentlyContinue) -and -not (Test-SITelemetryEnabled)) { return (& $out 'disabled' 0 $null 0) }
|        if (-not $Invoke) { return (& $out 'skipped' 0 $null 0) }
|        $p = Get-SIUplinkOutboxParams -NowUtc $nowUtc
|        $p.LeaseMinutes = [int]$c.LeaseMinutes
|        $b = @(ConvertTo-SIUplinkOutboxRows (& $Invoke (Get-SIUplinkOutboxBeginSql) $p 'reader'))
|        $b0 = if ($b.Count) { $b[0] } else { $null }
|        if (-not $b0 -or [int](Get-SIUplinkOutboxValue $b0 'HasTable') -ne 1) { return (& $out 'no-table' 0 $null 0) }
|        $dropped = [long](Get-SIUplinkOutboxValue $b0 'Dropped'); $saidBefore = [long](Get-SIUplinkOutboxValue $b0 'Said')
|        $leased = ([int](Get-SIUplinkOutboxValue $b0 'Taken') -eq 1)
|        # the drops not said yet -- ONCE, in this tick's line (the count keeps growing; "said" remembers how far it was said)
|        $newDrops = $dropped - $saidBefore
|        if ($newDrops -gt 0) {
|            $lines.Add(('uplink outbox: {0} unsent run report(s) were dropped -- older than {1} days or beyond {2:N0} kept (the oldest go first); {3} dropped in all' -f $newDrops, $c.MaxDays, $c.MaxRows, $dropped))
|            $said = $dropped
|        }
|        if (-not $leased) { $lines.Add('uplink outbox: another execution is sending the kept run reports -- nothing sent from here'); return (& $out 'busy' 0 $null $newDrops) }
|        if ($HeartbeatStatus -in @('failed', 'error')) {
|            $left = Get-SIUplinkOutboxBacklog -Invoke $Invoke -NowUtc $nowUtc
|            if ($left -and $left.pending -gt 0) { $lines.Add(('uplink outbox: {0} run report(s) kept; not sent this tick -- Invardia did not take the heartbeat' -f $left.pending)) }
|            return (& $out 'held' 0 $(if ($left) { $left.pending } else { $null }) $newDrops)
|        }
|        if (-not $Send) {
|            if (-not $Transport -and (Get-Module -Name Pester)) { return (& $out 'skipped' 0 $null $newDrops) }
|            if (-not $Context -and (Get-Command -Name Get-SITelemetryContext -ErrorAction SilentlyContinue)) { $Context = Get-SITelemetryContext }
|            if (-not $Context -or [string]$Context.Mode -ne 'identified') { return (& $out 'skipped' 0 $null $newDrops) }
|            if (-not $Transport) { $Transport = { param($Record, $Endpoint, $AccessCode, $TimeoutSec) Send-SITelemetryUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec } }
|            $obCtx = $Context; $obTr = $Transport; $obTo = 5
|            try { $obTo = [int](Get-SITelemetrySendState).TimeoutSec } catch { $obTo = 5 }
|            # PLAIN, not a closure: the drain calls it in this function's scope chain, so $obCtx / $obTr / $obTo are the ones
|            # here -- and the sender's functions are found where the caller loaded them (a closure sees only global ones)
|            $Send = { param($Record) (Send-SITelemetryRecordWithFallback -Record $Record -Transport $obTr -Context $obCtx -TimeoutSec $obTo -NowUtc ([datetime]::UtcNow)).Result }
|        }
|        $da = @{ Invoke = $Invoke; Send = $Send; NowUtc = $nowUtc; Sleep = $Sleep }
|        foreach ($k in 'RoundSize', 'RoundWaitSec', 'MaxRounds') { if ($Rounds.ContainsKey($k)) { $da[$k] = [int]$Rounds[$k] } }
|        $d = Invoke-SIUplinkOutboxDrain @da
|        $left = Get-SIUplinkOutboxBacklog -Invoke $Invoke -NowUtc $nowUtc
|        $leftN = if ($left) { $left.pending } else { $null }
|        if ($d.Stopped) {
|            $lines.Add(('uplink outbox: {0} kept run report(s) sent, then Invardia did not take the next ({1}) -- the rest stay for the next tick ({2} kept)' -f $d.Sent, $d.Why, $(if ($null -ne $leftN) { $leftN } else { 'unknown' })))
|            return (& $out 'stopped' $d.Sent $leftN $newDrops)
|        }
|        if ($d.Sent -gt 0) {
|            $lines.Add(('uplink outbox: {0} kept run report(s) sent in {1} round(s){2}' -f $d.Sent, $d.Rounds, $(if ($leftN) { ('; {0} left for the next tick' -f $leftN) } else { '; caught up' })))
|            return (& $out 'drained' $d.Sent $leftN $newDrops)
|        }
|        & $out 'caught-up' 0 $leftN $newDrops
|    } catch {
|        $lines.Add(('uplink outbox: not sent this tick ({0})' -f (ConvertTo-SIUplinkOutboxAnswer $_.Exception.Message)))
|        & $out 'error' 0 $null 0
|    } finally {
|        if ($leased -or $null -ne $said) {
|            $sv = if ($null -ne $said) { [long]$said } else { [long]$saidBefore }
|            try { $null = & $Invoke (Get-SIUplinkOutboxEndSql) ([ordered]@{ StateName = [string]$c.StateName; By = [string]$c.By; Said = $sv; Release = $(if ($leased) { 1 } else { 0 }) }) 'nonquery' } catch { }
|        }
|    }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-Guard.ps1'] = @{ Sha256 = '84d4108d57e1bda83c25a284fd1c157bedb426f6656d0cbb36f9728abe4a0a23'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- GUARD EVENTS (#277): every guard that holds, refuses or halts a step to protect data tells a person
|    and Invardia, on by default.
|
|    ONE CALL for every guard: Send-SIGuardEvent. It takes the guard id (stable, dotted, from config\guard-catalog.locked.json),
|    the outcome (halted | refused | held | skipped | warning), the measured values against their limits, what was held, an
|    optional subject (which connector / report / job), the detail sentence and a link -- and then, EACH STEP FAILURE-SAFE
|    (nothing here ever throws to its caller, and nothing here can fail the job that tripped the guard):
|
|      (a) RUN HEALTH   one row in SI_RunHealth_CL, Phase 'Guard', ExitReason 'guard-<outcome>' (the run's own Start / End
|                       rows are untouched; every reader of run health filters on Phase == 'End');
|      (b) AUDIT        one AUDIT-1 event 'guard.event.trip' on the Pro database's audit trail (Pro only: needs the database);
|      (c) MAIL         one mail per guard per run to SI_GuardMail_To (else the install's report recipients, MailTo; else the
|                       Pro SuperAdmins), through the Risk Analysis relay settings and transports. ON by default
|                       (SI_GuardMail_Enabled). DE-DUPLICATED: a guard that keeps tripping mails again only after 24 hours,
|                       and that mail says "still tripping (N times)". The trip state lives in the Pro database
|                       (cfg.GuardState) when there is one, else in a small file (%ProgramData%\SecurityInsight\guards);
|      (d) TELEMETRY    one GUARD-1 record (Schema 2, Kind 'guard' -- Invardia's receiver, 2026-10-04) posted through the
|                       framework client's Send-AitUplink, following SI_Telemetry_Enabled (default ON). Self-sufficient for a
|                       support ticket per environment + guard: GuardId, GuardOutcome, Severity, Area, Job, Measured /
|                       Thresholds (numbers), HeldCount, TripCount, FirstSeenUtc, Version, Ring. ANONYMOUS adds only the random
|                       InstallId -- no tenant, host, subject, detail, action text or link; IDENTIFIED adds ClaimedTenantId,
|                       Host, ActionText (redacted, at most 500 characters), Link (https) and -- Invardia S16 -- InstallId =
|                       the install's LASTING id (SI-InstallId) when it has one. The framework's own record
|                       builder (New-AitUplinkReport) knows heartbeat | run | install only; the guard record is built here.
|      (e) THE GUARDS VIEW  one row in cfg.GuardEvent (Pro database) -- the web app's Operations > Guards (safety checks) view, and the
|                       outbox the mail job reads for events the web app writes (Invoke-SIGuardOutbox).
|
|    A TEST SESSION NEVER MAILS OR SENDS (Pester loaded, no transport handed in) and never writes state to the machine.
|
|    Customer-facing words (subject, body) are plain language: what was protected, what happened, the numbers against the
|    limit, what was held (nothing lost), what to do. No internal numbers, no jargon.
|
|    PS 5.1 and 7.
|#>
|
|if (-not (Get-Command -Name Get-SITelemetryContext -ErrorAction SilentlyContinue)) {
|    try { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-TelemetrySend.ps1')) } catch { }
|}
|# MAIL-1: the one mail transport (SI_Mail_Mode: sharedMailbox | smtp | none)
|if (-not (Get-Command -Name Send-SIMail -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-MailTransport.ps1')) }
|# CR4 (#654): the stricter period after a release that changed engine code -- halved limits, the guard mode
|if (-not (Get-Command -Name Resolve-SIGuardLimit -ErrorAction SilentlyContinue)) {
|    $sgs = [System.IO.Path]::Combine($PSScriptRoot, 'SI-GuardStrict.ps1')
|    if ([System.IO.File]::Exists($sgs)) { . $sgs }
|}
|# owner 2026-10-17: guards heal themselves, say which release they tripped on, and can be accepted at every install
|if (-not (Get-Command -Name Get-SIGuardHealDecision -ErrorAction SilentlyContinue)) {
|    $sgh = [System.IO.Path]::Combine($PSScriptRoot, 'SI-GuardHeal.ps1')
|    if ([System.IO.File]::Exists($sgh)) { . $sgh }
|}
|
|$script:SIGuard = @{
|    SIRoot      = (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))
|    WindowHours = 24
|    Catalog     = $null
|    IdPattern   = '^[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*){2}$'
|    NamePattern = '^[a-z][A-Za-z0-9]{0,30}$'
|    Sources     = @('job', 'web', 'setup', 'engine')
|    AuditAction = 'guard.event.trip'
|    Product     = 'securityinsight'
|}
|if ($null -eq $global:SI_GuardHealth) { $global:SI_GuardHealth = @{ Events = 0; Failed = 0; LastError = '' } }
|
|# =====================================================================================================================
|#  The catalog -- PURE (reads one shipped file)
|# =====================================================================================================================
|function Get-SIGuardCatalog {
|    <# The closed list of guards (config\guard-catalog.locked.json): outcomes, severity per outcome, guards. Cached. #>
|    param([string]$SIRoot = $script:SIGuard.SIRoot, [switch]$Refresh)
|    if ($script:SIGuard.Catalog -and -not $Refresh -and -not $PSBoundParameters.ContainsKey('SIRoot')) { return $script:SIGuard.Catalog }
|    $p = [System.IO.Path]::Combine($SIRoot, 'config', 'guard-catalog.locked.json')
|    $c = ConvertFrom-Json -InputObject ([System.IO.File]::ReadAllText($p))
|    if (-not $PSBoundParameters.ContainsKey('SIRoot')) { $script:SIGuard.Catalog = $c }
|    $c
|}
|
|function Get-SIGuardDefinition {
|    <# The catalog entry of one guard id; throws for an id that is not listed (a guard must be listed on purpose). #>
|    param([Parameter(Mandatory)][string]$Id)
|    $g = @((Get-SIGuardCatalog).guards | Where-Object { [string]$_.id -eq $Id }) | Select-Object -First 1
|    if (-not $g) { throw ("guard '{0}' is not in config\guard-catalog.locked.json" -f $Id) }
|    $g
|}
|
|function Get-SIGuardSeverity {
|    <# PURE. halted / refused = critical (the step did not happen); held / skipped / warning = warning. #>
|    param([Parameter(Mandatory)][string]$Outcome)
|    switch ($Outcome) {
|        'halted'  { return 'critical' }
|        'refused' { return 'critical' }
|        'held'    { return 'warning' }
|        'skipped' { return 'warning' }
|        'warning' { return 'warning' }
|    }
|    throw ("'{0}' is not a guard outcome (halted, refused, held, skipped, warning)" -f $Outcome)
|}
|
|# =====================================================================================================================
|#  Settings -- PURE over the values handed in
|# =====================================================================================================================
|function Test-SIGuardFlag {
|    <# PURE. A switch setting: the setting wins when set, then the environment value, else -Default. false/0/off/no = off. #>
|    param([AllowNull()]$Value, [AllowNull()][AllowEmptyString()][string]$EnvValue, [bool]$Default = $true)
|    foreach ($v in @($Value, $EnvValue)) {
|        if ($null -eq $v) { continue }
|        if ($v -is [bool]) { return $v }
|        $s = ([string]$v).Trim().Trim('$').ToLowerInvariant()
|        if (-not $s) { continue }
|        return -not ($s -in @('false', '0', 'off', 'no', 'disabled'))
|    }
|    $Default
|}
|
|function Get-SIGuardSetting {
|    <# One setting: -Globals (a test's hashtable) when given, else the live global. #>
|    param([Parameter(Mandatory)][string]$Name, [System.Collections.IDictionary]$Globals)
|    if ($Globals) { if ($Globals.Contains($Name)) { return $Globals[$Name] }; return $null }
|    Get-Variable -Name $Name -Scope Global -ValueOnly -ErrorAction SilentlyContinue
|}
|
|function Test-SIGuardMailEnabled {
|    param([System.Collections.IDictionary]$Globals)
|    $envV = if ($Globals) { $null } else { $env:SI_GUARDMAIL_ENABLED }
|    Test-SIGuardFlag -Value (Get-SIGuardSetting -Name 'SI_GuardMail_Enabled' -Globals $Globals) -EnvValue $envV -Default $true
|}
|
|# =====================================================================================================================
|#  #414 -- THE GUARD SWITCHES (operator, 2026-10-06: "give me settings for ALL gates, so I can turn them off and fine
|#  tune them"). Every guard in config\guard-catalog.locked.json has two settings, both ON by default:
|#    SI_Guard_<Token>_Enabled   off = the guard does not hold, refuse or halt: it logs ONE line "guard <id> is off
|#                               (setting ...)" and the step goes on as if it had not tripped (no event, no mail). For a
|#                               guard whose stop is not SecurityInsight's own choice (the source failed, the data has no
|#                               key, the licence) off means: no event and no mail -- the catalog's 'whenOff' says which,
|#                               in plain words, and the Settings page shows it.
|#    SI_Guard_<Token>_Mail      off = the event is still recorded (Guards page, run health, audit), but not mailed.
|#  plus ONE master switch SI_Guards_Enabled (off = every guard is off). <Token> = the id in PascalCase
|#  ('vuln.connector.close-ceiling' -> 'VulnConnectorCloseCeiling'). Pro: the Settings page (cfg.Setting -> $global:);
|#  Community / VM: the same names in the configuration file.
|# =====================================================================================================================
|function ConvertTo-SIGuardSettingToken {
|    <# PURE. 'vuln.connector.close-ceiling' -> 'VulnConnectorCloseCeiling'. #>
|    param([Parameter(Mandatory)][string]$GuardId)
|    (@($GuardId -split '[.\-]' | Where-Object { $_ } | ForEach-Object { $_.Substring(0, 1).ToUpperInvariant() + $_.Substring(1) })) -join ''
|}
|
|function Get-SIGuardSwitchNames {
|    <# PURE. The setting names of one guard's switches. #>
|    param([Parameter(Mandatory)][string]$GuardId)
|    $t = ConvertTo-SIGuardSettingToken -GuardId $GuardId
|    [pscustomobject]@{ Master = 'SI_Guards_Enabled'; Enabled = ('SI_Guard_{0}_Enabled' -f $t); Mail = ('SI_Guard_{0}_Mail' -f $t) }
|}
|
|function Test-SIGuardDefaultOn {
|    <#
|        #448 (operator 2026-10-07: "turn off these in all env worldwide" -- "people are pissed of all these stupid blockers"):
|        a guard is ON by default unless the catalog marks it "defaultOff": true. Those guards (a report that shrank, a
|        collection of a not-complete run, the vulnerability connector after a not-complete run) neither hold, refuse nor
|        mail until an install switches them ON (SI_Guard_<Token>_Enabled = true). Unreadable catalog: on (never throws).
|    #>
|    param([Parameter(Mandatory)][string]$GuardId)
|    try {
|        $g = @((Get-SIGuardCatalog).guards | Where-Object { [string]$_.id -eq $GuardId }) | Select-Object -First 1
|        return -not ($g -and $g.PSObject.Properties['defaultOff'] -and [bool]$g.defaultOff)
|    } catch { return $true }
|}
|function Test-SIGuardOn {
|    <#
|        Is this guard on? The master switch (SI_Guards_Enabled, env SI_GUARDS_ENABLED) AND the guard's own
|        SI_Guard_<Token>_Enabled; the master defaults ON, a guard ON unless the catalog marks it "defaultOff". A guard that is
|        off says so ONCE per process per guard, in one line: "guard <id> is off (setting <name>) -- the step goes on without
|        it". That line is a WARN only when an install SWITCHED OFF a check that is on by default (or the master); a guard
|        that is off because the catalog default says so (nothing set) is INFO -- the guard relief (owner 2026-10-11) turned
|        all but two guards off by default, and 34 warnings a run would be noise. -Quiet says nothing. Never throws (on).
|    #>
|    param([Parameter(Mandatory)][string]$GuardId, [System.Collections.IDictionary]$Globals, [scriptblock]$Log, [switch]$Quiet)
|    try {
|        $n = Get-SIGuardSwitchNames -GuardId $GuardId
|        $envM = if ($Globals) { $null } else { $env:SI_GUARDS_ENABLED }
|        $master = Test-SIGuardFlag -Value (Get-SIGuardSetting -Name $n.Master -Globals $Globals) -EnvValue $envM -Default $true
|        $ownValue = Get-SIGuardSetting -Name $n.Enabled -Globals $Globals
|        $defaultOn = Test-SIGuardDefaultOn -GuardId $GuardId
|        $own = Test-SIGuardFlag -Value $ownValue -Default $defaultOn
|        if ($master -and $own) { return $true }
|        if (-not $Quiet) {
|            if ($null -eq $global:SI_GuardOffSaid) { $global:SI_GuardOffSaid = @{} }
|            if (-not $global:SI_GuardOffSaid.ContainsKey($GuardId)) {
|                $global:SI_GuardOffSaid[$GuardId] = $true
|                # the guard's own switch is set (an empty value = not set)
|                $explicit = -not ($null -eq $ownValue -or ($ownValue -isnot [bool] -and -not ([string]$ownValue).Trim().Trim('$')))
|                $line = if ((-not $master) -or $explicit) { 'guard {0} is off (setting {1}) -- the step goes on without it' -f $GuardId, $(if (-not $master) { $n.Master } else { $n.Enabled }) }
|                        else { 'guard {0} is off by default (switch it on with {1}) -- the step goes on without it' -f $GuardId, $n.Enabled }
|                # WARN only when a protection that is on by default was switched off (the master, or a default-on guard's switch).
|                # The caller's -Log failing never changes the answer: it was caught below as "on" -- a guard that is OFF read
|                # as on (the SQL CMDB run of 2026-10-22: its logger recursed until the call depth overflowed)
|                $warnLine = ((-not $master) -or ($explicit -and $defaultOn))
|                try {
|                    if ($warnLine) { if ($Log) { & $Log 'WARN' $line } else { Write-Warning $line } }
|                    elseif ($Log) { & $Log 'INFO' $line } else { Write-Verbose $line }
|                } catch { Write-Warning ('{0} (the step''s log could not take this line: {1})' -f $line, $_.Exception.Message) }
|            }
|        }
|        return $false
|    } catch { return $true }
|}
|
|function Test-SIGuardMailOn {
|    <#
|        The guard's own mail switch SI_Guard_<Token>_Mail. Not set = it follows the guard: on while the guard is on (a
|        default-off guard an install switches on mails without a second switch), off while it is off. The install-wide
|        SI_GuardMail_Enabled is separate.
|    #>
|    param([Parameter(Mandatory)][string]$GuardId, [System.Collections.IDictionary]$Globals)
|    try { Test-SIGuardFlag -Value (Get-SIGuardSetting -Name (Get-SIGuardSwitchNames -GuardId $GuardId).Mail -Globals $Globals) -Default (Test-SIGuardOn -GuardId $GuardId -Globals $Globals -Quiet) } catch { $true }
|}
|
|function Get-SIGuardOffList {
|    <# The ids of the guards that are off now (for a PURE planner that takes -GuardsOff). Each is said once (Test-SIGuardOn). #>
|    param([string[]]$GuardIds, [System.Collections.IDictionary]$Globals, [scriptblock]$Log)
|    $ids = if ($GuardIds) { $GuardIds } else { @((Get-SIGuardCatalog).guards | ForEach-Object { [string]$_.id }) }
|    @($ids | Where-Object { -not (Test-SIGuardOn -GuardId $_ -Globals $Globals -Log $Log) })
|}
|
|function Get-SIGuardCauseKey {
|    <# PURE. A short stable hash of one cause (SHA-256, first 16 hex characters), for Send-SIGuardEvent -CauseKeys. #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Text)
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $b = $sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($Text.Trim().ToLowerInvariant())) } finally { $sha.Dispose() }
|    (-join @($b | Select-Object -First 8 | ForEach-Object { $_.ToString('x2') }))
|}
|
|function Split-SIGuardAddresses {
|    <# PURE. A list, or text separated by ',' or ';' -> the addresses (something@something), trimmed, each once. #>
|    param([AllowNull()]$Value)
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($v in @($Value)) {
|        if ($null -eq $v) { continue }
|        foreach ($p in ("$v" -split '[,;]')) {
|            $t = $p.Trim()
|            if ($t -match '^[^@\s]+@[^@\s]+$' -and -not ($out -contains $t)) { $out.Add($t) }
|        }
|    }
|    # unrolled on purpose: callers wrap the call in @() (one address stays a one-element list, none an empty one)
|    $out.ToArray()
|}
|
|function Get-SIGuardMailRecipients {
|    <#
|        PURE. Who the guard mails go to: SI_GuardMail_To, else the install's report recipients (MailTo), else the Pro
|        SuperAdmins' mail addresses (-SuperAdminMails). Returns @{ To; Source }.
|    #>
|    param([System.Collections.IDictionary]$Globals, [AllowNull()][string[]]$SuperAdminMails)
|    $to = @(Split-SIGuardAddresses (Get-SIGuardSetting -Name 'SI_GuardMail_To' -Globals $Globals))
|    if ($to.Count) { return [pscustomobject]@{ To = $to; Source = 'SI_GuardMail_To' } }
|    $to = @(Split-SIGuardAddresses (Get-SIGuardSetting -Name 'MailTo' -Globals $Globals))
|    if ($to.Count) { return [pscustomobject]@{ To = $to; Source = 'MailTo' } }
|    $to = @(Split-SIGuardAddresses $SuperAdminMails)
|    if ($to.Count) { return [pscustomobject]@{ To = $to; Source = 'SuperAdmins' } }
|    [pscustomobject]@{ To = @(); Source = '' }
|}
|
|function Get-SIGuardSmtp {
|    <#
|        PURE. How SecurityInsight sends -- the ONE mail setting set every mail uses (Get-SIMailSettings, MAIL-1):
|        SI_Mail_Mode (sharedMailbox | smtp | none), SI_Mail_From, and for smtp SmtpServer, SMTPPort, SMTP_UseSSL,
|        SMTPFrom / MailFrom / SMTPUser, SMTPUser + SMTPPassword or SecureCredentialsSMTP, Mail_SendAnonymous.
|        Kept here by name so a Community install, which does not ship the Pro close-loop mail, mails its guards too.
|        Returns @{ Mode; Off; Server; Port; UseSsl; From; Anonymous; User; Password; SharedMailbox; Problems; ... }.
|    #>
|    param([System.Collections.IDictionary]$Globals)
|    Get-SIMailSettings -Globals $Globals
|}
|
|# =====================================================================================================================
|#  The event -- PURE
|# =====================================================================================================================
|function ConvertTo-SIGuardNumber {
|    <# PURE. A measured value / limit as a number ($null when it is not one). Whole numbers stay [long]. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or "$Value".Trim() -eq '') { return $null }
|    $d = 0.0
|    if (-not [double]::TryParse(("$Value".Trim() -replace '%$', ''), [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$d)) { return $null }
|    if ([double]::IsNaN($d) -or [double]::IsInfinity($d)) { return $null }
|    if ($d -eq [Math]::Floor($d) -and [Math]::Abs($d) -lt 9e15) { return [long]$d }
|    [Math]::Round($d, 4)
|}
|
|function New-SIGuardEvent {
|    <#
|        PURE. One guard event, checked against the catalog. -Values: @( @{ Name = 'closeShare'; Label = 'Share of open
|        records to close'; Measured = 25.9; Limit = 10; Unit = '%' }, ... ) -- Name is camelCase (it becomes a telemetry
|        field), Label is what a person reads. -Subject names WHICH connector / report / job (never sent anonymously).
|        -Detail is one plain sentence of what happened (never sent anonymously). -Action overrides the catalog's text.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$GuardId,
|        [Parameter(Mandatory)][string]$Outcome,
|        [string]$Engine, [string]$Job, [string]$Subject, [string]$Detail,
|        [object[]]$Values = @(), [long]$HeldCount = 0, [string]$Action, [string]$Link,
|        [string]$RunId, [datetime]$NowUtc = [datetime]::UtcNow, [string]$Source = 'job'
|    )
|    if ($GuardId -notmatch $script:SIGuard.IdPattern) { throw ("'{0}' is not a guard id (area.object.what, lower-case)" -f $GuardId) }
|    $def = Get-SIGuardDefinition -Id $GuardId
|    $sev = Get-SIGuardSeverity -Outcome $Outcome
|    if ($script:SIGuard.Sources -notcontains $Source) { throw ("'{0}' is not a guard source ({1})" -f $Source, ($script:SIGuard.Sources -join ', ')) }
|    if ($HeldCount -lt 0) { $HeldCount = 0 }
|    $vals = New-Object System.Collections.Generic.List[object]
|    foreach ($v in @($Values)) {
|        if ($null -eq $v) { continue }
|        $name = [string]$(if ($v -is [System.Collections.IDictionary]) { $v['Name'] } else { $v.Name })
|        if ($name -notmatch $script:SIGuard.NamePattern) { throw ("guard value name '{0}' must be camelCase letters and digits (it is a telemetry field)" -f $name) }
|        $get = { param($k) if ($v -is [System.Collections.IDictionary]) { $v[$k] } elseif ($v.PSObject.Properties[$k]) { $v.$k } else { $null } }
|        $label = [string](& $get 'Label'); if (-not $label) { $label = $name }
|        $vo = [pscustomobject]@{ Name = $name; Label = $label; Measured = (ConvertTo-SIGuardNumber (& $get 'Measured')); Limit = (ConvertTo-SIGuardNumber (& $get 'Limit')); Unit = [string](& $get 'Unit') }
|        # CR4 (#654): a limit halved in the stricter period after a release carries the configured one beside it
|        $cfgL = ConvertTo-SIGuardNumber (& $get 'Configured')
|        if ($null -ne $cfgL -and $null -ne $vo.Limit) { $vo | Add-Member -NotePropertyName Configured -NotePropertyValue $cfgL }
|        $vals.Add($vo)
|    }
|    $job = if ($Job) { $Job } elseif ([string]$def.job) { [string]$def.job } elseif ($Engine -and (Get-Command -Name Resolve-SITelemetryJob -ErrorAction SilentlyContinue)) { [string](Resolve-SITelemetryJob -Engine $Engine) } else { '' }
|    $sub = "$Subject".Trim(); if ($sub.Length -gt 400) { $sub = $sub.Substring(0, 400) }
|    $det = "$Detail".Trim(); if ($det.Length -gt 2000) { $det = $det.Substring(0, 2000) }
|    [pscustomobject]@{
|        GuardId   = $GuardId
|        GuardKey  = $(if ($sub) { $GuardId + '|' + $sub.ToLowerInvariant() } else { $GuardId })
|        Area      = [string]$def.area
|        Job       = $job
|        Engine    = [string]$Engine
|        Protected = [string]$def.protects
|        Subject   = $sub
|        Outcome   = $Outcome
|        Severity  = $sev
|        Values    = $vals.ToArray()
|        HeldCount = $HeldCount
|        Detail    = $det
|        Action    = $(if ($Action) { $Action } else { [string]$def.action })
|        Link      = [string]$Link
|        RunId     = $(if ($RunId) { $RunId } else { [string]$global:SI_GuardRunId })
|        Source    = $Source
|        TimeUtc   = $NowUtc.ToUniversalTime()
|    }
|}
|
|function Format-SIGuardNumber {
|    <# PURE. A number for a person: thousands grouped and decimals in -Culture (default: the install's number format, else
|       invariant). $null reads "unknown". #>
|    param([AllowNull()]$Value, [System.Globalization.CultureInfo]$Culture = [System.Globalization.CultureInfo]::InvariantCulture)
|    if ($null -eq $Value) { return 'unknown' }
|    if ($Value -is [long] -or $Value -is [int]) { return ([long]$Value).ToString('N0', $Culture) }
|    ([double]$Value).ToString('#,0.##', $Culture)
|}
|
|function Format-SIGuardValues {
|    <# PURE. "Label: 25.9 % (limit 10 %)" per value, joined by '; '. #>
|    param([object[]]$Values = @(), [System.Globalization.CultureInfo]$Culture = [System.Globalization.CultureInfo]::InvariantCulture)
|    $parts = foreach ($v in @($Values)) {
|        if ($null -eq $v) { continue }
|        $u = if ($v.Unit) { ' ' + $v.Unit } else { '' }
|        $t = '{0}: {1}{2}' -f $v.Label, (Format-SIGuardNumber $v.Measured $Culture), $(if ($null -ne $v.Measured) { $u } else { '' })
|        if ($null -ne $v.Limit) {
|            # CR4 (#654): the stricter period after a release -- the halved limit and the configured one, said calmly
|            if ($v.PSObject.Properties['Configured'] -and $null -ne $v.Configured -and $v.Configured -ne $v.Limit) {
|                $t += (' (limit {0}{2} in the stricter period after a release, normally {1}{2})' -f (Format-SIGuardNumber $v.Limit $Culture), (Format-SIGuardNumber $v.Configured $Culture), $u)
|            } else { $t += (' (limit {0}{1})' -f (Format-SIGuardNumber $v.Limit $Culture), $u) }
|        }
|        $t
|    }
|    (@($parts) -join '; ')
|}
|
|# =====================================================================================================================
|#  THE THREE PARTS (what happened / why / consequence + what to do) -- PURE, the catalog's templates filled from the event.
|#  The SAME rules as the web app (Guards\GuardText.cs): {held} {detail} {subject} {when} {latest} {v:<name>}; {x|text}
|#  uses text when x is empty; a [ ... ] part is left out when a placeholder in it is empty.
|# =====================================================================================================================
|function Format-SIGuardText {
|    <# PURE. One catalog template filled from -Fields (name -> text; an empty or missing name reads empty). #>
|    param([AllowEmptyString()][string]$Template, [hashtable]$Fields = @{})
|    if (-not $Template) { return '' }
|    $placeholder = '\{(held|detail|subject|when|latest|v:[A-Za-z0-9]+)(?:\|([^{}]*))?\}'
|    $fill = {
|        param([string]$s, [ref]$missing)
|        [regex]::Replace($s, $placeholder, {
|            param($m)
|            $v = [string]$Fields[$m.Groups[1].Value]
|            if ("$v".Trim()) { return "$v".Trim() }
|            if ($m.Groups[2].Success) { return $m.Groups[2].Value }
|            $missing.Value = $true
|            ''
|        })
|    }
|    $out = [regex]::Replace($Template, '\s?\[([^\[\]]*)\]', {
|        param($m)
|        $miss = $false
|        $inner = & $fill $m.Groups[1].Value ([ref]$miss)
|        if ($miss) { return '' }
|        $(if ($m.Value.StartsWith(' ')) { ' ' } else { '' }) + $inner
|    })
|    $none = $false
|    $out = & $fill $out ([ref]$none)
|    ConvertTo-SIGuardPlurals ([regex]::Replace($out, '\s{2,}', ' ')).Trim()
|}
|
|function ConvertTo-SIGuardPlurals {
|    <# PURE. Operator 2026-10-09 ("no (s) anywhere"): "1 job(s)" -> "1 job", "2 job(s)" -> "2 jobs", "report(s)" -> "reports"
|       -- the same rule as the web app (GuardText.Plurals), so the page and the mail say the same words. #>
|    param([AllowEmptyString()][string]$Text)
|    if (-not $Text -or $Text.IndexOf('(s)') -lt 0) { return $Text }
|    $many = { param([string]$w)
|        if ($w.Length -gt 1 -and $w.EndsWith('y') -and 'aeiou'.IndexOf([char]::ToLowerInvariant($w[$w.Length - 2])) -lt 0) { return $w.Substring(0, $w.Length - 1) + 'ies' }
|        if ($w.EndsWith('s') -or $w.EndsWith('x') -or $w.EndsWith('ch') -or $w.EndsWith('sh')) { return $w + 'es' }
|        $w + 's' }
|    $t = [regex]::Replace($Text, "(?<n>\d[\d,. ']*)\s+(?<w>[A-Za-z-]+)\(s\)", {
|        param($m)
|        $digits = (-join ($m.Groups['n'].Value.ToCharArray() | Where-Object { [char]::IsDigit($_) })).TrimStart('0')
|        $one = ($digits -eq '1') -and ($m.Groups['n'].Value.IndexOf('.') -lt 0)
|        $m.Groups['n'].Value + ' ' + $(if ($one) { $m.Groups['w'].Value } else { & $many $m.Groups['w'].Value })
|    })
|    [regex]::Replace($t, '(?<w>[A-Za-z-]+)\(s\)', { param($m) & $many $m.Groups['w'].Value })
|}
|
|function Get-SIGuardTextFields {
|    <# PURE. The placeholder values of one event: held, detail, subject, when, v:<name> (numbers in -Culture). -NoDetail
|       leaves out what never travels to Invardia (detail, subject). #>
|    param([Parameter(Mandatory)]$Event, [System.Globalization.CultureInfo]$Culture = [System.Globalization.CultureInfo]::InvariantCulture, [switch]$NoDetail)
|    $f = @{}
|    if ([long]$Event.HeldCount -gt 0) { $f['held'] = Format-SIGuardNumber ([long]$Event.HeldCount) $Culture }
|    if (-not $NoDetail) { $f['detail'] = [string]$Event.Detail; $f['subject'] = [string]$Event.Subject }
|    if ($Event.PSObject.Properties['TimeUtc'] -and $Event.TimeUtc) { $f['when'] = ('{0:yyyy-MM-dd HH:mm} UTC' -f ([datetime]$Event.TimeUtc)) }
|    foreach ($v in @($Event.Values)) { if ($v -and $null -ne $v.Measured) { $f['v:' + [string]$v.Name] = Format-SIGuardNumber $v.Measured $Culture } }
|    $f
|}
|
|function Get-SIGuardParts {
|    <#
|        PURE. The three parts a person reads -- What (what happened), Why (the cause of THIS event), Consequence (what the user
|        sees or misses) -- plus Steps (what to do) and Kind (what a release means), filled from the event. A guard listed
|        without them (an older catalog) falls back to its 'action' text as the one step.
|    #>
|    param([Parameter(Mandatory)]$Event, [System.Globalization.CultureInfo]$Culture = [System.Globalization.CultureInfo]::InvariantCulture, [switch]$NoDetail)
|    $def = Get-SIGuardDefinition -Id ([string]$Event.GuardId)
|    $get = { param([string]$n) if ($def.PSObject.Properties[$n]) { $def.$n } else { $null } }
|    $fields = Get-SIGuardTextFields -Event $Event -Culture $Culture -NoDetail:$NoDetail
|    $steps = @(@(& $get 'steps') | Where-Object { "$_".Trim() } | ForEach-Object { Format-SIGuardText -Template ([string]$_) -Fields $fields } | Where-Object { $_ })
|    if (-not $steps.Count) { $steps = @([string]$def.action) }
|    [pscustomobject]@{
|        Kind        = $(if (& $get 'kind') { [string](& $get 'kind') } else { 'info' })
|        What        = (Format-SIGuardText -Template ([string](& $get 'what')) -Fields $fields)
|        Why         = $(if ($NoDetail) { '' } else { Format-SIGuardText -Template ([string](& $get 'why')) -Fields $fields })
|        Consequence = (Format-SIGuardText -Template ([string](& $get 'consequence')) -Fields $fields)
|        IfRelease   = (Format-SIGuardText -Template ([string](& $get 'ifRelease')) -Fields $fields)
|        Steps       = $steps
|    }
|}
|
|function Format-SIGuardSteps {
|    <# PURE. Numbered steps as one line: "1. ... 2. ..." #>
|    param([string[]]$Steps = @())
|    $i = 0
|    (@($Steps | Where-Object { "$_".Trim() } | ForEach-Object { $i++; '{0}. {1}' -f $i, "$_".Trim() }) -join ' ')
|}
|
|function Get-SIGuardWhere {
|    <# PURE. WHERE a guard event happened, in plain words: the job (else the engine) and what it was about (the report,
|       connector, asset or jobs the caller named). "" only when the event names neither. #>
|    param([Parameter(Mandatory)]$Event)
|    $job = if ("$($Event.Job)".Trim()) { "$($Event.Job)".Trim() } elseif ("$($Event.Engine)".Trim()) { "$($Event.Engine)".Trim() } else { '' }
|    $sub = "$($Event.Subject)".Trim()
|    $parts = @()
|    if ($job) { $parts += ('job {0}' -f $job) }
|    if ($sub -and $sub -ine $job) { $parts += $sub }
|    ($parts -join ', ')
|}
|
|function Format-SIGuardSummary {
|    <#
|        PURE. ONE plain line a person can act on (#425: "the context is so poor that nobody knows"): WHAT happened, WHERE
|        (job and report / connector / asset), the NUMBERS (measured against the limit, how many were held) and WHAT TO DO.
|        The same words as the Guards page and the mail (the catalog's parts); used for the run log and the run-health record.
|    #>
|    param([Parameter(Mandatory)]$Event, [System.Globalization.CultureInfo]$Culture = [System.Globalization.CultureInfo]::InvariantCulture)
|    $parts = $null; try { $parts = Get-SIGuardParts -Event $Event -Culture $Culture } catch { $parts = $null }
|    $what = if ($parts -and $parts.What) { $parts.What } elseif ("$($Event.Detail)".Trim()) { "$($Event.Detail)".Trim() } else { 'SecurityInsight protected {0}.' -f $Event.Protected }
|    $out = New-Object System.Collections.Generic.List[string]
|    $out.Add(($what.TrimEnd('.') + '.'))
|    # the cause of THIS event when the catalog's sentence did not already carry it
|    if ("$($Event.Detail)".Trim() -and $what.IndexOf("$($Event.Detail)".Trim(), [StringComparison]::OrdinalIgnoreCase) -lt 0) {
|        $out.Add(('Cause: {0}' -f ("$($Event.Detail)".Trim().TrimEnd('.') + '.')))
|    }
|    $where = Get-SIGuardWhere -Event $Event
|    if ($where) { $out.Add(('Where: {0}.' -f $where)) }
|    $nums = New-Object System.Collections.Generic.List[string]
|    $vals = Format-SIGuardValues -Values @($Event.Values) -Culture $Culture
|    if ($vals) { $nums.Add($vals) }
|    if ([long]$Event.HeldCount -gt 0) { $nums.Add(('{0} held' -f (Format-SIGuardNumber ([long]$Event.HeldCount) $Culture))) }
|    if ($nums.Count) { $out.Add(('Numbers: {0}.' -f ($nums -join '; '))) }
|    # CR4 (#654): the stricter period after a release, in one calm clause
|    if ($Event.PSObject.Properties['Strict'] -and $Event.Strict) {
|        $sv = "$($Event.Strict.Version)".Trim(); $su = if (Get-Command -Name Format-SIGuardStrictUntil -ErrorAction SilentlyContinue) { Format-SIGuardStrictUntil $Event.Strict.Until } else { '' }
|        $out.Add(('Stricter period{0}{1}: the limit is halved for 24 hours after a release that changed the engine, as planned.' -f $(if ($sv) { ' after release ' + $sv } else { ' after a release' }), $(if ($su) { ' until ' + $su } else { '' })))
|    }
|    $def = $null; try { $def = Get-SIGuardDefinition -Id ([string]$Event.GuardId) } catch { }
|    $own = $def -and "$($Event.Action)".Trim() -and [string]$Event.Action -ne [string]$def.action
|    $todo = if ($parts -and @($parts.Steps).Count -and -not $own) { Format-SIGuardSteps -Steps $parts.Steps } else { "$($Event.Action)".Trim() }
|    if ($todo) { $out.Add(('What to do: {0}' -f $todo)) }
|    ConvertTo-SIGuardPlurals (($out -join ' ') -replace '\.\.', '.')
|}
|
|function Get-SIGuardTelemetryKey {
|    <# PURE. The de-duplication key Invardia's receiver uses per install: the guard id, plus a short hash of the subject when
|       there is one (the hash names no connector / report; two subjects of one guard stay two tickets). #>
|    param([Parameter(Mandatory)]$Event)
|    if (-not $Event.Subject) { return [string]$Event.GuardId }
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { $h = $sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes(([string]$Event.Subject).ToLowerInvariant())) } finally { $sha.Dispose() }
|    ('{0}#{1}' -f $Event.GuardId, (-join ($h[0..5] | ForEach-Object { $_.ToString('x2') })))
|}
|
|# =====================================================================================================================
|#  De-duplication -- PURE decision + three stores
|# =====================================================================================================================
|function ConvertTo-SIGuardUtc {
|    <# PURE. A stored time as UTC, or $null (null, DBNull, empty, not a time). A text without a zone is read AS UTC. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or $Value -is [System.DBNull] -or "$Value".Trim() -eq '') { return $null }
|    if ($Value -is [datetime]) { if ($Value.Kind -eq [DateTimeKind]::Local) { return $Value.ToUniversalTime() }; return [datetime]::SpecifyKind($Value, [DateTimeKind]::Utc) }
|    $d = [datetime]::MinValue
|    $styles = [System.Globalization.DateTimeStyles]::AssumeUniversal -bor [System.Globalization.DateTimeStyles]::AdjustToUniversal
|    if ([datetime]::TryParse("$Value", [System.Globalization.CultureInfo]::InvariantCulture, $styles, [ref]$d)) { return $d }
|    $null
|}
|
|function Get-SIGuardTenantTag {
|    <# PURE over the settings. The tenant as the mail shows it, from what the run already knows (never a network call). #>
|    param([System.Collections.IDictionary]$Globals)
|    foreach ($n in 'TenantShort', 'TenantNameOrganization', 'SI_TenantDisplayName') {
|        $v = "$(Get-SIGuardSetting -Name $n -Globals $Globals)".Trim(); if ($v) { return $v }
|    }
|    ''
|}
|
|function Get-SIGuardTripState {
|    <#
|        PURE. The trip's place in its episode. -Previous: @{ FirstSeenUtc; LastSeenUtc; TripCount; LastMailUtc } or $null.
|        A trip more than -WindowHours after the last one starts a NEW episode (count 1, mail). Within the window the count
|        goes up; a mail goes out only when the last mail is at least -WindowHours old ("still tripping, N times").
|        -MailEnabled $false never mails and keeps LastMailUtc. Returns @{ FirstSeenUtc; LastSeenUtc; TripCount; LastMailUtc;
|        Mail; StillTripping }.
|    #>
|    param([AllowNull()]$Previous, [Parameter(Mandatory)][datetime]$NowUtc, [int]$WindowHours = 24, [bool]$MailEnabled = $true)
|    $now = $NowUtc.ToUniversalTime()
|    $t = { param($v) ConvertTo-SIGuardUtc $v }
|    $prevLast = $null; $prevFirst = $null; $prevMail = $null; $prevCount = 0
|    if ($Previous) {
|        $prevLast = & $t $Previous.LastSeenUtc; $prevFirst = & $t $Previous.FirstSeenUtc; $prevMail = & $t $Previous.LastMailUtc
|        $n = 0; if ([int]::TryParse("$($Previous.TripCount)", [ref]$n)) { $prevCount = $n }
|    }
|    # a guard that CLEARED (a later complete run was back at the normal level, or it was accepted) starts a new episode
|    $prevCleared = $null
|    if ($Previous -and $Previous.PSObject.Properties['ClearedUtc']) { $prevCleared = & $t $Previous.ClearedUtc }
|    elseif ($Previous -is [System.Collections.IDictionary] -and $Previous.Contains('ClearedUtc')) { $prevCleared = & $t $Previous['ClearedUtc'] }
|    $newEpisode = ($null -eq $prevLast) -or (($now - $prevLast).TotalHours -gt $WindowHours) -or ($prevCleared -and $prevCleared -ge $prevLast)
|    if ($newEpisode) {
|        $mail = [bool]$MailEnabled
|        return [pscustomobject]@{ FirstSeenUtc = $now; LastSeenUtc = $now; TripCount = 1; LastMailUtc = $(if ($mail) { $now } else { $null }); Mail = $mail; StillTripping = $false }
|    }
|    $count = $prevCount + 1
|    $first = if ($prevFirst) { $prevFirst } else { $prevLast }
|    $mail = [bool]$MailEnabled -and (($null -eq $prevMail) -or (($now - $prevMail).TotalHours -ge $WindowHours))
|    [pscustomobject]@{ FirstSeenUtc = $first; LastSeenUtc = $now; TripCount = $count; LastMailUtc = $(if ($mail) { $now } else { $prevMail }); Mail = $mail; StillTripping = $true }
|}
|
|function New-SIGuardMemoryStateStore {
|    <# A state store in memory (tests; a container without a disk or a database). #>
|    $h = @{}
|    [pscustomobject]@{
|        Kind = 'memory'
|        Get  = { param([string]$Key) if ($h.ContainsKey($Key)) { $h[$Key] } else { $null } }.GetNewClosure()
|        # every field of the state is kept (the episode's four, and the version / clear fields of SI-GuardHeal.ps1)
|        Set  = { param([string]$Key, [string]$GuardId, $State)
|                 $o = [ordered]@{ FirstSeenUtc = $State.FirstSeenUtc; LastSeenUtc = $State.LastSeenUtc; TripCount = $State.TripCount; LastMailUtc = $State.LastMailUtc }
|                 if ($State -is [System.Collections.IDictionary]) { foreach ($k in @($State.Keys)) { if (-not $o.Contains([string]$k)) { $o[[string]$k] = $State[$k] } } }
|                 else { foreach ($p in @($State.PSObject.Properties)) { if (-not $o.Contains($p.Name) -and $p.Name -notin 'Mail', 'StillTripping') { $o[$p.Name] = $p.Value } } }
|                 $h[$Key] = [pscustomobject]$o }.GetNewClosure()
|    }
|}
|
|function Get-SIGuardStateDirectory {
|    <# SI_GUARD_STATE_DIR, else %ProgramData%\SecurityInsight\guards on Windows, else ~/.securityinsight/guards. #>
|    $d = [string]$env:SI_GUARD_STATE_DIR
|    if ($d.Trim()) { return $d.Trim() }
|    if ([Environment]::OSVersion.Platform -eq [PlatformID]::Win32NT) {
|        return [System.IO.Path]::Combine([Environment]::GetFolderPath('CommonApplicationData'), 'SecurityInsight', 'guards')
|    }
|    $h = [Environment]::GetFolderPath('UserProfile'); if (-not $h) { $h = [System.IO.Path]::GetTempPath() }
|    [System.IO.Path]::Combine($h, '.securityinsight', 'guards')
|}
|
|function New-SIGuardFileStateStore {
|    <# A state store in one JSON file (<dir>\guard-state.json): guard key -> state. A file that cannot be read starts empty. #>
|    param([Parameter(Mandatory)][string]$Directory)
|    $file = [System.IO.Path]::Combine($Directory, 'guard-state.json')
|    # a closure (GetNewClosure) cannot see script-scope functions: the one it needs is captured
|    $toUtc = ${function:ConvertTo-SIGuardUtc}
|    $read = {
|        $m = @{}
|        try {
|            if ([System.IO.File]::Exists($file)) {
|                $o = ConvertFrom-Json -InputObject ([System.IO.File]::ReadAllText($file))
|                foreach ($p in @($o.PSObject.Properties)) { $m[$p.Name] = $p.Value }
|            }
|        } catch { }
|        $m
|    }.GetNewClosure()
|    [pscustomobject]@{
|        Kind = 'file'
|        Path = $file
|        Get  = { param([string]$Key) $m = & $read; if ($m.ContainsKey($Key)) { $m[$Key] } else { $null } }.GetNewClosure()
|        Set  = {
|            param([string]$Key, [string]$GuardId, $State)
|            $m = & $read
|            $iso = { param($v) $u = & $toUtc $v; if ($null -eq $u) { $null } else { $u.ToString('o', [System.Globalization.CultureInfo]::InvariantCulture) } }
|            $m[$Key] = [ordered]@{ GuardId = $GuardId; FirstSeenUtc = (& $iso $State.FirstSeenUtc); LastSeenUtc = (& $iso $State.LastSeenUtc); TripCount = [int]$State.TripCount; LastMailUtc = (& $iso $State.LastMailUtc) }
|            # the version / clear fields (SI-GuardHeal.ps1), when the state carries them
|            foreach ($xn in 'Version', 'PreviousVersion', 'FirstRunId', 'MarkerKind', 'ClearedRunId', 'ClearedVersion', 'ClearedHow') {
|                $xv = if ($State -is [System.Collections.IDictionary]) { $State[$xn] } elseif ($State.PSObject.Properties[$xn]) { $State.$xn } else { $null }
|                if ($null -ne $xv -and "$xv" -ne '') { $m[$Key][$xn] = [string]$xv }
|            }
|            $xc = if ($State -is [System.Collections.IDictionary]) { $State['ClearedUtc'] } elseif ($State.PSObject.Properties['ClearedUtc']) { $State.ClearedUtc } else { $null }
|            if ($null -ne $xc -and "$xc" -ne '') { $m[$Key]['ClearedUtc'] = (& $iso $xc) }
|            # keep the file small: episodes older than 30 days are dropped
|            $keep = [ordered]@{}
|            foreach ($k in @($m.Keys | Sort-Object)) {
|                $ls = $m[$k].LastSeenUtc
|                $age = 0; try { $age = ([datetime]::UtcNow - ([datetime]$ls).ToUniversalTime()).TotalDays } catch { $age = 0 }
|                if ($age -le 30) { $keep[$k] = $m[$k] }
|            }
|            $null = [System.IO.Directory]::CreateDirectory([System.IO.Path]::GetDirectoryName($file))
|            [System.IO.File]::WriteAllText($file, (ConvertTo-Json -InputObject $keep -Depth 4))
|        }.GetNewClosure()
|    }
|}
|
|function Get-SIGuardSql {
|    <# The guard statements against the Pro database (sql\si-pro-settings.sql: cfg.GuardEvent, cfg.GuardState). #>
|    param([Parameter(Mandatory)][ValidateSet('Exists', 'StateGet', 'StateSet', 'Insert', 'SuperAdmins', 'OutboxRead', 'OutboxMark')][string]$Name)
|    switch ($Name) {
|        'Exists' { "SELECT CASE WHEN OBJECT_ID(N'cfg.GuardEvent') IS NOT NULL AND OBJECT_ID(N'cfg.GuardState') IS NOT NULL THEN 1 ELSE 0 END AS HasGuards;" }
|        # every column: the episode's four, and the version / clear columns where the database has them (SI-GuardHeal.ps1)
|        'StateGet' { "SELECT TOP (1) * FROM cfg.GuardState WHERE GuardKey = @GuardKey;" }
|        'StateSet' { @'
|MERGE cfg.GuardState WITH (HOLDLOCK) AS t
|USING (SELECT @GuardKey AS GuardKey) AS s ON t.GuardKey = s.GuardKey
|WHEN MATCHED THEN UPDATE SET GuardId = @GuardId, FirstSeenUtc = @FirstSeenUtc, LastSeenUtc = @LastSeenUtc, TripCount = @TripCount, LastMailUtc = @LastMailUtc
|WHEN NOT MATCHED THEN INSERT (GuardKey, GuardId, FirstSeenUtc, LastSeenUtc, TripCount, LastMailUtc)
|     VALUES (@GuardKey, @GuardId, @FirstSeenUtc, @LastSeenUtc, @TripCount, @LastMailUtc);
|'@ }
|        'Insert' { @'
|INSERT cfg.GuardEvent (GuardId, GuardKey, Area, Job, Engine, Source, Outcome, Severity, Protected, Subject, Detail, MeasuredText, ValuesJson,
|                       HeldCount, ActionText, Link, RunId, TripCount, FirstSeenUtc, MailState, MailTo, TelemetryState)
|VALUES (@GuardId, @GuardKey, @Area, @Job, @Engine, @Source, @Outcome, @Severity, @Protected, @Subject, @Detail, @MeasuredText, @ValuesJson,
|        @HeldCount, @ActionText, @Link, @RunId, @TripCount, @FirstSeenUtc, @MailState, @MailTo, @TelemetryState);
|SELECT CAST(SCOPE_IDENTITY() AS BIGINT) AS Id;
|'@ }
|        'SuperAdmins' { "IF OBJECT_ID(N'cfg.AccessAssignment') IS NULL SELECT CAST(NULL AS NVARCHAR(256)) AS Mail WHERE 1 = 0; ELSE SELECT DisplayName AS Mail FROM cfg.AccessAssignment WHERE Role = N'SuperAdmin' AND PrincipalType = N'User' AND DisplayName LIKE N'%_@_%';" }
|        'OutboxRead' { "SELECT TOP (50) Id, TsUtc, GuardId, GuardKey, Area, Job, Engine, Source, Outcome, Severity, Subject, Detail, ValuesJson, HeldCount, ActionText, Link, RunId, MailState, TelemetryState FROM cfg.GuardEvent WHERE MailState = N'pending' OR TelemetryState = N'pending' ORDER BY Id;" }
|        'OutboxMark' { "UPDATE cfg.GuardEvent SET MailState = @MailState, MailTo = COALESCE(@MailTo, MailTo), TelemetryState = @TelemetryState, TripCount = COALESCE(@TripCount, TripCount), FirstSeenUtc = COALESCE(@FirstSeenUtc, FirstSeenUtc) WHERE Id = @Id;" }
|    }
|}
|
|function New-SIGuardSqlStateStore {
|    <# A state store in the Pro database (cfg.GuardState), over the (sql, params, mode) seam every Pro engine has. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke)
|    $inv = $Invoke
|    $getSql = Get-SIGuardSql 'StateGet'; $setSql = Get-SIGuardSql 'StateSet'   # captured: a closure cannot see script-scope functions
|    # the version / clear fields of SI-GuardHeal.ps1, written only where the database has their columns
|    $extraSql = if (Get-Command -Name Get-SIGuardHealSql -ErrorAction SilentlyContinue) { Get-SIGuardHealSql 'StateExtra' } else { '' }
|    [pscustomobject]@{
|        Kind = 'sql'
|        Get  = { param([string]$Key) $rows = @(& $inv $getSql @{ GuardKey = $Key } 'reader'); if ($rows.Count -and $rows[0]) { $rows[0] } else { $null } }.GetNewClosure()
|        Set  = { param([string]$Key, [string]$GuardId, $State)
|                 $null = & $inv $setSql @{ GuardKey = $Key; GuardId = $GuardId; FirstSeenUtc = $State.FirstSeenUtc; LastSeenUtc = $State.LastSeenUtc; TripCount = [int]$State.TripCount; LastMailUtc = $State.LastMailUtc } 'nonquery'
|                 if ($extraSql) {
|                     $x = @{ GuardKey = $Key }
|                     foreach ($n in 'Version', 'PreviousVersion', 'FirstRunId', 'MarkerKind', 'ClearedUtc', 'ClearedRunId', 'ClearedVersion', 'ClearedHow') {
|                         $v = if ($State -is [System.Collections.IDictionary]) { $State[$n] } elseif ($State.PSObject.Properties[$n]) { $State.$n } else { $null }
|                         if ($v -is [string]) { $v = $v.Trim(); if ($v.Length -gt 64) { $v = $v.Substring(0, 64) }; if (-not $v) { $v = $null } }
|                         $x[$n] = $v
|                     }
|                     $null = & $inv $extraSql $x 'nonquery'
|                 } }.GetNewClosure()
|    }
|}
|
|# =====================================================================================================================
|#  The mail -- PURE
|# =====================================================================================================================
|# owner 2026-10-11 ("dont stop my business with unnecessary guards"; a warn-only check mailed "action needed"): a check that
|# only WARNS (it held, stopped or refused nothing) sends no mail -- it is recorded, shown on the Guards page and in the run
|# report. A mail means something was stopped or held. The one exception: the licence grace period, which needs a renewal.
|# #937 (owner 2026-10-28, "Stop the mail"): a check whose catalog entry says "mail": "never" sends no mail whatever its
|# outcome -- collection.source.asset-drop accepts a real drop by itself on the next complete collection, so its mail asked
|# nothing of anyone. Its event, the Guards page, the run report and the report to Invardia are unchanged.
|$script:SIGuardWarningMails = @('licence.state.grace')
|function Test-SIGuardNeverMails {
|    <# PURE over the catalog. Does the guard's catalog entry say "mail": "never"? Unknown id / unreadable catalog: $false. #>
|    param([AllowNull()][AllowEmptyString()][string]$GuardId)
|    if (-not "$GuardId".Trim()) { return $false }
|    try {
|        $g = @((Get-SIGuardCatalog).guards | Where-Object { [string]$_.id -eq $GuardId }) | Select-Object -First 1
|        return [bool]($g -and $g.PSObject.Properties['mail'] -and ([string]$g.mail -ieq 'never'))
|    } catch { return $false }
|}
|function Test-SIGuardOutcomeMails {
|    <# PURE. Whether this event's outcome sends a mail at all: every outcome but 'warning' (and the listed exceptions);
|       never for a guard the catalog marks "mail": "never". #>
|    param([Parameter(Mandatory)]$Event)
|    if (Test-SIGuardNeverMails -GuardId ([string]$Event.GuardId)) { return $false }
|    ([string]$Event.Outcome -ine 'warning') -or ($script:SIGuardWarningMails -contains [string]$Event.GuardId)
|}
|
|function ConvertTo-SIGuardTextHtml {
|    <#
|        PURE. One guard text as HTML a person can read: a run of 4 or more items joined by '; ' (a list of columns, reports,
|        jobs) becomes an intro line and a bullet list of at most 10 items ("and N more"), never one run-on paragraph.
|    #>
|    param([AllowEmptyString()][string]$Text, [int]$MaxItems = 10)
|    $enc = { param($s) if (Get-Command -Name ConvertTo-SIMailInlineHtml -ErrorAction SilentlyContinue) { ConvertTo-SIMailInlineHtml $s } else { [System.Net.WebUtility]::HtmlEncode([string]$s) } }
|    $t = [string]$Text
|    $segs = @($t -split ';\s+')
|    if ($segs.Count -lt 4) { return (& $enc $t) }
|    # the intro is what stands before the list: the text up to the last ': ' of the first segment
|    $first = $segs[0]; $intro = ''
|    $cut = $first.LastIndexOf(': ')
|    if ($cut -gt 0) { $intro = $first.Substring(0, $cut + 1); $segs[0] = $first.Substring($cut + 2) }
|    $items = @($segs | ForEach-Object { $_.Trim().TrimEnd('.') } | Where-Object { $_ })
|    $shown = @($items | Select-Object -First $MaxItems)
|    $li = @($shown | ForEach-Object { '<li style="margin:0 0 2px 0;">' + (& $enc $_) + '</li>' }) -join ''
|    if ($items.Count -gt $shown.Count) { $li += '<li style="margin:0 0 2px 0;color:#59636e;">' + (& $enc ('and {0} more' -f ($items.Count - $shown.Count))) + '</li>' }
|    (& $enc $intro) + '<ul style="margin:4px 0 0 18px;padding:0;">' + $li + '</ul>'
|}
|
|function Get-SIGuardCulture {
|    <# The install's number format for mails: SIWeb_NumberFormatDefault when it names a culture, else invariant. #>
|    param([System.Collections.IDictionary]$Globals)
|    $c = "$(Get-SIGuardSetting -Name 'SIWeb_NumberFormatDefault' -Globals $Globals)".Trim()
|    if ($c -and $c -ne 'auto') { try { return [System.Globalization.CultureInfo]::GetCultureInfo($c) } catch { } }
|    [System.Globalization.CultureInfo]::InvariantCulture
|}
|
|function Get-SIGuardMailSeverity {
|    <#
|        PURE. The guard mail's severity word (MAIL-3, #653): 'Failed' for a guard that reports a failed step or update
|        (an id ending in failed / interrupted), 'Warning' for an outcome 'warning' (recorded and shown, nothing held),
|        'Action needed' for every trip that stopped, refused, held or skipped something -- a person decides what happens next.
|    #>
|    param([Parameter(Mandatory)]$Event)
|    if ([string]$Event.GuardId -match '(?i)[.-](failed|interrupted)$') { return 'Failed' }
|    if ([string]$Event.Outcome -ieq 'warning') { return 'Warning' }
|    'Action needed'
|}
|
|function ConvertTo-SIGuardMail {
|    <#
|        PURE. The guard mail: subject "<severity word>: <what was protected>" (+ "still tripping, N times"),
|        and a body with what happened, the numbers against the limit, what was held (nothing lost), what to do and the link.
|        Returns @{ Subject; Html; Text }.
|    #>
|    param([Parameter(Mandatory)]$Event, [Parameter(Mandatory)]$Trip, [string]$TenantTag, [System.Globalization.CultureInfo]$Culture = [System.Globalization.CultureInfo]::InvariantCulture)
|    $e = { param($s) [System.Net.WebUtility]::HtmlEncode([string]$s) }
|    # MAIL-2 / #573: free text keeps its line breaks (encoded, a <br> per break) -- never collapsed into one run-on line
|    $tx = { param($s) if (Get-Command -Name ConvertTo-SIMailInlineHtml -ErrorAction SilentlyContinue) { ConvertTo-SIMailInlineHtml $s } else { [System.Net.WebUtility]::HtmlEncode([string]$s) } }
|    $what = ([string]$Event.Protected)
|    # MAIL-3 (#653): '<severity word>: <what was protected>' -- the transport adds '[<environment>]' and '[SecurityInsight]'
|    $subject = '{0}: {1}' -f (Get-SIGuardMailSeverity -Event $Event), $(if ($what) { $what.Substring(0, 1).ToUpperInvariant() + $what.Substring(1) } else { 'Your data' })
|    if ($Trip.StillTripping) { $subject += (' (still tripping, {0} times since {1:yyyy-MM-dd HH:mm} UTC)' -f $Trip.TripCount, ([datetime]$Trip.FirstSeenUtc)) }
|    if ($TenantTag) { $subject += (' | {0}' -f $TenantTag) }
|    $verb = switch ([string]$Event.Outcome) {
|        'halted'  { 'SecurityInsight stopped a step to protect {0}.' }
|        'refused' { 'SecurityInsight refused a step to protect {0}.' }
|        'held'    { 'SecurityInsight held back part of a step to protect {0}.' }
|        'skipped' { 'SecurityInsight skipped a step to protect {0}.' }
|        default   { 'SecurityInsight needs your attention to protect {0}.' }
|    }
|    $lead = $verb -f $what
|    # #728 (no tables in mails): the numbers are "Topic: text" lines, one per measured value -- the label in bold, the
|    # value, and the limit in brackets only when the value has one: "Rows: 1,060,000 (limit 2,000,000)"
|    $rows = foreach ($v in @($Event.Values)) {
|        $u = if ($v.Unit) { ' ' + $v.Unit } else { '' }
|        $val = (Format-SIGuardNumber $v.Measured $Culture) + $(if ($null -ne $v.Measured) { $u } else { '' })
|        $lim = if ($null -ne $v.Limit) { 'limit ' + (Format-SIGuardNumber $v.Limit $Culture) + $u + $(if ($v.PSObject.Properties['Configured'] -and $null -ne $v.Configured -and $v.Configured -ne $v.Limit) { ', normally {0}{1}' -f (Format-SIGuardNumber $v.Configured $Culture), $u } else { '' }) } else { '' }
|        '<p style="margin:0 0 8px 0;line-height:1.5;"><strong>{0}:</strong> {1}{2}</p>' -f (& $e $v.Label), (& $e $val), $(if ($lim) { ' (' + (& $e $lim) + ')' } else { '' })
|    }
|    # CR4 (#654): a trip in the stricter period after a release says so calmly -- expected, temporary, with the numbers
|    $strictText = if ($Event.PSObject.Properties['Strict'] -and $Event.Strict -and (Get-Command -Name Format-SIGuardStrictSentence -ErrorAction SilentlyContinue)) { Format-SIGuardStrictSentence -Strict $Event.Strict } else { '' }
|    $table = if (@($rows).Count) { '<div data-guard-values style="margin:0 0 12px 0;font-size:14px;">' + (@($rows) -join '') + '</div>' } else { '' }
|    $held = if ($Event.HeldCount -gt 0) { ('{0} item(s) were held back. Nothing was lost: they stay as they were and are processed again on the next good run.' -f (Format-SIGuardNumber ([long]$Event.HeldCount) $Culture)) }
|            else { 'Nothing was changed by this step, so nothing was lost.' }
|    $tripLine = if ($Trip.StillTripping) { ('This has happened {0} times since {1:yyyy-MM-dd HH:mm} UTC; you get at most one mail a day about it.' -f $Trip.TripCount, ([datetime]$Trip.FirstSeenUtc)) } else { '' }
|    $font = 'font-family:Segoe UI,Arial,sans-serif;'
|    $p = { param($s) '<p style="margin:0 0 12px 0;">' + $s + '</p>' }
|    $sb = New-Object System.Text.StringBuilder
|    [void]$sb.Append('<html><body style="margin:0;padding:0;background:#f4f6f8;"><div style="' + $font + 'max-width:720px;margin:0 auto;background:#ffffff;border:1px solid #d0d7de;">')
|    [void]$sb.Append('<div style="background:' + $(if ($Event.Severity -eq 'critical') { '#b42318' } else { '#9a6700' }) + ';color:#ffffff;padding:14px 22px;font-size:18px;"><strong>SecurityInsight</strong> &middot; action needed</div>')
|    [void]$sb.Append('<div style="padding:18px 22px;font-size:14px;color:#1f2328;">')
|    # #728: a summary block first -- what happened, what was held, whether the reader must act (not marked
|    # data-mail-summary: the guard mail carries no portal link line, as before)
|    $sumLines = @('<strong>' + (& $e $lead) + '</strong>')
|    if ($Event.HeldCount -gt 0) { $sumLines += (& $e ('{0} item(s) held back; nothing was lost.' -f (Format-SIGuardNumber ([long]$Event.HeldCount) $Culture))) }
|    $sumLines += ('<strong>' + (& $e (Get-SIGuardMailSeverity -Event $Event)) + ':</strong> see What to do below.')
|    [void]$sb.Append('<div data-guard-summary style="background:#EEF3FE;border-left:4px solid #1B4FE4;border-radius:4px;padding:12px 16px;margin:0 0 18px 0;font-size:15px;line-height:1.55;color:#0B1633;"><p style="margin:0;">' + ($sumLines -join '<br>') + '</p></div>')
|    # owner 2026-10-11 ("nobody understand what to do and the consequence"): three blocks in this order -- what happened (and
|    # its cause), what it means for you, what to do -- each a heading over its text; a list is a bullet list; a part that
|    # does not apply (nothing held, no release possible) is left out
|    $h = { param($s) '<p style="margin:16px 0 4px 0;font-size:15px;"><strong>' + $s + '</strong></p>' }
|    $parts = $null; try { $parts = Get-SIGuardParts -Event $Event -Culture $Culture } catch { $parts = $null }
|    $releasable = $parts -and $parts.IfRelease -and ([string]$parts.IfRelease -notmatch '^This check cannot be released')
|    [void]$sb.Append((& $h 'What happened'))
|    if ($parts -and $parts.What) {
|        [void]$sb.Append((& $p (& $tx $parts.What)))
|        if ($parts.Why) { [void]$sb.Append('<div style="margin:0 0 12px 0;">' + (ConvertTo-SIGuardTextHtml -Text $parts.Why) + '</div>') }
|    } elseif ($Event.Detail) { [void]$sb.Append('<div style="margin:0 0 12px 0;">' + (ConvertTo-SIGuardTextHtml -Text $Event.Detail) + '</div>') }
|    if ($table) { [void]$sb.Append($table) }
|    if ($strictText) { [void]$sb.Append((& $p (& $tx $strictText))) }
|    # owner 2026-10-17: which release it tripped on, so "our update" is told from "your source changed"
|    $attrText = if ($Event.PSObject.Properties['Attribution'] -and [string]$Event.Attribution) { [string]$Event.Attribution } else { '' }
|    if ($attrText) { [void]$sb.Append((& $p (& $tx $attrText))) }
|    [void]$sb.Append((& $h 'What it means for you'))
|    if ($parts -and $parts.Consequence) { [void]$sb.Append((& $p (& $tx $parts.Consequence))) }
|    if ($Event.HeldCount -gt 0) { [void]$sb.Append((& $p (& $tx $held))) }
|    elseif (-not ($parts -and $parts.Consequence)) { [void]$sb.Append((& $p (& $tx $held))) }
|    [void]$sb.Append((& $h 'What to do'))
|    # an explicit -Action (the caller's own words) wins over the catalog's steps
|    $def = $null; try { $def = Get-SIGuardDefinition -Id ([string]$Event.GuardId) } catch { }
|    $own = $def -and [string]$Event.Action -and [string]$Event.Action -ne [string]$def.action
|    if ($parts -and @($parts.Steps).Count -and -not $own) {
|        $li = @($parts.Steps | ForEach-Object { '<li style="margin:0 0 4px 0;">' + (& $e $_) + '</li>' }) -join ''
|        [void]$sb.Append('<ol style="margin:0 0 12px 18px;padding:0;">' + $li + '</ol>')
|    } else { [void]$sb.Append((& $p (& $tx $Event.Action))) }
|    if ($releasable) { [void]$sb.Append((& $p ('<strong>If you release it:</strong> ' + (& $tx $parts.IfRelease)))) }
|    if ($tripLine) { [void]$sb.Append((& $p (& $tx $tripLine))) }
|    if ($Event.Link) { [void]$sb.Append((& $p ('<a href="' + (& $e $Event.Link) + '" style="color:#0969da;">Open it in SecurityInsight</a>'))) }
|    # #425: where = the job (else the engine) and what it was about -- in the footer with the time and the reference
|    $whereText = Get-SIGuardWhere -Event $Event
|    [void]$sb.Append('<p style="margin:20px 0 0 0;padding-top:10px;border-top:1px solid #d0d7de;font-size:12px;color:#59636e;">' + (& $e ('{0:yyyy-MM-dd HH:mm} UTC{1}{2} - reference {3}' -f ([datetime]$Event.TimeUtc), $(if ($whereText) { ' - ' + $whereText } else { '' }), $(if ($TenantTag) { ' - ' + $TenantTag } else { '' }), $Event.GuardId)) +
|        '. To turn this check or its mail off, or to tune its limits: Settings &gt; Guards (safety checks).</p>')
|    [void]$sb.Append('</div></div></body></html>')
|    $todo = if ($parts -and @($parts.Steps).Count -and -not $own) { 'What to do: ' + (Format-SIGuardSteps -Steps $parts.Steps) } else { $Event.Action }
|    $three = if ($parts -and $parts.What) { @(('What happened: ' + $parts.What), $(if ($parts.Why) { 'Cause: ' + $parts.Why }), $(if ($parts.Consequence) { 'What it means for you: ' + $parts.Consequence })) } else { @([string]$Event.Detail) }
|    $heldText = if ($Event.HeldCount -gt 0 -or -not ($parts -and $parts.Consequence)) { $held } else { '' }
|    $releaseText = if ($releasable) { 'If you release it: ' + $parts.IfRelease } else { '' }
|    $text = @(@($lead) + $three + @((Format-SIGuardValues -Values $Event.Values -Culture $Culture), $strictText, $attrText, $heldText, $todo, $releaseText, $tripLine, [string]$Event.Link)) | Where-Object { "$_".Trim() }
|    [pscustomobject]@{ Subject = $subject; Html = $sb.ToString(); Text = (@($text) -join "`r`n`r`n") }   # MAIL-2: CRLF, a blank line between paragraphs
|}
|
|# =====================================================================================================================
|#  Telemetry -- PURE builder of the GUARD-1 record (Invardia's receiver: Schema 2, Kind 'guard')
|# =====================================================================================================================
|$script:SIGuardWire = @{
|    GuardIdPattern  = '^[a-z0-9][a-z0-9.-]{0,99}$'
|    KeyPattern      = '^[a-z][A-Za-z0-9]{0,30}$'
|    Outcomes        = @('halted', 'refused', 'held', 'skipped', 'warning')   # 'warning': GUARD-1.3 (recorded and shown, no ticket, no release-health alert)
|    Severities      = @('critical', 'warning')
|    MaxValues       = 10
|    ActionTextMax   = 500
|    # every field the record may carry; anything else would land in the receiver's Detail
|    Fields          = @('Schema', 'Kind', 'Product', 'Version', 'Ring', 'Edition', 'Hosting', 'RuntimeIdentity', 'LicenceState', 'Job', 'GuardId', 'GuardOutcome',
|                        'Severity', 'Area', 'Measured', 'Thresholds', 'HeldCount', 'TripCount', 'FirstSeenUtc', 'InstallId', 'ClaimedTenantId', 'Host',
|                        'ActionText', 'Link', 'LastSeenUtc',
|                        # CR4 (#654, Invardia 1.0.445): a trip in the stricter period after a release; the identified guard mode
|                        'Strict', 'ConfiguredLimit', 'EffectiveLimit', 'GuardMode',
|                        # owner 2026-10-17 (Invardia DESIGN "A guard report that says cleared"): GuardOutcome 'cleared'
|                        'ClearedBy', 'ClearedUtc')
|    IdentifiedOnly  = @('ClaimedTenantId', 'Host', 'ActionText', 'Link')
|}
|
|function Resolve-SIGuardHealOutcomesSwitch {
|    <#
|        PURE. Do the guard-heal reports go to Invardia from this install? (Invardia 2026-10-17: its guard receiver takes only
|        halted / refused / held / skipped / warning so far.) Switch SI_Uplink_SendGuardHealOutcomes (job variable
|        SI_UPLINK_SENDGUARDHEALOUTCOMES), read like the other SI_Uplink_Send* switches: -Value (the setting) wins, then
|        -EnvValue; on / true / yes = on; off / false / no = off; a ring list ("0", "0,1", "ring 1") = on for those rings;
|        anything else = auto = the rings in -ConfirmedRings -- every ring since Invardia 1.0.512 (2026-10-17: its receiver takes
|        'cleared' passed / released, 'taken', SiVersion / PreviousVersion / Attribution, "held (accepted range)"), so ON by default.
|        OFF: no 'cleared' report is sent (Send-SIGuardClear, the outbox's clears: TelemetryState 'off', so a later switch-on
|        never sends them in a burst) and a trip report keeps its earlier shape (no "held (accepted range)" words). Everything
|        local -- the heal, the Guards page, run health, mail, audit -- is the same either way. Returns @{ On; Setting; Reason }.
|        REMOVE-ME: once Invardia's receiver takes 'cleared' (ClearedBy / ClearedUtc), confirm the rings, then drop the switch.
|    #>
|    param([AllowNull()]$Value = $global:SI_Uplink_SendGuardHealOutcomes, [AllowNull()][AllowEmptyString()][string]$EnvValue = $env:SI_UPLINK_SENDGUARDHEALOUTCOMES,
|          [AllowNull()]$Ring, [int[]]$ConfirmedRings = @(0, 1, 2, 3), [System.Collections.IDictionary]$Globals)
|    if ($Globals -and -not $PSBoundParameters.ContainsKey('Value')) { $Value = Get-SIGuardSetting -Name 'SI_Uplink_SendGuardHealOutcomes' -Globals $Globals }
|    $name = 'SI_Uplink_SendGuardHealOutcomes'
|    if (Get-Command -Name Resolve-SIUplinkFieldSwitch -ErrorAction SilentlyContinue) {
|        return (Resolve-SIUplinkFieldSwitch -Name $name -Value $Value -EnvValue $EnvValue -Ring $Ring -ConfirmedRings $ConfirmedRings)
|    }
|    # the same rules as Resolve-SIUplinkFieldSwitch (SI-HeartbeatJob.ps1), for a process that has not loaded it
|    $rn = -1
|    if ($null -ne $Ring -and "$Ring".Trim() -ne '') { if (-not [int]::TryParse("$Ring", [ref]$rn)) { $rn = -1 } }
|    $set = ''
|    foreach ($v in @($Value, $EnvValue)) {
|        if ($null -eq $v) { continue }
|        if ($v -is [bool]) { $set = $(if ($v) { 'on' } else { 'off' }); break }
|        $s = ([string]$v).Trim().Trim('$').ToLowerInvariant()
|        if (-not $s) { continue }
|        $set = $s; break
|    }
|    if ($set -in @('on', 'true', 'yes', 'enabled')) { return [pscustomobject]@{ On = $true; Setting = 'on'; Reason = "$name is on" } }
|    if ($set -in @('off', 'false', 'no', 'disabled')) { return [pscustomobject]@{ On = $false; Setting = 'off'; Reason = "$name is off" } }
|    if ($set -match '^(ring\s*)?[0-3](\s*[,;]\s*(ring\s*)?[0-3])*$') {
|        $rings = @([regex]::Matches($set, '[0-3]') | ForEach-Object { [int]$_.Value })
|        return [pscustomobject]@{ On = ($rn -ge 0 -and $rings -contains $rn); Setting = $set; Reason = "$name is on for ring(s) $($rings -join ', ')" }
|    }
|    [pscustomobject]@{ On = ($rn -ge 0 -and @($ConfirmedRings) -contains $rn); Setting = 'auto'; Reason = "$name is auto (confirmed rings: $(if (@($ConfirmedRings).Count) { @($ConfirmedRings) -join ', ' } else { 'none' }))" }
|}
|
|function ConvertTo-SIGuardWireOutcome {
|    <# PURE. The receiver's GuardOutcome (halted | refused | held | skipped | warning -- GUARD-1.3). A trip that HELD
|       NOTHING -- SI's own 'warning' (a licence in grace, a report that lost findings), or a 'held' with no held count --
|       travels as 'warning': recorded and shown, no ticket, no release-health alert. 'held' is kept for a trip that
|       really held something (HeldCount > 0). #>
|    param([Parameter(Mandatory)][string]$Outcome, [long]$HeldCount = 0)
|    if ($Outcome -eq 'held' -and $HeldCount -le 0) { return 'warning' }
|    if ($script:SIGuardWire.Outcomes -contains $Outcome) { return $Outcome }
|    throw ("'{0}' is not a guard outcome" -f $Outcome)
|}
|
|function New-SIGuardTelemetryRecord {
|    <#
|        PURE. The GUARD-1 record (Invardia's receiver opens / updates ONE support ticket per environment + guard for Pro; for
|        Community it counts installs per guard and version). -Context: a Get-SITelemetryContext result.
|          always      Schema 2, Kind guard, Product, Version, Ring, Edition, Hosting, RuntimeIdentity, LicenceState, Job, GuardId,
|                      GuardOutcome, Severity, Area, Measured / Thresholds (camelCase keys, numbers only, at most 10 each),
|                      HeldCount, TripCount, FirstSeenUtc, LastSeenUtc
|          anonymous   + InstallId. NO tenant, host, subject, detail, action text or link.
|          identified  + ClaimedTenantId, Host, ActionText (at most 500 characters, redacted), Link (https only), and InstallId =
|                      the install's LASTING id (Context.LastingInstallId, Invardia S16) when there is one.
|        A value outside the receiver's lists is refused here (it would reject the whole report).
|    #>
|    param([Parameter(Mandatory)]$Event, [Parameter(Mandatory)]$Trip, [Parameter(Mandatory)]$Context, [string]$HostName, $Now)
|    $w = $script:SIGuardWire
|    $anon = ([string]$Context.Mode -eq 'anonymous')
|    $iso = { param($v) $u = ConvertTo-SIGuardUtc $v; if ($null -eq $u) { $null } else { $u.ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture) } }
|    $gid = [string]$Event.GuardId
|    if ($gid -notmatch $w.GuardIdPattern) { throw ("guard id '{0}' does not fit the receiver ({1})" -f $gid, $w.GuardIdPattern) }
|    if ($w.Severities -notcontains [string]$Event.Severity) { throw ("severity '{0}' is not critical / warning" -f $Event.Severity) }
|    $measured = [ordered]@{}; $limits = [ordered]@{}
|    foreach ($v in @($Event.Values)) {
|        if ($v.Name -notmatch $w.KeyPattern) { continue }
|        if ($null -ne $v.Measured -and $measured.Count -lt $w.MaxValues) { $measured[$v.Name] = $v.Measured }
|        if ($null -ne $v.Limit -and $limits.Count -lt $w.MaxValues) { $limits[$v.Name] = $v.Limit }
|    }
|    $r = [ordered]@{ Schema = 2; Kind = 'guard'; Product = $script:SIGuard.Product }
|    $ver = "$($Context.Version)".Trim(); if ($ver) { $r.Version = $ver }
|    if ($Context.PSObject.Properties['Ring'] -and $null -ne $Context.Ring -and "$($Context.Ring)" -ne '') { $r.Ring = [int]$Context.Ring }
|    foreach ($k in 'Edition', 'Hosting', 'RuntimeIdentity', 'LicenceState') { $val = "$($Context.$k)".Trim(); if ($val) { $r[$k] = $val } }
|    if ([string]$Event.Job) { $r.Job = [string]$Event.Job }
|    $r.GuardId      = $gid
|    $r.GuardOutcome = ConvertTo-SIGuardWireOutcome -Outcome ([string]$Event.Outcome) -HeldCount ([long]$Event.HeldCount)
|    $r.Severity     = [string]$Event.Severity
|    $r.Area         = [string]$Event.Area
|    $r.Measured     = [pscustomobject]$measured
|    $r.Thresholds   = [pscustomobject]$limits
|    $r.HeldCount    = [long]$Event.HeldCount
|    $r.TripCount    = [int]$Trip.TripCount
|    $r.FirstSeenUtc = & $iso $Trip.FirstSeenUtc
|    if ($anon) {
|        $r.InstallId = [string]$Context.InstallId
|    } else {
|        $r.ClaimedTenantId = [string]$Context.TenantId
|        $r.Host = $(if ($HostName) { $HostName } else { [string][System.Environment]::MachineName })
|        # Invardia S16: the install's LASTING id (SI-InstallId) on the identified report -- never the anonymous id; none = no field
|        if ($Context.PSObject.Properties['LastingInstallId'] -and (Get-Command -Name ConvertTo-SIInvardiaInstallId -ErrorAction SilentlyContinue)) {
|            $lid = ConvertTo-SIInvardiaInstallId ([string]$Context.LastingInstallId); if ($lid) { $r.InstallId = $lid }
|        }
|        $red =if (Get-Command -Name ConvertTo-AitUplinkRedacted -ErrorAction SilentlyContinue) { { param($s) ConvertTo-AitUplinkRedacted -Text $s } } else { { param($s) $s } }
|        # the three parts WITHOUT the event's detail or subject (what happened, the consequence, what to do) -- the same
|        # words as the mail and the Guards page; the caller's own -Action when it gave one
|        $atText = [string]$Event.Action
|        try {
|            $def = Get-SIGuardDefinition -Id $gid
|            if ($atText -eq [string]$def.action) {
|                $pp = Get-SIGuardParts -Event $Event -NoDetail
|                if ($pp.What) { $atText = (@($pp.What, $pp.Consequence, $(if (@($pp.Steps).Count) { 'What to do: ' + (Format-SIGuardSteps -Steps $pp.Steps) })) | Where-Object { "$_".Trim() }) -join ' ' }
|            }
|        } catch { }
|        $at = (& $red $atText).Trim()
|        if ($at.Length -gt $w.ActionTextMax) { $at = $at.Substring(0, $w.ActionTextMax - 3) + '...' }
|        if ($at) { $r.ActionText = $at }
|        if ([string]$Event.Link -match '^https://') { $r.Link = [string]$Event.Link }
|    }
|    # CR4 (#654): a trip in the stricter period after a release -- Strict, the customer's configured limit and the halved
|    # one (whole numbers only: Invardia keeps nothing else); the guard mode on an identified report only
|    $sv = @(@($Event.Values) | Where-Object { $_ -and $_.PSObject.Properties['Configured'] -and $null -ne $_.Configured -and $null -ne $_.Limit }) | Select-Object -First 1
|    if ($sv -or ($Event.PSObject.Properties['Strict'] -and $Event.Strict)) {
|        $r.Strict = $true
|        $cl = if ($sv) { [Math]::Abs([double]$sv.Configured) } elseif ($null -ne $Event.Strict.Configured) { [Math]::Abs([double]$Event.Strict.Configured) } else { $null }
|        $el = if ($sv) { [Math]::Abs([double]$sv.Limit) } elseif ($null -ne $Event.Strict.Effective) { [Math]::Abs([double]$Event.Strict.Effective) } else { $null }
|        if ($null -ne $cl -and $cl -eq [Math]::Floor($cl) -and $cl -lt 2147483647) { $r.ConfiguredLimit = [long]$cl }
|        if ($null -ne $el -and $el -eq [Math]::Floor($el) -and $el -lt 2147483647) { $r.EffectiveLimit = [long]$el }
|        if (-not $anon -and $Event.PSObject.Properties['Strict'] -and $Event.Strict -and (Get-Command -Name ConvertTo-SIGuardModeWire -ErrorAction SilentlyContinue)) {
|            $gm = ConvertTo-SIGuardModeWire -Mode ([pscustomobject]@{ Mode = 'strict'; Recorded = $true; Until = $Event.Strict.Until; Version = $Event.Strict.Version; EndedEarlyAt = $null; EndedByRole = '' })
|            if ($gm) { $r.GuardMode = [pscustomobject]$gm }
|        }
|    }
|    $r.LastSeenUtc = & $iso $(if ($Now) { $Now } else { $Trip.LastSeenUtc })
|    [pscustomobject]$r
|}
|
|function ConvertTo-SIGuardWire {
|    <# PURE. The record as it is posted: the GUARD-1 record itself (Send-AitUplink posts any record). $null when an
|       anonymous record has no install id (the receiver needs one) -- then nothing is sent. Returns @{ Shape; Record }. #>
|    param([Parameter(Mandatory)]$Record, [Parameter(Mandatory)]$Context)
|    if ([string]$Context.Mode -eq 'anonymous' -and [string]$Record.InstallId -notmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$') {
|        return [pscustomobject]@{ Shape = 'none'; Record = $null }
|    }
|    [pscustomobject]@{ Shape = 'guard'; Record = $Record }
|}
|
|# =====================================================================================================================
|#  THE ONE CALL
|# =====================================================================================================================
|function Get-SIGuardCallerEngine {
|    <# The engine folder of the script that called (engine\<name>\...), for a guard that is not told its engine. #>
|    try {
|        foreach ($f in @(Get-PSCallStack)) {
|            $s = [string]$f.ScriptName
|            if ($s -match '[\\/]engine[\\/]([a-z0-9-]+)[\\/]' -and $Matches[1] -ne '_shared') { return $Matches[1] }
|        }
|    } catch { }
|    ''
|}
|
|function Send-SIGuardEvent {
|    <#
|        THE call every guard makes. NEVER throws. Returns @{ Status (recorded | duplicate | error); Event; Trip; Mail;
|        Telemetry; Stored; RunHealth; Audit; Reason }.
|        What: -GuardId, -Outcome, -Engine / -Job, -Subject, -Detail, -Values, -HeldCount, -Action, -Link, -RunId, -Source.
|        Seams (tests; all optional):
|          -Invoke             the Pro database (sql, params, mode) -- dedup state, the Guards view row, the audit event,
|                              the SuperAdmins' mail. Default: $global:SI_GuardInvoke, else none.
|          -StateStore         a dedup store (New-SIGuardMemoryStateStore / -FileStateStore / -SqlStateStore).
|          -MailTransport      { param($To, $Subject, $Html, $Priority) } -> $true; default: the Risk Analysis transports.
|          -TelemetryTransport { param($Record, $Endpoint, $AccessCode, $TimeoutSec) } -> @{ Status }; default Send-AitUplink.
|          -TelemetryContext   a Get-SITelemetryContext result.
|          -RunHealth          { param($RunContext, $ExitReason, $Message, $HeldCount) }; default Send-SIRunHealthRow.
|          -Globals            settings as a hashtable instead of the live globals.
|          -Now                the clock.
|        -NoMail / -NoTelemetry: this call only (the settings decide otherwise).
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$GuardId,
|        [Parameter(Mandatory)][string]$Outcome,
|        [string]$Engine, [string]$Job, [string]$Subject, [string]$Detail,
|        [object[]]$Values = @(), [long]$HeldCount = 0, [string]$Action, [string]$Link, [string]$RunId, [string]$Source = 'job',
|        [scriptblock]$Invoke, $StateStore, [scriptblock]$MailTransport, [scriptblock]$TelemetryTransport, $TelemetryContext,
|        [scriptblock]$RunHealth, [System.Collections.IDictionary]$Globals, $Now, [switch]$NoMail, [switch]$NoTelemetry,
|        [scriptblock]$Log,
|        # #414: the distinct causes this event is about (Get-SIGuardCauseKey). When EVERY one was reported before, the
|        # event is not made again (Status 'already-reported': no row, no mail, no report) -- a cause fires ONCE, however
|        # many runs still see it (ring 1, 2026-10-06: 14,624 rows of one broken run re-fired on every data sync).
|        [string[]]$CauseKeys,
|        # the SecurityInsight version this run is on (default: Get-SIGuardRunVersion) -- tests hand one in
|        [string]$Version
|    )
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) if ($level -eq 'WARN') { Write-Warning $msg } else { Write-Host (' [{0}] {1}' -f $level, $msg) } } }
|    $res = [ordered]@{ Status = 'error'; Event = $null; Trip = $null; Mail = [pscustomobject]@{ State = 'not-tried'; To = @(); Subject = '' }
|                       Telemetry = [pscustomobject]@{ State = 'not-tried'; Shape = ''; Record = $null }; Stored = $false; RunHealth = 'not-tried'; Audit = 'not-tried'; Reason = '' }
|    if ($null -eq $global:SI_GuardHealth) { $global:SI_GuardHealth = @{ Events = 0; Failed = 0; LastError = '' } }
|    # #414: a guard switched off makes no event and no mail (it says so once, Test-SIGuardOn)
|    if (-not (Test-SIGuardOn -GuardId $GuardId -Globals $Globals -Log $Log)) {
|        $res.Status = 'off'; $res.Reason = 'the guard is off (setting)'
|        return [pscustomobject]$res
|    }
|    try {
|        $nowUtc = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|        $isTest = [bool](Get-Module -Name Pester)
|        if (-not $global:SI_GuardRunId) { $global:SI_GuardRunId = [guid]::NewGuid().ToString() }
|        if (-not $Engine) { $Engine = Get-SIGuardCallerEngine }
|        $ev = New-SIGuardEvent -GuardId $GuardId -Outcome $Outcome -Engine $Engine -Job $Job -Subject $Subject -Detail $Detail -Values $Values `
|                -HeldCount $HeldCount -Action $Action -Link $Link -RunId $RunId -NowUtc $nowUtc -Source $Source
|        # CR4 (#654): a limit halved in the stricter period after a release (Resolve-SIGuardLimit) rides on the event
|        if (Get-Command -Name Add-SIGuardStrictToEvent -ErrorAction SilentlyContinue) { try { $ev = Add-SIGuardStrictToEvent -Event $ev } catch { } }
|        if (-not $ev.Link) {
|            $base = "$(Get-SIGuardSetting -Name 'SIWeb_PublicBaseUrl' -Globals $Globals)".Trim().TrimEnd('/')
|            if ($base -match '^https://') { $ev.Link = $base + '/Admin/Guards' }
|        }
|        $res.Event = $ev
|
|        # ---- one event per guard (and subject) per run ----
|        if ($null -eq $global:SI_GuardSeenThisRun) { $global:SI_GuardSeenThisRun = @{} }
|        $runKey = '{0}|{1}' -f $ev.RunId, $ev.GuardKey
|        if ($global:SI_GuardSeenThisRun.ContainsKey($runKey)) {
|            $res.Status = 'duplicate'; $res.Reason = 'this guard already reported in this run'
|            return [pscustomobject]$res
|        }
|        $global:SI_GuardSeenThisRun[$runKey] = $true
|        # A 'warning' is not prefixed: the console's own "WARNING:" already says it (it printed "WARNING: WARNING: ...").
|        # #425: what, where, the numbers and what to do -- one line a person can act on (Format-SIGuardSummary)
|        $summary = Format-SIGuardSummary -Event $ev
|        & $Log 'WARN' ('{0}{1}' -f $(if ($ev.Outcome -ieq 'warning') { '' } else { $ev.Outcome.ToUpperInvariant() + ': ' }), $summary)
|
|        # #735: every guard in ONE place -- a step that hands in no database (the collection's asset-drop guard, Risk
|        # Analysis' row-count / column-fill / bucket-jump guards) still writes its row to cfg.GuardEvent when the install has a
|        # Pro database (Resolve-SIGuardEventInvoke); run health and the uplink are written as before
|        $Invoke = Resolve-SIGuardEventInvoke -Invoke $Invoke -IsTest $isTest
|        $hasTables = $false
|        if ($Invoke) {
|            try { $hasTables = ([int](& $Invoke (Get-SIGuardSql 'Exists') @{} 'scalar') -eq 1) } catch { & $Log 'WARN' ('the guard tables could not be checked: {0}' -f $_.Exception.Message) }
|        }
|
|        # ---- the trip's episode (de-duplication) ----
|        if (-not $StateStore) {
|            if ($hasTables) { $StateStore = New-SIGuardSqlStateStore -Invoke $Invoke }
|            elseif ($isTest) { if (-not $global:SI_GuardTestStore) { $global:SI_GuardTestStore = New-SIGuardMemoryStateStore }; $StateStore = $global:SI_GuardTestStore }
|            else { $StateStore = New-SIGuardFileStateStore -Directory (Get-SIGuardStateDirectory) }
|        }
|        # #414: a cause reported before is not reported again
|        $causes = @($CauseKeys | Where-Object { "$_".Trim() } | ForEach-Object { 'cause|{0}|{1}' -f $ev.GuardId, ([string]$_).Trim().ToLowerInvariant() })
|        if ($causes.Count) {
|            $newCauses = @($causes | Where-Object { $ck = $_; $known = $null; try { $known = & $StateStore.Get $ck } catch { $known = $null }; -not $known })
|            if (-not $newCauses.Count) {
|                & $Log 'INFO' ('{0}: already reported (the same cause) -- not reported again' -f $ev.GuardId)
|                $res.Status = 'already-reported'; $res.Reason = 'every cause of this event was reported before'
|                return [pscustomobject]$res
|            }
|        }
|        $prev = $null
|        try { $prev = & $StateStore.Get $ev.GuardKey } catch { & $Log 'WARN' ('the guard''s earlier trips could not be read ({0}) -- treated as a first trip' -f $_.Exception.Message) }
|        # ---- WHICH RELEASE (owner 2026-10-17): the version it tripped on, the one before, "the first run after the update" ----
|        $marker = $null; $newMarker = $null; $attr = $null
|        if (Get-Command -Name Get-SIGuardAttribution -ErrorAction SilentlyContinue) {
|            try {
|                $ver = if ($Version) { $Version } else { Get-SIGuardRunVersion }
|                $marker = Read-SIGuardVersionMarker -StateStore $StateStore -GuardKey $ev.GuardKey
|                $attr = Get-SIGuardAttribution -Marker $marker -Version $ver -RunId $ev.RunId
|                $newMarker = Update-SIGuardVersionMarker -Marker $marker -Version $ver -RunId $ev.RunId -NowUtc $nowUtc -Kind trip -Tripped $true
|                $ev | Add-Member -NotePropertyName Version -NotePropertyValue ([string]$attr.Version) -Force
|                $ev | Add-Member -NotePropertyName PreviousVersion -NotePropertyValue ([string]$attr.PreviousVersion) -Force
|                $ev | Add-Member -NotePropertyName AfterUpdate -NotePropertyValue ([bool]$attr.AfterUpdate) -Force
|                $ev | Add-Member -NotePropertyName Attribution -NotePropertyValue ([string]$attr.Text) -Force
|            } catch { & $Log 'INFO' ('the version this guard tripped on could not be worked out: {0}' -f $_.Exception.Message) }
|        }
|        # ---- ACCEPTED BY THE OWNER (cfg.GuardAccept): still recorded, not mailed, not reported again ----
|        $accepted = $null
|        if ($hasTables -and (Get-Command -Name Test-SIGuardAcceptCovers -ErrorAction SilentlyContinue)) {
|            try {
|                $acc = @(& $Invoke (Get-SIGuardHealSql 'AcceptRead') @{ GuardId = $ev.GuardId } 'reader' | ForEach-Object { $_ } | Where-Object { $_ })
|                $accepted = Test-SIGuardAcceptCovers -Accepts $acc -GuardKey $ev.GuardKey -Version $(if ($attr) { [string]$attr.Version } else { '' }) -TimeUtc $nowUtc
|            } catch { $accepted = $null }
|        }
|        # owner review 2026-10-17: ONLY A WARNING is muted by an acceptance. A trip that HOLDS, refuses or stops something is
|        # still mailed and reported -- with "inside a range the owner accepted" -- so held data is never silent.
|        $acceptedHold = $false
|        if ($accepted) {
|            $wireOc = 'warning'; try { $wireOc = ConvertTo-SIGuardWireOutcome -Outcome ([string]$ev.Outcome) -HeldCount ([long]$ev.HeldCount) } catch { $wireOc = 'held' }
|            if ($wireOc -ne 'warning') {
|                $acceptedHold = $true
|                $note = 'This version is inside a range the owner accepted ({0}), but this run still held or stopped something, so it is mailed and reported as usual.' -f [string](Get-SIGuardField $accepted 'AcceptedBy')
|                $ev | Add-Member -NotePropertyName Attribution -NotePropertyValue ((@([string]$(if ($ev.PSObject.Properties['Attribution']) { $ev.Attribution } else { '' }), $note) | Where-Object { $_ }) -join ' ') -Force
|                if ($attr) { $attr.Text = [string]$ev.Attribution }
|                & $Log 'INFO' ('{0}: inside a range the owner accepted, but it held data -- mailed and reported as usual' -f $ev.GuardId)
|                $accepted = $null
|            } else { & $Log 'INFO' ('{0}: accepted by {1} for this version -- a warning only: recorded, not mailed and not reported again' -f $ev.GuardId, [string](Get-SIGuardField $accepted 'AcceptedBy')) }
|        }
|        if ($accepted) { $NoMail = $true }
|        $mailOn = (Test-SIGuardMailEnabled -Globals $Globals) -and (Test-SIGuardMailOn -GuardId $ev.GuardId -Globals $Globals) -and -not $NoMail -and (Test-SIGuardOutcomeMails -Event $ev)
|        $trip = Get-SIGuardTripState -Previous $prev -NowUtc $nowUtc -WindowHours $script:SIGuard.WindowHours -MailEnabled $mailOn
|        $res.Trip = $trip
|
|        # ---- (c) MAIL ----
|        $mailState = 'off'; $mailTo = @(); $mailSubject = ''
|        if (-not $mailOn) { $mailState = 'off' }
|        elseif (-not $trip.Mail) { $mailState = 'deduped' }
|        else {
|            try {
|                $admins = @()
|                $rcp = Get-SIGuardMailRecipients -Globals $Globals
|                if (-not @($rcp.To).Count -and $hasTables) {
|                    try { $admins = @(& $Invoke (Get-SIGuardSql 'SuperAdmins') @{} 'reader' | ForEach-Object { [string]$_.Mail }) } catch { }
|                    $rcp = Get-SIGuardMailRecipients -Globals $Globals -SuperAdminMails $admins
|                }
|                $mailTo = @($rcp.To)
|                $tag = Get-SIGuardTenantTag -Globals $Globals
|                $m = ConvertTo-SIGuardMail -Event $ev -Trip $trip -TenantTag $tag -Culture (Get-SIGuardCulture -Globals $Globals)
|                $mailSubject = $m.Subject
|                if (-not $mailTo.Count) {
|                    # #277 (live: printed 24 times in one run): said ONCE per process; every guard row carries 'mail: no recipients'
|                    $mailState = 'no-recipients'
|                    if (-not $global:SI_GuardNoRecipientsWarned) { $global:SI_GuardNoRecipientsWarned = $true; & $Log 'WARN' 'the guard mail has no recipients (set SI_GuardMail_To, or MailTo) -- not sent' }
|                }
|                elseif (-not $MailTransport -and $isTest) { $mailState = 'test-session' }
|                else {
|                    $prio = if ($ev.Severity -eq 'critical') { 'High' } else { 'Normal' }
|                    $smtp = if ($MailTransport) { $null } else { Get-SIGuardSmtp -Globals $Globals }
|                    if (-not $MailTransport -and $smtp.Off) { $mailState = 'off' }
|                    elseif (-not $MailTransport -and @($smtp.Problems).Count) { $mailState = 'no-relay'; & $Log 'WARN' ('the guard mail could not be sent: ' + (@($smtp.Problems) -join '; ')) }
|                    else {
|                        $ok = if ($MailTransport) { & $MailTransport $mailTo $m.Subject $m.Html $prio } else { Send-SIGuardMailDefault -Smtp $smtp -To $mailTo -Subject $m.Subject -Html $m.Html -Priority $prio }
|                        $mailState = if (@($ok | Where-Object { $_ -is [bool] } | Select-Object -Last 1) -contains $false) { 'failed' } else { 'sent' }
|                    }
|                }
|            } catch {
|                $mailState = 'failed'
|                & $Log 'WARN' ('the guard mail could not be sent: {0}. The job itself is not affected.' -f $_.Exception.Message)
|            }
|            # an undelivered mail is tried again on the next trip, not a day later
|            if ($mailState -ne 'sent') { $trip.LastMailUtc = $(if ($prev) { ConvertTo-SIGuardUtc $prev.LastMailUtc } else { $null }) }
|        }
|        if ($accepted) { $mailState = 'accepted' }
|        $res.Mail = [pscustomobject]@{ State = $mailState; To = $mailTo; Subject = $mailSubject }
|
|        # ---- (d) TELEMETRY ----
|        $telState = 'off'; $shape = ''; $wireRec = $null
|        try {
|            if ($accepted) { $telState = 'accepted' }
|            elseif ($NoTelemetry -or -not (Get-Command -Name Test-SITelemetryEnabled -ErrorAction SilentlyContinue)) { $telState = 'off' }
|            elseif (-not $Globals -and -not (Test-SITelemetryEnabled)) { $telState = 'off' }
|            elseif ($Globals -and -not (Test-SIGuardFlag -Value (Get-SIGuardSetting -Name 'SI_Telemetry_Enabled' -Globals $Globals) -Default $true)) { $telState = 'off' }
|            elseif ($global:SI_TelemetryHalted -and -not $TelemetryTransport) { $telState = 'halted' }
|            elseif (-not $TelemetryTransport -and $isTest) { $telState = 'test-session' }
|            else {
|                $ctx = if ($TelemetryContext) { $TelemetryContext } else { Get-SITelemetryContext }
|                $rec = New-SIGuardTelemetryRecord -Event $ev -Trip $trip -Context $ctx -Now $nowUtc
|                # a trip that held inside a range the owner accepted says so to Invardia (identified: its words) -- only with
|                # SI_Uplink_SendGuardHealOutcomes on (off: the report keeps its earlier shape)
|                if ($acceptedHold -and $rec.PSObject.Properties['ActionText'] -and (Resolve-SIGuardHealOutcomesSwitch -Ring $ctx.Ring -Globals $Globals).On) {
|                    $tx2 = 'held (accepted range): ' + [string]$rec.ActionText; if ($tx2.Length -gt 500) { $tx2 = $tx2.Substring(0, 497) + '...' }
|                    $rec.ActionText = $tx2
|                }
|                $wire = ConvertTo-SIGuardWire -Record $rec -Context $ctx
|                $shape = $wire.Shape; $wireRec = $wire.Record
|                if ($null -eq $wire.Record) { $telState = 'no-install-id' }
|                else {
|                    if (-not $TelemetryTransport) { $TelemetryTransport = { param($Record, $Endpoint, $AccessCode, $TimeoutSec) if (Get-Command -Name Test-SITelemetryCommunitySendAllowed -ErrorAction SilentlyContinue) { $g = Test-SITelemetryCommunitySendAllowed -AccessCode $AccessCode; if (-not $g.Allowed) { return [pscustomobject]@{ Status = 'skipped'; Reason = $g.Reason; Sent = $false } } }; Send-AitUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec } }
|                    $r = & $TelemetryTransport $wire.Record $ctx.Endpoint $ctx.AccessCode 5
|                    if ("$($r.Status)" -eq 'ok') { $telState = 'sent' }
|                    else {
|                        $telState = 'failed'
|                        $global:SI_TelemetryHalted = $true
|                        & $Log 'WARN' ('the guard report to Invardia was not sent ({0}); the job is not affected' -f $(if (Get-Command -Name ConvertTo-AitUplinkRedacted -ErrorAction SilentlyContinue) { ConvertTo-AitUplinkRedacted -Text "$($r.Reason)" } else { "$($r.Reason)" }))
|                    }
|                }
|            }
|        } catch { $telState = 'failed'; & $Log 'WARN' ('the guard report to Invardia could not be prepared: {0}' -f $_.Exception.Message) }
|        $res.Telemetry = [pscustomobject]@{ State = $telState; Shape = $shape; Record = $wireRec }
|
|        # ---- the episode, saved (with the version it tripped on; a trip re-opens a cleared episode) ----
|        $tripSave = $trip
|        if ($attr) {
|            $tripSave = [pscustomobject]@{ FirstSeenUtc = $trip.FirstSeenUtc; LastSeenUtc = $trip.LastSeenUtc; TripCount = $trip.TripCount; LastMailUtc = $trip.LastMailUtc
|                                           Version = [string]$attr.Version; PreviousVersion = [string]$attr.PreviousVersion; ClearedUtc = $null; ClearedRunId = $null; ClearedVersion = $null; ClearedHow = $null }
|        }
|        try { & $StateStore.Set $ev.GuardKey $ev.GuardId $tripSave } catch { & $Log 'WARN' ('the guard''s trip count could not be saved: {0}' -f $_.Exception.Message) }
|        foreach ($ck in $causes) { try { & $StateStore.Set $ck $ev.GuardId $trip } catch { } }
|        if ($newMarker) { Save-SIGuardVersionMarker -StateStore $StateStore -GuardKey $ev.GuardKey -GuardId $ev.GuardId -Marker $newMarker -NowUtc $nowUtc }
|
|        # ---- (e) the Guards view row ----
|        if ($hasTables) {
|            try {
|                $vj = ConvertTo-Json -InputObject @($ev.Values) -Depth 3 -Compress
|                $newId = & $Invoke (Get-SIGuardSql 'Insert') @{
|                    GuardId = $ev.GuardId; GuardKey = $ev.GuardKey; Area = $ev.Area; Job = $ev.Job; Engine = $ev.Engine; Source = $ev.Source
|                    Outcome = $ev.Outcome; Severity = $ev.Severity; Protected = $ev.Protected; Subject = $ev.Subject; Detail = $ev.Detail
|                    MeasuredText = (Format-SIGuardValues -Values $ev.Values); ValuesJson = $vj; HeldCount = [long]$ev.HeldCount; ActionText = $ev.Action
|                    Link = $ev.Link; RunId = $ev.RunId; TripCount = [int]$trip.TripCount; FirstSeenUtc = $trip.FirstSeenUtc
|                    MailState = $mailState; MailTo = (@($mailTo) -join '; '); TelemetryState = $telState } 'scalar'
|                $res.Stored = $true
|                # the version it tripped on and the words of "which release" (only where the database has the columns)
|                if ($attr) {
|                    $nid = 0L
|                    if ([long]::TryParse([string]$(if ($newId -is [array]) { $newId[0] } else { $newId }), [ref]$nid) -and $nid -gt 0) {
|                        $at = [string]$attr.Text; if ($at.Length -gt 400) { $at = $at.Substring(0, 400) }
|                        try { $null = & $Invoke (Get-SIGuardHealSql 'EventInfo') @{ Id = $nid; SiVersion = $(if ($attr.Version) { [string]$attr.Version } else { $null }); PreviousVersion = $(if ($attr.PreviousVersion) { [string]$attr.PreviousVersion } else { $null }); Attribution = $(if ($at) { $at } else { $null }) } 'nonquery' } catch { }
|                    }
|                }
|            } catch { & $Log 'WARN' ('the guard event could not be saved for the Guards view: {0}' -f $_.Exception.Message) }
|        }
|
|        # ---- (a) RUN HEALTH ----
|        try {
|            $ctxRh = [pscustomobject]@{ RunId = $ev.RunId; Engine = $(if ($ev.Engine) { $ev.Engine } else { 'guard' }); ShardIndex = 0; ShardCount = 1; CollectionTime = $nowUtc; StartedAt = $nowUtc }
|            $msg = '{0}: {1}' -f $ev.GuardId, $summary
|            if ($attr -and [string]$attr.Text) { $msg += ' ' + [string]$attr.Text }
|            if ($mailState -eq 'no-recipients') { $msg += ' | mail: no recipients' }
|            if ($accepted) { $msg += ' | accepted by the owner for this version' }
|            if ($RunHealth) { $null = & $RunHealth $ctxRh ('guard-' + $ev.Outcome) $msg ([long]$ev.HeldCount); $res.RunHealth = 'written' }
|            elseif (Get-Command -Name Send-SIRunHealthRow -ErrorAction SilentlyContinue) {
|                Send-SIRunHealthRow -RunContext $ctxRh -Phase Guard -AssetCount ([int][Math]::Min([long]$ev.HeldCount, [int]::MaxValue)) -ExitReason ('guard-' + $ev.Outcome) -ErrorMessage $msg -NoTelemetry
|                $res.RunHealth = 'written'
|            } else { $res.RunHealth = 'unavailable' }
|        } catch { $res.RunHealth = 'failed' }
|
|        # ---- (b) AUDIT ----
|        if ($Invoke -and (Get-Command -Name Write-SIAuditEvent -ErrorAction SilentlyContinue)) {
|            $after = [ordered]@{ guard = $ev.GuardId; area = $ev.Area; outcome = $ev.Outcome; severity = $ev.Severity; held = [long]$ev.HeldCount
|                                 measured = (Format-SIGuardValues -Values $ev.Values); trips = [int]$trip.TripCount; mail = $mailState; telemetry = $telState }
|            $actor = if (Get-Command -Name Get-SIAuditActor -ErrorAction SilentlyContinue) { Get-SIAuditActor -Job $(if ($ev.Engine) { $ev.Engine } else { 'guard' }) } else { 'guard' }
|            $ok = Write-SIAuditEvent -Invoke $Invoke -Action $script:SIGuard.AuditAction -Actor $actor -ActorSource $(if ($ev.Source -eq 'web') { 'web' } elseif ($ev.Source -eq 'setup') { 'setup' } else { 'job' }) `
|                    -Target $(if ($ev.Subject) { '{0} ({1})' -f $ev.GuardId, $ev.Subject } else { $ev.GuardId }) -Reason $ev.Protected `
|                    -Outcome $(if ($ev.Severity -eq 'critical') { 'refused' } else { 'held' }) -OutcomeText $(if ($ev.Detail) { $ev.Detail } else { $ev.Action }) `
|                    -CorrelationId $ev.RunId -After $after -Log { param($l, $m) }
|            $res.Audit = if ($ok) { 'written' } else { 'failed' }
|        } else { $res.Audit = 'no-database' }
|
|        $global:SI_GuardHealth.Events++
|        $res.Status = 'recorded'
|        return [pscustomobject]$res
|    } catch {
|        $global:SI_GuardHealth.Failed++; $global:SI_GuardHealth.LastError = [string]$_.Exception.Message
|        $res.Status = 'error'; $res.Reason = [string]$_.Exception.Message
|        try { & $Log 'WARN' ('a guard event could not be recorded: {0}. The job itself is not affected.' -f $_.Exception.Message) } catch { }
|        return [pscustomobject]$res
|    }
|}
|
|function Send-SIGuardMailDefault {
|    <# The default mail path: the one transport (Send-SIMail, SI-MailTransport.ps1) with the mail settings (-Smtp, from
|       Get-SIGuardSmtp). A plain function, not a closure: a closure cannot see functions dot-sourced into the engine's
|       script scope. THROWS when the mail does not go out. #>
|    param([Parameter(Mandatory)]$Smtp, [Parameter(Mandatory)][string[]]$To, [Parameter(Mandatory)][string]$Subject, [Parameter(Mandatory)][string]$Html, [string]$Priority = 'Normal',
|          # MAIL-3 (#653): the subject's severity word (the guard mail writes it first in its subject itself)
|          [AllowNull()][AllowEmptyString()][string]$Severity)
|    $r = Send-SIMail -Settings $Smtp -To $To -Subject $Subject -BodyHtml $Html -Priority $Priority -Severity $Severity
|    if (-not $r.Sent) { throw $(if ($r.Error) { [string]$r.Error } else { 'the mail was not accepted' }) }
|    return $true
|}
|
|function Invoke-SIGuardOutbox {
|    <#
|        The mail job's step (Pro): the guard events the WEB APP wrote (cfg.GuardEvent, MailState / TelemetryState
|        'pending') are mailed and reported here, with the same de-duplication as a job's guard. Never throws; returns
|        @{ Read; Mailed; Reported; Failed }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, $StateStore, [scriptblock]$MailTransport, [scriptblock]$TelemetryTransport, $TelemetryContext,
|          [System.Collections.IDictionary]$Globals, $Now, [switch]$DryRun, [scriptblock]$Log)
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Host (' [{0}] {1}' -f $level, $msg) } }
|    $out = [ordered]@{ Read = 0; Mailed = 0; Reported = 0; Failed = 0 }
|    try {
|        if ([int](& $Invoke (Get-SIGuardSql 'Exists') @{} 'scalar') -ne 1) { & $Log 'INFO' 'guards    : the Pro database has no guard tables yet -- nothing to send'; return [pscustomobject]$out }
|        $rows = @(& $Invoke (Get-SIGuardSql 'OutboxRead') @{} 'reader' | ForEach-Object { $_ } | Where-Object { $_ })
|        $out.Read = $rows.Count
|        if (-not $rows.Count) { return [pscustomobject]$out }
|        if (-not $StateStore) { $StateStore = New-SIGuardSqlStateStore -Invoke $Invoke }
|        foreach ($row in $rows) {
|            # owner 2026-10-17: a CLEAR another writer recorded (the owner's acceptance, cfg.GuardAcceptSet) -- only the report
|            # to Invardia that the guard is cleared (ClearedBy 'released': a person decided); nothing is mailed
|            if ([string]$row.Outcome -eq 'cleared') {
|                try {
|                    $telState = [string]$row.TelemetryState
|                    if ($telState -eq 'pending' -and -not $DryRun) {
|                        $enabled = if ($Globals) { Test-SIGuardFlag -Value (Get-SIGuardSetting -Name 'SI_Telemetry_Enabled' -Globals $Globals) -Default $true } else { Test-SITelemetryEnabled }
|                        $ctx = $null
|                        if ($enabled -and -not ($global:SI_TelemetryHalted -and -not $TelemetryTransport)) { $ctx = if ($TelemetryContext) { $TelemetryContext } else { Get-SITelemetryContext } }
|                        if (-not $enabled) { $telState = 'off' }
|                        elseif ($global:SI_TelemetryHalted -and -not $TelemetryTransport) { $telState = 'halted' }
|                        # Invardia's receiver does not take 'cleared' yet: with SI_Uplink_SendGuardHealOutcomes off the clear is
|                        # marked 'off' -- never sent, and never sent later in a burst when the switch goes on
|                        elseif (-not (Resolve-SIGuardHealOutcomesSwitch -Ring $ctx.Ring -Globals $Globals).On) { $telState = 'off' }
|                        else {
|                            $def = Get-SIGuardDefinition -Id ([string]$row.GuardId)
|                            $nowC = if ($row.TsUtc -and -not ($row.TsUtc -is [System.DBNull])) { ([datetime]$row.TsUtc).ToUniversalTime() } else { [datetime]::UtcNow }
|                            $rec = New-SIGuardClearTelemetryRecord -GuardId ([string]$row.GuardId) -Context $ctx -How released -NowUtc $nowC -Job $(if ([string]$row.Job) { [string]$row.Job } else { [string]$def.job }) -Area ([string]$def.area) -Text ([string]$row.Detail)
|                            if ([string]$ctx.Mode -eq 'anonymous' -and [string]$rec.InstallId -notmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$') { $telState = 'no-install-id' }
|                            else {
|                                if (-not $TelemetryTransport) { $TelemetryTransport = { param($Record, $Endpoint, $AccessCode, $TimeoutSec) if (Get-Command -Name Test-SITelemetryCommunitySendAllowed -ErrorAction SilentlyContinue) { $g = Test-SITelemetryCommunitySendAllowed -AccessCode $AccessCode; if (-not $g.Allowed) { return [pscustomobject]@{ Status = 'skipped'; Reason = $g.Reason; Sent = $false } } }; Send-AitUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec } }
|                                $r = & $TelemetryTransport $rec $ctx.Endpoint $ctx.AccessCode 5
|                                if ("$($r.Status)" -eq 'ok') { $telState = 'sent'; $out.Reported++ } else { $telState = 'failed' }
|                            }
|                        }
|                        $null = & $Invoke (Get-SIGuardSql 'OutboxMark') @{ Id = [long]$row.Id; MailState = $(if ([string]$row.MailState -eq 'pending') { 'off' } else { [string]$row.MailState }); MailTo = $null; TelemetryState = $telState; TripCount = $null; FirstSeenUtc = $null } 'nonquery'
|                    }
|                } catch { $out.Failed++; & $Log 'WARN' ('guards    : the clear {0} could not be reported: {1}' -f $row.Id, $_.Exception.Message) }
|                continue
|            }
|            try {
|                $vals = @(); if ([string]$row.ValuesJson) { try { $vals = @(ConvertFrom-Json -InputObject ([string]$row.ValuesJson)) } catch { $vals = @() } }
|                $ev = New-SIGuardEvent -GuardId ([string]$row.GuardId) -Outcome ([string]$row.Outcome) -Engine ([string]$row.Engine) -Job ([string]$row.Job) -Subject ([string]$row.Subject) `
|                        -Detail ([string]$row.Detail) -Values $vals -HeldCount ([long]$row.HeldCount) -Action ([string]$row.ActionText) -Link ([string]$row.Link) -RunId ([string]$row.RunId) `
|                        -NowUtc $(if ($row.TsUtc) { [datetime]$row.TsUtc } else { [datetime]::UtcNow }) -Source $(if ([string]$row.Source) { [string]$row.Source } else { 'web' })
|                $nowUtc = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|                # CR4 (#654): a web app event whose limit was halved (its value carries Configured) -- the period's words
|                $hv = @(@($ev.Values) | Where-Object { $_ -and $_.PSObject.Properties['Configured'] }) | Select-Object -First 1
|                if ($hv -and (Get-Command -Name Get-SIGuardModeNow -ErrorAction SilentlyContinue)) {
|                    try {
|                        $gmo = Get-SIGuardModeNow -Invoke $Invoke
|                        $ev | Add-Member -NotePropertyName Strict -NotePropertyValue ([pscustomobject]@{ GuardId = $ev.GuardId; Name = $hv.Name; Label = $hv.Label; Configured = [Math]::Abs([double]$hv.Configured)
|                                                                                                       Effective = [Math]::Abs([double]$hv.Limit); Unit = $hv.Unit; Until = $gmo.Until; Version = [string]$gmo.Version }) -Force
|                    } catch { }
|                }
|                $prev = $null; try { $prev = & $StateStore.Get $ev.GuardKey } catch { }
|                $mailOn = (Test-SIGuardMailEnabled -Globals $Globals) -and (Test-SIGuardMailOn -GuardId $ev.GuardId -Globals $Globals) -and (Test-SIGuardOutcomeMails -Event $ev)
|                $trip =Get-SIGuardTripState -Previous $prev -NowUtc $nowUtc -MailEnabled $mailOn
|                $mailState = [string]$row.MailState; $telState = [string]$row.TelemetryState; $to = $null
|                if ($mailState -eq 'pending') {
|                    if (-not $mailOn) { $mailState = 'off' }
|                    elseif (-not $trip.Mail) { $mailState = 'deduped' }
|                    elseif ($DryRun) { $mailState = 'pending' }
|                    else {
|                        $rcp = Get-SIGuardMailRecipients -Globals $Globals -SuperAdminMails @(& $Invoke (Get-SIGuardSql 'SuperAdmins') @{} 'reader' | ForEach-Object { [string]$_.Mail })
|                        $to = @($rcp.To)
|                        if (-not $to.Count) { $mailState = 'no-recipients' }
|                        else {
|                            $smtp = if ($MailTransport) { $null } else { Get-SIGuardSmtp -Globals $Globals }
|                            if (-not $MailTransport -and $smtp.Off) { $mailState = 'off' }
|                            elseif (-not $MailTransport -and @($smtp.Problems).Count) { $mailState = 'no-relay' }
|                            else {
|                                $m = ConvertTo-SIGuardMail -Event $ev -Trip $trip -Culture (Get-SIGuardCulture -Globals $Globals)
|                                $prio = if ($ev.Severity -eq 'critical') { 'High' } else { 'Normal' }
|                                try { if ($MailTransport) { $null = & $MailTransport $to $m.Subject $m.Html $prio } else { $null = Send-SIGuardMailDefault -Smtp $smtp -To $to -Subject $m.Subject -Html $m.Html -Priority $prio }; $mailState = 'sent'; $out.Mailed++ }
|                                catch { $mailState = 'failed'; $out.Failed++; & $Log 'WARN' ('guards    : the mail about {0} was not sent: {1}' -f $ev.GuardId, $_.Exception.Message) }
|                            }
|                        }
|                    }
|                    if ($mailState -ne 'sent') { $trip.LastMailUtc = $(if ($prev) { ConvertTo-SIGuardUtc $prev.LastMailUtc } else { $null }) }
|                }
|                if ($telState -eq 'pending' -and -not $DryRun) {
|                    $enabled = if ($Globals) { Test-SIGuardFlag -Value (Get-SIGuardSetting -Name 'SI_Telemetry_Enabled' -Globals $Globals) -Default $true } else { Test-SITelemetryEnabled }
|                    if (-not $enabled) { $telState = 'off' }
|                    elseif ($global:SI_TelemetryHalted -and -not $TelemetryTransport) { $telState = 'halted' }
|                    else {
|                        $ctx = if ($TelemetryContext) { $TelemetryContext } else { Get-SITelemetryContext }
|                        $rec = New-SIGuardTelemetryRecord -Event $ev -Trip $trip -Context $ctx -Now $nowUtc
|                        $wire = ConvertTo-SIGuardWire -Record $rec -Context $ctx
|                        if ($null -eq $wire.Record) { $telState = 'no-install-id' }
|                        else {
|                            if (-not $TelemetryTransport) { $TelemetryTransport = { param($Record, $Endpoint, $AccessCode, $TimeoutSec) if (Get-Command -Name Test-SITelemetryCommunitySendAllowed -ErrorAction SilentlyContinue) { $g = Test-SITelemetryCommunitySendAllowed -AccessCode $AccessCode; if (-not $g.Allowed) { return [pscustomobject]@{ Status = 'skipped'; Reason = $g.Reason; Sent = $false } } }; Send-AitUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec } }
|                            $r = & $TelemetryTransport $wire.Record $ctx.Endpoint $ctx.AccessCode 5
|                            if ("$($r.Status)" -eq 'ok') { $telState = 'sent'; $out.Reported++ } else { $telState = 'failed'; $global:SI_TelemetryHalted = $true }
|                        }
|                    }
|                }
|                if (-not $DryRun) {
|                    try { & $StateStore.Set $ev.GuardKey $ev.GuardId $trip } catch { }
|                    $null = & $Invoke (Get-SIGuardSql 'OutboxMark') @{ Id = [long]$row.Id; MailState = $mailState; MailTo = $(if ($to) { @($to) -join '; ' } else { $null }); TelemetryState = $telState; TripCount = [int]$trip.TripCount; FirstSeenUtc = $trip.FirstSeenUtc } 'nonquery'
|                }
|            } catch { $out.Failed++; & $Log 'WARN' ('guards    : event {0} could not be sent: {1}' -f $row.Id, $_.Exception.Message) }
|        }
|        & $Log 'INFO' ('guards    : {0} event(s) from the web app -- {1} mailed, {2} reported to Invardia' -f $out.Read, $out.Mailed, $out.Reported)
|    } catch { $out.Failed++; & $Log 'WARN' ('guards    : the guard outbox could not be read: {0}' -f $_.Exception.Message) }
|    [pscustomobject]$out
|}
|
|# =====================================================================================================================
|#  ADAPTERS -- PURE: one area's result -> the guard events it tripped (each a hashtable of Send-SIGuardEvent arguments).
|#  The engines call Invoke-SIGuardCalls with them, so "which guard tripped, with which numbers" is provable offline.
|# =====================================================================================================================
|function Invoke-SIGuardCalls {
|    <#
|        Sends each call (Send-SIGuardEvent arguments) with the shared extras (-Invoke, -Engine, ...). Never throws.
|        AUTO-HEAL (owner 2026-10-17): -Checked names the guards this step CHECKED (guard ids, or @{ GuardId; Subject; Values;
|        Detail }; a bare id takes -Subject) and -Complete whether the run was complete. Every checked guard that did not
|        trip records that it ran on this version, and clears its open episode when the run was complete and its values are
|        within their limits (Invoke-SIGuardHeal, SI-GuardHeal.ps1). Without -Checked nothing is cleared (as before).
|        Returns the trips' results (the clears are not among them).
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Calls, [hashtable]$Common = @{}, [AllowNull()][AllowEmptyCollection()][object[]]$Checked, [bool]$Complete = $false, [string]$Subject)
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($c in @($Calls)) {
|        if ($null -eq $c) { continue }
|        try {
|            $a = @{}; foreach ($k in @($Common.Keys)) { if ($null -ne $Common[$k]) { $a[$k] = $Common[$k] } }
|            foreach ($k in @($c.Keys)) { $a[$k] = $c[$k] }
|            $out.Add((Send-SIGuardEvent @a))
|        } catch { }
|    }
|    if ($PSBoundParameters.ContainsKey('Checked') -and @($Checked | Where-Object { $_ }).Count -and (Get-Command -Name Invoke-SIGuardHeal -ErrorAction SilentlyContinue)) {
|        try {
|            $hc = @{}; foreach ($k in @($Common.Keys)) { $hc[$k] = $Common[$k] }
|            if ($Subject) { $hc['Subject'] = $Subject }
|            $null = Invoke-SIGuardHeal -Checked $Checked -Calls @($Calls | Where-Object { $_ }) -Complete $Complete -Common $hc
|        } catch { }
|    }
|    $out.ToArray()
|}
|
|function Resolve-SIGuardEventInvoke {
|    <#
|        #735 -- the database a guard event is written to (cfg.GuardEvent, the Operations > Guards (safety checks) view): the -Invoke the step
|        handed in; else the process's guard seam ($global:SI_GuardInvoke); else the Pro database of this install
|        (-ProInvoke, default Get-SIGuardProInvoke -- none without a Pro database). A test session (-IsTest) never opens one.
|        $null = no database (Community): the event still goes to run health and the uplink. Never throws.
|    #>
|    param([scriptblock]$Invoke, [bool]$IsTest = $false, [scriptblock]$ProInvoke)
|    try {
|        if ($Invoke) { return $Invoke }
|        if ($IsTest) { return $null }
|        if ($global:SI_GuardInvoke -is [scriptblock]) { return $global:SI_GuardInvoke }
|        if (-not $ProInvoke) {
|            if (-not (Get-Command -Name Get-SIGuardProInvoke -ErrorAction SilentlyContinue)) { return $null }
|            $ProInvoke = { Get-SIGuardProInvoke }
|        }
|        $p = & $ProInvoke
|        if ($p -is [array]) { $p = @($p | Where-Object { $_ -is [scriptblock] }) | Select-Object -First 1 }
|        if ($p -is [scriptblock]) { return $p }
|    } catch { }
|    $null
|}
|
|function Get-SIGuardProInvoke {
|    <#
|        The Pro SETTINGS database's (sql, params, mode) seam for the guard rows -- the engine's own -Default when it already
|        points there (or no Pro database is configured), else one opened for SI_ProSqlServer / SI_ProSqlDatabase with the
|        engine's sign-in (New-SIDataSqlInvoke; #735 loaded here when the engine has not loaded it -- a collection job writes
|        its guard rows too). Remembered for the process. Never throws.
|    #>
|    param([scriptblock]$Default, [string]$Server, [string]$Database)
|    try {
|        $ps = [string]$global:SI_ProSqlServer; $pd = [string]$global:SI_ProSqlDatabase
|        if ($ps -and $pd -and -not ($ps -eq $Server -and $pd -eq $Database) -and -not ($global:SI_GuardProInvoke -is [scriptblock]) -and -not (Get-Command -Name New-SIDataSqlInvoke -ErrorAction SilentlyContinue)) {
|            $dsq = [System.IO.Path]::Combine($PSScriptRoot, 'data-sql', 'SI-DataSql.ps1')
|            if ([System.IO.File]::Exists($dsq)) { try { . $dsq } catch { } }
|        }
|        if (-not $ps -or -not $pd -or ($ps -eq $Server -and $pd -eq $Database)) { $inv = $Default }
|        elseif ($global:SI_GuardProInvoke -is [scriptblock]) { $inv = $global:SI_GuardProInvoke }
|        elseif (Get-Command -Name New-SIDataSqlInvoke -ErrorAction SilentlyContinue) {
|            $inv = New-SIDataSqlInvoke -Server $ps -Database $pd -AppId $global:SI_SPN_AppId -TenantId $global:SI_SPN_TenantId -CertThumbprint $global:SI_SPN_CertThumbprint
|            $global:SI_GuardProInvoke = $inv
|        } else { $inv = $null }
|        if ($inv -and -not ($global:SI_GuardInvoke -is [scriptblock])) { $global:SI_GuardInvoke = $inv }
|        return $inv
|    } catch { return $Default }
|}
|
|function Get-SIGuardCallsForVulnPlan {
|    <# The vulnerability connector: a halted plan (close ceiling, empty / collapsed snapshot, scope change, incomplete run)
|       -> one 'halted' event; else results not known to be complete that held closes -> one 'held' event. #>
|    param([Parameter(Mandatory)]$Plan, $Complete, [string]$Subject)
|    if ($Plan.Halted) {
|        $g = if ($Plan.PSObject.Properties['HaltGuard'] -and $Plan.HaltGuard) { [string]$Plan.HaltGuard } else { 'vuln.connector.run-incomplete' }
|        $held = if ($Plan.PSObject.Properties['HaltHeld']) { [long]$Plan.HaltHeld } else { 0 }
|        $vals = if ($Plan.PSObject.Properties['HaltValues']) { @($Plan.HaltValues) } else { @() }
|        return @(@{ GuardId = $g; Outcome = 'halted'; Subject = $Subject; Detail = ([string]$Plan.HaltReason -replace '^\[[A-Za-z]+\]\s*', ''); Values = $vals; HeldCount = $held })
|    }
|    if ($Complete -and -not $Complete.Complete) {
|        # #850: a paged run's plan carries the count (its pages' held records are never all held at once)
|        $n = if ($Plan.PSObject.Properties['HeldIncompleteCount']) { [long]$Plan.HeldIncompleteCount } else { @($Plan.Held | Where-Object { [string]$_.Reason -like 'this run was not complete*' }).Count }
|        if ($n -gt 0) {
|            return @(@{ GuardId = 'vuln.connector.snapshot-incomplete'; Outcome = 'held'; Subject = $Subject; HeldCount = $n
|                          Detail = ('The newest Risk Analysis results are not known to be complete ({0}), so {1} record(s) that would have closed stay open.' -f [string]$Complete.Reason, $n)
|                          Values = @(@{ Name = 'heldCloses'; Label = 'Closes held back'; Measured = $n }) })
|        }
|    }
|    @()
|}
|
|function Get-SIGuardCallsForCmdbSql {
|    <# The SQL CMDB connector: a refused or stale run -> one event, its guard told apart by the refusal's reason. #>
|    param([Parameter(Mandatory)]$Result)
|    $o = [string]$Result.Outcome; $why = [string]$Result.Reason
|    if ($o -eq 'stale') { return @(@{ GuardId = 'cmdb.sql.stale'; Outcome = 'skipped'; Detail = $why }) }
|    # UPLINK-FIX (customer G 2026-10-07): a first run whose correlation map has no results yet -- shown, a WARNING (no
|    # ticket, no critical mail), never a refusal: the CI table has nothing to protect yet and the next run fills it.
|    if ($o -eq 'pending') { return @(@{ GuardId = $(if ($why -match 'profile snapshot') { 'cmdb.sql.snapshot-incomplete' } else { 'cmdb.sql.no-correlation-map' }); Outcome = 'warning'; Detail = $why }) }
|    if ($o -ne 'refused') { return @() }
|    $desired = 0; if ($Result.Plan -and $Result.Plan.Summary) { $desired = [long]$Result.Plan.Summary.Desired }
|    $g = 'cmdb.sql.snapshot-incomplete'; $vals = @()
|    if ($why -match 'correlation map') { $g = 'cmdb.sql.no-correlation-map' }
|    elseif ($why -match 'holds no asset|no kind in scope') { $g = 'cmdb.sql.empty-snapshot'; $vals = @(@{ Name = 'assetsSeen'; Label = 'Assets seen'; Measured = 0 }) }
|    elseif ($why -match '^(\w+): (\d+) asset\(s\) seen against (\d+) active CI\(s\) -- below (\d+)') {
|        $g = 'cmdb.sql.collapse'
|        $vals = @(@{ Name = 'assetsSeen'; Label = ('Assets seen ({0})' -f $Matches[1]); Measured = [long]$Matches[2] }, @{ Name = 'activeCis'; Label = 'Active CIs'; Measured = [long]$Matches[3] },
|                  @{ Name = 'seenShare'; Label = 'Seen against active'; Measured = $(if ([long]$Matches[3]) { [Math]::Round(100.0 * [long]$Matches[2] / [long]$Matches[3], 1) } else { 0 }); Limit = [long]$Matches[4]; Unit = '%' })
|    }
|    @(@{ GuardId = $g; Outcome = 'refused'; Detail = $why; Values = $vals; HeldCount = $desired })
|}
|
|function Get-SIGuardCallsForServiceNowCmdb {
|    <# The ServiceNow CMDB connector: the instance unreachable (halted), assets refused by the create / match gates (held),
|       an incoherent service model (refused). #>
|    param($Result, [int]$ModelProblems = 0, [string[]]$ModelText = @())
|    $calls = New-Object System.Collections.Generic.List[object]
|    if ($ModelProblems -gt 0) {
|        $calls.Add(@{ GuardId = 'cmdb.servicenow.service-model'; Outcome = 'refused'; Detail = ('The service model has {0} problem(s): {1}' -f $ModelProblems, ((@($ModelText) | Select-Object -First 3) -join '; '))
|                      Values = @(@{ Name = 'modelProblems'; Label = 'Problems in the service model'; Measured = $ModelProblems }) })
|    }
|    if ($Result) {
|        if ($Result.Halted) { $calls.Add(@{ GuardId = 'cmdb.servicenow.unreachable'; Outcome = 'halted'; Detail = [string]$Result.HaltReason }) }
|        $review = @($Result.Review | Where-Object { $_ })
|        # #928: the data-out push hands in the reasons (a sample) and the COUNT of rows ServiceNow did not accept
|        $n = if ($Result.PSObject.Properties['ReviewCount'] -and $null -ne $Result.ReviewCount) { [long]$Result.ReviewCount } else { [long]$review.Count }
|        if ($n -gt 0) {
|            $why = (@($review | ForEach-Object { [string]$_.Reason } | Group-Object | Sort-Object Count -Descending | Select-Object -First 3 | ForEach-Object { '{0} x {1}' -f $_.Count, $_.Name })) -join '; '
|            $calls.Add(@{ GuardId = 'cmdb.servicenow.create-gate'; Outcome = 'held'; HeldCount = $n
|                          Detail = ('{0} asset(s) were not written to ServiceNow{1}' -f $n, $(if ($why) { ': ' + $why } else { '' }))
|                          Values = @(@{ Name = 'assetsHeld'; Label = 'Assets not written'; Measured = $n }, @{ Name = 'assetsSubmitted'; Label = 'Assets submitted'; Measured = [long]$Result.Submitted }) })
|        }
|    }
|    $calls.ToArray()
|}
|
|function ConvertTo-SIGuardServiceNowPushResult {
|    <#
|        PURE. #928 (the ServiceNow push moved to ONE route, the data-out connector): the push result of one ServiceNow
|        data-out session (Open-SIDataOutSnowSession ... Close-SIDataOutSnowSession) in the shape the ServiceNow CMDB guard
|        reads (Get-SIGuardCallsForServiceNowCmdb -Result): @{ Halted; HaltReason; Review; ReviewCount; Submitted; Reached }.
|          Halted     the check before the push could not reach the instance, or the instance refused the account (a
|                     connection problem of KIND 'setup' -- no connector switched on, no credential -- is the install's
|                     setup, said by the run and Data health, never "not reachable");
|          Review     the reasons ServiceNow gave for the rows its import did not accept (at most 50), ReviewCount their number;
|          Reached    the push reached ServiceNow (the guards' checks ran and may clear).
|    #>
|    param([Parameter(Mandatory)]$Session)
|    $get = { param($o, $n) if ($null -eq $o) { $null } elseif ($o -is [System.Collections.IDictionary]) { $o[$n] } elseif ($o.PSObject.Properties[$n]) { $o.$n } else { $null } }
|    $chk = & $get $Session 'Check'
|    $conn = & $get $chk 'Connection'
|    $halted = [bool]($conn -and ($conn.Ok -eq $false) -and ([string]$conn.Kind -ne 'setup'))
|    $errs = @(@(& $get $Session 'Errors') | Where-Object { $_ } | Select-Object -First 50 | ForEach-Object { [pscustomobject]@{ Reason = [string]$_ } })
|    $notAccepted = [long](& $get $Session 'NotAccepted')
|    [pscustomobject]@{
|        Halted      = $halted
|        HaltReason  = $(if ($halted) { [string]$conn.Text } else { '' })
|        Review      = $errs
|        ReviewCount = $notAccepted
|        Submitted   = [long](& $get $Session 'Sent')
|        Reached     = [bool]($conn -and $conn.Ok -eq $true)
|    }
|}
|
|function Get-SIGuardCallsForDataSync {
|    <# The Pro data sync: collections held because their run is not known to be complete -> one 'held' event. #>
|    param([Parameter(Mandatory)]$Result)
|    $calls = New-Object System.Collections.Generic.List[object]
|    $held = @($Result.Held)
|    if ($held.Count) {
|        $rows = 0L; foreach ($h in $held) { $rows += [long]$h.Rows }
|        # per collection: when, how many findings, and WHAT was incomplete in the words of its run (its run-health message)
|        $each = @($held | Sort-Object { $_.CollectionTime } | Select-Object -First 5 | ForEach-Object {
|            $why = if ($_.PSObject.Properties['RunDetail'] -and [string]$_.RunDetail) { [string]$_.RunDetail } else { [string]$_.Reason }
|            $when = if ($_.PSObject.Properties['CollectionTime'] -and $_.CollectionTime) { [string]::Format([Globalization.CultureInfo]::InvariantCulture, 'of {0:yyyy-MM-dd HH:mm} UTC ', [datetime]$_.CollectionTime) } else { '' }
|            [string]::Format([Globalization.CultureInfo]::InvariantCulture, 'the collection {0}({1:N0} findings): {2}', $when, [long]$_.Rows, $why) })
|        $calls.Add(@{ GuardId = 'datasync.collection.held'; Outcome = 'held'; HeldCount = $held.Count
|               Detail = ('{0} collection(s) were not loaded because the Risk Analysis run that produced them did not finish completely -- {1}' -f $held.Count, ($each -join '; '))
|               Values = @(@{ Name = 'collectionsHeld'; Label = 'Collections held'; Measured = $held.Count }, @{ Name = 'rowsHeld'; Label = 'Findings in them'; Measured = $rows }) })
|    }
|    # #294: snapshots that are never loaded -- rows without their finding id, or without a CollectionTime at all
|    $refused = @(); if ($Result.PSObject.Properties['Refused']) { $refused = @($Result.Refused | Where-Object { $_ }) }
|    $untimed = @(); if ($Result.PSObject.Properties['Untimed']) { $untimed = @($Result.Untimed | Where-Object { $_ }) }
|    if ($refused.Count -or $untimed.Count) {
|        $rRows = 0L; foreach ($r in $refused) { $rRows += [long]$r.Rows }
|        $uRows = 0L; foreach ($u in $untimed) { $uRows += [long]$u.Rows }
|        $parts = New-Object System.Collections.Generic.List[string]
|        foreach ($r in $refused) { $parts.Add(('{0:yyyy-MM-dd HH:mm} UTC: {1}' -f $r.CollectionTime, [string]$r.Reason)) }
|        if ($untimed.Count) {
|            $hours = (@($untimed | Sort-Object { $_.Hour } | ForEach-Object { '{0:yyyy-MM-dd HH:00} UTC' -f ([datetime]$_.Hour) }) | Select-Object -First 5) -join ', '
|            $parts.Add([string]::Format([Globalization.CultureInfo]::InvariantCulture, 'the Risk Analysis run around {0} wrote {1:N0} row(s) without their collection time (their key columns were lost on the way into Log Analytics), so they belong to no collection and cannot be placed in a day', $hours, $uRows))
|        }
|        # #414: ONE event per distinct cause -- each refused collection and each hour of rows without a collection time is a
|        # cause; a sync that sees only causes reported before reports nothing (they stay until they age out of the window)
|        $causeKeys = @(@($refused | ForEach-Object { Get-SIGuardCauseKey -Text ([string]::Format([Globalization.CultureInfo]::InvariantCulture, 'refused|{0:yyyy-MM-ddTHH:mm:ss}', [datetime]$_.CollectionTime)) }) +
|                       @($untimed | ForEach-Object { Get-SIGuardCauseKey -Text ([string]::Format([Globalization.CultureInfo]::InvariantCulture, 'untimed|{0:yyyy-MM-ddTHH}', [datetime]$_.Hour)) }))
|        $calls.Add(@{ GuardId = 'datasync.collection.refused'; Outcome = 'refused'; HeldCount = ($refused.Count + $untimed.Count); CauseKeys = $causeKeys
|               Detail = ('Risk Analysis data that is not loaded as a day: {0}' -f ((@($parts) | Select-Object -First 5) -join '; '))
|               Values = @(@{ Name = 'collectionsRefused'; Label = 'Collections refused'; Measured = $refused.Count }, @{ Name = 'rowsRefused'; Label = 'Findings in them'; Measured = $rRows },
|                          @{ Name = 'rowsWithoutTime'; Label = 'Rows without a collection time'; Measured = $uRows }) })
|    }
|    # #428: an asset kind the findings imply that arrived as 0 CIs, or CIs with findings and no kind (the 2026-10-07
|    # "azure (0)" class) -- one event per distinct cause (collection + kind), so a repeat sync reports nothing new
|    $kc = @(); if ($Result.PSObject.Properties['Loaded']) { $kc = @($Result.Loaded | Where-Object { $_ -and $_.PSObject.Properties['KindCoverage'] -and $null -ne $_.KindCoverage }) }
|    $kParts = New-Object System.Collections.Generic.List[string]; $kKeys = New-Object System.Collections.Generic.List[string]
|    $kDropped = 0; $kKindless = 0L
|    foreach ($l in $kc) {
|        $c = $l.KindCoverage; $when = [string]::Format([Globalization.CultureInfo]::InvariantCulture, '{0:yyyy-MM-ddTHH:mm:ss}', [datetime]$l.CollectionTime)
|        foreach ($k in @($c.Dropped)) {
|            $kDropped++
|            $kParts.Add([string]::Format([Globalization.CultureInfo]::InvariantCulture, 'the collection of {0:yyyy-MM-dd HH:mm} UTC has findings on {1:N0} {2} asset(s) but 0 CIs of kind {2}', [datetime]$l.CollectionTime, [long]$c.Implied[$k], $k))
|            $kKeys.Add((Get-SIGuardCauseKey -Text ('kind|{0}|{1}' -f $when, $k)))
|        }
|        if ([long]$c.Kindless -gt 0) {
|            $kKindless += [long]$c.Kindless
|            $kParts.Add([string]::Format([Globalization.CultureInfo]::InvariantCulture, 'the collection of {0:yyyy-MM-dd HH:mm} UTC has {1:N0} asset(s) with findings and no asset kind', [datetime]$l.CollectionTime, [long]$c.Kindless))
|            $kKeys.Add((Get-SIGuardCauseKey -Text ('kindless|{0}' -f $when)))
|        }
|    }
|    if ($kParts.Count) {
|        $calls.Add(@{ GuardId = 'datasync.asset.kind-dropped'; Outcome = 'warning'; HeldCount = $kParts.Count; CauseKeys = $kKeys.ToArray()
|               Detail = ('Findings the web app''s asset kind filter cannot show: {0}' -f ((@($kParts) | Select-Object -First 5) -join '; '))
|               Values = @(@{ Name = 'kindsDropped'; Label = 'Asset kinds stored as 0'; Measured = $kDropped }, @{ Name = 'assetsWithoutKind'; Label = 'Assets with no kind'; Measured = $kKindless }) })
|    }
|    $calls.ToArray()
|}
|
|function Get-SIGuardCallsForRowCount {
|    <# Risk Analysis: the row-count guard's findings (LARGE-DROP / WENT-TO-ZERO / MISSING) -> ONE event per run, listing
|       every report. #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Findings, [string]$Template)
|    # HANDED-OFF is informational: the findings moved to the receiving report (the guard itself says "moved, not lost").
|    # Measured in the 2.2 -> 3.0 upgrade test: it raised this warning on every upgraded install's first night.
|    # BELOW-THRESHOLD (#407) is not a loss either: a one-row threshold report whose count fell to or below its threshold
|    # (the run log carries it as a warning). Ring 1, 2026-10-06: it made the run partial after a PIM activation ended.
|    $f = @($Findings | Where-Object { $_ -and [string]$_.Kind -ne 'HANDED-OFF' -and [string]$_.Kind -ne 'BELOW-THRESHOLD' })
|    if (-not $f.Count) { return @() }
|    $words = @{ 'LARGE-DROP' = 'far fewer findings'; 'WENT-TO-ZERO' = 'no findings any more'; 'MISSING' = 'no result at all'
|                'HANDOFF-LOST' = 'left to a report that produced no result -- those findings are in no report' }
|    $list = @($f | ForEach-Object { $k = [string]$_.Kind; $w = if ($words.ContainsKey($k)) { $words[$k] } else { $k.ToLowerInvariant() }; '{0}: {1} -> {2} ({3})' -f $_.Report, $_.Previous, $(if ($null -eq $_.Current) { 'none' } else { $_.Current }), $w })
|    $prev = 0L; $curr = 0L; foreach ($x in $f) { $prev += [long]$x.Previous; if ($null -ne $x.Current) { $curr += [long]$x.Current } }
|    @(@{ GuardId = 'ra.output.row-drop'; Outcome = 'warning'; Subject = $Template
|           Detail = ('{0} report(s) produced far fewer findings than the previous run: {1}' -f $f.Count, ((@($list) | Select-Object -First 20) -join '; '))
|           Values = @(@{ Name = 'reports'; Label = 'Reports affected'; Measured = $f.Count }, @{ Name = 'findingsBefore'; Label = 'Findings in them before'; Measured = $prev }, @{ Name = 'findingsNow'; Label = 'Findings in them now'; Measured = $curr }) })
|}
|
|function Get-SIGuardCallsForColumnFill {
|    <# Risk Analysis: the column-fill guard's findings (COLUMN-EMPTIED / COLUMN-VANISHED) -> ONE event per run, listing
|       every report and column. #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Findings, [string]$Template)
|    $f = @($Findings | Where-Object { $_ })
|    if (-not $f.Count) { return @() }
|    $list = @($f | ForEach-Object { '{0}.{1} ({2})' -f $_.Report, $_.Column, $(if ([string]$_.Kind -eq 'COLUMN-VANISHED') { 'gone' } else { 'empty' }) })
|    @(@{ GuardId = 'ra.output.column-emptied'; Outcome = 'warning'; Subject = $Template
|           Detail = ('{0} column(s) lost their content since the previous run: {1}' -f $f.Count, ((@($list) | Select-Object -First 20) -join '; '))
|           Values = @(@{ Name = 'columns'; Label = 'Columns affected'; Measured = $f.Count }, @{ Name = 'reports'; Label = 'Reports affected'; Measured = @($f | ForEach-Object { $_.Report } | Select-Object -Unique).Count }) })
|}
|
|function Get-SIGuardCallsForFlow {
|    <# The daily job flow, for a run THIS wake-up started or resumed: a scheduled start that was missed (catch-up, held),
|       dependent steps skipped after a failure (skipped), interrupted steps (held).
|       NOT a trip: a wake-up while the flow is running (Busy -- the runner wakes every 5 minutes, so that is every wake-up
|       of a long run), and not due (Wait / Done).
|       NOT a trip either (owner 2026-10-12, "Quiet when runs are just long"): a start that was owed ONLY because the
|       previous run was still going at its scheduled time and that was made as soon as that run ended -- every run of an
|       install whose pipeline takes longer than its schedule's interval. The run's own note says so (the runner writes
|       it at the start: Get-SIJobFlowLateStart, 'started late because the previous run was still going'), so it is in the
|       run's record and on the pipeline page, and no guard event is raised.
|       STILL a trip: a scheduled start missed for any other reason (the note says 'scheduled start was missed': no run
|       was going and it started late all the same, or it did not start when the previous run ended), and a catch-up
|       whose note does not say why (a record written before the note said it). #>
|    param([Parameter(Mandatory)]$Result)
|    $calls = New-Object System.Collections.Generic.List[object]
|    if ($Result.PSObject.Properties['Outcome'] -and [string]$Result.Outcome -in @('Busy', 'Wait', 'Done')) { return @() }
|    # #700: a run CANCELLED on purpose (a person, the updater) is not a trip -- the cancel is on the audit trail with who and why
|    if ($Result.PSObject.Properties['State'] -and [string]$Result.State -eq 'Cancelled') { return @() }
|    $flowNote =if ($Result.PSObject.Properties['Note'] -and $Result.Note) { [string]$Result.Note } else { '' }
|    $onlyLongRun = $flowNote -match 'started late because the previous run'
|    $missedStart = $flowNote -match 'scheduled start was missed'
|    if ($missedStart -or ([string]$Result.Trigger -eq 'catch-up' -and -not $onlyLongRun)) {
|        $calls.Add(@{ GuardId = 'flow.run.catch-up'; Outcome = 'held'; Detail = $(if ($flowNote) { $flowNote } else { 'A scheduled start was held until the previous flow run finished.' }) })
|    }
|    $steps = @($Result.Steps)
|    # A step STOPPED FROM OUTSIDE (an update, a roll or a person stopped its execution: Interrupted, class 'stopped') is on
|    # purpose, like a cancelled run -- not a trip, and neither are the jobs skipped because the flow stopped there (owner
|    # 2026-10-23: no run may alert for nothing). Any other interruption or skip is still a trip.
|    $stoppedOnPurpose = @($steps | Where-Object { [string]$_.State -eq 'Interrupted' -and [string]$_.ErrorClass -eq 'stopped' }).Count -gt 0
|    # #306: 'stage-blocked' = a stage that did not start because the stage before it did not succeed
|    $skipped = @($steps | Where-Object { [string]$_.State -eq 'Skipped' -and [string]$_.ErrorClass -in @('needs-failed', 'flow-stopped', 'stage-blocked') -and -not ($stoppedOnPurpose -and [string]$_.ErrorClass -eq 'flow-stopped') })
|    # #532 THROTTLE-IS-NORMAL (framework §12.18): steps skipped because a step Microsoft THROTTLED did not complete are not a
|    # trip -- throttling is normal and is never mailed; the engine raises the one "stuck" alert when it cannot catch up.
|    # Every failure of the run throttled = none of its skips is mailed; else a skip that needed a throttled step is left out.
|    $throttledJobs = @($steps | Where-Object { [string]$_.State -eq 'Failed' -and [string]$_.ErrorClass -eq 'throttled' } | ForEach-Object { [string]$_.Job })
|    if ($throttledJobs.Count) {
|        $realFailures = @($steps | Where-Object { [string]$_.State -in @('Failed', 'TimedOut', 'Interrupted') -and -not ([string]$_.State -eq 'Failed' -and [string]$_.ErrorClass -eq 'throttled') })
|        if ($realFailures.Count -eq 0) { $skipped = @() }
|        else {
|            $skipped = @($skipped | Where-Object {
|                $s = $_; $byThrottle = $false
|                if ([string]$s.ErrorClass -eq 'needs-failed') { foreach ($j in $throttledJobs) { if ([string]$s.Error -like ('needs {0},*' -f $j)) { $byThrottle = $true; break } } }
|                -not $byThrottle
|            })
|        }
|    }
|    if ($skipped.Count) {
|        $calls.Add(@{ GuardId = 'flow.step.skipped'; Outcome = 'skipped'; HeldCount = $skipped.Count
|                      Detail = ('{0} job(s) were skipped: {1}' -f $skipped.Count, ((@($skipped | ForEach-Object { '{0} ({1})' -f $_.Job, $_.Error })) -join '; '))
|                      Values = @(@{ Name = 'stepsSkipped'; Label = 'Jobs skipped'; Measured = $skipped.Count }, @{ Name = 'steps'; Label = 'Jobs in the flow'; Measured = $steps.Count }) })
|    }
|    # working rule 4: a step whose container never ran the engine was started again; it did not start that time either.
|    # 'halted' when steps that need it were skipped (or the flow stopped there), else 'skipped' (only this step is missing).
|    $never = @($steps | Where-Object { [string]$_.State -eq 'Failed' -and [string]$_.ErrorClass -eq 'never-started' })
|    if ($never.Count) {
|        $jobs = @($never | ForEach-Object { [string]$_.Job })
|        $after = New-Object System.Collections.Generic.List[object]
|        foreach ($s in $steps) {
|            if ([string]$s.State -ne 'Skipped') { continue }
|            if ([string]$s.ErrorClass -eq 'flow-stopped') { $after.Add($s); continue }
|            if ([string]$s.ErrorClass -ne 'needs-failed') { continue }
|            foreach ($j in $jobs) { if ([string]$s.Error -like ('needs {0},*' -f $j)) { $after.Add($s); break } }
|        }
|        $calls.Add(@{ GuardId = 'flow.step.start-failed'; Outcome = $(if ($after.Count) { 'halted' } else { 'skipped' }); HeldCount = $never.Count; Subject = ($jobs -join ', ')
|                      Detail = ('{0} job(s) did not start, also not when started again: {1}{2}' -f $never.Count, ((@($never | ForEach-Object { '{0} ({1} attempts)' -f $_.Job, $(if ($_.PSObject.Properties['Attempts']) { [int]$_.Attempts } else { 1 }) })) -join '; '), $(if ($after.Count) { ('; {0} job(s) after it were skipped' -f $after.Count) } else { '' }))
|                      Values = @(@{ Name = 'stepsNotStarted'; Label = 'Jobs that did not start'; Measured = $never.Count }, @{ Name = 'stepsSkipped'; Label = 'Jobs skipped because of it'; Measured = $after.Count }) })
|    }
|    $int = @($steps | Where-Object { [string]$_.State -eq 'Interrupted' -and [string]$_.ErrorClass -ne 'stopped' })
|    if ($int.Count) {
|        $calls.Add(@{ GuardId = 'flow.step.interrupted'; Outcome = 'held'; HeldCount = $int.Count
|                      Detail = ('{0} job(s) were interrupted and not started again: {1}' -f $int.Count, ((@($int | ForEach-Object { [string]$_.Job })) -join ', '))
|                      Values = @(@{ Name = 'stepsInterrupted'; Label = 'Jobs interrupted'; Measured = $int.Count }) })
|    }
|    $calls.ToArray()
|}
|
|function Get-SIGuardHealth {
|    <# How many guard events this process recorded, and how many could not be (with the last reason). #>
|    if ($null -eq $global:SI_GuardHealth) { $global:SI_GuardHealth = @{ Events = 0; Failed = 0; LastError = '' } }
|    [pscustomobject]@{ Events = [int]$global:SI_GuardHealth.Events; Failed = [int]$global:SI_GuardHealth.Failed; LastError = [string]$global:SI_GuardHealth.LastError }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-MailTransport.ps1'] = @{ Sha256 = '6945650e8bbfe94d129db3daf129d5a7c0bd717eb1f74641545419995b1a40df'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT -- THE ONE MAIL TRANSPORT (MAIL-1). Every mail SecurityInsight sends goes through Send-SIMail:
|    the Risk Analysis report, the guard mails (Send-SIGuardMailDefault), the close-loop, exemption, sign-in, governance,
|    department and task-digest mails (Send-SICloseLoopMail) and the updater's licence mail. tests\pester\
|    SIv3-MailTransport.Tests.ps1 fails when any other file talks SMTP itself.
|
|    SI_Mail_Mode (the setting; install parameter mailMode):
|      sharedMailbox  Microsoft Graph app-only: POST /v1.0/users/{SI_Mail_From}/sendMail, as SecurityInsight's OWN
|                     identity (the job's managed identity in a container). The recommended mode for every new install.
|                     The send right is Exchange Online's 'Application Mail.Send' role scoped to that one mailbox (RBAC
|                     for Applications) -- and SecurityInsight REFUSES to send until it has verified the restriction
|                     (Get-SIMailRestriction), saying why.
|      smtp           your own relay (anonymous, or signed in; the password from Key Vault) -- RA-Mail.ps1's transports.
|      none           no mail.
|      not set        smtp when SmtpServer is set (an existing install keeps working on upgrade), else none.
|    SI_Mail_From      the shared mailbox; also the From for smtp (wins over SMTPFrom / MailFrom / SMTPUser).
|    SI_Mail_ProbeMailbox  a mailbox OUTSIDE the scope: sending as it must be refused, which proves the restriction.
|
|    Attachments with sharedMailbox: Graph takes an attachment inline in sendMail only up to ~3 MB (the whole request
|    at most 4 MB). A larger one would need an upload session, which needs Mail.ReadWrite on the mailbox -- a wider
|    right than Mail.Send. So a larger attachment is NOT sent: the mail goes without it and says where the file is
|    (the workbook stays on disk / in the export storage) -- the same trade the SMTP size guard makes.
|
|    PS 5.1 safe. No modules. Every network call goes through a seam (-Http, -TokenProvider) so the tests run offline.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope.
|
|$script:SIMailTransportRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|# MAIL-2 / #573: the one mail layout -- Send-SIMail formats every body with it (Format-SIMailBody)
|if (-not (Get-Command -Name Format-SIMailBody -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-MailLayout.ps1')) }
|# #574: the mail PDF -- Send-SIMail attaches one to every mail that reports something (New-SIMailPdf)
|if (-not (Get-Command -Name New-SIMailPdf -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-MailPdf.ps1')) }
|# #710: the line under a mail's summary that links the install's page in the Invardia portal (Add-SIInvardiaPortalLink)
|if (-not (Get-Command -Name Add-SIInvardiaPortalLink -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-InvardiaPortalLink.ps1')) }
|$script:SIMailGraphInlineMaxMb = 3
|$script:SIMailRestrictionCache = @{}
|$script:SIMailAllowedStates = @('verified', 'legacy-policy')
|
|function Get-SIMailSetting {
|    param([Parameter(Mandatory)][string]$Name, [System.Collections.IDictionary]$Globals)
|    if ($Globals) { if ($Globals.Contains($Name)) { return $Globals[$Name] }; return $null }
|    Get-Variable -Name $Name -Scope Global -ValueOnly -ErrorAction SilentlyContinue
|}
|
|function ConvertTo-SIMailFlag {
|    param($Value, [bool]$Default = $false)
|    if ($null -eq $Value) { return $Default }
|    if ($Value -is [bool]) { return $Value }
|    $s = "$Value".Trim()
|    if (-not $s) { return $Default }
|    switch -Regex ($s) { '^(?i)(1|true|yes|on|\$true)$' { return $true } '^(?i)(0|false|no|off|\$false)$' { return $false } }
|    $Default
|}
|
|function Resolve-SIMailMode {
|    <#
|        PURE. The mail mode from SI_Mail_Mode and, when it is not set, from SmtpServer (an existing install).
|        Returns @{ Mode = none | smtp | sharedMailbox; Source = setting | legacy-smtp | default; Problem }.
|    #>
|    param([AllowNull()]$Value, [AllowNull()][string]$SmtpServer)
|    $v = if ($null -eq $Value) { '' } else { "$Value".Trim() }
|    if ($v) {
|        switch -Regex ($v) {
|            '^(?i)(sharedmailbox|shared|graph|sharedmailbox365|o365)$' { return [pscustomobject]@{ Mode = 'sharedMailbox'; Source = 'setting'; Problem = $null } }
|            '^(?i)smtp$'                                               { return [pscustomobject]@{ Mode = 'smtp'; Source = 'setting'; Problem = $null } }
|            '^(?i)(none|off|disabled)$'                                { return [pscustomobject]@{ Mode = 'none'; Source = 'setting'; Problem = $null } }
|        }
|        return [pscustomobject]@{ Mode = 'none'; Source = 'setting'; Problem = ("SI_Mail_Mode '{0}' is not one of none, smtp, sharedMailbox" -f $v) }
|    }
|    if ("$SmtpServer".Trim()) { return [pscustomobject]@{ Mode = 'smtp'; Source = 'legacy-smtp'; Problem = $null } }
|    [pscustomobject]@{ Mode = 'none'; Source = 'default'; Problem = $null }
|}
|
|function Resolve-SIInstallMailMode {
|    <#
|        PURE. The install parameter: mailMode (sharedMailbox | smtp | none), else the older bool 'mail' (true = smtp,
|        false = none), else sharedMailbox (the default for a new install). Returns the mode.
|    #>
|    param([System.Collections.IDictionary]$Values)
|    $m = if ($Values -and $Values.Contains('mailMode')) { "$($Values['mailMode'])".Trim() } else { '' }
|    if ($m) { return (Resolve-SIMailMode -Value $m).Mode }
|    if ($Values -and $Values.Contains('mail') -and $null -ne $Values['mail']) { if (ConvertTo-SIMailFlag $Values['mail']) { return 'smtp' } else { return 'none' } }
|    'sharedMailbox'
|}
|
|function Test-SIMailAddress { param([string]$Value) "$Value".Trim() -match '^[^@\s]+@[^@\s]+\.[^@\s]+$' }
|
|function Get-SIMailEnvironment {
|    <#
|        PURE (reads -Globals, else the live settings; the VERSION file). WHICH environment a mail comes from -- every mail
|        names it in its subject and footer (MAIL-1; owner: "i cannot see which tenant it is wrong"). Never "this tenant".
|          Name     SIWeb_EnvironmentName (the web app header's name; Pro runs read it from the web app's settings), else
|                   SI_EnvironmentName, else the tenant's name (SIWeb_TenantName / SI_TenantDomain /
|                   TenantNameOrganization), else '' -- never an id (a GUID or the install id)
|          Display  '<Name> (ring <n>, PRO|COMMUNITY)' -- as the web app's header shows it; the footer and the PDF carry it,
|                   the SUBJECT carries the Name only (MAIL-3, #653: Get-SIMailSubject)
|          Tenant   SIWeb_TenantName / SI_TenantDomain / TenantNameOrganization / TenantShort, and the tenant id
|          Version  SecurityInsight's version; WebUrl  SIWeb_PublicBaseUrl
|          InvardiaEnvironmentId  #710: the install's environment in the Invardia portal (SI_InstallRingFacts
|                   .InvardiaEnvironment, recorded from Invardia's answer), '' when not known
|    #>
|    param([System.Collections.IDictionary]$Globals)
|    Initialize-SIMailTransportState
|    $g = { param($n) $v = Get-SIMailSetting -Name $n -Globals $Globals; if ($null -eq $v) { '' } else { "$v".Trim() } }
|    $first = { param([string[]]$names) foreach ($n in $names) { $v = & $g $n; if ($v) { return $v } }; '' }
|    # a subject never shows an id (support: "it shows tenant id" -- the install id GUID stood where the name belongs): the
|    # environment's name, else the tenant's name / primary domain; with neither, no name (the subject then has no
|    # bracket, the footer says "your SecurityInsight"). A value that is only an id (a GUID, an inv-... id) is never a name.
|    $isId = { param([string]$s) $s -match '^\{?[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\}?$' -or $s -eq (& $g 'SI_InstallId') }
|    $name = ''
|    foreach ($n in @('SIWeb_EnvironmentName', 'SI_EnvironmentName', 'SIWeb_TenantName', 'SI_TenantDomain', 'TenantNameOrganization')) {
|        $v = & $g $n; if ($v -and -not (& $isId $v)) { $name = $v; break }
|    }
|    $ring = & $g 'SI_UpdateRing'
|    $edition = if ((& $g 'SI_ProSqlServer') -or (& $g 'SI_Edition') -match '^(?i)pro$') { 'PRO' } else { 'COMMUNITY' }
|    $inside = @(@($(if ("$ring" -match '^\d$') { 'ring ' + $ring }), $edition) | Where-Object { $_ }) -join ', '
|    # #449: a name that already says it -- "Internal (ring 1, PRO)" on ring 1 -- is shown as it is: never "... (PRO)" twice
|    $display = if ($name -match '\([^()]*\)\s*$') { $name.Trim() } else { '{0} ({1})' -f $(if ($name) { $name } else { 'your SecurityInsight' }), $inside }
|    $tid = & $first @('SI_SPN_TenantId', 'SpnTenantId', 'AzureTenantId', 'HighPriv_Modern_TenantID', 'TenantId')
|    $tname = & $first @('SIWeb_TenantName', 'SI_TenantDomain', 'TenantNameOrganization', 'TenantShort')
|    $ver = & $g 'SI_Version'
|    if (-not $ver) { try { $vf = [IO.Path]::Combine($script:SIMailTransportRoot, 'VERSION'); if (Test-Path -LiteralPath $vf) { $ver = ([IO.File]::ReadAllText($vf)).Trim() } } catch { } }
|    $web = (& $g 'SIWeb_PublicBaseUrl').TrimEnd('/')
|    $envId = ''
|    try { if (Get-Command -Name Get-SIInvardiaEnvironmentIdKnown -ErrorAction SilentlyContinue) { $envId = Get-SIInvardiaEnvironmentIdKnown -Facts (Get-SIMailSetting -Name 'SI_InstallRingFacts' -Globals $Globals) } } catch { $envId = '' }
|    [pscustomobject]@{ Name = $name; Display = $display; Ring = "$ring"; Edition = $edition; TenantName = $tname; TenantId = $tid
|                       Solution = 'SecurityInsight'; Version = $ver; WebUrl = $(if ($web -match '^https://') { $web } else { '' }); InvardiaEnvironmentId = $envId }
|}
|
|# MAIL-3 (#653): one subject format for every mail SecurityInsight sends
|$script:SIMailProduct = 'SecurityInsight'
|$script:SIMailSubjectMax = 120
|$script:SIMailSubjectEnvMax = 48
|
|# THE TRANSPORT'S OWN VALUES, also when this file was loaded in another scope than the function that runs (live 2026-11-01:
|# the close-loop mail's technical review threw "Substring ... length (-3)" -- $script:SIMailSubjectEnvMax was empty where
|# Get-SIMailSubjectEnvironment ran). Every function that reads them calls this first; a value already set is kept.
|function Initialize-SIMailTransportState {
|    if ($null -eq $script:SIMailTransportRoot) { $script:SIMailTransportRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot) }
|    if ($null -eq $script:SIMailGraphInlineMaxMb) { $script:SIMailGraphInlineMaxMb = 3 }
|    if ($null -eq $script:SIMailRestrictionCache) { $script:SIMailRestrictionCache = @{} }
|    if ($null -eq $script:SIMailAllowedStates) { $script:SIMailAllowedStates = @('verified', 'legacy-policy') }
|    if ($null -eq $script:SIMailProduct) { $script:SIMailProduct = 'SecurityInsight' }
|    if ($null -eq $script:SIMailSubjectMax) { $script:SIMailSubjectMax = 120 }
|    if ($null -eq $script:SIMailSubjectEnvMax) { $script:SIMailSubjectEnvMax = 48 }
|    if ($null -eq $script:SIMailForwardSentinels) { $script:SIMailForwardSentinels = @('false', 'none', 'n/a', 'na', 'null', 'nil', 'no', '0', '-', '--', 'empty') }
|}
|
|function ConvertTo-SIMailSeverityWord {
|    <# PURE. The subject's severity word from a -Severity value: 'Failed' | 'Warning' | 'Action needed' | '' (none). #>
|    param([AllowNull()][AllowEmptyString()][string]$Severity)
|    switch -Regex ("$Severity".Trim()) {
|        '^(?i)fail(ed|ure)?$'            { return 'Failed' }
|        '^(?i)warn(ing)?$'               { return 'Warning' }
|        '^(?i)action[\s_-]*(needed)?$'   { return 'Action needed' }
|    }
|    ''
|}
|
|function Get-SIMailSubjectEnvironment {
|    <#
|        PURE. The environment as the subject names it: the NAME the web app's header shows (Get-SIMailEnvironment .Name),
|        never the ring or the edition (the owner: only the name; they stay in the footer). A name that carries them itself
|        ('Internal (ring 1, PRO)') loses that part here; brackets are taken out (they would break the format).
|    #>
|    param($Environment)
|    Initialize-SIMailTransportState
|    if (-not $Environment) { return '' }
|    $n = "$($Environment.Name)".Trim()
|    if (-not $n -and -not $Environment.PSObject.Properties['Name']) { $n = "$($Environment.Display)".Trim() }
|    # never an id in a subject (a GUID-shaped name, from an older setting or caller)
|    if ($n -match '^\{?[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\}?$') { $n = '' }
|    $n = ($n -replace '(?i)\s*\([^()]*\b(ring\s*\d|pro|community)\b[^()]*\)\s*$', '').Trim()
|    $n = ($n -replace '[\[\]]', '').Trim()
|    if ($n.Length -gt $script:SIMailSubjectEnvMax) { $n = $n.Substring(0, $script:SIMailSubjectEnvMax - 3).TrimEnd() + '...' }
|    $n
|}
|
|function Get-SIMailSubject {
|    <#
|        PURE. THE ONE PLACE that builds a mail's whole subject (MAIL-3, #653):
|            [<Environment>] <severity word: if relevant><what happened> [<ticket if any>] [SecurityInsight]
|        - <Environment>   the web app header's name (Get-SIMailSubjectEnvironment) -- no ring, no edition
|        - severity word   -Severity (Failed | Warning | ActionNeeded), else a leading 'Failed:' / 'Warning:' /
|                          'Action needed:' the sender wrote itself; none for reports, digests and information mails
|        - <what happened> the sender's text, with a leading product name taken out ('SecurityInsight <middle dot> ',
|                          'SecurityInsight -- ', 'SecurityInsight: ', 'Security Insights | ' ...): the product is named once,
|                          at the end. Mails the web app queued in SQL come through here too, so a row queued by an older
|                          web app is put right as it is sent.
|        - at most -MaxLength (120) characters: ONLY <what happened> is shortened, with '...'; the brackets, the severity
|          word and the ticket are always kept.
|        - idempotent: a subject already in the format is returned as it is (never wrapped twice).
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Subject, $Environment,
|          [AllowNull()][AllowEmptyString()][string]$Severity, [AllowNull()][AllowEmptyString()][string]$Ticket, [int]$MaxLength = 0)
|    Initialize-SIMailTransportState
|    if ($MaxLength -le 0) { $MaxLength = $script:SIMailSubjectMax }
|    $product = ' [' + $script:SIMailProduct + ']'
|    $name = Get-SIMailSubjectEnvironment -Environment $Environment
|    $prefix = if ($name) { '[' + $name + '] ' } else { '' }
|    $word = ConvertTo-SIMailSeverityWord $Severity
|    $t = "$Ticket".Trim().Trim('[', ']').Trim()
|    $s = ([string]$Subject -replace '[\r\n\t]+', ' ').Trim()
|    # already in the format: never wrapped twice
|    if ($s.EndsWith($product) -and $s.Length -le $MaxLength -and (-not $prefix -or $s.StartsWith($prefix)) -and
|        (-not $word -or $s.StartsWith($prefix + $word + ':')) -and (-not $t -or $s.Contains('[' + $t + ']'))) { return $s }
|    # take the subject apart: product, environment (also the older '[<Name> (ring n, PRO)] ' one), ticket
|    if ($s.EndsWith($product)) { $s = $s.Substring(0, $s.Length - $product.Length).TrimEnd() }
|    $old = if ($Environment) { "$($Environment.Display)".Trim() } else { '' }
|    if ($prefix -and $s.StartsWith($prefix)) { $s = $s.Substring($prefix.Length).TrimStart() }
|    elseif ($old -and $s.StartsWith('[' + $old + '] ')) { $s = $s.Substring($old.Length + 3).TrimStart() }
|    if ($t -and $s.EndsWith('[' + $t + ']')) { $s = $s.Substring(0, $s.Length - $t.Length - 2).TrimEnd() }
|    # the product is named once, at the end (separators: middle dot, bar, colon, hyphen(s), en / em dash -- written as
|    # [char] so this file stays plain ASCII)
|    $dot = [string][char]0x00B7; $en = [string][char]0x2013; $em = [string][char]0x2014
|    $s = $s -replace ('^(?i)Security\s?Insights?(\s+Pro)?\s*(' + $dot + '|\||:|-{1,2}|' + $en + '|' + $em + ')\s*'), ''
|    $s = $s -replace '^(?i)SecurityInsight\s+(?=test mail$)', ''
|    # a severity word the sender wrote first
|    $m = [regex]::Match($s, ('^(?i)(Failed|Warning|Action needed)\s*(:|-{1,2}|' + $en + ')\s*'))
|    if ($m.Success) { if (-not $word) { $word = ConvertTo-SIMailSeverityWord $m.Groups[1].Value }; $s = $s.Substring($m.Length) }
|    $s = $s.Trim()
|    if (-not $s) { $s = 'Notification' }
|    $s = $s.Substring(0, 1).ToUpperInvariant() + $s.Substring(1)
|    $sev = if ($word) { $word + ': ' } else { '' }
|    $tail = $(if ($t) { ' [' + $t + ']' } else { '' }) + $product
|    $room = $MaxLength - $prefix.Length - $sev.Length - $tail.Length
|    if ($s.Length -gt $room) { $keep = [Math]::Max(1, $room - 3); $s = $s.Substring(0, [Math]::Min($keep, $s.Length)).TrimEnd() + '...' }
|    $prefix + $sev + $s + $tail
|}
|
|function Get-SIMailFooterHtml {
|    <# PURE. The footer every mail carries: environment, tenant name + id, solution + version, the web app's link. #>
|    param([Parameter(Mandatory)]$Environment)
|    $e = { param($s) [System.Net.WebUtility]::HtmlEncode([string]$s) }
|    $tenant = if ($Environment.TenantName -and $Environment.TenantId) { '{0} ({1})' -f $Environment.TenantName, $Environment.TenantId }
|              elseif ($Environment.TenantId) { $Environment.TenantId } elseif ($Environment.TenantName) { $Environment.TenantName } else { 'not recorded' }
|    $parts = @(
|        ('Environment: <b>{0}</b>' -f (& $e $Environment.Display))
|        ('Tenant: {0}' -f (& $e $tenant))
|        ('{0}{1}' -f (& $e $Environment.Solution), $(if ($Environment.Version) { ' v' + (& $e $Environment.Version) } else { '' }))
|    )
|    if ($Environment.WebUrl) { $parts += ('<a href="{0}" style="color:#2c5a8e;">{0}</a>' -f (& $e $Environment.WebUrl)) }
|    '<div data-si-mail-footer style="margin-top:16px;padding:8px 12px;border-top:1px solid #e0e6ed;font-family:Segoe UI,Arial,sans-serif;font-size:11px;color:#5a6a7a;">' + ($parts -join ' &middot; ') + '</div>'
|}
|
|function Add-SIMailFooter {
|    <# PURE. The footer, inside </body> when the mail is a full HTML document, else at the end. Added once. #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$BodyHtml, [Parameter(Mandatory)]$Environment)
|    if ($BodyHtml -match 'data-si-mail-footer') { return $BodyHtml }
|    $f = Get-SIMailFooterHtml -Environment $Environment
|    $i = $BodyHtml.LastIndexOf('</body>', [StringComparison]::OrdinalIgnoreCase)
|    if ($i -ge 0) { return $BodyHtml.Substring(0, $i) + $f + $BodyHtml.Substring($i) }
|    $BodyHtml + $f
|}
|
|function Add-SIMailSourceNote {
|    <# PURE. The source note(s) -- "Endpoint data is from ... -- the last collection from that source did not complete." --
|       as one paragraph at the end of the mail's body (inside </body> when it is a full HTML document; the footer follows).
|       Added once; no notes = the body unchanged. The text is encoded here. #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$BodyHtml, [AllowEmptyCollection()][string[]]$Notes = @())
|    $lines = @($Notes | Where-Object { "$_".Trim() })
|    if (-not $lines.Count -or $BodyHtml -match 'data-si-source-note') { return $BodyHtml }
|    $enc = @($lines | ForEach-Object { [System.Net.WebUtility]::HtmlEncode([string]$_) }) -join '<br>'
|    $p = '<p data-si-source-note="1" style="font-family:Segoe UI,Arial,sans-serif;font-size:13px;line-height:1.5;color:#8a4b00;background:#fff4e0;border-left:4px solid #d98a00;padding:8px 12px;margin:12px 24px;">' + $enc + '</p>'
|    $i = $BodyHtml.LastIndexOf('</body>', [StringComparison]::OrdinalIgnoreCase)
|    if ($i -ge 0) { return $BodyHtml.Substring(0, $i) + $p + $BodyHtml.Substring($i) }
|    $BodyHtml + $p
|}
|
|function Get-SIMailSettings {    <#
|        PURE (reads -Globals, else the live $global: settings). Everything a sender needs, for either mode:
|        @{ Mode; ModeSource; Off; From; SharedMailbox; ProbeMailbox; Server; Port; UseSsl; From; Anonymous; User; Password;
|           Problems }. Off = mail is switched off on purpose (SI_Mail_Mode = none): nothing is sent and that is not a
|        failure. A mode that is not set up has Problems (said, never guessed).
|        Kept property-compatible with the older relay object (Get-SIGuardSmtp / Get-SICloseLoopMailSmtp return it).
|    #>
|    param([System.Collections.IDictionary]$Globals)
|    Initialize-SIMailTransportState
|    $g = { param($n) Get-SIMailSetting -Name $n -Globals $Globals }
|    $problems = New-Object System.Collections.Generic.List[string]
|    $server = "$(& $g 'SmtpServer')".Trim()
|    $mode = Resolve-SIMailMode -Value (& $g 'SI_Mail_Mode') -SmtpServer $server
|    if ($mode.Problem) { $problems.Add($mode.Problem) }
|    $useSsl = ConvertTo-SIMailFlag (& $g 'SMTP_UseSSL')
|    $portRaw = "$(& $g 'SMTPPort')".Trim()
|    $port = if ($portRaw -match '^\d+$') { [int]$portRaw } elseif ($useSsl) { 587 } else { 25 }
|    $mailFrom = "$(& $g 'SI_Mail_From')".Trim()
|    $from = $mailFrom
|    if (-not $from) { foreach ($n in 'SMTPFrom', 'MailFrom', 'SMTPUser') { $v = "$(& $g $n)".Trim(); if ($v) { $from = $v; break } } }
|    $user = "$(& $g 'SMTPUser')".Trim()
|    $passRaw = & $g 'SMTPPassword'
|    $pass = if ($passRaw -is [securestring]) { (New-Object System.Management.Automation.PSCredential ('x', $passRaw)).GetNetworkCredential().Password } else { "$passRaw" }
|    $cred = & $g 'SecureCredentialsSMTP'
|    if ($cred -is [System.Management.Automation.PSCredential]) { $user = $cred.UserName; $pass = $cred.GetNetworkCredential().Password }
|    $anonRaw = & $g 'Mail_SendAnonymous'
|    $anon = ConvertTo-SIMailFlag $anonRaw
|    $probe = "$(& $g 'SI_Mail_ProbeMailbox')".Trim()
|    $off = $false
|    switch ($mode.Mode) {
|        'smtp' {
|            if (-not $server) { $problems.Add('no mail server is configured (SmtpServer)') }
|            if (-not $from) { $problems.Add('no sender address is configured (SI_Mail_From or SMTPFrom)') }
|            if (-not $anon) {
|                $explicitOff = ($null -ne $anonRaw -and "$anonRaw".Trim() -ne '')
|                if (-not $user -and -not $pass -and -not $explicitOff) { $anon = $true }
|                elseif (-not $user -or -not $pass) {
|                    $missing = @(@(@{ n = 'SMTPUser'; v = $user }, @{ n = 'SMTPPassword'; v = $pass }) | Where-Object { -not $_.v } | ForEach-Object { $_.n }) -join ' and '
|                    $problems.Add(("authenticated SMTP is configured but {0} is empty -- store the password in Key Vault (secret SI-Smtp-Password, setup\Set-SIMail.ps1 -Mode smtp) and re-run setup, or set Mail_SendAnonymous = true for an anonymous relay" -f $missing))
|                }
|            }
|        }
|        'sharedMailbox' {
|            if (-not $mailFrom) { $problems.Add('no shared mailbox is configured (SI_Mail_From) -- run setup\Set-SIMail.ps1 or Settings > E-mail > Set up mail') }
|            elseif (-not (Test-SIMailAddress $mailFrom)) { $problems.Add(("SI_Mail_From '{0}' is not a mail address" -f $mailFrom)) }
|            $from = $mailFrom
|        }
|        default {
|            if ($mode.Source -eq 'setting' -and -not $mode.Problem) { $off = $true }
|            elseif (-not $mode.Problem) { $problems.Add('mail is not set up (no SI_Mail_Mode, and no SmtpServer) -- run setup\Set-SIMail.ps1, or Settings > E-mail > Set up mail') }
|        }
|    }
|    $maxMb = 24
|    $mm = & $g 'SI_MaxMailAttachmentMB'
|    if ("$mm" -match '^\d+(\.\d+)?$' -and [double]$mm -gt 0) { $maxMb = [double]$mm }
|    if ($mode.Mode -eq 'sharedMailbox') { $maxMb = [Math]::Min($maxMb, $script:SIMailGraphInlineMaxMb) }
|    [pscustomobject]@{
|        Mode = $mode.Mode; ModeSource = $mode.Source; Off = [bool]$off
|        Server = $server; Port = $port; UseSsl = [bool]$useSsl; From = $from; Anonymous = [bool]$anon; User = $user; Password = $pass
|        SharedMailbox = $(if ($mode.Mode -eq 'sharedMailbox') { $mailFrom } else { '' }); ProbeMailbox = $probe
|        Attestation = "$(& $g 'SI_Mail_RestrictionAttestation')".Trim()
|        MaxAttachmentMb = $maxMb
|        Environment = (Get-SIMailEnvironment -Globals $Globals)
|        Problems = $problems.ToArray()
|    }
|}
|
|function Get-SIMailAttachmentPlan {
|    <#
|        PURE (reads file sizes). Which attachments go with the mail: the encoded size (base64, ~37% more) of ALL of them
|        together must stay within -MaxMb (sharedMailbox: 3 MB, Graph's inline limit; smtp: the relay budget). A file that
|        does not fit is left out, largest first kept out. Returns @{ Include; Dropped (@{ Path; DiskMb; EncodedMb }); MaxMb }.
|    #>
|    param([string[]]$Paths = @(), [double]$MaxMb = 24, [scriptblock]$SizeOf = { param($p) (Get-Item -LiteralPath $p).Length })
|    $inc = New-Object System.Collections.Generic.List[string]; $drop = New-Object System.Collections.Generic.List[object]
|    $budget = $MaxMb * 1MB; $used = 0.0
|    foreach ($p in @($Paths | Where-Object { "$_".Trim() })) {
|        $size = [double](& $SizeOf $p); $enc = $size * 1.37
|        if ($used + $enc -le $budget) { $inc.Add($p); $used += $enc }
|        else { $drop.Add([pscustomobject]@{ Path = $p; DiskMb = [Math]::Round($size / 1MB, 1); EncodedMb = [Math]::Round($enc / 1MB, 1) }) }
|    }
|    [pscustomobject]@{ Include = $inc.ToArray(); Dropped = $drop.ToArray(); MaxMb = $MaxMb }
|}
|
|function New-SIGraphSendMailBody {
|    <#
|        PURE. The Graph sendMail request: HTML body, To / Cc, importance, attachments as fileAttachment (base64), not
|        saved to Sent Items. -Attachments = @(@{ Name; ContentType; Bytes }).
|    #>
|    param([Parameter(Mandatory)][string[]]$To, [string[]]$Cc = @(), [Parameter(Mandatory)][string]$Subject, [Parameter(Mandatory)][AllowEmptyString()][string]$BodyHtml,
|          [ValidateSet('Normal', 'High', 'Low')][string]$Priority = 'Normal', [object[]]$Attachments = @(), [bool]$SaveToSentItems = $false)
|    $rcp = { param($list) , @(@($list) | Where-Object { "$_".Trim() } | ForEach-Object { @{ emailAddress = @{ address = "$_".Trim() } } }) }
|    $msg = [ordered]@{
|        subject      = $Subject
|        body         = [ordered]@{ contentType = 'HTML'; content = $BodyHtml }
|        toRecipients = (& $rcp $To)
|        importance   = $Priority.ToLowerInvariant()
|    }
|    $cc2 = & $rcp $Cc
|    if (@($cc2).Count) { $msg.ccRecipients = $cc2 }
|    if (@($Attachments).Count) {
|        $msg.attachments = @(@($Attachments) | ForEach-Object {
|            [ordered]@{ '@odata.type' = '#microsoft.graph.fileAttachment'; name = [string]$_.Name
|                        contentType = $(if ($_.ContentType) { [string]$_.ContentType } else { 'application/octet-stream' })
|                        contentBytes = [Convert]::ToBase64String([byte[]]$_.Bytes) } })
|    }
|    [ordered]@{ message = $msg; saveToSentItems = $SaveToSentItems }
|}
|
|function Get-SIMailContentType {
|    param([string]$Path)
|    switch -Regex ([IO.Path]::GetExtension("$Path").ToLowerInvariant()) {
|        '^\.xlsx$' { 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet' }
|        '^\.pptx$' { 'application/vnd.openxmlformats-officedocument.presentationml.presentation' }
|        '^\.csv$'  { 'text/csv' }
|        '^\.json$' { 'application/json' }
|        '^\.html?$' { 'text/html' }
|        '^\.pdf$'  { 'application/pdf' }
|        default    { 'application/octet-stream' }
|    }
|}
|
|function Invoke-SIMailHttp {
|    <# The default HTTP seam: POST JSON, never throws on a status code. Returns @{ StatusCode; Body }. #>
|    param([Parameter(Mandatory)][string]$Uri, [Parameter(Mandatory)][string]$Token, [Parameter(Mandatory)]$Body, [int]$TimeoutSec = 120)
|    Add-Type -AssemblyName System.Net.Http -ErrorAction SilentlyContinue
|    $client = New-Object System.Net.Http.HttpClient
|    try {
|        $client.Timeout = [TimeSpan]::FromSeconds($TimeoutSec)
|        $req = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Post, $Uri)
|        [void]$req.Headers.TryAddWithoutValidation('Authorization', 'Bearer ' + $Token)
|        $json = ConvertTo-Json -InputObject $Body -Depth 12 -Compress
|        $content = New-Object System.Net.Http.ByteArrayContent(, [Text.Encoding]::UTF8.GetBytes($json))
|        $content.Headers.Remove('Content-Type') | Out-Null
|        [void]$content.Headers.TryAddWithoutValidation('Content-Type', 'application/json; charset=utf-8')
|        $req.Content = $content
|        $resp = $client.SendAsync($req).GetAwaiter().GetResult()
|        $text = ''; if ($resp.Content) { $text = $resp.Content.ReadAsStringAsync().GetAwaiter().GetResult() }
|        [pscustomobject]@{ StatusCode = [int]$resp.StatusCode; Body = $text }
|    } finally { $client.Dispose() }
|}
|
|function Get-SIMailGraphToken {
|    <# SecurityInsight's own Graph token: the run's identity (managed identity in a container), else Get-SIGraphToken. #>
|    if (-not (Get-Command -Name Get-SIAzureToken -ErrorAction SilentlyContinue)) {
|        $restFile = [IO.Path]::Combine($script:SIMailTransportRoot, 'engine', '_shared', 'SI-AzRest.ps1')
|        $li = [IO.Path]::Combine($script:SIMailTransportRoot, 'engine', '_shared', 'SI-LogIngest.ps1')
|        if ((Test-Path -LiteralPath $restFile) -and (Test-Path -LiteralPath $li)) { . $li; . $restFile }
|    }
|    if (Get-Command -Name Get-SIAzureToken -ErrorAction SilentlyContinue) { return (Get-SIAzureToken -Audience Graph) }
|    if (Get-Command -Name Get-SIGraphToken -ErrorAction SilentlyContinue) { return (Get-SIGraphToken) }
|    throw 'no Microsoft Graph token: SecurityInsight''s sign-in is not loaded'
|}
|
|function Get-SIMailGraphError {
|    <# PURE. @{ Code; Message } from a Graph error body. #>
|    param([string]$Body)
|    Initialize-SIMailTransportState
|    try { $e = (ConvertFrom-Json -InputObject $Body).error; return [pscustomobject]@{ Code = [string]$e.code; Message = [string]$e.message } } catch { }
|    [pscustomobject]@{ Code = ''; Message = "$Body" }
|}
|
|function Get-SIMailProbeVerdict {
|    <#
|        PURE. The answer to a probe -- sendMail as a mailbox with NO recipient, so nothing can be delivered:
|          allowed    400 ErrorInvalidRecipients (or 202): the identity MAY send as that mailbox -- the request got past
|                     authorization and failed only on the missing recipient
|          denied     401 / 403 (ErrorAccessDenied): it may not
|          not-found  404 / ErrorInvalidUser: no such mailbox
|          error      anything else
|    #>
|    param([int]$StatusCode, [string]$Body)
|    $e = Get-SIMailGraphError -Body $Body
|    if ($StatusCode -eq 202) { return 'allowed' }
|    if ($StatusCode -eq 400 -and ("$($e.Code)" -match '(?i)InvalidRecipients' -or "$($e.Message)" -match '(?i)recipient')) { return 'allowed' }
|    if ($StatusCode -in 401, 403 -or "$($e.Code)" -match '(?i)AccessDenied|Authorization_RequestDenied') { return 'denied' }
|    if ($StatusCode -eq 404 -or "$($e.Code)" -match '(?i)InvalidUser|ResourceNotFound|MailboxNotEnabled') { return 'not-found' }
|    'error'
|}
|
|function Get-SIMailRestrictionVerdict {
|    <#
|        PURE. Is SecurityInsight's send right restricted to the shared mailbox? From: whether its Graph token carries a
|        tenant-wide Mail.Send (roles claim), the probe as the shared mailbox (-Self) and as another mailbox (-Other, empty
|        when there is none), and an Exchange administrator's attestation. Returns @{ State; Detail; AllowsSend }:
|          verified       may send as the shared mailbox, may NOT send as another one (RBAC for Applications)
|          legacy-policy  the same, but through a tenant-wide Mail.Send that an Application Access Policy restricts --
|                         works; move to RBAC for Applications
|          unrestricted   may send as another mailbox -- REFUSED, in red
|          not-granted    may not send as the shared mailbox yet (role assignment missing, or not active yet)
|          unverified     (no longer answered when the identity holds no tenant-wide Mail.Send: see below)
|        Owner 2026-10-19 ("you cannot do that. we need a generic fix for this"): an identity WITHOUT the tenant-wide Graph
|        Mail.Send (roles claim) that may send as the shared mailbox can only send through Exchange's role scoped to that
|        mailbox -- that IS the restriction, proved by the token itself: 'verified', no probe mailbox needed. A probe mailbox
|        stays an extra proof; a probe that cannot be used (e.g. it does not exist) never blocks sending, it adds a note.
|          error          a probe failed in a way that says nothing
|    #>
|    param([bool]$TokenHasMailSend, [string]$Self, [string]$Other, [string]$Mailbox, [string]$ProbeMailbox, [string]$Attestation)
|    Initialize-SIMailTransportState
|    $s = { param($st, $d) [pscustomobject]@{ State = $st; Detail = $d; AllowsSend = ($script:SIMailAllowedStates -contains $st) } }
|    if ($Self -eq 'not-found') { return (& $s 'not-granted' ("the mailbox {0} does not exist (or is not a mailbox)" -f $Mailbox)) }
|    if ($Self -eq 'denied') { return (& $s 'not-granted' ("SecurityInsight may not send as {0} yet: Exchange's 'Application Mail.Send' role assignment for its identity is missing or not active yet (it can take up to 2 hours) -- setup\Set-SIMail.ps1" -f $Mailbox)) }
|    if ($Self -ne 'allowed') { return (& $s 'error' ("the send right on {0} could not be checked" -f $Mailbox)) }
|    if ($Other -eq 'allowed') {
|        $why = if ($TokenHasMailSend) { 'its identity holds the tenant-wide Microsoft Graph permission Mail.Send -- remove it (setup\Set-SIMail.ps1 -Apply does)' } else { 'its Exchange role assignment is not scoped to the shared mailbox' }
|        return (& $s 'unrestricted' ("Mail.Send is not restricted to the shared mailbox: SecurityInsight could also send as {0}; {1}" -f $ProbeMailbox, $why))
|    }
|    if ($Other -eq 'denied') {
|        if ($TokenHasMailSend) { return (& $s 'legacy-policy' ("restricted to {0} by an Application Access Policy (the older way) -- move to Exchange RBAC for Applications (setup\Set-SIMail.ps1)" -f $Mailbox)) }
|        return (& $s 'verified' ("restricted to {0}: sending as {1} is refused" -f $Mailbox, $ProbeMailbox))
|    }
|    if ($TokenHasMailSend) { return (& $s 'unrestricted' 'SecurityInsight''s identity holds the tenant-wide Microsoft Graph permission Mail.Send and no other mailbox proved it restricted -- remove it (setup\Set-SIMail.ps1 -Apply does)') }
|    if ("$Attestation".Trim()) { return (& $s 'verified' ("restricted to {0} (confirmed by the Exchange administrator: {1})" -f $Mailbox, "$Attestation".Trim())) }
|    # no tenant-wide Mail.Send + allowed as the shared mailbox: the only send right is the role scoped to that mailbox
|    $d = "restricted by Exchange RBAC for Applications: the identity holds no tenant-wide Mail.Send; its only send right is the role scoped to {0}" -f $Mailbox
|    if ("$ProbeMailbox".Trim()) {
|        if ($Other -eq 'not-found') { $d += ("; the probe mailbox {0} does not exist -- remove or correct SI_Mail_ProbeMailbox" -f "$ProbeMailbox".Trim()) }
|        elseif ("$Other".Trim()) { $d += ("; the probe mailbox {0} could not be used ({1})" -f "$ProbeMailbox".Trim(), $Other) }
|    }
|    & $s 'verified' $d
|}
|
|function Get-SIMailRestriction {
|    <#
|        Probes the restriction as SecurityInsight's identity (two sendMail calls with no recipient: nothing is sent) and
|        returns @{ State; Detail; AllowsSend; Mailbox; CheckedUtc }. Cached per process and mailbox. Never throws.
|    #>
|    param([Parameter(Mandatory)]$Settings, [scriptblock]$Http, [scriptblock]$TokenProvider, [switch]$Force)
|    Initialize-SIMailTransportState
|    $mb = [string]$Settings.SharedMailbox
|    $key = ('{0}|{1}' -f $mb, $Settings.ProbeMailbox).ToLowerInvariant()
|    if (-not $Force -and $script:SIMailRestrictionCache.ContainsKey($key)) { return $script:SIMailRestrictionCache[$key] }
|    if (-not $Http) { $Http = { param($u, $t, $b) Invoke-SIMailHttp -Uri $u -Token $t -Body $b } }
|    if (-not $TokenProvider) { $TokenProvider = { Get-SIMailGraphToken } }
|    $now = [datetime]::UtcNow.ToString('yyyy-MM-ddTHH:mm:ssZ')
|    try {
|        $tok = [string](& $TokenProvider)
|        $roles = @()
|        try { $p = $tok.Split('.')[1].Replace('-', '+').Replace('_', '/'); while ($p.Length % 4) { $p += '=' }; $roles = @(([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($p)) | ConvertFrom-Json).roles) } catch { }
|        $probeBody = [ordered]@{ message = [ordered]@{ subject = 'SecurityInsight permission check (never delivered: no recipient)'; body = [ordered]@{ contentType = 'Text'; content = '-' }; toRecipients = @() }; saveToSentItems = $false }
|        $ask = { param($box) $r = & $Http ('https://graph.microsoft.com/v1.0/users/{0}/sendMail' -f [uri]::EscapeDataString($box)) $tok $probeBody; Get-SIMailProbeVerdict -StatusCode ([int]$r.StatusCode) -Body ([string]$r.Body) }
|        $self = & $ask $mb
|        $other = ''
|        if ($self -eq 'allowed' -and "$($Settings.ProbeMailbox)".Trim() -and "$($Settings.ProbeMailbox)".Trim() -ne $mb) { $other = & $ask ([string]$Settings.ProbeMailbox) }
|        $v = Get-SIMailRestrictionVerdict -TokenHasMailSend ($roles -contains 'Mail.Send') -Self $self -Other $other -Mailbox $mb -ProbeMailbox ([string]$Settings.ProbeMailbox) -Attestation ([string]$Settings.Attestation)
|    } catch {
|        $v = [pscustomobject]@{ State = 'error'; Detail = ('the send right could not be checked: {0}' -f $_.Exception.Message); AllowsSend = $false }
|    }
|    $out = [pscustomobject]@{ State = $v.State; Detail = $v.Detail; AllowsSend = [bool]$v.AllowsSend; Mailbox = $mb; CheckedUtc = $now }
|    $script:SIMailRestrictionCache[$key] = $out
|    $out
|}
|
|function ConvertTo-SIMailRestrictionJson {
|    <# PURE. The cfg.InstallState 'MailRestriction' value (<= 400 characters). #>
|    param([Parameter(Mandatory)]$Restriction)
|    $d = [string]$Restriction.Detail
|    $mk = { param($det) ConvertTo-Json -Compress -InputObject ([ordered]@{ state = [string]$Restriction.State; detail = $det; mailbox = [string]$Restriction.Mailbox; checkedUtc = [string]$Restriction.CheckedUtc }) }
|    $j = & $mk $d
|    while ($j.Length -gt 400 -and $d.Length -gt 10) { $d = $d.Substring(0, [Math]::Max(10, $d.Length - ($j.Length - 400) - 3)) + '...'; $j = & $mk $d }
|    $j
|}
|
|function Write-SIMailRestrictionState {
|    <# The restriction, for the web app's Mail card and home banner: cfg.InstallState 'MailRestriction'. Never throws. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)]$Restriction, [string]$By = 'SecurityInsight mail')
|    $sql = @'
|IF OBJECT_ID(N'cfg.InstallState') IS NOT NULL
|MERGE cfg.InstallState AS t USING (SELECT N'MailRestriction' AS Name) AS s ON t.Name = s.Name
|WHEN MATCHED THEN UPDATE SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By
|WHEN NOT MATCHED THEN INSERT (Name, Value, UpdatedBy) VALUES (N'MailRestriction', @Value, @By);
|'@
|    try { $null = & $Invoke $sql @{ Value = (ConvertTo-SIMailRestrictionJson -Restriction $Restriction); By = $By } 'nonquery'; $true } catch { $false }
|}
|
|# ---------------------------------------------------------------------------------------------------------------------
|#  THE SEND RECORD (#719, 2026-10-17): every mail Send-SIMail tries to send leaves its outcome in cfg.InstallState --
|#  'MailLastSent' (the newest mail handed over) and 'MailLastFailed' (the newest one that was not, with its error). The
|#  heartbeat's Mail field reads both (Get-SIHeartbeatMail): the close-loop, RA, guard, management-summary and other
|#  mails do not go through an outbox, so the outboxes alone left Mail.lastSentUtc days behind. Written by the engine in
|#  the same way as 'MailRestriction' (Write-SIMailRestrictionState); the web app never writes these rows.
|# ---------------------------------------------------------------------------------------------------------------------
|function ConvertTo-SIMailSendRecordJson {
|    <# PURE. The cfg.InstallState 'MailLastSent' / 'MailLastFailed' value (<= 400 characters): { utc, mode[, error] }. #>
|    param([Parameter(Mandatory)][datetime]$Utc, [AllowEmptyString()][string]$Mode = '', [AllowNull()][AllowEmptyString()][string]$ErrorText)
|    $u = $Utc.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
|    $mk = { param($e) $o = [ordered]@{ utc = $u; mode = [string]$Mode }; if ($null -ne $e) { $o.error = $e }; ConvertTo-Json -Compress -InputObject $o }
|    if (-not "$ErrorText".Trim()) { return (& $mk $null) }
|    $e = ("$ErrorText".Trim() -replace '\s+', ' ')
|    if ($e.Length -gt 300) { $e = $e.Substring(0, 297) + '...' }
|    $j = & $mk $e
|    while ($j.Length -gt 400 -and $e.Length -gt 10) { $e = $e.Substring(0, [Math]::Max(10, $e.Length - ($j.Length - 400) - 3)) + '...'; $j = & $mk $e }
|    $j
|}
|
|function Get-SIMailSendRecordSql {
|    <# PURE. One row of cfg.InstallState by its key (@Name = MailLastSent | MailLastFailed). #>
|@'
|IF OBJECT_ID(N'cfg.InstallState') IS NOT NULL
|MERGE cfg.InstallState WITH (HOLDLOCK) AS t USING (SELECT @Name AS Name) AS s ON t.Name = s.Name
|WHEN MATCHED THEN UPDATE SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By
|WHEN NOT MATCHED THEN INSERT (Name, Value, UpdatedBy) VALUES (@Name, @Value, @By);
|'@
|}
|
|function Write-SIMailSendRecord {
|    <# The outcome of one send -> cfg.InstallState 'MailLastSent' (-Sent) or 'MailLastFailed'. Never throws; $true when written. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [bool]$Sent, [AllowNull()][AllowEmptyString()][string]$ErrorText,
|          [AllowEmptyString()][string]$Mode = '', [datetime]$NowUtc = [datetime]::UtcNow, [string]$By = 'SecurityInsight mail')
|    $name = if ($Sent) { 'MailLastSent' } else { 'MailLastFailed' }
|    $err = if ($Sent) { $null } elseif ("$ErrorText".Trim()) { $ErrorText } else { 'the mail was not sent' }
|    try { $null = & $Invoke (Get-SIMailSendRecordSql) @{ Name = $name; Value = (ConvertTo-SIMailSendRecordJson -Utc $NowUtc -Mode $Mode -ErrorText $err); By = $By } 'nonquery'; $true } catch { $false }
|}
|
|function Get-SIMailSendRecordInvoke {
|    <#
|        The SQL seam the send record uses: $global:SI_MailSendRecordInvoke when a job (or a test) set one; else, once per
|        process, the Pro database from the job's globals (SI_ProSqlServer / _SqlDatabase, else the data backend's) through
|        New-SIDataSqlInvoke when the job loaded it. $null = no record (no database, or none could be opened). Never throws.
|    #>
|    if ($global:SI_MailSendRecordInvoke -is [scriptblock]) { return $global:SI_MailSendRecordInvoke }
|    if ($global:SI_MailSendRecordUnavailable) { return $null }
|    $inv = $null
|    try {
|        if (Get-Command -Name New-SIDataSqlInvoke -ErrorAction SilentlyContinue) {
|            foreach ($pair in @(@('SI_ProSqlServer', 'SI_ProSqlDatabase'), @('SI_Pro_DataSqlServer', 'SI_Pro_DataSqlDatabase'))) {
|                $s = "$(Get-Variable -Name $pair[0] -Scope Global -ValueOnly -ErrorAction SilentlyContinue)".Trim()
|                $d = "$(Get-Variable -Name $pair[1] -Scope Global -ValueOnly -ErrorAction SilentlyContinue)".Trim()
|                if ($s -and $d) { $inv = New-SIDataSqlInvoke -Server $s -Database $d -AppId $global:SI_SPN_AppId -TenantId $global:SI_SPN_TenantId -CertThumbprint $global:SI_SPN_CertThumbprint; break }
|            }
|        }
|    } catch { $inv = $null }
|    if ($inv -is [scriptblock]) { $global:SI_MailSendRecordInvoke = $inv; return $inv }
|    $global:SI_MailSendRecordUnavailable = $true
|    $null
|}
|
|# ---------------------------------------------------------------------------------------------------------------------
|#  THE MAIL FORWARD (#765, owner 2026-10-19: "is it possible to define mail forward on accounts like in pim, so each admin
|#  account also get the repots but using their normal office"). A person on the Access page (cfg.AccessAssignment) may have
|#  ForwardTo -- "Send SecurityInsight mail to". Send-SIMail applies it to EVERY mail it sends (the jobs' own report and
|#  alert mails, and every mail the web app queued in an outbox: approvals, owners, notifications, management summaries):
|#  a recipient that names that person -- by object id, their own mail / sign-in name, or a name shown that is a mail
|#  address, case-insensitively -- gets the mail at the forward instead, never at both; the list is de-duplicated. Anyone
|#  not in the table is unchanged. The web app validates the address before it is stored (Auth\MailForward.cs, the same
|#  rules and the same test cases: MailForwardTests / SIv3-MailForward.Tests.ps1); a stored value that is not a real
|#  address is never used.
|# ---------------------------------------------------------------------------------------------------------------------
|$script:SIMailForwardSentinels = @('false', 'none', 'n/a', 'na', 'null', 'nil', 'no', '0', '-', '--', 'empty')
|$script:SIMailForwardCache = $null
|$script:SIMailForwardWarned = $false
|
|function Test-SIMailAddress {
|    <# PURE. A real mail address: one local part, one @, a domain with a dot and a letter top-level domain; no name, no list. #>
|    param([AllowNull()][AllowEmptyString()][string]$Address)
|    $v = "$Address".Trim()
|    if ($v.Length -le 5 -or $v.Length -gt 320) { return $false }
|    if ($v.Contains('..') -or $v.StartsWith('.') -or $v.Contains('.@')) { return $false }
|    return ($v -cmatch '^[A-Za-z0-9.!#$%&''*+/=?^_`{|}~-]+@(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,63}$')
|}
|
|function ConvertTo-SIMailForward {
|    <# PURE. A stored / typed forward as the transport uses it: '' for a blank or a sentinel (FALSE, none, n/a, 0, ...) and
|       for anything that is not a real mail address (never used); else the address, lower-case. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    Initialize-SIMailTransportState
|    $v = "$Value".Trim()
|    if (-not $v -or $script:SIMailForwardSentinels -contains $v.ToLowerInvariant()) { return '' }
|    if (-not (Test-SIMailAddress $v)) { return '' }
|    $v.ToLowerInvariant()
|}
|
|function Get-SIMailForwardSql {
|    <# PURE. The people with a forward (no column yet = none: a database one schema version behind). #>
|@'
|IF OBJECT_ID(N'cfg.AccessAssignment') IS NOT NULL AND COL_LENGTH(N'cfg.AccessAssignment', N'ForwardTo') IS NOT NULL
|    EXEC (N'SELECT PrincipalId, DisplayName, AccountMail, ForwardTo FROM cfg.AccessAssignment WHERE PrincipalType = N''User'' AND ForwardTo IS NOT NULL;');
|ELSE
|    SELECT CAST(NULL AS nvarchar(64)) AS PrincipalId, CAST(NULL AS nvarchar(256)) AS DisplayName, CAST(NULL AS nvarchar(320)) AS AccountMail, CAST(NULL AS nvarchar(320)) AS ForwardTo WHERE 1 = 0;
|'@
|}
|
|function ConvertTo-SIMailForwardMap {
|    <# PURE. Rows (PrincipalId, DisplayName, AccountMail, ForwardTo) -> @{ '<key, lower-case>' = '<forward>' }: the object id, the
|       account mail and a mail-address name of every person whose forward is a real address. #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Rows = @())
|    $map = @{}
|    foreach ($r in @($Rows)) {
|        if (-not $r) { continue }
|        $get = { param($n) if ($r -is [System.Collections.IDictionary]) { "$($r[$n])" } elseif ($r.PSObject.Properties[$n]) { "$($r.$n)" } else { '' } }
|        $f = ConvertTo-SIMailForward (& $get 'ForwardTo')
|        if (-not $f) { continue }
|        $keys = @((& $get 'PrincipalId').Trim().ToLowerInvariant())
|        foreach ($n in 'AccountMail', 'DisplayName') { $k = (& $get $n).Trim(); if (Test-SIMailAddress $k) { $keys += $k.ToLowerInvariant() } }
|        foreach ($k in $keys) { if ($k -and -not $map.ContainsKey($k)) { $map[$k] = $f } }
|    }
|    $map
|}
|
|function Resolve-SIMailRecipients {
|    <# PURE. The list as it is sent: each address the map names is replaced by its forward (never both), de-duplicated
|       case-insensitively (the first place of each kept). Returns @{ To (string[]); Changed (@{ From; To }[]) }. #>
|    param([AllowNull()][AllowEmptyCollection()][string[]]$To = @(), [AllowNull()][hashtable]$Map)
|    $out = New-Object System.Collections.Generic.List[string]
|    $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $changed = New-Object System.Collections.Generic.List[object]
|    foreach ($raw in @($To | ForEach-Object { "$_" -split '[;,]' } | ForEach-Object { $_.Trim() } | Where-Object { $_ })) {
|        $target = $raw
|        if ($Map) {
|            $k = $raw.ToLowerInvariant()
|            if ($Map.ContainsKey($k) -and $Map[$k] -and $Map[$k] -ne $k) { $target = [string]$Map[$k]; $changed.Add([pscustomobject]@{ From = $raw; To = $target }) }
|        }
|        if ($seen.Add($target)) { $out.Add($target) }
|    }
|    [pscustomobject]@{ To = [string[]]$out.ToArray(); Changed = @($changed.ToArray()) }
|}
|
|function Get-SIMailForwardMap {
|    <# The forwards of the people with access, read once per 10 minutes per process: $global:SI_MailForwardMap when a job (or a
|       test) set one; else the Pro database through the same seam as the send record (Get-SIMailSendRecordInvoke). Cannot
|       be read = @{} (every address as given) and ONE line in the log. Never throws. #>
|    param([scriptblock]$Invoke)
|    Initialize-SIMailTransportState
|    if ($global:SI_MailForwardMap -is [hashtable]) { return $global:SI_MailForwardMap }
|    if ($script:SIMailForwardCache -and $script:SIMailForwardCache.Until -gt [datetime]::UtcNow) { return $script:SIMailForwardCache.Map }
|    $map = @{}
|    try {
|        $inv = if ($Invoke) { $Invoke } else { Get-SIMailSendRecordInvoke }
|        # the reader answers its rows as ONE array (', $rows'): unrolled here, so each row is a row
|        if ($inv) { $map = ConvertTo-SIMailForwardMap -Rows @(& $inv (Get-SIMailForwardSql) @{} 'rows' | ForEach-Object { $_ }) }
|        $script:SIMailForwardCache = @{ Map = $map; Until = [datetime]::UtcNow.AddMinutes(10) }
|    } catch {
|        if (-not $script:SIMailForwardWarned) { Write-Host ('   note: the mail forwards of the people with access could not be read ({0}) -- every mail goes to the addresses as given' -f $_.Exception.Message); $script:SIMailForwardWarned = $true }
|        $script:SIMailForwardCache = @{ Map = @{}; Until = [datetime]::UtcNow.AddMinutes(10) }
|    }
|    $map
|}
|
|function Send-SIMail {
|    <#
|        THE send. -Settings from Get-SIMailSettings (or Get-SIGuardSmtp / Get-SICloseLoopMailSmtp, the same object).
|        Returns @{ Sent; Mode; Off; Error; Dropped (attachments left out); Restriction; Text; Pdf (its file name); PdfError }.
|        NEVER throws; diagnostics are
|        written to the host. -Http / -TokenProvider are the Graph seams (tests); -PdfBuilder the PDF seam ({ param($Subject, $Html) @{ Bytes; Error } }); -NoPdf: no PDF (a sign-in mail).
|    #>
|    param([Parameter(Mandatory)]$Settings, [Parameter(Mandatory)][string[]]$To, [string[]]$Cc = @(), [Parameter(Mandatory)][string]$Subject,
|          [Parameter(Mandatory)][AllowEmptyString()][string]$BodyHtml, [string[]]$Attachments = @(),
|          [ValidateSet('Normal', 'High', 'Low')][string]$Priority = 'Normal', [scriptblock]$Http, [scriptblock]$TokenProvider,
|          [switch]$NoPdf, [scriptblock]$PdfBuilder,
|          # MAIL-3 (#653): the subject's severity word (Failed | Warning | ActionNeeded; none = a report or information mail)
|          # and a support ticket number -- both optional; Get-SIMailSubject builds the whole subject
|          [AllowNull()][AllowEmptyString()][string]$Severity, [AllowNull()][AllowEmptyString()][string]$Ticket)
|    Initialize-SIMailTransportState
|    $res = [ordered]@{ Sent = $false; Mode = [string]$Settings.Mode; Off = [bool]$Settings.Off; Error = $null; Dropped = @(); Restriction = $null; Text = ''; Pdf = $null; PdfError = $null }
|    $fail = { param($m) $res.Error = $m; Write-Host ('   mail NOT sent: ' + $m); [pscustomobject]$res }
|    $mode = if ($Settings.Mode) { [string]$Settings.Mode } else { 'smtp' }
|    if ($Settings.Off) { Write-Host '   mail is off (SI_Mail_Mode = none) -- not sent'; $res.Error = 'mail is off (SI_Mail_Mode = none)'; return [pscustomobject]$res }
|    if (@($Settings.Problems).Count) { return (& $fail ((@($Settings.Problems)) -join '; ')) }
|    $to = @($To | ForEach-Object { "$_" -split '[;,]' } | ForEach-Object { $_.Trim() } | Where-Object { $_ })
|    if (-not $to.Count) { return (& $fail 'the mail has no recipient') }
|    # #765 (owner 2026-10-19, "mail forward on accounts like in pim"): a recipient who is a person on the Access page with
|    # "Send SecurityInsight mail to" gets the mail THERE, never at both; the list is de-duplicated. A mail that carries a
|    # one-time secret (-NoPdf: a sign-in link or code) goes only to the address it was made for. Never fails a mail: the
|    # forwards that cannot be read leave every address as it is (one line says so).
|    if (-not $NoPdf) {
|        try {
|            $fwMap = Get-SIMailForwardMap
|            $fw = Resolve-SIMailRecipients -To $to -Map $fwMap
|            foreach ($c in @($fw.Changed)) { Write-Host ('   mail for {0} goes to {1} (their "Send SecurityInsight mail to" on Access)' -f $c.From, $c.To) }
|            $to = @($fw.To)
|            if (@($Cc | Where-Object { "$_".Trim() }).Count) {
|                $ccr = Resolve-SIMailRecipients -To $Cc -Map $fwMap
|                $Cc = @(@($ccr.To) | Where-Object { $to -notcontains $_ })
|            }
|        } catch { Write-Host ('   note: the mail forwards could not be applied ({0}) -- sent to the addresses as given' -f $_.Exception.Message) }
|    }
|    # MAIL-1 / MAIL-3: every mail names its environment -- the subject ('[<Name>] ... [SecurityInsight]') and the footer
|    # (name, ring, edition), built here once for every sender
|    $envInfo = if ($Settings.PSObject.Properties['Environment'] -and $Settings.Environment) { $Settings.Environment } else { Get-SIMailEnvironment }
|    $Subject = Get-SIMailSubject -Subject $Subject -Environment $envInfo -Severity $Severity -Ticket $Ticket
|    # MAIL-2 / #573: EVERY body goes through the one layout -- real paragraphs, explicit spacing, never raw text in HTML.
|    # One HTML body: Graph sendMail takes one body, and so does the SMTP transport; .Text is the CRLF text rendering.
|    $formatted = Format-SIMailBody -BodyHtml $BodyHtml -Title $Subject
|    $BodyHtml = [string]$formatted.Html
|    # #710 (owner 2026-10-16): ONE line under the summary -- "See details and history: <the install's page in the Invardia
|    # portal>" -- only when Invardia has named the environment, only in a mail that has a summary (or a place-holder at
|    # its top: the daily close-loop mail and the management summary, owner 2026-10-16), never in a mail that
|    # carries a one-time secret (-NoPdf). Never fails a mail.
|    if (-not $NoPdf) {
|        try {
|            $eid = if ($envInfo -and $envInfo.PSObject.Properties['InvardiaEnvironmentId']) { [string]$envInfo.InvardiaEnvironmentId } else { '' }
|            if ($eid) { $BodyHtml = Add-SIInvardiaPortalLink -BodyHtml $BodyHtml -EnvironmentId $eid }
|        } catch { }
|    }
|    # the place-holder of a mail that asks for the line at its top is never sent (no id, or a -NoPdf mail)
|    try { $BodyHtml = Remove-SIInvardiaPortalLinkAnchor $BodyHtml } catch { }
|    # a source on its last good collection: every mail that carries data says so, in the same sentence the pages show
|    # (never fails a mail; a sign-in mail -- -NoPdf -- carries no data and no note)
|    if (-not $NoPdf) {
|        try {
|            if (-not (Get-Command -Name Get-SISourceMailNotes -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-SourceState.ps1') }
|            $BodyHtml = Add-SIMailSourceNote -BodyHtml $BodyHtml -Notes @(Get-SISourceMailNotes)
|        } catch { }
|    }
|    $BodyHtml = Add-SIMailFooter -BodyHtml $BodyHtml -Environment $envInfo
|    $res.Text = ConvertTo-SIMailText -Html $BodyHtml
|
|    # #574: ONE PDF of the mail -- its summary, facts and detail, exactly what the body shows (built from the body as it is
|    # sent). Attached LAST, so a large report workbook keeps its place; over the attachment budget it is left out like
|    # any attachment. A PDF that cannot be built never blocks the mail: it goes without it, and says so. -NoPdf: a mail
|    # that carries a one-time secret (a sign-in link or code) never gets a copy of it in a file.
|    $pdfPath = $null
|    if (-not $NoPdf) {
|        $pdf = $null
|        try {
|            $pdf = if ($PdfBuilder) { & $PdfBuilder $Subject $BodyHtml } else { New-SIMailPdf -Title $Subject -Html $BodyHtml -Footer ('SecurityInsight' + $(if ($envInfo -and $envInfo.Display) { ' - ' + [string]$envInfo.Display } else { '' })) }
|        } catch { $pdf = [pscustomobject]@{ Bytes = $null; Error = ('the PDF could not be built: ' + $_.Exception.Message) } }
|        if ($pdf -and $pdf.Bytes) {
|            try {
|                $pdfPath = Save-SIMailPdf -Bytes ([byte[]]$pdf.Bytes) -Subject $Subject
|                $Attachments = @(@($Attachments | Where-Object { "$_".Trim() }) + @($pdfPath))
|                $res.Pdf = Split-Path -Leaf $pdfPath
|            } catch { $res.PdfError = 'the PDF could not be saved: ' + $_.Exception.Message }
|        } else {
|            $res.PdfError = if ($pdf -and $pdf.Error) { [string]$pdf.Error } else { 'the PDF could not be built' }
|        }
|        if ($res.PdfError) { Write-Host ('   warning: the mail goes without its PDF -- ' + $res.PdfError) }
|    }
|    try {
|
|    if ($mode -eq 'sharedMailbox') {
|        $r = Get-SIMailRestriction -Settings $Settings -Http $Http -TokenProvider $TokenProvider
|        $res.Restriction = $r
|        if (-not $r.AllowsSend) { return (& $fail ('Mail.Send is not restricted to the shared mailbox yet -- SecurityInsight does not send until it is. ' + $r.Detail)) }
|        if ($r.State -eq 'legacy-policy') { Write-Host ('   note: ' + $r.Detail) }
|        $plan = Get-SIMailAttachmentPlan -Paths $Attachments -MaxMb ([double]$Settings.MaxAttachmentMb)
|        $res.Dropped = @($plan.Dropped)
|        foreach ($d in $plan.Dropped) { Write-Host ('   attachment left out: {0} ({1} MB, ~{2} MB encoded; Microsoft Graph takes at most {3} MB in one mail) -- the file stays where it is' -f (Split-Path $d.Path -Leaf), $d.DiskMb, $d.EncodedMb, $plan.MaxMb) }
|        $att = @(); foreach ($p in $plan.Include) { $att += @{ Name = (Split-Path $p -Leaf); ContentType = (Get-SIMailContentType $p); Bytes = [IO.File]::ReadAllBytes($p) } }
|        $body = New-SIGraphSendMailBody -To $to -Cc $Cc -Subject $Subject -BodyHtml $BodyHtml -Priority $Priority -Attachments $att
|        if (-not $Http) { $Http = { param($u, $t, $b) Invoke-SIMailHttp -Uri $u -Token $t -Body $b } }
|        if (-not $TokenProvider) { $TokenProvider = { Get-SIMailGraphToken } }
|        Write-Host ("Sending mail (shared mailbox {0}) to {1} with subject '{2}'" -f $Settings.SharedMailbox, ($to -join ', '), $Subject)
|        try {
|            $tok = [string](& $TokenProvider)
|            $resp = & $Http ('https://graph.microsoft.com/v1.0/users/{0}/sendMail' -f [uri]::EscapeDataString([string]$Settings.SharedMailbox)) $tok $body
|        } catch { return (& $fail ('Microsoft Graph could not be reached: ' + $_.Exception.Message)) }
|        if ([int]$resp.StatusCode -eq 202) { $res.Sent = $true; return [pscustomobject]$res }
|        $e = Get-SIMailGraphError -Body ([string]$resp.Body)
|        $hint = if ([int]$resp.StatusCode -eq 403) { ' -- SecurityInsight may not send as this mailbox (Exchange role assignment)' } elseif ([int]$resp.StatusCode -eq 413) { ' -- the mail is too large for Microsoft Graph' } else { '' }
|        $script:SIMailRestrictionCache.Clear()
|        # the status with its name ('403 (Forbidden)'), so the heartbeat's error class reads it (#719: Mail.lastErrorCode)
|        $sc = [int]$resp.StatusCode; $scName = ''; try { $scName = ' ({0})' -f ([System.Net.HttpStatusCode]$sc) } catch { $scName = '' }
|        return (& $fail ('Microsoft Graph answered {0}{1} {2}: {3}{4}' -f $sc, $scName, $e.Code, $e.Message, $hint))
|    }
|
|    # smtp -- the Risk Analysis transports (RA-Mail.ps1), the one place that talks SMTP
|    if (-not (Get-Command -Name Send-MailAnonymous -ErrorAction SilentlyContinue)) {
|        $ra = [IO.Path]::Combine($script:SIMailTransportRoot, 'engine', 'risk-analysis', '_shared', 'RA-Mail.ps1')
|        if (Test-Path -LiteralPath $ra) { . $ra }
|    }
|    if (-not (Get-Command -Name Send-MailAnonymous -ErrorAction SilentlyContinue)) { return (& $fail 'the SMTP transports (RA-Mail.ps1) are not available') }
|    $plan = Get-SIMailAttachmentPlan -Paths $Attachments -MaxMb ([double]$Settings.MaxAttachmentMb)
|    $res.Dropped = @($plan.Dropped)
|    $smtpArgs = @{ SmtpServer = [string]$Settings.Server; Port = [int]$Settings.Port; UseSsl = [bool]$Settings.UseSsl; From = [string]$Settings.From; To = $to; Subject = $Subject; BodyHtml = $BodyHtml; Priority = $Priority }
|    if (@($plan.Include).Count) { $smtpArgs.Attachments = @($plan.Include) }
|    if ($Settings.Anonymous) {
|        $out = @(Send-MailAnonymous @smtpArgs)
|        $lines = @($out | Where-Object { $_ -isnot [bool] } | ForEach-Object { [string]$_ })
|        foreach ($l in $lines) { Write-Host $l }
|        $verdict = @($out | Where-Object { $_ -is [bool] }) | Select-Object -Last 1
|        if (-not $verdict) {
|            $detail = @($lines | Where-Object { $_ -match 'FAILED|Message\s*:|StatusCode|InnerException' } | ForEach-Object { $_.Trim() }) -join ' | '
|            if (-not $detail) { $detail = 'the relay did not accept the message' }
|            $res.Error = $detail; return [pscustomobject]$res
|        }
|        $res.Sent = $true; return [pscustomobject]$res
|    }
|    try {
|        $smtpArgs.Credential = New-Object System.Management.Automation.PSCredential ([string]$Settings.User, (ConvertTo-SecureString ([string]$Settings.Password) -AsPlainText -Force))
|        $out = @(Send-MailSecure @smtpArgs -ErrorAction Stop)
|        foreach ($l in $out) { Write-Host ([string]$l) }
|        $res.Sent = $true
|    } catch {
|        $m = $_.Exception.Message
|        if ($_.Exception.InnerException) { $m += ' (' + $_.Exception.InnerException.Message + ')' }
|        $res.Error = $m
|    }
|    [pscustomobject]$res
|    } finally {
|        # #574: the PDF's temp copy goes once the mail is handed over (sent or not)
|        if ($pdfPath) { Remove-Item -LiteralPath (Split-Path -Parent $pdfPath) -Recurse -Force -ErrorAction SilentlyContinue }
|        # #719: every send leaves its outcome for the heartbeat (cfg.InstallState 'MailLastSent' / 'MailLastFailed'); never fails a mail
|        try { $recInv = Get-SIMailSendRecordInvoke; if ($recInv) { $null = Write-SIMailSendRecord -Invoke $recInv -Sent ([bool]$res.Sent) -ErrorText ([string]$res.Error) -Mode $mode } } catch { }
|    }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-MailLayout.ps1'] = @{ Sha256 = 'ff4f8d1dc50e2ddc6192900a462d1369aa954671cd508ebe0363f64789ba8ca3'; Text = @'
|#Requires -Version 5.1
|<#
|    SECURITYINSIGHT -- THE ONE MAIL LAYOUT (framework MAIL-2, REQUIREMENTS #573: "every SI mail must be readable, with
|    real paragraphs and blank lines"). Every mail SecurityInsight sends goes through it: Send-SIMail (SI-MailTransport.ps1)
|    calls Format-SIMailBody on EVERY body before it is sent, whoever built it -- the Risk Analysis report, the guard
|    mails, the close-loop / exemption / governance / department / task-digest mails, the licence notice, and the mails
|    the web app queues in its outboxes (cfg.SignInMail, cfg.ExemptionMail, cfg.GovernanceMail, cfg.ReportMail).
|    tests\pester\SIv3-MailReadable.Tests.ps1 renders each mail type and fails when paragraphs or blank lines are lost,
|    and fails when a sender bypasses Format-SIMailBody.
|
|    WHY THE MAILS WERE HARD TO READ (the root causes this file removes):
|      1. plain text (or multi-line free text: a reason, a comment, an AI narrative) put into HTML without turning its
|         line breaks into paragraphs / <br> -- HTML collapses "\n" and "\n\n" into one space, so paragraphs ran together;
|      2. a <p> per LINE (the AI narrative) instead of a <p> per paragraph, with a 6 px gap -- no visible blank line;
|      3. <p> with no margin of its own -- Outlook (desktop, web) drops the default paragraph spacing, so paragraphs had no
|         blank line between them;
|      4. text joined with "`n" (LF only) for the text variant -- no CRLF, no blank line between paragraphs.
|
|    THE BODY: one HTML body. Microsoft Graph sendMail (the shared-mailbox mode) takes ONE body (contentType HTML or Text)
|    -- it has no multipart/alternative -- and the SMTP mode's Send-MailMessage also takes one body. So every mail is an
|    HTML body built with real structure: a <p> per paragraph (explicit margin), <br> only inside a paragraph, <ul> for
|    lists, headings, every interpolated value HTML-encoded. The plain-text rendering of the same mail
|    (ConvertTo-SIMailText: CRLF line ends, a blank line between paragraphs) is returned by Send-SIMail (.Text) and is what
|    a multipart sender would put in its text/plain part.
|
|    NO TABLES (REQUIREMENTS #728, owner: "Drop the tables in emails as it becomes hard to read on mobiles / Make line with
|    topic: / Then text. / Use bold where it can add important context / Use line spacing where needed"). The layout of
|    every SI mail, the same as Invardia's owner notes:
|      - a SUMMARY block first (data-mail-summary): 2-4 short lines -- what happened, the numbers, whether the reader must act;
|      - SECTIONS with a heading (ConvertTo-SIMailHeadingHtml);
|      - "Topic: text" lines, the topic in bold and short (ConvertTo-SIMailLineHtml / ConvertTo-SIMailFactsHtml);
|      - ONE LINE PER RECORD instead of a table row ("Device_Missing_CVEs_Detailed: Complete, 1,060,000 rows");
|      - bullets for lists; blank space between the parts;
|      - no fixed widths: the frame is a <div> with a max-width, so a phone shows it at its own width.
|    No helper here emits <table>, and tests\pester\SIv3-MailNoTables.Tests.ps1 fails when any SI mail does.
|
|    PURE functions only. PowerShell 5.1 and 7 syntax; no modules.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope.
|
|$script:SIMailLayout = @{
|    Font      = 'font-family:Segoe UI,Arial,sans-serif;'
|    Ink       = '#0B1633'
|    Muted     = '#52607D'
|    Blue      = '#1B4FE4'
|    Line      = '#DCE3F2'
|    Panel     = '#F6F8FD'
|    Tint      = '#EEF3FE'
|    # an explicit bottom margin on every paragraph: Outlook drops the default <p> spacing
|    PStyle    = 'margin:0 0 14px 0;line-height:1.55;'
|    Marker    = 'data-si-mail-layout'
|    # the elements that make a body HTML (Format-SIMailBody); anything else tag-like in a text is text
|    HtmlElement = '(?i)<!DOCTYPE\b|</?(html|body|head|p|div|span|table|thead|tbody|tr|td|th|br|hr|h[1-6]|ul|ol|li|strong|b|em|i|u|a|img|code|pre|blockquote|font|center|small|meta|style)(\s[^>]*)?/?>'
|}
|
|function ConvertTo-SIMailEncoded {
|    <# PURE. HTML-encode one value (never raw text in HTML). #>
|    param([AllowNull()]$Value)
|    [System.Net.WebUtility]::HtmlEncode([string]$Value)
|}
|
|function ConvertTo-SIMailLinkified {
|    <# PURE. Encoded text with every https:// link clickable. #>
|    param([AllowEmptyString()][string]$Text)
|    if (-not $Text) { return '' }
|    $sb = New-Object System.Text.StringBuilder
|    $i = 0
|    foreach ($m in [regex]::Matches($Text, 'https://[^\s<>"'']+')) {
|        $url = $m.Value
|        while ($url.Length -gt 8 -and '.,;:)]'.Contains([string]$url[$url.Length - 1])) { $url = $url.Substring(0, $url.Length - 1) }
|        [void]$sb.Append((ConvertTo-SIMailEncoded $Text.Substring($i, $m.Index - $i)))
|        $u = ConvertTo-SIMailEncoded $url
|        [void]$sb.Append(('<a href="{0}" style="color:{1};text-decoration:underline;">{0}</a>' -f $u, $script:SIMailLayout.Blue))
|        $i = $m.Index + $url.Length
|    }
|    if ($i -lt $Text.Length) { [void]$sb.Append((ConvertTo-SIMailEncoded $Text.Substring($i))) }
|    $sb.ToString()
|}
|
|function ConvertTo-SIMailInlineHtml {
|    <# PURE. One free-text VALUE (a reason, a comment, a detail) for inside a paragraph or a table cell: encoded, links
|       clickable, every line break kept as <br> (a blank line as two). #>
|    param([AllowNull()]$Text)
|    $t = ([string]$Text) -replace "`r`n", "`n" -replace "`r", "`n"
|    $t = $t.Trim()
|    if (-not $t) { return '' }
|    ((@($t -split "`n") | ForEach-Object { ConvertTo-SIMailLinkified $_.TrimEnd() }) -join '<br>')
|}
|
|function ConvertTo-SIMailParagraphHtml {
|    <#
|        PURE. Plain text -> HTML blocks: a blank line separates paragraphs (<p>, with the explicit margin), a single line
|        break stays a <br> inside its paragraph, a run of lines starting with "- " / "* " is a <ul>. Every value is
|        encoded. -Markdown adds the subset an AI narrative uses: "## " / "### " headings, **bold**, _italic_ and
|        [text](https://link).
|        -NoLinks: TEXT ONLY -- no link is made clickable: a [text](link) shows its text alone, a bare address stays plain
|        text. For text SecurityInsight did not write itself (the AI narrative, which reads collected names).
|    #>
|    param([AllowNull()]$Text, [switch]$Markdown, [switch]$NoLinks, [string]$Style)
|    $L = $script:SIMailLayout
|    $pStyle = if ($Style) { $Style } else { $L.PStyle }
|    $t = ([string]$Text) -replace "`r`n", "`n" -replace "`r", "`n"
|    if (-not $t.Trim()) { return '' }
|    $plain = { param([string]$x) if ($NoLinks) { ConvertTo-SIMailEncoded $x } else { ConvertTo-SIMailLinkified $x } }
|    $inline = {
|        param([string]$s)
|        if (-not $Markdown) { return (& $plain $s) }
|        # markdown links first, the rest encoded + linkified
|        $out = New-Object System.Text.StringBuilder; $i = 0
|        foreach ($m in [regex]::Matches($s, '\[([^\]\n]+)\]\(([a-zA-Z][a-zA-Z0-9+.-]*:[^\s)]+)\)')) {
|            [void]$out.Append((& $plain $s.Substring($i, $m.Index - $i)))
|            if ($NoLinks -or $m.Groups[2].Value -notmatch '^https://') { [void]$out.Append((ConvertTo-SIMailEncoded $m.Groups[1].Value)) }
|            else { [void]$out.Append(('<a href="{0}" style="color:{1};text-decoration:underline;">{2}</a>' -f (ConvertTo-SIMailEncoded $m.Groups[2].Value), $L.Blue, (ConvertTo-SIMailEncoded $m.Groups[1].Value))) }
|            $i = $m.Index + $m.Length
|        }
|        if ($i -lt $s.Length) { [void]$out.Append((& $plain $s.Substring($i))) }
|        $h = $out.ToString()
|        $h = [regex]::Replace($h, '\*\*([^\*\n]+?)\*\*', '<strong>$1</strong>')
|        $h = [regex]::Replace($h, '(^|\s)_([^_\n]+?)_(\s|[\.,;:\)\]]|$)', '$1<em>$2</em>$3')
|        $h
|    }
|    $blocks = New-Object System.Collections.Generic.List[string]
|    foreach ($para in [regex]::Split($t.Trim(), '\n[ \t]*\n')) {
|        $lines = @($para -split "`n" | ForEach-Object { $_.TrimEnd() } | Where-Object { $_.Trim() })
|        if (-not $lines.Count) { continue }
|        $buf = New-Object System.Collections.Generic.List[string]
|        $ul = New-Object System.Collections.Generic.List[string]
|        $flushP = { if ($buf.Count) { $blocks.Add(('<p style="{0}{1}">{2}</p>' -f $L.Font, $pStyle, ($buf -join '<br>'))); $buf.Clear() } }
|        $flushU = { if ($ul.Count) { $blocks.Add(('<ul style="{0}margin:0 0 14px 0;padding:0 0 0 22px;">{1}</ul>' -f $L.Font, (($ul | ForEach-Object { '<li style="margin:0 0 4px 0;">' + $_ + '</li>' }) -join ''))); $ul.Clear() } }
|        foreach ($ln in $lines) {
|            if ($Markdown -and $ln -match '^\s*(#{2,3})\s+(.+)$') {
|                & $flushP; & $flushU
|                $size = if ($matches[1].Length -eq 2) { '16px' } else { '14px' }
|                $blocks.Add(('<h3 style="{0}font-size:{1};color:{2};margin:18px 0 8px 0;">{3}</h3>' -f $L.Font, $size, $L.Ink, (& $inline $matches[2].Trim())))
|                continue
|            }
|            if ($ln -match '^\s*[-*•]\s+(.+)$') { & $flushP; $ul.Add((& $inline $matches[1].Trim())); continue }
|            & $flushU
|            $buf.Add((& $inline $ln.Trim()))
|        }
|        & $flushP; & $flushU
|    }
|    ($blocks -join "`r`n")
|}
|
|function ConvertTo-SIMailHeadingHtml {
|    <# PURE. A section heading (#728: sections with a heading). Encoded. #>
|    param([AllowEmptyString()][string]$Text)
|    if (-not "$Text".Trim()) { return '' }
|    $L = $script:SIMailLayout
|    ('<h2 style="{0}font-size:16px;line-height:1.35;font-weight:700;color:{1};margin:24px 0 10px 0;">{2}</h2>' -f $L.Font, $L.Ink, (ConvertTo-SIMailEncoded $Text))
|}
|
|function ConvertTo-SIMailLineHtml {
|    <#
|        PURE. ONE "Topic: text" line (#728): the topic in bold, then the text, as a paragraph of its own (blank space after
|        it). -Text is plain text (encoded, links clickable, line breaks kept); -Html is a trusted fragment already built with
|        encoded values (a link, a bold number). No topic = the text alone.
|    #>
|    param([AllowEmptyString()][string]$Topic, [AllowNull()]$Text, [string]$Html, [string]$Color)
|    $L = $script:SIMailLayout
|    $body = if ($PSBoundParameters.ContainsKey('Html')) { $Html } else { ConvertTo-SIMailInlineHtml $Text }
|    $t = "$Topic".Trim()
|    if (-not $t -and -not "$body".Trim()) { return '' }
|    $lead = if ($t) { '<strong>' + (ConvertTo-SIMailEncoded ($t.TrimEnd(':'))) + ':</strong> ' } else { '' }
|    $ink = if ($Color) { $Color } else { $L.Ink }
|    ('<p style="{0}font-size:14px;line-height:1.5;color:{1};margin:0 0 10px 0;">{2}{3}</p>' -f $L.Font, $ink, $lead, $body)
|}
|
|function ConvertTo-SIMailFactsHtml {
|    <#
|        PURE. Key / value facts as "Topic: text" lines (#728: no table), one line per fact, the topic in bold; empty values
|        left out. -Facts: an ordered dictionary, or pairs @(@(k,v), ...). -Title: a section heading above them.
|    #>
|    param($Facts, [string]$Title)
|    $L = $script:SIMailLayout
|    $rows = New-Object System.Collections.Generic.List[object]
|    if ($Facts -is [System.Collections.IDictionary]) { foreach ($k in $Facts.Keys) { $rows.Add(@([string]$k, $Facts[$k])) } }
|    else { foreach ($p in @($Facts)) { if ($null -ne $p) { $rows.Add(@([string]@($p)[0], @($p)[1])) } } }
|    $kept = @($rows | Where-Object { "$(@($_)[1])".Trim() })
|    if (-not $kept.Count) { return '' }
|    $sb = New-Object System.Text.StringBuilder
|    if ($Title) { [void]$sb.Append((ConvertTo-SIMailHeadingHtml $Title)) }
|    [void]$sb.Append(('<div style="{0}margin:0 0 16px 0;" data-mail-facts>' -f $L.Font))
|    foreach ($r in $kept) { [void]$sb.Append((ConvertTo-SIMailLineHtml -Topic @($r)[0] -Text @($r)[1])) }
|    [void]$sb.Append('</div>')
|    $sb.ToString()
|}
|
|function ConvertTo-SIMailSummaryHtml {
|    <#
|        PURE. The SUMMARY block every mail starts with (#728): 2-4 short lines -- what happened, the numbers, whether the
|        reader must act. -Lines: plain text (encoded), one per line; -Html: trusted fragments (already encoded) instead.
|        A tinted block with a blue edge, no table, no fixed width (data-mail-summary: the portal link line goes under it).
|    #>
|    param([AllowEmptyCollection()][string[]]$Lines = @(), [AllowEmptyCollection()][string[]]$Html = @())
|    $L = $script:SIMailLayout
|    $parts = @(@($Html | Where-Object { "$_".Trim() }) + @($Lines | Where-Object { "$_".Trim() } | ForEach-Object { ConvertTo-SIMailInlineHtml $_ }))
|    if (-not $parts.Count) { return '' }
|    ('<div data-mail-summary style="{0}background:{1};border-left:4px solid {2};border-radius:4px;padding:12px 16px;margin:0 0 18px 0;font-size:15px;line-height:1.55;color:{3};"><p style="margin:0;">{4}</p></div>' -f `
|        $L.Font, $L.Tint, $L.Blue, $L.Ink, ($parts -join '<br>'))
|}
|
|function ConvertTo-SIMailButtonHtml {
|    <# PURE. The one blue button: a styled link in a paragraph of its own (no table, #728). Not https:// = no button. #>
|    param([string]$Url, [string]$Text)
|    if ("$Url" -notmatch '^https://') { return '' }
|    $L = $script:SIMailLayout
|    ('<p data-mail-button style="{2}margin:8px 0 18px 0;line-height:1.2;"><a href="{1}" target="_blank" style="{2}display:inline-block;background:{0};border:2px solid {0};border-radius:8px;padding:12px 24px;font-size:15px;font-weight:700;color:#ffffff;text-decoration:none;">{3}</a></p>' -f `
|        $L.Blue, (ConvertTo-SIMailEncoded $Url), $L.Font, (ConvertTo-SIMailEncoded $Text))
|}
|
|function New-SIMailFrameHtml {
|    <#
|        PURE. The frame every SI mail sits in (#728: no table, no fixed width -- a <div> with a max-width, so a phone shows it
|        at its own width): the SecurityInsight bar (an optional -Subtitle line under it: the tenant, the time), the title,
|        the -ContentHtml (trusted, already built with encoded values), the footer line. Carries the layout marker.
|    #>
|    param([string]$Title, [Parameter(Mandatory)][AllowEmptyString()][string]$ContentHtml, [string]$Footer, [string]$FooterHtml,
|          [string]$Brand = 'SecurityInsight', [string]$Subtitle)
|    $L = $script:SIMailLayout
|    $foot = if ($FooterHtml) { $FooterHtml } elseif ($Footer) { ConvertTo-SIMailInlineHtml $Footer } else { '' }
|    '<!DOCTYPE html><html><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="color-scheme" content="light only"></head>' +
|        ('<body style="margin:0;padding:0;background:#f3f5f8;" {0}="1"><div style="background:#f3f5f8;padding:16px 8px;">' -f $L.Marker) +
|        '<div style="max-width:680px;margin:0 auto;background:#ffffff;border:1px solid #e0e6ed;border-radius:8px;">' +
|        ('<div style="background:{0};padding:14px 20px;border-radius:8px 8px 0 0;{1}font-size:18px;font-weight:700;color:#ffffff;">{2}{3}</div>' -f $L.Ink, $L.Font, (ConvertTo-SIMailEncoded $Brand),
|            $(if ($Subtitle) { '<br><span style="font-size:12px;font-weight:400;color:#cfdce8;">' + (ConvertTo-SIMailEncoded $Subtitle) + '</span>' } else { '' })) +
|        $(if ($Title) { '<div style="padding:18px 20px 0 20px;"><h1 style="{0}font-size:21px;line-height:1.3;color:{1};margin:0 0 14px 0;">{2}</h1></div>' -f $L.Font, $L.Ink, (ConvertTo-SIMailEncoded $Title) } else { '' }) +
|        ('<div style="padding:4px 20px 12px 20px;{0}font-size:14px;color:{1};">{2}</div>' -f $L.Font, $L.Ink, $ContentHtml) +
|        $(if ($foot) { '<div style="padding:12px 20px 16px 20px;border-top:1px solid #e0e6ed;{0}font-size:11px;line-height:1.5;color:{1};">{2}</div>' -f $L.Font, $L.Muted, $foot } else { '' }) +
|        '</div></div></body></html>'
|}
|
|function New-SIMailLayout {
|    <#
|        PURE. A whole mail in the MAIL-2 / #728 layout, from PLAIN TEXT parts (everything is encoded here): the title, the
|        summary first (a tinted block), the facts as "Topic: text" lines, the paragraphs (-Paragraphs: one string per paragraph, or one text with blank
|        lines; lines starting "- " become a list), an optional trusted -BodyHtml fragment (already built with encoded
|        values), the blue button to the exact page, the doc link, the footer line.
|        Returns @{ Html; Text } -- Text: CRLF line ends, a blank line between paragraphs.
|    #>
|    param([string]$Title, [string]$Summary, $Facts, [string]$FactsTitle, [AllowEmptyCollection()][string[]]$Paragraphs = @(),
|          [string]$BodyHtml, [string]$ButtonUrl, [string]$ButtonText = 'Open SecurityInsight', [string]$DocUrl, [string]$DocText = 'Documentation',
|          [string]$Footer)
|    $L = $script:SIMailLayout
|    $parts = New-Object System.Text.StringBuilder
|    if ($Summary) { [void]$parts.Append((ConvertTo-SIMailSummaryHtml -Lines @($Summary))) }
|    if ($null -ne $Facts) { [void]$parts.Append((ConvertTo-SIMailFactsHtml -Facts $Facts -Title $FactsTitle)) }
|    $text = (@($Paragraphs) | Where-Object { "$_".Trim() }) -join "`n`n"
|    if ($text) { [void]$parts.Append((ConvertTo-SIMailParagraphHtml -Text $text)) }
|    if ($BodyHtml) { [void]$parts.Append($BodyHtml) }
|    [void]$parts.Append((ConvertTo-SIMailButtonHtml -Url $ButtonUrl -Text $ButtonText))
|    if ("$DocUrl" -match '^https://') {
|        [void]$parts.Append(('<p style="{0}{1}font-size:13px;color:{2};">{3}: <a href="{4}" style="color:{5};">{4}</a></p>' -f $L.Font, $L.PStyle, $L.Muted, (ConvertTo-SIMailEncoded $DocText), (ConvertTo-SIMailEncoded $DocUrl), $L.Blue))
|    }
|    $html = New-SIMailFrameHtml -Title $Title -ContentHtml $parts.ToString() -Footer $Footer
|    [pscustomobject]@{ Html = $html; Text = (ConvertTo-SIMailText -Html $html) }
|}
|
|function ConvertTo-SIMailText {
|    <#
|        PURE. The plain-text rendering of an HTML mail: CRLF line ends, one blank line between paragraphs / headings /
|        tables / lists, a list item as "- ", a table row as its cells separated by " | ", links as "text (url)". It is what
|        a text/plain part carries and what the tests read for "a blank line between paragraphs".
|    #>
|    param([AllowEmptyString()][string]$Html)
|    if (-not $Html) { return '' }
|    $h = [regex]::Replace($Html, '(?is)<(head|style|script)\b.*?</\1>', '')
|    $h = [regex]::Replace($h, '(?is)<!--.*?-->', '')
|    $h = $h -replace "[\r\n\t]+", ' '
|    $h = [regex]::Replace($h, '(?is)<a\b[^>]*href="(https?://[^"]+)"[^>]*>(.*?)</a>', {
|        param($m)
|        $label = [regex]::Replace($m.Groups[2].Value, '<[^>]+>', '').Trim()
|        $url = [System.Net.WebUtility]::HtmlDecode($m.Groups[1].Value)
|        if (-not $label -or [System.Net.WebUtility]::HtmlDecode($label) -eq $url) { $url } else { $label + ' (' + $url + ')' }
|    })
|    $h = [regex]::Replace($h, '(?i)<br\s*/?>', "`n")
|    $h = [regex]::Replace($h, '(?i)<li\b[^>]*>', "`n- ")
|    $h = [regex]::Replace($h, '(?i)</t[dh]>', ' | ')
|    $h = [regex]::Replace($h, '(?i)</tr>', "`n")
|    $h = [regex]::Replace($h, '(?i)</?(p|h[1-6]|ul|ol|table|div|pre|blockquote)\b[^>]*>', "`n`n")
|    $h = [regex]::Replace($h, '<[^>]+>', '')
|    $h = [System.Net.WebUtility]::HtmlDecode($h)
|    $lines = foreach ($ln in ($h -split "`n")) {
|        $x = ($ln -replace '[  ]+', ' ').Trim()
|        $x = $x -replace '(\s*\|\s*)+$', ''
|        $x = $x -replace '^(\|\s*)+', ''
|        $x
|    }
|    # collapse: at most one blank line in a row, none at the ends
|    $out = New-Object System.Collections.Generic.List[string]
|    foreach ($x in $lines) {
|        if (-not $x) { if ($out.Count -and $out[$out.Count - 1] -ne '') { $out.Add('') }; continue }
|        $out.Add($x)
|    }
|    while ($out.Count -and $out[$out.Count - 1] -eq '') { $out.RemoveAt($out.Count - 1) }
|    ($out -join "`r`n")
|}
|
|function Format-SIMailBody {
|    <#
|        PURE. THE chokepoint every mail goes through (Send-SIMail calls it on every body). Returns @{ Html; Text }.
|          plain text (no HTML tag)  -> the MAIL-2 layout around it, its paragraphs and line breaks kept (New-SIMailLayout)
|          HTML                      -> structure kept; every <p> without a margin of its own gets the explicit paragraph
|                                       margin (Outlook drops the default spacing); a raw line break INSIDE a paragraph's
|                                       text (multi-line free text) becomes <br> (a blank line: a paragraph break)
|        Idempotent: a body already formatted is returned as it is.
|    #>
|    param([AllowEmptyString()][string]$BodyHtml, [string]$Title = 'SecurityInsight')
|    $L = $script:SIMailLayout
|    if ($BodyHtml -match $L.Marker) { return [pscustomobject]@{ Html = $BodyHtml; Text = (ConvertTo-SIMailText -Html $BodyHtml) } }
|    # HTML = it carries a mail markup element. A text that merely holds something tag-like ("<script>" in a reason, an
|    # address in angle brackets) is TEXT: it gets the layout, encoded -- never passed through as HTML.
|    if ($BodyHtml -notmatch $L.HtmlElement) {
|        # a plain-text body: never put raw text into HTML
|        return (New-SIMailLayout -Title $Title -Paragraphs @(([string]$BodyHtml).Trim()))
|    }
|    $html = $BodyHtml
|    # raw line breaks inside a paragraph's text -> <br> (two -> a paragraph gap)
|    $html = [regex]::Replace($html, '(?is)(<p\b[^>]*>)(.*?)(</p>)', {
|        param($m)
|        $inner = $m.Groups[2].Value
|        $inner = [regex]::Replace($inner, '(?<=[^\s>])[ \t]*\r?\n[ \t]*\r?\n[ \t]*(?=[^\s<])', '<br><br>')
|        $inner = [regex]::Replace($inner, '(?<=[^\s>])[ \t]*\r?\n[ \t]*(?=[^\s<])', '<br>')
|        $m.Groups[1].Value + $inner + $m.Groups[3].Value
|    })
|    # every <p> carries an explicit margin
|    $html = [regex]::Replace($html, '(?i)<p(\s[^>]*)?>', {
|        param($m)
|        $attrs = $m.Groups[1].Value
|        if ($attrs -match '(?i)\bstyle\s*=\s*"([^"]*)"') {
|            $st = $matches[1]
|            if ($st -match '(?i)(^|;)\s*margin(-[a-z]+)?\s*:') { return $m.Value }   # its own margin (or margin-top ...) is kept
|            $newSt = $st.TrimEnd(';', ' ') + $(if ($st.Trim()) { ';' } else { '' }) + $L.PStyle
|            return ('<p' + ($attrs -replace '(?i)\bstyle\s*=\s*"[^"]*"', ('style="' + $newSt.Replace('$', '$$') + '"')) + '>')
|        }
|        '<p' + $attrs + ' style="' + $L.PStyle + '">'
|    })
|    # the marker: formatted once
|    if ($html -match '(?i)<body\b') { $html = [regex]::Replace($html, '(?i)<body\b', ('<body ' + $L.Marker + '="1"'), 1) }
|    else { $html = '<div ' + $L.Marker + '="1">' + $html + '</div>' }
|    [pscustomobject]@{ Html = $html; Text = (ConvertTo-SIMailText -Html $html) }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-MailPdf.ps1'] = @{ Sha256 = 'e603968eb03994fb2b8f564f26580296768fc713924bf4464e186f2a27e94592'; Text = @'
|# pwsh 7 (Add-Type on .NET 8); in Windows PowerShell 5.1 the PDF is simply not built and the mail goes without it.
|<#
|    SECURITYINSIGHT -- THE MAIL PDF (REQUIREMENTS #574; owner: "include pdf file with summary and relavant infp in mails").
|    Send-SIMail (SI-MailTransport.ps1) attaches ONE PDF to every mail that reports something: the mail's own content (after
|    the #573 layout) -- its summary first, then the facts, lists and tables in the mail's order -- as an A4 PDF. Built by
|    the ONE PDF builder, engine/_shared/pdf/SIMailPdf.cs (the web app compiles the same file), compiled here with Add-Type
|    against the PDFsharp + MigraDoc DLLs (MIT; container/Install-SIPdfLibrary.ps1 puts them in the images, SI_PDF_LIB).
|
|    A PDF that cannot be built NEVER blocks the mail: New-SIMailPdf returns the reason, Send-SIMail sends without it and
|    says so. No PowerShell module, no browser, no native code.
|#>
|
|# NO Set-StrictMode here -- it leaks into the caller's scope.
|
|$script:SIMailPdfRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
|$script:SIMailPdfState = @{ Loaded = $false; Error = $null }
|
|function Get-SIPdfPackageManifest {
|    <# The pinned package list (engine/_shared/pdf/SI.Pdf.packages.json). #>
|    Get-Content -Raw -LiteralPath ([IO.Path]::Combine($PSScriptRoot, 'pdf', 'SI.Pdf.packages.json')) | ConvertFrom-Json
|}
|
|function Find-SIPdfLibrary {
|    <#
|        Where the PDF DLLs are: @{ Files (name -> path); Missing (names) }. Looked for, per DLL, in: SI_PDF_LIB, /opt/si/pdf
|        (the images), engine/_shared/pdf/lib (a local install), then the NuGet package cache (a developer or test machine
|        that built the web app: ~/.nuget/packages/<id>/<version>/lib/net8.0).
|    #>
|    param([string[]]$Dirs)
|    $m = Get-SIPdfPackageManifest
|    $fw = [string]$m.framework
|    $base = @()
|    if ($Dirs) { $base += $Dirs }
|    if ("$env:SI_PDF_LIB".Trim()) { $base += "$env:SI_PDF_LIB".Trim() }
|    $base += '/opt/si/pdf'
|    $base += [IO.Path]::Combine($PSScriptRoot, 'pdf', 'lib')
|    $nuget = if ("$env:NUGET_PACKAGES".Trim()) { "$env:NUGET_PACKAGES".Trim() } else { [IO.Path]::Combine([Environment]::GetFolderPath('UserProfile'), '.nuget', 'packages') }
|    $files = [ordered]@{}; $missing = @()
|    foreach ($p in @($m.packages)) {
|        foreach ($dll in @($p.dlls)) {
|            $hit = $null
|            foreach ($d in $base) { $c = [IO.Path]::Combine($d, $dll); if (Test-Path -LiteralPath $c) { $hit = $c; break } }
|            if (-not $hit) { $c = [IO.Path]::Combine($nuget, ([string]$p.id).ToLowerInvariant(), [string]$p.version, 'lib', $fw, $dll); if (Test-Path -LiteralPath $c) { $hit = $c } }
|            if ($hit) { $files[$dll] = $hit } else { $missing += $dll }
|        }
|    }
|    [pscustomobject]@{ Files = $files; Missing = $missing }
|}
|
|function Import-SIPdfBuilder {
|    <# Loads the PDF DLLs and compiles the ONE builder (SIMailPdf.cs) once per process. $true, or $false with the reason
|       in $script:SIMailPdfState.Error. Never throws. #>
|    param([string[]]$Dirs)
|    if ('SecurityInsight.Pdf.SIMailPdf' -as [type]) { $script:SIMailPdfState.Loaded = $true; return $true }
|    try {
|        $lib = Find-SIPdfLibrary -Dirs $Dirs
|        if (@($lib.Missing).Count) { throw ('the PDF library is not installed (missing: {0}; the images carry it in /opt/si/pdf)' -f (@($lib.Missing) -join ', ')) }
|        $loaded = @{}; foreach ($a in [AppDomain]::CurrentDomain.GetAssemblies()) { $loaded[$a.GetName().Name] = $true }
|        # dependencies first
|        $order = @('Microsoft.Extensions.DependencyInjection.Abstractions.dll', 'Microsoft.Extensions.Logging.Abstractions.dll', 'PdfSharp.Shared.dll', 'PdfSharp.System.dll', 'PdfSharp.dll', 'PdfSharp.Charting.dll', 'MigraDoc.DocumentObjectModel.dll', 'MigraDoc.Rendering.dll')
|        foreach ($n in $order) {
|            if (-not $lib.Files.Contains($n)) { continue }
|            if ($loaded.ContainsKey([IO.Path]::GetFileNameWithoutExtension($n))) { continue }
|            $null = [Reflection.Assembly]::LoadFrom([string]$lib.Files[$n])
|        }
|        $src = [IO.Path]::Combine($PSScriptRoot, 'pdf', 'SIMailPdf.cs')
|        # -ReferencedAssemblies replaces Add-Type's default references: the PDF DLLs + .NET's own reference set (pwsh ships it
|        # in $PSHOME/ref; without that folder, the runtime's own assemblies)
|        $netRefs = @()
|        $refDir = [IO.Path]::Combine($PSHOME, 'ref')
|        if (Test-Path -LiteralPath $refDir) { $netRefs = @(Get-ChildItem -LiteralPath $refDir -Filter '*.dll' -File | ForEach-Object FullName) }
|        else { $netRefs = @(([string][AppContext]::GetData('TRUSTED_PLATFORM_ASSEMBLIES')) -split [IO.Path]::PathSeparator | Where-Object { $_ -match '[\\/](System|Microsoft\.CSharp|netstandard|mscorlib)[^\\/]*\.dll$' }) }
|        $refs = @(@($lib.Files.Values | ForEach-Object { [string]$_ }) + $netRefs)
|        Add-Type -Path $src -ReferencedAssemblies $refs -IgnoreWarnings -ErrorAction Stop
|        $script:SIMailPdfState.Loaded = $true; $script:SIMailPdfState.Error = $null
|        return $true
|    } catch {
|        $script:SIMailPdfState.Error = $_.Exception.Message
|        return $false
|    }
|}
|
|function ConvertTo-SIMailPdfFileName {
|    <# PURE. 'SecurityInsight - <subject>.pdf', safe on every file system, at most ~90 characters. #>
|    param([string]$Subject)
|    $s = ("$Subject" -replace '[\\/:*?"<>|\[\]\r\n\t]+', ' ' -replace '\s+', ' ').Trim(' ', '.', '-')
|    if (-not $s) { $s = 'SecurityInsight' }
|    if ($s -notmatch '(?i)securityinsight') { $s = 'SecurityInsight - ' + $s }
|    if ($s.Length -gt 86) { $s = $s.Substring(0, 86).TrimEnd(' ', '.', '-') }
|    $s + '.pdf'
|}
|
|function New-SIMailPdf {
|    <#
|        The PDF of a mail: -Title (the subject), -Html (the body as it is sent). Returns @{ Bytes; Error }; never throws.
|        The footer line names SecurityInsight and the environment (-Footer).
|    #>
|    param([string]$Title, [AllowEmptyString()][string]$Html, [string]$Footer = 'SecurityInsight')
|    if (-not (Import-SIPdfBuilder)) { return [pscustomobject]@{ Bytes = $null; Error = [string]$script:SIMailPdfState.Error } }
|    try {
|        $bytes = [SecurityInsight.Pdf.SIMailPdf]::FromHtml($Title, $Html, $Footer)
|        if (-not $bytes -or $bytes.Length -lt 100) { throw 'the PDF came out empty' }
|        [pscustomobject]@{ Bytes = $bytes; Error = $null }
|    } catch {
|        $e = $_.Exception; while ($e.InnerException) { $e = $e.InnerException }
|        [pscustomobject]@{ Bytes = $null; Error = ('the PDF could not be built: ' + $e.Message) }
|    }
|}
|
|function Save-SIMailPdf {
|    <# Writes the PDF bytes to a fresh temp folder under its mail name; returns the path (Send-SIMail removes it). #>
|    param([Parameter(Mandatory)][byte[]]$Bytes, [string]$Subject)
|    $dir = [IO.Path]::Combine([IO.Path]::GetTempPath(), 'si-mail-pdf-' + [guid]::NewGuid().ToString('N'))
|    $null = New-Item -ItemType Directory -Force -Path $dir
|    $path = [IO.Path]::Combine($dir, (ConvertTo-SIMailPdfFileName -Subject $Subject))
|    [IO.File]::WriteAllBytes($path, $Bytes)
|    $path
|}
'@ }
$__siSupportFiles['engine/_shared/pdf/SI.Pdf.packages.json'] = @{ Sha256 = '19d358ee948712aa60363528bb3991f5bdf167508875723099246bbe9c756934'; Text = @'
|{
|  "_comment": "#574 -- the .NET PDF library SecurityInsight renders its mail PDFs with: PDFsharp + MigraDoc 6.2.4 (MIT, verified on the nuspec of this exact version: <license type=\"expression\">MIT</license>; https://licenses.nuget.org/MIT) and its two Microsoft.Extensions dependencies (MIT). Never QuestPDF. ONE pinned list for every consumer: container/Install-SIPdfLibrary.ps1 downloads exactly these packages at image build and refuses any whose SHA-512 differs; engine/_shared/SI-MailPdf.ps1 finds the DLLs by these names; engine/_shared/pdf/SI.Pdf.csproj references the same versions (a test keeps them equal). Only the managed DLLs listed here are copied -- no native code, no executable, no PowerShell module.",
|  "framework": "net8.0",
|  "packages": [
|    { "id": "PDFsharp", "version": "6.2.4", "license": "MIT",
|      "sha512": "2b5fea680c984317f8839ece1804b6d51c436e2e67017e13ad68edf110707530b6340c0ef2f3c57860b4b1f7352ef42c162b5ea425c5b3a08685a9c0d4d45f0e",
|      "dlls": [ "PdfSharp.dll", "PdfSharp.Shared.dll", "PdfSharp.System.dll", "PdfSharp.Charting.dll" ] },
|    { "id": "PDFsharp-MigraDoc", "version": "6.2.4", "license": "MIT",
|      "sha512": "0dff6eddb3086207f0458fa0815d311b5b65f626fa3279bf2c4ca79ce18a37b1920ff282323949302c295fe096c9a621c868c8537718d16f2283624064eb5f19",
|      "dlls": [ "MigraDoc.DocumentObjectModel.dll", "MigraDoc.Rendering.dll" ] },
|    { "id": "Microsoft.Extensions.Logging.Abstractions", "version": "8.0.3", "license": "MIT",
|      "sha512": "e689ec1e2cb9d2fafa9fd9f6ab861a0895aa9a1cbc9fb37e9dd856c8d1709004eb1455e64570b51013be88b60e9ae0c44f8f853932d9cdeab33ddb42fcec199b",
|      "dlls": [ "Microsoft.Extensions.Logging.Abstractions.dll" ] },
|    { "id": "Microsoft.Extensions.DependencyInjection.Abstractions", "version": "8.0.2", "license": "MIT",
|      "sha512": "ba1960ef110ac7387a2a06eefc02c59ce57b0fe58b3e0cccb79b1c8f2150105c5d1f4b65e0ed95ff50d70f28142917c6a735b83f4e5406bb1d8f9dd1f9635d7d",
|      "dlls": [ "Microsoft.Extensions.DependencyInjection.Abstractions.dll" ] }
|  ]
|}
'@ }
$__siSupportFiles['engine/_shared/SI-SourceState.ps1'] = @{ Sha256 = '8a30c2e117dc25434e40ce423758aaa5d951e53d182bc4443d1c0637a44f10f1'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE STATE OF EACH SOURCE (owner 2026-10-12: "a source dropout should not block ci calculation, then
|    use latest avail collection from the source" / "last known state is sufficient to send if a source is not working").
|
|    A SOURCE is one collection step of the pipeline (identity / azure / endpoint / publicip). The pipeline runner tells
|    this store how each collection ended (engine\_shared\SI-JobFlow.ps1, -SourceState):
|
|      Good     the collection ended well: the source's last good collection is this one.
|      Dropped  the collection did not end well. Two things happen, in ONE statement:
|                 1. nothing it wrote counts as a complete collection. A feed (provider + record type) the failed step had
|                    already closed since it started (a collection in several processes: one of them died) is HELD: its
|                    row in sidata.RecordCollection says so, and ONE of its records is marked "not complete" -- the CI
|                    build reads a feed's completeness from its newest collection's records (Get-SICiFeedLatestSql), so
|                    every record the collection did not reach stays FROZEN (it keeps its CI active) instead of turning
|                    'not seen'. A collection that never closed is not complete already (SI-RecordSql.ps1: the feed close).
|                 2. the source is recorded as on its last good collection (sidata.SourceState: LastGoodAt stays, the
|                    attempt and the first moment it dropped are kept) -- what the run's sentence, the data sync and the
|                    finding lifecycle read.
|
|    The two tables come from sql\si-data-schema.sql (the updater applies it); on a database that does not have them yet
|    every statement here answers "nothing" and changes nothing. SQL over the (sql, params, mode) seam the record writer
|    uses (New-SIRecordSqlInvoke: every parameter is text; mode 'rows' answers objects). Free code, both editions.
|    PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|function Get-SISourceStateSql {
|    <# The T-SQL of the source state (one place; the real-SQL test runs it against sql\si-data-schema.sql). Times are ISO
|       text (@sinceText, @nowText); a feed the step wrote counts from 5 minutes before the step started (clocks differ). #>
|    param([Parameter(Mandatory)][ValidateSet('Good', 'Dropped', 'Read')][string]$Name)
|    switch ($Name) {
|        'Good' { @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.SourceState') IS NULL BEGIN SELECT CAST(NULL AS DATETIME2(3)) AS LastGoodAt, 0 AS Held; RETURN; END
|DECLARE @since DATETIME2(3) = TRY_CONVERT(DATETIME2(3), NULLIF(@sinceText, N''), 127);
|DECLARE @now DATETIME2(3) = ISNULL(TRY_CONVERT(DATETIME2(3), NULLIF(@nowText, N''), 127), SYSUTCDATETIME());
|DECLARE @good DATETIME2(3) = NULL;
|IF OBJECT_ID('sidata.RecordCollection') IS NOT NULL
|    SELECT @good = MAX(CollectionTime) FROM sidata.RecordCollection
|    WHERE Engine = @source AND State = N'good' AND CollectionTime >= DATEADD(minute, -5, ISNULL(@since, @now));
|SET @good = COALESCE(@good, @since, @now);
|MERGE sidata.SourceState AS t
|USING (SELECT @source AS Source) AS s ON t.Source = s.Source
|WHEN MATCHED THEN UPDATE SET LastGoodAt = @good, LastAttemptAt = @now, LastAttemptOk = 1, DroppedSince = NULL, Detail = NULL, UpdatedAt = SYSUTCDATETIME()
|WHEN NOT MATCHED THEN INSERT (Source, LastGoodAt, LastAttemptAt, LastAttemptOk) VALUES (@source, @good, @now, 1);
|SELECT @good AS LastGoodAt, 0 AS Held;
|'@ }
|        'Dropped' { @'
|SET NOCOUNT ON;
|SET XACT_ABORT ON;
|IF OBJECT_ID('sidata.SourceState') IS NULL BEGIN SELECT CAST(NULL AS DATETIME2(3)) AS LastGoodAt, 0 AS Held; RETURN; END
|DECLARE @since DATETIME2(3) = TRY_CONVERT(DATETIME2(3), NULLIF(@sinceText, N''), 127);
|DECLARE @now DATETIME2(3) = ISNULL(TRY_CONVERT(DATETIME2(3), NULLIF(@nowText, N''), 127), SYSUTCDATETIME());
|DECLARE @from DATETIME2(3) = DATEADD(minute, -5, ISNULL(@since, @now));
|DECLARE @held INT = 0, @before DATETIME2(3) = NULL;
|BEGIN TRANSACTION;
|IF OBJECT_ID('sidata.RecordCollection') IS NOT NULL
|BEGIN
|    -- 1. every feed this collection had closed since the step started is held: it did not end well
|    DECLARE @h TABLE (Provider NVARCHAR(32) NOT NULL, RecordType NVARCHAR(32) NOT NULL, CollectionTime DATETIME2(3) NOT NULL);
|    UPDATE sidata.RecordCollection SET State = N'held', Reason = LEFT(N'the collection did not complete: ' + ISNULL(@why, N''), 400), UpdatedAt = SYSUTCDATETIME()
|    OUTPUT inserted.Provider, inserted.RecordType, inserted.CollectionTime INTO @h (Provider, RecordType, CollectionTime)
|    WHERE Engine = @source AND State = N'good' AND CollectionTime >= @from;
|    SET @held = @@ROWCOUNT;
|    IF @held > 0
|    BEGIN
|        -- one record of each held feed's collection says "not complete": the CI build then freezes what that collection missed
|        ;WITH x AS (SELECT r.RecordKey, ROW_NUMBER() OVER (PARTITION BY r.Provider, ISNULL(r.RecordType, N'') ORDER BY r.RecordKey) AS n
|                   FROM sidata.CiRecord r JOIN @h h ON h.Provider = r.Provider AND h.RecordType = ISNULL(r.RecordType, N'') AND h.CollectionTime = r.CollectionTime)
|        UPDATE r SET Complete = 0 FROM sidata.CiRecord r JOIN x ON x.RecordKey = r.RecordKey WHERE x.n = 1;
|    END
|    -- a source that dropped before its state was ever recorded: its last good collection is the newest one it closed before
|    SELECT @before = MAX(CollectionTime) FROM sidata.RecordCollection WHERE Engine = @source AND State = N'good' AND CollectionTime < @from;
|END
|-- 2. the source is on its last good collection
|MERGE sidata.SourceState AS t
|USING (SELECT @source AS Source) AS s ON t.Source = s.Source
|WHEN MATCHED THEN UPDATE SET LastGoodAt = ISNULL(t.LastGoodAt, @before), LastAttemptAt = @now, LastAttemptOk = 0, DroppedSince = ISNULL(t.DroppedSince, @now),
|     Detail = LEFT(ISNULL(@why, N''), 400), UpdatedAt = SYSUTCDATETIME()
|WHEN NOT MATCHED THEN INSERT (Source, LastGoodAt, LastAttemptAt, LastAttemptOk, DroppedSince, Detail) VALUES (@source, @before, @now, 0, @now, LEFT(ISNULL(@why, N''), 400));
|COMMIT TRANSACTION;
|SELECT LastGoodAt, @held AS Held FROM sidata.SourceState WHERE Source = @source;
|'@ }
|        'Read' { @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.SourceState') IS NULL
|    SELECT CAST(NULL AS NVARCHAR(32)) AS Source, CAST(NULL AS DATETIME2(3)) AS LastGoodAt, CAST(NULL AS DATETIME2(3)) AS LastAttemptAt, CAST(NULL AS BIT) AS LastAttemptOk,
|           CAST(NULL AS DATETIME2(3)) AS DroppedSince, CAST(NULL AS NVARCHAR(400)) AS Detail WHERE 1 = 0
|ELSE
|    SELECT Source, LastGoodAt, LastAttemptAt, LastAttemptOk, DroppedSince, Detail FROM sidata.SourceState ORDER BY Source;
|'@ }
|    }
|}
|
|function ConvertTo-SISourceStateTime {
|    <# PURE. A time as the ISO text the statements take ('' for none); a database time back as UTC [datetime] or $null. #>
|    param($Value, [switch]$FromDb)
|    if ($null -eq $Value -or $Value -is [DBNull] -or "$Value" -eq '') { if ($FromDb) { return $null } else { return '' } }
|    if ($FromDb) {
|        if ($Value -is [datetime]) { return [datetime]::SpecifyKind([datetime]$Value, 'Utc') }
|        try { return [datetime]::Parse([string]$Value, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal) } catch { return $null }
|    }
|    ([datetime]$Value).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ', [Globalization.CultureInfo]::InvariantCulture)
|}
|
|function ConvertFrom-SISourceStateRow {
|    <# PURE. A sidata.SourceState row (object or hashtable) as @{ Source; LastGoodUtc; LastAttemptUtc; Ok; DroppedSinceUtc; Detail }. #>
|    param($Row)
|    if ($null -eq $Row) { return $null }
|    if ($Row -is [System.Collections.IDictionary]) { $Row = [pscustomobject]$Row }
|    $g = { param($n) if ($Row.PSObject.Properties[$n]) { $Row.$n } else { $null } }
|    $ok = & $g 'LastAttemptOk'
|    [pscustomobject]@{ Source = [string](& $g 'Source'); LastGoodUtc = (ConvertTo-SISourceStateTime (& $g 'LastGoodAt') -FromDb); LastAttemptUtc = (ConvertTo-SISourceStateTime (& $g 'LastAttemptAt') -FromDb)
|                       Ok = ($null -eq $ok -or $ok -is [DBNull] -or "$ok" -in @('True', '1')); DroppedSinceUtc = (ConvertTo-SISourceStateTime (& $g 'DroppedSince') -FromDb)
|                       Detail = $(if ($null -eq (& $g 'Detail') -or (& $g 'Detail') -is [DBNull]) { '' } else { [string](& $g 'Detail') }) }
|}
|
|function New-SISourceStateStore {
|    <#
|        The source state over the database seam -Invoke { param($Sql, $Params, $Mode) } (New-SIRecordSqlInvoke, or a test's).
|        Good($Source, $SinceUtc, $NowUtc) and Dropped($Source, $SinceUtc, $NowUtc, $Why) answer when that source last
|        collected completely (UTC, or $null: never recorded); Read() answers every source's row. The methods throw on a
|        database error -- the pipeline runner catches it, says it and goes on.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke)
|    $o = [pscustomobject]@{ Invoke = $Invoke }
|    $o | Add-Member -MemberType ScriptMethod -Name Good -Value {
|        param($Source, $SinceUtc, $NowUtc)
|        $r = @(& $this.Invoke (Get-SISourceStateSql 'Good') @{ source = ([string]$Source).ToLowerInvariant(); sinceText = (ConvertTo-SISourceStateTime $SinceUtc); nowText = (ConvertTo-SISourceStateTime $NowUtc) } 'rows' | ForEach-Object { $_ }) | Select-Object -First 1
|        if ($r -is [System.Collections.IDictionary]) { $r = [pscustomobject]$r }
|        if ($r) { ConvertTo-SISourceStateTime $r.LastGoodAt -FromDb } else { $null }
|    }
|    $o | Add-Member -MemberType ScriptMethod -Name Dropped -Value {
|        param($Source, $SinceUtc, $NowUtc, $Why)
|        $r = @(& $this.Invoke (Get-SISourceStateSql 'Dropped') @{ source = ([string]$Source).ToLowerInvariant(); sinceText = (ConvertTo-SISourceStateTime $SinceUtc); nowText = (ConvertTo-SISourceStateTime $NowUtc); why = [string]$Why } 'rows' | ForEach-Object { $_ }) | Select-Object -First 1
|        if ($r -is [System.Collections.IDictionary]) { $r = [pscustomobject]$r }
|        if ($r) { ConvertTo-SISourceStateTime $r.LastGoodAt -FromDb } else { $null }
|    }
|    $o | Add-Member -MemberType ScriptMethod -Name Read -Value {
|        # flattened first: the data sync's seam hands the rows back as ONE array object, which would be read as a single row
|        @(& $this.Invoke (Get-SISourceStateSql 'Read') @{} 'rows' | ForEach-Object { $_ } | Where-Object { $null -ne $_ } | ForEach-Object { ConvertFrom-SISourceStateRow $_ } | Where-Object { $_ -and $_.Source })
|    }
|    $o
|}
|
|function Get-SISourceDropouts {
|    <#
|        The sources that are on their LAST GOOD collection right now (their newest collection did not end well):
|        @(@{ Source; LastGoodUtc; DroppedSinceUtc; Detail }). Never throws: a database that cannot be read answers none
|        (and says so through -Log) -- callers that must be careful treat "cannot tell" themselves.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [scriptblock]$Log)
|    try {
|        @((New-SISourceStateStore -Invoke $Invoke).Read() | Where-Object { -not $_.Ok })
|    } catch {
|        if ($Log) { & $Log 'WARN' ('the state of the sources could not be read ({0})' -f $_.Exception.Message) }
|        @()
|    }
|}
|
|# =====================================================================================================================
|#  WHAT RESTS ON A DROPPED SOURCE -- only that is frozen (owner 2026-10-12: "Freeze only if ALL its sources are down")
|# =====================================================================================================================
|# While a source is on its last good collection, a finding or ticket that goes missing is FROZEN (never counted absent,
|# never closed) only when EVERY source that describes its CI is down; a CI that at least one healthy source still
|# describes closes its findings as usual. What can be told with certainty is which CIs a source describes: the feeds
|# (provider + record type) each collection step writes are registered when a collection closes
|# (sidata.RecordCollection.Engine), and sidata.CiRecord says which CI every record belongs to -- the unit is the CI:
|#   FROZEN   every CI that has a record in a feed of a dropped source and NO record in a feed of a healthy source,
|#            every owner that is not a CI, and every CI no record points to;
|#   AS USUAL every CI that a healthy source describes (also when a dropped source describes it too), and every CI no
|#            dropped source describes.
|#   (A feed that both a dropped and a healthy collection step write counts as dropped; a record of a feed no collection
|#   step registered -- a CMDB record -- is no evidence either way.)
|# THE KNOWN CONSEQUENCE, accepted by the owner: a finding that ONLY the dropped source could see, on a CI another source
|# still describes, can be counted absent and closed after the usual complete runs although nothing shows a fix. It opens
|# again, as reopened, when that source is back.
|# A dropped source whose feeds are not known (nothing registered in the last 30 days) cannot be attributed at all: then
|# nothing is closed in that run (Known = $false).
|
|function Get-SISourceDropoutOwnersSql {
|    <# The T-SQL of the per-source freeze. 'Sources': each dropped source and how many feeds are known for it.
|       'Lifecycle': the finding-lifecycle OWNER keys to freeze (the CIs ONLY dropped sources describe, and the open owners
|       that cannot be attributed). 'Cis': every CI that has records, N = 1 when only dropped sources describe it. #>
|    param([Parameter(Mandatory)][ValidateSet('Sources', 'Lifecycle', 'Cis')][string]$Name)
|    $head = @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.SourceState') IS NULL OR OBJECT_ID('sidata.RecordCollection') IS NULL OR OBJECT_ID('sidata.CiRecord') IS NULL
|BEGIN
|    SELECT CAST(NULL AS NVARCHAR(450)) AS K, 0 AS N WHERE 1 = 0;
|    RETURN;
|END
|'@
|    $feeds = @'
|WITH f AS (SELECT DISTINCT c.Provider, c.RecordType
|           FROM sidata.RecordCollection c JOIN sidata.SourceState d ON d.Source = c.Engine
|           WHERE d.LastAttemptOk = 0 AND c.CollectionTime >= DATEADD(day, -30, SYSUTCDATETIME())),
|     g AS (SELECT DISTINCT c.Provider, c.RecordType
|           FROM sidata.RecordCollection c
|           WHERE c.CollectionTime >= DATEADD(day, -30, SYSUTCDATETIME()) AND c.Engine <> N''
|             AND NOT EXISTS (SELECT 1 FROM sidata.SourceState d WHERE d.Source = c.Engine AND d.LastAttemptOk = 0)
|             AND NOT EXISTS (SELECT 1 FROM f WHERE f.Provider = c.Provider AND f.RecordType = c.RecordType)),
|     x AS (SELECT r.CiId, MAX(CASE WHEN f.Provider IS NULL THEN 0 ELSE 1 END) AS Down, MAX(CASE WHEN g.Provider IS NULL THEN 0 ELSE 1 END) AS Healthy
|           FROM sidata.CiRecord r
|           LEFT JOIN f ON f.Provider = r.Provider AND f.RecordType = ISNULL(r.RecordType, N'')
|           LEFT JOIN g ON g.Provider = r.Provider AND g.RecordType = ISNULL(r.RecordType, N'')
|           WHERE r.CiId IS NOT NULL GROUP BY r.CiId)
|'@
|    switch ($Name) {
|        'Sources' { $head + @'
|
|SELECT d.Source AS K,
|       (SELECT COUNT(*) FROM (SELECT DISTINCT c.Provider, c.RecordType FROM sidata.RecordCollection c
|                              WHERE c.Engine = d.Source AND c.CollectionTime >= DATEADD(day, -30, SYSUTCDATETIME())) x) AS N
|FROM sidata.SourceState d WHERE d.LastAttemptOk = 0;
|'@ }
|        # ONE result set (a seam may read only the first): the CIs a dropped source describes, and the open owners that are
|        # not a CI or whose CI no record points to. No lifecycle table = no lifecycle rows = nothing to freeze.
|        'Lifecycle' { $head + @'
|
|IF OBJECT_ID('sidata.CiFindingState') IS NULL
|BEGIN
|    SELECT CAST(NULL AS NVARCHAR(450)) AS K, 0 AS N WHERE 1 = 0;
|    RETURN;
|END
|;
|'@ + $feeds + @'
|,
|-- an open owner under an asset key (no CI id; an empty one is none): the CIs its asset is PROVEN to belong to -- a stored
|-- finding of a CI that names the asset id, or the CI link of the asset's own id
|oa AS (SELECT DISTINCT s.OwnerKey FROM sidata.CiFindingState s
|       WHERE s.State <> N'closed' AND NULLIF(s.CiId, N'') IS NULL AND s.OwnerKey LIKE N'asset:%'),
|lk AS (SELECT oa.OwnerKey, cf.CiId FROM oa JOIN sidata.CiFinding cf ON N'asset:' + LOWER(cf.AssetId) = oa.OwnerKey
|       WHERE NULLIF(cf.CiId, N'') IS NOT NULL AND NULLIF(cf.AssetId, N'') IS NOT NULL
|       UNION
|       SELECT oa.OwnerKey, l.CiId FROM oa JOIN sidata.CiLink l ON l.NativeId = SUBSTRING(oa.OwnerKey, 7, 450)),
|-- unfrozen ONLY when the link is proven (exactly one CI) AND every source of that CI is on a current collection (its
|-- records rest on no dropped source, and on at least one healthy one); anything unproven stays frozen
|pv AS (SELECT k.OwnerKey FROM lk k GROUP BY k.OwnerKey
|       HAVING COUNT(DISTINCT k.CiId) = 1 AND EXISTS (SELECT 1 FROM x WHERE x.CiId = MIN(k.CiId) AND x.Down = 0 AND x.Healthy = 1))
|SELECT CAST(x.CiId AS NVARCHAR(450)) AS K, 1 AS N
|FROM x WHERE x.Down = 1 AND x.Healthy = 0
|UNION
|SELECT s.OwnerKey AS K, 0 AS N FROM sidata.CiFindingState s
|WHERE s.State <> N'closed' AND (NULLIF(s.CiId, N'') IS NULL OR NOT EXISTS (SELECT 1 FROM sidata.CiRecord r WHERE r.CiId = s.CiId))
|  AND NOT EXISTS (SELECT 1 FROM pv WHERE pv.OwnerKey = s.OwnerKey);
|'@ }
|        'Cis' { $head + @'
|
|;
|'@ + $feeds + @'
|
|SELECT x.CiId AS K, CASE WHEN x.Down = 1 AND x.Healthy = 0 THEN 1 ELSE 0 END AS N FROM x;
|'@ }
|    }
|}
|
|function Get-SISourceDropoutOwners {
|    <#
|        What must be frozen while a source is on its last good collection. -For Lifecycle (default): .Owners = the finding
|        lifecycle's owner keys to freeze. -For Cis: .Healthy = the CI keys (lower case) whose records are all from healthy
|        sources -- every other asset is frozen (Test-SISourceAssetFrozen).
|        Returns @{ Dropouts; Known; Owners; Unlinked; Healthy; Why } (Unlinked: the open owners frozen because no CI with current sources is proven for them). No source dropped: Dropouts empty, Known $true, nothing frozen.
|        Known = $false when it cannot be told what rests on a dropped source (its feeds are not registered, or the database
|        could not be read) -- the caller then closes NOTHING in that run. Never throws.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [ValidateSet('Lifecycle', 'Cis')][string]$For = 'Lifecycle', [scriptblock]$Log)
|    $out = [ordered]@{ Dropouts = @(); Known = $true; Owners = @(); Unlinked = 0; Healthy = (New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)); Why = '' }
|    $val = { param($r, $n) if ($r -is [System.Collections.IDictionary]) { $r[$n] } elseif ($r -and $r.PSObject.Properties[$n]) { $r.$n } else { $null } }
|    try {
|        $out.Dropouts = @((New-SISourceStateStore -Invoke $Invoke).Read() | Where-Object { -not $_.Ok })
|        if (-not $out.Dropouts.Count) { return [pscustomobject]$out }
|        $known = @{}
|        foreach ($r in @(& $Invoke (Get-SISourceDropoutOwnersSql 'Sources') @{} 'rows' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })) { $known[[string](& $val $r 'K')] = [int](& $val $r 'N') }
|        $blind = @($out.Dropouts | Where-Object { -not $known.ContainsKey([string]$_.Source) -or $known[[string]$_.Source] -lt 1 } | ForEach-Object { [string]$_.Source })
|        if ($blind.Count) {
|            $out.Known = $false
|            $out.Why = ('which assets {0} describes is not known yet (no complete collection of it is registered)' -f ($blind -join ', '))
|            return [pscustomobject]$out
|        }
|        $rows = @(& $Invoke (Get-SISourceDropoutOwnersSql $For) @{} 'rows' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })
|        if ($For -eq 'Cis') {
|            foreach ($r in $rows) { $k = [string](& $val $r 'K'); if ($k -and [int](& $val $r 'N') -eq 0) { [void]$out.Healthy.Add($k.Trim()) } }
|        } else {
|            $out.Owners = @($rows | ForEach-Object { [string](& $val $_ 'K') } | Where-Object { $_ } | Sort-Object -Unique)
|            # the open owners frozen because no CI is proven for them (or their CI's sources are not shown current): counted, said
|            $out.Unlinked = @($rows | Where-Object { [int](& $val $_ 'N') -eq 0 -and [string](& $val $_ 'K') }).Count
|        }
|    } catch {
|        $out.Known = $false
|        $out.Why = ('what rests on the dropped source could not be read ({0})' -f $_.Exception.Message)
|        if ($Log) { & $Log 'WARN' $out.Why }
|    }
|    [pscustomobject]$out
|}
|
|function Test-SISourceAssetFrozen {
|    <# PURE. Is this asset (its CI key) frozen while a source is on its last good collection? Yes unless it is a CI whose
|       records are all from healthy sources (-Freeze: Get-SISourceDropoutOwners -For Cis). No source dropped: never. #>
|    param([AllowEmptyString()][AllowNull()][string]$Key, $Freeze)
|    if ($null -eq $Freeze -or -not @($Freeze.Dropouts).Count) { return $false }
|    $k = ([string]$Key).Trim()
|    if (-not $k) { return $true }
|    -not $Freeze.Healthy.Contains($k)
|}
|
|# =====================================================================================================================
|#  THE AGE OF A SOURCE -- known, said, and after 7 days it holds delivery (owner 2026-10-12: "last known state is
|#  sufficient to send if a source is not working" -- for a while: SI_Pro_SourceDropout_HoldDeliveryDays, default 7)
|# =====================================================================================================================
|function Get-SISourceAgeDays {
|    <# PURE. How many days a source has been without a good collection: 0 while its newest collection completed; else the
|       days since its last good collection (a source that never had one: since it first dropped). #>
|    param($Source, [datetime]$NowUtc = [datetime]::UtcNow)
|    if ($null -eq $Source -or $Source.Ok) { return 0.0 }
|    $from = $null
|    if ($Source.LastGoodUtc) { $from = ([datetime]$Source.LastGoodUtc).ToUniversalTime() } elseif ($Source.DroppedSinceUtc) { $from = ([datetime]$Source.DroppedSinceUtc).ToUniversalTime() }
|    if ($null -eq $from) { return 0.0 }
|    [math]::Round([math]::Max(0.0, ($NowUtc.ToUniversalTime() - $from).TotalDays), 2)
|}
|
|function Get-SISourceHoldDays {
|    <# PURE. After how many days without a good collection of a source delivery waits: SI_Pro_SourceDropout_HoldDeliveryDays,
|       default 7; 0 = delivery never waits for a source; anything that is not a whole number from 0 to 365 = the default. #>
|    param($Value = $global:SI_Pro_SourceDropout_HoldDeliveryDays)
|    $n = 0
|    if ($null -ne $Value -and [int]::TryParse(([string]$Value).Trim(), [ref]$n) -and $n -ge 0 -and $n -le 365) { return $n }
|    7
|}
|
|function Get-SISourceAgeText {
|    <# PURE. One plain line per source that is on its last good collection, with how old that collection is:
|       "endpoint has had no good collection for 3 days -- its data is from 2026-10-09 14:05 UTC". #>
|    param([AllowEmptyCollection()][object[]]$Sources = @(), [datetime]$NowUtc = [datetime]::UtcNow)
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    foreach ($s in @($Sources | Where-Object { $_ -and -not $_.Ok })) {
|        $d = Get-SISourceAgeDays -Source $s -NowUtc $NowUtc
|        $age = if ($d -lt 1) { '{0} hour(s)' -f [int][math]::Floor($d * 24) } else { '{0} day(s)' -f [int][math]::Floor($d) }
|        if ($s.LastGoodUtc) { '{0} has had no good collection for {1} -- its data is from {2} UTC' -f $s.Source, $age, ([datetime]$s.LastGoodUtc).ToUniversalTime().ToString('yyyy-MM-dd HH:mm', $inv) }
|        else { '{0} has had no good collection for {1}' -f $s.Source, $age }
|    }
|}
|
|function Get-SISourceDeliveryHold {
|    <#
|        PURE. Why delivery must wait, or '' when it need not: a source has had no good collection for -HoldDays days or
|        more. The calculation (the CI build, Risk Analysis) goes on; mails, tickets and the other delivery steps wait until
|        that source collects again -- what they would send rests on data that old. -HoldDays 0 = never.
|    #>
|    param([AllowEmptyCollection()][object[]]$Sources = @(), [datetime]$NowUtc = [datetime]::UtcNow, [int]$HoldDays = 7)
|    if ($HoldDays -le 0) { return '' }
|    $old = @($Sources | Where-Object { $_ -and -not $_.Ok -and (Get-SISourceAgeDays -Source $_ -NowUtc $NowUtc) -ge $HoldDays })
|    if (-not $old.Count) { return '' }
|    'delivery waits: {0} had no good collection for {1} days or more ({2}) -- nothing is mailed and no ticket is changed until that source collects again; the calculation goes on' -f `
|        ((@($old | ForEach-Object { [string]$_.Source })) -join ', '), $HoldDays,
|        ((@($old | ForEach-Object { '{0}: {1} days' -f $_.Source, [int][math]::Floor((Get-SISourceAgeDays -Source $_ -NowUtc $NowUtc)) })) -join ', ')
|}
|
|# =====================================================================================================================
|#  LABELLED EVERYWHERE -- the same sentence on the pages, on an export's info sheet and in the mails
|# =====================================================================================================================
|function Get-SISourceLabel {
|    <# PURE. A source as a person reads it: Endpoint / Identity / Azure / Public IP scan (the web app says the same). #>
|    param([AllowEmptyString()][AllowNull()][string]$Source)
|    switch (([string]$Source).Trim().ToLowerInvariant()) {
|        'endpoint' { 'Endpoint' } 'identity' { 'Identity' } 'azure' { 'Azure' } 'publicip' { 'Public IP scan' } default { [string]$Source }
|    }
|}
|
|function Get-SISourceNoteText {
|    <# PURE. "Endpoint data is from 2026-10-10 14:05 UTC -- the last collection from that source did not complete." #>
|    param([AllowEmptyString()][AllowNull()][string]$Source, $LastGoodUtc)
|    $when = 'its last good collection'
|    if ($LastGoodUtc) { $when = ([datetime]$LastGoodUtc).ToUniversalTime().ToString('yyyy-MM-dd HH:mm', [Globalization.CultureInfo]::InvariantCulture) + ' UTC' }
|    '{0} data is from {1} -- the last collection from that source did not complete.' -f (Get-SISourceLabel $Source), $when
|}
|
|function Get-SISourceCollectionMarkSql {
|    <#
|        ONE statement, at the end of every data sync: each loaded collection that was produced while a source was on its
|        last good collection gets a row saying which source and from when (sidata.CollectionSource) -- what the web app
|        shows when that collection is opened later. A collection is marked once; marks of collections that are gone are
|        cleared. Answers the rows added. Guarded: without the tables it does nothing.
|    #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.CollectionSource') IS NULL OR OBJECT_ID('sidata.SourceState') IS NULL OR OBJECT_ID('sidata.Collection') IS NULL
|BEGIN
|    SELECT 0 AS Marked;
|    RETURN;
|END
|DELETE FROM sidata.CollectionSource WHERE NOT EXISTS (SELECT 1 FROM sidata.Collection AS c WHERE c.CollectionId = sidata.CollectionSource.CollectionId);
|INSERT sidata.CollectionSource (CollectionId, Source, LastGoodAt)
|SELECT c.CollectionId, s.Source, s.LastGoodAt
|FROM sidata.Collection AS c CROSS JOIN sidata.SourceState AS s
|WHERE s.LastAttemptOk = 0 AND c.Status = N'Complete'
|  AND c.CollectionTime >= ISNULL(s.DroppedSince, c.CollectionTime)
|  AND NOT EXISTS (SELECT 1 FROM sidata.CollectionSource AS x WHERE x.CollectionId = c.CollectionId AND x.Source = s.Source);
|SELECT @@ROWCOUNT AS Marked;
|'@
|}
|
|function Invoke-SISourceCollectionMark {
|    <# The data sync's call: marks the loaded collections (Get-SISourceCollectionMarkSql). Never throws; returns the rows added. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [scriptblock]$Log)
|    try {
|        $n = & $Invoke (Get-SISourceCollectionMarkSql) @{} 'scalar'
|        if ($null -eq $n -or $n -is [DBNull]) { return 0 }
|        if ([int]$n -gt 0 -and $Log) { & $Log 'INFO' ("sources     : {0} collection(s) marked as calculated while a source was on its last good collection" -f [int]$n) }
|        [int]$n
|    } catch {
|        if ($Log) { & $Log 'WARN' ("sources     : the collections could not be marked ({0}) -- the web app shows the current state of the sources only" -f $_.Exception.Message) }
|        0
|    }
|}
|
|# the mails: read once per process (a job sends its mails within minutes), from the install's database
|$script:SISourceMailNotes = $null
|
|function Get-SISourceMailNotes {
|    <#
|        The sentence(s) a mail carries while a source is on its last good collection -- none when every source collected.
|        -Invoke: the database seam (default: the install's database, when one is configured). Never throws; read once per
|        process (-Fresh reads again).
|    #>
|    param([scriptblock]$Invoke, [switch]$Fresh)
|    if (-not $Fresh -and -not $Invoke -and $null -ne $script:SISourceMailNotes) { return @($script:SISourceMailNotes) }
|    $notes = @()
|    try {
|        if (-not $Invoke) {
|            if (-not ([string]$global:SI_ProSqlServer -and [string]$global:SI_ProSqlDatabase)) { return @() }
|            if (-not (Get-Command -Name New-SIRecordSqlInvoke -ErrorAction SilentlyContinue)) { . ([IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'data-model', 'SI-RecordSql.ps1')) }
|            $Invoke = New-SIRecordSqlInvoke
|            if (-not $Invoke) { return @() }
|            $notes = @(Get-SISourceDropouts -Invoke $Invoke | ForEach-Object { Get-SISourceNoteText -Source $_.Source -LastGoodUtc $_.LastGoodUtc })
|            $script:SISourceMailNotes = $notes
|        } else {
|            $notes = @(Get-SISourceDropouts -Invoke $Invoke | ForEach-Object { Get-SISourceNoteText -Source $_.Source -LastGoodUtc $_.LastGoodUtc })
|        }
|    } catch { $notes = @() }
|    @($notes)
|}
|
|function Get-SISourceDropoutText {
|    <# PURE. "endpoint (data from 2026-10-10 14:05 UTC)" for each source on its last good collection, joined; '' for none. #>
|    param([AllowEmptyCollection()][object[]]$Dropouts = @())
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    (@($Dropouts | Where-Object { $_ } | ForEach-Object {
|        if ($_.LastGoodUtc) { '{0} (data from {1} UTC)' -f $_.Source, ([datetime]$_.LastGoodUtc).ToUniversalTime().ToString('yyyy-MM-dd HH:mm', $inv) } else { '{0} (its last good collection)' -f $_.Source }
|    })) -join ', '
|}
'@ }
$__siSupportFiles['engine/data-model/SI-RecordSql.ps1'] = @{ Sha256 = '640dbdb5a3ea91bfcaeb65b99df4343efd6702c8be811751fa3f0ab2cb28aad8'; Text = @'
|#Requires -Version 5.1
|<#
|    PROVIDER RECORDS IN SQL (#477, V3-DATA-MODEL 2.20 -- operator 2026-10-08/09: correlation in SQL ONLY, SQL in every v3
|    install; "la is only for kusto risk analysis"). Every batch of records a profiler captures is written to the install's
|    database -- and ONLY there (a copy to Log Analytics is the optional export SI_LaExport, never read back):
|
|      sidata.CiRecord          one row per record key (provider, type, class, name, collection time, complete, the record
|                               as JSON, its CONTENT HASH) -- MERGE by key; the CI a record belongs to (CiId) is kept
|      sidata.RecordIdentifier  the record's strong identifiers (the identity ledger's types -- the SAME extraction the CI
|                               build groups on, Get-SIRecordIdentifiers) -- narrow and indexed
|
|    COST (#501, operator: "performance and cost must be optimed"): a record whose CONTENT did not change (the hash leaves out
|    what changes every run: collection time, run id, complete) keeps its JSON and its identifiers -- only its collection
|    time and completeness are set (one set-based statement for the batch; the link state reads them). A changed record
|    gets its JSON, hash and identifiers rewritten.
|    A failed write is said and counted; it never fails the profiler (the profile rows are unaffected), but the CIs of a
|    run with missing records are built from what the database holds.
|    PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Get-SIRecordIdentifiers -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-CiBuild.ps1') }
|if (-not (Get-Command -Name Get-SIObjectLedgerConnection -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'identity\SI-ObjectLedgerStore.ps1') }
|
|# the fields that change on every run without the record changing -- left out of the content hash; the first three are
|# kept as COLUMNS (CollectionTime, Complete, SourceLastSeen) and the CI build reads them from the columns, not the JSON
|$script:SIRecordVolatileFields = @('si_collection_time', 'si_collection_complete', 'si_source_last_seen', 'si_run_id')
|
|function Get-SIContentHash {
|    <#
|        PURE. SHA-256 (hex) of an object's content WITHOUT the -Exclude fields: the keys in ordinal order, compact JSON --
|        the same content always gives the same hash on every host (no culture, no key order).
|    #>
|    param([Parameter(Mandatory)]$Item, [string[]]$Exclude = @())
|    $o = [ordered]@{}
|    $names = New-Object System.Collections.Generic.List[string]
|    if ($Item -is [System.Collections.IDictionary]) { foreach ($k in $Item.Keys) { $names.Add([string]$k) } }
|    else { foreach ($p in $Item.PSObject.Properties) { $names.Add([string]$p.Name) } }
|    $arr = $names.ToArray(); [Array]::Sort($arr, [StringComparer]::Ordinal)
|    foreach ($n in $arr) {
|        if ($Exclude -contains $n) { continue }
|        if ($Item -is [System.Collections.IDictionary]) { $o[$n] = $Item[$n] } else { $o[$n] = $Item.PSObject.Properties[$n].Value }
|    }
|    $json = ConvertTo-Json -InputObject $o -Compress -Depth 14
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { ([System.BitConverter]::ToString($sha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($json))) -replace '-', '') }
|    finally { $sha.Dispose() }
|}
|
|# 🔴 THE IDENTIFIER KEY MUST FIT SQL SERVER'S 900-BYTE CLUSTERED KEY. sidata.RecordIdentifier's key is RecordKey + IdType +
|# IdValue, and an Azure resource's record key ("azure:<resource id>") plus its resource id identifier is longer: one such
|# record made the whole batch's write fail ("The index entry of length 906 bytes for the index 'PK_RecordIdentifier'
|# exceeds the maximum length of 900 bytes"), on every run, so no Azure record reached the database, their CIs were no
|# longer built, and Risk Analysis lost the CI -- tier, risk factors, classification (the SQL tag) -- of every cloud resource.
|# The schema is additive-only (no key change), so a LONG identifier value is stored as its SHA-256 instead. The decision
|# depends on the value alone, so the same identifier is the same stored value on every record (the grouping compares
|# equality only), and the readers that match a plain value against the table hash it the same way
|# (Get-SIRecordIdValueSqlExpr). A record whose key is still too long is written without that identifier, with a warning,
|# instead of failing the batch.
|$script:SIRecordIdValueMaxChars = 128
|$script:SIRecordIdKeyMaxBytes = 900
|
|function ConvertTo-SIRecordIdValue {
|    <# PURE. The stored form of an identifier value: the value (lower-cased), or 'sha256:' + the lower-case hex SHA-256 of its
|       UTF-16LE bytes when it is longer than 128 characters -- what T-SQL HASHBYTES('SHA2_256', <nvarchar>) answers. #>
|    param([AllowNull()][string]$Value)
|    if ($null -eq $Value) { return $null }
|    $v = $Value.Trim().ToLowerInvariant()
|    if ($v.Length -le $script:SIRecordIdValueMaxChars) { return $v }
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try { return ('sha256:' + (([System.BitConverter]::ToString($sha.ComputeHash([System.Text.Encoding]::Unicode.GetBytes($v))) -replace '-', '').ToLowerInvariant())) }
|    finally { $sha.Dispose() }
|}
|
|function Get-SIRecordIdValueSqlExpr {
|    <# PURE. The T-SQL expression that turns a plain identifier value <Expr> into its stored form (ConvertTo-SIRecordIdValue). #>
|    param([Parameter(Mandatory)][string]$Expr)
|    "(CASE WHEN LEN($Expr) > $($script:SIRecordIdValueMaxChars) THEN N'sha256:' + LOWER(CONVERT(NVARCHAR(64), HASHBYTES('SHA2_256', CAST(LOWER(LTRIM(RTRIM($Expr))) AS NVARCHAR(4000))), 2)) ELSE LOWER(LTRIM(RTRIM($Expr))) END)"
|}
|
|function ConvertTo-SIRecordSqlItems {
|    <#
|        PURE. Record rows (the record rows of one batch) -> @{ Records = [CiRecord items]; Identifiers = [items] }.
|        A row without a record key is left out. Every record carries its content hash (Hash, hex).
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [datetime]$Now = [datetime]::UtcNow, [hashtable]$TypeMap = (Get-SICiLedgerTypeMap),
|          # #882 -DeferDoc: no DocJson yet (Write-SIRecordsToSql builds it only for the records that changed); the rows each
|          # record came from are answered as Sources (same order as Records)
|          [switch]$DeferDoc)
|    $srcs = New-Object System.Collections.Generic.List[object]
|    $recs = New-Object System.Collections.Generic.List[object]
|    $ids = New-Object System.Collections.Generic.List[object]
|    $iso = { param($v) if ($null -eq $v -or "$v" -eq '') { $null } elseif ($v -is [datetime]) { $v.ToUniversalTime().ToString('o') } else { [string]$v } }
|    # one record per key (the database compares keys without case): the LAST row of a key wins, whole -- never a mix of
|    # two rows' columns, and only that row's identifiers
|    $last = New-Object 'System.Collections.Generic.Dictionary[string,int]' ([StringComparer]::OrdinalIgnoreCase)
|    $all = @($Rows)
|    for ($n = 0; $n -lt $all.Count; $n++) {
|        if ($null -eq $all[$n]) { continue }
|        $k = [string](Get-SIItemValue $all[$n] 'si_record_key'); if ($k) { $last[$k] = $n }
|    }
|    for ($n = 0; $n -lt $all.Count; $n++) {
|        $r = $all[$n]
|        if ($null -eq $r) { continue }
|        $key = [string](Get-SIItemValue $r 'si_record_key')
|        if (-not $key -or $last[$key] -ne $n) { continue }
|        $complete = Get-SIItemValue $r 'si_collection_complete'
|        $recs.Add([ordered]@{
|            RecordKey = $key; Provider = [string](Get-SIItemValue $r 'si_provider'); RecordType = [string](Get-SIItemValue $r 'si_record_type')
|            Class = [string](Get-SIItemValue $r 'si_class'); Name = [string](Get-SIItemValue $r 'si_asset_name')
|            SourceLastSeen = (& $iso (Get-SIItemValue $r 'si_source_last_seen')); CollectionTime = (& $iso (Get-SIItemValue $r 'si_collection_time'))
|            Complete = $(if ($null -eq $complete) { $null } else { [bool]($complete -eq $true -or "$complete" -match '^(?i)true|1$') })
|            Hash = (Get-SIContentHash -Item $r -Exclude $script:SIRecordVolatileFields)
|            DocJson = $(if ($DeferDoc) { $null } else { ConvertTo-Json -InputObject $r -Compress -Depth 12 })
|        })
|        $srcs.Add($r)
|        foreach ($i in (Get-SIRecordIdentifiers -Record $r -TypeMap $TypeMap)) {
|            $iv = ConvertTo-SIRecordIdValue ([string]$i.Value)
|            if (2 * ($key.Length + ([string]$i.Type).Length + $iv.Length) -gt $script:SIRecordIdKeyMaxBytes) {
|                $script:SIRecordIdTooLong++
|                continue
|            }
|            $ids.Add([ordered]@{ RecordKey = $key; IdType = [string]$i.Type; IdValue = $iv; SeenAt = $Now.ToUniversalTime().ToString('o') })
|        }
|    }
|    $o = [pscustomobject]@{ Records = $recs.ToArray(); Identifiers = $ids.ToArray() }
|    if ($DeferDoc) { $o | Add-Member -NotePropertyName Sources -NotePropertyValue $srcs.ToArray() }
|    $o
|}
|
|function Get-SIRecordSqlChangedKeysSql {
|    <#
|        #882 -- ONLY WHAT CHANGED IS SENT. One read before a batch is written: of the batch's records (@deltaKeys = [{ RecordKey; Hash }]),
|        which are new or carry another content hash than the stored one (@deltaKeys: a parameter name no other statement uses -- the seams and tests tell the statements apart by it). Answers ONE row: DeltaAsked (how many keys were
|        asked -- the caller trusts the answer only when it matches) and ChangedKeys (JSON [{ RecordKey }]). Read-only.
|        Measured at a large install (2026-10-21): 2.5 million records a run, 1.43 million of them on-premises AD identities
|        93 % unchanged -- each sent whole (its document) and parsed by the database on every run.
|    #>
|    @'
|SET NOCOUNT ON;
|DECLARE @k TABLE (RecordKey NVARCHAR(450) PRIMARY KEY, Hash VARBINARY(32));
|INSERT @k SELECT RecordKey, MAX(CONVERT(VARBINARY(32), Hash, 2))
|FROM OPENJSON(@deltaKeys) WITH (RecordKey NVARCHAR(450), Hash VARCHAR(64)) WHERE RecordKey IS NOT NULL GROUP BY RecordKey;
|SELECT (SELECT COUNT(*) FROM @k) AS DeltaAsked,
|       (SELECT k.RecordKey FROM @k k LEFT JOIN sidata.CiRecord t ON t.RecordKey = k.RecordKey
|        WHERE t.RecordKey IS NULL OR t.ContentHash IS NULL OR t.ContentHash <> k.Hash FOR JSON PATH) AS ChangedKeys;
|'@
|}
|
|function Get-SIRecordSqlChangedKeys {
|    <#
|        #882: the keys of -Records (ConvertTo-SIRecordSqlItems items) that are new or changed in the database, as a
|        case-insensitive set -- or $null when that cannot be shown (no answer, an answer that does not count every key asked,
|        an error): then every record is sent whole, as before. Never throws.
|    #>
|    param([AllowEmptyCollection()][object[]]$Records = @(), [Parameter(Mandatory)][scriptblock]$Invoke)
|    try {
|        $hk = @(foreach ($x in @($Records)) { if ($null -ne $x) { [ordered]@{ RecordKey = [string]$x.RecordKey; Hash = [string]$x.Hash } } })
|        if (-not $hk.Count) { return $null }
|        $res = @(& $Invoke (Get-SIRecordSqlChangedKeysSql) @{ deltaKeys = (ConvertTo-SIJsonArray $hk) } 'rows')
|        $row = $null; if ($res.Count -gt 0) { $row = $res[0] }
|        if ($null -eq $row) { return $null }
|        $asked = Get-SIItemValue $row 'DeltaAsked'
|        if ($null -eq $asked -or $asked -is [System.DBNull]) { return $null }
|        $distinct = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|        foreach ($x in $hk) { [void]$distinct.Add([string]$x.RecordKey) }
|        if ([int]$asked -ne $distinct.Count) { return $null }
|        $set = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|        $json = Get-SIItemValue $row 'ChangedKeys'
|        if ($null -ne $json -and $json -isnot [System.DBNull] -and "$json".Trim()) {
|            foreach ($c in @(ConvertFrom-Json -InputObject ([string]$json))) { if ($null -ne $c -and [string]$c.RecordKey) { [void]$set.Add([string]$c.RecordKey) } }
|        }
|        , $set
|    } catch { $null }
|}
|
|function Get-SIRecordSqlWriteSql {
|    <#
|        The ONE statement a batch is written with. New or CHANGED records (hash differs): the whole row and their
|        identifiers. Unchanged records: only the collection time, completeness and source last-seen. Answers one row:
|        Seen (the batch), Changed (new + changed), and the identifier rows written.
|        ONE WRITER AT A TIME (record-deadlock, 2026-10-26): several processes publish one run's buckets at once, and two of
|        them deadlocked on sidata.CiRecord (SQL error 1205 -- their keys are disjoint, but the UPDATE moves the collection
|        time in three indexes and the joins can scan). So the transaction first takes the database's application lock
|        'si-record-write', owned by the TRANSACTION (freed by its commit or rollback, never left behind), waiting up to
|        -LockMs. Not free in time: error 51222, retried like a lock timeout (Write-SIRecordsToSql). Only this write waits --
|        the merging, the conversion and the changed-keys read stay parallel. Which records changed is read INSIDE the
|        lock, so it is what the write sees. -LockMs 0 = no lock (only the tests' measurement uses it).
|        SAFE TO RERUN: SET XACT_ABORT ON rolls the whole transaction back on any error (a deadlock victim too) and ends
|        the batch; a rerun is a new batch that declares its table variables again from @r / @i and reads @changed again
|        from what is committed -- the same input gives the same rows (proven on a real SQL Server: SIv3-RecordDeadlock).
|    #>
|    param([int]$LockMs = 120000)
|    $lock = ''
|    if ($LockMs -gt 0) {
|        $lock = ("DECLARE @lk INT;`n" +
|            "EXEC @lk = sp_getapplock @Resource = N'si-record-write', @LockMode = N'Exclusive', @LockOwner = N'Transaction', @LockTimeout = {0};`n" +
|            "IF @lk < 0 BEGIN DECLARE @lkm NVARCHAR(300) = CONCAT(N'the record write lock (si-record-write) was not free in {1} s (sp_getapplock answered ', @lk, N')'); THROW 51222, @lkm, 1; END;`n") -f [int]$LockMs, [int][Math]::Ceiling($LockMs / 1000.0)
|    }
|    (@'
|SET XACT_ABORT ON;
|SET NOCOUNT ON;
|DECLARE @s TABLE (RecordKey NVARCHAR(450) PRIMARY KEY, Provider NVARCHAR(32), RecordType NVARCHAR(32), Class NVARCHAR(16), Name NVARCHAR(400),
|    SourceLastSeen DATETIME2(3), CollectionTime DATETIME2(3), Complete BIT, Hash VARBINARY(32), DocJson NVARCHAR(MAX));
|INSERT @s SELECT RecordKey, MAX(Provider), MAX(RecordType), MAX(Class), MAX(Name), MAX(SourceLastSeen), MAX(CollectionTime), CAST(MAX(CAST(Complete AS INT)) AS BIT),
|    MAX(CONVERT(VARBINARY(32), Hash, 2)), MAX(DocJson)
|FROM OPENJSON(@r) WITH (RecordKey NVARCHAR(450), Provider NVARCHAR(32), RecordType NVARCHAR(32), Class NVARCHAR(16), Name NVARCHAR(400),
|    SourceLastSeen DATETIME2(3), CollectionTime DATETIME2(3), Complete BIT, Hash VARCHAR(64), DocJson NVARCHAR(MAX))
|WHERE RecordKey IS NOT NULL GROUP BY RecordKey;
|DECLARE @changed TABLE (RecordKey NVARCHAR(450) PRIMARY KEY);
|BEGIN TRANSACTION;
|{WRITELOCK}INSERT @changed SELECT s.RecordKey FROM @s s LEFT JOIN sidata.CiRecord t ON t.RecordKey = s.RecordKey
|WHERE (t.RecordKey IS NULL OR t.ContentHash IS NULL OR t.ContentHash <> s.Hash) AND s.DocJson IS NOT NULL;
|UPDATE t SET CollectionTime = s.CollectionTime, Complete = s.Complete, SourceLastSeen = s.SourceLastSeen
|FROM sidata.CiRecord t JOIN @s s ON s.RecordKey = t.RecordKey
|WHERE s.RecordKey NOT IN (SELECT RecordKey FROM @changed)
|  AND (t.CollectionTime <> s.CollectionTime OR ISNULL(t.Complete, 1) <> ISNULL(s.Complete, 1) OR ISNULL(t.SourceLastSeen, '19000101') <> ISNULL(s.SourceLastSeen, '19000101'));
|MERGE sidata.CiRecord AS t
|USING (SELECT s.* FROM @s s JOIN @changed c ON c.RecordKey = s.RecordKey) AS s
|ON t.RecordKey = s.RecordKey
|WHEN MATCHED THEN UPDATE SET Provider = s.Provider, RecordType = s.RecordType, Class = s.Class, Name = s.Name, SourceLastSeen = s.SourceLastSeen,
|    CollectionTime = s.CollectionTime, Complete = s.Complete, ContentHash = s.Hash, DocJson = s.DocJson
|WHEN NOT MATCHED THEN INSERT (RecordKey, Provider, RecordType, Class, Name, SourceLastSeen, CollectionTime, Complete, ContentHash, DocJson)
|    VALUES (s.RecordKey, s.Provider, s.RecordType, s.Class, s.Name, s.SourceLastSeen, s.CollectionTime, s.Complete, s.Hash, s.DocJson);
|DELETE ri FROM sidata.RecordIdentifier ri WHERE ri.RecordKey IN (SELECT RecordKey FROM @changed);
|INSERT sidata.RecordIdentifier (RecordKey, IdType, IdValue, SeenAt)
|SELECT DISTINCT x.RecordKey, x.IdType, x.IdValue, x.SeenAt FROM OPENJSON(@i) WITH (RecordKey NVARCHAR(450), IdType NVARCHAR(40), IdValue NVARCHAR(400), SeenAt DATETIME2(3)) x
|WHERE x.RecordKey IN (SELECT RecordKey FROM @changed) AND x.IdValue IS NOT NULL;
|DECLARE @ids INT = @@ROWCOUNT;
|COMMIT TRANSACTION;
|SELECT (SELECT COUNT(*) FROM @s) AS Seen, (SELECT COUNT(*) FROM @changed) AS Changed, @ids AS Identifiers;
|'@).Replace('{WRITELOCK}', $lock)
|}
|
|# a batch write that lost a DEADLOCK (1205) or waited too long for a lock (1222; 51222 = the record write lock above) is
|# written again -- the statement is safe to rerun (Get-SIRecordSqlWriteSql). Attempts in all, and the first wait (doubled
|# each time, plus 0-100 % at random so two losers do not meet again). Tests set the wait to almost nothing.
|$script:SIRecordWriteAttempts = 4
|$script:SIRecordWriteRetryMs = 500
|
|function Get-SIRecordWriteRetryReason {
|    <#
|        PURE. Why a failed batch write may be tried again: 'deadlock' (SQL error 1205), 'lock timeout' (1222, or 51222 = the
|        record write lock was not free in time) -- or $null (any other failure: not retried). Reads the SqlException's
|        numbers through the inner exceptions, else the text Format-SISqlError makes ("SQL error 1205 (line ...").
|    #>
|    param($Exception)
|    $nums = New-Object System.Collections.Generic.List[int]
|    $texts = New-Object System.Collections.Generic.List[string]
|    $e = $Exception
|    while ($e) {
|        $texts.Add([string]$e.Message)
|        if ($e -is [System.Data.SqlClient.SqlException]) { foreach ($x in $e.Errors) { $nums.Add([int]$x.Number) } }
|        $e = $e.InnerException
|    }
|    foreach ($t in $texts) { foreach ($m in [regex]::Matches($t, 'SQL error (\d+)\b')) { $nums.Add([int]$m.Groups[1].Value) } }
|    if ($nums.Contains(1205)) { return 'deadlock' }
|    if ($nums.Contains(1222) -or $nums.Contains(51222)) { return 'lock timeout' }
|    $null
|}
|
|function Write-SIRecordsToSql {
|    <#
|        One batch of record rows -> the database. -Invoke { param($Sql, $Params, $Mode) } is the SQL seam (tests; a caller's
|        store; Mode 'rows' answers objects). Returns @{ Seen; Changed; Identifiers; Failed }; never throws (a failure is a
|        warning and Failed = the batch's records).
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [Parameter(Mandatory)][scriptblock]$Invoke, [datetime]$Now = [datetime]::UtcNow,
|          # THE FEED CLOSE (New-SIRecordFeedClose): with it, the first record of each feed in this batch is written "not
|          # complete" until the whole collection is in (Complete-SIRecordFeeds), and a failed batch is counted on it
|          $Close,
|          # what this batch is, for the log lines ("bucket 7"); empty = "a batch of N record(s)"
|          [string]$What = '',
|          # how long the write waits for the record write lock (Get-SIRecordSqlWriteSql); 0 = no lock (tests' measurement)
|          [int]$LockMs = 120000)
|    $items = $null
|    $attempt = 0; $why = $null
|    $pinned = @()
|    try {
|        $script:SIRecordIdTooLong = 0
|        if ($Close) { $pinned = @(Set-SIRecordFeedPins -Rows $Rows -Close $Close | Where-Object { $null -ne $_ }) }
|        $changedKeys = $null
|        try {
|            $items = ConvertTo-SIRecordSqlItems -Rows $Rows -Now $Now -DeferDoc
|            # #882: ONLY WHAT CHANGED IS SENT WHOLE -- the database says which records are new or changed (their content hash);
|            # an unchanged record goes with its key and hash only (its collection time, completeness and last-seen are
|            # updated as before). When that cannot be shown, every record is sent whole, as before.
|            $changedKeys = Get-SIRecordSqlChangedKeys -Records @($items.Records) -Invoke $Invoke
|            for ($ri = 0; $ri -lt @($items.Records).Count; $ri++) {
|                $rec = $items.Records[$ri]
|                if ($null -eq $changedKeys -or $changedKeys.Contains([string]$rec.RecordKey)) { $rec.DocJson = ConvertTo-Json -InputObject $items.Sources[$ri] -Compress -Depth 12 }
|            }
|            if ($null -ne $changedKeys) { $items.Identifiers = @($items.Identifiers | Where-Object { $changedKeys.Contains([string]$_.RecordKey) }) }
|        }
|        finally { foreach ($pr in $pinned) { $pr.si_collection_complete = $true } }   # the rows themselves are handed on unchanged
|        if ($script:SIRecordIdTooLong -gt 0) {
|            Write-Warning ('records: {0} identifier(s) left out -- their record key is too long for the identifier index (900 bytes); those records are kept and grouped by their other identifiers.' -f $script:SIRecordIdTooLong)
|        }
|        if ($items.Records.Count -eq 0) { return [pscustomobject]@{ Seen = 0; Changed = 0; Identifiers = 0; Failed = 0 } }
|        $p = @{ r = (ConvertTo-SIJsonArray $items.Records); i = (ConvertTo-SIJsonArray $items.Identifiers) }
|        # A DEADLOCK OR A LOCK TIMEOUT IS WRITTEN AGAIN (record-deadlock, 2026-10-26: 3,632 of 36,011 records of a run were
|        # lost to two 1205s). The statement is safe to rerun: it rolled back in full. Any other failure, or the last attempt,
|        # fails the batch exactly as before -- said and counted, never a silent loss.
|        $writeSql = Get-SIRecordSqlWriteSql -LockMs $LockMs
|        $max = [Math]::Max(1, [int]$script:SIRecordWriteAttempts)
|        $res = $null
|        $label = $What; if (-not $label) { $label = 'a batch of {0} record(s)' -f @($items.Records).Count }
|        for ($attempt = 1; $attempt -le $max; $attempt++) {
|            try { $res = @(& $Invoke $writeSql $p 'rows'); break }
|            catch {
|                $why = Get-SIRecordWriteRetryReason -Exception $_.Exception
|                if (-not $why -or $attempt -ge $max) { throw }
|                $waitMs = [int]([double]$script:SIRecordWriteRetryMs * [Math]::Pow(2, $attempt - 1) * (1.0 + (Get-Random -Minimum 0.0 -Maximum 1.0)))
|                Write-Warning ('records: {0} on {1}, attempt {2} of {3} -- retried in {4:0.0} s' -f $why, $label, $attempt, $max, ($waitMs / 1000.0))
|                Start-Sleep -Milliseconds $waitMs
|            }
|        }
|        if ($attempt -gt 1) { Write-Host ('[INFO] records: {0} written on attempt {1} of {2} (after a {3})' -f $label, $attempt, $max, $why) }
|        $row = $null; if ($res.Count -gt 0) { $row = $res[0] }
|        [pscustomobject]@{ Seen = [int](Get-SIItemValue $row 'Seen'); Changed = [int](Get-SIItemValue $row 'Changed'); Identifiers = [int](Get-SIItemValue $row 'Identifiers'); Failed = 0 }
|    } catch {
|        $n = 0; if ($items) { $n = @($items.Records).Count }
|        $tries = ''; if ($why -and $attempt -gt 1) { $tries = (' -- FAILED after {0} attempts, the last a {1}' -f $attempt, $why) }
|        $where = ''; if ($What) { $where = ' of ' + $What }
|        Write-Warning ('records: {0} record(s){1} could not be written to the database{2} -- {3}. The next run writes them again.' -f $n, $where, $tries, $_.Exception.Message)
|        if ($Close) { $Close.Failed = [int]$Close.Failed + [Math]::Max(1, $n) }
|        [pscustomobject]@{ Seen = 0; Changed = 0; Identifiers = 0; Failed = $n }
|    }
|}
|
|# =====================================================================================================================
|#  THE FEED CLOSE -- a half-written collection never counts as a complete one
|# =====================================================================================================================
|# The CI build reads, per feed (provider + record type), the NEWEST collection time and whether every record of it says
|# "complete" (Get-SICiFeedLatestSql); a record missing from a complete newer collection turns 'not seen'. The records of
|# one collection are written in batches, by one process or by several. A collection that stopped half-way -- the process
|# ended, a batch could not be written -- must not look like a complete one that simply has fewer records: every record it
|# did not reach would turn 'not seen', and CIs would be retired by a failure.
|# So the FIRST record of each feed in every batch is written "not complete" (a PIN), and the pins are set to complete in
|# ONE statement when every batch of the collection is in (Complete-SIRecordFeeds) -- which also registers the collection
|# (sidata.RecordCollection: who wrote it, how many records). A collection that never closed keeps its pins: its feed's
|# newest collection is not complete, so what it missed is FROZEN (it keeps its CI active). Cost: one extra statement per
|# collection and a handful of rows. Absence is never read from a collection that did not close.
|
|function New-SIRecordFeedClose {
|    <# The close of ONE collection (one engine run): the pins written so far, the feeds seen, the batches that failed. #>
|    param([string]$Engine = '')
|    [pscustomobject]@{ Engine = ([string]$Engine).Trim().ToLowerInvariant(); Pins = (New-Object System.Collections.Generic.List[string])
|                       Feeds = @{}; Incomplete = @{}; Failed = 0; PinFeed = @{} }
|}
|
|function Set-SIRecordFeedPins {
|    <#
|        PURE (changes -Rows in place; the caller sets them back). The first record of each feed in this batch whose pull
|        was complete is marked "not complete" and remembered on -Close. A feed whose own pull was NOT complete is only
|        noted (its records already say so, and it is not registered as a good collection). Returns the rows it pinned.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [Parameter(Mandatory)]$Close)
|    $seen = @{}
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($r in @($Rows)) {
|        if ($null -eq $r) { continue }
|        $key = [string](Get-SIItemValue $r 'si_record_key')
|        if (-not $key) { continue }
|        $feed = Get-SIRecordFeed $r
|        $c = Get-SIItemValue $r 'si_collection_complete'
|        if ($null -ne $c -and -not ($c -eq $true -or "$c" -match '^(?i)(true|1)$')) { $Close.Incomplete[$feed] = $true; continue }
|        $Close.Feeds[$feed] = $true
|        if ($seen.ContainsKey($feed)) { continue }
|        if (-not ($r -is [psobject]) -or -not $r.PSObject.Properties['si_collection_complete']) { continue }
|        $seen[$feed] = $true
|        $r.si_collection_complete = $false
|        $Close.Pins.Add($key)
|        if ($Close.PSObject.Properties['PinFeed']) { $Close.PinFeed[$key] = $feed }
|        $out.Add($r)
|    }
|    # each pinned row by itself (never the list as ONE object: the caller sets every row back, one by one)
|    $out.ToArray()
|}
|
|function Get-SIRecordFeedCloseSql {
|    <#
|        The ONE statement that closes a collection: @k = the pinned record keys (JSON array of text), @f = its feeds
|        ([{ Provider; RecordType }]), @ctText = the collection time (ISO), @engine = the collection step that wrote it.
|        The pins become complete; each feed's collection is registered with its record count (a collection a failed step
|        already had HELD stays held). Answers Closed (pins set) and Feeds (registered).
|        A feed may carry State 'drop' and a Reason (the asset-drop guard keeps the last good collection: one of its pins is
|        then left out of @k by the caller, so that feed's collection stays "not complete").
|    #>
|    @'
|SET NOCOUNT ON;
|SET XACT_ABORT ON;
|DECLARE @ct DATETIME2(3) = TRY_CONVERT(DATETIME2(3), NULLIF(@ctText, N''), 127);
|DECLARE @n INT = 0, @feeds INT = 0;
|BEGIN TRANSACTION;
|UPDATE r SET Complete = 1
|FROM sidata.CiRecord r JOIN OPENJSON(@k) WITH (RecordKey NVARCHAR(450) '$') k ON k.RecordKey = r.RecordKey
|WHERE r.CollectionTime = @ct AND r.Complete = 0;
|SET @n = @@ROWCOUNT;
|IF OBJECT_ID('sidata.RecordCollection') IS NOT NULL
|BEGIN
|    MERGE sidata.RecordCollection AS t
|    USING (SELECT f.Provider, ISNULL(f.RecordType, N'') AS RecordType, f.State, f.Reason,
|                  (SELECT COUNT(*) FROM sidata.CiRecord r WHERE r.Provider = f.Provider AND ISNULL(r.RecordType, N'') = ISNULL(f.RecordType, N'') AND r.CollectionTime = @ct) AS Records
|           FROM OPENJSON(@f) WITH (Provider NVARCHAR(32), RecordType NVARCHAR(32), State NVARCHAR(16), Reason NVARCHAR(400)) f WHERE f.Provider IS NOT NULL) AS s
|    ON t.Provider = s.Provider AND t.RecordType = s.RecordType AND t.CollectionTime = @ct
|    WHEN MATCHED THEN UPDATE SET Records = s.Records, UpdatedAt = SYSUTCDATETIME(),
|         State = CASE WHEN t.State = N'held' OR s.State IS NULL THEN t.State ELSE s.State END, Reason = ISNULL(s.Reason, t.Reason)
|    WHEN NOT MATCHED THEN INSERT (Provider, RecordType, CollectionTime, Engine, Records, State, Reason) VALUES (s.Provider, s.RecordType, @ct, @engine, s.Records, ISNULL(s.State, N'good'), s.Reason);
|    SET @feeds = @@ROWCOUNT;
|END
|COMMIT TRANSACTION;
|SELECT @n AS Closed, @feeds AS Feeds;
|'@
|}
|
|# =====================================================================================================================
|#  THE ASSET-DROP GUARD (collection.source.asset-drop) -- the customer decides (owner 2026-10-12: "what happens with
|#  assets, make guard, let customer decide. it can be deletion of many azure ress")
|# =====================================================================================================================
|# A collection can COMPLETE and still carry far fewer assets than before: a real clean-up (many Azure resources removed),
|# or a source that answered only in part. Findings and vulnerabilities go up and down and are never judged by count; the
|# RECORDS of a feed (provider + record type: devices, users, Azure resources ...) are assets, and they are judged here,
|# when the collection closes -- BEFORE the CI build reads the feed:
|#   the feed's record count against its LAST GOOD collection, down by SI_Pro_DataQuality_AssetDropPercent (30 %) or more,
|#   and only when that last good collection had at least 20 records (a small feed moves by whole assets: 3 of 8 gone is
|#   38 % and no sign of a broken source -- 20 keeps the limit above "a handful of assets changed").
|# What then happens is the customer's choice, SI_Pro_SourceDropout_AssetDropAction:
|#   confirm (default)  the new collection is NOT taken as the truth: it is registered as a 'drop', and one of its records
|#                      stays "not complete", so everything it no longer lists is frozen (as when a collection fails). The
|#                      run goes on. When the NEXT complete collection of that feed shows the same level (within the
|#                      limit of the dropped level) the drop is accepted by itself -- a real mass deletion needs no person
|#                      and costs one run. Back to normal instead = the drop never took effect.
|#   accept             the records are taken as they came; the guard only reports.
|# One event per drop: the first collection that drops raises it; the collections that follow while it is unconfirmed do not.
|# A collection published by several processes at once (scheduled shards) is not judged: each sees only its own part.
|$script:SIRecordDropMinRecords = 20
|$script:SIRecordDropGuardId = 'collection.source.asset-drop'
|# A FEED SEVERAL STEPS WRITE IS JUDGED ONLY BY THE STEP THAT WRITES IT WHOLE. Every collection step reads the Exposure
|# Graph, so an eg feed is written by more than one step under the same collection time (the time is the minute the run
|# started): the endpoint step records the eg nodes of its Azure VMs and Arc machines (a handful), the Azure step every
|# Azure node. The step that closed first counted only what was written so far and held a feed that was not yet whole --
|# 3 against 36, then 36 against 36 one minute later (three installs, 2026-10-19/20). The other steps' part of such a feed
|# is a subset of the owner's (same record keys), so the owner's close always sees the whole feed; the others do not judge it.
|$script:SIRecordFeedOwner = @{ 'eg|azure_resource' = 'azure'; 'eg|public_ip' = 'azure'; 'eg|device' = 'endpoint'
|                               'eg|user' = 'identity'; 'eg|service_principal' = 'identity' }
|
|function Test-SIRecordFeedJudgedBy {
|    <# PURE. Whether the collection step -Engine judges the feed (provider|record type): its owner does, a step that writes
|       only a part of it does not ("not judged yet" -- never held, never a drop). An unknown step judges every feed. #>
|    param([string]$Feed, [string]$Engine = '')
|    $e = ([string]$Engine).Trim().ToLowerInvariant()
|    $f = ([string]$Feed).Trim().ToLowerInvariant()
|    if (-not $e -or -not $script:SIRecordFeedOwner.ContainsKey($f)) { return $true }
|    $script:SIRecordFeedOwner[$f] -eq $e
|}
|
|function Get-SIRecordDropSettings {
|    <# PURE. The limit and the choice: @{ Percent (1-100, default 30); Action ('confirm' | 'accept'); MinRecords }. #>
|    param($Percent = $global:SI_Pro_DataQuality_AssetDropPercent, $Action = $global:SI_Pro_SourceDropout_AssetDropAction)
|    $pc = 0
|    if (-not ($null -ne $Percent -and [int]::TryParse(([string]$Percent).Trim(), [ref]$pc) -and $pc -ge 1 -and $pc -le 100)) { $pc = 30 }
|    $act = if (([string]$Action).Trim().ToLowerInvariant() -eq 'accept') { 'accept' } else { 'confirm' }
|    [pscustomobject]@{ Percent = $pc; Action = $act; MinRecords = $script:SIRecordDropMinRecords }
|}
|
|function Get-SIRecordFeedDropVerdict {
|    <#
|        PURE. One feed's collection against its history. -Now: its record count; -History: its earlier collections, NEWEST
|        FIRST (@{ Records; State }: good | drop | held). Returns @{ Action; Drop; Baseline; ChangePercent; Event; Confirmed }:
|          take    not a drop (or nothing to compare with, or a feed too small to judge) -- taken as it came;
|          hold    a drop under 'confirm': the last good collection is kept (Event = $true only for the FIRST such collection);
|          accept  a drop that is taken: under 'accept' at once (Event = $true, it only reports), or under 'confirm' because
|                  the collection before it was a drop at the same level (Confirmed = $true, no event).
|    #>
|    param([int]$Now, [AllowEmptyCollection()][object[]]$History = @(), [int]$Percent = 30, [int]$MinRecords = 20, [string]$Action = 'confirm')
|    $res = [ordered]@{ Action = 'take'; Drop = $false; Baseline = $null; ChangePercent = $null; Event = $false; Confirmed = $false }
|    $hist = @($History | Where-Object { $_ })
|    $good = @($hist | Where-Object { [string]$_.State -eq 'good' }) | Select-Object -First 1
|    if (-not $good -or [int]$good.Records -lt $MinRecords) { return [pscustomobject]$res }
|    $base = [int]$good.Records
|    $res.Baseline = $base
|    $res.ChangePercent = [math]::Round(100.0 * ($Now - $base) / $base, 1)
|    if ($res.ChangePercent -gt (0 - $Percent)) { return [pscustomobject]$res }
|    $res.Drop = $true
|    if ($Action -eq 'accept') { $res.Action = 'accept'; $res.Event = $true; return [pscustomobject]$res }
|    $prev = $hist[0]
|    if ([string]$prev.State -eq 'drop') {
|        $pr = [int]$prev.Records
|        if ($pr -gt 0 -and [math]::Abs(100.0 * ($Now - $pr) / $pr) -lt $Percent) { $res.Action = 'accept'; $res.Confirmed = $true }
|        else { $res.Action = 'hold' }
|        return [pscustomobject]$res
|    }
|    $res.Action = 'hold'; $res.Event = $true
|    [pscustomobject]$res
|}
|
|function Get-SIRecordFeedDropSql {
|    <# ONE read at the close: per feed of @f, how many records the collection @ctText holds now, and the feed's 8 newest
|       earlier collections OF THE SAME COLLECTION STEP @engine (newest first). Without sidata.RecordCollection: no rows.
|       Why the step: one feed can be written by two steps -- the endpoint collection records the Exposure Graph nodes of
|       Azure VMs and Arc machines (eg azure_resource, a handful), the Azure collection records every Azure node (eg
|       azure_resource, all of them). Measured at the internal install 2026-10-13: the endpoint's 8 were judged against the
|       Azure collection's 101 (-92 %) and held, every night, though nothing was missing. A step is judged against itself. #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.RecordCollection') IS NULL
|BEGIN
|    SELECT CAST(NULL AS NVARCHAR(32)) AS Provider, CAST(NULL AS NVARCHAR(32)) AS RecordType, 0 AS NowRecords, CAST(NULL AS DATETIME2(3)) AS CollectionTime, 0 AS Records, CAST(NULL AS NVARCHAR(16)) AS State WHERE 1 = 0;
|    RETURN;
|END
|DECLARE @ct DATETIME2(3) = TRY_CONVERT(DATETIME2(3), NULLIF(@ctText, N''), 127);
|SELECT f.Provider, ISNULL(f.RecordType, N'') AS RecordType,
|       (SELECT COUNT(*) FROM sidata.CiRecord r WHERE r.Provider = f.Provider AND ISNULL(r.RecordType, N'') = ISNULL(f.RecordType, N'') AND r.CollectionTime = @ct) AS NowRecords,
|       h.CollectionTime, h.Records, h.State
|FROM OPENJSON(@h) WITH (Provider NVARCHAR(32), RecordType NVARCHAR(32)) f
|OUTER APPLY (SELECT TOP (8) c.CollectionTime, c.Records, c.State FROM sidata.RecordCollection c
|             WHERE c.Provider = f.Provider AND c.RecordType = ISNULL(f.RecordType, N'') AND c.CollectionTime < @ct
|               AND (ISNULL(@engine, N'') = N'' OR ISNULL(c.Engine, N'') = @engine)
|             ORDER BY c.CollectionTime DESC) h
|WHERE f.Provider IS NOT NULL
|ORDER BY f.Provider, f.RecordType, h.CollectionTime DESC;
|'@
|}
|
|function Get-SIRecordFeedDrops {
|    <#
|        The asset-drop guard's verdicts for the feeds of one collection, at its close: @(@{ Feed; Provider; RecordType; Now;
|        Baseline; ChangePercent; Action; Event; Confirmed; Text }) -- only the feeds that DROPPED. Nothing is judged when
|        the guard is off (Settings > Guards), when the collection is published by several processes at once (scheduled
|        shards), or when the history cannot be read. Never throws -- a guard never blocks a run.
|    #>
|    param([AllowEmptyCollection()][object[]]$Feeds = @(), [Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$CollectionTimeText, [string]$Engine = '',
|          $Settings, [int]$ShardCount = -1,
|          # owner 2026-10-17 (guards heal themselves): every feed judged and NOT held is added here as a guard check
|          # (@{ GuardId; Subject; Values; Detail }) -- the close hands them to the guard, which clears an earlier drop's episode
|          [System.Collections.Generic.List[object]]$Checks,
|          # #1056 the install's identity choice (Get-SIIdentityScopeChoice); not given = the install's settings
|          $IdentityChoice)
|    try {
|        if (-not @($Feeds).Count) { return }
|        if ($ShardCount -lt 0) { $sc = 0; if (-not [int]::TryParse([string][Environment]::GetEnvironmentVariable('SI_SHARD_COUNT'), [ref]$sc)) { $sc = 1 }; $ShardCount = $sc }
|        if ($ShardCount -gt 1) { return }
|        # a feed this step writes only a part of is judged by the step that writes it whole (Test-SIRecordFeedJudgedBy)
|        $Feeds = @(@($Feeds) | Where-Object { $_ -and (Test-SIRecordFeedJudgedBy -Feed ('{0}|{1}' -f (Get-SIItemValue $_ 'Provider'), (Get-SIItemValue $_ 'RecordType')) -Engine $Engine) })
|        if (-not $Feeds.Count) { return }
|        if ((Get-Command -Name Test-SIGuardOn -ErrorAction SilentlyContinue) -and -not (Test-SIGuardOn -GuardId $script:SIRecordDropGuardId)) { return }
|        if (-not $Settings) {
|            $Settings = Get-SIRecordDropSettings
|            # CR4 (#654): halved for 24 hours after a release that changed engine code (the configured share x 0.5, at least 1)
|            if (-not (Get-Command -Name Resolve-SIGuardLimit -ErrorAction SilentlyContinue)) {
|                $sgs = [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-GuardStrict.ps1')
|                if ([IO.File]::Exists($sgs)) { . $sgs }
|            }
|            if (Get-Command -Name Resolve-SIGuardLimit -ErrorAction SilentlyContinue) {
|                $Settings.Percent = [int](Resolve-SIGuardLimit -GuardId $script:SIRecordDropGuardId -Name 'changePercent' -Label 'Asset drop at most (% of a source''s records)' -Configured $Settings.Percent -Unit '%').Effective
|            }
|        }
|        $rows = @(& $Invoke (Get-SIRecordFeedDropSql) @{ h = (ConvertTo-SIJsonArray @($Feeds)); ctText = $CollectionTimeText; engine = ([string]$Engine).Trim().ToLowerInvariant() } 'rows' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })
|        $by = [ordered]@{}
|        foreach ($r in $rows) {
|            $p = [string](Get-SIItemValue $r 'Provider'); if (-not $p) { continue }
|            $k = '{0}|{1}' -f $p, [string](Get-SIItemValue $r 'RecordType')
|            if (-not $by.Contains($k)) { $by[$k] = [pscustomobject]@{ Provider = $p; RecordType = [string](Get-SIItemValue $r 'RecordType'); Now = [int](Get-SIItemValue $r 'NowRecords'); History = (New-Object System.Collections.Generic.List[object]) } }
|            $st = Get-SIItemValue $r 'State'
|            if ($null -ne $st -and -not ($st -is [DBNull]) -and "$st") { $rc = Get-SIItemValue $r 'Records'; if ($null -eq $rc -or $rc -is [DBNull]) { $rc = 0 }; $by[$k].History.Add([pscustomobject]@{ Records = [int]$rc; State = [string]$st }) }
|        }
|        # #1056 a customer's choice (SI_Identity_SkipNeverSyncedAd / SI_Identity_SkipNeverSyncedDisabledAd / SI_Identity_SkipDeletedGroups) leaves records out
|        # of the Exposure Graph feed on purpose: they are added back to the count judged here, so the choice is never read as a
|        # broken source. Read only while a switch is on in this install; off, nothing changes.
|        $leftOut = @{}
|        if ($null -eq $IdentityChoice -and (Get-Command -Name Get-SIIdentityScopeChoice -ErrorAction SilentlyContinue)) { $IdentityChoice = Get-SIIdentityScopeChoice }
|        if ($null -ne $IdentityChoice -and $IdentityChoice.Any -and (Get-Command -Name Get-SIIdentityScopeLeftOutByFeed -ErrorAction SilentlyContinue)) {
|            $leftOut = Get-SIIdentityScopeLeftOutByFeed -Invoke $Invoke -CollectionTimeText $CollectionTimeText -Choice $IdentityChoice
|        }
|        foreach ($k in $by.Keys) {
|            $f = $by[$k]
|            $lk = ([string]$k).ToLowerInvariant()
|            if ($leftOut.ContainsKey($lk) -and [long]$leftOut[$lk] -gt 0) {
|                Write-Host ('[INFO] records: {0} {1}: {2} record(s) left out by the install''s choice this run are counted with the {3} recorded for the asset-drop check' -f $f.Provider, $f.RecordType, $leftOut[$lk], $f.Now)
|                $f.Now = [int]([Math]::Min([long][int]::MaxValue, [long]$f.Now + [long]$leftOut[$lk]))
|            }
|            $v = Get-SIRecordFeedDropVerdict -Now $f.Now -History $f.History.ToArray() -Percent $Settings.Percent -MinRecords $Settings.MinRecords -Action $Settings.Action
|            if ($null -ne $Checks) { $ck = Get-SIRecordFeedDropCheck -Feed $f -Verdict $v -Percent $Settings.Percent; if ($ck) { $Checks.Add($ck) } }
|            if (-not $v.Drop) { continue }
|            $what = '{0} {1} records: {2} in this collection against {3} in the last good one ({4} %)' -f $f.Provider, $f.RecordType, $f.Now, $v.Baseline, $v.ChangePercent
|            $text = switch ($v.Action) {
|                'hold' { $what + ' -- the last good collection is kept until the next complete collection shows the same level' }
|                default { if ($v.Confirmed) { $what + ' -- the same level as the collection before it: the drop is accepted' } else { $what + ' -- taken as it came (SI_Pro_SourceDropout_AssetDropAction = accept)' } }
|            }
|            Write-Host ('[{0}] records: {1}' -f $(if ($v.Action -eq 'hold') { 'WARN' } else { 'INFO' }), $text)
|            [pscustomobject]@{ Feed = $k; Provider = $f.Provider; RecordType = $f.RecordType; Now = $f.Now; Baseline = $v.Baseline; ChangePercent = $v.ChangePercent
|                               Action = $v.Action; Event = [bool]$v.Event; Confirmed = [bool]$v.Confirmed; Text = $text; Percent = $Settings.Percent }
|        }
|    } catch { Write-Warning ('records: the asset-drop check could not be made -- {0}. The collection is taken as it came.' -f $_.Exception.Message) }
|}
|
|function Get-SIRecordFeedDropCheck {
|    <#
|        PURE. One judged feed as a guard CHECK (owner 2026-10-17, guards heal themselves) -- @{ GuardId; Subject; Values;
|        Detail }, or $null when the feed is held or raised its own event this run:
|          take               back within the limit of its last good collection (or nothing to judge): clears an earlier drop
|                             "back at the normal level" -- the drop never took effect;
|          accept, confirmed  the same level twice: the drop is TAKEN AS THE NEW LEVEL -- never a heal: the episode closes
|                             with its own words (How 'taken': "taken as the new level after 2 runs at the same level -- not
|                             back to normal"), Invardia is NOT told it cleared (its ticket stays), and a later collection at
|                             that level is not read as "back to normal";
|          hold / accept now  still low, or reported this run: nothing is cleared.
|    #>
|    param([Parameter(Mandatory)]$Feed, [Parameter(Mandatory)]$Verdict, [int]$Percent = 30)
|    $sub = '{0} {1}' -f $Feed.Provider, $Feed.RecordType
|    if ($Verdict.Action -eq 'take') {
|        $vals = @(); $det = ''
|        if ($null -ne $Verdict.Baseline) {
|            $vals = @(@{ Name = 'changePercent'; Label = 'Change'; Measured = $Verdict.ChangePercent; Limit = (-1 * $Percent); Unit = '%' })
|            $det = '{0} records: {1} in this collection against {2} in the last good one -- back at the normal level.' -f $sub, $Feed.Now, $Verdict.Baseline
|        }
|        return @{ GuardId = $script:SIRecordDropGuardId; Subject = $sub; Values = $vals; Detail = $det }
|    }
|    if ($Verdict.Action -eq 'accept' -and $Verdict.Confirmed) {
|        return @{ GuardId = $script:SIRecordDropGuardId; Subject = $sub; Values = @(); How = 'taken'
|                  Detail = ('{0} records: {1} in this collection against {2} in the last good one, the same level as the collection before it.' -f $sub, $Feed.Now, $Verdict.Baseline) }
|    }
|    $null
|}
|
|function Get-SIGuardCallsForRecordDrop {
|    <# PURE. The guard events of the drops that raise one (Send-SIGuardEvent arguments): 'held' when the last good collection
|       is kept, 'warning' when the drop was taken at once. One per feed and drop -- a drop that is still unconfirmed, or
|       confirmed, raises none. #>
|    param([AllowEmptyCollection()][object[]]$Drops = @(), [string]$Engine = '')
|    foreach ($d in @($Drops | Where-Object { $_ -and $_.Event })) {
|        $c = @{ GuardId = $script:SIRecordDropGuardId; Outcome = $(if ($d.Action -eq 'hold') { 'held' } else { 'warning' }); Subject = ('{0} {1}' -f $d.Provider, $d.RecordType)
|                HeldCount = [long]([math]::Max(0, [int]$d.Baseline - [int]$d.Now)); Detail = ([string]$d.Text + '.')
|                Values = @(@{ Name = 'previousAssets'; Label = 'Assets in the last good collection'; Measured = [long]$d.Baseline },
|                           @{ Name = 'currentAssets'; Label = 'Assets in this collection'; Measured = [long]$d.Now },
|                           @{ Name = 'changePercent'; Label = 'Change'; Measured = $d.ChangePercent; Limit = (-1 * [int]$d.Percent); Unit = '%' }) }
|        if ($Engine) { $c['Job'] = 'si-' + $Engine.Trim().ToLowerInvariant() }
|        $c
|    }
|}
|
|function Send-SIRecordFeedDropEvents {
|    <# Raises the drops' guard events (the Guards page, run health, the guard's mail). Never throws; without the guard
|       code loaded the drop is in the run log only. #>
|    param([AllowEmptyCollection()][object[]]$Drops = @(), [string]$Engine = '',
|          # the feeds judged and not held (Get-SIRecordFeedDropCheck): a complete collection back at the normal level clears an
|          # earlier drop's episode -- recorded, and reported to Invardia as cleared (owner 2026-10-17)
|          [AllowEmptyCollection()][object[]]$Checks = @())
|    try {
|        $calls = @(Get-SIGuardCallsForRecordDrop -Drops $Drops -Engine $Engine)
|        $checked = @($Checks | Where-Object { $_ })
|        if (-not $calls.Count -and -not $checked.Count) { return }
|        if (-not (Get-Command -Name Invoke-SIGuardCalls -ErrorAction SilentlyContinue)) {
|            $g = [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-Guard.ps1')
|            if ([IO.File]::Exists($g)) { . $g }
|        }
|        if (Get-Command -Name Invoke-SIGuardCalls -ErrorAction SilentlyContinue) {
|            $common = @{ Engine = $Engine }
|            if ($Engine) { $common['Job'] = 'si-' + $Engine.Trim().ToLowerInvariant() }
|            if ($checked.Count) { $null = Invoke-SIGuardCalls -Calls $calls -Common $common -Checked $checked -Complete $true }
|            else { $null = Invoke-SIGuardCalls -Calls $calls -Common @{ Engine = $Engine } }
|        }
|    } catch { Write-Warning ('records: the asset-drop event could not be raised -- {0}' -f $_.Exception.Message) }
|}
|
|function Complete-SIRecordFeeds {
|    <#
|        The end of a collection's records: when every batch was written (-Close.Failed = 0) the pins become complete and
|        the collection is registered; when a batch failed NOTHING is closed -- the collection stays "not complete" and the
|        records it did not write stay as the last good collection left them (said plainly). Never throws.
|        Returns @{ Closed; Feeds; Held } (Held = $true when it was left open).
|    #>
|    param([Parameter(Mandatory)]$Close, [Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][datetime]$CollectionTime)
|    try {
|        if ([int]$Close.Failed -gt 0) {
|            Write-Warning ('records: this collection is NOT complete -- {0} record(s) could not be written. The records it did not reach keep their last good state (nothing is shown as gone); the next collection that completes sets it right.' -f [int]$Close.Failed)
|            return [pscustomobject]@{ Closed = 0; Feeds = 0; Held = $true }
|        }
|        if ($Close.Pins.Count -eq 0) { return [pscustomobject]@{ Closed = 0; Feeds = 0; Held = $false } }
|        $feeds = @(@($Close.Feeds.Keys) | Where-Object { -not $Close.Incomplete.ContainsKey($_) } | Sort-Object | ForEach-Object {
|                $i = ([string]$_).IndexOf('|'); [ordered]@{ Provider = ([string]$_).Substring(0, $i); RecordType = ([string]$_).Substring($i + 1) } })
|        # (a feed whose own pull was not complete has no pins: all of its records say "not complete", and it is not registered)
|        $ctText = $CollectionTime.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.fffZ', [Globalization.CultureInfo]::InvariantCulture)
|        # THE ASSET-DROP GUARD, before the close: a feed that completed with far fewer assets than its last good collection
|        # keeps the last good collection (one of its pins stays "not complete") until the next collection confirms the level
|        $dropChecks = New-Object System.Collections.Generic.List[object]
|        # (a close that is only one of several processes publishing the same collection -- Judge = $false -- counts a feed
|        # before it is whole: not judged, as a sharded collection is not)
|        $drops = @()
|        if (-not ($Close.PSObject.Properties['Judge'] -and -not $Close.Judge)) {
|            $drops = @(Get-SIRecordFeedDrops -Feeds $feeds -Invoke $Invoke -CollectionTimeText $ctText -Engine ([string]$Close.Engine) -Checks $dropChecks)
|        }
|        $pins = New-Object System.Collections.Generic.List[string]
|        $kept = @{}
|        foreach ($d in @($drops | Where-Object { $_.Action -eq 'hold' })) { $kept[[string]$d.Feed] = $d }
|        $left = @{}
|        foreach ($k in $Close.Pins) {
|            $pf = if ($Close.PSObject.Properties['PinFeed'] -and $Close.PinFeed.ContainsKey($k)) { [string]$Close.PinFeed[$k] } else { '' }
|            if ($pf -and $kept.ContainsKey($pf) -and -not $left.ContainsKey($pf)) { $left[$pf] = $k; continue }   # ONE pin of a held feed stays
|            $pins.Add($k)
|        }
|        foreach ($f in $feeds) {
|            $fk = '{0}|{1}' -f $f.Provider, $f.RecordType
|            if ($kept.ContainsKey($fk) -and $left.ContainsKey($fk)) { $f['State'] = 'drop'; $f['Reason'] = [string]$kept[$fk].Text }
|        }
|        $p = @{ k = (ConvertTo-SIJsonArray $pins.ToArray()); f = (ConvertTo-SIJsonArray $feeds); ctText = $ctText; engine = [string]$Close.Engine }
|        $row = @(& $Invoke (Get-SIRecordFeedCloseSql) $p 'rows') | Select-Object -First 1
|        # the collection CLOSED complete (every batch written): the feeds back at the normal level clear an earlier drop
|        Send-SIRecordFeedDropEvents -Drops $drops -Engine ([string]$Close.Engine) -Checks $dropChecks.ToArray()
|        [pscustomobject]@{ Closed = [int](Get-SIItemValue $row 'Closed'); Feeds = [int](Get-SIItemValue $row 'Feeds'); Held = $false; Drops = $drops }
|    } catch {
|        Write-Warning ('records: the collection could not be closed -- {0}. It counts as not complete: nothing it did not reach is shown as gone.' -f $_.Exception.Message)
|        [pscustomobject]@{ Closed = 0; Feeds = 0; Held = $true }
|    }
|}
|
|function ConvertTo-SIJsonArray {
|    <# PURE. Always a JSON ARRAY for OPENJSON (PowerShell 5.1 writes a one-item list as the bare object). #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Items, [int]$Depth = 6)
|    if ($null -eq $Items -or @($Items).Count -eq 0) { return '[]' }
|    $j = ConvertTo-Json -InputObject @($Items) -Compress -Depth $Depth
|    if ($j.TrimStart().StartsWith('[')) { $j } else { '[' + $j + ']' }
|}
|
|function New-SIRecordSqlInvoke {
|    <#
|        The SQL seam over the install's database (SI_ProSqlServer / SI_ProSqlDatabase), signed in as the job (managed
|        identity in a container, else the engine certificate) -- the identity ledger's connection. $null = no database
|        configured: records and CIs live in SQL only, so the caller says plainly that nothing is kept.
|    #>
|    param([string]$Server = [string]$global:SI_ProSqlServer, [string]$Database = [string]$global:SI_ProSqlDatabase)
|    if ([string]::IsNullOrWhiteSpace($Server) -or [string]::IsNullOrWhiteSpace($Database)) { return $null }
|    # Not a GetNewClosure(): a closure runs in its own module scope and does not see the connection helpers the caller
|    # loaded. The server and database go in as literals; the functions are found where the seam is called.
|    $q = { param($s) "'" + ([string]$s).Replace("'", "''") + "'" }
|    $seam = [scriptblock]::Create(('param($Sql, $Params, $Mode) Invoke-SIRecordSqlDb -Server {0} -Database {1} -Sql $Sql -Params $Params -Mode $Mode' -f (& $q $Server), (& $q $Database)))
|    # 2026-10-29 a real database: the CI list's and the CI views' columns are filled a CiId range at a time (SI-DataCi.ps1 "KEY RANGES")
|    $seam | Add-Member -NotePropertyName SISqlRanged -NotePropertyValue $true
|    $seam
|}
|
|function Read-SISqlRows {
|    <#
|        Runs a command and answers the rows of EVERY result set, reading them to the end. A batch whose first statements
|        return nothing (temp tables, a loop, then the one SELECT) and whose later statement fails must be an ERROR here,
|        never an empty answer: closing a reader early discards the rest of the batch and its error (customer H 2026-10-09:
|        the CI grouping ran 294 s, answered no row and no error, and the build said "no records").
|    #>
|    param([Parameter(Mandatory)]$Command)
|    # 'Stop': a .NET exception in a loop condition is only STATEMENT-terminating -- under a container's error preference
|    # the loop just ended and the function answered nothing (customer H 2026-10-09: "answered no result", no error shown)
|    $ErrorActionPreference = 'Stop'
|    $rows = New-Object System.Collections.Generic.List[object]
|    $rd = $null
|    # what the database answered, for the "answered no result" messages (ring 1 2026-10-09, #513: a one-row SELECT came back
|    # with no row and no error inside the container, and nothing said whether the database or the reader lost it)
|    $global:SISqlLastRead = [ordered]@{ Sets = 0; Fields = ''; Rows = 0; HasRows = '' }
|    try {
|        $rd = $Command.ExecuteReader()
|        do {
|            $global:SISqlLastRead.Sets++
|            $global:SISqlLastRead.Fields = ('{0}{1}{2}' -f $global:SISqlLastRead.Fields, $(if ($global:SISqlLastRead.Fields) { '/' } else { '' }), $rd.FieldCount)
|            $global:SISqlLastRead.HasRows = ('{0}{1}' -f $global:SISqlLastRead.HasRows, $(if ($rd.HasRows) { 'y' } else { 'n' }))
|            # 🔒 the rows are read HERE, never by handing the reader to a function: a data reader is enumerable, and binding it to
|            # a function's parameter let PowerShell 7.4 (the container image) enumerate it -- every row consumed before the
|            # function's own Read(). Ring 1 2026-10-09 (#513): "1 result set(s), columns 1, rows reported y, 0 row(s) read";
|            # pwsh 7.6 (the development machine, the test VM) does not, so no offline run ever showed it. Guarded by SIv3-CiBuildSql.
|            if ($rd.FieldCount -gt 0) {
|                $names = @(for ($i = 0; $i -lt $rd.FieldCount; $i++) { $rd.GetName($i) })
|                while ($rd.Read()) {
|                    $o = [ordered]@{}
|                    for ($i = 0; $i -lt $names.Count; $i++) { $v = $rd.GetValue($i); if ($v -is [System.DBNull]) { $v = $null }; $o[$names[$i]] = $v }
|                    $rows.Add([pscustomobject]$o)
|                }
|            }
|            $global:SISqlLastRead.Rows = $rows.Count
|        } while ($rd.NextResult())
|    } catch {
|        throw (New-Object System.Exception((Format-SISqlError -Exception $_.Exception -InfoMessages @($script:SISqlInfoMessages)), $_.Exception))
|    } finally { if ($rd) { $rd.Close() } }
|    $rows.ToArray()
|}
|
|# the server's info messages of the current statement (SqlConnection.InfoMessage) -- part of an error's text
|$script:SISqlInfoMessages = New-Object System.Collections.Generic.List[string]
|
|function Get-SIRecordSchemaCheckSql {
|    <#
|        READ-ONLY: what the record writer and the CI build need of the database, beyond what an older release created --
|        answers ONE row, Missing = the names that are not there (empty = all there). The engine never changes the schema:
|        the tables, columns and indexes come from sql\si-data-schema.sql, which the updater applies (the job's identity
|        has data rights only -- customer H 2026-10-09).
|    #>
|    @'
|SET NOCOUNT ON;
|SELECT CONCAT_WS(N', ',
|    CASE WHEN OBJECT_ID('sidata.CiRecord') IS NULL THEN N'sidata.CiRecord' END,
|    CASE WHEN OBJECT_ID('sidata.RecordIdentifier') IS NULL THEN N'sidata.RecordIdentifier' END,
|    CASE WHEN OBJECT_ID('sidata.Ci') IS NULL THEN N'sidata.Ci' END,
|    CASE WHEN OBJECT_ID('sidata.CiGroupMember') IS NULL THEN N'sidata.CiGroupMember' END,
|    CASE WHEN OBJECT_ID('sidata.CiGroupEdge') IS NULL THEN N'sidata.CiGroupEdge' END,
|    CASE WHEN OBJECT_ID('sidata.CiBuildState') IS NULL THEN N'sidata.CiBuildState' END,
|    CASE WHEN OBJECT_ID('sidata.CiRecord') IS NOT NULL AND COL_LENGTH('sidata.CiRecord', 'ContentHash') IS NULL THEN N'sidata.CiRecord.ContentHash' END,
|    CASE WHEN OBJECT_ID('sidata.Ci') IS NOT NULL AND COL_LENGTH('sidata.Ci', 'ContentHash') IS NULL THEN N'sidata.Ci.ContentHash' END,
|    CASE WHEN OBJECT_ID('sidata.Ci') IS NOT NULL AND COL_LENGTH('sidata.Ci', 'PostedHash') IS NULL THEN N'sidata.Ci.PostedHash' END,
|    CASE WHEN OBJECT_ID('sidata.Ci') IS NOT NULL AND COL_LENGTH('sidata.Ci', 'PostedAt') IS NULL THEN N'sidata.Ci.PostedAt' END,
|    -- #534 the incremental CI build: what each record was at its last build, its group's dirty mark, a CI's last posted row
|    CASE WHEN OBJECT_ID('sidata.CiRecord') IS NOT NULL AND COL_LENGTH('sidata.CiRecord', 'BuiltHash') IS NULL THEN N'sidata.CiRecord.BuiltHash' END,
|    CASE WHEN OBJECT_ID('sidata.CiRecord') IS NOT NULL AND COL_LENGTH('sidata.CiRecord', 'BuiltGroupKey') IS NULL THEN N'sidata.CiRecord.BuiltGroupKey' END,
|    CASE WHEN OBJECT_ID('sidata.CiRecord') IS NOT NULL AND COL_LENGTH('sidata.CiRecord', 'BuiltState') IS NULL THEN N'sidata.CiRecord.BuiltState' END,
|    CASE WHEN OBJECT_ID('sidata.CiRecord') IS NOT NULL AND COL_LENGTH('sidata.CiRecord', 'BuiltTimeSig') IS NULL THEN N'sidata.CiRecord.BuiltTimeSig' END,
|    CASE WHEN OBJECT_ID('sidata.CiRecord') IS NOT NULL AND COL_LENGTH('sidata.CiRecord', 'BuiltAt') IS NULL THEN N'sidata.CiRecord.BuiltAt' END,
|    CASE WHEN OBJECT_ID('sidata.CiGroupMember') IS NOT NULL AND COL_LENGTH('sidata.CiGroupMember', 'Dirty') IS NULL THEN N'sidata.CiGroupMember.Dirty' END,
|    CASE WHEN OBJECT_ID('sidata.CiGroupMember') IS NOT NULL AND COL_LENGTH('sidata.CiGroupMember', 'CurHash') IS NULL THEN N'sidata.CiGroupMember.CurHash' END,
|    CASE WHEN OBJECT_ID('sidata.CiGroupMember') IS NOT NULL AND COL_LENGTH('sidata.CiGroupMember', 'CurState') IS NULL THEN N'sidata.CiGroupMember.CurState' END,
|    CASE WHEN OBJECT_ID('sidata.CiGroupMember') IS NOT NULL AND COL_LENGTH('sidata.CiGroupMember', 'CurTimeSig') IS NULL THEN N'sidata.CiGroupMember.CurTimeSig' END,
|    CASE WHEN OBJECT_ID('sidata.Ci') IS NOT NULL AND COL_LENGTH('sidata.Ci', 'PostRowHash') IS NULL THEN N'sidata.Ci.PostRowHash' END,
|    -- identities before devices: the owner / user values a device / resource CI named
|    CASE WHEN OBJECT_ID('sidata.CiIdentityRef') IS NULL THEN N'sidata.CiIdentityRef' END,
|    -- #534 follow-up: when a record is next due, and the owning CMDB's items per CI
|    CASE WHEN OBJECT_ID('sidata.CiRecord') IS NOT NULL AND COL_LENGTH('sidata.CiRecord', 'NextDueAt') IS NULL THEN N'sidata.CiRecord.NextDueAt' END,
|    CASE WHEN OBJECT_ID('sidata.CiCmdbUse') IS NULL THEN N'sidata.CiCmdbUse' END,
|    CASE WHEN OBJECT_ID('sidata.CiCmdbKey') IS NULL THEN N'sidata.CiCmdbKey' END
|) AS Missing;
|'@
|}
|
|function Get-SIRecordSchemaMissing {
|    <# The names Get-SIRecordSchemaCheckSql reports missing (an empty list = the database is current). Throws on a SQL error. #>
|    param([Parameter(Mandatory)][scriptblock]$Sql)
|    $global:SISqlLastRead = $null
|    $got = @(& $Sql (Get-SIRecordSchemaCheckSql) @{} 'rows')
|    $row = $got | Select-Object -First 1
|    if ($null -eq $row) { throw ('the schema check answered no result ({0})' -f (Get-SISqlLastReadText -Answered $got.Count)) }
|    $m = [string](Get-SIItemValue $row 'Missing')
|    @($m.Split(',') | ForEach-Object { $_.Trim() } | Where-Object { $_ })
|}
|
|function Get-SISqlLastReadText {
|    <#
|        What the database answered to the last read (Read-SISqlRows), as one plain phrase -- the evidence an "answered no
|        result" message carries: no read at all, or N result set(s), their column counts, whether the server said it had
|        rows, and how many rows were read. -Answered: how many objects reached the caller.
|    #>
|    param([int]$Answered = 0)
|    $r = $global:SISqlLastRead
|    if ($null -eq $r) { return ('the statement was not read by the database reader; {0} object(s) came back' -f $Answered) }
|    'the database answered {0} result set(s), columns {1}, rows reported {2}, {3} row(s) read; {4} object(s) came back' -f $r.Sets, $r.Fields, $r.HasRows, $r.Rows, $Answered
|}
|
|function Format-SISqlError {
|    <#
|        A SQL failure as one line with what the database said: every error's number, line and message (a SqlException
|        carries several; .Message alone hid the real cause on customer H 2026-10-09), plus the server's info messages.
|    #>
|    param([Parameter(Mandatory)]$Exception, [string[]]$InfoMessages = @())
|    $e = $Exception
|    while ($e -and -not ($e -is [System.Data.SqlClient.SqlException]) -and $e.InnerException) { $e = $e.InnerException }
|    $parts = New-Object System.Collections.Generic.List[string]
|    if ($e -is [System.Data.SqlClient.SqlException]) {
|        foreach ($x in $e.Errors) { $parts.Add(('SQL error {0} (line {1}): {2}' -f $x.Number, $x.LineNumber, $x.Message)) }
|    }
|    if ($parts.Count -eq 0) { $parts.Add([string]$Exception.Message) }
|    foreach ($i in @($InfoMessages | Select-Object -Last 3)) { if ($i) { $parts.Add('server said: ' + $i) } }
|    ($parts | Select-Object -Unique) -join ' | '
|}
|
|$script:SIRecordSqlConnections = @{}
|
|function Invoke-SIRecordSqlDb {
|    <#
|        One statement against the database, signed in as the job. The connection is kept open for the process (one sign-in,
|        not one per statement -- a CI build sends hundreds) and re-opened once when it was lost.
|        -Mode: nonquery | scalar | rows (objects, the first result set).
|        A STATEMENT that meets one of Azure SQL's platform answers (Test-SISqlStatementTransient, engine\_shared\SI-SqlRetry.ps1:
|        4083 "the connection was recovered and rowcount ... not available", 9001, a failover, busy, a reset connection, "a
|        severe error occurred") is run again on a NEW connection after a pause (Get-SISqlStatementRetryWaits), and the log
|        says so. Live 2026-11-04: one 4083 failed a correlation run's CI build. Redoing is safe: every statement sent here is
|        one batch (its own transaction, MERGE by key; no #temp table outlives it) and the CI build is re-runnable; a 'rows'
|        answer is read whole before it is handed on. The CI build's lock lives on its own connection (Enter-SICiBuildLock),
|        never this one. Past the last attempt the error is thrown tagged transient-sql (Exception.Data['SIErrorClass']).
|        Any other failure is the answer at once.
|        Seams (tests): -Open { } -> an open connection; -StatementWaits; -Sleep { param($Seconds) }.
|    #>
|    param([Parameter(Mandatory)][string]$Server, [Parameter(Mandatory)][string]$Database, [Parameter(Mandatory)][string]$Sql, [hashtable]$Params, [string]$Mode = 'nonquery', [int]$TimeoutSeconds = 0,
|          [scriptblock]$Open, [int[]]$StatementWaits, [scriptblock]$Sleep)
|    $ErrorActionPreference = 'Stop'
|    $key = ('{0}|{1}' -f $Server, $Database).ToLowerInvariant()
|    $waits = if ($PSBoundParameters.ContainsKey('StatementWaits')) { @($StatementWaits) } elseif (Get-Command -Name Get-SISqlStatementRetryWaits -ErrorAction SilentlyContinue) { @(Get-SISqlStatementRetryWaits) } else { @() }
|    $reopened = $false; $try = 0
|    while ($true) {
|        $cn = $script:SIRecordSqlConnections[$key]
|        if ($null -eq $cn -or $cn.State -ne [System.Data.ConnectionState]::Open) {
|            if ($cn) { try { $cn.Dispose() } catch { } }
|            $cn = if ($Open) { & $Open } else { Get-SIObjectLedgerConnection -Server $Server -Database $Database }
|            if (-not $cn) { throw 'the database could not be opened' }
|            Register-SISqlInfoMessages -Connection $cn
|            $script:SIRecordSqlConnections[$key] = $cn
|        }
|        try {
|            $script:SISqlInfoMessages.Clear()
|            $c = $cn.CreateCommand(); $c.CommandText = $Sql; $c.CommandTimeout = $TimeoutSeconds
|            if ($Params) { foreach ($k in $Params.Keys) { $pp = $c.Parameters.Add('@' + $k, [System.Data.SqlDbType]::NVarChar, -1); $pp.Value = [string]$Params[$k] } }
|            if ($Mode -eq 'scalar') { return $c.ExecuteScalar() }
|            if ($Mode -eq 'rows') { return @(Read-SISqlRows -Command $c) }
|            return $c.ExecuteNonQuery()
|        } catch {
|            $err = $_
|            $transient = $false
|            if (Get-Command -Name Test-SISqlStatementTransient -ErrorAction SilentlyContinue) { $transient = [bool](Test-SISqlStatementTransient -ErrorRecord $err) }
|            if ($transient -and $try -lt @($waits).Count) {
|                # the connection is given up for good (never back into the pool) and the statement runs again on a new one
|                $script:SIRecordSqlConnections.Remove($key)
|                if ($cn -is [System.Data.SqlClient.SqlConnection]) { try { [System.Data.SqlClient.SqlConnection]::ClearPool($cn) } catch { } }
|                try { $cn.Dispose() } catch { }
|                $w = [int]@($waits)[$try]; $try++
|                $first = (([string]$err.Exception.Message) -split "`n")[0].Trim()
|                Write-Host ('       the database {0} answered a temporary Azure SQL error ({1}) -- connecting again and running the statement again in {2} s ({3}/{4})' -f $Database, $first, $w, $try, @($waits).Count) -ForegroundColor DarkYellow
|                if ($w -gt 0) { if ($Sleep) { & $Sleep $w } else { Start-Sleep -Seconds $w } }
|                continue
|            }
|            # a lost connection (closed, broken, a token past its life) is re-opened once; anything else is the answer
|            if (-not $reopened -and $cn.State -ne [System.Data.ConnectionState]::Open) { $reopened = $true; $script:SIRecordSqlConnections.Remove($key); continue }
|            $ex = New-Object System.Exception((Format-SISqlError -Exception $err.Exception -InfoMessages @($script:SISqlInfoMessages)), $err.Exception)
|            if ($transient) { $ex.Data['SIErrorClass'] = 'transient-sql' }
|            throw $ex
|        }
|    }
|}
|
|function Register-SISqlInfoMessages {
|    <# Keeps the server's info messages of a connection (PRINT, warnings) for the error text of its next failure. #>
|    param([Parameter(Mandatory)]$Connection)
|    # a delegate, not an event job: SqlClient raises it on this thread, while the statement runs; the closure holds the
|    # one list (cleared, never replaced, before every statement)
|    $list = $script:SISqlInfoMessages
|    $h = { param($s, $e) foreach ($x in $e.Errors) { [void]$list.Add(('{0}: {1}' -f $x.Number, $x.Message)) } }.GetNewClosure()
|    try { $Connection.add_InfoMessage([System.Data.SqlClient.SqlInfoMessageEventHandler]$h) } catch { }
|}
|
|# =====================================================================================================================
|#  ONE CI BUILD AT A TIME (owner 2026-10-12: "we cannot have 2 builds running at the same time. add as guard")
|# =====================================================================================================================
|# Two CI builds side by side write the same CIs, links, identity ledger and SI_CI_CL rows at once. Every starter (the
|# pipeline, a job run by hand, a release check, Risk Analysis building the CIs in its own run) shares ONE place: the
|# database. So the build holds an exclusive APPLICATION LOCK there for as long as it writes:
|#   * sp_getapplock, owned by the SESSION of a connection that is opened for the lock alone and stays open for the whole
|#     build. The server frees it when that connection ends -- a build that is stopped or killed frees it by itself. No
|#     flag is left behind, so nothing stale can ever block a build (LastBuildStatus 'running' is NOT the lock: after a
|#     stopped build it only means "carry on", Test-SICiCarryOn).
|#   * a second build that finds the lock held builds NOTHING beside the first: it WAITS (one line when it starts to wait,
|#     one every few minutes; bounded only by its own job's run limit) and then runs as an ordinary build -- incremental
|#     and quick when the first one just finished. It reads the build's state only AFTER it holds the lock, so a build
|#     that is running now is never taken for a stopped one.
|#   * WHO HOLDS IT is written to sidata.CiBuildState 'BuildLockHolder' ({ token; since; who }) by the holder, for the
|#     waiting build's log line and the event -- information only, never the lock.
|#   * THE CONNECTION CAN DROP while the build runs. The build checks its lock before every batch it writes
|#     (Test-SICiBuildLock). Lost: it takes the lock again at once; when 'BuildLockHolder' still carries its own token no
|#     other build ran in between and it goes on. In every other case (another build holds the lock, or held it
|#     meanwhile, or the check cannot be made) it STOPS without writing -- the next build builds what is left.
|#   * THE GUARD ci.build.concurrent is the REPORT (one event when a build has to wait); the lock is the correctness and
|#     holds whether the guard is on or off.
|# No database (Community without SQL): there is no CI build in SQL, so there is nothing to lock.
|$script:SICiBuildLockGuardId = 'ci.build.concurrent'
|# the lock THIS process holds: @{ Connection; Open; Token; Holder (its 'BuildLockHolder' value); Since; Who } -- kept
|# when this file is loaded again (the job holds the lock across the scripts it loads)
|if (-not (Test-Path -LiteralPath 'variable:script:SICiBuildLockState')) { $script:SICiBuildLockState = $null }
|
|function Get-SICiBuildLockSql {
|    <# The statements of the CI build's lock (one place; the real-SQL tests run them). #>
|    param([Parameter(Mandatory)][ValidateSet('Take', 'Mode', 'Release', 'HolderSet', 'HolderGet', 'HolderClear')][string]$Name)
|    switch ($Name) {
|        # @ms: how long to wait for it (0 = ask once). Result >= 0: held; -1: another session holds it
|        'Take' { "SET NOCOUNT ON; DECLARE @r INT, @t INT = CAST(@ms AS INT); EXEC @r = sp_getapplock @Resource = N'si-ci-build', @LockMode = N'Exclusive', @LockOwner = N'Session', @LockTimeout = @t; SELECT @r AS Result;" }
|        'Mode' { "SET NOCOUNT ON; SELECT APPLOCK_MODE(N'public', N'si-ci-build', N'Session') AS Mode;" }
|        'Release' { "SET NOCOUNT ON; IF APPLOCK_MODE(N'public', N'si-ci-build', N'Session') <> N'NoLock' EXEC sp_releaseapplock @Resource = N'si-ci-build', @LockOwner = N'Session'; SELECT 1 AS Released;" }
|        'HolderSet' { @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.CiBuildState') IS NULL BEGIN SELECT 0 AS Written; RETURN; END
|MERGE sidata.CiBuildState AS t USING (SELECT N'BuildLockHolder' AS Name, LEFT(@v, 400) AS Value) AS s ON t.Name = s.Name
|WHEN MATCHED THEN UPDATE SET Value = s.Value, UpdatedAt = SYSUTCDATETIME()
|WHEN NOT MATCHED THEN INSERT (Name, Value) VALUES (s.Name, s.Value);
|SELECT 1 AS Written;
|'@ }
|        'HolderGet' { @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.CiBuildState') IS NULL BEGIN SELECT CAST(NULL AS NVARCHAR(400)) AS Value; RETURN; END
|SELECT (SELECT TOP 1 Value FROM sidata.CiBuildState WHERE Name = N'BuildLockHolder') AS Value;
|'@ }
|        # only its own value: a build that lost the lock never clears the next holder's
|        'HolderClear' { "SET NOCOUNT ON; IF OBJECT_ID('sidata.CiBuildState') IS NOT NULL UPDATE sidata.CiBuildState SET Value = N'', UpdatedAt = SYSUTCDATETIME() WHERE Name = N'BuildLockHolder' AND Value = LEFT(@v, 400); SELECT 1 AS Cleared;" }
|    }
|}
|
|function Invoke-SICiBuildLockSql {
|    <# One statement on the lock's own connection -> its rows. Throws when the connection is gone. #>
|    param([Parameter(Mandatory)]$Connection, [Parameter(Mandatory)][string]$Sql, [hashtable]$Params, [int]$TimeoutSeconds = 0)
|    $ErrorActionPreference = 'Stop'
|    $c = $Connection.CreateCommand(); $c.CommandText = $Sql; $c.CommandTimeout = $TimeoutSeconds
|    if ($Params) { foreach ($k in $Params.Keys) { $pp = $c.Parameters.Add('@' + $k, [System.Data.SqlDbType]::NVarChar, -1); $pp.Value = [string]$Params[$k] } }
|    @(Read-SISqlRows -Command $c)
|}
|
|function Get-SICiBuildLockOpen {
|    <# The lock's connection for this install's database (SI_ProSqlServer / SI_ProSqlDatabase), signed in as the job --
|       a scriptblock that opens one; $null when no database is configured (nothing to lock). #>
|    param([string]$Server = [string]$global:SI_ProSqlServer, [string]$Database = [string]$global:SI_ProSqlDatabase)
|    if ([string]::IsNullOrWhiteSpace($Server) -or [string]::IsNullOrWhiteSpace($Database)) { return $null }
|    $q = { param($s) "'" + ([string]$s).Replace("'", "''") + "'" }
|    [scriptblock]::Create(('Get-SIObjectLedgerConnection -Server {0} -Database {1}' -f (& $q $Server), (& $q $Database)))
|}
|
|function Get-SICiBuildLockWho {
|    <# PURE. Who a build is, in the words the other build's log line and the event use: the job run (a container job's
|       execution carries the job's name), else the run id and the machine. #>
|    param([string]$RunId, [string]$Execution = [string]$env:CONTAINER_APP_JOB_EXECUTION_NAME, [string]$Computer = [string]$env:COMPUTERNAME)
|    if (-not [string]::IsNullOrWhiteSpace($Execution)) { return ('job run {0}' -f $Execution.Trim()) }
|    $who = if (-not [string]::IsNullOrWhiteSpace($RunId)) { 'run {0}' -f $RunId.Trim() } else { 'a run started by hand' }
|    if (-not [string]::IsNullOrWhiteSpace($Computer)) { $who = '{0} on {1}' -f $who, $Computer.Trim() }
|    $who
|}
|
|function ConvertFrom-SICiBuildLockHolder {
|    <# PURE. The 'BuildLockHolder' value -> @{ Token; Since ([datetime] UTC or $null); Who }; $null when there is none. #>
|    param([AllowNull()][AllowEmptyString()][string]$Value)
|    if ([string]::IsNullOrWhiteSpace($Value)) { return $null }
|    try {
|        $o = ConvertFrom-Json -InputObject $Value
|        $since = $null
|        if ($o.PSObject.Properties['since'] -and $o.since) {
|            # (PowerShell 7 hands an ISO time in JSON back as a date already)
|            $d = [datetime]::MinValue
|            if ($o.since -is [datetime]) { $since = ([datetime]$o.since).ToUniversalTime() }
|            elseif ([datetime]::TryParse([string]$o.since, [Globalization.CultureInfo]::InvariantCulture, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal, [ref]$d)) { $since = $d }
|        }
|        [pscustomobject]@{ Token = [string]$o.token; Since = $since; Who = [string]$o.who }
|    } catch { $null }
|}
|
|function Format-SICiBuildLockLine {
|    <#
|        PURE. The run log's lines about the lock, in plain words:
|          Wait   a build finds another one running (-Other: its ConvertFrom-SICiBuildLockHolder, when known)
|          Still  it is still waiting (-Minutes so far)
|          Go     the other build finished (-Minutes waited)
|          Kept   this build's lock connection was lost and taken again; nothing ran in between
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Wait', 'Still', 'Go', 'Kept')][string]$Kind, $Other, [int]$Minutes = 0)
|    $about = @()
|    if ($Other -and $Other.Since) { $about += ('since {0:yyyy-MM-dd HH:mm} UTC' -f ([datetime]$Other.Since).ToUniversalTime()) }
|    if ($Other -and $Other.Who) { $about += [string]$Other.Who }
|    $in = if ($about.Count) { ' ({0})' -f ($about -join ', ') } else { '' }
|    switch ($Kind) {
|        'Wait' { 'CIs: another CI build is running{0} -- this one waits for it and then builds what is left' -f $in }
|        'Still' { 'CIs: still waiting for the other CI build{0} -- {1} minute(s) so far; nothing is built beside it' -f $in, $Minutes }
|        'Go' { 'CIs: the other CI build has finished (waited {0} minute(s)) -- this one builds what is left' -f $Minutes }
|        'Kept' { 'CIs: the connection that holds this build''s lock was lost and opened again -- no other CI build ran in between, so the build goes on' }
|    }
|}
|
|function Get-SIGuardCallsForCiBuildWait {
|    <# PURE. The guard event of a CI build that was started while another one was running and waits for it
|       (Send-SIGuardEvent arguments): a warning -- nothing is held, nothing fails. One per build that has to wait. #>
|    param($Other, [string]$Who, [string]$RunId, [string]$Engine)
|    $first = if ($Other -and $Other.Who) { [string]$Other.Who } else { 'another run' }
|    $since = if ($Other -and $Other.Since) { ', running since {0:yyyy-MM-dd HH:mm} UTC' -f ([datetime]$Other.Since).ToUniversalTime() } else { '' }
|    $c = @{ GuardId = $script:SICiBuildLockGuardId; Outcome = 'warning'
|            Detail = ('A CI build ({0}) was started while another CI build ({1}{2}) was still running. It waits for that build to finish and then builds what is left.' -f $(if ($Who) { $Who } else { 'this run' }), $first, $since) }
|    if ($RunId) { $c['RunId'] = $RunId }
|    if ($Engine) { $c['Engine'] = $Engine; $c['Job'] = 'si-' + $Engine.Trim().ToLowerInvariant(); $c['Subject'] = $Engine.Trim().ToLowerInvariant() }
|    $c
|}
|
|function Send-SICiBuildWaitEvent {
|    <# Raises the event of a build that has to wait (the Guards page, run health). Never throws; without the guard code
|       loaded the wait is in the run log only. #>
|    param($Other, [string]$Who, [string]$RunId, [string]$Engine)
|    try {
|        if (-not (Get-Command -Name Invoke-SIGuardCalls -ErrorAction SilentlyContinue)) {
|            $g = [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), '_shared', 'SI-Guard.ps1')
|            if ([IO.File]::Exists($g)) { . $g }
|        }
|        if (Get-Command -Name Invoke-SIGuardCalls -ErrorAction SilentlyContinue) {
|            $inv = $null; if (Get-Command -Name Get-SIGuardProInvoke -ErrorAction SilentlyContinue) { $inv = Get-SIGuardProInvoke }
|            $null = Invoke-SIGuardCalls -Calls @(Get-SIGuardCallsForCiBuildWait -Other $Other -Who $Who -RunId $RunId -Engine $Engine) -Common @{ Invoke = $inv }
|        }
|    } catch { Write-Warning ('CIs: the event of a CI build that waits could not be raised -- {0}' -f $_.Exception.Message) }
|}
|
|function Close-SICiBuildLockConnection {
|    <# Ends the lock's connection for good (never back into a pool with the lock on it). Never throws. #>
|    param($Connection)
|    if ($null -eq $Connection) { return }
|    try { $Connection.GetType()::ClearPool($Connection) } catch { }
|    try { $Connection.Dispose() } catch { }
|}
|
|function Enter-SICiBuildLock {
|    <#
|        Takes the CI build's lock for this process, waiting for a build that holds it. Returns
|        @{ Held = $true; Owned (this call took it -- the caller that owns it releases it, Exit-SICiBuildLock);
|           Waited; WaitSeconds; Other (the build it waited for, when known) }.
|        A process that already holds it (the correlation job takes it before the CI build asks) gets Owned = $false, or --
|        when its lock was lost and another build ran meanwhile -- Held = $false with Why.
|        Throws when the lock cannot be asked for at all (the database does not answer, five times in a row).
|        Seams (tests): -Open { } -> an open connection; -Guard { param($Other, $Who) } instead of the guard event;
|        -Sleep { param($Seconds) }; -Now { }.
|    #>
|    param([scriptblock]$Open, [string]$RunId, [string]$Engine, [scriptblock]$Log, [int]$PollSeconds = 30, [int]$ProgressMinutes = 5,
|          [scriptblock]$Guard, [scriptblock]$Sleep = { param($Seconds) Start-Sleep -Seconds $Seconds }, [scriptblock]$Now = { [datetime]::UtcNow })
|    if (-not $Log) { $Log = { param($l, $m) if ($l -eq 'WARN') { Write-Warning $m } else { Write-Host ('[' + $l + '] ' + $m) } } }
|    if ($script:SICiBuildLockState) {
|        $chk = Test-SICiBuildLock -Log $Log
|        return [pscustomobject]@{ Held = [bool]$chk.Held; Owned = $false; Waited = $false; WaitSeconds = 0; Other = $null; Why = [string]$chk.Why }
|    }
|    if (-not $Open) { $Open = Get-SICiBuildLockOpen }
|    if (-not $Open) { throw 'no database is configured for the lock that keeps CI builds apart' }
|    if ($PollSeconds -lt 1) { $PollSeconds = 1 }
|    $who = Get-SICiBuildLockWho -RunId $RunId
|    $cn = $null; $t0 = ([datetime](& $Now)).ToUniversalTime(); $lastSaid = $t0; $waiting = $false; $other = $null; $fails = 0
|    while ($true) {
|        $code = $null
|        try {
|            if ($null -eq $cn -or $cn.State -ne [System.Data.ConnectionState]::Open) {
|                Close-SICiBuildLockConnection $cn
|                $cn = & $Open
|                if (-not $cn) { throw 'the database could not be opened' }
|            }
|            # asked once; while waiting, in turns of -PollSeconds (the server queues the request: the lock is taken the moment it is free)
|            $ms = if ($waiting) { $PollSeconds * 1000 } else { 0 }
|            $r = @(Invoke-SICiBuildLockSql -Connection $cn -Sql (Get-SICiBuildLockSql 'Take') -Params @{ ms = [string]$ms } -TimeoutSeconds ($PollSeconds + 120))
|            $code = [int]$r[0].Result
|            if ($code -lt 0 -and $code -ne -1) { throw ('the database refused the lock (result {0})' -f $code) }
|            $fails = 0
|        } catch {
|            $fails++
|            Close-SICiBuildLockConnection $cn; $cn = $null
|            if ($fails -ge 5) { throw ('the lock that keeps two CI builds apart could not be taken ({0})' -f $_.Exception.Message) }
|            & $Sleep ([Math]::Min(30, 5 * $fails))
|            continue
|        }
|        if ($code -ge 0) { break }
|        $nowU = ([datetime](& $Now)).ToUniversalTime()
|        if (-not $waiting) {
|            $waiting = $true; $lastSaid = $nowU
|            try { $other = ConvertFrom-SICiBuildLockHolder ([string]@(Invoke-SICiBuildLockSql -Connection $cn -Sql (Get-SICiBuildLockSql 'HolderGet'))[0].Value) } catch { $other = $null }
|            & $Log 'INFO' (Format-SICiBuildLockLine -Kind Wait -Other $other)
|            # the report (never the lock): one event for this build
|            if ($Guard) { try { & $Guard $other $who } catch { } } else { Send-SICiBuildWaitEvent -Other $other -Who $who -RunId $RunId -Engine $Engine }
|        } elseif (($nowU - $lastSaid).TotalMinutes -ge $ProgressMinutes) {
|            $lastSaid = $nowU
|            & $Log 'INFO' (Format-SICiBuildLockLine -Kind Still -Other $other -Minutes ([int]($nowU - $t0).TotalMinutes))
|        }
|    }
|    $t1 = ([datetime](& $Now)).ToUniversalTime()
|    $token = [guid]::NewGuid().ToString('n')
|    $holder = ConvertTo-Json -Compress -InputObject ([ordered]@{ token = $token; since = $t1.ToString('o'); who = $(if ($who.Length -gt 200) { $who.Substring(0, 200) } else { $who }) })
|    $written = $false
|    try { $written = ([int]@(Invoke-SICiBuildLockSql -Connection $cn -Sql (Get-SICiBuildLockSql 'HolderSet') -Params @{ v = $holder })[0].Written -eq 1) } catch { $written = $false }
|    $script:SICiBuildLockState = [pscustomobject]@{ Connection = $cn; Open = $Open; Token = $(if ($written) { $token } else { '' }); Holder = $holder; Since = $t1; Who = $who }
|    if ($waiting) { & $Log 'INFO' (Format-SICiBuildLockLine -Kind Go -Minutes ([int]($t1 - $t0).TotalMinutes)) }
|    [pscustomobject]@{ Held = $true; Owned = $true; Waited = $waiting; WaitSeconds = [int]($t1 - $t0).TotalSeconds; Other = $other; Why = '' }
|}
|
|function Test-SICiBuildLock {
|    <#
|        Does this process still hold the CI build's lock? Asked before every batch the build writes (it also keeps the
|        lock's connection in use). @{ Held; Why }. No lock in this process (no database, a test seam): Held, nothing to
|        check. A lost connection: the lock is taken again at once, and the build goes on only when 'BuildLockHolder' still
|        carries this build's own token (no other build ran in between); else Held = $false and the lock is given up.
|    #>
|    param([scriptblock]$Log)
|    $s = $script:SICiBuildLockState
|    if (-not $s) { return [pscustomobject]@{ Held = $true; Why = '' } }
|    try {
|        if ($s.Connection -and $s.Connection.State -eq [System.Data.ConnectionState]::Open) {
|            if ([string]@(Invoke-SICiBuildLockSql -Connection $s.Connection -Sql (Get-SICiBuildLockSql 'Mode'))[0].Mode -eq 'Exclusive') { return [pscustomobject]@{ Held = $true; Why = '' } }
|        }
|    } catch { }
|    # the lock is gone with its connection
|    Close-SICiBuildLockConnection $s.Connection
|    $script:SICiBuildLockState = $null
|    $cn = $null
|    try {
|        $cn = & $s.Open
|        if (-not $cn) { throw 'the database could not be opened' }
|        if ([int]@(Invoke-SICiBuildLockSql -Connection $cn -Sql (Get-SICiBuildLockSql 'Take') -Params @{ ms = '0' })[0].Result -lt 0) {
|            Close-SICiBuildLockConnection $cn
|            return [pscustomobject]@{ Held = $false; Why = 'this build lost its lock (its database connection ended) and another CI build is running now -- this build stops here and writes nothing more; the next build builds what is left' }
|        }
|        $now = ConvertFrom-SICiBuildLockHolder ([string]@(Invoke-SICiBuildLockSql -Connection $cn -Sql (Get-SICiBuildLockSql 'HolderGet'))[0].Value)
|        if ($s.Token -and $now -and [string]$now.Token -eq [string]$s.Token) {
|            $s.Connection = $cn
|            $script:SICiBuildLockState = $s
|            if ($Log) { & $Log 'INFO' (Format-SICiBuildLockLine -Kind Kept) }
|            return [pscustomobject]@{ Held = $true; Why = '' }
|        }
|        try { $null = Invoke-SICiBuildLockSql -Connection $cn -Sql (Get-SICiBuildLockSql 'Release') } catch { }
|        Close-SICiBuildLockConnection $cn
|        return [pscustomobject]@{ Held = $false; Why = 'this build lost its lock (its database connection ended) and another CI build may have run meanwhile -- this build stops here and writes nothing more; the next build builds what is left' }
|    } catch {
|        Close-SICiBuildLockConnection $cn
|        return [pscustomobject]@{ Held = $false; Why = ('this build lost its lock (its database connection ended) and could not take it again ({0}) -- this build stops here and writes nothing more; the next build builds what is left' -f $_.Exception.Message) }
|    }
|}
|
|function Exit-SICiBuildLock {
|    <# Releases the CI build's lock of this process and ends its connection. Never throws; nothing held = nothing done. #>
|    $s = $script:SICiBuildLockState
|    $script:SICiBuildLockState = $null
|    if (-not $s) { return }
|    try {
|        if ($s.Connection -and $s.Connection.State -eq [System.Data.ConnectionState]::Open) {
|            try { $null = Invoke-SICiBuildLockSql -Connection $s.Connection -Sql (Get-SICiBuildLockSql 'HolderClear') -Params @{ v = [string]$s.Holder } } catch { }
|            $null = Invoke-SICiBuildLockSql -Connection $s.Connection -Sql (Get-SICiBuildLockSql 'Release')
|        }
|    } catch { }
|    Close-SICiBuildLockConnection $s.Connection
|}
'@ }
$__siSupportFiles['engine/data-model/SI-CiBuild.ps1'] = @{ Sha256 = '3b4086bb4e2d9a70fa3da98b22aff9a5b48c5be76d69d16ea0b69ec79168ef31'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight CI BUILD -- phase 2 of the v3 data model (V3-DATA-MODEL part 2, P2 + the first step of P3):
|    the provider records of SI_Record_CL become CIs.
|
|      1. GROUP     records that share a STRONG identifier (data-model field catalog, join = strong) are one asset:
|                   connected components (union-find), transitive. Weak identifiers (names, IPs, MACs) never join.
|                   A public IP address is the identity of a public_ip record (Shodan knows nothing else).
|                   CMDB records are not grouped here: they are linked to a CI in the enrichment step.
|      2. IDENTIFY  every group gets its CI id from the identity LEDGER -- the same ledger the correlation engine keeps,
|                   the same identifier types, so a CI keeps the id it already has (and that a CMDB already holds):
|                   mint (new), reuse (one known id), merge (two known ids: the oldest survives). No provisional ids:
|                   no ledger, no CIs (a key that moves duplicates CIs in a CMDB).
|      3. LINK      every record is a linked object of its CI: provider, type, native id, primary, state, last seen.
|                   State: active (in its feed's newest collection), not_seen (missing from a COMPLETE newer
|                   collection), frozen (missing, but the newer collection was incomplete -- absence proves nothing),
|                   gone (positive evidence: offboarded). si_link_<provider> = the provider's primary record.
|      4. RESOLVE   every SI field the records carry is resolved onto the CI by its catalog policy -- the source-of-
|                   truth rule (V3-DATA-MODEL 2.6): fresh candidates only (record age <= staleDays), the first provider
|                   in the field's authority order wins, risk booleans any-true, lists union; no fresh candidate -> the
|                   newest value, marked stale. si_field_sources says, per field, which provider and record won.
|
|    PURE: no I/O. Invoke-SICiBuild (SI-CiBuildRun.ps1) reads the records, the ledger, and publishes.
|    PowerShell 5.1: no ?. / ??, no ternary, no Set-StrictMode.
|#>
|
|. (Join-Path $PSScriptRoot 'SI-Conditions.ps1')
|# #459: conflicts beside the winner (fresh providers that disagree) -- SI-FieldResolution.ps1
|. (Join-Path $PSScriptRoot 'SI-FieldResolution.ps1')
|# the asset lifecycle (V3-DATA-MODEL 2.5.5, #406): categories, grace periods, seen window -- one mechanism with the CMDB sync
|. (Join-Path $PSScriptRoot 'SI-CiLifecycle.ps1')
|# #1056 a customer's choice of which Exposure Graph identities become assets: a CI whose record the choice now leaves out
|# retires with a reason naming the switch (Get-SIRecordLink below)
|$script:SIIdentityScopeChoiceFile = [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'asset-profiling', 'shared', 'SI-IdentityScopeChoice.ps1')
|if (-not (Get-Command -Name Get-SIRecordLeftOutByIdentityChoice -ErrorAction SilentlyContinue) -and [IO.File]::Exists($script:SIIdentityScopeChoiceFile)) { . $script:SIIdentityScopeChoiceFile }
|$script:SICiIdentityChoiceReady = [bool](Get-Command -Name Get-SIRecordLeftOutByIdentityChoice -ErrorAction SilentlyContinue)
|$script:SICiIdentityChoiceCache = $null
|# #1054 A SOURCE'S PLACEHOLDER NAME IS NEVER A CI'S NAME (owner's data-quality sweep 2026-11-02: 29 active devices named
|# "dummydevicename" -- Defender's placeholder for a device it has no name for). The CI takes the name from another linked
|# source; when none has one, a clear generated name: the shared stand-in of SI-AssetName.ps1 ('unnamed-device-<short id>',
|# deterministic, unique per device, recognisable by its 'unnamed-' prefix). The correlation check (SI-CorrelationSuspects.ps1,
|# rule placeholder) flags it. The list is the data model's placeholder_device_names (the same list the check reads).
|$script:SIAssetNameFile = [IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'asset-profiling', 'shared', 'SI-AssetName.ps1')
|if (-not (Get-Command -Name Get-SISyntheticAssetName -ErrorAction SilentlyContinue) -and [IO.File]::Exists($script:SIAssetNameFile)) { . $script:SIAssetNameFile }
|$script:SICiPlaceholderListId = 'placeholder_device_names'
|# the shipped list, used when no data model is given (the same values as data-model\lists.locked.json)
|$script:SICiPlaceholderNamesDefault = @('dummydevicename', 'unknown', 'localhost', '(none)', 'n/a')
|
|function Get-SICiPlaceholderNames {
|    <# PURE. The placeholder device names in force (lower case, trimmed): the model's list placeholder_device_names (locked +
|       the customer's override, as the model was merged), else the shipped list. #>
|    param($Model)
|    $vals = $null
|    if ($null -ne $Model) {
|        $lists = $null
|        try { $lists = $Model['lists'] } catch { $lists = $null }
|        if ($null -ne $lists) {
|            foreach ($l in @(Get-SIItemValue $lists 'lists')) {
|                if ($null -ne $l -and [string](Get-SIItemValue $l 'id') -eq $script:SICiPlaceholderListId) { $vals = @(Get-SIItemValue $l 'values'); break }
|            }
|        }
|    }
|    if ($null -eq $vals) { $vals = $script:SICiPlaceholderNamesDefault }
|    , [string[]]@(foreach ($v in @($vals)) { $s = ([string]$v).Trim().ToLowerInvariant(); if ($s) { $s } })
|}
|
|function Test-SICiPlaceholderName {
|    <# PURE. Is this name a source's placeholder (compared whole, trimmed, without case)? #>
|    param([AllowNull()]$Value, [AllowNull()][AllowEmptyCollection()][string[]]$Names)
|    if ($null -eq $Value -or $null -eq $Names -or $Names.Count -eq 0) { return $false }
|    $s = ([string]$Value).Trim().ToLowerInvariant()
|    if (-not $s) { return $false }
|    foreach ($n in $Names) { if ($s -eq $n) { return $true } }
|    $false
|}
|
|function Get-SICiUnnamedDeviceName {
|    <# PURE. #1054 the generated name of a device no linked source has a name for: 'unnamed-device-<short id>' from the native id
|       of its record (record key '<provider>:<id>' -- Defender's device id for a Defender record). $null when there is no id. #>
|    param([AllowEmptyString()][string]$RecordKey)
|    $id = [string]$RecordKey; $i = $id.IndexOf(':'); if ($i -ge 0) { $id = $id.Substring($i + 1) }
|    if (-not $id) { return $null }
|    if (Get-Command -Name Get-SISyntheticAssetName -ErrorAction SilentlyContinue) { return (Get-SISyntheticAssetName -Engine 'device' -Id $id) }
|    $clean = ($id -replace '[^A-Za-z0-9]', ''); if (-not $clean) { return $null }
|    $take = [Math]::Min(8, $clean.Length)
|    'unnamed-device-' + $clean.Substring($clean.Length - $take, $take).ToLowerInvariant()
|}
|
|function Get-SICiIdentityChoice {
|    <# The install's choice (Get-SIIdentityScopeChoice), read once and again only when one of the three settings changes -- the
|       CI build asks for every missing Exposure Graph record. $null when the choice code is not shipped. #>
|    if ($null -eq $script:SICiIdentityChoiceReady) { $script:SICiIdentityChoiceReady = [bool](Get-Command -Name Get-SIRecordLeftOutByIdentityChoice -ErrorAction SilentlyContinue) }
|    if (-not $script:SICiIdentityChoiceReady) { return $null }
|    $key = '{0}|{1}|{2}' -f $global:SI_Identity_SkipNeverSyncedAd, $global:SI_Identity_SkipNeverSyncedDisabledAd, $global:SI_Identity_SkipDeletedGroups
|    if ($null -eq $script:SICiIdentityChoiceCache -or $script:SICiIdentityChoiceCache.Key -ne $key) {
|        $script:SICiIdentityChoiceCache = [pscustomobject]@{ Key = $key; Choice = (Get-SIIdentityScopeChoice) }
|    }
|    $script:SICiIdentityChoiceCache.Choice
|}
|
|function Get-SICiLedgerTypeMap {
|    <# The catalog's strong identifier fields -> the identity ledger's identifier types (shared with the correlation engine). #>
|    return @{
|        mde_device_id     = 'MdeDeviceId'
|        entra_device_id   = 'AadDeviceId'
|        eg_node_id        = 'ExposureGraphNodeId'
|        azure_resource_id = 'AzureResourceId'
|        entra_object_id   = 'AadObjectId'
|        ad_object_guid    = 'ActiveDirectoryObjectGuid'
|        ad_sid            = 'SecurityIdentifier'
|        azure_vm_id       = 'AzureVmId'
|        intune_device_id  = 'IntuneDeviceId'
|        entra_app_id      = 'AadAppId'
|        # #500 a resource in another cloud (AWS ARN / GCP resource name), as Defender for Cloud's multicloud connector reports it
|        mdc_native_resource_id = 'CloudNativeResourceId'
|    }
|}
|
|function Get-SICiClassRank {
|    <# Which class a CI takes when its records differ: an Azure VM correlated with its Defender device is a device. #>
|    param([string]$Class)
|    switch ($Class) { 'device' { 0 } 'cloud_resource' { 1 } 'public_ip' { 2 } 'identity' { 3 } default { 9 } }
|}
|
|function Get-SIRecordIdentifiers {
|    <# A record's strong identifiers as @{ Type; Value; Key } (ledger vocabulary, lower-cased value). #>
|    param([Parameter(Mandatory)]$Record, [Parameter(Mandatory)][hashtable]$TypeMap)
|    $out = [System.Collections.Generic.List[object]]::new()
|    foreach ($f in $TypeMap.Keys) {
|        foreach ($v in (Get-SIValueList (Get-SIItemValue $Record $f))) {
|            $s = ([string]$v).Trim().ToLowerInvariant()
|            if (-not $s) { continue }
|            $t = $TypeMap[$f]
|            $out.Add([pscustomobject]@{ Type = $t; Value = $s; Key = ('{0}|{1}' -f $t.ToLowerInvariant(), $s) })
|        }
|    }
|    if ([string](Get-SIItemValue $Record 'si_class') -eq 'public_ip') {
|        $ip = ([string](Get-SIItemValue $Record 'si_ip_address')).Trim().ToLowerInvariant()
|        if ($ip) { $out.Add([pscustomobject]@{ Type = 'PublicIpAddress'; Value = $ip; Key = ('publicipaddress|{0}' -f $ip) }) }
|    }
|    return , $out
|}
|
|function Get-SICiGroups {
|    <#
|    .SYNOPSIS  Records -> groups of records that are one asset (connected components over strong identifiers).
|    .OUTPUTS   @{ Groups = [ @{ Members = [ @{ Identifiers; Record } ] } ]; Unkeyable = <records without a strong id>; Largest }
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Records, [hashtable]$TypeMap = (Get-SICiLedgerTypeMap))
|    $parent = @{}
|    $find = {
|        param($x)
|        $r = $x
|        while ($parent[$r] -ne $r) { $r = $parent[$r] }
|        $y = $x
|        while ($parent[$y] -ne $r) { $n = $parent[$y]; $parent[$y] = $r; $y = $n }
|        $r
|    }
|    $members = New-Object System.Collections.Generic.List[object]
|    $unkeyable = New-Object System.Collections.Generic.List[object]
|    foreach ($rec in $Records) {
|        if ($null -eq $rec) { continue }
|        if ([string](Get-SIItemValue $rec 'si_record_type') -eq 'cmdb_ci') { continue }
|        $ids = Get-SIRecordIdentifiers -Record $rec -TypeMap $TypeMap
|        if ($ids.Count -eq 0) { $unkeyable.Add($rec); continue }
|        $m = [pscustomobject]@{ Identifiers = $ids.ToArray(); Record = $rec; Node = ('rec:' + [string](Get-SIItemValue $rec 'si_record_key')) }
|        $members.Add($m)
|        if (-not $parent.ContainsKey($m.Node)) { $parent[$m.Node] = $m.Node }
|        foreach ($id in $ids) {
|            if (-not $parent.ContainsKey($id.Key)) { $parent[$id.Key] = $id.Key }
|            $a = & $find $m.Node; $b = & $find $id.Key
|            if ($a -ne $b) { if ([string]::CompareOrdinal($a, $b) -lt 0) { $parent[$b] = $a } else { $parent[$a] = $b } }
|        }
|    }
|    $byRoot = [ordered]@{}
|    foreach ($m in $members) {
|        $root = & $find $m.Node
|        if (-not $byRoot.Contains($root)) { $byRoot[$root] = New-Object System.Collections.Generic.List[object] }
|        $byRoot[$root].Add($m)
|    }
|    $groups = New-Object System.Collections.Generic.List[object]
|    $largest = 0
|    foreach ($k in $byRoot.Keys) {
|        $groups.Add([pscustomobject]@{ Members = $byRoot[$k].ToArray() })
|        if ($byRoot[$k].Count -gt $largest) { $largest = $byRoot[$k].Count }
|    }
|    return @{ Groups = $groups.ToArray(); Unkeyable = $unkeyable.ToArray(); Largest = $largest }
|}
|
|function Get-SIRecordFeed {
|    <# A record's feed -- the unit whose newest collection says what is present: provider + record type. #>
|    param($Record)
|    '{0}|{1}' -f (Get-SIItemValue $Record 'si_provider'), (Get-SIItemValue $Record 'si_record_type')
|}
|
|function Get-SIFeedLatest {
|    <# Per feed: the newest collection time and whether that collection was complete. #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Records)
|    $latest = @{}
|    foreach ($r in $Records) {
|        $f = Get-SIRecordFeed $r
|        $t = ConvertTo-SIUtcOrNull (Get-SIItemValue $r 'si_collection_time')
|        if ($null -eq $t) { continue }
|        $c = (ConvertTo-SIBoolOrNull (Get-SIItemValue $r 'si_collection_complete')) -ne $false
|        if (-not $latest.ContainsKey($f) -or $t -gt $latest[$f].Time) { $latest[$f] = [pscustomobject]@{ Time = $t; Complete = $c } }
|        elseif ($t -eq $latest[$f].Time -and -not $c) { $latest[$f].Complete = $false }
|    }
|    return $latest
|}
|
|function Test-SIRecordAdAccountAsDevice {
|    <#
|        PURE. #1052 Is this an Exposure Graph DEVICE record that is really an Active Directory computer account -- one a
|        build before the fix recorded as a device (provider eg, record type device) with AD ids (ad_object_guid / ad_sid) and
|        NO device identifier at all (no Defender, Entra, Intune or Azure id)? Such a record is not a device and never was:
|        it made a device CI of its own (a domain controller's Tier 0 landed on that empty duplicate).
|    #>
|    param($Record)
|    if ($null -eq $Record) { return $false }
|    if ([string](Get-SIItemValue $Record 'si_provider') -ne 'eg' -or [string](Get-SIItemValue $Record 'si_record_type') -ne 'device') { return $false }
|    $ad = $false
|    foreach ($f in 'ad_object_guid', 'ad_sid') { if (@(Get-SIValueList (Get-SIItemValue $Record $f) | Where-Object { [string]$_ }).Count -gt 0) { $ad = $true; break } }
|    if (-not $ad) { return $false }
|    foreach ($f in 'mde_device_id', 'entra_device_id', 'intune_device_id', 'azure_resource_id', 'azure_vm_id') {
|        if (@(Get-SIValueList (Get-SIItemValue $Record $f) | Where-Object { [string]$_ }).Count -gt 0) { return $false }
|    }
|    $true
|}
|
|function Get-SIRecordLink {
|    <#
|        PURE. One record's link state with its evidence: @{ State (active | not_seen | frozen | gone); Reason ('' when active) }.
|          gone      positive evidence: the source says offboarded -- or (#1052) the record is an Active Directory computer
|                    account an earlier build took in as a device (Test-SIRecordAdAccountAsDevice): SecurityInsight itself
|                    knows it is no device, so its CI is retired at once with that reason, never left active
|          frozen    missing from its feed's newest collection and that collection was incomplete, or -- 60.5.0d -- the
|                    provider's collection scope changed after the record was last listed (-ScopeChangedAt: provider ->
|                    the time its scope changed): an asset that leaves because we stopped looking has told us nothing
|          not_seen  missing from a COMPLETE newer collection; or (#406, -SeenWithinDays) LISTED, but a device record whose
|                    source has not seen it within the seen window (Get-SIRecordSeenWindowDays) -- Defender keeps listing a
|                    machine it has not heard from
|          active    otherwise
|        Without -SeenWithinDays (0) a listed record is active, as before the lifecycle was kept.
|          gone (#1056) also: missing from a COMPLETE newer collection while the install's choice
|                    (SI_Identity_SkipNeverSyncedAd / SI_Identity_SkipNeverSyncedDisabledAd / SI_Identity_SkipDeletedGroups) leaves it out -- the reason names
|                    the switch (Get-SIRecordLeftOutByIdentityChoice). -IdentityChoice: Get-SIIdentityScopeChoice (not given =
|                    the install's settings; both off = exactly as before).
|    #>
|    param($Record, [hashtable]$FeedLatest, [datetime]$Now = [datetime]::UtcNow, [int]$SeenWithinDays = 0, [hashtable]$ScopeChangedAt, $IdentityChoice,
|          # #1057 record key -> its source's PROOF of deletion (SI-DeletionProof.ps1, ConvertTo-SIDeletionProofIndex): a record
|          # missing from a COMPLETE newer collection with a proof is gone, "deleted in <source>" -- the proof wins over the
|          # not-seen window; a record still listed, or one whose newer collection was not complete, is never decided by it
|          [hashtable]$DeletionProof)
|    $p = [string](Get-SIItemValue $Record 'si_provider')
|    if ([string](Get-SIItemValue $Record 'si_onboarding_status') -eq 'offboarded') { return [pscustomobject]@{ State = 'gone'; Reason = ('{0} says it is offboarded' -f $p) } }
|    if (Test-SIRecordAdAccountAsDevice $Record) { return [pscustomobject]@{ State = 'gone'; Reason = 'an Active Directory computer account, not a device of its own (#1052) -- its facts go to its Defender device when the match is safe' } }
|    $t = ConvertTo-SIUtcOrNull (Get-SIItemValue $Record 'si_collection_time')
|    $fl = $null; if ($FeedLatest) { $fl = $FeedLatest[(Get-SIRecordFeed $Record)] }
|    $fmt = { param($d) ([datetime]$d).ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture) }
|    if ($null -eq $fl -or $null -eq $t -or $t -ge $fl.Time) {
|        $win = Get-SIRecordSeenWindowDays -Record $Record -SeenWithinDays $SeenWithinDays
|        if ($win -gt 0) {
|            # measured at the moment the source LISTED it (its collection time): a source that stops collecting proves nothing
|            # about its devices -- only what it said when it last listed them counts (a source outage never retires)
|            $sls = ConvertTo-SIUtcOrNull (Get-SIItemValue $Record 'si_source_last_seen')
|            $at = $t; if ($null -eq $at -or $at -gt $Now.ToUniversalTime()) { $at = $Now.ToUniversalTime() }
|            if ($null -ne $sls -and ($at - $sls).TotalDays -gt $win) {
|                return [pscustomobject]@{ State = 'not_seen'; Reason = ('{0} lists it, but last saw it on {1} (more than {2} days)' -f $p, (& $fmt $sls), $win) }
|            }
|        }
|        return [pscustomobject]@{ State = 'active'; Reason = '' }
|    }
|    if ($ScopeChangedAt -and $ScopeChangedAt.ContainsKey($p) -and $ScopeChangedAt[$p] -is [datetime] -and $t -lt $ScopeChangedAt[$p]) {
|        return [pscustomobject]@{ State = 'frozen'; Reason = ('the {0} collection scope changed on {1}; it was last listed before that' -f $p, (& $fmt $ScopeChangedAt[$p])) }
|    }
|    if ($DeletionProof -and $DeletionProof.Count -gt 0 -and $fl.Complete) {
|        $pk = [string](Get-SIItemValue $Record 'si_record_key')
|        if ($pk -and $DeletionProof.ContainsKey($pk)) {
|            $pr = $DeletionProof[$pk]
|            $on = ''; if ($pr.DeletedAt -is [datetime]) { $on = ' on ' + (& $fmt $pr.DeletedAt) }
|            return [pscustomobject]@{ State = 'gone'; Reason = ('deleted in {0}{1} ({2})' -f $pr.Label, $on, $pr.Evidence); Deleted = [string]$pr.Label }
|        }
|    }
|    # a device whose source -- when it last listed it -- had not seen it within the seen window is not seen, whatever the
|    # newer collection was: that is the source's own evidence, not an absence
|    $win = Get-SIRecordSeenWindowDays -Record $Record -SeenWithinDays $SeenWithinDays
|    if ($win -gt 0) {
|        # (as when it last listed it -- its collection time -- never "now": the newer collection was not complete)
|        $sls = ConvertTo-SIUtcOrNull (Get-SIItemValue $Record 'si_source_last_seen')
|        if ($null -ne $sls -and ($t - $sls).TotalDays -gt $win) {
|            return [pscustomobject]@{ State = 'not_seen'; Reason = ('{0} last saw it on {1} (more than {2} days before it last listed it)' -f $p, (& $fmt $sls), $win) }
|        }
|    }
|    if ($fl.Complete) {
|        # #1056 a customer's choice leaves this Exposure Graph record out now: gone, with the switch named -- never a silent
|        # vanish and never a grace-period wait for an object the install chose not to keep
|        if ($p -eq 'eg') {
|            if ($null -eq $IdentityChoice) { $IdentityChoice = Get-SICiIdentityChoice }
|            if ($null -ne $IdentityChoice -and $IdentityChoice.Any) {
|                $lo = Get-SIRecordLeftOutByIdentityChoice -Record $Record -Choice $IdentityChoice
|                if ($lo.Gone) { return [pscustomobject]@{ State = 'gone'; Reason = ('{0} (last listed {1})' -f $lo.Reason, (& $fmt $t)) } }
|            }
|        }
|        return [pscustomobject]@{ State = 'not_seen'; Reason = ('{0} no longer lists it (last listed {1})' -f $p, (& $fmt $t)) }
|    }
|    return [pscustomobject]@{ State = 'frozen'; Reason = ('the newest {0} collection was incomplete' -f $p) }
|}
|
|function Get-SIRecordLinkState {
|    <# active | not_seen | frozen | gone for one record (Get-SIRecordLink's state). #>
|    param($Record, [hashtable]$FeedLatest, [datetime]$Now = [datetime]::UtcNow, [int]$SeenWithinDays = 0, [hashtable]$ScopeChangedAt)
|    (Get-SIRecordLink -Record $Record -FeedLatest $FeedLatest -Now $Now -SeenWithinDays $SeenWithinDays -ScopeChangedAt $ScopeChangedAt).State
|}
|
|function Get-SICiIdentityOrigin {
|    <#
|    .SYNOPSIS  PURE. #546 -- where an identity's on-premises facts come from: 'synced' | 'cloud' | '' (cannot tell).
|                 synced  an Active Directory user record is linked to the CI, or any record says si_onprem_synced = true
|                         (Entra onPremisesSyncEnabled, the Exposure Graph identity node)
|                 cloud   an Entra record is linked and none of the above holds: Graph's onPremisesSyncEnabled is null for an
|                         account that was never synchronised, and a service principal is always a cloud object
|                 ''      neither (e.g. only an Exposure Graph or a Defender for Identity record) -- a field with an
|                         origin-specific authority is then UNKNOWN on this CI, never guessed
|    .PARAMETER Candidates  as Resolve-SICiField takes them: @{ Record; Provider; Key; State }
|    #>
|    param([AllowEmptyCollection()][object[]]$Candidates = @())
|    $hasEntra = $false
|    foreach ($c in $Candidates) {
|        if ($null -eq $c) { continue }
|        $p = [string]$c.Provider
|        if ($p -eq 'ad' -and [string](Get-SIItemValue $c.Record 'si_record_type') -in 'user', '') { return 'synced' }
|        if ((ConvertTo-SIBoolOrNull (Get-SIItemValue $c.Record 'si_onprem_synced')) -eq $true) { return 'synced' }
|        if ($p -eq 'entra') { $hasEntra = $true }
|    }
|    if ($hasEntra) { return 'cloud' }
|    return ''
|}
|
|function Get-SIFieldOriginRule {
|    <#
|    .SYNOPSIS  PURE. #546 -- a field's resolution for an identity origin (field catalog resolution.byOrigin.<origin>):
|               @{ Policy; Authority; DecidedBy } or $null when the field has no origin-specific authority.
|               Authority = the providers that may supply the value for that origin (in order; the others are ignored);
|               DecidedBy = the providers one of which must be linked to the CI for the value -- or its absence -- to be
|               known (default: Authority). A field with byOrigin on a CI whose origin is '' returns @{ Unknown = $true }.
|               Customer-overridable like every catalog field: Community field-catalog.custom.json, Pro cfg.ItemOverride
|               'field-catalog:<field>'.
|    #>
|    param([Parameter(Mandatory)]$Field, [AllowEmptyString()][string]$Origin)
|    $bo = $null
|    if ($Field.resolution) { $bo = Get-SIItemValue $Field.resolution 'byOrigin' }
|    if ($null -eq $bo) { return $null }
|    if (-not $Origin) { return @{ Unknown = $true } }
|    $r = Get-SIItemValue $bo $Origin
|    if ($null -eq $r) { return $null }
|    $pol = [string](Get-SIItemValue $r 'policy'); if (-not $pol) { $pol = [string]$Field.resolution.policy }
|    $auth = @(@(Get-SIItemValue $r 'authority') | Where-Object { $_ } | ForEach-Object { [string]$_ })
|    $dec = @(@(Get-SIItemValue $r 'decidedBy') | Where-Object { $_ } | ForEach-Object { [string]$_ })
|    if ($dec.Count -eq 0) { $dec = $auth }
|    return @{ Policy = $pol; Authority = $auth; DecidedBy = $dec; Unknown = $false }
|}
|
|function Test-SICiFieldUnknown {
|    <#
|    .SYNOPSIS  PURE. #546 -- is this field UNKNOWN on the CI: it has an origin-specific authority and either the origin cannot
|               be told, or none of the providers that decide it for that origin has a current (active / frozen) record
|               linked. A synchronised account without its Active Directory / Defender for Identity record has an unknown
|               password age and on-premises sign-in -- never "stale", never "never signed in".
|    #>
|    param([Parameter(Mandatory)]$Field, [AllowEmptyString()][string]$Origin, [AllowEmptyCollection()][object[]]$Candidates = @())
|    $rule = Get-SIFieldOriginRule -Field $Field -Origin $Origin
|    if ($null -eq $rule) { return $false }
|    if ($rule.Unknown) { return $true }
|    foreach ($c in $Candidates) {
|        if ($null -ne $c -and $rule.DecidedBy -contains [string]$c.Provider -and [string]$c.State -in 'active', 'frozen') { return $false }
|    }
|    return $true
|}
|
|function Resolve-SICiField {
|    <#
|    .SYNOPSIS  One SI field resolved from a CI's records by its catalog policy.
|    .PARAMETER Origin  #546 the identity's origin (Get-SICiIdentityOrigin): a field with resolution.byOrigin takes that
|                       origin's policy and authority, and ONLY the providers in it may supply the value (Entra never
|                       decides a synchronised account's password age).
|    .OUTPUTS   $null (no record carries it) or @{ Value; Provider; Record; ObservedAt; Stale }
|    #>
|    param([Parameter(Mandatory)]$Field, [Parameter(Mandatory)][object[]]$Candidates, [datetime]$Now, [string]$CmdbOwner = 'cmdb', [string]$Origin = '')
|    $policy = [string]$Field.resolution.policy
|    $rawAuth = @($Field.resolution.authority)
|    # (an origin rule is used only with an origin: without one it is never applied -- not read)
|    $originRule = $null; if ($Origin) { $originRule = Get-SIFieldOriginRule -Field $Field -Origin $Origin }
|    if ($null -ne $originRule -and -not $originRule.Unknown) {
|        $policy = $originRule.Policy
|        $rawAuth = @($originRule.Authority)
|        $allowed = $originRule.Authority
|        $Candidates = @(foreach ($c in $Candidates) { if ($c -and $allowed -contains [string]$c.Provider) { $c } })
|        if ($Candidates.Count -eq 0) { return $null }
|    }
|    # (2026-10-16, the CI build of a large install: this runs for every field of every CI -- loops, never a pipeline, and
|    # a pool of ONE candidate is that candidate without a sort. The same answers.)
|    # #463 the catalog's 'cmdb_owner' token is the tenant's ONE CMDB owner; a field whose authority is ONLY the owner
|    # (si_cmdb_*) takes no value from any other provider -- a non-owner CMDB never decides (2.8.1, D11)
|    $authority = @(foreach ($a in $rawAuth) { if ([string]$a -eq 'cmdb_owner') { $CmdbOwner } else { $a } })
|    $notOwner = 0; foreach ($a in $rawAuth) { if ([string]$a -ne 'cmdb_owner') { $notOwner++ } }
|    $ownerOnly = ($rawAuth.Count -gt 0 -and $notOwner -eq 0)
|    if ($ownerOnly) { $Candidates = @(foreach ($c in $Candidates) { if ([string]$c.Provider -eq $CmdbOwner) { $c } }); if ($Candidates.Count -eq 0) { return $null } }
|    $staleDays = 30
|    if ($null -ne $Field.resolution.staleDays) { $staleDays = [double]$Field.resolution.staleDays }
|    $cands = New-Object System.Collections.Generic.List[object]
|    foreach ($c in $Candidates) {
|        $v = Get-SIItemValue $c.Record ([string]$Field.name)
|        if (Test-SIValueEmpty $v) { if (-not ($v -is [bool])) { continue } }
|        $seen = ConvertTo-SIUtcOrNull (Get-SIItemValue $c.Record 'si_source_last_seen')
|        $fresh = ($c.State -in 'active', 'frozen') -and ($null -ne $seen) -and ((($Now - $seen).TotalDays) -le $staleDays)
|        $rank = [array]::IndexOf($authority, [string]$c.Provider)
|        if ($rank -lt 0) { $rank = 999 }
|        $cands.Add([pscustomobject]@{ Value = $v; Provider = $c.Provider; Record = $c.Key; ObservedAt = $seen; Fresh = $fresh; Rank = $rank })
|    }
|    if ($cands.Count -eq 0) { return $null }
|    # plain arrays only: assigning @(<the generic list>) inside this branch threw "Argument types do not match" on both
|    # hosts (measured on the test VM) -- the candidates are copied out once with ToArray()
|    $candArr = $cands.ToArray()
|    $freshArr = @(foreach ($c in $candArr) { if ($c.Fresh) { $c } })
|    $stale = ($freshArr.Count -eq 0)
|    $pool = @(if ($stale) { $candArr } else { $freshArr })
|    $newest = { param($xs) $xa = @($xs); if ($xa.Count -eq 1) { return $xa[0] }; @($xa | Sort-Object @{ Expression = { if ($_.ObservedAt) { $_.ObservedAt } else { [datetime]::MinValue } }; Descending = $true }, @{ Expression = { $_.Rank } })[0] }
|    switch ($policy) {
|        'any_true' {
|            $t = @(foreach ($c in $pool) { if ((ConvertTo-SIBoolOrNull $c.Value) -eq $true) { $c } })
|            # Providers: EVERY provider that said true -- the evidence of a risk factor names them all (#464)
|            if ($t.Count -gt 0) { $w = & $newest $t; return @{ Value = $true; Provider = $w.Provider; Record = $w.Record; ObservedAt = $w.ObservedAt; Stale = $stale; Providers = @($t | ForEach-Object { [string]$_.Provider } | Select-Object -Unique) } }
|            $f = @(foreach ($c in $pool) { if ((ConvertTo-SIBoolOrNull $c.Value) -eq $false) { $c } })
|            if ($f.Count -gt 0) { $w = & $newest $f; return @{ Value = $false; Provider = $w.Provider; Record = $w.Record; ObservedAt = $w.ObservedAt; Stale = $stale } }
|            return $null
|        }
|        'union' {
|            $list = New-Object System.Collections.Generic.List[object]
|            $seenKeys = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|            $byRank = $pool; if ($pool.Count -gt 1) { $byRank = @($pool | Sort-Object Rank) }
|            foreach ($c in $byRank) {
|                foreach ($x in (Get-SIValueList $c.Value)) {
|                    $k = if ($x -is [string] -or $x -is [ValueType]) { [string]$x } else { ($x | ConvertTo-Json -Compress -Depth 6) }
|                    if ($seenKeys.Add($k)) { $list.Add($x) }
|                }
|            }
|            $w = & $newest $pool
|            return @{ Value = $list.ToArray(); Provider = (@($pool | Select-Object -ExpandProperty Provider -Unique) -join ','); Record = $w.Record; ObservedAt = $w.ObservedAt; Stale = $stale }
|        }
|        { $_ -in 'min', 'max' } {
|            # compared by the catalog TYPE: values read back from Log Analytics are text, so the value cannot tell
|            $isDate = ([string]$Field.type -eq 'datetime')
|            $best = $null; $bestV = $null
|            foreach ($c in $cands) {
|                $x = $null
|                if ($isDate) { $x = ConvertTo-SIUtcOrNull $c.Value } else { $x = ConvertTo-SINumberOrNull $c.Value }
|                if ($null -eq $x) { continue }
|                if ($null -eq $best -or ($policy -eq 'max' -and $x -gt $bestV) -or ($policy -eq 'min' -and $x -lt $bestV)) { $best = $c; $bestV = $x }
|            }
|            if ($null -eq $best) { return $null }
|            return @{ Value = $best.Value; Provider = $best.Provider; Record = $best.Record; ObservedAt = $best.ObservedAt; Stale = $false }
|        }
|        default {
|            # authority (and anything else that reaches a CI from records): best authority rank, then newest
|            if ($stale) { $w = & $newest $pool }
|            elseif ($pool.Count -eq 1) { $w = $pool[0] }
|            else { $w = @($pool | Sort-Object @{ Expression = { $_.Rank } }, @{ Expression = { if ($_.ObservedAt) { $_.ObservedAt } else { [datetime]::MinValue } }; Descending = $true })[0] }
|            return @{ Value = $w.Value; Provider = $w.Provider; Record = $w.Record; ObservedAt = $w.ObservedAt; Stale = $stale }
|        }
|    }
|}
|
|function Get-SICiFieldPlan {
|    <#
|    .SYNOPSIS  PURE. The catalog fields a CI resolves from its records, in catalog order, each with what New-SICiDocument
|               asks of it for every CI: its name, whether it is an identity field, whether it has an origin-specific
|               authority (resolution.byOrigin). Read once per set of CIs instead of once per CI and field -- the catalog
|               has several hundred fields.
|               A field is in the plan when its level is 'both' and it is not computed (a computed field is
|               SecurityInsight's own on the CI, never resolved from the records).
|    #>
|    param([Parameter(Mandatory)]$Catalog)
|    $plan = New-Object System.Collections.Generic.List[object]
|    foreach ($f in @($Catalog.fields)) {
|        if ([string]$f.level -ne 'both') { continue }
|        if ([string]$f.resolution.policy -eq 'computed') { continue }
|        # as Get-SIFieldOriginRule reads it: no byOrigin = no origin rule, whatever the origin
|        $bo = $null
|        if ($f.resolution) { $bo = Get-SIItemValue $f.resolution 'byOrigin' }
|        $plan.Add([pscustomobject]@{ Field = $f; Name = [string]$f.name; Identity = (@($f.classes) -contains 'identity'); ByOrigin = ($null -ne $bo) })
|    }
|    return $plan.ToArray()   # unrolled: the caller collects with @()
|}
|
|function New-SICiDocument {
|    <#
|    .SYNOPSIS  One CI from its records: id, class, links, lifecycle and every resolved SI field.
|    #>
|    param(
|        [Parameter(Mandatory)][string]$CiId,
|        [Parameter(Mandatory)][object[]]$Records,
|        [Parameter(Mandatory)]$Catalog,
|        [Parameter(Mandatory)][hashtable]$FeedLatest,
|        [datetime]$Now = [datetime]::UtcNow,
|        [string]$RunId = '',
|        # #463 the tenant's one CMDB owner (cmdb | servicenow) -- the catalog's cmdb_owner authority
|        [string]$CmdbOwner = 'cmdb',
|        # the catalog's resolved fields, read once for a whole set of CIs (Get-SICiFieldPlan -Catalog <the same catalog>);
|        # not given, it is read here -- the same result
|        [AllowNull()][object[]]$FieldPlan,
|        # #406 the lifecycle settings (Get-SICiLifecycleSettings: seen window, grace period per category); not given = the
|        # settings in force
|        $Lifecycle,
|        # what this CI was after the last build: @{ Lifecycle; Since; Reason } (Get-SICiBatchStored) -- none = a first build
|        $Previous,
|        # 60.5.0d provider -> the time its collection scope changed (Update-SICiScopeChanges)
|        [hashtable]$ScopeChangedAt,
|        # #1057 record key -> its source's proof of deletion (Get-SIRecordLink -DeletionProof)
|        [hashtable]$DeletionProof,
|        # #1054 the placeholder device names in force (Get-SICiPlaceholderNames -Model, read once per set); not given = the
|        # shipped list
|        [AllowNull()][AllowEmptyCollection()][string[]]$PlaceholderNames
|    )
|    if ($null -eq $Lifecycle) { $Lifecycle = Get-SICiLifecycleSettings }
|    if ($null -eq $PlaceholderNames) { $PlaceholderNames = Get-SICiPlaceholderNames }
|    $ci = [ordered]@{ si_ci_id = $CiId }
|    $class = 'identity'; $bestRank = 99
|    $cands = New-Object System.Collections.Generic.List[object]
|    $links = New-Object System.Collections.Generic.List[object]
|    foreach ($r in $Records) {
|        $rc = [string](Get-SIItemValue $r 'si_class')
|        $rk = Get-SICiClassRank $rc
|        if ($rk -lt $bestRank) { $bestRank = $rk; $class = $rc }
|        $ls = Get-SIRecordLink -Record $r -FeedLatest $FeedLatest -Now $Now -SeenWithinDays ([int]$Lifecycle.SeenWithinDays) -ScopeChangedAt $ScopeChangedAt -DeletionProof $DeletionProof
|        $state = [string]$ls.State
|        $p = [string](Get-SIItemValue $r 'si_provider')
|        $key = [string](Get-SIItemValue $r 'si_record_key')
|        $native = $key; $i = $key.IndexOf(':'); if ($i -ge 0) { $native = $key.Substring($i + 1) }
|        $lo = [pscustomobject][ordered]@{
|                provider = $p; type = [string](Get-SIItemValue $r 'si_record_type'); id = $native; record_key = $key
|                primary = $false; state = $state; last_seen = (ConvertTo-SIUtcOrNull (Get-SIItemValue $r 'si_source_last_seen'))
|            }
|        # the evidence of a link that is not active (dates only: it changes with the state, never by itself)
|        if ($ls.Reason) { $lo | Add-Member -NotePropertyName 'reason' -NotePropertyValue ([string]$ls.Reason) }
|        # #1057 the source the object was proven deleted in (Get-SICiLifecycle: retired at once)
|        if ($ls.PSObject.Properties['Deleted'] -and $ls.Deleted) { $lo | Add-Member -NotePropertyName 'deleted' -NotePropertyValue ([string]$ls.Deleted) }
|        $links.Add($lo)
|        $cands.Add([pscustomobject]@{ Record = $r; Provider = $p; Key = $key; State = $state })
|    }
|    # primary link per provider: active first, then the newest -- #1052 an AD computer account's link is never the primary
|    # one while the provider has another (si_link_eg names the device's own graph node, which the reports join by)
|    foreach ($grp in ($links | Group-Object provider)) {
|        $pick = @($grp.Group | Sort-Object @{ Expression = { if ($_.type -eq 'computer_account') { 1 } else { 0 } } }, @{ Expression = { if ($_.state -in 'active', 'frozen') { 0 } else { 1 } } }, @{ Expression = { if ($_.last_seen) { $_.last_seen } else { [datetime]::MinValue } }; Descending = $true })[0]
|        $pick.primary = $true
|    }
|    $ci['si_class'] = $class
|    $ci['si_collection_time'] = $Now.ToUniversalTime()
|    if ($RunId) { $ci['si_run_id'] = $RunId }
|    # #546 field authority by identity origin: synchronised from AD vs cloud-only decides which provider is authoritative
|    # for the on-premises facts (password age, on-premises sign-in); a field that cannot be decided is listed as unknown
|    $candArr = $cands.ToArray()
|    $origin = ''
|    if ($class -eq 'identity') { $origin = Get-SICiIdentityOrigin -Candidates $candArr; if ($origin) { $ci['si_identity_origin'] = $origin } }
|    $unknownFields = New-Object System.Collections.Generic.List[string]
|    $resolvedSources = [ordered]@{}
|    # THE FIELDS THE RECORDS CARRY AT ALL. A field no record of this CI carries resolves to nothing -- Resolve-SICiField
|    # only ever reads the candidates' own value of the field -- so it is not asked for: the catalog has several hundred
|    # fields, a CI's records carry a few dozen, and asking for every one was most of the CI build's time on a large tenant
|    # (2026-10-12). A name is looked up the way Get-SIItemValue finds it: without case on an object's properties and on a
|    # dictionary's keys, and through the dictionary's own Contains.
|    $carried = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $dictRecords = New-Object System.Collections.Generic.List[object]
|    foreach ($r in $Records) {
|        if ($null -eq $r) { continue }
|        if ($r -is [System.Collections.IDictionary]) { $dictRecords.Add($r); foreach ($k in $r.Keys) { [void]$carried.Add([string]$k) } }
|        else { foreach ($p in $r.PSObject.Properties) { [void]$carried.Add([string]$p.Name) } }
|    }
|    # a COMPUTED field (si_class, si_collection_time, si_run_id ...) is SecurityInsight's own on the CI -- never
|    # resolved from the records, or a record's value would overwrite what the CI build decided (Get-SICiFieldPlan)
|    if ($null -eq $FieldPlan) { $FieldPlan = @(Get-SICiFieldPlan -Catalog $Catalog) }
|    foreach ($fp in $FieldPlan) {
|        $f = $fp.Field
|        $fOrigin = ''
|        if ($class -eq 'identity' -and $fp.Identity) {
|            $fOrigin = $origin
|            # (a field without an origin-specific authority is never unknown: Test-SICiFieldUnknown answers false for it)
|            if ($fp.ByOrigin -and (Test-SICiFieldUnknown -Field $f -Origin $origin -Candidates $candArr)) { $unknownFields.Add([string]$f.name) }
|        }
|        $has = $carried.Contains($fp.Name)
|        if (-not $has) { foreach ($d in $dictRecords) { if ($d.Contains($fp.Name)) { $has = $true; break } } }
|        if (-not $has) { continue }
|        $fCands = $candArr
|        $placeholder = $null
|        if ($fp.Name -eq 'si_asset_name' -and $class -in 'device', 'cloud_resource') {
|            # #1054 a source's placeholder name never names a machine CI: the records that carry one are left out of the
|            # resolution, so the next source in the authority order gives the name; when only placeholders are left, a
|            # generated name (Get-SICiUnnamedDeviceName) from the record the authority order picks among them
|            $kept = New-Object System.Collections.Generic.List[object]
|            $phs = New-Object System.Collections.Generic.List[object]
|            foreach ($c in $candArr) {
|                if (Test-SICiPlaceholderName -Value (Get-SIItemValue $c.Record 'si_asset_name') -Names $PlaceholderNames) { $phs.Add($c) } else { $kept.Add($c) }
|            }
|            if ($phs.Count -gt 0) {
|                $placeholder = Resolve-SICiField -Field $f -Candidates $phs.ToArray() -Now $Now -CmdbOwner $CmdbOwner -Origin $fOrigin
|                $fCands = $kept.ToArray()
|            }
|        }
|        $res = $null
|        if ($fCands.Count -gt 0) { $res = Resolve-SICiField -Field $f -Candidates $fCands -Now $Now -CmdbOwner $CmdbOwner -Origin $fOrigin }
|        if ($null -eq $res -and $null -ne $placeholder) {
|            $gen = Get-SICiUnnamedDeviceName -RecordKey ([string]$placeholder.Record)
|            if ($gen) {
|                $ci[[string]$f.name] = $gen
|                $resolvedSources[[string]$f.name] = [ordered]@{ provider = $placeholder.Provider; record = $placeholder.Record; observed_at = $placeholder.ObservedAt; stale = [bool]$placeholder.Stale
|                    from = 'generated'; placeholder = ([string]$placeholder.Value).Trim().ToLowerInvariant() }
|                continue
|            }
|            # no id to build a name from: the placeholder stays (never a blank name) -- the check still flags it by its name
|            $res = $placeholder; $fCands = $candArr; $placeholder = $null
|        }
|        if ($null -eq $res) { continue }
|        $ci[[string]$f.name] = $res.Value
|        $resolvedSources[[string]$f.name] = [ordered]@{ provider = $res.Provider; record = $res.Record; observed_at = $res.ObservedAt; stale = [bool]$res.Stale }
|        # the name came from another source: which placeholder it replaced, and from which record
|        if ($null -ne $placeholder) { $resolvedSources[[string]$f.name]['placeholder'] = ([string]$placeholder.Value).Trim().ToLowerInvariant(); $resolvedSources[[string]$f.name]['placeholder_record'] = [string]$placeholder.Record }
|        if ($fOrigin -and $fp.ByOrigin -and $null -ne (Get-SIFieldOriginRule -Field $f -Origin $fOrigin)) { $resolvedSources[[string]$f.name]['origin'] = $fOrigin }
|        if ($unknownFields.Contains([string]$f.name)) { $resolvedSources[[string]$f.name]['unknown'] = $true }
|        if ($res.Providers -and @($res.Providers).Count -gt 1) { $resolvedSources[[string]$f.name]['providers'] = @($res.Providers) }
|        # a CI of ONE record has nothing to disagree with (Get-SICiFieldConflicts compares the other records only)
|        # (#1054 a placeholder name the resolution left out is no conflict: the candidates are the ones it resolved from)
|        if ($fCands.Count -ne 1 -or [string]$fCands[0].Key -ne [string]$res.Record) {
|            $conf = Get-SICiFieldConflicts -Field $f -Candidates $fCands -Resolved $res -Now $Now
|            if ($conf.Count -gt 0) { $resolvedSources[[string]$f.name]['conflicts'] = $conf }
|        }
|    }
|    if ($unknownFields.Count -gt 0) { $ci['si_unknown_fields'] = $unknownFields.ToArray() }
|    # NO MACHINE CI IS NAMELESS (owner 2026-11-05: a ring 1 install had 271 active device CIs with an EMPTY name, 270 with a
|    # Defender link). The placeholder rule above (#1054) names a CI only when a record CARRIES a placeholder; a Defender
|    # device with no computerDnsName carries NO name at all, so si_asset_name was never resolved and stayed empty. A device
|    # or cloud resource CI that no record names gets a name here: a cloud resource the name in its Azure resource id, else
|    # the generated 'unnamed-device-<short id>' from the record of the first source in this order: Defender, Azure,
|    # Defender for Cloud, Intune, Entra, Exposure Graph, any other (ordinal record key) -- the same on every build.
|    if ($class -in 'device', 'cloud_resource' -and [string]::IsNullOrWhiteSpace([string]$ci['si_asset_name'])) {
|        $order = @('mde', 'azure', 'mdc', 'intune', 'entra', 'eg')
|        $pickC = $null; $pickR = 999
|        foreach ($c in $candArr) {
|            $rk2 = [array]::IndexOf($order, [string]$c.Provider); if ($rk2 -lt 0) { $rk2 = 100 }
|            if ($null -eq $pickC -or $rk2 -lt $pickR -or ($rk2 -eq $pickR -and [string]::CompareOrdinal([string]$c.Key, [string]$pickC.Key) -lt 0)) { $pickC = $c; $pickR = $rk2 }
|        }
|        if ($null -ne $pickC) {
|            $gen = $null
|            if ($class -eq 'cloud_resource') {
|                $nid = [string]$pickC.Key; $ix = $nid.IndexOf(':'); if ($ix -ge 0) { $nid = $nid.Substring($ix + 1) }
|                if ($nid -match '^/subscriptions/') { $gen = ($nid.TrimEnd('/') -split '/')[-1] }
|            }
|            if (-not $gen) { $gen = Get-SICiUnnamedDeviceName -RecordKey ([string]$pickC.Key) }
|            if ($gen) {
|                $ci['si_asset_name'] = $gen
|                $resolvedSources['si_asset_name'] = [ordered]@{ provider = [string]$pickC.Provider; record = [string]$pickC.Key; observed_at = (ConvertTo-SIUtcOrNull (Get-SIItemValue $pickC.Record 'si_source_last_seen')); stale = $false; from = 'generated'; placeholder = '' }
|            }
|        }
|    }
|    $recordLinks = $links.ToArray()
|    # AZURE CHILD RESOURCES (owner 2026-10-11, SI-AzureChildren.ps1): every child resource a record of this CI lists
|    # (si_child_resources -- a VM extension, a disk, a network interface, a SQL database ...) is a LINKED OBJECT of this CI, so
|    # its id leads here (a finding reported on the child lands on its parent CI); a child is never a CI of its own. A child
|    # link has no record of its own (record_key '') and takes the state of the record that lists it. In id order.
|    $childLinks = New-Object System.Collections.Generic.List[object]
|    $childSeen = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($c in $candArr) {
|        foreach ($ch in (Get-SIValueList (Get-SIItemValue $c.Record 'si_child_resources'))) {
|            $chId = ([string](Get-SIItemValue $ch 'id')).Trim().ToLowerInvariant()
|            if (-not $chId -or -not $childSeen.Add($chId)) { continue }
|            $childLinks.Add([pscustomobject][ordered]@{
|                    provider = [string]$c.Provider; type = 'child_resource'; id = $chId; record_key = ''; primary = $false; state = [string]$c.State
|                    last_seen = (ConvertTo-SIUtcOrNull (Get-SIItemValue $c.Record 'si_source_last_seen')); resource_type = [string](Get-SIItemValue $ch 'type')
|                })
|        }
|    }
|    $linkArr = @($recordLinks) + @($childLinks.ToArray() | Sort-Object { $_.id })
|    $ci['si_linked_objects'] = $linkArr
|    $ci['si_link_count'] = $linkArr.Count
|    $linkField = @{ mde = 'si_link_mde'; entra = 'si_link_entra'; intune = 'si_link_intune'; azure = 'si_link_azure'; eg = 'si_link_eg'; ad = 'si_link_ad'; mdi = 'si_link_mdi'; shodan = 'si_link_shodan'; cmdb = 'si_link_cmdb'; servicenow = 'si_link_servicenow' }
|    foreach ($l in $recordLinks) { if ($l.primary -and $linkField.ContainsKey($l.provider)) { $ci[$linkField[$l.provider]] = $l.id } }
|    # THE LIFECYCLE (V3-DATA-MODEL 2.5.5, #406 -- SI-CiLifecycle.ps1, one mechanism with the CMDB sync) follows the CI's own
|    # records (a child link carries its parent record's state): active when any link is active; not seen within the grace
|    # period of the CI's category; retired after it, or at once when every link is gone; a CI whose only current links are
|    # frozen keeps what it was. The evidence is on the CI: since when, how many days not seen, and why.
|    $life = Get-SICiLifecycle -Links $recordLinks -Category (Get-SICiRetireCategory -Ci $ci -Links $recordLinks) -Settings $Lifecycle -Now $Now -Previous $Previous
|    $ci['si_lifecycle'] = [string]$life.Lifecycle
|    # (ISO text, seconds: the same text on every host and in the stored document, so "since" never changes a CI by itself)
|    if ($null -ne $life.Since) { $ci['si_lifecycle_since'] = ([datetime]$life.Since).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture) }
|    if ($life.Reason) { $ci['si_lifecycle_reason'] = [string]$life.Reason }
|    if ($life.Lifecycle -ne 'active' -and $null -ne $life.NotSeenDays) { $ci['si_not_seen_days'] = [int]$life.NotSeenDays }
|    # #642 A CLOUD RESOURCE'S LAST SEEN. Azure Resource Graph has no "last seen" of a resource (data-model/mappings/azure has no
|    # si_last_seen) and the exposure graph gives one only for some nodes, so sidata.Ci.LastSeen stayed empty for every cloud
|    # CI (found at a ring 1 install 2026-10-13). A resource is seen when its source lists it: the newest source time of its
|    # current (active / frozen) records -- else of any record. Only for cloud resources: an identity or a device keeps the
|    # last-seen its source reports (a sign-in, a check-in), never the collection time, or an account that never signs in would
|    # look active.
|    if ($class -eq 'cloud_resource' -and -not ($ci.Contains('si_last_seen') -and $ci['si_last_seen'])) {
|        $pick = $null; $pickT = $null; $pickCur = $false
|        foreach ($c in $candArr) {
|            $st = ConvertTo-SIUtcOrNull (Get-SIItemValue $c.Record 'si_source_last_seen')
|            if ($null -eq $st) { continue }
|            $cur = ([string]$c.State -in 'active', 'frozen')
|            if ($null -eq $pick -or ($cur -and -not $pickCur) -or ($cur -eq $pickCur -and $st -gt $pickT)) { $pick = $c; $pickT = $st; $pickCur = $cur }
|        }
|        if ($null -ne $pick) {
|            $ci['si_last_seen'] = $pickT
|            $resolvedSources['si_last_seen'] = [ordered]@{ provider = [string]$pick.Provider; record = [string]$pick.Key; observed_at = $pickT; stale = (-not $pickCur); from = 'listed_by_source' }
|        }
|    }
|    if ($ci.Contains('si_last_seen') -and $ci['si_last_seen']) {
|        $ls = ConvertTo-SIUtcOrNull $ci['si_last_seen']
|        if ($ls) { $ci['si_days_inactive'] = [int][Math]::Floor(($Now - $ls).TotalDays) }
|    }
|    $ci['si_field_sources'] = $resolvedSources
|    return $ci
|}
'@ }
$__siSupportFiles['engine/data-model/SI-FieldResolution.ps1'] = @{ Sha256 = '7322f94eb50e97deb3f3f8da3e1ed213814a5eaadf7967d4ae5ebed72683b8b5'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight SOURCE OF TRUTH BY PROVIDER TIMESTAMPS -- REQUIREMENTS #459, V3-DATA-MODEL 2.6.
|
|    Resolve-SICiField (SI-CiBuild.ps1) picks each SI field's value on the CI: fresh candidates only (the record's provider
|    timestamp -- the mapping object's 'timestamp', si_source_last_seen -- within the field's staleDays), then the first
|    provider in the field's authority order; no fresh candidate -> the newest value, marked stale; risk booleans any-true;
|    lists union. The winner is recorded in si_field_sources {provider, record, observed_at, stale}.
|
|    This file adds what 2.6 asks for beyond the winner: CONFLICTS. When other FRESH providers hold a different value for a
|    single-value (authority) field, they are recorded beside the winner (si_field_sources.<field>.conflicts), so a
|    disagreement is visible on the CI page instead of silently lost -- "AD still says 10.0.0.5, Defender says 10.0.4.17".
|    It never changes the value.
|
|    Each provider's "last updated" field (the mapping object's timestamp; a missing value = the collection time):
|      mde     machine.lastSeen                          (sensor heartbeat)
|      entra   device.approximateLastSignInDateTime      (devices; users and service principals: the directory read)
|      intune  device.lastSyncDateTime
|      eg      node.NodeProperties.rawData.lastSeen
|      ad      lastLogonTimestamp                        (replicates with a 9-14 day lag)
|      mdi     identity.Timestamp
|      azure   the collection time                       (Resource Graph has no last seen)
|      shodan  host.last_update
|      cmdb    ci.UpdatedAt;  servicenow  ci.sys_updated_on
|    Get-SIProviderTimestampFields reads them from the mappings (the mappings are the one source).
|
|    PURE. PowerShell 5.1: no ?. / ??, no ternary.
|#>
|
|if (-not (Get-Command -Name Get-SIItemValue -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-Conditions.ps1') }
|
|$script:SIFieldConflictMax = 5
|
|function Get-SIProviderTimestampFields {
|    <# PURE. Per provider and record type: the source path of its "last updated" timestamp ('$collection_time' = none). #>
|    param([Parameter(Mandatory)]$Model)
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($p in $Model.Mappings.Keys) {
|        foreach ($o in @($Model.Mappings[$p].objects)) {
|            if ($null -eq $o) { continue }
|            $out.Add([pscustomobject]@{ Provider = [string]$p; RecordType = [string]$o.recordType; Timestamp = [string]$o.timestamp })
|        }
|    }
|    return $out.ToArray()   # unrolled: foreach and @() both read it as the list
|}
|
|function ConvertTo-SIFieldCompareText {
|    <# PURE. A value as comparable text: trimmed, case-insensitive; a list as its sorted, de-duplicated items. #>
|    param($Value)
|    if ($null -eq $Value) { return '' }
|    if ($Value -is [bool]) { return ([string]$Value).ToLowerInvariant() }
|    if ($Value -is [datetime]) { return $Value.ToUniversalTime().ToString('o') }
|    if ($Value -is [string]) { return $Value.Trim().ToLowerInvariant() }
|    if ($Value -is [System.Collections.IEnumerable] -and -not ($Value -is [System.Collections.IDictionary])) {
|        $xs = [string[]]@(foreach ($x in $Value) { ConvertTo-SIFieldCompareText $x } )
|        $xs = [string[]]@($xs | Where-Object { $_ } | Select-Object -Unique)
|        [Array]::Sort($xs, [StringComparer]::Ordinal)
|        return ($xs -join '|')
|    }
|    if ($Value -is [ValueType]) { return ([string]::Format([Globalization.CultureInfo]::InvariantCulture, '{0}', $Value)).ToLowerInvariant() }
|    return (($Value | ConvertTo-Json -Compress -Depth 6)).ToLowerInvariant()
|}
|
|function Get-SICiFieldConflicts {
|    <#
|    .SYNOPSIS  PURE. The fresh candidates of a single-value (authority) field that disagree with the resolved value.
|    .PARAMETER Candidates  as Resolve-SICiField takes them: @{ Record; Provider; Key; State }
|    .PARAMETER Resolved    Resolve-SICiField's result (@{ Value; Provider; Record; Stale })
|    .OUTPUTS   [ [ordered]@{ provider; record; value; observed_at } ] -- at most 5, freshest first; empty when the field
|               is not an authority field, the value is stale (nothing fresh to disagree with) or every source agrees.
|    #>
|    param([Parameter(Mandatory)]$Field, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Candidates, $Resolved, [datetime]$Now = [datetime]::UtcNow)
|    $out = New-Object System.Collections.Generic.List[object]
|    if ($null -eq $Resolved -or [bool]$Resolved.Stale) { return , $out.ToArray() }
|    if ([string]$Field.resolution.policy -ne 'authority') { return , $out.ToArray() }
|    $staleDays = 30
|    if ($null -ne $Field.resolution.staleDays) { $staleDays = [double]$Field.resolution.staleDays }
|    # (2026-10-16: the winner's text is made only when another candidate has to be compared with it -- most CIs have one
|    # record, and this runs for every field of every CI)
|    $other = $false
|    foreach ($c in $Candidates) { if ($null -ne $c -and [string]$c.Key -ne [string]$Resolved.Record) { $other = $true; break } }
|    if (-not $other) { return , $out.ToArray() }
|    $win = ConvertTo-SIFieldCompareText $Resolved.Value
|    $seenText = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::Ordinal)
|    $rows = New-Object System.Collections.Generic.List[object]
|    foreach ($c in $Candidates) {
|        if ($null -eq $c -or [string]$c.Key -eq [string]$Resolved.Record) { continue }
|        $v = Get-SIItemValue $c.Record ([string]$Field.name)
|        if (Test-SIValueEmpty $v) { if (-not ($v -is [bool])) { continue } }
|        $seen = ConvertTo-SIUtcOrNull (Get-SIItemValue $c.Record 'si_source_last_seen')
|        $fresh = ($c.State -in 'active', 'frozen') -and ($null -ne $seen) -and ((($Now - $seen).TotalDays) -le $staleDays)
|        if (-not $fresh) { continue }
|        $t = ConvertTo-SIFieldCompareText $v
|        if ($t -eq $win) { continue }
|        $rows.Add([pscustomobject]@{ Seen = $seen; Text = $t; Entry = [ordered]@{ provider = [string]$c.Provider; record = [string]$c.Key; value = $v; observed_at = $seen } })
|    }
|    foreach ($r in @($rows.ToArray() | Sort-Object -Property @{ Expression = { $_.Seen }; Descending = $true })) {
|        if ($out.Count -ge $script:SIFieldConflictMax) { break }
|        if (-not $seenText.Add(('{0}|{1}' -f $r.Entry.provider, $r.Text))) { continue }
|        $out.Add($r.Entry)
|    }
|    return , $out.ToArray()
|}
'@ }
$__siSupportFiles['engine/data-model/SI-CiLifecycle.ps1'] = @{ Sha256 = '69bd83af6a1b63a7789761c22b020f3032c232a4d528287a81e834bb043a7fd4'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THE ASSET LIFECYCLE, ONE MECHANISM (V3-DATA-MODEL 2.5.5, REQUIREMENTS #406, 60.5.0c / 60.5.0d).
|
|    Owner 2026-10-06, verbatim: "14 day is not sufficient and auto-close graceperiod must be in the settings. for example a
|    person on summer vacation for 5 weeks will then be closed as his laptop is turned off after 14 days (wrong). ... default
|    auto close value should be 30 days but with option to override in the categories i listed".
|    Owner 2026-10-19: "we have already defined the lifecycle in the docs for design, read the req there. read also the code
|    of the actual impl." -- the core CI now carries the lifecycle the CMDB sync had alone.
|
|    The PURE parts both users share -- the CI build (SI-CiBuild.ps1, every edition) and the CMDB sync's asset lifecycle
|    (engine\asset-cmdb\_shared\SI-AssetLifecycle.ps1, Pro): the categories and their grace periods (the settings), the
|    seen window, the state LastSeen alone gives, a CI's category, and the CI lifecycle decision over its linked objects.
|
|    PER LINKED OBJECT (decided by Get-SIRecordLinkState, SI-CiBuild.ps1):
|        active    listed in its feed's newest collection, and -- a DEVICE record, whose source keeps listing a machine it has
|                  not heard from (Defender lists inactive devices) -- its source saw it within the seen window
|        not_seen  missing from a COMPLETE newer collection, or listed but its source has not seen it within the seen window
|        gone      POSITIVE evidence: offboarded
|        frozen    the newer collection was partial, or the provider's collection scope changed since the record was last
|                  listed (60.5.0d: an asset that leaves because we stopped looking has told us nothing) -- nothing changes
|    PER CI (Get-SICiLifecycle):
|        active    any link active
|        not_seen  no link active, newest last seen within the grace period of the CI's category
|        retired   beyond the grace period, or at once when EVERY link is gone; stays retired until a link is active again
|        reactivated (a transition, not a state): active again after not_seen / retired -- the reason says so
|        a CI whose only current links are frozen is active (absence proves nothing); one already retired stays retired
|    PowerShell 5.1: no ?. / ??, no ternary. No Set-StrictMode.
|#>
|
|$script:SIAssetRetireCategorySettings = [ordered]@{
|    'client-pc'         = 'SI_Pro_AssetRetire_GraceDays_ClientPc'
|    'server'            = 'SI_Pro_AssetRetire_GraceDays_Server'
|    'service-principal' = 'SI_Pro_AssetRetire_GraceDays_ServicePrincipal'
|    'user'              = 'SI_Pro_AssetRetire_GraceDays_User'
|    'azure-vm'          = 'SI_Pro_AssetRetire_GraceDays_AzureVm'
|    'azure-resource'    = 'SI_Pro_AssetRetire_GraceDays_AzureResource'
|}
|
|# a source whose own "last seen" lags by design (V3-DATA-MODEL 2.6): Entra updates approximateLastSignInDateTime at most every
|# ~14 days, AD replicates lastLogonTimestamp with a 9-14 day lag -- a device record of theirs is stale only past that lag
|$script:SICiProviderSeenLagDays = @{ entra = 14; ad = 14 }
|
|# =====================================================================================================================
|#  SETTINGS AND CATEGORIES -- pure
|# =====================================================================================================================
|function Resolve-SIAssetRetireSettings {
|    <#
|        PURE. The grace periods from a name -> value map (the live globals):
|          SI_Pro_AssetRetire_GraceDays                 default 30 -- every category without its own value, and 'other'
|          SI_Pro_AssetRetire_GraceDays_<Category>      a category's own value (ClientPc, Server, ServicePrincipal, User, AzureVm, AzureResource)
|          SI_Pro_CmdbSql_SeenWithinDays                default 8 -- seen this recently = active
|          SI_Cmdb_RetireAfterDays                      default 7 -- the CI retire brake (owner 2026-10-11): the floor of every grace period
|        A grace period shorter than the seen window would retire an asset the moment it is "not seen": it is raised to the
|        seen window (or SI_Cmdb_RetireAfterDays when that is longer) and the warning says so. A value that is not a whole
|        number uses the default and says so.
|        Returns @{ DefaultDays; Days (category -> days, 'other' included); SeenWithinDays; RetireAfterDays; Warnings }.
|    #>
|    param([hashtable]$Globals = @{})
|    if ($null -eq $Globals) { $Globals = @{} }
|    $warn = New-Object System.Collections.Generic.List[string]
|    $int = {
|        param([string]$name, [int]$default, [int]$min)
|        if (-not $Globals.ContainsKey($name) -or $null -eq $Globals[$name] -or "$($Globals[$name])".Trim() -eq '') { return $default }
|        $n = 0
|        if (-not [int]::TryParse("$($Globals[$name])".Trim(), [Globalization.NumberStyles]::Integer, [Globalization.CultureInfo]::InvariantCulture, [ref]$n)) {
|            $warn.Add(("{0} = '{1}' is not a whole number of days -- using {2}." -f $name, "$($Globals[$name])", $default)); return $default
|        }
|        if ($n -lt $min) { $warn.Add(("{0} = {1} is shorter than the minimum of {2} day(s) (the seen window, never under SI_Cmdb_RetireAfterDays) -- using {2}." -f $name, $n, $min)); return $min }
|        $n
|    }
|    $seen = & $int 'SI_Pro_CmdbSql_SeenWithinDays' 8 1
|    # the CI retire brake (owner 2026-10-11): no grace period is shorter than SI_Cmdb_RetireAfterDays (default 7), whatever the
|    # seen window -- an asset is never retired before it has been unseen that long
|    $retireDays = & $int 'SI_Cmdb_RetireAfterDays' 7 1
|    $floor = [Math]::Max($seen, $retireDays)
|    $def = [Math]::Max((& $int 'SI_Pro_AssetRetire_GraceDays' 30 $floor), $floor)
|    $days = [ordered]@{}
|    foreach ($c in @($script:SIAssetRetireCategorySettings.Keys)) { $days[$c] = & $int ([string]$script:SIAssetRetireCategorySettings[$c]) $def $floor }
|    $days['other'] = $def
|    [pscustomobject]@{ DefaultDays = $def; Days = $days; SeenWithinDays = $seen; RetireAfterDays = $retireDays; Warnings = $warn.ToArray() }
|}
|
|function Get-SICiLifecycleSettings {
|    <#
|        The lifecycle settings as they are in force: Resolve-SIAssetRetireSettings over the live globals (the Pro settings
|        store loads them; an edition without them gets the defaults: seen within 8 days, every grace period 30 days).
|        -Globals: a name -> value map instead (tests).
|    #>
|    param([hashtable]$Globals)
|    if ($null -eq $Globals) {
|        $Globals = @{}
|        $names = @('SI_Pro_CmdbSql_SeenWithinDays', 'SI_Cmdb_RetireAfterDays', 'SI_Pro_AssetRetire_GraceDays') + @($script:SIAssetRetireCategorySettings.Values)
|        foreach ($n in $names) { $v = Get-Variable -Scope Global -Name $n -ValueOnly -ErrorAction SilentlyContinue; if ($null -ne $v) { $Globals[$n] = $v } }
|    }
|    Resolve-SIAssetRetireSettings -Globals $Globals
|}
|
|function Get-SIAssetRetireCategory {
|    <#
|        PURE. The retire category of one CI from what the hand-off knows of it: its kind (endpoint | azure | identity), class
|        hint, proposed ServiceNow class and ARM id. An Azure VM is an azure-vm whichever profile describes it (Defender's
|        record of a VM comes first in the hand-off). Unknown = 'other' (the default grace period).
|    #>
|    param([AllowEmptyString()][string]$Kind = '', [AllowEmptyString()][string]$ClassHint = '', [AllowEmptyString()][string]$ProposedClass = '',
|          [AllowEmptyString()][string]$AzureResourceId = '')
|    $k = ([string]$Kind).Trim().ToLowerInvariant(); $h = ([string]$ClassHint).Trim().ToLowerInvariant(); $pc = ([string]$ProposedClass).Trim().ToLowerInvariant()
|    $arm = ([string]$AzureResourceId).Trim().ToLowerInvariant()
|    if ($pc -eq 'cmdb_ci_vm_instance' -or $arm -match '/providers/microsoft\.compute/virtualmachines(scalesets)?/') { return 'azure-vm' }
|    if ($pc -eq 'u_cmdb_ci_entra_user') { return 'user' }
|    if ($pc -eq 'u_cmdb_ci_entra_service_principal') { return 'service-principal' }
|    if ($h -eq 'identity' -or $k -eq 'identity') { return 'other' }
|    if ($pc -in 'cmdb_ci_win_server', 'cmdb_ci_linux_server', 'cmdb_ci_server') { return 'server' }
|    if ($h -eq 'azure-resource' -or $k -eq 'azure') { return 'azure-resource' }
|    if ($pc -eq 'cmdb_ci_computer' -or $h -eq 'device' -or $k -eq 'endpoint') { return 'client-pc' }
|    'other'
|}
|
|function Get-SIAssetLifecycleTarget {
|    <# PURE. The state LastSeen alone gives: active (within the seen window) | not-seen (within the grace) | retired. #>
|    param([Parameter(Mandatory)][datetime]$LastSeen, [Parameter(Mandatory)][datetime]$Now, [int]$SeenWithinDays = 8, [int]$GraceDays = 30)
|    $age = ($Now.ToUniversalTime() - $LastSeen.ToUniversalTime()).TotalDays
|    if ($age -le $SeenWithinDays) { return 'active' }
|    if ($age -le $GraceDays) { return 'not-seen' }
|    'retired'
|}
|
|function Get-SILifecycleValue {
|    <# PURE. A named value of a dictionary or an object ($null when it has none). #>
|    param($Item, [string]$Name)
|    if ($null -eq $Item) { return $null }
|    if ($Item -is [System.Collections.IDictionary]) { if ($Item.Contains($Name)) { return $Item[$Name] }; return $null }
|    $p = $Item.PSObject.Properties[$Name]; if ($p) { return $p.Value }
|    $null
|}
|
|function Get-SICiRetireCategory {
|    <#
|        PURE. The retire category of a CORE CI (the same categories and the same Get-SIAssetRetireCategory decision the CMDB
|        sync uses), from its class, its fields and its linked objects:
|          an Azure virtual machine (scale set) link       azure-vm  (also when Defender describes it)
|          a device whose OS is a server OS, or an Arc one server    -- any other device: client-pc
|          an identity with a service principal link       service-principal  -- with a user link: user
|          a cloud resource with an Azure link             azure-resource     -- anything else: other
|    #>
|    param([Parameter(Mandatory)]$Ci, [AllowEmptyCollection()][object[]]$Links = @())
|    $class = [string](Get-SILifecycleValue $Ci 'si_class')
|    $arm = ''
|    foreach ($l in @($Links)) {
|        if ($null -eq $l) { continue }
|        $id = [string](Get-SILifecycleValue $l 'id')
|        if ([string](Get-SILifecycleValue $l 'provider') -in 'azure', 'mdc' -and $id -match '^/subscriptions/') {
|            if (-not $arm -or $id -match '/providers/microsoft\.compute/virtualmachines(scalesets)?/') { $arm = $id }
|        }
|    }
|    switch ($class) {
|        'device' {
|            $os = ('{0} {1} {2}' -f (Get-SILifecycleValue $Ci 'si_os_name'), (Get-SILifecycleValue $Ci 'si_os_platform'), (Get-SILifecycleValue $Ci 'si_device_category')).ToLowerInvariant()
|            $pc = 'cmdb_ci_computer'
|            if ($os -match 'server' -or [string](Get-SILifecycleValue $Ci 'si_arc_status')) { $pc = 'cmdb_ci_server' }
|            return (Get-SIAssetRetireCategory -Kind 'endpoint' -ClassHint 'device' -ProposedClass $pc -AzureResourceId $arm)
|        }
|        'identity' {
|            $types = @(foreach ($l in @($Links)) { if ($l) { [string](Get-SILifecycleValue $l 'type') } })
|            if ($types -contains 'service_principal') { return (Get-SIAssetRetireCategory -Kind 'identity' -ProposedClass 'u_cmdb_ci_entra_service_principal') }
|            if ($types -contains 'user') { return (Get-SIAssetRetireCategory -Kind 'identity' -ProposedClass 'u_cmdb_ci_entra_user') }
|            return 'other'
|        }
|        'cloud_resource' {
|            if ($arm) { return (Get-SIAssetRetireCategory -Kind 'azure' -ClassHint 'azure-resource' -AzureResourceId $arm) }
|            return 'other'
|        }
|        default { return 'other' }
|    }
|}
|
|function Get-SIRecordSeenWindowDays {
|    <#
|        PURE. How long a record may go without its source seeing it before its link is not_seen, or 0 when the record's
|        listing alone decides: only a DEVICE record carries a source heartbeat that its source keeps listing past (Defender
|        lists a machine it has not heard from for months). An identity listed by Entra exists (a dormant account is a risk
|        to report, never an asset to retire), and a cloud resource listed by Azure Resource Graph exists (ARM existence).
|        A source whose last seen lags by design gets that lag (Entra devices, AD computers: 14 days).
|    #>
|    param($Record, [int]$SeenWithinDays = 8)
|    if ($SeenWithinDays -le 0 -or $null -eq $Record) { return 0 }
|    # EXPOSURE GRAPH AGES OUT (owner 2026-11-05, "ci object must be the stable id"): an Exposure Graph record of ANY class
|    # gets the seen window. Exposure Graph keeps LISTING nodes long after the asset is gone (a ring 1 install, 2026-11-05: a
|    # VM's old node ids stayed in ExposureGraphNodes for weeks; 13 CIs were kept active by Exposure Graph alone, unseen
|    # 14+ days). Listed is not "exists" for Exposure Graph -- its node's own observation time is the evidence:
|    # si_source_last_seen = the mapping's timestamp node.NodeProperties.rawData.lastSeen (eg.locked.json). On a VM node
|    # (azure_resource) it is the asset's observation (the stale node of mail-host-03 carried 2026-10-06 while still listed
|    # on 2026-11-03); on a device node it follows Exposure Graph's own refresh (2026-11-03 on every listed device), which is
|    # why an Exposure Graph link never decides a CI that another source links (Get-SICiLifecycle). Azure Resource Graph
|    # (provider azure) keeps "listed = exists".
|    # NOT an identity: a dormant account is a risk to report, never an asset to retire (the design's identity rule) -- an
|    # account Exposure Graph alone lists keeps 'listed = exists'
|    if ([string](Get-SILifecycleValue $Record 'si_provider') -eq 'eg' -and [string](Get-SILifecycleValue $Record 'si_class') -ne 'identity') { return $SeenWithinDays }
|    if ([string](Get-SILifecycleValue $Record 'si_class') -ne 'device') { return 0 }
|    $lag = $script:SICiProviderSeenLagDays[[string](Get-SILifecycleValue $Record 'si_provider')]
|    if ($lag -and [int]$lag -gt $SeenWithinDays) { return [int]$lag }
|    $SeenWithinDays
|}
|
|function Get-SICiSeenThresholdDays {
|    <# PURE. Every day count a CI's lifecycle can cross with time alone (the seen windows, every grace period) -- the CI build's time thresholds. #>
|    param([Parameter(Mandatory)]$Settings)
|    $out = New-Object System.Collections.Generic.List[int]
|    $add = { param([int]$d) if ($d -gt 0 -and -not $out.Contains($d)) { $out.Add($d) } }
|    & $add ([int]$Settings.SeenWithinDays)
|    foreach ($v in @($script:SICiProviderSeenLagDays.Values)) { & $add ([Math]::Max([int]$v, [int]$Settings.SeenWithinDays)) }
|    foreach ($k in @($Settings.Days.Keys)) { & $add ([int]$Settings.Days[$k]) }
|    & $add ([int]$Settings.DefaultDays)
|    $arr = $out.ToArray(); [Array]::Sort($arr); $arr
|}
|
|# =====================================================================================================================
|#  THE COLLECTION SCOPE (60.5.0d) -- pure
|# =====================================================================================================================
|# the settings that narrow what a provider LISTS (a change of one makes assets vanish from a complete run)
|$script:SICiCollectionScopeSettings = [ordered]@{
|    azure  = @('SI_AzSubscriptionId', 'SI_AzureExcludeTypes', 'SI_AzureSubscriptionExcludePatterns')
|    mdc    = @('SI_AzSubscriptionId', 'SI_AzureExcludeTypes', 'SI_AzureSubscriptionExcludePatterns')
|    entra  = @('SI_IncludeFirstPartySpns', 'SI_DisabledAssets_Collect')
|    mde    = @('SI_DisabledAssets_Collect')
|    intune = @('SI_DisabledAssets_Collect')
|    ad     = @('SI_DisabledAssets_Collect')
|    eg     = @('SI_DisabledAssets_Collect')
|    mdi    = @('SI_DisabledAssets_Collect')
|}
|
|function Get-SICiCollectionScope {
|    <#
|        PURE. The effective collection scope per provider: provider -> a hash of the scope settings' values (name=value, in
|        order; a list joined). -Globals: name -> value (default: the live globals).
|    #>
|    param([hashtable]$Globals)
|    $out = [ordered]@{}
|    $sha = [System.Security.Cryptography.SHA256]::Create()
|    try {
|        foreach ($p in @($script:SICiCollectionScopeSettings.Keys)) {
|            $parts = foreach ($n in @($script:SICiCollectionScopeSettings[$p])) {
|                $v = $null
|                if ($null -ne $Globals) { if ($Globals.ContainsKey($n)) { $v = $Globals[$n] } }
|                else { $v = Get-Variable -Scope Global -Name $n -ValueOnly -ErrorAction SilentlyContinue }
|                $t = if ($null -eq $v) { '' } elseif ($v -is [string]) { $v.Trim() } elseif ($v -is [System.Collections.IEnumerable]) { (@($v) | ForEach-Object { ([string]$_).Trim() } | Sort-Object) -join ',' } else { ([string]$v).Trim() }
|                '{0}={1}' -f $n, $t
|            }
|            $bytes = [System.Text.Encoding]::UTF8.GetBytes((@($parts) -join "`n"))
|            $out[$p] = ([BitConverter]::ToString($sha.ComputeHash($bytes)) -replace '-', '').ToLowerInvariant()
|        }
|    } finally { $sha.Dispose() }
|    $out
|}
|
|function Update-SICiScopeChanges {
|    <#
|        PURE. The collection scope compared with the one the last build recorded: provider -> the time its scope last changed.
|        -Stored: the recorded state (provider -> @{ h; at }); -Current: Get-SICiCollectionScope; -Now. A provider seen for the
|        first time records its scope (nothing changed). Returns @{ State (provider -> @{ h; at }, to record); ChangedAt
|        (provider -> datetime, every provider whose scope ever changed); Changed (the providers that changed in THIS build) }.
|    #>
|    param([hashtable]$Stored = @{}, [Parameter(Mandatory)]$Current, [datetime]$Now = [datetime]::UtcNow)
|    if ($null -eq $Stored) { $Stored = @{} }
|    $state = [ordered]@{}; $at = @{}; $chg = New-Object System.Collections.Generic.List[string]
|    foreach ($p in @($Current.Keys)) {
|        $h = [string]$Current[$p]
|        $prev = $Stored[$p]
|        $ph = [string](Get-SILifecycleValue $prev 'h'); $pa = Get-SILifecycleValue $prev 'at'
|        $paT = $null
|        if ($pa -is [datetime]) { $paT = ([datetime]$pa).ToUniversalTime() } elseif ($pa) { $d = [datetime]::MinValue; if ([datetime]::TryParse([string]$pa, [Globalization.CultureInfo]::InvariantCulture, ([Globalization.DateTimeStyles]::AssumeUniversal -bor [Globalization.DateTimeStyles]::AdjustToUniversal), [ref]$d)) { $paT = $d } }
|        if (-not $ph) { $state[$p] = [ordered]@{ h = $h; at = $(if ($paT) { $paT.ToString('o') } else { '' }) } }
|        elseif ($ph -ne $h) { $state[$p] = [ordered]@{ h = $h; at = $Now.ToUniversalTime().ToString('o') }; $chg.Add($p); $paT = $Now.ToUniversalTime() }
|        else { $state[$p] = [ordered]@{ h = $h; at = $(if ($paT) { $paT.ToString('o') } else { '' }) } }
|        if ($paT) { $at[$p] = $paT }
|    }
|    [pscustomobject]@{ State = $state; ChangedAt = $at; Changed = $chg.ToArray() }
|}
|
|# =====================================================================================================================
|#  THE CI LIFECYCLE -- pure
|# =====================================================================================================================
|function Get-SICiLifecycle {
|    <#
|        PURE. A CI's lifecycle from its linked objects (the record links: provider, type, state, last_seen, reason).
|          -Category  Get-SICiRetireCategory      -Settings  Get-SICiLifecycleSettings      -Now  the build's time
|          -Previous  what the CI was after the last build: @{ Lifecycle; Since; Reason } (none = a first build)
|        Returns @{ Lifecycle (active | not_seen | retired); Since; NotSeenDays; Reason; Change ('' | not_seen | retired |
|        reactivated | held); LastSeen; GraceDays; Category }.
|          Since    active: when it became active (kept from the last build while it stays active) -- not_seen: the last time
|                   any source saw it -- retired: when its grace period ran out, or when the last link was gone
|          Reason   the evidence, in words (dates only, so it changes only with the state)
|    #>
|    param([AllowEmptyCollection()][object[]]$Links = @(), [string]$Category = 'other', [Parameter(Mandatory)]$Settings,
|          [datetime]$Now = [datetime]::UtcNow, $Previous)
|    $now = $Now.ToUniversalTime()
|    $cat = if ($Category) { $Category } else { 'other' }
|    $grace = [int]$Settings.DefaultDays; if ($Settings.Days.Contains($cat)) { $grace = [int]$Settings.Days[$cat] }
|    $prevState = [string](Get-SILifecycleValue $Previous 'Lifecycle')
|    $prevSince = Get-SILifecycleValue $Previous 'Since'
|    if ($prevSince -and -not ($prevSince -is [datetime])) { $d = [datetime]::MinValue; if ([datetime]::TryParse([string]$prevSince, [Globalization.CultureInfo]::InvariantCulture, ([Globalization.DateTimeStyles]::AssumeUniversal -bor [Globalization.DateTimeStyles]::AdjustToUniversal), [ref]$d)) { $prevSince = $d } else { $prevSince = $null } }
|    $prevReason = [string](Get-SILifecycleValue $Previous 'Reason')
|    $active = New-Object System.Collections.Generic.List[object]; $frozen = New-Object System.Collections.Generic.List[object]
|    $notSeen = New-Object System.Collections.Generic.List[object]; $gone = New-Object System.Collections.Generic.List[object]
|    # EXPOSURE GRAPH NEVER OUTVOTES THE SOURCE IT MIRRORS (owner 2026-11-05): Exposure Graph re-lists what Defender, Azure
|    # and Entra hold, and on a device node its last seen is its own refresh time -- at a ring 1 install its links kept 202
|    # stale devices (Azure resource nodes) and 122 (device nodes) active after their own source had stopped seeing them.
|    # When the CI links any other source, the Exposure Graph links are left out of the decision; a CI that ONLY Exposure
|    # Graph links is decided by Exposure Graph, with the seen window on its node's own observation time
|    # (Get-SIRecordSeenWindowDays) -- not seen after the window, retired after its grace period. Absence is never
|    # remediation: a not seen / retired CI's findings are never counted as fixed (unchanged).
|    # (another source = one that observes the asset itself: a CMDB record says what the CMDB holds, not that the asset exists)
|    $hasOther = $false
|    foreach ($l in @($Links)) { if ($null -ne $l -and [string](Get-SILifecycleValue $l 'provider') -notin 'eg', 'cmdb', 'servicenow') { $hasOther = $true; break } }
|    foreach ($l in @($Links)) {
|        if ($null -eq $l) { continue }
|        if ($hasOther -and [string](Get-SILifecycleValue $l 'provider') -eq 'eg') { continue }
|        switch ([string](Get-SILifecycleValue $l 'state')) { 'active' { $active.Add($l) } 'frozen' { $frozen.Add($l) } 'gone' { $gone.Add($l) } default { $notSeen.Add($l) } }
|    }
|    $newest = {
|        param($xs)
|        $best = $null
|        foreach ($x in $xs) { $t = Get-SILifecycleValue $x 'last_seen'; if ($t -is [datetime] -and ($null -eq $best -or $t -gt $best)) { $best = ([datetime]$t).ToUniversalTime() } }
|        $best
|    }
|    $fmt = { param($d) ([datetime]$d).ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture) }
|    $names = { param($xs) (@(foreach ($x in $xs) { [string](Get-SILifecycleValue $x 'provider') }) | Select-Object -Unique) -join ', ' }
|    $res = [ordered]@{ Lifecycle = 'active'; Since = $null; NotSeenDays = $null; Reason = ''; Change = ''; LastSeen = $null; GraceDays = $grace; Category = $cat }
|    if ($active.Count -gt 0) {
|        $last = & $newest $active
|        $res.LastSeen = $last
|        if ($prevState -eq 'active' -and $prevSince) { $res.Since = $prevSince; $res.Reason = $prevReason }
|        elseif ($prevState -in 'not_seen', 'retired') {
|            $res.Since = $now; $res.Change = 'reactivated'
|            $res.Reason = ('reactivated: seen again by {0}{1} after it was {2}' -f (& $names $active), $(if ($last) { ' on ' + (& $fmt $last) } else { '' }), ($prevState -replace '_', ' '))
|        } else {
|            $res.Since = $(if ($prevSince -and $prevState -eq 'active') { $prevSince } else { $now })
|            $res.Reason = ('seen by {0}' -f (& $names $active))
|        }
|        if (-not $res.Reason) { $res.Reason = ('seen by {0}' -f (& $names $active)) }
|        return [pscustomobject]$res
|    }
|    if ($frozen.Count -gt 0) {
|        # ABSENCE PROVES NOTHING: a link whose newest collection was partial (the source is on its last GOOD collection, which
|        # listed it), or whose provider's scope changed, counts as listed -- the CI is active, never moved to not seen or
|        # retired by it; only a CI already retired stays retired until a source sees it again
|        $why = @(foreach ($f in $frozen) { $r = [string](Get-SILifecycleValue $f 'reason'); if ($r) { $r } }) | Select-Object -Unique
|        $res.LastSeen = & $newest ($frozen.ToArray() + $notSeen.ToArray())
|        $res.Change = 'held'
|        if ($prevState -eq 'retired') { $res.Lifecycle = 'retired'; $res.Since = $prevSince; $res.Reason = $prevReason }
|        elseif ($prevState -eq 'active') { $res.Lifecycle = 'active'; $res.Since = $prevSince; $res.Reason = $prevReason }
|        else { $res.Lifecycle = 'active'; $res.Since = $now; $res.Reason = '' }
|        if ($null -eq $res.Since) { $res.Since = $now }
|        $held = ('held: {0} -- {1}' -f (& $names $frozen), $(if (@($why).Count) { @($why) -join '; ' } else { 'its newest collection was incomplete' }))
|        if (-not $res.Reason) { $res.Reason = $held } elseif ($res.Reason -notmatch '^held: ') { $res.Reason = $res.Reason + ' (' + $held + ')' } else { $res.Reason = $held }
|        if ($res.Lifecycle -ne 'active' -and $res.LastSeen) { $res.NotSeenDays = [int][Math]::Floor(($now - $res.LastSeen).TotalDays) }
|        return [pscustomobject]$res
|    }
|    # #1057 PROOF OF DELETION WINS over the not-seen / grace-period window (owner 2026-11-02): no link active or held, and a
|    # source proved its object deleted (a gone link with 'deleted') -- retired at once, "deleted in <source>"
|    $deleted = @($gone | Where-Object { [string](Get-SILifecycleValue $_ 'deleted') })
|    if ($deleted.Count -gt 0) {
|        $res.Lifecycle = 'retired'; $res.LastSeen = & $newest ($gone.ToArray() + $notSeen.ToArray())
|        $res.Since = $(if ($prevState -eq 'retired' -and $prevSince) { $prevSince } else { $now })
|        $srcs = (@(foreach ($x in $deleted) { [string](Get-SILifecycleValue $x 'deleted') }) | Select-Object -Unique) -join ', '
|        $res.Reason = ('retired at once: deleted in {0} ({1} -- {2})' -f $srcs, (& $names $deleted), [string](Get-SILifecycleValue $deleted[0] 'reason'))
|        if ($prevState -ne 'retired') { $res.Change = 'retired' } elseif ($prevReason) { $res.Reason = $prevReason }
|        if ($res.LastSeen) { $res.NotSeenDays = [int][Math]::Floor(($now - $res.LastSeen).TotalDays) }
|        return [pscustomobject]$res
|    }
|    if ($notSeen.Count -eq 0) {
|        # every link is gone (positive evidence): retired at once
|        $res.Lifecycle = 'retired'; $res.LastSeen = & $newest $gone
|        $res.Since = $(if ($prevState -eq 'retired' -and $prevSince) { $prevSince } else { $now })
|        $res.Reason = ('retired at once: every linked object is gone ({0} -- {1})' -f (& $names $gone), $(@(foreach ($g in $gone) { $r = [string](Get-SILifecycleValue $g 'reason'); if ($r) { $r } }) | Select-Object -Unique | Select-Object -First 1))
|        if ($res.Reason -match ' -- \)$') { $res.Reason = $res.Reason -replace ' -- \)$', ')' }
|        if ($prevState -ne 'retired') { $res.Change = 'retired' } elseif ($prevReason) { $res.Reason = $prevReason }
|        if ($res.LastSeen) { $res.NotSeenDays = [int][Math]::Floor(($now - $res.LastSeen).TotalDays) }
|        return [pscustomobject]$res
|    }
|    # not seen: the newest sighting of any link that is not gone decides, against the category's grace period
|    $last = & $newest $notSeen
|    $res.LastSeen = $last
|    if ($null -eq $last) {
|        $res.Lifecycle = $(if ($prevState -eq 'retired') { 'retired' } else { 'not_seen' })
|        $res.Since = $(if ($prevSince) { $prevSince } else { $now })
|        $res.Reason = $(if ($prevReason -and $prevState -eq $res.Lifecycle) { $prevReason } else { 'not seen: no source reports when it last saw it' })
|        if ($prevState -ne $res.Lifecycle) { $res.Change = $res.Lifecycle }
|        return [pscustomobject]$res
|    }
|    $res.NotSeenDays = [int][Math]::Floor(($now - $last).TotalDays)
|    $target = Get-SIAssetLifecycleTarget -LastSeen $last -Now $now -SeenWithinDays ([int]$Settings.SeenWithinDays) -GraceDays $grace
|    $stale = @(foreach ($x in $notSeen) { $r = [string](Get-SILifecycleValue $x 'reason'); if ($r) { $r } }) | Select-Object -Unique | Select-Object -First 2
|    $evidence = $(if (@($stale).Count) { ' (' + (@($stale) -join '; ') + ')' } else { '' })
|    if ($target -eq 'retired' -or $prevState -eq 'retired') {
|        $res.Lifecycle = 'retired'
|        if ($prevState -eq 'retired' -and $prevSince) { $res.Since = $prevSince; $res.Reason = $prevReason }
|        else {
|            $res.Since = $last.AddDays($grace); if ($res.Since -gt $now) { $res.Since = $now }
|            $res.Reason = ('retired: not seen since {0}, longer than the {1}-day grace period of a {2}{3}' -f (& $fmt $last), $grace, $cat, $evidence)
|        }
|        if (-not $res.Reason) { $res.Reason = ('retired: not seen since {0}, longer than the {1}-day grace period of a {2}{3}' -f (& $fmt $last), $grace, $cat, $evidence) }
|        if ($prevState -ne 'retired') { $res.Change = 'retired' }
|        return [pscustomobject]$res
|    }
|    $res.Lifecycle = 'not_seen'; $res.Since = $last
|    $res.Reason = ('not seen since {0} -- retired on {1} unless it is seen again ({2}-day grace period of a {3}){4}' -f (& $fmt $last), (& $fmt ($last.AddDays($grace))), $grace, $cat, $evidence)
|    if ($prevState -ne 'not_seen') { $res.Change = 'not_seen' }
|    [pscustomobject]$res
|}
|
|function Get-SICiLifecycleDefinitions {
|    <#
|        PURE. The lifecycle in plain words, from the settings in force -- what every page and report says it shows (owner
|        2026-10-19: "assumptions and filters should be transparent rgr lifecycle"). The web app has the same text
|        (SI.Management.Core.ProData.CiLifecycleDefinitions); the test keeps the two the same.
|    #>
|    param([Parameter(Mandatory)]$Settings)
|    $s = [int]$Settings.SeenWithinDays; $d = [int]$Settings.DefaultDays
|    [ordered]@{
|        active      = ('Active: at least one source lists the asset and -- for a device -- saw it within the last {0} days (Entra and Active Directory devices: 14 days, their last sign-in lags by design).' -f $s)
|        not_seen    = ('Not seen: no source has seen the asset for more than {0} days; it stays in its grace period (default {1} days, per category) before it is retired.' -f $s, $d)
|        retired     = 'Retired: not seen for longer than the grace period of its category, or every source gave positive evidence it is gone (offboarded). Its findings close as asset retired -- also those a source still reports -- never as fixed, and do not count as open; nothing is deleted.'
|        reactivated = 'Reactivated: a not seen or retired asset that a source sees again is active again, and the change is recorded.'
|    }
|}
'@ }
$__siSupportFiles['engine/asset-profiling/shared/SI-IdentityScopeChoice.ps1'] = @{ Sha256 = '1d1fcd21463e57ac0e58b6e43f45fcc08e084d34750a5f3930263dd38a743e54'; Text = @'
|#Requires -Version 5.1
|<#
|    A CUSTOMER'S CHOICE: WHICH EXPOSURE GRAPH IDENTITIES BECOME ASSETS (REQUIREMENTS #1056, owner approved 2026-11-01).
|
|    Three per-install switches. Each one's default is its Default in $script:SIIdentityScopeSettings below, the same value as
|    its default in config\settings.catalog.locked.json and launcher\_lib\SecurityInsight.shared-defaults.ps1 (the two
|    older ones ON -- an install turns one off to keep these objects as assets; SI_Identity_SkipNeverSyncedAd OFF, owner
|    2026-11-08 -- an install with very many never-synced AD accounts turns it on):
|      SI_Identity_SkipNeverSyncedAd          (owner 2026-11-08)  an on-premises AD account the Exposure Graph lists but that
|                                             was never synced to Entra ID (the node has no Entra object id) becomes an asset
|                                             only while it is PRIVILEGED -- whatever its enabled state (the graph often lists
|                                             such an account with its name only, and no enabled state). A non-privileged one
|                                             gets no record and no CI; it is counted. A user node that is NOT an on-premises
|                                             AD account (Test-SIEgIsAdAccount: no domain SID, no account name + domain) is
|                                             never left out by it. It is the wider form of the next switch: while it is on, it
|                                             decides the never-synced AD accounts and the next one decides nothing.
|      SI_Identity_SkipNeverSyncedDisabledAd  (customer choice "1C")  an on-premises AD account the Exposure Graph lists but
|                                             that was never synced to Entra ID (the node has no Entra object id) becomes an
|                                             asset only while it is ENABLED or PRIVILEGED. A disabled, non-privileged one gets
|                                             no record and no CI; it is counted. Applies only while SI_Identity_SkipNeverSyncedAd
|                                             is off (Get-SIIdentityNeverSyncedSetting).
|      SI_Identity_SkipDeletedGroups          (customer choice "2B")  a group node WITH an Entra object id becomes an asset
|                                             only while Entra ID still has the group (active, or in its deleted items). A
|                                             group Entra no longer returns at all gets no record and no CI; it is counted.
|    Real users, groups, devices and findings are not affected: an account synced to Entra (it has an Entra object id), an
|    AD-only group, a device, a service principal and every finding are never touched by any switch.
|
|    THE STAGES
|      collection   the Exposure Graph identity read (IdentityRoleFetcher.ps1) asks Get-SIEgIdentityScopeDecision for every
|                   Exposure Graph user / group node it would record; a node left out is not recorded (no record part, no
|                   full-metadata copy). The index that enriches the Entra objects is unchanged.
|                   The never-synced switch that applies (SI_Identity_SkipNeverSyncedAd, or SI_Identity_SkipNeverSyncedDisabledAd
|                   while the first is off) is ALSO applied in the hunting query itself
|                   (Get-SIEgNeverSyncedSkipKql): the user nodes the decision could only leave out are not fetched and do
|                   not count toward the buckets; the count probe counts them (NotFetched) and they join the left-out count.
|                   Every test in the query leans the safe way, so the decision after the read still sees -- and keeps --
|                   every node it would keep. A group Entra ID no longer has is decided after the read (it needs Entra's list).
|      run report   one plain line per switch in the identity step's log (Format-SIIdentityScopeLine) and one row per switch
|                   and run in sidata.CollectionLeftOut (Write-SIIdentityScopeCounts) -- the Data health page shows them.
|      asset drop   the collection's asset-drop check adds the records a switch left out this run back to the count it
|                   judges (Get-SIIdentityScopeLeftOutByFeed), so a customer's choice is never read as a broken source.
|      CI build     a CI whose Exposure Graph record a switch now leaves out RETIRES with a reason naming the switch -- the
|                   record's link is 'gone' (Get-SIRecordLeftOutByIdentityChoice, SI-CiBuild.ps1 Get-SIRecordLink), never
|                   a silent vanish and never a 30-day "not seen" wait. Switched off again, the next collection records the
|                   node again and the CI is reactivated.
|
|    THE SIGNALS (all already in SecurityInsight)
|      never synced  the node has no Entra object id (the identity read found none in EntityIds or rawData) --
|                    only AD ids (SecurityIdentifier / ActiveDirectoryObjectGuid)
|      AD account    a domain SID (S-1-5-21-...) in EntityIds or rawData, or an account name AND an account domain in rawData
|                    (Test-SIEgIsAdAccount; the query's _siIsAd)
|      disabled      rawData accountEnabled / isEnabled / enabled = false, or userAccountControl carries ACCOUNTDISABLE (the
|                    flag name, or bit 0x2 of the number). Unknown = NOT disabled: nothing is left out on a guess
|                    (the rule of SI-DisabledAssets.ps1)
|      privileged    any of: adminCount > 0 (AD's protected-account marker), a nested critical AD group
|                    (nestedCriticalAdGroups), membership of a tier 0 / tier 1 AD group of the privilege tier catalog
|                    (nestedAdGroupNames), an assigned role (assignedRoles), a service account (hasServicePrincipalName /
|                    isServiceAccount -- SI's service-account signal), a sensitive account (isSensitive), or a Microsoft
|                    criticality level (criticalityLevel)
|      group exists  its Entra object id is in Entra ID's groups or deleted groups (Read-SIEntraGroupIds: one paged read of
|                    /groups and /directory/deletedItems/microsoft.graph.group, ids only). A read that is not complete
|                    decides nothing: no group with an Entra id is recorded that run and the Exposure Graph pull is marked
|                    not complete, so nothing is retired and nothing comes back (absence proves nothing).
|
|    PURE functions except Read-SIEntraGroupIds (Graph, behind -Fetch), Write-SIIdentityScopeCounts and
|    Get-SIIdentityScopeLeftOutByFeed (SQL, behind -Invoke). PowerShell 5.1 and 7: no ?. / ??, no ternary.
|    Tests: tests\pester\SIv3-IdentityScopeChoice.Tests.ps1.
|#>
|
|# Default = the shipped default (config\settings.catalog.locked.json, launcher\_lib\SecurityInsight.shared-defaults.ps1):
|# used when the global is unset -- a container that never stored the setting runs as the catalog says (the two older
|# switches ON, SI_Identity_SkipNeverSyncedAd OFF). A stored value (true or false) is kept. (The container also applies every catalog default at start; this keeps the rule where the code reads it,
|# the pattern of SI-DisabledAssets.ps1.)
|$script:SIIdentityScopeSettings = [ordered]@{
|    SkipNeverSyncedAd         = @{ Setting = 'SI_Identity_SkipNeverSyncedAd';         Default = $false }
|    SkipNeverSyncedDisabledAd = @{ Setting = 'SI_Identity_SkipNeverSyncedDisabledAd'; Default = $true }
|    SkipDeletedGroups         = @{ Setting = 'SI_Identity_SkipDeletedGroups';         Default = $true }
|}
|
|function ConvertTo-SIIdentityScopeFlag {
|    <# PURE. $true / $false / $null from a bool, 'true' / 'false', 1 / 0. Anything else is unknown ($null). #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [bool]) { return $Value }
|    if ($Value -is [int] -or $Value -is [long]) { if ($Value -eq 1) { return $true }; if ($Value -eq 0) { return $false }; return $null }
|    $s = ([string]$Value).Trim()
|    if ($s -ieq 'true' -or $s -eq '1' -or $s -ieq 'on' -or $s -ieq 'yes') { return $true }
|    if ($s -ieq 'false' -or $s -eq '0' -or $s -ieq 'off' -or $s -ieq 'no') { return $false }
|    return $null
|}
|
|function Get-SIIdentityScopeChoice {
|    <#
|        PURE (reads the three globals unless -Values is passed). The install's choice:
|        @{ SkipNeverSyncedAd; SkipNeverSyncedDisabledAd; SkipDeletedGroups; Any }. Not set (or not readable as yes / no) =
|        each switch's shipped default (the two older ON, SI_Identity_SkipNeverSyncedAd OFF); a clear no (false, 0, off) =
|        OFF, a clear yes = ON. Which never-synced switch decides:
|        Get-SIIdentityNeverSyncedSetting.
|    #>
|    param([hashtable]$Values)
|    $out = [ordered]@{}
|    foreach ($k in $script:SIIdentityScopeSettings.Keys) {
|        $name = $script:SIIdentityScopeSettings[$k].Setting
|        $raw = $null
|        if ($Values) { if ($Values.ContainsKey($name)) { $raw = $Values[$name] } elseif ($Values.ContainsKey($k)) { $raw = $Values[$k] } }
|        else { $raw = Get-Variable -Name $name -Scope Global -ValueOnly -ErrorAction SilentlyContinue }
|        $flag = ConvertTo-SIIdentityScopeFlag $raw
|        $out[$k] = if ($null -eq $flag) { [bool]$script:SIIdentityScopeSettings[$k].Default } else { [bool]$flag }
|    }
|    $out['Any'] = [bool]($out.SkipNeverSyncedAd -or $out.SkipNeverSyncedDisabledAd -or $out.SkipDeletedGroups)
|    [pscustomobject]$out
|}
|
|function Get-SIIdentityNeverSyncedSetting {
|    <#
|        PURE. The ONE switch that decides the never-synced on-premises AD accounts under -Choice (Get-SIIdentityScopeChoice):
|        'SI_Identity_SkipNeverSyncedAd' while it is on (it is the wider form), else 'SI_Identity_SkipNeverSyncedDisabledAd'
|        while that is on, else '' (none: every never-synced AD account is kept, as before either switch existed).
|        A choice made before the wider switch existed (no SkipNeverSyncedAd property) reads it as off.
|    #>
|    param($Choice)
|    if ($null -eq $Choice) { return '' }
|    $p = $Choice.PSObject.Properties['SkipNeverSyncedAd']
|    if ($p -and [bool]$p.Value) { return $script:SIIdentityScopeSettings.SkipNeverSyncedAd.Setting }
|    $p = $Choice.PSObject.Properties['SkipNeverSyncedDisabledAd']
|    if ($p -and [bool]$p.Value) { return $script:SIIdentityScopeSettings.SkipNeverSyncedDisabledAd.Setting }
|    return ''
|}
|
|function Get-SIIdentityScopeValue {
|    <# PURE. A named value of a dictionary or an object (case-insensitive), $null when it has none. #>
|    param([AllowNull()]$Bag, [string]$Name)
|    if ($null -eq $Bag) { return $null }
|    if ($Bag -is [System.Collections.IDictionary]) {
|        foreach ($k in $Bag.Keys) { if ([string]$k -ieq $Name) { return $Bag[$k] } }
|        return $null
|    }
|    $p = $Bag.PSObject.Properties[$Name]
|    if ($p) { return $p.Value }
|    return $null
|}
|
|function Get-SIIdentityScopeList {
|    <# PURE. A value as a list of non-empty items: an array, a comma / semicolon list in one text, a JSON array in text. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return @() }
|    if ($Value -is [string]) {
|        $t = $Value.Trim()
|        if (-not $t) { return @() }
|        if ($t.StartsWith('[')) { try { return @(@($t | ConvertFrom-Json) | Where-Object { $null -ne $_ -and "$_".Trim() }) } catch { } }
|        return @($t -split '[,;]' | ForEach-Object { $_.Trim() } | Where-Object { $_ })
|    }
|    if ($Value -is [System.Collections.IEnumerable] -and -not ($Value -is [System.Collections.IDictionary])) {
|        return @(@($Value) | Where-Object { $null -ne $_ -and "$_".Trim() })
|    }
|    return @($Value)
|}
|
|function Test-SIEgAdAccountDisabled {
|    <#
|        PURE. Does an Exposure Graph node's rawData SAY the account is disabled? $true, $false, or $null (it says nothing).
|        accountEnabled / isEnabled / enabled = false -> disabled; userAccountControl with ACCOUNTDISABLE (the flag name, or
|        bit 0x2 of the number) -> disabled. A DISABLED answer from any field wins; unknown is never disabled.
|    #>
|    param([AllowNull()]$RawData)
|    if ($null -eq $RawData) { return $null }
|    $sawEnabled = $false
|    foreach ($k in 'accountEnabled', 'isEnabled', 'enabled') {
|        $f = ConvertTo-SIIdentityScopeFlag (Get-SIIdentityScopeValue $RawData $k)
|        if ($f -eq $false) { return $true }
|        if ($f -eq $true) { $sawEnabled = $true }
|    }
|    $uac = Get-SIIdentityScopeValue $RawData 'userAccountControl'
|    if ($null -ne $uac) {
|        foreach ($v in (Get-SIIdentityScopeList $uac)) {
|            $s = ([string]$v).Trim()
|            if (-not $s) { continue }
|            $n = 0L
|            if ([long]::TryParse($s, [ref]$n)) { if ($n -band 2) { return $true }; $sawEnabled = $true; continue }
|            if ($s -match '^(?i)(AccountDisabled|ACCOUNTDISABLE|Account_Disabled|Disabled)$') { return $true }
|            $sawEnabled = $true   # a flag list without the disable flag says the account is enabled
|        }
|    }
|    if ($sawEnabled) { return $false }
|    return $null
|}
|
|function Test-SIEgIsAdAccount {
|    <#
|        PURE. Is an Exposure Graph node an on-premises AD account? The same test as the query's _siIsAd
|        (Get-SIEgNeverSyncedSkipKql): a domain SID (S-1-5-21-...) -- -Sid (the SID the identity read resolved from EntityIds
|        or rawData) or one of rawData's SID fields -- or an account name AND an account domain in rawData (both non-empty
|        text). Field names without case. Anything else (another identity provider, a node with no AD sign) = $false: a
|        switch about AD accounts never leaves it out.
|    #>
|    param([AllowNull()]$RawData, [AllowNull()][AllowEmptyString()][string]$Sid)
|    if ($Sid -and $Sid.Trim() -match '^(?i)s-1-5-21-') { return $true }
|    if ($null -eq $RawData) { return $false }
|    foreach ($k in 'adSid', 'accountSid', 'onPremSid', 'onPremisesSecurityIdentifier', 'securityIdentifier', 'sid') {
|        $v = Get-SIIdentityScopeValue $RawData $k
|        if ($v -is [string] -and $v.Trim() -match '^(?i)s-1-5-21-') { return $true }
|    }
|    $n = Get-SIIdentityScopeValue $RawData 'accountName'
|    $d = Get-SIIdentityScopeValue $RawData 'accountDomain'
|    if ($n -is [string] -and $n.Length -gt 0 -and $d -is [string] -and $d.Length -gt 0) { return $true }
|    return $false
|}
|
|function Get-SIIdentityCriticalAdGroupNames {
|    <#
|        The privilege tier catalog's tier 0 and tier 1 AD groups (Domain Admins, Enterprise Admins, Schema Admins, Account
|        Operators, Backup Operators ...) as a case-insensitive set: the shipped catalog plus the tenant's own catalog
|        (privilege-tier-catalog.custom.json) when it is there. -SIRoot: the solution folder. Never throws: a catalog that
|        cannot be read adds nothing (the other privilege signals still hold).
|    #>
|    param([string]$SIRoot)
|    $set = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    if (-not $SIRoot) { $SIRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) }
|    $dir = [IO.Path]::Combine($SIRoot, 'privilege-tier-catalog')
|    foreach ($file in @('privilege-tier-catalog.locked.json', 'privilege-tier-catalog.custom.json')) {
|        $p = [IO.Path]::Combine($dir, $file)
|        if (-not [IO.File]::Exists($p)) { continue }
|        try {
|            $doc = [IO.File]::ReadAllText($p) | ConvertFrom-Json
|            foreach ($sec in 'AD_BuiltInPermissionGroups_Tier0', 'AD_BuiltInPermissionGroups_Tier1', 'AD_CustomGroups_Tier0', 'AD_CustomGroups_Tier1') {
|                foreach ($e in @(Get-SIIdentityScopeValue $doc $sec)) {
|                    if ($null -eq $e) { continue }
|                    $n = [string](Get-SIIdentityScopeValue $e 'Name')
|                    if ($n -and $n.Trim()) { [void]$set.Add($n.Trim()) }
|                }
|            }
|        } catch { Write-Warning ('identity scope choice: the privilege tier catalog {0} could not be read -- {1}' -f $file, $_.Exception.Message) }
|    }
|    , $set
|}
|
|function Get-SIEgAdPrivilege {
|    <#
|        PURE. Is the account behind an Exposure Graph node privileged? @{ IsPrivileged; Why (the signals that said so) }.
|        -CriticalGroups: Get-SIIdentityCriticalAdGroupNames (names compared without case).
|    #>
|    param([AllowNull()]$RawData, [AllowNull()]$CriticalGroups)
|    $why = New-Object System.Collections.Generic.List[string]
|    if ($null -ne $RawData) {
|        $ac = 0; if ([int]::TryParse([string](Get-SIIdentityScopeValue $RawData 'adminCount'), [ref]$ac) -and $ac -gt 0) { $why.Add('admin count') }
|        # nestedCriticalAdGroups: the graph writes a dictionary { type, data: [ ... ] } (eg.locked.json #690 (29)); a plain list is read too
|        $crit = Get-SIIdentityScopeValue $RawData 'nestedCriticalAdGroups'
|        $critItems = @()
|        if ($null -ne $crit) {
|            $data = $null
|            if ($crit -is [System.Collections.IDictionary] -or $crit -is [System.Management.Automation.PSCustomObject]) { $data = Get-SIIdentityScopeValue $crit 'data' }
|            if ($null -ne $data) { $critItems = @(Get-SIIdentityScopeList $data) }
|            elseif (-not ($crit -is [System.Management.Automation.PSCustomObject]) -and -not ($crit -is [System.Collections.IDictionary])) { $critItems = @(Get-SIIdentityScopeList $crit) }
|        }
|        if ($critItems.Count -gt 0) { $why.Add('critical AD group') }
|        if ($null -ne $CriticalGroups -and $CriticalGroups.Count -gt 0) {
|            foreach ($g in (Get-SIIdentityScopeList (Get-SIIdentityScopeValue $RawData 'nestedAdGroupNames'))) {
|                $gn = ([string]$g).Trim()
|                if ($gn -and $CriticalGroups.Contains($gn)) { $why.Add('tier 0/1 AD group ' + $gn); break }
|            }
|        }
|        if (@(Get-SIIdentityScopeList (Get-SIIdentityScopeValue $RawData 'assignedRoles')).Count -gt 0) { $why.Add('assigned role') }
|        foreach ($k in 'hasServicePrincipalName', 'isServiceAccount') {
|            if ((ConvertTo-SIIdentityScopeFlag (Get-SIIdentityScopeValue $RawData $k)) -eq $true) { $why.Add('service account'); break }
|        }
|        if ((ConvertTo-SIIdentityScopeFlag (Get-SIIdentityScopeValue $RawData 'isSensitive')) -eq $true) { $why.Add('sensitive account') }
|        $cl = Get-SIIdentityScopeValue $RawData 'criticalityLevel'
|        if ($null -ne $cl) {
|            $lvl = $cl
|            if ($cl -is [System.Collections.IDictionary] -or $cl -is [System.Management.Automation.PSCustomObject]) { $lvl = Get-SIIdentityScopeValue $cl 'criticalityLevel' }
|            if ($null -ne $lvl -and "$lvl".Trim() -ne '') { $why.Add('Microsoft criticality level') }
|        }
|    }
|    [pscustomobject]@{ IsPrivileged = ($why.Count -gt 0); Why = $why.ToArray() }
|}
|
|function Get-SIEgNeverSyncedSkipKql {
|    <#
|        PURE. SI_Identity_SkipNeverSyncedDisabledAd IN THE HUNTING QUERY ITSELF: the KQL steps (to put after
|        "ExposureGraphNodes | where NodeLabel == 'user'") that set the column _siSkip -- true for a user node the Exposure
|        Graph read would only fetch to leave out (an on-premises AD account never synced to Entra ID, disabled and not
|        privileged). The read asks only for the nodes where _siSkip is false and counts the others; the decision after the
|        read (Get-SIEgIdentityScopeDecision) still runs on every node that is fetched.
|        NEVER LEAVES OUT A NODE SI KEEPS: every test leans the safe way --
|          rawData        only a node whose NodeProperties.rawData is an object (the object the decision reads) is ever skipped
|          never synced   ANY mention of AadObjectId in EntityIds, or a GUID in any of the rawData fields the read takes an
|                         Entra object id from, counts as synced (the read itself needs more to find one)
|          disabled       only what the decision reads as disabled for certain: accountEnabled / isEnabled / enabled false
|                         (false, 0, off, no), userAccountControl as a number with bit 0x2, or with the ACCOUNTDISABLE flag
|                         name as a list item; anything else is not disabled
|          privileged     ANY sign of a privilege signal: an admin count with a digit 1-9, nestedCriticalAdGroups that is not
|                         plainly empty, a tier 0/1 group name of the privilege tier catalog anywhere in nestedAdGroupNames,
|                         assignedRoles that is not plainly empty, a service-account or sensitive flag that is not plainly
|                         false, a criticality level with any value
|          AD identity    (so the count is the same count the decision makes) a domain SID, or an account name and domain
|        Field names are compared without case (the rawData text is lower-cased once). -CriticalGroups:
|        Get-SIIdentityCriticalAdGroupNames. A catalog name with characters outside letters, digits, space, '.', '_', '-'
|        cannot be matched safely in the text: then any non-empty nestedAdGroupNames counts as privileged.
|        -AnyEnabledState: SI_Identity_SkipNeverSyncedAd (the wider switch) -- the skip leaves out the enabled state:
|        _siSkip = isnotnull(_siRl) and not(_siHasOid) and _siIsAd and not(_siPriv). Every other test is the same, and
|        still leans the safe way (the AD identity test is what keeps a node of another identity provider).
|    #>
|    param([AllowNull()]$CriticalGroups, [switch]$AnyEnabledState)
|    $names = New-Object System.Collections.Generic.List[string]
|    $unsafeName = $false
|    foreach ($g in @($CriticalGroups)) {
|        if ($null -eq $g) { continue }
|        $n = ([string]$g).Trim().ToLowerInvariant()
|        if (-not $n) { continue }
|        if ($n -cmatch '^[a-z0-9]([a-z0-9 _.\-]*[a-z0-9])?$') { $names.Add($n.Replace('.', '\.')) } else { $unsafeName = $true }
|    }
|    $groupTest = 'false'
|    if ($unsafeName) { $groupTest = 'not(tostring(_siRl.nestedadgroupnames) in ("", "[]"))' }
|    elseif ($names.Count -gt 0) {
|        # a name as a whole item: what is before and after it is not a letter or digit (a quote, a comma, a space, an escape)
|        $groupTest = 'tostring(_siRl.nestedadgroupnames) matches regex @"(^|[^a-z0-9]|\\u[0-9a-f]{4})(' + ($names -join '|') + ')($|[^a-z0-9])"'
|    }
|    $flagNotFalse = { param($f) ('not(trim(@"\s+", tostring(_siRl.{0})) in ("", "false", "0", "off", "no"))' -f $f) }
|    $flagFalse = { param($f) ('trim(@"\s+", tostring(_siRl.{0})) in ("false", "0", "off", "no")' -f $f) }
|    $guid = '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
|    $sidKeys = @('adsid', 'accountsid', 'onpremsid', 'onpremisessecurityidentifier', 'securityidentifier', 'sid')
|    $rawSid = 'case(' + ((@($sidKeys | ForEach-Object { 'tostring(_siRl.{0}) matches regex @"^s-1-[0-9]", tostring(_siRl.{0})' -f $_ })) -join ', ') + ', "")'
|    $oidText = 'strcat(' + ((@('aadid', 'accountobjectid', 'objectid', 'aadobjectid', 'groupid', 'principalid', 'userid', 'id') | ForEach-Object { 'tostring(_siRl.{0})' -f $_ }) -join ', " ", ') + ')'
|    $uac = '_siRl.useraccountcontrol'
|    $uacNames = '"accountdisabled", "accountdisable", "account_disabled", "disabled"'
|    $parts = @(
|        '| extend _siIds = tolower(tostring(EntityIds)), _siRd = NodeProperties.rawData'
|        '| extend _siRl = iff(gettype(_siRd) == "dictionary" and not(_siIds contains "aadobjectid"), todynamic(tolower(tostring(_siRd))), dynamic(null))'
|        ('| extend _siHasOid = _siIds contains "aadobjectid" or {0} matches regex @"{1}"' -f $oidText, $guid)
|        ('| extend _siSid = coalesce(extract(@"securityidentifier[^}}]*?(s-1-[0-9-]+)", 1, _siIds), {0})' -f $rawSid)
|        '| extend _siIsAd = _siSid startswith "s-1-5-21-" or (gettype(_siRl.accountname) == "string" and isnotempty(tostring(_siRl.accountname)) and gettype(_siRl.accountdomain) == "string" and isnotempty(tostring(_siRl.accountdomain)))'
|    )
|    if (-not $AnyEnabledState) {
|        $parts += @(
|        ('| extend _siUacT = gettype({0}), _siUacS = trim(@"\s+", tostring({0}))' -f $uac)
|        ('| extend _siDisabled = {0} or {1} or {2}' -f (& $flagFalse 'accountenabled'), (& $flagFalse 'isenabled'), (& $flagFalse 'enabled')) +
|            (' or (_siUacT in ("long", "int") and binary_and(tolong({0}), 2) == 2)' -f $uac) +
|            ' or (_siUacT == "string" and _siUacS matches regex @"^[0-9]+$" and binary_and(tolong(_siUacS), 2) == 2)' +
|            (' or (_siUacT == "array" and array_length(set_intersect({0}, dynamic([{1}]))) > 0)' -f $uac, $uacNames) +
|            ' or (_siUacT == "string" and not(_siUacS startswith "[") and _siUacS matches regex @"(^|[,;])\s*(accountdisabled|accountdisable|account_disabled|disabled)\s*($|[,;])")'
|        )
|    }
|    $parts += @(
|        ('| extend _siPriv = tostring(_siRl.admincount) matches regex @"[1-9]"' +
|            ' or not(tostring(_siRl.nestedcriticaladgroups) in ("", "[]", "{}") or (gettype(_siRl.nestedcriticaladgroups) == "dictionary" and gettype(_siRl.nestedcriticaladgroups.data) == "array" and array_length(_siRl.nestedcriticaladgroups.data) == 0))' +
|            (' or {0}' -f $groupTest) +
|            ' or not(tostring(_siRl.assignedroles) in ("", "[]"))' +
|            (' or {0} or {1} or {2}' -f (& $flagNotFalse 'hasserviceprincipalname'), (& $flagNotFalse 'isserviceaccount'), (& $flagNotFalse 'issensitive')) +
|            ' or iff(gettype(_siRl.criticalitylevel) == "dictionary", isnotempty(tostring(_siRl.criticalitylevel.criticalitylevel)), isnotempty(tostring(_siRl.criticalitylevel))))')
|    )
|    if ($AnyEnabledState) { $parts += '| extend _siSkip = isnotnull(_siRl) and not(_siHasOid) and _siIsAd and not(_siPriv)' }
|    else { $parts += '| extend _siSkip = isnotnull(_siRl) and not(_siHasOid) and _siIsAd and _siDisabled and not(_siPriv)' }
|    ($parts -join ' ')
|}
|
|function Get-SIEgIdentityScopeDecision {
|    <#
|        PURE. Does one Exposure Graph identity node become a record (an asset) under the install's choice?
|          -NodeLabel     user | group | serviceprincipal | managedidentity
|          -AadObjectId   the Entra object id the identity read found ('' = never synced)
|          -RawData       the node's rawData
|          -Choice        Get-SIIdentityScopeChoice
|          -EntraGroups   the ids Entra ID returns (Read-SIEntraGroupIds .Ids); $null = not read
|          -GroupsUnknown the Entra group read was asked for and is NOT complete
|          -CriticalGroups Get-SIIdentityCriticalAdGroupNames
|          -Sid           the SID the identity read resolved (EntityIds or rawData), '' = none
|        Returns @{ Keep; Setting (the switch that left it out, ''); Why; Held ($true = left out this run only because the
|        Entra group read was not complete) }.
|        A never-synced user is decided by ONE switch (Get-SIIdentityNeverSyncedSetting): SI_Identity_SkipNeverSyncedAd while
|        it is on (kept when it is not an AD account, or privileged -- whatever its enabled state), else
|        SI_Identity_SkipNeverSyncedDisabledAd (kept when it is not disabled for certain, or privileged).
|    #>
|    param([AllowEmptyString()][string]$NodeLabel = '', [AllowEmptyString()][string]$AadObjectId = '', [AllowNull()]$RawData,
|          [Parameter(Mandatory)]$Choice, [AllowNull()]$EntraGroups, [switch]$GroupsUnknown, [AllowNull()]$CriticalGroups,
|          [AllowNull()][AllowEmptyString()][string]$Sid = '')
|    $keep = [pscustomobject]@{ Keep = $true; Setting = ''; Why = ''; Held = $false }
|    if (-not $Choice -or -not $Choice.Any) { return $keep }
|    $label = ([string]$NodeLabel).Trim().ToLowerInvariant()
|    $oid = ([string]$AadObjectId).Trim().ToLowerInvariant()
|    $neverSynced = Get-SIIdentityNeverSyncedSetting -Choice $Choice
|    if ($label -eq 'user' -and -not $oid -and $neverSynced -eq $script:SIIdentityScopeSettings.SkipNeverSyncedAd.Setting) {
|        if (-not (Test-SIEgIsAdAccount -RawData $RawData -Sid $Sid)) { return $keep }
|        $priv = Get-SIEgAdPrivilege -RawData $RawData -CriticalGroups $CriticalGroups
|        if ($priv.IsPrivileged) { return $keep }
|        return [pscustomobject]@{ Keep = $false; Setting = $neverSynced; Why = 'an on-premises AD account never synced to Entra ID and not privileged'; Held = $false }
|    }
|    if ($label -eq 'user' -and -not $oid -and $neverSynced -eq $script:SIIdentityScopeSettings.SkipNeverSyncedDisabledAd.Setting) {
|        if ((Test-SIEgAdAccountDisabled -RawData $RawData) -ne $true) { return $keep }
|        $priv = Get-SIEgAdPrivilege -RawData $RawData -CriticalGroups $CriticalGroups
|        if ($priv.IsPrivileged) { return $keep }
|        return [pscustomobject]@{ Keep = $false; Setting = $script:SIIdentityScopeSettings.SkipNeverSyncedDisabledAd.Setting; Why = 'an on-premises AD account never synced to Entra ID, disabled and not privileged'; Held = $false }
|    }
|    if ($label -eq 'group' -and $oid -and $Choice.SkipDeletedGroups) {
|        if ($GroupsUnknown) {
|            return [pscustomobject]@{ Keep = $false; Setting = $script:SIIdentityScopeSettings.SkipDeletedGroups.Setting; Why = 'the Entra ID group read was not complete this run -- the group keeps its last state'; Held = $true }
|        }
|        if ($null -eq $EntraGroups) { return $keep }
|        if ($EntraGroups.Contains($oid)) { return $keep }
|        return [pscustomobject]@{ Keep = $false; Setting = $script:SIIdentityScopeSettings.SkipDeletedGroups.Setting; Why = 'a group Entra ID no longer has (neither active nor in its deleted items)'; Held = $false }
|    }
|    return $keep
|}
|
|function Read-SIEntraGroupIds {
|    <#
|        Every group id Entra ID has: active (/groups) and recently deleted (/directory/deletedItems/microsoft.graph.group),
|        ids only, page by page. Returns @{ Ok; Ids (HashSet, lower-case); Active; Deleted; Error }. Ok = $false when either
|        read failed: the caller then decides nothing about groups this run.
|        -Fetch: test seam { param($Url, $OnPage) } -- calls $OnPage with each page's rows; throws on a failed read.
|    #>
|    param([scriptblock]$Fetch)
|    $ids = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    $res = [ordered]@{ Ok = $false; Ids = $ids; Active = 0; Deleted = 0; Error = '' }
|    if (-not $Fetch) {
|        $Fetch = {
|            param($Url, $OnPage)
|            $tk = ''
|            if (Get-Command -Name Get-SIGraphToken -ErrorAction SilentlyContinue) { $tk = [string](Get-SIGraphToken -Resource Graph) }
|            if (-not $tk) { throw 'no Microsoft Graph token' }
|            $null = Invoke-SIGraphPaged -RelativeUrl $Url -Token $tk -OnPage $OnPage
|        }
|    }
|    $state = @{ Active = 0; Deleted = 0 }
|    try {
|        & $Fetch '/groups?$select=id&$top=999' { param($rows) foreach ($r in @($rows)) { $i = [string](Get-SIIdentityScopeValue $r 'id'); if ($i) { if ($ids.Add($i.Trim().ToLowerInvariant())) { $state.Active++ } } } }
|        & $Fetch '/directory/deletedItems/microsoft.graph.group?$select=id&$top=999' { param($rows) foreach ($r in @($rows)) { $i = [string](Get-SIIdentityScopeValue $r 'id'); if ($i) { if ($ids.Add($i.Trim().ToLowerInvariant())) { $state.Deleted++ } } } }
|        $res.Ok = $true
|    } catch {
|        $res.Error = [string]$_.Exception.Message
|    }
|    $res.Active = [int]$state.Active; $res.Deleted = [int]$state.Deleted
|    [pscustomobject]$res
|}
|
|function New-SIIdentityScopeCounter {
|    <# A counter per switch that decides this run: @{ <setting> = @{ LeftOut; Held; Kept; Applied; Detail } }. Of the two
|       never-synced switches only the one that decides (Get-SIIdentityNeverSyncedSetting) gets a counter. #>
|    param([Parameter(Mandatory)]$Choice)
|    $c = [ordered]@{}
|    $neverSynced = Get-SIIdentityNeverSyncedSetting -Choice $Choice
|    foreach ($k in $script:SIIdentityScopeSettings.Keys) {
|        if (-not $Choice.$k) { continue }
|        if (($k -in @('SkipNeverSyncedAd', 'SkipNeverSyncedDisabledAd')) -and ($script:SIIdentityScopeSettings[$k].Setting -ne $neverSynced)) { continue }
|        $c[$script:SIIdentityScopeSettings[$k].Setting] = [pscustomobject]@{ Setting = $script:SIIdentityScopeSettings[$k].Setting; Feed = 'eg|user'; LeftOut = 0L; Held = 0L; Kept = 0L; Applied = $true; Detail = ''; NotFetched = 0L }
|    }
|    $c
|}
|
|function Add-SIIdentityScopeCount {
|    <# Counts one node's decision on the counter (a left-out node, or a node the switch looked at and kept). #>
|    param([Parameter(Mandatory)]$Counter, [Parameter(Mandatory)]$Decision, [string]$KeptBy = '')
|    if (-not $Decision.Keep) {
|        $c = $Counter[[string]$Decision.Setting]
|        if ($null -eq $c) { return }
|        if ($Decision.Held) { $c.Held++ } else { $c.LeftOut++ }
|        return
|    }
|    if ($KeptBy) { $c = $Counter[$KeptBy]; if ($null -ne $c) { $c.Kept++ } }
|}
|
|function Format-SIIdentityScopeLine {
|    <# PURE. The one plain line the identity step logs per switch (customer-facing: the setting named, counts only). #>
|    param([Parameter(Mandatory)]$Count)
|    $n = '{0:N0}' -f [long]$Count.LeftOut
|    switch ([string]$Count.Setting) {
|        'SI_Identity_SkipNeverSyncedAd' {
|            # left out in the hunting query itself (Get-SIEgNeverSyncedSkipKql -AnyEnabledState): part of the count, never fetched
|            $nf = 0L; if ($Count.PSObject.Properties['NotFetched'] -and $null -ne $Count.NotFetched) { $nf = [long]$Count.NotFetched }
|            if ($nf -gt 0) {
|                return ('Exposure Graph identities: {0} on-premises AD account(s) never synced to Entra ID and not privileged got no asset (SI_Identity_SkipNeverSyncedAd is on): {1:N0} not fetched (left out in the Exposure Graph query itself), {2:N0} left out after the read; {3:N0} never-synced account(s) kept because they are privileged. Existing CIs of the accounts left out retire with that reason.' -f $n, $nf, ([long]$Count.LeftOut - $nf), [long]$Count.Kept)
|            }
|            return ('Exposure Graph identities: {0} on-premises AD account(s) never synced to Entra ID and not privileged got no asset (SI_Identity_SkipNeverSyncedAd is on); {1:N0} never-synced account(s) kept because they are privileged. Existing CIs of the accounts left out retire with that reason.' -f $n, [long]$Count.Kept)
|        }
|        'SI_Identity_SkipNeverSyncedDisabledAd' {
|            # left out in the hunting query itself (Get-SIEgNeverSyncedSkipKql): part of the count, never fetched
|            $nf = 0L; if ($Count.PSObject.Properties['NotFetched'] -and $null -ne $Count.NotFetched) { $nf = [long]$Count.NotFetched }
|            if ($nf -gt 0) {
|                return ('Exposure Graph identities: {0} on-premises AD account(s) never synced to Entra ID, disabled and not privileged, got no asset (SI_Identity_SkipNeverSyncedDisabledAd is on): {1:N0} not fetched (left out in the Exposure Graph query itself), {2:N0} left out after the read; {3:N0} never-synced account(s) kept because they are enabled or privileged. Existing CIs of the accounts left out retire with that reason.' -f $n, $nf, ([long]$Count.LeftOut - $nf), [long]$Count.Kept)
|            }
|            return ('Exposure Graph identities: {0} on-premises AD account(s) never synced to Entra ID, disabled and not privileged, got no asset (SI_Identity_SkipNeverSyncedDisabledAd is on); {1:N0} never-synced account(s) kept because they are enabled or privileged. Existing CIs of the accounts left out retire with that reason.' -f $n, [long]$Count.Kept)
|        }
|        'SI_Identity_SkipDeletedGroups' {
|            if (-not $Count.Applied) {
|                $why = 'no detail'; if ($Count.Detail) { $why = [string]$Count.Detail }
|                return ('Exposure Graph identities: SI_Identity_SkipDeletedGroups is on, but the Entra ID group list could not be read completely ({0}) -- {1:N0} group(s) with an Entra id were not recorded this run and keep their last state (nothing retires, nothing comes back).' -f $why, [long]$Count.Held)
|            }
|            return ('Exposure Graph identities: {0} group(s) Entra ID no longer has (neither active nor in its deleted items) got no asset (SI_Identity_SkipDeletedGroups is on); {1:N0} group(s) that still exist in Entra ID kept. Existing CIs of the groups left out retire with that reason.' -f $n, [long]$Count.Kept)
|        }
|    }
|    ('{0}: {1} left out' -f [string]$Count.Setting, $n)
|}
|
|function Get-SIIdentityScopeWriteSql {
|    <# The ONE statement that records this run's counts (sidata.CollectionLeftOut; nothing when the table is not there yet) and
|       keeps 400 days of them. @rows = [{ Setting; Feed; LeftOut; Kept; Held; Applied; Detail }], @engine. #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'sidata.CollectionLeftOut') IS NULL BEGIN SELECT 0 AS Written; RETURN; END
|INSERT sidata.CollectionLeftOut (Setting, Feed, Engine, LeftOut, Kept, Held, Applied, Detail)
|SELECT LEFT(x.Setting, 64), LEFT(ISNULL(x.Feed, N''), 64), LEFT(ISNULL(@engine, N''), 32), ISNULL(x.LeftOut, 0), x.Kept, ISNULL(x.Held, 0), ISNULL(x.Applied, 1), LEFT(x.Detail, 400)
|FROM OPENJSON(@rows) WITH (Setting NVARCHAR(64), Feed NVARCHAR(64), LeftOut BIGINT, Kept BIGINT, Held BIGINT, Applied BIT, Detail NVARCHAR(400)) x
|WHERE x.Setting IS NOT NULL;
|DECLARE @n INT = @@ROWCOUNT;
|DELETE FROM sidata.CollectionLeftOut WHERE CollectedAt < DATEADD(day, -400, SYSUTCDATETIME());
|SELECT @n AS Written;
|'@
|}
|
|function Write-SIIdentityScopeCounts {
|    <#
|        Records this run's counts in the install's database (one row per switch). -Invoke: the SQL seam
|        { param($Sql, $Params, $Mode) } (New-SIRecordSqlInvoke); none = no database, the log line is the record. Never throws.
|    #>
|    param([Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Counts, [scriptblock]$Invoke, [string]$Engine = 'identity')
|    if (-not @($Counts).Count) { return 0 }
|    if (-not $Invoke) {
|        if (-not (Get-Command -Name New-SIRecordSqlInvoke -ErrorAction SilentlyContinue)) {
|            $rs = [IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'data-model', 'SI-RecordSql.ps1')
|            if ([IO.File]::Exists($rs)) { try { . $rs } catch { } }
|        }
|        if (Get-Command -Name New-SIRecordSqlInvoke -ErrorAction SilentlyContinue) { $Invoke = New-SIRecordSqlInvoke }
|    }
|    if (-not $Invoke) { return 0 }
|    try {
|        $rows = @(foreach ($c in @($Counts)) { [ordered]@{ Setting = [string]$c.Setting; Feed = [string]$c.Feed; LeftOut = [long]$c.LeftOut; Kept = [long]$c.Kept; Held = [long]$c.Held; Applied = [bool]$c.Applied; Detail = [string]$c.Detail } })
|        $j = ConvertTo-Json -InputObject @($rows) -Compress -Depth 4
|        if (-not $j.TrimStart().StartsWith('[')) { $j = '[' + $j + ']' }
|        $r = @(& $Invoke (Get-SIIdentityScopeWriteSql) @{ rows = $j; engine = $Engine } 'rows') | Select-Object -First 1
|        return [int](Get-SIIdentityScopeValue $r 'Written')
|    } catch {
|        Write-Warning ('identity scope choice: the counts could not be recorded in the database -- {0}. The run log has them.' -f $_.Exception.Message)
|        return 0
|    }
|}
|
|function Get-SIIdentityScopeLeftOutSql {
|    <# The records each feed's switches left out of the collection @ctText (rows written at or after it), per feed. #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'sidata.CollectionLeftOut') IS NULL BEGIN SELECT CAST(NULL AS NVARCHAR(64)) AS Feed, CAST(0 AS BIGINT) AS LeftOut WHERE 1 = 0; RETURN; END
|DECLARE @ct DATETIME2(3) = TRY_CONVERT(DATETIME2(3), NULLIF(@ctText, N''), 127);
|SELECT l.Feed, SUM(l.LeftOut) AS LeftOut
|FROM sidata.CollectionLeftOut l
|WHERE @ct IS NOT NULL AND l.CollectedAt >= @ct AND l.Applied = 1
|  AND l.Id IN (SELECT MAX(i.Id) FROM sidata.CollectionLeftOut i WHERE i.CollectedAt >= @ct GROUP BY i.Setting)
|GROUP BY l.Feed;
|'@
|}
|
|function Get-SIIdentityScopeLeftOutByFeed {
|    <#
|        The records the switches left out of one collection, per feed ('eg|user' -> count) -- what the asset-drop check adds
|        back before it judges a feed. Only read while a switch is on in this install (-Choice); otherwise, or on any failure,
|        an empty map (the check judges as before). Never throws.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$CollectionTimeText, $Choice)
|    $out = @{}
|    if (-not $Choice) { $Choice = Get-SIIdentityScopeChoice }
|    if (-not $Choice.Any) { return $out }
|    try {
|        foreach ($r in @(& $Invoke (Get-SIIdentityScopeLeftOutSql) @{ ctText = $CollectionTimeText } 'rows')) {
|            if ($null -eq $r) { continue }
|            $f = [string](Get-SIIdentityScopeValue $r 'Feed'); if (-not $f) { continue }
|            $n = Get-SIIdentityScopeValue $r 'LeftOut'; if ($null -eq $n -or $n -is [DBNull]) { $n = 0 }
|            $out[$f.ToLowerInvariant()] = [long]$n
|        }
|    } catch { Write-Warning ('identity scope choice: the left-out counts could not be read for the asset-drop check -- {0}' -f $_.Exception.Message) }
|    $out
|}
|
|function Get-SIRecordLeftOutByIdentityChoice {
|    <#
|        PURE. The CI build's side: is this Exposure Graph record -- MISSING from a complete newer collection -- one the
|        install's choice now leaves out? Decided from the record's own stored SI fields (the node is not read again):
|          SI_Identity_SkipNeverSyncedDisabledAd  an eg user record of a user (si_identity_type user) with no Entra object id,
|                                                 whose stored fields show no privilege (si_admin_count, si_ad_critical_groups,
|                                                 si_is_sensitive_account, si_ms_criticality): the switch keeps every enabled
|                                                 or privileged never-synced account listed, so one that is no longer listed
|                                                 is disabled now (or gone from AD)
|          SI_Identity_SkipNeverSyncedAd          the same record, while this wider switch is on (it then decides instead of
|                                                 the one above), and only when the record shows it is an AD account (a domain
|                                                 SID in ad_sid, or an account name + AD domain): the switch keeps every
|                                                 privileged never-synced account listed, so one no longer listed is not
|                                                 privileged (or gone from AD)
|          SI_Identity_SkipDeletedGroups         an eg user record of a group (si_identity_type group) with an Entra object id:
|                                                 the switch keeps every group Entra still has, so one no longer listed is gone
|        Returns @{ Gone; Reason } -- Gone = $false for anything else (the lifecycle's usual "not seen" applies).
|    #>
|    param([AllowNull()]$Record, [Parameter(Mandatory)]$Choice)
|    $no = [pscustomobject]@{ Gone = $false; Reason = '' }
|    if ($null -eq $Record -or -not $Choice -or -not $Choice.Any) { return $no }
|    if ([string](Get-SIIdentityScopeValue $Record 'si_provider') -ne 'eg' -or [string](Get-SIIdentityScopeValue $Record 'si_record_type') -ne 'user') { return $no }
|    $type = ([string](Get-SIIdentityScopeValue $Record 'si_identity_type')).Trim().ToLowerInvariant()
|    $oid = ([string]@(Get-SIIdentityScopeList (Get-SIIdentityScopeValue $Record 'entra_object_id'))[0]).Trim()
|    $neverSynced = Get-SIIdentityNeverSyncedSetting -Choice $Choice
|    if ($type -eq 'user' -and -not $oid -and $neverSynced) {
|        $wide = ($neverSynced -eq $script:SIIdentityScopeSettings.SkipNeverSyncedAd.Setting)
|        if ($wide) {
|            # the wider switch never leaves out a node that is not an AD account: a record without an AD sign keeps the
|            # usual "not seen" grace
|            $adSid = ([string]@(Get-SIIdentityScopeList (Get-SIIdentityScopeValue $Record 'ad_sid'))[0]).Trim()
|            $sam = [string](Get-SIIdentityScopeValue $Record 'si_sam_account_name')
|            $dom = [string](Get-SIIdentityScopeValue $Record 'si_ad_domain')
|            if (-not ($adSid -match '^(?i)s-1-5-21-') -and -not ($sam.Trim() -and $dom.Trim())) { return $no }
|        }
|        $ac = 0; if ([int]::TryParse([string](Get-SIIdentityScopeValue $Record 'si_admin_count'), [ref]$ac) -and $ac -gt 0) { return $no }
|        if (@(Get-SIIdentityScopeList (Get-SIIdentityScopeValue $Record 'si_ad_critical_groups')).Count -gt 0) { return $no }
|        if ((ConvertTo-SIIdentityScopeFlag (Get-SIIdentityScopeValue $Record 'si_is_sensitive_account')) -eq $true) { return $no }
|        if ((ConvertTo-SIIdentityScopeFlag (Get-SIIdentityScopeValue $Record 'si_is_service_account')) -eq $true) { return $no }
|        $crit = Get-SIIdentityScopeValue $Record 'si_ms_criticality'
|        if ($null -ne $crit -and "$crit".Trim() -ne '') { return $no }
|        if ($wide) {
|            return [pscustomobject]@{ Gone = $true; Reason = 'left out by the install''s choice SI_Identity_SkipNeverSyncedAd: an on-premises AD account never synced to Entra ID that the Exposure Graph no longer lists as privileged' }
|        }
|        return [pscustomobject]@{ Gone = $true; Reason = 'left out by the install''s choice SI_Identity_SkipNeverSyncedDisabledAd: an on-premises AD account never synced to Entra ID that the Exposure Graph no longer lists as enabled or privileged' }
|    }
|    if ($type -eq 'group' -and $oid -and $Choice.SkipDeletedGroups) {
|        return [pscustomobject]@{ Gone = $true; Reason = 'left out by the install''s choice SI_Identity_SkipDeletedGroups: a group Entra ID no longer has (neither active nor in its deleted items)' }
|    }
|    return $no
|}
'@ }
$__siSupportFiles['engine/asset-profiling/shared/SI-AssetName.ps1'] = @{ Sha256 = '3ea6186fc778998f9b99042bff7a3be25e8746290fe239b35feddd7ca519330c'; Text = @'
|#Requires -Version 5.1
|<#
|    SI v3 -- THE SYNTHETIC ASSET NAME. One rule, one place, four engines.
|
|    🔒 THE CONTRACT SI_AssetName MAKES: it is NEVER blank. When no source anywhere holds a name for an
|    asset, this produces a marked stand-in rather than a blank or a bare identifier.
|
|    🔴 WHY NOT JUST USE THE ID -- the question this file exists to answer. Falling back to the raw
|    identifier satisfies "never blank" and looks like data. MEASURED 2026-08-27: 78 of 198 endpoint rows
|    already carried a 40-hex MDE machine id in AssetName, and it reached the customer's Excel looking
|    exactly like a hostname that happened to be unreadable. A marked value says the true thing instead:
|    NOTHING KNOWS THIS ASSET'S NAME. Same stability, same uniqueness, no false impression.
|
|    🔑 PROPERTIES THAT MATTER, and each one is asserted by a test:
|      * DETERMINISTIC -- derived only from the id. No clock, no random, no run id. The same asset gets
|        the same synthetic name on every run, forever, which is what makes it safe to show in a report
|        and safe to group by.
|      * UNIQUE -- the id is unique per asset, so the name is too. Reports that group or count by name
|        stay correct; a shared placeholder would silently merge distinct assets into one row, which is
|        this codebase's oldest scar (a blank join key manufacturing 296 findings, v2.2.442).
|      * RECOGNISABLE -- the 'unnamed-' prefix is a contract a consumer can test without parsing.
|      * HARMLESS TO CMDB MATCHING -- it will never match a real CI, which is CORRECT: these assets have
|        no name to match on. A raw hash never matched either, so nothing regresses.
|
|    NO Set-StrictMode here -- it leaks into the caller's scope (measured 2026-08-12).
|#>
|
|function Get-SISyntheticAssetName {
|    <#
|        -Engine  'endpoint' | 'azure' | 'identity' | 'publicip'
|        -Id      the asset's stable identifier (PrimaryEntityId)
|
|        Returns 'unnamed-<engine>-<8 chars of the id>', or $null when there is no id at all -- because
|        with no id there is nothing stable to build from, and inventing one would be worse than a blank.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][AllowEmptyString()][string]$Engine,
|        [Parameter(Mandatory)][AllowEmptyString()][string]$Id
|    )
|
|    if ([string]::IsNullOrWhiteSpace($Id)) { return $null }
|
|    $eng = ([string]$Engine).Trim().ToLowerInvariant()
|    if ([string]::IsNullOrWhiteSpace($eng)) { $eng = 'asset' }
|
|    # 🪤 Strip to alphanumerics BEFORE truncating. Ids in this estate include ARM paths
|    # (/subscriptions/.../virtualMachines/x) and IP addresses -- taking the first 8 characters raw would
|    # yield '/subscri' for every Azure resource on earth, which is a shared placeholder wearing a unique
|    # name. Stripping first means the 8 characters carry actual entropy.
|    $clean = ($Id -replace '[^A-Za-z0-9]', '')
|    if ([string]::IsNullOrWhiteSpace($clean)) {
|        # An id made entirely of punctuation is not something to guess at.
|        return $null
|    }
|
|    # 🪤 And take the TAIL, not the head. An ARM resource id's entropy is at the end (the resource name);
|    # its first characters are the subscription guid, shared by every resource in the subscription.
|    $take = [Math]::Min(8, $clean.Length)
|    $frag = $clean.Substring($clean.Length - $take, $take).ToLowerInvariant()
|
|    return ('unnamed-{0}-{1}' -f $eng, $frag)
|}
|
|function Test-SISyntheticAssetName {
|    <# Is this value one of ours? A contract a consumer can test without parsing the shape. #>
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Value)
|    if ([string]::IsNullOrWhiteSpace($Value)) { return $false }
|    return ($Value -like 'unnamed-*')
|}
'@ }
$__siSupportFiles['engine/risk-analysis/_shared/RA-Mail.ps1'] = @{ Sha256 = '34513dce339cd6a586eb628b8319290c4300ccef8e7481cbe9b9ce0c6a5b375c'; Text = @'
|#######################################################################################################
|#  SecurityInsight - Risk Analysis engine
|#  SMTP delivery: the anonymous and authenticated send paths.
|#
|#  The two transports the mail step chooses between. Separated so a change to delivery cannot be
|#  confused with a change to what is being delivered.
|#
|#  AUDIT #16: moved VERBATIM out of Invoke-RiskAnalysis.ps1 on 2026-08-05. Dot-sourced back in at
|#  exactly the position it occupied, so load order is unchanged. Every function body is
|#  byte-identical to before the move - verified with tests/Get-EngineFunctionInventory.ps1,
|#  which compares a SHA-256 of each function's source text before and after.
|#
|#  Do NOT add $PSScriptRoot-dependent code here: in this file it resolves to _shared/, one level
|#  deeper than the engine root the main script derives $siRoot from.
|#######################################################################################################
|
|function Test-SIMailAttachmentFits {
|    <#
|        Will this file fit inside the relay's message-size limit once it is attached?
|
|        🔑 THE ANSWER IS NOT THE FILE SIZE. MIME attachments are base64-encoded, which inflates them
|        by ~37%, so a 10 MB workbook is ~13.7 MB of message. A check against the on-disk size passes
|        and the relay still rejects -- and an oversized attachment does not arrive truncated, it takes
|        the WHOLE MESSAGE with it. The operator then loses the AI summary and the findings as well as
|        the spreadsheet, which is the opposite of the intended trade.
|
|        Pure and parameterised so the boundary is provable without a mail server or a 250 MB file.
|        Returns the numbers as well as the verdict, because the caller has to tell the operator what
|        was too big and by how much.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][long]$SizeBytes,
|        [Parameter()][double]$MaxMb = 24
|    )
|    $encodedMb = [Math]::Round(($SizeBytes * 1.37) / 1MB, 1)
|    [pscustomobject]@{
|        DiskMb    = [Math]::Round($SizeBytes / 1MB, 1)
|        EncodedMb = $encodedMb
|        MaxMb     = $MaxMb
|        Fits      = ($encodedMb -le $MaxMb)
|    }
|}
|
|function Get-RAMailSubject {
|    <# The Risk Analysis mail subject's <what happened> (MAIL-3, #653: the transport -- Get-SIMailSubject -- adds the
|       environment in front and '[SecurityInsight]' at the end, so the product is not named here). -TenantTag is
|       Get-SITenantDisplayName's '<domain> (<tenant id>)' (#243); empty leaves the tenant out. -NotComplete: a report of
|       this run is NOT COMPLETE (#641) -- the subject starts with the severity word 'Failed'. #>
|    param([string]$ReportTemplate, [string]$TenantTag, [switch]$NotComplete)
|    $s = if ($NotComplete) { 'Failed: Risk Analysis not complete | {0}' -f $ReportTemplate } else { 'Risk Analysis | {0}' -f $ReportTemplate }
|    if (-not [string]::IsNullOrWhiteSpace($TenantTag)) { $s += (' | {0}' -f $TenantTag.Trim()) }
|    return $s
|}
|
|function Get-RAMailReportName {
|    <# PURE. The report as the mail BODY names it: "Summary report" / "Detailed report" -- never the internal template id
|       ('RiskAnalysis_Summary_Bucket'); a template that is neither keeps its own name. #>
|    param([AllowNull()][AllowEmptyString()][string]$ReportTemplate)
|    $g = $null
|    if (Get-Command -Name Get-RAReportGrainLabel -ErrorAction SilentlyContinue) { try { $g = Get-RAReportGrainLabel -ReportTemplate $ReportTemplate } catch { $g = $null } }
|    if (-not $g) { if ("$ReportTemplate" -match '(?i)summary') { $g = 'Summary' } elseif ("$ReportTemplate" -match '(?i)detail') { $g = 'Detailed' } }
|    if ($g) { return ('{0} report' -f $g) }
|    "$ReportTemplate".Trim()
|}
|
|function Send-MailAnonymous {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)] [string]$SmtpServer,
|        [Parameter(Mandatory)] [int]$Port,
|        [Parameter()] [bool]$UseSsl = $false,
|
|        [Parameter(Mandatory)] [string]$From,
|        [Parameter(Mandatory)] [string[]]$To,
|        [Parameter(Mandatory)] [string]$Subject,
|        [Parameter(Mandatory)] [string]$BodyHtml,
|
|        [Parameter()] [string[]]$Attachments,
|        [Parameter()] [ValidateSet('Normal','High','Low')] [string]$Priority = 'High'
|    )
|
|    # v2.2.247 -- diagnostic-rich anonymous send. NEVER throws (operator: "no
|    # -stop as script must continue"). Returns $true on success, $false on
|    # failure, with the relay's actual status code / .NET exception chain
|    # printed inline so the operator can see WHY mail didn't arrive instead
|    # of a green "[OK] anonymous mail sent" line that lied about success.
|    #
|    # Two phases:
|    #   1. TCP pre-flight (5s, async with timeout). If we can't even open a
|    #      socket -- DNS failure, firewall ACL, listener down, source-IP
|    #      restriction -- skip the cmdlet call entirely and log the cause.
|    #   2. Send-MailMessage with -ErrorAction SilentlyContinue + -ErrorVariable.
|    #      Any non-terminating error from the cmdlet now lands in $smtpErr
|    #      instead of getting swallowed; we walk the .NET exception chain
|    #      (SmtpException -> SmtpStatusCode, InnerException) and print each
|    #      level. Then return $false so the caller knows not to log [OK].
|
|    Write-Output ("Sending mail (anonymous) to {0} with subject '{1}'" -f ($To -join ', '), $Subject)
|
|    # 1. TCP pre-flight
|    try {
|        $tcp = New-Object System.Net.Sockets.TcpClient
|        $iar = $tcp.BeginConnect($SmtpServer, $Port, $null, $null)
|        if (-not $iar.AsyncWaitHandle.WaitOne(5000, $false)) {
|            $tcp.Close()
|            Write-Output ("   TCP pre-flight FAILED (5s timeout) -- {0}:{1}" -f $SmtpServer, $Port)
|            Write-Output  "   (likely cause: DNS resolution slow / wrong, firewall ACL silently dropping, listener not on this port)"
|            return $false
|        }
|        $tcp.EndConnect($iar)
|        $tcp.Close()
|        Write-Output ("   TCP pre-flight OK -- {0}:{1} accepted connection" -f $SmtpServer, $Port)
|    } catch {
|        Write-Output ("   TCP pre-flight FAILED -- {0}:{1} :: {2}" -f $SmtpServer, $Port, $_.Exception.Message)
|        Write-Output  "   (likely cause: DNS resolution, firewall ACL, listener down, or relay restricting source IP)"
|        return $false
|    }
|
|    $params = @{
|        SmtpServer  = $SmtpServer
|        Port        = $Port
|        From        = $From
|        To          = $To
|        Subject     = $Subject
|        Body        = $BodyHtml
|        BodyAsHtml  = $true
|        Encoding    = 'UTF8'
|        Priority    = $Priority
|        ErrorAction = 'SilentlyContinue'
|    }
|    if ($UseSsl) { $params.UseSsl = $true }
|    if ($Attachments -and $Attachments.Count -gt 0) { $params.Attachments = $Attachments }
|
|    # 2. Send; capture any non-terminating error so we can surface details
|    $smtpErr = $null
|    Send-MailMessage @params -ErrorVariable smtpErr 2>$null
|
|    if ($smtpErr -and $smtpErr.Count -gt 0) {
|        Write-Output  "   SMTP send FAILED -- relay rejected or cmdlet hit a non-terminating error:"
|        foreach ($er in $smtpErr) {
|            $ex = $er.Exception
|            if ($null -eq $ex) { continue }
|            Write-Output ("   Exception type : {0}" -f $ex.GetType().FullName)
|            Write-Output ("   Message        : {0}" -f $ex.Message)
|            if ($ex.PSObject.Properties['StatusCode']) {
|                Write-Output ("   SMTP StatusCode: {0}" -f $ex.StatusCode)
|            }
|            $inner = $ex.InnerException
|            $depth = 0
|            while ($inner -and $depth -lt 5) {
|                Write-Output ("   InnerException : [{0}] {1}" -f $inner.GetType().FullName, $inner.Message)
|                if ($inner.PSObject.Properties['StatusCode']) {
|                    Write-Output ("   Inner StatusCode: {0}" -f $inner.StatusCode)
|                }
|                $inner = $inner.InnerException
|                $depth++
|            }
|        }
|        Write-Output  "   (common causes: relay requires AUTH, sender not whitelisted, RBL block, SPF/DMARC reject, TLS handshake mismatch)"
|        return $false
|    }
|
|    return $true
|}
|
|function Send-MailSecure {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)] [string]$SmtpServer,
|        [Parameter(Mandatory)] [int]$Port,
|        [Parameter()] [bool]$UseSsl = $false,
|
|        [Parameter(Mandatory)] [pscredential]$Credential,
|        [Parameter(Mandatory)] [string]$From,
|        [Parameter(Mandatory)] [string[]]$To,
|        [Parameter(Mandatory)] [string]$Subject,
|        [Parameter(Mandatory)] [string]$BodyHtml,
|
|        [Parameter()] [string[]]$Attachments,
|        [Parameter()] [ValidateSet('Normal','High','Low')] [string]$Priority = 'High'
|    )
|
|    $params = @{
|        SmtpServer  = $SmtpServer
|        Port        = $Port
|        Credential  = $Credential
|        From        = $From
|        To          = $To
|        Subject     = $Subject
|        Body        = $BodyHtml
|        BodyAsHtml  = $true
|        Encoding    = 'UTF8'
|        Priority    = $Priority
|    }
|
|    if ($UseSsl) { $params.UseSsl = $true }
|    if ($Attachments -and $Attachments.Count -gt 0) { $params.Attachments = $Attachments }
|
|    Write-Output ("Sending mail (secure) to {0} with subject '{1}'" -f ($To -join ', '), $Subject)
|    # A refused mail is a NON-terminating error by default, so the caller used to print "secure mail sent" after a
|    # rejection. Stop makes it throw; the callers catch it and print the relay's error (mail stays non-fatal for RA).
|    $params.ErrorAction = 'Stop'
|    Send-MailMessage @params
|}
'@ }
$__siSupportFiles['engine/_shared/SI-GuardHeal.ps1'] = @{ Sha256 = 'e9f0e8596f26a0a661390b8f0b662c2b76c0e942bd994a7c0b7271a2ac7cf3c5'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- GUARDS HEAL THEMSELVES, SAY WHICH RELEASE THEY TRIPPED ON, AND CAN BE ACCEPTED (owner 2026-10-17:
|    "can a guard autoheal itself if it was caused by bug in code and new release fix it. it must"; "can you make a way that
|    i can accept an guard everywhere by email or support app").
|
|    THREE THINGS, one file (loaded by SI-Guard.ps1; every function that talks to a store or a transport NEVER throws):
|
|    1. AUTO-HEAL. A guard that held or warned is an OPEN EPISODE in the guard state (cfg.GuardState on Pro, else the small
|       file / memory store of SI-Guard.ps1). Where a guard is checked, the caller names what it checked (Invoke-SIGuardCalls
|       -Checked) and whether the run was COMPLETE. A checked guard that did not trip, in a complete run, whose measured
|       values are within their limits again, CLEARS its episode (Get-SIGuardHealDecision, pure):
|         * the episode keeps who cleared it and when (ClearedUtc / ClearedRunId / ClearedVersion / ClearedHow);
|         * one cfg.GuardEvent row, Outcome 'cleared', "Back to normal in run <id> on version <v>";
|         * one run-health row (Phase Guard, ExitReason guard-cleared);
|         * Invardia gets the guard report GuardOutcome 'cleared', ClearedBy 'passed' (its receiver closes the ticket);
|         * nothing is mailed.
|       A run that is NOT complete never clears anything, and a run that trips again keeps the episode open. A held set
|       (cfg.GuardRelease) is never applied by a heal: the newer complete run decides again under the current rules and the
|       older held set is superseded by that run's own code (only current holds), so nothing is lost and no short
|       collection is published.
|
|    2. RELEASE ATTRIBUTION. Every trip carries the SecurityInsight version it happened on and the version before it, from
|       the guard's VERSION MARKER (state key 'ver|<guard key>': the version this check last ran on, the one before, the
|       first run on it, and whether that first run tripped). Get-SIGuardAttribution (pure) says it in plain words: "the
|       first run after the update to <v> (from <p>)" (our update is the likely cause), or "this check has run on <v> since
|       <time>" (a change in the source is more likely). A marker written by a passing check (kind 'check') is what makes
|       "first run after the update" a claim; a guard whose caller names no checks only compares with its own last trip.
|
|    3. ACCEPT EVERYWHERE. The owner accepts a guard situation at an install -- by guard id and a version range (or one
|       guard key) -- through the procedure cfg.GuardAcceptSet (sql\si-pro-settings.sql; setup\Invoke-SIGuardAcceptEverywhere.ps1
|       runs it through the Invardia Support app, one install at a time). The trips it covers are acknowledged, their
|       episodes cleared (Invardia is told ClearedBy 'released' by the mail job), and a held set is released only through
|       the release path with its checks (held, not expired, the plan the hash names). A later trip on a version inside an
|       accepted range is still recorded, but not mailed and not reported again (Test-SIGuardAcceptCovers, pure).
|
|    PS 5.1 and 7. No modules.
|#>
|
|$script:SIGuardHeal = @{
|    MarkerPrefix = 'ver|'
|    Hows         = @('passed', 'released', 'accepted', 'taken')
|    AuditClear   = 'guard.event.clear'
|}
|
|function Get-SIGuardHealSettings {
|    <#
|        This file's constants (and the run version it caches), read ONLY through here. $script: is the script scope of
|        the CALLER, not of this file: a script that runs after another one loaded this file (the vulnerability close-loop
|        runs itself again as a new script; a launcher loads the guards first) has no $script:SIGuardHeal, and reading it
|        failed every clear check with "You cannot call a method on a null-valued expression" (live 2026-10-19). A scope
|        without it gets the same constants.
|    #>
|    if ($null -eq $script:SIGuardHeal) {
|        $script:SIGuardHeal = @{ MarkerPrefix = 'ver|'; Hows = @('passed', 'released', 'accepted', 'taken'); AuditClear = 'guard.event.clear' }
|    }
|    $script:SIGuardHeal
|}
|
|# =====================================================================================================================
|#  Small helpers -- PURE
|# =====================================================================================================================
|function Get-SIGuardField {
|    <# PURE. One field of a hashtable / object / data row; $null when it is not there (DBNull reads $null). #>
|    param($Object, [Parameter(Mandatory)][string]$Name)
|    if ($null -eq $Object) { return $null }
|    $v = $null
|    if ($Object -is [System.Collections.IDictionary]) { if ($Object.Contains($Name)) { $v = $Object[$Name] } }
|    elseif ($Object -is [System.Data.DataRow]) { if ($Object.Table.Columns.Contains($Name)) { $v = $Object[$Name] } }
|    elseif ($Object.PSObject.Properties[$Name]) { $v = $Object.$Name }
|    if ($v -is [System.DBNull]) { return $null }
|    $v
|}
|
|function ConvertTo-SIGuardVersionParts {
|    <# PURE. '3.0.0.2138' -> 3,0,0,2138; '3.0.0-rc.12+0dc9062' -> 3,0,0,0 (the numeric part, padded to four); '' or not a
|       version -> $null. More than four parts -> $null. #>
|    param([AllowNull()][AllowEmptyString()][string]$Version)
|    $s = ([string]$Version).Trim()
|    $m = [regex]::Match($s, '^[0-9]+(\.[0-9]+)*')
|    if (-not $m.Success) { return $null }
|    $parts = @($m.Value.Split('.'))
|    if ($parts.Count -gt 4) { return $null }
|    $out = New-Object System.Collections.Generic.List[long]
|    foreach ($p in $parts) { $n = 0L; if (-not [long]::TryParse($p, [ref]$n)) { return $null }; $out.Add($n) }
|    while ($out.Count -lt 4) { $out.Add(0) }
|    , $out.ToArray()
|}
|
|function Compare-SIGuardVersion {
|    <# PURE. -1 / 0 / 1 for A < = > B by their numeric parts; $null when either is not a version. #>
|    param([AllowNull()][AllowEmptyString()][string]$A, [AllowNull()][AllowEmptyString()][string]$B)
|    # (not $a / $b: PowerShell names are case-blind, and -A / -B are [string] -- the parts would turn back into text)
|    $pa = ConvertTo-SIGuardVersionParts $A; $pb = ConvertTo-SIGuardVersionParts $B
|    if ($null -eq $pa -or $null -eq $pb) { return $null }
|    for ($i = 0; $i -lt 4; $i++) { if ($pa[$i] -lt $pb[$i]) { return -1 }; if ($pa[$i] -gt $pb[$i]) { return 1 } }
|    0
|}
|
|function Test-SIGuardVersionInRange {
|    <# PURE. Is -Version within [-From, -To] (either bound may be empty = open)? No bound at all = $true. A version that is
|       not one (empty, unreadable) is never inside a range that has a bound. #>
|    param([AllowNull()][AllowEmptyString()][string]$Version, [AllowNull()][AllowEmptyString()][string]$From, [AllowNull()][AllowEmptyString()][string]$To)
|    $f = ([string]$From).Trim(); $t = ([string]$To).Trim()
|    if (-not $f -and -not $t) { return $true }
|    if ($f) { $c = Compare-SIGuardVersion $Version $f; if ($null -eq $c -or $c -lt 0) { return $false } }
|    if ($t) { $c = Compare-SIGuardVersion $Version $t; if ($null -eq $c -or $c -gt 0) { return $false } }
|    $true
|}
|
|function Get-SIGuardRunVersion {
|    <# The SecurityInsight version this process runs (the release, e.g. 3.0.0.2138): $global:SI_GuardVersionOverride (a
|       test's), else the telemetry's release version, else the VERSION file. Cached for the process. '' when unknown. #>
|    if ($null -ne $global:SI_GuardVersionOverride) { return [string]$global:SI_GuardVersionOverride }
|    $gh = Get-SIGuardHealSettings
|    if ($gh.ContainsKey('Version') -and $null -ne $gh.Version) { return [string]$gh.Version }
|    $v = ''
|    try { if (Get-Command -Name Get-SITelemetryReleaseVersion -ErrorAction SilentlyContinue) { $v = [string](Get-SITelemetryReleaseVersion) } } catch { $v = '' }
|    if (-not $v.Trim()) {
|        try {
|            $f = [System.IO.Path]::Combine((Split-Path -Parent (Split-Path -Parent $PSScriptRoot)), 'VERSION')
|            if ([System.IO.File]::Exists($f)) { $v = ([System.IO.File]::ReadAllText($f)).Trim() }
|        } catch { $v = '' }
|    }
|    $gh.Version = $v.Trim()
|    $gh.Version
|}
|
|function Get-SIGuardKeyFor {
|    <# PURE. The guard key of a guard id and subject -- the same rule as New-SIGuardEvent. #>
|    param([Parameter(Mandatory)][string]$GuardId, [AllowNull()][AllowEmptyString()][string]$Subject)
|    $sub = ([string]$Subject).Trim(); if ($sub.Length -gt 400) { $sub = $sub.Substring(0, 400) }
|    if ($sub) { $GuardId + '|' + $sub.ToLowerInvariant() } else { $GuardId }
|}
|
|# =====================================================================================================================
|#  2. RELEASE ATTRIBUTION -- PURE
|# =====================================================================================================================
|function Get-SIGuardVersionMarker {
|    <# PURE. A stored marker row/object -> @{ Version; PreviousVersion; FirstRunId; SinceUtc; Kind; FirstRunTripped }, or
|       $null when there is none (or it names no version). A marker row in cfg.GuardState keeps SinceUtc in FirstSeenUtc and
|       FirstRunTripped in TripCount (1 / 0). #>
|    param($Stored)
|    if ($null -eq $Stored) { return $null }
|    $v = [string](Get-SIGuardField $Stored 'Version')
|    if (-not $v.Trim()) { return $null }
|    $since = Get-SIGuardField $Stored 'SinceUtc'; if ($null -eq $since) { $since = Get-SIGuardField $Stored 'FirstSeenUtc' }
|    $ft = Get-SIGuardField $Stored 'FirstRunTripped'
|    if ($null -eq $ft) { $tc = 0; [void][int]::TryParse([string](Get-SIGuardField $Stored 'TripCount'), [ref]$tc); $ft = ($tc -gt 0) }
|    $kind = [string](Get-SIGuardField $Stored 'MarkerKind'); if (-not $kind) { $kind = [string](Get-SIGuardField $Stored 'Kind') }
|    [pscustomobject]@{ Version = $v.Trim(); PreviousVersion = ([string](Get-SIGuardField $Stored 'PreviousVersion')).Trim(); FirstRunId = [string](Get-SIGuardField $Stored 'FirstRunId')
|                       SinceUtc = (ConvertTo-SIGuardHealUtc $since); Kind = $(if ($kind -eq 'check') { 'check' } else { 'trip' }); FirstRunTripped = [bool]$ft }
|}
|
|function ConvertTo-SIGuardHealUtc {
|    <# PURE. A stored time as UTC, or $null. A text without a zone is read AS UTC. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or $Value -is [System.DBNull] -or "$Value".Trim() -eq '') { return $null }
|    if ($Value -is [datetime]) { if ($Value.Kind -eq [DateTimeKind]::Local) { return $Value.ToUniversalTime() }; return [datetime]::SpecifyKind($Value, [DateTimeKind]::Utc) }
|    $d = [datetime]::MinValue
|    $styles = [System.Globalization.DateTimeStyles]::AssumeUniversal -bor [System.Globalization.DateTimeStyles]::AdjustToUniversal
|    if ([datetime]::TryParse("$Value", [System.Globalization.CultureInfo]::InvariantCulture, $styles, [ref]$d)) { return $d }
|    $null
|}
|
|function Update-SIGuardVersionMarker {
|    <#
|        PURE. The marker after this run's check of the guard. -Marker: the one before (Get-SIGuardVersionMarker) or $null;
|        -Kind 'check' (the caller names its checks, so a pass is recorded) or 'trip'; -Tripped: this run tripped it.
|          no marker / another version  a new marker: this version, the one before it, this run as the first on it
|          the same version             kept; the first run's trip is remembered when this IS the first run
|        A marker of kind 'check' stays 'check' (passes are recorded for this guard).
|    #>
|    param($Marker, [AllowEmptyString()][string]$Version, [string]$RunId, [Parameter(Mandatory)][datetime]$NowUtc, [ValidateSet('check', 'trip')][string]$Kind = 'trip', [bool]$Tripped = $false)
|    $v = ([string]$Version).Trim()
|    if (-not $v) { return $Marker }
|    $kind = if ($Kind -eq 'check' -or ($Marker -and $Marker.Kind -eq 'check')) { 'check' } else { 'trip' }
|    if (-not $Marker -or $Marker.Version -ne $v) {
|        return [pscustomobject]@{ Version = $v; PreviousVersion = $(if ($Marker) { [string]$Marker.Version } else { '' }); FirstRunId = [string]$RunId
|                                  SinceUtc = $NowUtc.ToUniversalTime(); Kind = $kind; FirstRunTripped = [bool]$Tripped }
|    }
|    $ft = [bool]$Marker.FirstRunTripped -or ($Tripped -and [string]$RunId -and [string]$RunId -eq [string]$Marker.FirstRunId)
|    [pscustomobject]@{ Version = $Marker.Version; PreviousVersion = [string]$Marker.PreviousVersion; FirstRunId = [string]$Marker.FirstRunId
|                       SinceUtc = $Marker.SinceUtc; Kind = $kind; FirstRunTripped = $ft }
|}
|
|function Get-SIGuardAttribution {
|    <#
|        PURE. Which release a trip happened on, in plain words. -Marker: the guard's marker BEFORE this run (or $null);
|        -Version: the version this run is on; -RunId: this run. Returns @{ Version; PreviousVersion; FirstRunAfterUpdate;
|        AfterUpdate (the update is the likely cause); Text }.
|          the first run after an update (the check last ran on another version, a recorded pass or trip)
|                                -> "This happened in the first run after the update to <v> (from <p>) ..."
|          the same version, its first run tripped too
|                                -> "It has tripped since the first run after the update to <v> (from <p>) ..."
|          the same version, it ran on it before without tripping in its first run (passes recorded)
|                                -> "This check has run on version <v> since <time> ... a change in the data source ..."
|          nothing known         -> "This happened on version <v>."
|        A marker made only by earlier TRIPS (the caller names no checks) never claims "first run after the update": it says
|        on which version the check last tripped.
|    #>
|    param($Marker, [AllowEmptyString()][string]$Version, [string]$RunId)
|    $v = ([string]$Version).Trim()
|    $out = [ordered]@{ Version = $v; PreviousVersion = ''; FirstRunAfterUpdate = $false; AfterUpdate = $false; Text = '' }
|    if (-not $v) { return [pscustomobject]$out }
|    if (-not $Marker) { $out.Text = ('This happened on version {0}.' -f $v); return [pscustomobject]$out }
|    if ($Marker.Version -ne $v) {
|        $out.PreviousVersion = [string]$Marker.Version
|        if ($Marker.Kind -eq 'check') {
|            $out.FirstRunAfterUpdate = $true; $out.AfterUpdate = $true
|            $out.Text = ('This happened in the first run after the update to {0} (from {1}). The update is the likely cause, not a change in your data source.' -f $v, $Marker.Version)
|        } else {
|            $out.Text = ('This happened on version {0}; the last time this check tripped, it was version {1}.' -f $v, $Marker.Version)
|        }
|        return [pscustomobject]$out
|    }
|    $out.PreviousVersion = [string]$Marker.PreviousVersion
|    $first = [string]$RunId -and [string]$RunId -eq [string]$Marker.FirstRunId
|    if ($Marker.PreviousVersion -and ($first -or $Marker.FirstRunTripped) -and $Marker.Kind -eq 'check') {
|        $out.AfterUpdate = $true; $out.FirstRunAfterUpdate = [bool]$first
|        $out.Text = if ($first) { ('This happened in the first run after the update to {0} (from {1}). The update is the likely cause, not a change in your data source.' -f $v, $Marker.PreviousVersion) }
|                    else { ('This has tripped since the first run after the update to {0} (from {1}). The update is the likely cause, not a change in your data source.' -f $v, $Marker.PreviousVersion) }
|        return [pscustomobject]$out
|    }
|    if ($Marker.Kind -eq 'check' -and $Marker.SinceUtc) {
|        $out.Text = ('This happened on version {0}, which this check has run on since {1:yyyy-MM-dd HH:mm} UTC without tripping at first. A change in your data source is more likely than the update.' -f $v, ([datetime]$Marker.SinceUtc))
|        return [pscustomobject]$out
|    }
|    $out.Text = ('This happened on version {0}.' -f $v)
|    [pscustomobject]$out
|}
|
|# =====================================================================================================================
|#  1. AUTO-HEAL -- PURE decision
|# =====================================================================================================================
|function Test-SIGuardValueWithinLimit {
|    <# PURE. One measured value against its limit: a NEGATIVE limit is a floor (a drop of -30 %: within while the change is
|       above it), any other limit a ceiling (within while at or below it). No limit or no measurement = within. #>
|    param($Value)
|    $m = Get-SIGuardField $Value 'Measured'; $l = Get-SIGuardField $Value 'Limit'
|    if ($null -eq $m -or $null -eq $l -or "$m".Trim() -eq '' -or "$l".Trim() -eq '') { return $true }
|    $md = 0.0; $ld = 0.0
|    $ic = [System.Globalization.CultureInfo]::InvariantCulture
|    if (-not [double]::TryParse("$m", [System.Globalization.NumberStyles]::Float, $ic, [ref]$md)) { return $true }
|    if (-not [double]::TryParse("$l", [System.Globalization.NumberStyles]::Float, $ic, [ref]$ld)) { return $true }
|    if ($ld -lt 0) { return ($md -gt $ld) }
|    ($md -le $ld)
|}
|
|function Test-SIGuardEpisodeOpen {
|    <# PURE. An episode (a cfg.GuardState row) is open when it has a trip that no clear came after. A version marker
|       ('ver|') or a cause key ('cause|') is never an episode. #>
|    param($Episode, [string]$Key = '')
|    if ($null -eq $Episode) { return $false }
|    if ($Key -match '^(ver|cause)\|') { return $false }
|    $last = ConvertTo-SIGuardHealUtc (Get-SIGuardField $Episode 'LastSeenUtc')
|    if ($null -eq $last) { return $false }
|    $tc = 0; [void][int]::TryParse([string](Get-SIGuardField $Episode 'TripCount'), [ref]$tc)
|    if ($tc -lt 1) { return $false }
|    $cl = ConvertTo-SIGuardHealUtc (Get-SIGuardField $Episode 'ClearedUtc')
|    -not ($cl -and $cl -ge $last)
|}
|
|function Get-SIGuardHealDecision {
|    <#
|        PURE. Does this run clear the guard's open episode? -Episode: its state (or $null); -Tripped: it tripped in this run;
|        -Complete: the run was complete; -Values: this run's measured values against their limits (optional).
|        Returns @{ Decision ('none' | 'stays' | 'cleared'); Reason }:
|          none     no open episode (never tripped, or cleared already)
|          stays    it tripped again; or the run was not complete (only a complete run shows the level is normal); or a
|                   measured value is still outside its limit
|          cleared  a complete run, no trip, every value within its limit -- whatever version it runs (the release that
|                   fixed it, or the same one when the source came back)
|    #>
|    param($Episode, [string]$Key = '', [bool]$Tripped = $false, [bool]$Complete = $false, [object[]]$Values = @())
|    if (-not (Test-SIGuardEpisodeOpen -Episode $Episode -Key $Key)) { return [pscustomobject]@{ Decision = 'none'; Reason = 'no open episode' } }
|    if ($Tripped) { return [pscustomobject]@{ Decision = 'stays'; Reason = 'it tripped again in this run' } }
|    if (-not $Complete) { return [pscustomobject]@{ Decision = 'stays'; Reason = 'this run was not complete -- only a complete run can show the level is normal again' } }
|    foreach ($v in @($Values | Where-Object { $_ })) {
|        if (-not (Test-SIGuardValueWithinLimit $v)) {
|            $lb = [string](Get-SIGuardField $v 'Label'); if (-not $lb) { $lb = [string](Get-SIGuardField $v 'Name') }
|            return [pscustomobject]@{ Decision = 'stays'; Reason = ('still outside its limit: {0} {1} (limit {2})' -f $lb, (Get-SIGuardField $v 'Measured'), (Get-SIGuardField $v 'Limit')) }
|        }
|    }
|    [pscustomobject]@{ Decision = 'cleared'; Reason = 'a complete run is back at the normal level' }
|}
|
|function Format-SIGuardClearText {
|    <# PURE. The plain sentence of a clear: "Back to normal in run <id> on version <v>." (+ the run's own words), or for an
|       acceptance "Accepted by <who>: <reason>." #>
|    param([ValidateSet('passed', 'released', 'accepted', 'taken')][string]$How = 'passed', [string]$RunId, [string]$Version, [string]$Detail, [string]$By, [string]$Reason)
|    $t = switch ($How) {
|        'accepted' { 'Accepted by {0}: {1}' -f $(if ($By) { $By } else { 'the owner' }), $(if ($Reason) { $Reason.Trim().TrimEnd('.') } else { 'no reason given' }) }
|        'released' { 'Released by {0}' -f $(if ($By) { $By } else { 'an Admin' }) }
|        # NOT a heal (owner review 2026-10-17): the lower level is real as far as SecurityInsight can tell
|        'taken'    { 'Taken as the new level after 2 runs at the same level -- not back to normal; check the source if this drop is not expected' }
|        default    { 'Back to normal in run {0} on version {1}' -f $(if ($RunId) { $RunId } else { '(unknown)' }), $(if ($Version) { $Version } else { '(unknown)' }) }
|    }
|    $t = $t.TrimEnd('.') + '.'
|    if (([string]$Detail).Trim()) { $t += ' ' + ([string]$Detail).Trim() }
|    $t
|}
|
|# =====================================================================================================================
|#  3. ACCEPT -- PURE coverage
|# =====================================================================================================================
|function Test-SIGuardAcceptCovers {
|    <#
|        PURE. Does an owner's acceptance cover this trip? -Accepts: cfg.GuardAccept rows of the guard (GuardKey, FromVersion,
|        ToVersion, AcceptedUtc, RevokedUtc). Covered = the same guard key (an acceptance without a key covers every key of
|        the guard), the trip's version inside [FromVersion, ToVersion], and -- for an acceptance with NO upper bound -- only a
|        trip at or before the acceptance (an open-ended acceptance never mutes the future). Returns the covering row or $null.
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Accepts, [Parameter(Mandatory)][string]$GuardKey, [AllowEmptyString()][string]$Version, [Parameter(Mandatory)][datetime]$TimeUtc)
|    foreach ($a in @($Accepts | Where-Object { $_ })) {
|        if ($null -ne (Get-SIGuardField $a 'RevokedUtc')) { continue }
|        $k = ([string](Get-SIGuardField $a 'GuardKey')).Trim()
|        if ($k -and $k.ToLowerInvariant() -ne $GuardKey.ToLowerInvariant()) { continue }
|        $from = [string](Get-SIGuardField $a 'FromVersion'); $to = [string](Get-SIGuardField $a 'ToVersion')
|        if (-not (Test-SIGuardVersionInRange -Version $Version -From $from -To $to)) { continue }
|        if (-not $to.Trim()) {
|            $at = ConvertTo-SIGuardHealUtc (Get-SIGuardField $a 'AcceptedUtc')
|            if ($null -eq $at -or $TimeUtc.ToUniversalTime() -gt $at) { continue }
|        }
|        return $a
|    }
|    $null
|}
|
|# =====================================================================================================================
|#  The SQL (sql\si-pro-settings.sql: the #733 columns, cfg.GuardAccept). Every statement survives a database the
|#  update has not reached yet: the new columns are written through a guarded dynamic statement.
|# =====================================================================================================================
|function Get-SIGuardHealSql {
|    param([Parameter(Mandatory)][ValidateSet('StateExtra', 'EventInfo', 'AcceptRead')][string]$Name)
|    switch ($Name) {
|        'StateExtra' { @'
|IF COL_LENGTH(N'cfg.GuardState', N'ClearedUtc') IS NOT NULL
|    EXEC sp_executesql N'UPDATE cfg.GuardState SET Version = @v, PreviousVersion = @pv, FirstRunId = @fr, MarkerKind = @mk, ClearedUtc = @cu, ClearedRunId = @cr, ClearedVersion = @cv, ClearedHow = @ch WHERE GuardKey = @k',
|        N'@k nvarchar(500), @v nvarchar(64), @pv nvarchar(64), @fr nvarchar(64), @mk nvarchar(16), @cu datetime2(0), @cr nvarchar(64), @cv nvarchar(64), @ch nvarchar(16)',
|        @k = @GuardKey, @v = @Version, @pv = @PreviousVersion, @fr = @FirstRunId, @mk = @MarkerKind, @cu = @ClearedUtc, @cr = @ClearedRunId, @cv = @ClearedVersion, @ch = @ClearedHow;
|'@ }
|        'EventInfo' { @'
|IF COL_LENGTH(N'cfg.GuardEvent', N'Attribution') IS NOT NULL
|    EXEC sp_executesql N'UPDATE cfg.GuardEvent SET SiVersion = @v, PreviousVersion = @pv, Attribution = @a WHERE Id = @id',
|        N'@id bigint, @v nvarchar(64), @pv nvarchar(64), @a nvarchar(400)', @id = @Id, @v = @SiVersion, @pv = @PreviousVersion, @a = @Attribution;
|'@ }
|        'AcceptRead' { "IF OBJECT_ID(N'cfg.GuardAccept') IS NULL SELECT CAST(NULL AS BIGINT) AS AcceptId WHERE 1 = 0; ELSE SELECT AcceptId, GuardKey, FromVersion, ToVersion, AcceptedBy, AcceptedUtc, RevokedUtc FROM cfg.GuardAccept WHERE GuardId = @GuardId;" }
|    }
|}
|
|function Get-SIGuardStateExtraParams {
|    <# PURE. The #733 fields of a state (episode or marker) as the 'StateExtra' statement's parameters. #>
|    param([Parameter(Mandatory)][string]$Key, $State)
|    $s = { param($n, $max) $x = [string](Get-SIGuardField $State $n); if ($x.Length -gt $max) { $x = $x.Substring(0, $max) }; if ($x) { $x } else { $null } }
|    @{ GuardKey = $Key; Version = (& $s 'Version' 64); PreviousVersion = (& $s 'PreviousVersion' 64); FirstRunId = (& $s 'FirstRunId' 64)
|       MarkerKind = (& $s 'MarkerKind' 16); ClearedUtc = (ConvertTo-SIGuardHealUtc (Get-SIGuardField $State 'ClearedUtc'))
|       ClearedRunId = (& $s 'ClearedRunId' 64); ClearedVersion = (& $s 'ClearedVersion' 64); ClearedHow = (& $s 'ClearedHow' 16) }
|}
|
|function ConvertTo-SIGuardMarkerState {
|    <# PURE. A marker as a state row (GuardState's columns): SinceUtc -> FirstSeenUtc, FirstRunTripped -> TripCount. #>
|    param([Parameter(Mandatory)]$Marker, [Parameter(Mandatory)][datetime]$NowUtc)
|    [pscustomobject]@{ FirstSeenUtc = $(if ($Marker.SinceUtc) { $Marker.SinceUtc } else { $NowUtc }); LastSeenUtc = $NowUtc; TripCount = $(if ($Marker.FirstRunTripped) { 1 } else { 0 }); LastMailUtc = $null
|                       Version = $Marker.Version; PreviousVersion = $Marker.PreviousVersion; FirstRunId = $Marker.FirstRunId; MarkerKind = $Marker.Kind
|                       SinceUtc = $Marker.SinceUtc; FirstRunTripped = [bool]$Marker.FirstRunTripped }
|}
|
|# =====================================================================================================================
|#  Talking to the store -- never throws
|# =====================================================================================================================
|function Resolve-SIGuardStore {
|    <# The (store, has-tables, invoke) a guard step uses: the -StateStore handed in, else the Pro database's when it has the
|       guard tables, else (a test session) the process's memory store, else the file store. Never throws. #>
|    param([scriptblock]$Invoke, $StateStore)
|    $isTest = [bool](Get-Module -Name Pester)
|    # #735: the same database the trips are written to -- a cleared episode shows on the Guards view next to its trip
|    if (Get-Command -Name Resolve-SIGuardEventInvoke -ErrorAction SilentlyContinue) { $Invoke = Resolve-SIGuardEventInvoke -Invoke $Invoke -IsTest $isTest }
|    elseif (-not $Invoke -and $global:SI_GuardInvoke -is [scriptblock] -and -not $isTest) { $Invoke = $global:SI_GuardInvoke }
|    $has = $false
|    if ($Invoke) { try { $has = ([int](& $Invoke (Get-SIGuardSql 'Exists') @{} 'scalar') -eq 1) } catch { $has = $false } }
|    if (-not $StateStore) {
|        if ($has) { $StateStore = New-SIGuardSqlStateStore -Invoke $Invoke }
|        elseif ($isTest) { if (-not $global:SI_GuardTestStore) { $global:SI_GuardTestStore = New-SIGuardMemoryStateStore }; $StateStore = $global:SI_GuardTestStore }
|        else { $StateStore = New-SIGuardFileStateStore -Directory (Get-SIGuardStateDirectory) }
|    }
|    [pscustomobject]@{ Store = $StateStore; HasTables = $has; Invoke = $Invoke; IsTest = $isTest }
|}
|
|function Read-SIGuardVersionMarker {
|    param([Parameter(Mandatory)]$StateStore, [Parameter(Mandatory)][string]$GuardKey)
|    try { return (Get-SIGuardVersionMarker (& $StateStore.Get ((Get-SIGuardHealSettings).MarkerPrefix + $GuardKey))) } catch { return $null }
|}
|
|function Save-SIGuardVersionMarker {
|    param([Parameter(Mandatory)]$StateStore, [Parameter(Mandatory)][string]$GuardKey, [Parameter(Mandatory)][string]$GuardId, $Marker, [Parameter(Mandatory)][datetime]$NowUtc)
|    if (-not $Marker) { return }
|    try { & $StateStore.Set ((Get-SIGuardHealSettings).MarkerPrefix + $GuardKey) $GuardId (ConvertTo-SIGuardMarkerState -Marker $Marker -NowUtc $NowUtc) } catch { }
|}
|
|# =====================================================================================================================
|#  The report to Invardia that a guard is cleared -- PURE builder (Invardia: GuardOutcome 'cleared', ClearedBy, ClearedUtc)
|# =====================================================================================================================
|function New-SIGuardClearTelemetryRecord {
|    <#
|        PURE. The guard report that says cleared (Invardia's receiver: the same report as a trip -- Schema 2, Kind guard,
|        Product, GuardId -- with GuardOutcome 'cleared', ClearedBy 'passed' (the next run passed the guard) or 'released' (a
|        person released or accepted it), ClearedUtc). No Severity, no numbers. ANONYMOUS adds only the InstallId; IDENTIFIED
|        adds ClaimedTenantId, Host and the plain sentence as ActionText (at most 500 characters, redacted).
|    #>
|    param([Parameter(Mandatory)][string]$GuardId, [Parameter(Mandatory)]$Context, [ValidateSet('passed', 'released', 'accepted')][string]$How = 'passed',
|          [Parameter(Mandatory)][datetime]$NowUtc, [string]$Job, [string]$Area, [string]$Text, [string]$HostName)
|    $anon = ([string]$Context.Mode -eq 'anonymous')
|    $iso = $NowUtc.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture)
|    $r = [ordered]@{ Schema = 2; Kind = 'guard'; Product = 'securityinsight' }
|    $ver = "$($Context.Version)".Trim(); if ($ver) { $r.Version = $ver }
|    if ($Context.PSObject.Properties['Ring'] -and $null -ne $Context.Ring -and "$($Context.Ring)" -ne '') { $r.Ring = [int]$Context.Ring }
|    foreach ($k in 'Edition', 'Hosting', 'RuntimeIdentity', 'LicenceState') { if ($Context.PSObject.Properties[$k]) { $val = "$($Context.$k)".Trim(); if ($val) { $r[$k] = $val } } }
|    if ($Job) { $r.Job = $Job }
|    $r.GuardId = $GuardId
|    $r.GuardOutcome = 'cleared'
|    $r.ClearedBy = $(if ($How -eq 'passed') { 'passed' } else { 'released' })
|    $r.ClearedUtc = $iso
|    if ($Area) { $r.Area = $Area }
|    if ($anon) { $r.InstallId = [string]$Context.InstallId }
|    else {
|        $r.ClaimedTenantId = [string]$Context.TenantId
|        $r.Host = $(if ($HostName) { $HostName } else { [string][System.Environment]::MachineName })
|        # Invardia S16: the install's LASTING id (SI-InstallId) on the identified report -- never the anonymous id; none = no field
|        if ($Context.PSObject.Properties['LastingInstallId'] -and (Get-Command -Name ConvertTo-SIInvardiaInstallId -ErrorAction SilentlyContinue)) {
|            $lid = ConvertTo-SIInvardiaInstallId ([string]$Context.LastingInstallId); if ($lid) { $r.InstallId = $lid }
|        }
|        $t = [string]$Text
|        if (Get-Command -Name ConvertTo-AitUplinkRedacted -ErrorAction SilentlyContinue) { try { $t = [string](ConvertTo-AitUplinkRedacted -Text $t) } catch { } }
|        $t = $t.Trim(); if ($t.Length -gt 500) { $t = $t.Substring(0, 497) + '...' }
|        if ($t) { $r.ActionText = $t }
|    }
|    $r.LastSeenUtc = $iso
|    [pscustomobject]$r
|}
|
|# =====================================================================================================================
|#  THE CLEAR -- one call, never throws
|# =====================================================================================================================
|function Send-SIGuardClear {
|    <#
|        Clears one guard episode: the state (ClearedUtc ...), one cfg.GuardEvent row Outcome 'cleared' (Pro), one run-health
|        row 'guard-cleared', one audit event 'guard.event.clear' (Pro), and the report to Invardia (cleared). Nothing is
|        mailed. NEVER throws. Returns @{ Status ('cleared' | 'error'); Text; Telemetry; Stored; RunHealth }.
|        -Episode: the open episode (read by the caller); -How passed | released | accepted; seams as Send-SIGuardEvent.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$GuardId, [string]$Subject, [string]$RunId, [string]$Version, [string]$Engine, [string]$Job,
|        [ValidateSet('passed', 'released', 'accepted', 'taken')][string]$How = 'passed', [string]$Detail, [object[]]$Values = @(), $Episode,
|        [scriptblock]$Invoke, $StateStore, [scriptblock]$TelemetryTransport, $TelemetryContext, [scriptblock]$RunHealth,
|        [System.Collections.IDictionary]$Globals, $Now, [switch]$NoTelemetry, [scriptblock]$Log, [string]$By, [string]$Reason
|    )
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) if ($level -eq 'WARN') { Write-Warning $msg } else { Write-Host (' [{0}] {1}' -f $level, $msg) } } }
|    $res = [ordered]@{ Status = 'error'; Text = ''; Telemetry = [pscustomobject]@{ State = 'not-tried'; Record = $null }; Stored = $false; RunHealth = 'not-tried'; Reason = '' }
|    try {
|        $nowUtc = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|        $def = Get-SIGuardDefinition -Id $GuardId
|        if (-not $RunId) { $RunId = $(if ($global:SI_GuardRunId) { [string]$global:SI_GuardRunId } else { '' }) }
|        if (-not $Version) { $Version = Get-SIGuardRunVersion }
|        $key = Get-SIGuardKeyFor -GuardId $GuardId -Subject $Subject
|        $text = Format-SIGuardClearText -How $How -RunId $RunId -Version $Version -Detail $Detail -By $By -Reason $Reason
|        $res.Text = $text
|        $rs = Resolve-SIGuardStore -Invoke $Invoke -StateStore $StateStore
|        $store = $rs.Store; $Invoke = $rs.Invoke
|        if (-not $Episode) { try { $Episode = & $store.Get $key } catch { $Episode = $null } }
|        $job = if ($Job) { $Job } elseif ([string]$def.job) { [string]$def.job } elseif ($Engine -and (Get-Command -Name Resolve-SITelemetryJob -ErrorAction SilentlyContinue)) { [string](Resolve-SITelemetryJob -Engine $Engine) } else { '' }
|        & $Log 'INFO' ('{0}{1}: {2}' -f $GuardId, $(if ($Subject) { ' (' + $Subject + ')' } else { '' }), $text)
|
|        # ---- the episode, cleared ----
|        $st = [pscustomobject]@{
|            FirstSeenUtc = $(if ($Episode) { ConvertTo-SIGuardHealUtc (Get-SIGuardField $Episode 'FirstSeenUtc') } else { $nowUtc })
|            LastSeenUtc  = $(if ($Episode -and (Get-SIGuardField $Episode 'LastSeenUtc')) { ConvertTo-SIGuardHealUtc (Get-SIGuardField $Episode 'LastSeenUtc') } else { $nowUtc })
|            TripCount    = $(if ($Episode) { [int]('0' + [string](Get-SIGuardField $Episode 'TripCount')) } else { 0 })
|            LastMailUtc  = $(if ($Episode) { ConvertTo-SIGuardHealUtc (Get-SIGuardField $Episode 'LastMailUtc') } else { $null })
|            Version = $(if ($Episode) { [string](Get-SIGuardField $Episode 'Version') } else { '' }); PreviousVersion = $(if ($Episode) { [string](Get-SIGuardField $Episode 'PreviousVersion') } else { '' })
|            ClearedUtc = $nowUtc; ClearedRunId = $RunId; ClearedVersion = $Version; ClearedHow = $How
|        }
|        if ($null -eq $st.FirstSeenUtc) { $st.FirstSeenUtc = $nowUtc }
|        try { & $store.Set $key $GuardId $st } catch { & $Log 'WARN' ('the guard''s clear could not be saved: {0}' -f $_.Exception.Message) }
|
|        # ---- the report to Invardia ----
|        $telState = 'off'; $rec = $null
|        try {
|            # a level TAKEN is not a clear: Invardia is not told the guard cleared (its ticket stays for a person)
|            if ($How -eq 'taken') { $telState = 'not-a-clear' }
|            elseif ($NoTelemetry -or -not (Get-Command -Name Test-SITelemetryEnabled -ErrorAction SilentlyContinue)) { $telState = 'off' }
|            elseif (-not $Globals -and -not (Test-SITelemetryEnabled)) { $telState = 'off' }
|            elseif ($Globals -and -not (Test-SIGuardFlag -Value (Get-SIGuardSetting -Name 'SI_Telemetry_Enabled' -Globals $Globals) -Default $true)) { $telState = 'off' }
|            elseif ($global:SI_TelemetryHalted -and -not $TelemetryTransport) { $telState = 'halted' }
|            elseif (-not $TelemetryTransport -and $rs.IsTest) { $telState = 'test-session' }
|            else {
|                $ctx = if ($TelemetryContext) { $TelemetryContext } else { Get-SITelemetryContext }
|                # Invardia's receiver does not take 'cleared' yet (2026-10-17): with SI_Uplink_SendGuardHealOutcomes off (the
|                # default) the clear is recorded here and NOT reported -- TelemetryState 'off', never sent later in a burst
|                $healOn = (Get-Command -Name Resolve-SIGuardHealOutcomesSwitch -ErrorAction SilentlyContinue) -and (Resolve-SIGuardHealOutcomesSwitch -Ring $ctx.Ring -Globals $Globals).On
|                if (-not $healOn) { $telState = 'off' }
|                else {
|                $rec = New-SIGuardClearTelemetryRecord -GuardId $GuardId -Context $ctx -How $How -NowUtc $nowUtc -Job $job -Area ([string]$def.area) -Text $text
|                if ([string]$ctx.Mode -eq 'anonymous' -and [string]$rec.InstallId -notmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$') { $telState = 'no-install-id'; $rec = $null }
|                else {
|                    if (-not $TelemetryTransport) { $TelemetryTransport = { param($Record, $Endpoint, $AccessCode, $TimeoutSec) if (Get-Command -Name Test-SITelemetryCommunitySendAllowed -ErrorAction SilentlyContinue) { $g = Test-SITelemetryCommunitySendAllowed -AccessCode $AccessCode; if (-not $g.Allowed) { return [pscustomobject]@{ Status = 'skipped'; Reason = $g.Reason; Sent = $false } } }; Send-AitUplink -Record $Record -Endpoint $Endpoint -AccessCode $AccessCode -TimeoutSec $TimeoutSec } }
|                    $r = & $TelemetryTransport $rec $ctx.Endpoint $ctx.AccessCode 5
|                    # a clear that was not accepted is said, not retried, and stops nothing else (the next clear or ok run closes it)
|                    $telState = if ("$($r.Status)" -eq 'ok') { 'sent' } else { 'failed' }
|                }
|                }
|            }
|        } catch { $telState = 'failed'; & $Log 'INFO' ('the guard''s clear could not be reported to Invardia: {0}' -f $_.Exception.Message) }
|        $res.Telemetry = [pscustomobject]@{ State = $telState; Record = $rec }
|
|        # ---- the Guards view row (Pro) ----
|        if ($rs.HasTables) {
|            try {
|                $vals = @($Values | Where-Object { $_ })
|                $id = & $Invoke (Get-SIGuardSql 'Insert') @{
|                    GuardId = $GuardId; GuardKey = $key; Area = [string]$def.area; Job = $job; Engine = $Engine; Source = 'job'
|                    Outcome = $(if ($How -eq 'taken') { 'taken' } else { 'cleared' }); Severity = $(if ($How -eq 'taken') { 'warning' } else { 'info' }); Protected = [string]$def.protects; Subject = ([string]$Subject).Trim(); Detail = $text
|                    MeasuredText = $(if ($vals.Count -and (Get-Command -Name Format-SIGuardValues -ErrorAction SilentlyContinue)) { try { Format-SIGuardValues -Values @(New-SIGuardEvent -GuardId $GuardId -Outcome warning -Values $vals).Values } catch { '' } } else { '' })
|                    ValuesJson = $null; HeldCount = 0L; ActionText = $null; Link = $null; RunId = $RunId; TripCount = [int]$st.TripCount; FirstSeenUtc = $st.FirstSeenUtc
|                    MailState = 'off'; MailTo = $null; TelemetryState = $telState } 'scalar'
|                $res.Stored = $true
|                $nid = 0L
|                if ([long]::TryParse([string]$(if ($id -is [array]) { $id[0] } else { $id }), [ref]$nid) -and $nid -gt 0) {
|                    try { $null = & $Invoke (Get-SIGuardHealSql 'EventInfo') @{ Id = $nid; SiVersion = $(if ($Version) { $Version } else { $null }); PreviousVersion = $null; Attribution = $null } 'nonquery' } catch { }
|                }
|            } catch { & $Log 'WARN' ('the guard''s clear could not be saved for the Guards view: {0}' -f $_.Exception.Message) }
|        }
|
|        # ---- run health ----
|        try {
|            $ctxRh = [pscustomobject]@{ RunId = $RunId; Engine = $(if ($Engine) { $Engine } else { 'guard' }); ShardIndex = 0; ShardCount = 1; CollectionTime = $nowUtc; StartedAt = $nowUtc }
|            $msg = '{0}: {1}' -f $GuardId, $text
|            if ($RunHealth) { $null = & $RunHealth $ctxRh $(if ($How -eq 'taken') { 'guard-taken' } else { 'guard-cleared' }) $msg 0L; $res.RunHealth = 'written' }
|            elseif (Get-Command -Name Send-SIRunHealthRow -ErrorAction SilentlyContinue) {
|                Send-SIRunHealthRow -RunContext $ctxRh -Phase Guard -AssetCount 0 -ExitReason $(if ($How -eq 'taken') { 'guard-taken' } else { 'guard-cleared' }) -ErrorMessage $msg -NoTelemetry
|                $res.RunHealth = 'written'
|            } else { $res.RunHealth = 'unavailable' }
|        } catch { $res.RunHealth = 'failed' }
|
|        # ---- audit (Pro) ----
|        if ($rs.HasTables -and (Get-Command -Name Write-SIAuditEvent -ErrorAction SilentlyContinue)) {
|            try {
|                $actor = if (Get-Command -Name Get-SIAuditActor -ErrorAction SilentlyContinue) { Get-SIAuditActor -Job $(if ($Engine) { $Engine } else { 'guard' }) } else { 'guard' }
|                $null = Write-SIAuditEvent -Invoke $Invoke -Action (Get-SIGuardHealSettings).AuditClear -Actor $actor -ActorSource 'job' -Target $(if ($Subject) { '{0} ({1})' -f $GuardId, $Subject } else { $GuardId }) `
|                        -Reason ([string]$def.protects) -Outcome 'ok' -OutcomeText $text -CorrelationId $RunId -After ([ordered]@{ guard = $GuardId; how = $How; version = $Version; run = $RunId; telemetry = $telState }) -Log { param($l, $m) }
|            } catch { }
|        }
|        $res.Status = 'cleared'
|        return [pscustomobject]$res
|    } catch {
|        $res.Status = 'error'; $res.Reason = [string]$_.Exception.Message
|        try { & $Log 'WARN' ('a guard could not be cleared: {0}. The job itself is not affected.' -f $_.Exception.Message) } catch { }
|        return [pscustomobject]$res
|    }
|}
|
|function ConvertTo-SIGuardCheckList {
|    <# PURE. -Checked as given (guard ids, or @{ GuardId; Subject; Values; Detail }) -> @(@{ GuardId; Subject; Key; Values;
|       Detail }), each key once. -Subject is the default subject of a bare id. #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Checked, [string]$Subject)
|    $seen = @{}
|    foreach ($c in @($Checked | Where-Object { $_ })) {
|        $gid = if ($c -is [string]) { $c } else { [string](Get-SIGuardField $c 'GuardId') }
|        if (-not $gid) { continue }
|        $sub = if ($c -is [string]) { $Subject } else { $s = Get-SIGuardField $c 'Subject'; if ($null -eq $s) { $Subject } else { [string]$s } }
|        $key = Get-SIGuardKeyFor -GuardId $gid -Subject $sub
|        if ($seen.ContainsKey($key)) { continue }
|        $seen[$key] = $true
|        [pscustomobject]@{ GuardId = $gid; Subject = ([string]$sub).Trim(); Key = $key
|                           Values = $(if ($c -is [string]) { @() } else { @(Get-SIGuardField $c 'Values') | Where-Object { $_ } })
|                           Detail = $(if ($c -is [string]) { '' } else { [string](Get-SIGuardField $c 'Detail') })
|                           # 'taken' (a drop confirmed at its new level) closes the episode WITHOUT being a heal; default passed
|                           How = $(if ($c -is [string]) { 'passed' } else { $h = [string](Get-SIGuardField $c 'How'); if ($h -in 'passed', 'taken') { $h } else { 'passed' } }) }
|    }
|}
|
|function Invoke-SIGuardHeal {
|    <#
|        After a step's guard calls: every CHECKED guard (and subject) that did NOT trip in this run records that it ran on
|        this version (its marker, kind 'check'), and -- when the run was -Complete and its values are within their limits --
|        clears an open episode (Send-SIGuardClear, How 'passed'). -Calls: the trips this step sent (their keys are not
|        cleared). -Common: the same extras the trips got (-Invoke, -Engine, -Job, -RunId, -Subject ...). NEVER throws.
|        Returns the clears made.
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$Checked, [AllowNull()][AllowEmptyCollection()][object[]]$Calls = @(), [bool]$Complete = $false,
|          [hashtable]$Common = @{}, [scriptblock]$Log)
|    $out = New-Object System.Collections.Generic.List[object]
|    try {
|        $defSub = if ($Common.ContainsKey('Subject')) { [string]$Common['Subject'] } else { '' }
|        $list = @(ConvertTo-SIGuardCheckList -Checked $Checked -Subject $defSub)
|        if (-not $list.Count) { return , $out.ToArray() }
|        $tripped = @{}
|        foreach ($c in @($Calls | Where-Object { $_ })) {
|            $g = [string](Get-SIGuardField $c 'GuardId'); if (-not $g) { continue }
|            $s = Get-SIGuardField $c 'Subject'; if ($null -eq $s) { $s = $defSub }
|            $tripped[(Get-SIGuardKeyFor -GuardId $g -Subject ([string]$s))] = $true
|        }
|        $rs = Resolve-SIGuardStore -Invoke $(if ($Common.ContainsKey('Invoke')) { $Common['Invoke'] } else { $null }) -StateStore $(if ($Common.ContainsKey('StateStore')) { $Common['StateStore'] } else { $null })
|        $nowUtc = if ($Common.ContainsKey('Now') -and $Common['Now']) { ([datetime]$Common['Now']).ToUniversalTime() } else { [datetime]::UtcNow }
|        $runId = if ($Common.ContainsKey('RunId') -and $Common['RunId']) { [string]$Common['RunId'] } elseif ($global:SI_GuardRunId) { [string]$global:SI_GuardRunId } else { '' }
|        $ver = Get-SIGuardRunVersion
|        $globals = if ($Common.ContainsKey('Globals')) { $Common['Globals'] } else { $null }
|        foreach ($c in $list) {
|            if ($tripped.ContainsKey($c.Key)) { continue }
|            # a guard switched off neither trips nor clears (its own line is said by the trip path)
|            try { if (-not (Test-SIGuardOn -GuardId $c.GuardId -Globals $globals -Quiet)) { continue } } catch { }
|            $m = Read-SIGuardVersionMarker -StateStore $rs.Store -GuardKey $c.Key
|            Save-SIGuardVersionMarker -StateStore $rs.Store -GuardKey $c.Key -GuardId $c.GuardId -Marker (Update-SIGuardVersionMarker -Marker $m -Version $ver -RunId $runId -NowUtc $nowUtc -Kind check -Tripped $false) -NowUtc $nowUtc
|            $ep = $null; try { $ep = & $rs.Store.Get $c.Key } catch { $ep = $null }
|            $d = Get-SIGuardHealDecision -Episode $ep -Key $c.Key -Tripped $false -Complete $Complete -Values @($c.Values)
|            if ($d.Decision -ne 'cleared') {
|                if ($d.Decision -eq 'stays' -and $Log) { & $Log 'INFO' ('{0}{1} stays open: {2}' -f $c.GuardId, $(if ($c.Subject) { ' (' + $c.Subject + ')' } else { '' }), $d.Reason) }
|                continue
|            }
|            $a = @{ GuardId = $c.GuardId; Subject = $c.Subject; RunId = $runId; Version = $ver; How = $(if ($c.How) { $c.How } else { 'passed' }); Detail = $c.Detail; Values = @($c.Values); Episode = $ep; StateStore = $rs.Store }
|            if ($rs.Invoke) { $a['Invoke'] = $rs.Invoke }
|            foreach ($k in 'Engine', 'Job', 'TelemetryTransport', 'TelemetryContext', 'RunHealth', 'Globals', 'Now', 'NoTelemetry') { if ($Common.ContainsKey($k) -and $null -ne $Common[$k]) { $a[$k] = $Common[$k] } }
|            if ($Log) { $a['Log'] = $Log } elseif ($Common.ContainsKey('Log') -and $Common['Log']) { $a['Log'] = $Common['Log'] }
|            $out.Add((Send-SIGuardClear @a))
|        }
|    } catch {
|        try { if ($Log) { & $Log 'WARN' ('the guards could not be checked for a clear: {0}' -f $_.Exception.Message) } else { Write-Warning ('the guards could not be checked for a clear: {0}' -f $_.Exception.Message) } } catch { }
|    }
|    , $out.ToArray()
|}
'@ }
$__siSupportFiles['engine/_shared/data-sql/SI-DataSql.ps1'] = @{ Sha256 = 'f3384150f3e27f72d80980a5dee55a55c3a15b0c921c76da9acf760a685fa610'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight Pro -- the data sync's SQL side (REQUIREMENTS §9.3.3 phase B): the connection, the set-based
|    writes, the daily aggregates and the retention purge, against sql/si-data-schema.sql (schema `sidata`).
|
|    ONE SEAM. Every statement goes through -Invoke: a scriptblock (sql, params-hashtable, mode 'reader'|'nonquery'|
|    'scalar') -- the vulnerability target's seam (engine/asset-cmdb/_shared/SI-VulnTarget.ps1), so the tests replace
|    the database with a fake that records calls. The default opens a connection per call with an Entra token: the
|    container job's MANAGED IDENTITY when $global:SI_UseManagedIdentity, else the engine SPN's CERTIFICATE. No SQL
|    login, no secret. ONE token per ~45 minutes.
|
|    SET-BASED. Rows travel as ONE JSON parameter per chunk and land in one statement (OPENJSON), each chunk in its own
|    transaction. A collection is visible only once its LAST chunk landed and it is marked 'Complete'.
|
|    RETENTION is here, not in the schema file (that one is additive only). It purges sidata collections older than the
|    retention, in batches sized from their measured time; vuln.*, si.* and cfg.* are never touched.
|
|    PS 5.1 safe.
|#>
|
|# The certificate lookup and the SPN token are the identity ledger's (same SPN, same host). Loaded, not copied.
|if (-not (Get-Command -Name 'Get-SILedgerAccessToken' -ErrorAction SilentlyContinue)) {
|    $__ledger = Join-Path (Split-Path -Parent (Split-Path -Parent $PSScriptRoot)) 'data-model\identity\SI-ObjectLedgerStore.ps1'
|    if (Test-Path -LiteralPath $__ledger) { . $__ledger }
|}
|
|function New-SIDataSqlInvoke {
|    <# The default -Invoke: a connection per call, Entra token (managed identity in a container, else certificate). #>
|    param(
|        [Parameter(Mandatory)][string]$Server,
|        [Parameter(Mandatory)][string]$Database,
|        [string]$AppId,
|        [string]$TenantId,
|        [string]$CertThumbprint,
|        # 0 = no limit (owner 2026-10-22: "i accept no limits"): deletes and aggregates touch many rows; long work is batched and says its progress
|        [int]$CommandTimeoutSec = 0,
|        # test seams: -TokenSeam { } -> a token (no sign-in); -Connect { param($Server, $Database, $Token) } -> an open
|        # connection; -Sleep { param($Seconds) }; -StatementWaits = the pauses of the statement retry (Get-SISqlStatementRetryWaits)
|        [scriptblock]$TokenSeam, [scriptblock]$Connect, [scriptblock]$Sleep, [int[]]$StatementWaits
|    )
|    $srv = $Server; $db = $Database; $app = $AppId; $ten = $TenantId; $timeout = $CommandTimeoutSec
|    # the engine's Azure SQL access token goes ONLY to an Azure SQL server (a test's own token seam is never a real token)
|    if (-not (Get-Command -Name New-SISqlConnectionString -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine((Split-Path -Parent $PSScriptRoot), 'SI-OutboundTrust.ps1')) }
|    if (-not $TokenSeam) {
|        $hostWhy = Test-SIAzureSqlHost -Server $Server
|        if ($hostWhy) { throw ("New-SIDataSqlInvoke: the database is not opened -- {0}" -f $hostWhy) }
|    }
|    # the database is a NAME, and the connection string is BUILT: a ';' in a setting never adds a keyword (another server)
|    $dbWhy = Test-SISqlDatabaseName -Database $Database
|    if ($dbWhy) { throw ("New-SIDataSqlInvoke: the database is not opened -- {0}" -f $dbWhy) }
|    $csText = New-SISqlConnectionString -Server $Server -Database $Database
|    # A GetNewClosure() block cannot see functions the caller dot-sourced, so the token function travels INTO the
|    # closure as a value (as in SI-VulnTarget.ps1).
|    if ($TokenSeam) {
|        $getToken = $TokenSeam
|    } elseif ($global:SI_UseManagedIdentity) {
|        if (-not (Get-Command -Name 'Get-SIManagedIdentityToken' -ErrorAction SilentlyContinue)) {
|            throw 'New-SIDataSqlInvoke: managed identity is on but the identity token helper is not loaded -- this sign-in works only inside a SecurityInsight container.'
|        }
|        $miFn = ${function:Get-SIManagedIdentityToken}
|        $getToken = { & $miFn -Resource 'https://database.windows.net/' }.GetNewClosure()
|    } else {
|        if (-not (Get-Command -Name 'Get-SILedgerAccessToken' -ErrorAction SilentlyContinue)) {
|            throw 'New-SIDataSqlInvoke: the SQL token helper (data-model\identity\SI-ObjectLedgerStore.ps1) is not installed.'
|        }
|        if (-not $AppId -or -not $TenantId -or -not $CertThumbprint) {
|            throw 'New-SIDataSqlInvoke: the engine identity (SI_SPN_AppId / SI_SPN_TenantId / SI_SPN_CertThumbprint) is not set.'
|        }
|        $cert = Get-SILedgerCertificate -Thumbprint $CertThumbprint
|        if (-not $cert) { throw ("New-SIDataSqlInvoke: certificate {0} with a private key was not found in LocalMachine or CurrentUser." -f $CertThumbprint) }
|        $tokenFn = ${function:Get-SILedgerAccessToken}
|        $getToken = { & $tokenFn -Certificate $cert -AppId $app -TenantId $ten }.GetNewClosure()
|    }
|    $tokenCache = @{ Token = $null; Until = [datetime]::MinValue }
|    # the shared open-with-retry, as a value (the closure below cannot see dot-sourced functions)
|    if (-not (Get-Command -Name 'Open-SISqlConnectionRetry' -ErrorAction SilentlyContinue)) { . (Join-Path (Split-Path -Parent $PSScriptRoot) 'SI-SqlRetry.ps1') }
|    $openSql = ${function:Open-SISqlConnectionRetry}
|    # the statement retry (SI-SqlRetry.ps1), as values: which failures are Azure SQL's platform answers, and the pauses
|    $isTransient = ${function:Test-SISqlStatementTransient}
|    $waits = if ($PSBoundParameters.ContainsKey('StatementWaits')) { @($StatementWaits) } else { @(Get-SISqlStatementRetryWaits) }
|    $sleepFn = if ($Sleep) { $Sleep } else { { param($s) Start-Sleep -Seconds $s } }
|    $connectFn = $Connect
|    # #738: what a reader on ANOTHER thread needs to make the same connection (Risk Analysis reads its next page while it
|    # posts the current one): the connection string and a current token -- values, never this script block
|    $connInfo = {
|        if (-not $tokenCache.Token -or [datetime]::UtcNow -ge $tokenCache.Until) {
|            $tokenCache.Token = & $getToken
|            $tokenCache.Until = [datetime]::UtcNow.AddMinutes(45)
|        }
|        @{ ConnectionString = $csText; AccessToken = $tokenCache.Token; CommandTimeout = $timeout }
|    }.GetNewClosure()
|    $invoke = {
|        # mode 'stream' (#639): each row is handed to -OnRow ({ param($Row) }, a hashtable) as it is read, never collected;
|        # the answer is the number of rows. 'reader' / 'rows' collect every row -- for a read that is bounded by its query.
|        param([string]$sql, $p, [string]$mode, [scriptblock]$OnRow)
|        # THE OPEN is retried (the shared Open-SISqlConnectionRetry, SI-SqlRetry.ps1): a failover, a serverless resume, a busy
|        # database or a client timeout -- with a fresh token each time (the sweep of 2026-10-22: one 40613 here failed the
|        # whole step). The STATEMENT has its own retry, below.
|        $tok = {
|            param([bool]$Fresh)
|            if ($Fresh -or -not $tokenCache.Token -or [datetime]::UtcNow -ge $tokenCache.Until) {
|                $tokenCache.Token = & $getToken
|                $tokenCache.Until = [datetime]::UtcNow.AddMinutes(45)
|            }
|            $tokenCache.Token
|        }
|        # A STATEMENT that meets one of Azure SQL's platform answers (Test-SISqlStatementTransient: the log not available, a
|        # rollback during recovery, a failover, busy, a reset connection, "a severe error occurred") is run again on a NEW
|        # connection after a pause (Get-SISqlStatementRetryWaits: 6 more attempts over about 9 minutes, owner 2026-10-29), and
|        # the log says so. Live 2026-10-28: one 9001 here ended a 52-hour data sync. Redoing is safe: those answers roll the
|        # statement back; a reset connection may hide a commit, and every writer of the data sync is checked by its own count
|        # (a collection is complete only when its rows equal the source's; the findings per CI and the key figures are
|        # replaced in one checked transaction). NEVER redone: a stream that has handed a row on (it would hand it on twice),
|        # an open that failed (Open-SISqlConnectionRetry retried it already), and every other error (a query defect fails on
|        # attempt 1). Past the last attempt the error is thrown tagged transient-sql (Exception.Data['SIErrorClass']).
|        $state = @{ Delivered = 0L; OpenFailed = $false }
|        $attemptOnce = {
|            $cn = $null
|            try { $cn = $(if ($connectFn) { & $openSql -Server $srv -Database $db -Token $tok -Connect $connectFn } else { & $openSql -Server $srv -Database $db -Token $tok }) }
|            catch { $state.OpenFailed = $true; throw }
|            try {
|                # mode 'session' (no fixed limits, owner 2026-10-22): ONE connection for several plain batches, so #temp tables
|                # live from one step to the next and each step is its own command -- the caller says its progress between them.
|                # -OnRow { param($Run) } gets $Run = { param($Sql, $Mode) } ('scalar' | 'reader' | anything else = no answer);
|                # a batch is sent WITHOUT parameters (a parameterised command runs in sp_executesql, which drops its #temp tables)
|                if ($mode -eq 'session') {
|                    if (-not $OnRow) { throw "SQL mode 'session' needs a step callback (OnRow)." }
|                    $sessionCn = $cn; $sessionTimeout = $timeout
|                    $run = {
|                        param([string]$StepSql, [string]$StepMode)
|                        $sc = $sessionCn.CreateCommand(); $sc.CommandText = $StepSql; $sc.CommandTimeout = $sessionTimeout
|                        switch ($StepMode) {
|                            'scalar' { $v = $sc.ExecuteScalar(); if ($v -is [System.DBNull]) { $null } else { $v } }
|                            'reader' {
|                                $rd = $sc.ExecuteReader(); $out = New-Object System.Collections.Generic.List[object]
|                                try { while ($rd.Read()) { $h = @{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $h[$rd.GetName($i)] = $(if ($rd.IsDBNull($i)) { $null } else { $rd.GetValue($i) }) }; $out.Add($h) } } finally { $rd.Close() }
|                                , $out.ToArray()
|                            }
|                            default { [void]$sc.ExecuteNonQuery() }
|                        }
|                    }.GetNewClosure()
|                    return (& $OnRow $run)
|                }
|                $cmd = $cn.CreateCommand(); $cmd.CommandText = $sql; $cmd.CommandTimeout = $timeout
|                if ($p) { foreach ($k in $p.Keys) { [void]$cmd.Parameters.AddWithValue('@' + $k, $(if ($null -eq $p[$k]) { [System.DBNull]::Value } else { $p[$k] })) } }
|                switch ($mode) {
|                    # 'rows' is the same read as 'reader': the callers of the v3 model (which CIs the collection scope leaves out, the
|                    # finding lifecycle's counts, the finding model's counts) ask for 'rows' -- unanswered, their statements ran
|                    # but nothing came back, so an out-of-scope CI's findings closed as fixed instead of freezing
|                    { $_ -in 'reader', 'rows' } {
|                        $rd = $cmd.ExecuteReader()
|                        $out = New-Object System.Collections.Generic.List[object]
|                        while ($rd.Read()) { $h = @{}; for ($i = 0; $i -lt $rd.FieldCount; $i++) { $h[$rd.GetName($i)] = $rd.GetValue($i) }; $out.Add($h) }
|                        $rd.Close(); , $out.ToArray()
|                    }
|                    'stream' {
|                        if (-not $OnRow) { throw "SQL read mode 'stream' needs a row callback (OnRow)." }
|                        $rd = $cmd.ExecuteReader()
|                        $n = 0L
|                        try {
|                            $names = [string[]]::new($rd.FieldCount)
|                            for ($i = 0; $i -lt $rd.FieldCount; $i++) { $names[$i] = $rd.GetName($i) }
|                            while ($rd.Read()) {
|                                $h = @{}; for ($i = 0; $i -lt $names.Length; $i++) { $h[$names[$i]] = $rd.GetValue($i) }
|                                $state.Delivered++; $null = & $OnRow $h
|                                $n++
|                            }
|                        } finally { $rd.Close() }
|                        $n
|                    }
|                    'scalar' { $cmd.ExecuteScalar() }
|                    default  { [void]$cmd.ExecuteNonQuery() }
|                }
|            } catch {
|                # a broken connection is not handed out again by the pool
|                if ($cn -is [System.Data.SqlClient.SqlConnection]) { try { [System.Data.SqlClient.SqlConnection]::ClearPool($cn) } catch { } }
|                throw
|            } finally { if ($cn) { $cn.Dispose() } }
|        }
|        $try = 0
|        while ($true) {
|            try { & $attemptOnce; break }
|            catch {
|                $err = $_
|                $transient = [bool](& $isTransient $err)
|                if (-not $transient -or $state.OpenFailed) { throw }
|                $first = (([string]$err.Exception.Message) -split "`n")[0].Trim()
|                if ($state.Delivered -gt 0 -or $try -ge @($waits).Count) {
|                    $why = if ($state.Delivered -gt 0) { '{0:N0} row(s) were already read, so the read is not repeated' -f $state.Delivered } else { 'it was tried {0} time(s)' -f ($try + 1) }
|                    $ex = New-Object System.Exception(('the database {0} answered a temporary Azure SQL error ({1}); {2} -- transient-sql' -f $db, $first, $why), $err.Exception)
|                    $ex.Data['SIErrorClass'] = 'transient-sql'
|                    throw $ex
|                }
|                $w = [int]@($waits)[$try]; $try++
|                Write-Host ('       the database {0} answered a temporary Azure SQL error ({1}) -- connecting again and running the statement again in {2} s ({3}/{4})' -f $db, $first, $w, $try, @($waits).Count) -ForegroundColor DarkYellow
|                if ($w -gt 0) { & $sleepFn $w }
|            }
|        }
|    }.GetNewClosure()
|    $invoke | Add-Member -NotePropertyName SIConnectionInfo -NotePropertyValue $connInfo
|    # the database this seam writes to: the write pacing (SI-SqlPacing.ps1) reads ITS load -- only a seam marked so is read
|    $invoke | Add-Member -NotePropertyName SISqlTarget -NotePropertyValue ([pscustomobject]@{ Server = $srv; Database = $db })
|    # this seam reads row by row (mode 'stream', Invoke-SIDataSqlStream)
|    $invoke | Add-Member -NotePropertyName SISqlStream -NotePropertyValue $true
|    # this seam runs several batches on one connection (mode 'session': the key figures in steps, with progress)
|    $invoke | Add-Member -NotePropertyName SISqlSession -NotePropertyValue $true
|    # 2026-10-29 this seam runs the data sync's heavy steps in key ranges, each range one command (SI-DataCi.ps1 "KEY RANGES")
|    $invoke | Add-Member -NotePropertyName SISqlRanged -NotePropertyValue $true
|    $invoke
|}
|
|function Invoke-SIDataSqlStream {
|    <#
|        #639: a SQL read of ANY size, a row (or a page) at a time -- never every row collected. -OnRow { param($Row) } gets
|        each row (a hashtable: column -> value) as it is read; -OnPage { param($Rows) } gets them in pages of -PageRows
|        (both may be given). Returns the number of rows read.
|        A seam that reads row by row (New-SIDataSqlInvoke, marked SISqlStream) is asked in mode 'stream'; any other seam (a
|        test's fake) is asked in mode 'reader' and its rows are handed on the same way -- the same callbacks either way.
|        The 'reader' mode stays for reads bounded by their query (a count, a TOP, one key).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$Sql, $Params, [scriptblock]$OnRow,
|          [scriptblock]$OnPage, [int]$PageRows = 5000)
|    if (-not $OnRow -and -not $OnPage) { throw 'Invoke-SIDataSqlStream: give -OnRow or -OnPage.' }
|    if ($PageRows -lt 1) { $PageRows = 1 }
|    $state = @{ Page = (New-Object System.Collections.Generic.List[object]) }
|    $__on = $OnRow; $__pg = $OnPage; $__n = $PageRows
|    $each = {
|        param($Row)
|        if ($__on) { $null = & $__on $Row }
|        if ($__pg) {
|            $state.Page.Add($Row)
|            if ($state.Page.Count -ge $__n) { $pg = $state.Page.ToArray(); $state.Page.Clear(); $null = & $__pg $pg }
|        }
|    }.GetNewClosure()
|    $n = 0L
|    $streams = [bool]($Invoke.PSObject.Properties['SISqlStream'] -and $Invoke.SISqlStream)
|    if ($streams) {
|        $n = [long](& $Invoke $Sql $Params 'stream' $each)
|    } else {
|        # (a seam answers its rows as ONE array: , $rows -- assigned, then walked)
|        $got = & $Invoke $Sql $Params 'reader'
|        foreach ($r in @($got)) { if ($null -eq $r) { continue }; & $each $r; $n++ }
|        $got = $null
|    }
|    if ($__pg -and $state.Page.Count -gt 0) { $pg = $state.Page.ToArray(); $state.Page.Clear(); $null = & $__pg $pg }
|    $n
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE STATEMENTS -- pure text, so their shape is testable
|# ------------------------------------------------------------------------------------------------------------------
|
|function Get-SIDataSchemaCheckSql {
|    "SELECT CASE WHEN OBJECT_ID('sidata.Collection') IS NOT NULL AND OBJECT_ID('sidata.Finding') IS NOT NULL AND OBJECT_ID('sidata.FindingDaily') IS NOT NULL AND OBJECT_ID('sidata.VulnLifecycleDaily') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Get-SIDataLoadedSql {
|    # #638: with who wrote it (Source 'risk-analysis' = Risk Analysis wrote it itself -- never loaded from Log Analytics again)
|    # #717: and whether the retention removed its rows (Retired = 1) -- such a collection is never loaded again either
|    @"
|IF COL_LENGTH('sidata.Collection', 'Source') IS NULL
|    SELECT CollectionId, CollectionTime, Status, CAST(NULL AS nvarchar(16)) AS Source FROM sidata.Collection WHERE Kind = @Kind AND CollectionTime >= CONVERT(datetime2(3), @Since, 126);
|ELSE IF COL_LENGTH('sidata.Collection', 'RetiredAt') IS NULL
|    EXEC sp_executesql N'SELECT CollectionId, CollectionTime, Status, Source FROM sidata.Collection WHERE Kind = @Kind AND CollectionTime >= CONVERT(datetime2(3), @Since, 126)', N'@Kind nvarchar(16), @Since nvarchar(40)', @Kind = @Kind, @Since = @Since;
|ELSE EXEC sp_executesql N'SELECT CollectionId, CollectionTime, Status, Source, CASE WHEN RetiredAt IS NULL THEN 0 ELSE 1 END AS Retired FROM sidata.Collection WHERE Kind = @Kind AND CollectionTime >= CONVERT(datetime2(3), @Since, 126)', N'@Kind nvarchar(16), @Since nvarchar(40)', @Kind = @Kind, @Since = @Since;
|"@
|}
|
|function Get-SIDataRunUpsertSql {
|    @'
|IF NOT EXISTS (SELECT 1 FROM sidata.Run WHERE RunId = @RunId)
|INSERT sidata.Run (RunId, Engine, CollectionTime, Verdict, StartedAt, EndedAt, SolutionVersion)
|VALUES (@RunId, @Engine, CONVERT(datetime2(3), @CollectionTime, 126), @Verdict,
|        CONVERT(datetime2(3), NULLIF(@StartedAt, ''), 126), CONVERT(datetime2(3), NULLIF(@EndedAt, ''), 126), NULLIF(@SolutionVersion, ''));
|'@
|}
|
|function Get-SIDataNewCollectionSql {
|    @'
|INSERT sidata.Collection (CollectionTime, Kind, RunId, Status, SolutionVersion)
|OUTPUT inserted.CollectionId
|VALUES (CONVERT(datetime2(3), @CollectionTime, 126), @Kind, NULLIF(@RunId, ''), 'Loading', NULLIF(@SolutionVersion, ''));
|'@
|}
|
|function Get-SIDataCompleteCollectionSql {
|    # Only a 'Loading' collection whose finding count equals what Log Analytics held is marked complete.
|    @'
|UPDATE sidata.Collection SET Status = 'Complete', [Rows] = @Rows, LoadedAt = SYSUTCDATETIME()
|WHERE CollectionId = @CollectionId AND Status = 'Loading'
|  AND (SELECT COUNT_BIG(*) FROM sidata.Finding WHERE CollectionId = @CollectionId) = @Rows;
|SELECT @@ROWCOUNT;
|'@
|}
|
|function Get-SIDataInsertFindingSql {
|    @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|INSERT sidata.Finding (CollectionId, AssetKey, AssetName, ReportName, SecurityDomain, ConfigurationId, Cve, Title, Severity, Tier, RiskScore, DetailJson,
|                       ExemptionId, ExemptedUntil, ExemptionRequestId)
|SELECT @CollectionId, NULLIF(j.AssetKey, ''), NULLIF(j.AssetName, ''), NULLIF(j.ReportName, ''), NULLIF(j.SecurityDomain, ''),
|       NULLIF(j.ConfigurationId, ''), NULLIF(j.Cve, ''), NULLIF(j.Title, ''), NULLIF(j.Severity, ''), j.Tier, j.RiskScore, j.DetailJson,
|       j.ExemptionId, CONVERT(datetime2(0), NULLIF(j.ExemptedUntil, ''), 126), j.ExemptionRequestId
|FROM OPENJSON(@j) WITH (AssetKey nvarchar(400), AssetName nvarchar(400), ReportName nvarchar(256), SecurityDomain nvarchar(128),
|                        ConfigurationId nvarchar(256), Cve nvarchar(100), Title nvarchar(1000), Severity nvarchar(30), Tier tinyint,
|                        RiskScore float, DetailJson nvarchar(max), ExemptionId bigint, ExemptedUntil nvarchar(40), ExemptionRequestId bigint) j;
|DECLARE @n int = @@ROWCOUNT;
|COMMIT;
|SELECT @n;
|'@
|}
|
|function Get-SIDataFindingTierFromAssetSql {
|    <#
|        A finding loaded WITHOUT a tier, on an asset that HAS one, takes its asset's tier (one collection). The row came
|        from a report whose own link to the profile missed (measured 2026-10-05: an attack-path report returned the same
|        asset twice, with Tier 3 on one row and none on the other) -- the finding was then "Unclassified" while its asset
|        was Tier 3 on the Tier board. A finding's tier is its asset's tier, so the two can no longer disagree.
|        Runs after the assets are written and before the collection is completed (the daily aggregates read it after).
|    #>
|    @'
|SET XACT_ABORT ON;
|UPDATE f SET f.Tier = a.Tier
|FROM sidata.Finding AS f JOIN sidata.Asset AS a ON a.AssetKey = f.AssetKey
|WHERE f.CollectionId = @CollectionId AND f.Tier IS NULL AND a.Tier IS NOT NULL;
|SELECT @@ROWCOUNT;
|'@
|}
|
|function Get-SIDataInsertRecommendationSql {
|    @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|INSERT sidata.Recommendation (CollectionId, AssetKey, RecommendationId, Name, Severity, Tier, DetailJson)
|SELECT @CollectionId, NULLIF(j.AssetKey, ''), NULLIF(j.RecommendationId, ''), NULLIF(j.Name, ''), NULLIF(j.Severity, ''), j.Tier, j.DetailJson
|FROM OPENJSON(@j) WITH (AssetKey nvarchar(400), RecommendationId nvarchar(400), Name nvarchar(1000), Severity nvarchar(30), Tier tinyint,
|                        DetailJson nvarchar(max)) j;
|DECLARE @n int = @@ROWCOUNT;
|COMMIT;
|SELECT @n;
|'@
|}
|
|function Get-SIDataUpsertAssetSql {
|    # Current state: a newer sighting moves LastSeen forward, never back; a value missing this time keeps the old one.
|    @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @a TABLE (AssetKey nvarchar(400) PRIMARY KEY, AssetName nvarchar(400), AssetKind nvarchar(16), AssetKinds nvarchar(64), Tier tinyint,
|                  KeySource nvarchar(16), LastSeen datetime2(3), PropertiesJson nvarchar(max));
|INSERT @a SELECT j.AssetKey, NULLIF(j.AssetName, ''), NULLIF(j.AssetKind, ''), NULLIF(j.AssetKinds, ''), j.Tier, j.KeySource, CONVERT(datetime2(3), j.LastSeen, 126), j.PropertiesJson
|FROM OPENJSON(@j) WITH (AssetKey nvarchar(400), AssetName nvarchar(400), AssetKind nvarchar(16), AssetKinds nvarchar(64), Tier tinyint, KeySource nvarchar(16),
|                        LastSeen nvarchar(40), PropertiesJson nvarchar(max)) j;
|UPDATE t SET AssetName = COALESCE(s.AssetName, t.AssetName), AssetKind = COALESCE(s.AssetKind, t.AssetKind),
|             AssetKinds = COALESCE(s.AssetKinds, t.AssetKinds), Tier = COALESCE(s.Tier, t.Tier),
|             KeySource = s.KeySource, LastSeen = CASE WHEN s.LastSeen > t.LastSeen THEN s.LastSeen ELSE t.LastSeen END,
|             PropertiesJson = COALESCE(s.PropertiesJson, t.PropertiesJson), UpdatedAt = SYSUTCDATETIME()
|FROM sidata.Asset t JOIN @a s ON s.AssetKey = t.AssetKey;
|INSERT sidata.Asset (AssetKey, AssetName, AssetKind, AssetKinds, Tier, KeySource, FirstSeen, LastSeen, PropertiesJson)
|SELECT s.AssetKey, s.AssetName, s.AssetKind, s.AssetKinds, s.Tier, s.KeySource, s.LastSeen, s.LastSeen, s.PropertiesJson
|FROM @a s WHERE NOT EXISTS (SELECT 1 FROM sidata.Asset t WHERE t.AssetKey = s.AssetKey);
|COMMIT;
|SELECT COUNT(*) FROM @a;
|'@
|}
|
|function Get-SIDataUpsertIdentifierSql {
|    @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DECLARE @i TABLE (AssetKey nvarchar(400), IdentifierType nvarchar(64), IdentifierValue nvarchar(256), SeenAt datetime2(3));
|INSERT @i SELECT j.AssetKey, j.IdentifierType, j.IdentifierValue, CONVERT(datetime2(3), j.SeenAt, 126)
|FROM OPENJSON(@j) WITH (AssetKey nvarchar(400), IdentifierType nvarchar(64), IdentifierValue nvarchar(256), SeenAt nvarchar(40)) j;
|UPDATE t SET LastSeen = CASE WHEN s.SeenAt > t.LastSeen THEN s.SeenAt ELSE t.LastSeen END
|FROM sidata.AssetIdentifier t JOIN @i s ON s.AssetKey = t.AssetKey AND s.IdentifierType = t.IdentifierType AND s.IdentifierValue = t.IdentifierValue;
|INSERT sidata.AssetIdentifier (AssetKey, IdentifierType, IdentifierValue, FirstSeen, LastSeen)
|SELECT s.AssetKey, s.IdentifierType, s.IdentifierValue, s.SeenAt, s.SeenAt
|FROM @i s WHERE NOT EXISTS (SELECT 1 FROM sidata.AssetIdentifier t
|                            WHERE t.AssetKey = s.AssetKey AND t.IdentifierType = s.IdentifierType AND t.IdentifierValue = s.IdentifierValue);
|COMMIT;
|SELECT COUNT(*) FROM @i;
|'@
|}
|
|function Get-SIDataScoreMaxColumnSql {
|    <#
|        #245 -- adds FindingDaily.ScoreMax (the highest finding score per group) to a database set up before it existed.
|        The SAME guarded, additive statement as sql/si-data-schema.sql, run before the aggregate is written, so a
|        customer database does not need setup run again for the column to appear. Never alters or drops anything.
|    #>
|    "IF COL_LENGTH('sidata.FindingDaily', 'ScoreMax') IS NULL ALTER TABLE sidata.FindingDaily ADD ScoreMax FLOAT NULL; SELECT 1;"
|}
|
|function Get-SIDataExemptionColumnsSql {
|    <#
|        #264 -- the exemption MARK on sidata.Finding (ExemptionId, ExemptedUntil, ExemptionRequestId) and
|        Collection.ExemptedDerivedAt, added to a database set up before they existed: the SAME guarded, additive statements
|        as sql/si-data-schema.sql, run before a collection is loaded, so every finding lands with its mark even before setup
|        is run again. Also sidata.Asset.AssetKinds (#431, every kind a CI is made of), which the asset upsert writes.
|        Never alters or drops anything. (The counted twin TABLES come with setup; see
|        Get-SIDataExemptedSchemaCheckSql.)
|    #>
|    @'
|IF COL_LENGTH('sidata.Finding', 'ExemptionId') IS NULL ALTER TABLE sidata.Finding ADD ExemptionId BIGINT NULL;
|IF COL_LENGTH('sidata.Finding', 'ExemptedUntil') IS NULL ALTER TABLE sidata.Finding ADD ExemptedUntil DATETIME2(0) NULL;
|IF COL_LENGTH('sidata.Finding', 'ExemptionRequestId') IS NULL ALTER TABLE sidata.Finding ADD ExemptionRequestId BIGINT NULL;
|IF COL_LENGTH('sidata.Collection', 'ExemptedDerivedAt') IS NULL ALTER TABLE sidata.Collection ADD ExemptedDerivedAt DATETIME2(0) NULL;
|IF COL_LENGTH('sidata.Asset', 'AssetKinds') IS NULL ALTER TABLE sidata.Asset ADD AssetKinds NVARCHAR(64) NULL;
|SELECT 1;
|'@
|}
|
|function Get-SIDataPartialTableSql {
|    <#
|        A collection an Admin RELEASED although its run was not shown complete (Operations > Guards (safety checks), "Release: load this
|        collection anyway") is loaded ONCE and MARKED PARTIAL here (sidata.CollectionPartial: the reason, who released it,
|        when) -- the web app shows a "partial" badge wherever the collection is used (working rule 4: a partial result is
|        never shown as whole). The SAME guarded, additive statement as sql/si-data-schema.sql, run before such a load, so a
|        database does not need setup run again for it. Never alters or drops anything.
|    #>
|    @'
|IF OBJECT_ID('sidata.CollectionPartial') IS NULL
|CREATE TABLE sidata.CollectionPartial (
|    CollectionId     INT            NOT NULL CONSTRAINT PK_CollectionPartial PRIMARY KEY,
|    Reason           NVARCHAR(2000) NULL,
|    ReleasedBy       NVARCHAR(256)  NULL,
|    ReleasedUtc      DATETIME2(0)   NULL,
|    MarkedUtc        DATETIME2(0)   NOT NULL CONSTRAINT DF_CollectionPartial_MarkedUtc DEFAULT SYSUTCDATETIME()
|);
|SELECT 1;
|'@
|}
|
|function Get-SIDataMarkPartialSql {
|    <# One released collection, just loaded, marked partial (once); marks of collections that are gone are cleared. #>
|    @'
|DELETE FROM sidata.CollectionPartial WHERE NOT EXISTS (SELECT 1 FROM sidata.Collection AS c WHERE c.CollectionId = sidata.CollectionPartial.CollectionId);
|IF NOT EXISTS (SELECT 1 FROM sidata.CollectionPartial WHERE CollectionId = @CollectionId)
|INSERT sidata.CollectionPartial (CollectionId, Reason, ReleasedBy, ReleasedUtc)
|VALUES (@CollectionId, LEFT(@Reason, 2000), NULLIF(@By, ''), TRY_CONVERT(datetime2(0), NULLIF(@ReleasedUtc, ''), 126));
|SELECT 1;
|'@
|}
|
|function Get-SIDataFindingDailySql {
|    <#
|        The day's aggregate = the LATEST complete Detailed collection of that day, replacing whatever the day held.
|        Per group: findings, assets, the score total (kept ONLY so an average can be formed: ScoreTotal / Findings) and
|        the HIGHEST finding score (ScoreMax, #245). The web app shows the average and the highest, never the total.
|        -Counted (#264): the same day into sidata.FindingDailyCounted over the findings WITHOUT an exemption mark -- the
|        counted twin a dashboard reads when exempted findings are not counted.
|    #>
|    param([switch]$Counted)
|    $table = 'FindingDaily'; $mark = ''; $assets = 'AssetDaily'
|    if ($Counted) { $table = 'FindingDailyCounted'; $mark = ' AND f.ExemptionId IS NULL'; $assets = 'AssetDailyCounted' }
|    # #295: in the same transaction, the day's DISTINCT assets at every grain (sidata.AssetDaily, a CUBE of the four
|    # columns) -- the per-group Assets above is distinct only within its own group and must never be added up. Only where
|    # the table exists (the data sync adds it, Get-SIDataAssetDailyTablesSql): deferred name resolution, never executed
|    # otherwise.
|    (@'
|SET XACT_ABORT ON;
|DECLARE @d date = CONVERT(date, @Day, 126);
|DECLARE @c int = (SELECT TOP (1) CollectionId FROM sidata.Collection
|                  WHERE Kind = 'Detailed' AND Status = 'Complete' AND CollectionTime >= @d AND CollectionTime < DATEADD(day, 1, @d)
|                  ORDER BY CollectionTime DESC);
|-- #717: the day's collection had its finding rows removed by the retention -- its stored day totals are what is left of
|-- it, so they are KEPT as they are (never recomputed from no rows)
|IF @c IS NOT NULL AND COL_LENGTH('sidata.Collection', 'RetiredAt') IS NOT NULL
|BEGIN
|    DECLARE @gone int = 0;
|    EXEC sp_executesql N'SELECT @g = COUNT(*) FROM sidata.Collection WHERE CollectionId = @c AND RetiredAt IS NOT NULL', N'@c int, @g int OUTPUT', @c = @c, @g = @gone OUTPUT;
|    IF @gone > 0 BEGIN SELECT 0; RETURN; END
|END
|BEGIN TRAN;
|DELETE FROM sidata.{TABLE} WHERE [Day] = @d;
|-- #855: the CI lifecycle is a KEY of every row (an asset has exactly one lifecycle, so the distinct assets of two lifecycles
|-- add up); a view reads the lifecycle a person chose (default: active)
|INSERT sidata.{TABLE} ([Day], CollectionId, Tier, Severity, SecurityDomain, ReportName, Findings, Assets, ScoreTotal, ScoreMax, CiLifecycle)
|SELECT @d, @c, f.Tier, ISNULL(f.Severity, ''), ISNULL(f.SecurityDomain, ''), ISNULL(f.ReportName, ''),
|       COUNT(*), COUNT(DISTINCT f.AssetKey), ISNULL(SUM(f.RiskScore), 0), MAX(f.RiskScore), f.CiLifecycle
|FROM sidata.Finding f
|WHERE @c IS NOT NULL AND f.CollectionId = @c{MARK}
|GROUP BY f.CiLifecycle, f.Tier, ISNULL(f.Severity, ''), ISNULL(f.SecurityDomain, ''), ISNULL(f.ReportName, '');
|DECLARE @n int = @@ROWCOUNT;
|IF OBJECT_ID('sidata.{ASSETS}') IS NOT NULL
|BEGIN
|    DELETE FROM sidata.{ASSETS} WHERE [Day] = @d;
|    -- GroupingId stays the CUBE of the four columns; the lifecycle is never grouped away
|    INSERT sidata.{ASSETS} ([Day], CollectionId, GroupingId, Tier, Severity, SecurityDomain, ReportName, Assets, CiLifecycle)
|    SELECT @d, @c, GROUPING_ID(g.Tier, g.Sev, g.Dom, g.Rep), g.Tier, g.Sev, g.Dom, g.Rep, COUNT(DISTINCT g.AssetKey), g.Lc
|    FROM (SELECT f.Tier, ISNULL(f.Severity, '') AS Sev, ISNULL(f.SecurityDomain, '') AS Dom, ISNULL(f.ReportName, '') AS Rep, f.AssetKey, f.CiLifecycle AS Lc
|          FROM sidata.Finding f WHERE @c IS NOT NULL AND f.CollectionId = @c{MARK}) AS g
|    GROUP BY g.Lc, CUBE (g.Tier, g.Sev, g.Dom, g.Rep);
|END;
|COMMIT;
|SELECT @n;
|'@).Replace('{TABLE}', $table).Replace('{MARK}', $mark).Replace('{ASSETS}', $assets)
|}
|
|function Get-SIDataAssetDailyTablesSql {
|    <#
|        #295 -- adds sidata.AssetDaily and its counted twin (the distinct assets at every grain) to a database set up before
|        they existed: the SAME guarded, additive statements as sql/si-data-schema.sql, so a customer database does not need
|        setup run again. Never alters or drops anything.
|    #>
|    $parts = foreach ($t in 'AssetDaily', 'AssetDailyCounted') {
|@"
|IF OBJECT_ID('sidata.$t') IS NULL
|CREATE TABLE sidata.$t (
|    AssetDailyId     BIGINT IDENTITY(1, 1) NOT NULL CONSTRAINT PK_$t PRIMARY KEY NONCLUSTERED,
|    [Day]            DATE           NOT NULL,
|    CollectionId     INT            NOT NULL CONSTRAINT FK_$($t)_Collection REFERENCES sidata.Collection (CollectionId),
|    GroupingId       TINYINT        NOT NULL,
|    Tier             TINYINT        NULL,
|    Severity         NVARCHAR(30)   NULL,
|    SecurityDomain   NVARCHAR(128)  NULL,
|    ReportName       NVARCHAR(256)  NULL,
|    Assets           INT            NOT NULL
|);
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'CX_$($t)_Day' AND object_id = OBJECT_ID('sidata.$t'))
|CREATE CLUSTERED INDEX CX_$($t)_Day ON sidata.$t ([Day], GroupingId);
|IF NOT EXISTS (SELECT 1 FROM sys.indexes WHERE name = 'IX_$($t)_Collection' AND object_id = OBJECT_ID('sidata.$t'))
|CREATE INDEX IX_$($t)_Collection ON sidata.$t (CollectionId);
|"@
|    }
|    ($parts -join "`n") + "`nSELECT 1;"
|}
|
|function Get-SIDataAssetDailyPendingSql {
|    <#
|        #295 -- the days whose FindingDaily has rows but whose distinct-asset grains (AssetDaily) were never computed: every
|        day loaded before the table existed. The data sync recomputes each such day once (Get-SIDataFindingDailySql, and its
|        counted twin where the day's collection has twins). Nothing when the table does not exist yet.
|    #>
|    @'
|DECLARE @q nvarchar(max) = N'SELECT CAST(NULL AS nvarchar(10)) AS [Day], CAST(0 AS bit) AS Counted WHERE 1 = 0';
|IF OBJECT_ID('sidata.AssetDaily') IS NOT NULL
|    SET @q += N' UNION SELECT DISTINCT CONVERT(nvarchar(10), fd.[Day], 23), CAST(0 AS bit) FROM sidata.FindingDaily AS fd
|                 WHERE NOT EXISTS (SELECT 1 FROM sidata.AssetDaily AS ad WHERE ad.[Day] = fd.[Day])';
|IF OBJECT_ID('sidata.AssetDailyCounted') IS NOT NULL AND OBJECT_ID('sidata.FindingDailyCounted') IS NOT NULL
|    SET @q += N' UNION SELECT DISTINCT CONVERT(nvarchar(10), fc.[Day], 23), CAST(1 AS bit) FROM sidata.FindingDailyCounted AS fc
|                 WHERE NOT EXISTS (SELECT 1 FROM sidata.AssetDailyCounted AS ac WHERE ac.[Day] = fc.[Day])';
|SET @q += N' ORDER BY 1, 2';
|EXEC sp_executesql @q;
|'@
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  #855 W10 THE CI LIFECYCLE ON EVERY FINDING (sql\si-data-schema.sql "THE CI LIFECYCLE ON EVERY FINDING")
|# ------------------------------------------------------------------------------------------------------------------
|#  Owner 2026-10-21: "we need to be able to trust all data" / "default filter is active, so it should be active only". Risk
|#  Analysis keeps producing findings for CIs that are not seen or retired; what a view counts is decided by the CI's lifecycle
|#  (sidata.Ci.Lifecycle, the CI build's -- the settings in force), never by a day count of the view's own. Each finding of a
|#  collection is stamped with its CI's lifecycle when the collection is stored, BEFORE it is marked complete and before any
|#  aggregate is built from it, set-based in FindingId ranges sized from their measured time. A collection stored before the
|#  column existed is unstamped (every finding counts as active, as before); the newest one is stamped ONCE and derived again
|#  (Invoke-SIDataCiLifecycleRestamp), so the views are right from the first data sync after the update.
|
|# the derived tables that carry the lifecycle as a key / a column (the schema file's list; the data sync adds the columns too)
|$script:SIDataCiLifecycleTables = @('FindingDaily', 'FindingDailyCounted', 'AssetDaily', 'AssetDailyCounted', 'FindingPivotCell', 'FindingPivotCellCounted',
|                                     'PivotCell', 'AssetRiskSummary', 'AssetRiskSummaryCounted', 'Tier0Asset', 'Tier0AssetCounted', 'CiFindingSummary')
|
|function Get-SIDataCiLifecycleColumnsSql {
|    <#
|        The lifecycle columns -- the SAME guarded, additive statements as sql\si-data-schema.sql (a test holds the two equal),
|        so the data sync of an install whose schema was applied before them adds them itself. A column add is metadata only.
|        Never alters or drops anything.
|    #>
|    $l = New-Object System.Collections.Generic.List[string]
|    $l.Add("IF COL_LENGTH('sidata.Finding', 'CiLifecycle') IS NULL ALTER TABLE sidata.Finding ADD CiLifecycle NVARCHAR(16) NULL;")
|    $l.Add("IF COL_LENGTH('sidata.Collection', 'CiLifecycleAt') IS NULL ALTER TABLE sidata.Collection ADD CiLifecycleAt DATETIME2(0) NULL;")
|    foreach ($t in $script:SIDataCiLifecycleTables) {
|        if ($t -eq 'FindingDaily') { $l.Add("IF COL_LENGTH('sidata.FindingDaily', 'CiLifecycle') IS NULL ALTER TABLE sidata.FindingDaily ADD CiLifecycle NVARCHAR(16) NULL;"); continue }
|        $l.Add("IF COL_LENGTH('sidata.$t', 'CiLifecycle') IS NULL AND OBJECT_ID('sidata.$t') IS NOT NULL ALTER TABLE sidata.$t ADD CiLifecycle NVARCHAR(16) NULL;")
|        if ($t -like 'AssetRiskSummary*') { $l.Add("IF COL_LENGTH('sidata.$t', 'Unclassified') IS NULL AND OBJECT_ID('sidata.$t') IS NOT NULL ALTER TABLE sidata.$t ADD Unclassified BIGINT NULL;") }
|    }
|    # W9: the vulnerabilities' closes by reason
|    foreach ($c in 'ClosedFixed', 'ClosedRetired', 'ClosedOther') { $l.Add("IF COL_LENGTH('sidata.VulnLifecycleDaily', '$c') IS NULL ALTER TABLE sidata.VulnLifecycleDaily ADD $c INT NULL;") }
|    ($l -join "`r`n") + "`r`nSELECT 1;"
|}
|
|function Get-SIDataCiLifecycleReadySql {
|    <# 1 when the findings carry the lifecycle column and the CIs exist to stamp it from; else 0. #>
|    "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'CiLifecycle') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'CiLifecycleAt') IS NOT NULL AND OBJECT_ID('sidata.Ci') IS NOT NULL AND OBJECT_ID('sidata.CiLink') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Get-SIDataCiLifecycleStampSql {
|    <#
|        One FindingId range (@After, @Upto] of one collection: each finding's CI lifecycle, from the CI the key figures resolve
|        (SI-DataKeyFigures.ps1): the CI whose id is the finding's AssetKey, else the CI that carries the AssetKey as a linked
|        object (sidata.CiLink.NativeId, the primary and newest link first). A CI without a lifecycle is active; a finding no CI
|        carries is left NULL (not known to be gone: counted as active). Resolved ONCE per distinct asset of the range, then
|        one set-based update of only the rows whose value differs. Answers the rows written.
|    #>
|    @'
|SET NOCOUNT ON;
|CREATE TABLE #m (AssetKey NVARCHAR(400) COLLATE DATABASE_DEFAULT NOT NULL PRIMARY KEY, Lc NVARCHAR(16) COLLATE DATABASE_DEFAULT NULL);
|INSERT #m (AssetKey, Lc)
|SELECT a.AssetKey,
|       CASE WHEN ci.CiId IS NOT NULL THEN ISNULL(NULLIF(ci.Lifecycle, N''), N'active')
|            WHEN lk.CiId IS NOT NULL THEN ISNULL(NULLIF(lk.Lifecycle, N''), N'active') END
|FROM (SELECT DISTINCT f.AssetKey FROM sidata.Finding AS f
|      WHERE f.CollectionId = @CollectionId AND f.FindingId > @After AND f.FindingId <= @Upto AND f.AssetKey IS NOT NULL) AS a
|LEFT JOIN sidata.Ci AS ci ON LEN(a.AssetKey) <= 64 AND ci.CiId = a.AssetKey
|OUTER APPLY (SELECT TOP (1) l.CiId, c2.Lifecycle FROM sidata.CiLink AS l JOIN sidata.Ci AS c2 ON c2.CiId = l.CiId
|             WHERE ci.CiId IS NULL AND LEN(a.AssetKey) <= 450 AND l.NativeId = LOWER(a.AssetKey)
|             ORDER BY l.IsPrimary DESC, l.LastSeen DESC) AS lk;
|UPDATE f SET CiLifecycle = m.Lc
|FROM sidata.Finding AS f
|JOIN #m AS m ON m.AssetKey = f.AssetKey
|WHERE f.CollectionId = @CollectionId AND f.FindingId > @After AND f.FindingId <= @Upto
|  AND (f.CiLifecycle IS NULL AND m.Lc IS NOT NULL OR f.CiLifecycle IS NOT NULL AND m.Lc IS NULL OR f.CiLifecycle <> m.Lc);
|SELECT @@ROWCOUNT;
|'@
|}
|
|function Get-SIDataCiLifecycleStampedSql {
|    <# The collection's findings are stamped (Collection.CiLifecycleAt). #>
|    "UPDATE sidata.Collection SET CiLifecycleAt = SYSUTCDATETIME() WHERE CollectionId = @CollectionId; SELECT @@ROWCOUNT;"
|}
|
|function Invoke-SIDataCiLifecycleStamp {
|    <#
|        Stamps ONE collection's findings with their CI's lifecycle (Get-SIDataCiLifecycleStampSql) in FindingId ranges sized
|        from their measured time and paced by the database's load (as the derive), then CiLifecycleAt. A database without the
|        column or the CIs stamps nothing (answers -1). Returns the rows written.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][int]$CollectionId, [ref]$BatchSize, [long]$TargetMs = 5000)
|    if (([int](& $Invoke (Get-SIDataCiLifecycleReadySql) @{} 'scalar')) -ne 1) { return -1L }
|    $bRaw = & $Invoke (Get-SIDataFindingBoundsSql) @{ CollectionId = $CollectionId } 'reader'
|    $b = @($bRaw) | Select-Object -First 1
|    $done = 0L
|    if ($b -and $null -ne $b['Lo'] -and -not ($b['Lo'] -is [System.DBNull])) {
|        $lo = [long]$b['Lo']; $hi = [long]$b['Hi']
|        $size = [long]50000; if ($BatchSize -and $BatchSize.Value -gt 0) { $size = [long]$BatchSize.Value }
|        $after = $lo - 1
|        $paced = [bool](Get-Command -Name Invoke-SISqlPacing -ErrorAction SilentlyContinue); $lastMs = 0L
|        $sql = Get-SIDataCiLifecycleStampSql
|        while ($after -lt $hi) {
|            if ($paced) { $pace = Invoke-SISqlPacing -Invoke $Invoke -LastBatchMs $lastMs; if ($pace.Shrink) { $size = [Math]::Max(500L, [long][Math]::Floor($size / 2)) } }
|            $upto = [Math]::Min($hi, $after + $size)
|            $sw = [Diagnostics.Stopwatch]::StartNew()
|            $done += [long](& $Invoke $sql @{ CollectionId = $CollectionId; After = $after; Upto = $upto } 'scalar')
|            $sw.Stop(); $lastMs = $sw.ElapsedMilliseconds
|            $after = $upto
|            $size = Get-SIDataNextSize -Current $size -ElapsedMs $sw.ElapsedMilliseconds -TargetMs $TargetMs -Minimum 500
|        }
|        if ($BatchSize) { $BatchSize.Value = $size }
|    }
|    [void](& $Invoke (Get-SIDataCiLifecycleStampedSql) @{ CollectionId = $CollectionId } 'scalar')
|    $done
|}
|
|function Get-SIDataCiLifecycleRestampSql {
|    <#
|        The collections the views open by default that were stored before the lifecycle was stamped: the newest complete
|        Detailed collection and the published one (sidata.PublishedRun), when their CiLifecycleAt is empty. Older collections
|        stay as they were (their findings count as active -- their trend days are what they were). Never a retired collection.
|    #>
|    $live = Get-SIDataLiveFilter -Alias 'c'
|    @"
|SELECT c.CollectionId, CONVERT(nvarchar(10), c.CollectionTime, 23) AS [Day], c.CollectionTime
|FROM sidata.Collection AS c
|WHERE c.Kind = 'Detailed' AND c.Status = 'Complete' AND c.CiLifecycleAt IS NULL$live
|  AND (c.CollectionId = (SELECT TOP (1) n.CollectionId FROM sidata.Collection AS n WHERE n.Kind = 'Detailed' AND n.Status = 'Complete' ORDER BY n.CollectionTime DESC)
|       OR (OBJECT_ID('sidata.PublishedRun') IS NOT NULL AND c.CollectionId IN (SELECT p.DetailedCollectionId FROM sidata.PublishedRun AS p WHERE p.Name = N'current')))
|ORDER BY c.CollectionTime DESC
|"@
|}
|
|function Get-SIDataCiLifecycleRederiveSql {
|    <#
|        A collection stamped after it was derived is derived again: its views' data (DerivedAt -- the facets, and through it
|        every per-collection aggregate, the prepared context, the summaries, the remediations and the key figures, which are
|        built again when they are older than the derive) and its departments (ResolvedVersion). Its day's FindingDaily is
|        worked out again by the caller.
|    #>
|    "UPDATE sidata.Collection SET DerivedAt = NULL, ResolvedVersion = NULL WHERE CollectionId = @CollectionId; SELECT @@ROWCOUNT;"
|}
|
|function Invoke-SIDataCiLifecycleRestamp {
|    <#
|    .SYNOPSIS  Stamps the newest and the published collection once when they were stored before the lifecycle was stamped, and
|               marks them to be derived again by this run's own steps. Never throws.
|    .NOTES     Returns @{ Status; Collections; Findings }. Bounded: at most these two collections, ever once each.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [switch]$DryRun, [scriptblock]$Log)
|    if (-not $Log) { $Log = { param($l, $m) Write-Host ('[{0}] {1}' -f $l, $m) } }
|    try {
|        if (([int](& $Invoke (Get-SIDataCiLifecycleReadySql) @{} 'scalar')) -ne 1) { return [pscustomobject]@{ Status = 'no-schema'; Collections = 0; Findings = 0 } }
|        $pending = @(@(& $Invoke (Get-SIDataCiLifecycleRestampSql) @{} 'reader') | ForEach-Object { $_ } | Where-Object { $_ })
|        if ($pending.Count -eq 0) { return [pscustomobject]@{ Status = 'ok'; Collections = 0; Findings = 0 } }
|        if ($DryRun) {
|            & $Log 'INFO' ("lifecycle   : {0} collection(s) would be stamped with their CIs' lifecycle and derived again; nothing is written." -f $pending.Count)
|            return [pscustomobject]@{ Status = 'dry-run'; Collections = 0; Findings = 0; Pending = $pending.Count }
|        }
|        $n = 0L; $bs = [long]0
|        foreach ($p in $pending) {
|            $cid = [int]$p['CollectionId']
|            $n += [long](Invoke-SIDataCiLifecycleStamp -Invoke $Invoke -CollectionId $cid -BatchSize ([ref]$bs))
|            [void](& $Invoke (Get-SIDataCiLifecycleRederiveSql) @{ CollectionId = $cid } 'scalar')
|            [void](Invoke-SIDataFindingDaily -Invoke $Invoke -Day ([string]$p['Day']))
|        }
|        & $Log 'OK' ("lifecycle   : {0} collection(s) stamped with their CIs' lifecycle ({1} finding row(s)) -- their views are worked out again in this run, active CIs by default" -f $pending.Count, $n)
|        [pscustomobject]@{ Status = 'ok'; Collections = $pending.Count; Findings = $n }
|    } catch {
|        & $Log 'WARN' ("lifecycle   : the CIs' lifecycle was not stamped on the newest collection this run -- {0}. It is tried again on the next run; until then its findings count as active." -f $_.Exception.Message)
|        [pscustomobject]@{ Status = 'failed'; Error = $_.Exception.Message; Collections = 0; Findings = 0 }
|    }
|}
|
|function Get-SIDataVulnLifecycleSql {
|    <#
|        Every day from the first close-loop event to today: opened, closed (by SI or an engineer), reopened, and the
|        number open at the end of the day (a running sum of the state changes). -1 when the close-loop is not installed.
|        #855 W9: the closes split by reason -- fixed (Remediated), asset retired (AssetRetired), any other reason.
|    #>
|    @'
|SET XACT_ABORT ON;
|IF OBJECT_ID('vuln.VulnerabilityEvent') IS NULL BEGIN SELECT -1; RETURN; END;
|DECLARE @first date = (SELECT CAST(MIN([At]) AS date) FROM vuln.VulnerabilityEvent);
|DECLARE @last date = CAST(SYSUTCDATETIME() AS date);
|IF @first IS NULL BEGIN SELECT 0; RETURN; END;
|CREATE TABLE #lc ([Day] date PRIMARY KEY, Opened int, Closed int, Reopened int, OpenAtEndOfDay int, ClosedFixed int, ClosedRetired int, ClosedOther int);
|WITH firstopen AS (
|    -- #292: THE BASELINE. The first snapshot a source sent is what was already there, not what is new: its Open
|    -- events (the source's first run, or its first day when the run is not recorded) count toward the open total but
|    -- never as "opened". Without this every finding of the connector's first snapshot read as new for a week.
|    SELECT i.Source, MIN(e.[At]) AS FirstAt
|    FROM vuln.VulnerabilityEvent AS e JOIN vuln.VulnerabilityItem AS i ON i.SysId = e.SysId
|    WHERE e.Action = 'Open'
|    GROUP BY i.Source
|), baseline AS (
|    SELECT f.Source, f.FirstAt,
|           (SELECT TOP (1) e2.RunId FROM vuln.VulnerabilityEvent AS e2 JOIN vuln.VulnerabilityItem AS i2 ON i2.SysId = e2.SysId
|             WHERE i2.Source = f.Source AND e2.Action = 'Open' AND e2.[At] = f.FirstAt) AS RunId
|    FROM firstopen AS f
|), ev AS (
|    SELECT CAST(e.[At] AS date) AS [Day],
|           SUM(CASE WHEN e.Action = 'Open'
|                     AND NOT (b.Source IS NOT NULL AND ((b.RunId IS NOT NULL AND e.RunId = b.RunId)
|                                                     OR (b.RunId IS NULL AND CAST(e.[At] AS date) = CAST(b.FirstAt AS date))))
|                    THEN 1 ELSE 0 END) AS Opened,
|           SUM(CASE WHEN e.Action IN ('Close', 'EngineerClose') THEN 1 ELSE 0 END) AS Closed,
|           -- #855 W9: a close is FIXED only when its reason is Remediated; an asset that retired is not fixed work, nor is any other reason
|           SUM(CASE WHEN e.Action IN ('Close', 'EngineerClose') AND LEFT(ISNULL(e.Reason, N''), CHARINDEX(N':', ISNULL(e.Reason, N'') + N':') - 1) = N'Remediated' THEN 1 ELSE 0 END) AS ClosedFixed,
|           SUM(CASE WHEN e.Action IN ('Close', 'EngineerClose') AND LEFT(ISNULL(e.Reason, N''), CHARINDEX(N':', ISNULL(e.Reason, N'') + N':') - 1) = N'AssetRetired' THEN 1 ELSE 0 END) AS ClosedRetired,
|           SUM(CASE WHEN e.Action = 'Reopen' THEN 1 ELSE 0 END) AS Reopened,
|           SUM(CASE WHEN e.ToState = 'Open' AND ISNULL(e.FromState, '') <> 'Open' THEN 1
|                    WHEN e.FromState = 'Open' AND ISNULL(e.ToState, '') <> 'Open' THEN -1 ELSE 0 END) AS Delta
|    FROM vuln.VulnerabilityEvent AS e
|    LEFT JOIN vuln.VulnerabilityItem AS i ON i.SysId = e.SysId
|    LEFT JOIN baseline AS b ON b.Source = i.Source
|    GROUP BY CAST(e.[At] AS date)
|), cal AS (
|    SELECT @first AS [Day] UNION ALL SELECT DATEADD(day, 1, [Day]) FROM cal WHERE [Day] < @last
|)
|INSERT #lc ([Day], Opened, Closed, Reopened, OpenAtEndOfDay, ClosedFixed, ClosedRetired, ClosedOther)
|SELECT cal.[Day], ISNULL(ev.Opened, 0), ISNULL(ev.Closed, 0), ISNULL(ev.Reopened, 0),
|       SUM(ISNULL(ev.Delta, 0)) OVER (ORDER BY cal.[Day] ROWS UNBOUNDED PRECEDING),
|       ISNULL(ev.ClosedFixed, 0), ISNULL(ev.ClosedRetired, 0), ISNULL(ev.Closed, 0) - ISNULL(ev.ClosedFixed, 0) - ISNULL(ev.ClosedRetired, 0)
|FROM cal LEFT JOIN ev ON ev.[Day] = cal.[Day]
|OPTION (MAXRECURSION 0);
|BEGIN TRAN;
|DELETE FROM sidata.VulnLifecycleDaily;
|INSERT sidata.VulnLifecycleDaily ([Day], Opened, Closed, Reopened, OpenAtEndOfDay)
|SELECT [Day], Opened, Closed, Reopened, OpenAtEndOfDay FROM #lc;
|-- #855 W9: the closes by reason, where the database carries the columns (the data sync adds them: Get-SIDataCiLifecycleColumnsSql)
|IF COL_LENGTH('sidata.VulnLifecycleDaily', 'ClosedFixed') IS NOT NULL
|    EXEC sp_executesql N'UPDATE d SET ClosedFixed = l.ClosedFixed, ClosedRetired = l.ClosedRetired, ClosedOther = l.ClosedOther FROM sidata.VulnLifecycleDaily AS d JOIN #lc AS l ON l.[Day] = d.[Day];';
|COMMIT;
|SELECT COUNT(*) FROM #lc;
|'@
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE COLLECTION VIEWS' DATA (#241): columns derived from DetailJson + the per-collection aggregate (sidata.FindingFacet)
|# ------------------------------------------------------------------------------------------------------------------
|
|function Get-SIDataViewsSchemaCheckSql {
|    <# 1 when the database carries the collection views' columns and aggregate table (si-data-schema.sql, #241), else 0. #>
|    "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'RiskRating') IS NOT NULL AND COL_LENGTH('sidata.Finding', 'HasExploit') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'DerivedAt') IS NOT NULL AND OBJECT_ID('sidata.FindingFacet') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Get-SIDataUnderivedSql {
|    <#
|        Complete collections whose views' data is not computed yet -- new loads and, once, every collection loaded earlier.
|        Newest first. -Services (the database carries the Services view's tables, #255): also every collection whose
|        service membership is not computed yet, so an install extended later derives its older collections once.
|    #>
|    param([switch]$Services)
|    # #717: never a collection whose finding rows the retention removed (its aggregates are what is left of it)
|    $live = Get-SIDataLiveFilter
|    if ($Services) { return "SELECT CollectionId, CollectionTime FROM sidata.Collection WHERE Status = 'Complete' AND (DerivedAt IS NULL OR ServicesDerivedAt IS NULL)$live ORDER BY CollectionTime DESC" }
|    "SELECT CollectionId, CollectionTime FROM sidata.Collection WHERE Status = 'Complete' AND DerivedAt IS NULL$live ORDER BY CollectionTime DESC"
|}
|
|function Get-SIDataFindingBoundsSql {
|    "SELECT MIN(FindingId) AS Lo, MAX(FindingId) AS Hi FROM sidata.Finding WHERE CollectionId = @CollectionId"
|}
|
|# #830 / #834 THE RISK ANALYSIS ROW'S VALUES THE READERS READ ON EVERY FINDING, stored once at derive time (si-data-schema.sql
|# "RaRowAssetId ..."): column -> the row's fields, in the order the readers coalesce them; Kind 'value' = the value as text (a
|# list or an object as its JSON text), 'fill' = 1 when the field is not empty or blank (data quality's fill rule). The readers
|# (SI-VulnDesired.ps1, SI-DataQuality.ps1) name the same columns; SIv3-SqlOnlyReaders.Tests.ps1 keeps the three in step.
|$script:SIDataRowColumns = [ordered]@{
|    RaRowAssetId                = @{ Kind = 'value'; Fields = @('AssetId') }
|    RaRowSolutionVersion        = @{ Kind = 'value'; Fields = @('SolutionVersion') }
|    RaRowCriticalityTier        = @{ Kind = 'value'; Fields = @('CriticalityTier') }
|    RaRowSiComponent            = @{ Kind = 'value'; Fields = @('si_component') }
|    RaScopeRiskRating           = @{ Kind = 'value'; Fields = @('RiskRating', 'si_risk_rating') }
|    RaScopeCategory             = @{ Kind = 'value'; Fields = @('si_category', 'Category') }
|    RaScopeSubcategory          = @{ Kind = 'value'; Fields = @('si_subcategory', 'SubCategory', 'Subcategory') }
|    RaScopeClass                = @{ Kind = 'value'; Fields = @('si_class', 'AssetClass') }
|    RaScopeComponent            = @{ Kind = 'value'; Fields = @('si_component', 'Component') }
|    RaScopePatchCycle           = @{ Kind = 'value'; Fields = @('si_patch_cycle') }
|    RaScopeOsFamily             = @{ Kind = 'value'; Fields = @('si_os_family') }
|    RaScopeSubCi                = @{ Kind = 'value'; Fields = @('si_servicenow_subci') }
|    RaScopeAffectedProduct      = @{ Kind = 'value'; Fields = @('si_affected_product') }
|    RaFillRiskFactorProbability = @{ Kind = 'fill'; Fields = @('RiskFactor_Probability_Detailed') }
|    RaFillRiskFactorConsequence = @{ Kind = 'fill'; Fields = @('RiskFactor_Consequence_Detailed') }
|}
|
|function Get-SIDataRowColumnExpr {
|    <#
|        PURE. The SQL that fills one row column from -Json (an expression of the row's JSON text), exactly the readers' former
|        per-finding read: one field = COALESCE(JSON_VALUE, JSON_QUERY); several = the first that is not empty (the readers'
|        coalesce, which skips empty text); 'fill' = 1 when the value trimmed of white space is not empty, else 0.
|    #>
|    param([Parameter(Mandatory)][string]$Column, [string]$Json = 'f.DetailJson',
|          # read from the row's ONE parse (Get-SIDataRowFieldsApply, alias rj) instead of one JSON_VALUE / JSON_QUERY per field --
|          # the same value: the scalar as text (NULL past 4,000 characters, as JSON_VALUE), else the list or object as JSON text
|          [switch]$Parsed)
|    $c = $script:SIDataRowColumns[$Column]; if (-not $c) { throw ("not a row column: '{0}'" -f $Column) }
|    $one = if ($Parsed) { { param([string]$fld) $n = (Get-SIDataRowFieldList).IndexOf($fld); "COALESCE(CASE WHEN LEN(rj.[v$n]) <= 4000 THEN rj.[v$n] END, rj.[j$n])" } }
|           else { { param([string]$fld) "COALESCE(JSON_VALUE($Json, N'$.$fld'), JSON_QUERY($Json, N'$.$fld'))" } }
|    if ($c.Kind -eq 'fill') { return ("CASE WHEN LEN(TRIM(CHAR(9) + CHAR(10) + CHAR(13) + CHAR(32) FROM COALESCE({0}, N''))) > 0 THEN 1 ELSE 0 END" -f (& $one $c.Fields[0])) }
|    if ($c.Fields.Count -eq 1) { return (& $one $c.Fields[0]) }
|    'COALESCE(' + ((@($c.Fields | ForEach-Object { "NULLIF($(& $one $_), N'')" })) -join ', ') + ')'
|}
|
|function Get-SIDataRowFieldList {
|    <# PURE. Every field the row columns read, once each, in a fixed order (the place names its parsed column). #>
|    $flds = New-Object System.Collections.Generic.List[string]
|    foreach ($c in $script:SIDataRowColumns.Values) { foreach ($x in $c.Fields) { if (-not $flds.Contains($x)) { $flds.Add($x) } } }
|    , $flds
|}
|
|function Get-SIDataRowFieldsApply {
|    <#
|        PURE. #834 the row's fields the row columns read, parsed ONCE per finding: OUTER APPLY OPENJSON ... WITH -- for each
|        field its scalar text (v_<field>) and its list or object (j_<field>, AS JSON). Measured at 20,000 findings: one
|        JSON_VALUE + JSON_QUERY per column parsed every row ~30 times more and took the derive from 16.3 to 39.7 s.
|    #>
|    $flds = Get-SIDataRowFieldList
|    # the columns by the field's place (v<n> / j<n>): two fields may differ only in case (SubCategory, Subcategory), and SQL names do not
|    $w = @(for ($i = 0; $i -lt $flds.Count; $i++) { $x = $flds[$i]; "[v$i] nvarchar(max) N'$.$x'"; "[j$i] nvarchar(max) N'$.$x' AS JSON" }) -join ', '
|    "OUTER APPLY OPENJSON(CASE WHEN ISJSON(f.DetailJson) = 1 THEN f.DetailJson END) WITH ($w) AS rj"
|}
|
|function Get-SIDataRowColumnsSql {
|    <#
|        2026-10-25 ONLY the row values ($script:SIDataRowColumns) of one FindingId range: exactly the derive's expressions over
|        exactly the derive's rows (ISJSON = 1), so a collection filled here holds what the derive would have written. The
|        vulnerability step runs BEFORE the data sync and reads the row values typed (set-based, Test-SIVulnSetBasedReady); it
|        fills them here first (Invoke-SIDataRowColumnsFill). -Carried: only the rows the data sync carried in (CarriedFrom),
|        for a collection whose own rows were filled that way (Invoke-SIDataDeriveCollection). Idempotent.
|    #>
|    param([switch]$Carried, [switch]$NoCount)
|    $set = @(foreach ($rc in $script:SIDataRowColumns.Keys) { '    {0} = {1}' -f $rc, (Get-SIDataRowColumnExpr -Column $rc -Parsed) }) -join ",`r`n"
|    $only = if ($Carried) { ' AND f.CarriedFrom IS NOT NULL' } else { '' }
|    $count = if ($NoCount) { '' } else { "`r`nSELECT @@ROWCOUNT;" }
|    "UPDATE f SET`r`n$set`r`nFROM sidata.Finding AS f`r`n$(Get-SIDataRowFieldsApply)`r`nWHERE f.CollectionId = @CollectionId AND f.FindingId > @After AND f.FindingId <= @Upto AND ISJSON(f.DetailJson) = 1$only;$count"
|}
|
|function Get-SIDataDeriveFindingSql {
|    <#
|        One FindingId range of one collection: the views' columns from DetailJson (the whole Log Analytics row). A value
|        Log Analytics stored as an array is read as its items. Lists are stored ';'-separated without padding, so a
|        token filter matches ';' + list + ';'. Re-running a range writes the same values (idempotent).
|        -Services (#255): also the CMDB service the row carried (cmdbId / cmdbName), only when the database has those columns.
|        -Fix (#590): also the finding's fix -- how to fix it, the recommended security update and its id, the affected
|        software (si_fix_remediation / si_fix_recommended_update / si_fix_recommended_update_id / si_affected_software),
|        only when the database has those columns (Get-SIDataFixSchemaCheckSql).
|        -Category (#834): also the Risk Analysis row's Category (RaCategory) -- exactly the expression the Domain -> Category
|        pairs read (Get-SIDataDomainCategorySql), so the pairs come from a narrow index, never every finding's JSON again.
|    #>
|    param([switch]$Services, [switch]$Fix, [switch]$Category,
|          # #830 / #834 also the row values the readers read on every finding ($script:SIDataRowColumns)
|          [switch]$RowColumns,
|          # 2026-10-25 the collection's own rows already carry the row values (the vulnerability step filled them, RaRowsAt):
|          # only the rows the data sync carried in get them here (Get-SIDataRowColumnsSql -Carried)
|          [switch]$CarriedRowColumns)
|    $svc = ''
|    if ($Services) {
|        $svc = ",`r`n    CmdbId            = LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(f.DetailJson, '$.cmdbId'))), N''), 256)," +
|               "`r`n    CmdbName          = LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(f.DetailJson, '$.cmdbName'))), N''), 400)"
|    }
|    if ($Fix) {
|        $svc += ",`r`n    FixRemediation         = LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(f.DetailJson, '$.si_fix_remediation'))), N''), 4000)," +
|                "`r`n    FixRecommendedUpdate   = LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(f.DetailJson, '$.si_fix_recommended_update'))), N''), 1000)," +
|                "`r`n    FixRecommendedUpdateId = LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(f.DetailJson, '$.si_fix_recommended_update_id'))), N''), 1000)," +
|                "`r`n    AffectedSoftware       = LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(f.DetailJson, '$.si_affected_software'))), N''), 2000)"
|    }
|    if ($Category) { $svc += ",`r`n    RaCategory        = LEFT(JSON_VALUE(f.DetailJson, '$.Category'), 128)" }
|    if ($RowColumns) { foreach ($rc in $script:SIDataRowColumns.Keys) { $svc += (",`r`n    {0} = {1}" -f $rc, (Get-SIDataRowColumnExpr -Column $rc -Parsed)) } }
|    $apply = if ($RowColumns) { "`r`n" + (Get-SIDataRowFieldsApply) } else { '' }
|    $tail = if ($CarriedRowColumns -and -not $RowColumns) { "DECLARE @n int = @@ROWCOUNT;`r`n" + (Get-SIDataRowColumnsSql -Carried -NoCount) + "`r`nSELECT @n;" } else { 'SELECT @@ROWCOUNT;' }
|    (@'
|UPDATE f SET
|    RiskScoreWeighted = TRY_CONVERT(float, JSON_VALUE(f.DetailJson, '$.RiskScoreTotal_Weighted')),
|    RiskRating        = LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(f.DetailJson, '$.RiskRating'))), N''), 16),
|    MitreTactics      = LEFT(NULLIF(REPLACE(REPLACE(REPLACE(REPLACE(COALESCE(JSON_VALUE(f.DetailJson, '$.MITRE_Tactics'),
|                            REPLACE(REPLACE(REPLACE(REPLACE(JSON_QUERY(f.DetailJson, '$.MITRE_Tactics'), N'","', N';'), N'[', N''), N']', N''), N'"', N'')),
|                            N', ', N';'), N',', N';'), N'; ', N';'), N' ;', N';'), N''), 1000),
|    MitreTechniques   = LEFT(NULLIF(REPLACE(REPLACE(REPLACE(REPLACE(COALESCE(JSON_VALUE(f.DetailJson, '$.MITRE_Techniques'),
|                            REPLACE(REPLACE(REPLACE(REPLACE(JSON_QUERY(f.DetailJson, '$.MITRE_Techniques'), N'","', N';'), N'[', N''), N']', N''), N'"', N'')),
|                            N', ', N';'), N',', N';'), N'; ', N';'), N' ;', N';'), N''), 2000),
|    ComplianceTags    = LEFT(NULLIF(REPLACE(REPLACE(COALESCE(JSON_VALUE(f.DetailJson, '$.ComplianceTags'),
|                            REPLACE(REPLACE(REPLACE(REPLACE(JSON_QUERY(f.DetailJson, '$.ComplianceTags'), N'","', N';'), N'[', N''), N']', N''), N'"', N'')),
|                            N'; ', N';'), N' ;', N';'), N''), 2000),
|    Cvss              = COALESCE(TRY_CONVERT(float, JSON_VALUE(f.DetailJson, '$.MaxCvssScore')),
|                                 CASE WHEN f.Cve IS NOT NULL THEN TRY_CONVERT(float, JSON_VALUE(f.DetailJson, '$.Impact')) END),
|    HasExploit        = CASE LOWER(JSON_VALUE(f.DetailJson, '$.HasExploit')) WHEN 'true' THEN 1 WHEN '1' THEN 1 WHEN 'false' THEN 0 WHEN '0' THEN 0 END{0}
|FROM sidata.Finding AS f{1}
|WHERE f.CollectionId = @CollectionId AND f.FindingId > @After AND f.FindingId <= @Upto AND ISJSON(f.DetailJson) = 1;
|{2}
|'@).Replace('{0}', $svc).Replace('{1}', $apply).Replace('{2}', $tail)
|}
|
|function Get-SIDataFacetSql {
|    <#
|        The collection's aggregates for the facet views, replacing what it held, and DerivedAt -- one transaction, so a
|        reader sees the old set or the new one, never half. A list value (tactic, technique, tag) counts each finding
|        once per distinct item. CVSS bands are the CVSS v3 qualitative ratings.
|        -Counted (#264): the same aggregates over the findings WITHOUT an exemption mark, into sidata.FindingFacetCounted;
|        DerivedAt is not touched (the exempted step stamps ExemptedDerivedAt; a DerivedAt newer than it makes the twin stale).
|    #>
|    param([switch]$Counted)
|    $table = 'FindingFacet'; $mark = ''
|    $stamp = "UPDATE sidata.Collection SET DerivedAt = SYSUTCDATETIME() WHERE CollectionId = @CollectionId;"
|    if ($Counted) { $table = 'FindingFacetCounted'; $mark = ' AND ExemptionId IS NULL'; $stamp = '' }
|    (@'
|SET XACT_ABORT ON;
|CREATE TABLE #ff (Facet nvarchar(16) NOT NULL, Value nvarchar(256) NOT NULL, Findings int NOT NULL, Assets int NOT NULL,
|                  ScoreTotal float NOT NULL, WeightedTotal float NULL, MaxScore float NULL);
|{FACTS}
|INSERT #ff (Facet, Value, Findings, Assets, ScoreTotal, WeightedTotal, MaxScore)
|SELECT Facet, Value, COUNT(*), COUNT(DISTINCT AssetKey), ISNULL(SUM(RiskScore), 0), SUM(RiskScoreWeighted), MAX(RiskScore)
|FROM d GROUP BY Facet, Value;
|BEGIN TRAN;
|DELETE FROM sidata.{TABLE} WHERE CollectionId = @CollectionId;
|INSERT sidata.{TABLE} (CollectionId, Facet, Value, Findings, Assets, ScoreTotal, WeightedTotal, MaxScore)
|SELECT @CollectionId, Facet, Value, Findings, Assets, ScoreTotal, WeightedTotal, MaxScore FROM #ff;
|DECLARE @n int = @@ROWCOUNT;
|{STAMP}
|COMMIT;
|SELECT @n;
|'@).Replace('{FACTS}', (Get-SIDataFacetFactsSql -Where ('CollectionId = @CollectionId' + $mark))).Replace('{TABLE}', $table).Replace('{STAMP}', $stamp)
|}
|
|function Get-SIDataFacetFactsSql {
|    <#
|        THE facts of the facet aggregates, ONE text for the whole-collection statement (Get-SIDataFacetSql) and the ranged
|        one (Get-SIDataFacetRangeSql): the CTE chain f -> facts -> d over the findings -Where selects -- d is one row per
|        (finding, facet, value), a value counted once per finding. -FixColumn: the recommended update from the finding's
|        stored column (FixRecommendedUpdate, written by the derive with the SAME expression just before) instead of
|        parsing DetailJson again -- the same value, one JSON parse less per finding.
|    #>
|    param([Parameter(Mandatory)][string]$Where, [switch]$FixColumn)
|    $fix = "CASE WHEN ISJSON(DetailJson) = 1 THEN LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(DetailJson, '$.si_fix_recommended_update'))), N''), 1000) END AS FixUpdate"
|    if ($FixColumn) { $fix = 'CASE WHEN ISJSON(DetailJson) = 1 THEN FixRecommendedUpdate END AS FixUpdate' }
|    (@'
|WITH f AS (
|    SELECT FindingId, AssetKey, RiskScore, RiskScoreWeighted, RiskRating, MitreTactics, MitreTechniques, ComplianceTags, Cvss,
|           Severity, Tier, SecurityDomain, ReportName, Category, Subcategory, DepartmentName,
|           CASE WHEN ISJSON(DetailJson) = 1 THEN LEFT(NULLIF(LTRIM(RTRIM(JSON_VALUE(DetailJson, '$.si_component'))), N''), 64) END AS Component,
|           {FIX}
|    -- #855: the facets count ACTIVE CIs only (a finding no CI carries, or of an unstamped collection, counts as active) -- their
|    -- key (CollectionId, Facet, Value) cannot take the lifecycle in an additive schema; the views say so
|    FROM sidata.Finding WHERE {WHERE} AND (CiLifecycle IS NULL OR CiLifecycle = N'active')
|), facts AS (
|    SELECT FindingId, N'rating' AS Facet, COALESCE(RiskRating, N'(none)') AS Value, AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'cvss', CASE WHEN Cvss IS NULL THEN N'(none)' WHEN Cvss >= 9 THEN N'Critical (9.0-10)' WHEN Cvss >= 7 THEN N'High (7.0-8.9)'
|                                              WHEN Cvss >= 4 THEN N'Medium (4.0-6.9)' WHEN Cvss > 0 THEN N'Low (0.1-3.9)' ELSE N'None (0)' END, AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'score', COALESCE(CONVERT(nvarchar(32), CONVERT(decimal(19, 1), RiskScore)), N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'weighted', COALESCE(CONVERT(nvarchar(32), CONVERT(bigint, FLOOR(RiskScoreWeighted))), N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'severity', COALESCE(Severity, N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'tier', COALESCE(CONVERT(nvarchar(8), Tier), N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'domain', COALESCE(SecurityDomain, N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'report', COALESCE(ReportName, N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    -- the findings grid's Category / Subcategory / Department dropdowns (owner 2026-10-28: "i would like these to be dropdowns")
|    UNION ALL SELECT FindingId, N'category', COALESCE(Category, N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'subcategory', COALESCE(Subcategory, N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'department', COALESCE(DepartmentName, N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT FindingId, N'component', COALESCE(Component, N'(none)'), AssetKey, RiskScore, RiskScoreWeighted FROM f
|    UNION ALL SELECT f.FindingId, N'tactic', LTRIM(RTRIM(s.value)), f.AssetKey, f.RiskScore, f.RiskScoreWeighted FROM f CROSS APPLY STRING_SPLIT(f.MitreTactics, N';') AS s WHERE f.MitreTactics IS NOT NULL
|    UNION ALL SELECT f.FindingId, N'technique', LTRIM(RTRIM(s.value)), f.AssetKey, f.RiskScore, f.RiskScoreWeighted FROM f CROSS APPLY STRING_SPLIT(f.MitreTechniques, N';') AS s WHERE f.MitreTechniques IS NOT NULL
|    UNION ALL SELECT f.FindingId, N'tag', LTRIM(RTRIM(s.value)), f.AssetKey, f.RiskScore, f.RiskScoreWeighted FROM f CROSS APPLY STRING_SPLIT(f.ComplianceTags, N';') AS s WHERE f.ComplianceTags IS NOT NULL
|    UNION ALL SELECT f.FindingId, N'update', LTRIM(RTRIM(s.value)), f.AssetKey, f.RiskScore, f.RiskScoreWeighted FROM f CROSS APPLY STRING_SPLIT(f.FixUpdate, N';') AS s WHERE f.FixUpdate IS NOT NULL
|), d AS (
|    SELECT DISTINCT FindingId, Facet, LEFT(Value, 256) AS Value, AssetKey, RiskScore, RiskScoreWeighted FROM facts WHERE Value <> N''
|)
|'@).Replace('{FIX}', $fix).Replace('{WHERE}', $Where).TrimEnd()
|}
|
|# ---- THE FACETS IN FINDING RANGES (a large collection) --------------------------------------------------------------
|#  Live 2026-10-19 (two large installs, 885,300 and 1,164,897 findings in one collection): the whole-collection facet
|#  statement (Get-SIDataFacetSql) ran past the data sync's SQL limit, so DerivedAt was never stamped and every run derived
|#  the collection again and failed the same way. The SAME aggregates are now built in FindingId ranges -- sized from their
|#  measured time and paced by the database's load, exactly as the derive's ranges -- each range staging its partial
|#  aggregate per (facet, value, CI) in sidata.FindingFacetStage; ONE closing statement groups the staged rows per (facet,
|#  value) and replaces the collection's aggregate (and stamps DerivedAt) in one transaction, as before. The ranges cut the
|#  findings in disjoint sets, so: findings = the sum of the ranges' counts, CIs = the distinct CI keys over all ranges
|#  (COUNT(DISTINCT), a CI without a key is not counted -- as before), scores = the sums and the maximum. Same rows.
|#  A database without the stage table (its schema not applied yet) builds the facets in one statement, as before.
|
|function Get-SIDataFacetStageReadySql { "SELECT CASE WHEN OBJECT_ID('sidata.FindingFacetStage') IS NOT NULL THEN 1 ELSE 0 END" }
|
|function Get-SIDataFacetStageClearSql {
|    <# One batch of a collection's staged facet rows of one variant (-Counted = @Counted 1), for Invoke-SIDataBatchedDelete. #>
|    "DELETE TOP (@Batch) FROM sidata.FindingFacetStage WHERE CollectionId = @CollectionId AND Counted = @Counted; SELECT @@ROWCOUNT;"
|}
|
|function Get-SIDataFacetRangeSql {
|    <# One FindingId range (@After, @Upto] of one collection: its partial facet aggregate per (facet, value, CI), staged.
|       -Counted: the findings without an exemption mark. Returns the rows staged. #>
|    param([switch]$Counted, [switch]$FixColumn)
|    $where = 'CollectionId = @CollectionId AND FindingId > @After AND FindingId <= @Upto'
|    if ($Counted) { $where += ' AND ExemptionId IS NULL' }
|    (@'
|SET NOCOUNT ON;
|{FACTS}
|INSERT sidata.FindingFacetStage (CollectionId, Counted, Facet, Value, AssetKey, Findings, ScoreTotal, WeightedTotal, MaxScore)
|SELECT @CollectionId, {C}, Facet, Value, AssetKey, COUNT(*), SUM(RiskScore), SUM(RiskScoreWeighted), MAX(RiskScore)
|FROM d GROUP BY Facet, Value, AssetKey;
|SELECT @@ROWCOUNT;
|'@).Replace('{FACTS}', (Get-SIDataFacetFactsSql -Where $where -FixColumn:$FixColumn)).Replace('{C}', $(if ($Counted) { '1' } else { '0' }))
|}
|
|function Get-SIDataFacetFinishSql {
|    <# The collection's aggregate from its staged ranges, replacing what it held -- and DerivedAt (not for -Counted) -- in ONE
|       transaction (a reader sees the old set or the new one). Returns the aggregate's rows. #>
|    param([switch]$Counted)
|    $table = 'FindingFacet'; $c = '0'
|    $stamp = "UPDATE sidata.Collection SET DerivedAt = SYSUTCDATETIME() WHERE CollectionId = @CollectionId;"
|    if ($Counted) { $table = 'FindingFacetCounted'; $c = '1'; $stamp = '' }
|    (@'
|SET XACT_ABORT ON;
|CREATE TABLE #ff (Facet nvarchar(16) NOT NULL, Value nvarchar(256) NOT NULL, Findings int NOT NULL, Assets int NOT NULL,
|                  ScoreTotal float NOT NULL, WeightedTotal float NULL, MaxScore float NULL);
|INSERT #ff (Facet, Value, Findings, Assets, ScoreTotal, WeightedTotal, MaxScore)
|SELECT Facet, Value, SUM(Findings), COUNT(DISTINCT AssetKey), ISNULL(SUM(ScoreTotal), 0), SUM(WeightedTotal), MAX(MaxScore)
|FROM sidata.FindingFacetStage WHERE CollectionId = @CollectionId AND Counted = {C}
|GROUP BY Facet, Value;
|BEGIN TRAN;
|DELETE FROM sidata.{TABLE} WHERE CollectionId = @CollectionId;
|INSERT sidata.{TABLE} (CollectionId, Facet, Value, Findings, Assets, ScoreTotal, WeightedTotal, MaxScore)
|SELECT @CollectionId, Facet, Value, Findings, Assets, ScoreTotal, WeightedTotal, MaxScore FROM #ff;
|DECLARE @n int = @@ROWCOUNT;
|{STAMP}
|COMMIT;
|SELECT @n;
|'@).Replace('{TABLE}', $table).Replace('{C}', $c).Replace('{STAMP}', $stamp)
|}
|
|$script:SIDataFacetStageMissingSaid = $false
|
|function Invoke-SIDataFacet {
|    <#
|        ONE collection's facet aggregate (-Counted: its counted twin): in FindingId ranges through the stage table when the
|        database has it, else in one statement (said once per process). The ranges are sized from their measured time
|        (-TargetMs, -BatchSize carries the size between calls) and paced by the database's load. What an earlier run left
|        staged for the collection is removed first; the staged rows are removed after the aggregate is replaced.
|        -Log { param($Level, $Message) }: a line about once a minute while the ranges run, and the total at the end.
|        Returns the aggregate's rows (as the one statement did).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][int]$CollectionId, [switch]$Counted, [switch]$FixColumn,
|          [ref]$BatchSize, [long]$TargetMs = 5000, [scriptblock]$Log)
|    $ready = $false
|    try { $ready = ([int](& $Invoke (Get-SIDataFacetStageReadySql) @{} 'scalar')) -eq 1 } catch { $ready = $false }
|    if (-not $ready) {
|        if (-not $script:SIDataFacetStageMissingSaid -and $Log) {
|            $script:SIDataFacetStageMissingSaid = $true
|            & $Log 'WARN' 'facets      : the database does not have the table that builds the facet counts in parts yet -- they are built in one statement (the next update adds the table).'
|        }
|        return [int](& $Invoke (Get-SIDataFacetSql -Counted:$Counted) @{ CollectionId = $CollectionId } 'scalar')
|    }
|    $cv = $(if ($Counted) { 1 } else { 0 })
|    $del = [long]0
|    [void](Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataFacetStageClearSql) -Params @{ CollectionId = $CollectionId; Counted = $cv } -BatchSize ([ref]$del))
|    $bRaw = & $Invoke (Get-SIDataFindingBoundsSql) @{ CollectionId = $CollectionId } 'reader'
|    $b = @($bRaw) | Select-Object -First 1
|    if ($b -and $null -ne $b['Lo'] -and -not ($b['Lo'] -is [System.DBNull])) {
|        $lo = [long]$b['Lo']; $hi = [long]$b['Hi']
|        $size = [long]20000; if ($BatchSize -and $BatchSize.Value -gt 0) { $size = [long]$BatchSize.Value }
|        $after = $lo - 1
|        $paced = [bool](Get-Command -Name Invoke-SISqlPacing -ErrorAction SilentlyContinue); $lastMs = 0L
|        $sql = Get-SIDataFacetRangeSql -Counted:$Counted -FixColumn:$FixColumn
|        $all = [Diagnostics.Stopwatch]::StartNew(); $saidAt = 0.0; $ranges = 0
|        while ($after -lt $hi) {
|            if ($paced) { $pace = Invoke-SISqlPacing -Invoke $Invoke -LastBatchMs $lastMs; if ($pace.Shrink) { $size = [Math]::Max(500L, [long][Math]::Floor($size / 2)) } }
|            $upto = [Math]::Min($hi, $after + $size)
|            $sw = [Diagnostics.Stopwatch]::StartNew()
|            [void](& $Invoke $sql @{ CollectionId = $CollectionId; After = $after; Upto = $upto } 'scalar')
|            $sw.Stop(); $lastMs = $sw.ElapsedMilliseconds
|            $after = $upto; $ranges++
|            $size = Get-SIDataNextSize -Current $size -ElapsedMs $sw.ElapsedMilliseconds -TargetMs $TargetMs -Minimum 500
|            if ($Log -and ($all.Elapsed.TotalSeconds - $saidAt) -ge 60) {
|                $saidAt = $all.Elapsed.TotalSeconds
|                $pct = [int][Math]::Floor(100.0 * [double]($after - $lo + 1) / [double]([Math]::Max(1L, $hi - $lo + 1)))
|                & $Log 'INFO' ("facets      : the facet counts of the collection are being built -- {0} % of its findings so far" -f $pct)
|            }
|        }
|        if ($BatchSize) { $BatchSize.Value = $size }
|    }
|    $n = [int](& $Invoke (Get-SIDataFacetFinishSql -Counted:$Counted) @{ CollectionId = $CollectionId } 'scalar')
|    $del = [long]0
|    [void](Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataFacetStageClearSql) -Params @{ CollectionId = $CollectionId; Counted = $cv } -BatchSize ([ref]$del))
|    $n
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE SERVICES VIEW (#255): which CMDB service(s) each CI belongs to -- ONE resolver -- and the risk per service
|# ------------------------------------------------------------------------------------------------------------------
|#
|#  THE RESOLVER CONTRACT. "Which service(s) does a CI belong to" is answered in ONE place: the ordered list of
|#  membership sources returned by Get-SIDataServiceSources. Each source is @{ Name; Sql }:
|#    Name  1-32 of [A-Za-z0-9._-]; stamped on every membership it contributes (ServiceMember.Source)
|#    Sql   ONE read-only SELECT (no ';', no write or DDL verb) returning the columns AssetKey (the sidata CI key),
|#          ServiceKey (the service's stable id -- its CMDB number), ServiceName (display name, may be NULL), for the
|#          collection @CollectionId (the only parameter). It may read sidata.* and cfg.* (an SI-homed CMDB).
|#  A CI may belong to several services (one row per service). The same (service, CI) from two sources is kept once,
|#  stamped with the EARLIER source in the list. Only CIs with findings in the collection are kept.
|#  A new source (the SI-homed CMDB, an external CSV / ServiceNow CMDB) plugs in with Register-SIDataServiceSource;
|#  -Replace makes the registered sources the whole list (e.g. an SI-homed CMDB that is authoritative).
|#  Get-SIDataServicesSql turns the list into ServiceMember (the resolver's output) and the two aggregates.
|#  A membership change after a collection was derived is picked up by setting its ServicesDerivedAt to NULL (the next
|#  data sync re-derives it); a collection's membership is otherwise frozen as it was when it was derived.
|
|$script:SIDataServiceSourcesRegistered = @()
|$script:SIDataServiceSourcesReplace = $false
|
|function Get-SIDataServiceSourceDefault {
|    <# The first source: the CMDB service Risk Analysis carried on the CI's finding rows (cmdbId, else cmdbName). #>
|    @{ Name = 'risk-analysis'; Sql = @'
|SELECT f.AssetKey, COALESCE(f.CmdbId, f.CmdbName) AS ServiceKey, MAX(COALESCE(f.CmdbName, f.CmdbId)) AS ServiceName
|FROM sidata.Finding AS f
|WHERE f.CollectionId = @CollectionId AND f.AssetKey IS NOT NULL AND COALESCE(f.CmdbId, f.CmdbName) IS NOT NULL
|GROUP BY f.AssetKey, COALESCE(f.CmdbId, f.CmdbName)
|'@ }
|}
|
|function Test-SIDataServiceSource {
|    <# Throws when a source does not keep the contract. #>
|    param([Parameter(Mandatory)]$Source)
|    $n = [string]$Source.Name; $q = [string]$Source.Sql
|    if ($n -notmatch '^[A-Za-z0-9._-]{1,32}$') { throw ("service source '{0}': the name must be 1-32 of letters, digits, '.', '_' or '-'." -f $n) }
|    if ($q -notmatch '^\s*SELECT\s') { throw ("service source '{0}': the statement must be ONE SELECT." -f $n) }
|    if ($q.Contains(';')) { throw ("service source '{0}': the statement must be ONE SELECT (no ';')." -f $n) }
|    if ($q -match '(?i)\b(INSERT|UPDATE|DELETE|MERGE|DROP|ALTER|TRUNCATE|CREATE|EXEC|EXECUTE|GRANT|INTO)\b') { throw ("service source '{0}': the statement must be read-only." -f $n) }
|    foreach ($c in 'AssetKey', 'ServiceKey', 'ServiceName') { if ($q -notmatch "\b$c\b") { throw ("service source '{0}': the statement must return {1}." -f $n, $c) } }
|    foreach ($m in [regex]::Matches($q, '@(\w+)')) { if ($m.Groups[1].Value -ne 'CollectionId') { throw ("service source '{0}': @CollectionId is the only parameter (found @{1})." -f $n, $m.Groups[1].Value) } }
|}
|
|function Register-SIDataServiceSource {
|    <# Adds a membership source after the ones already in the list; -Replace: the registered sources become the whole list. #>
|    param([Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string]$Sql, [switch]$Replace)
|    $src = @{ Name = $Name; Sql = $Sql }
|    Test-SIDataServiceSource -Source $src
|    $script:SIDataServiceSourcesRegistered = @(@($script:SIDataServiceSourcesRegistered | Where-Object { $_.Name -ne $Name }) + $src)
|    if ($Replace) { $script:SIDataServiceSourcesReplace = $true }
|}
|
|function Reset-SIDataServiceSources {
|    <# Back to the default list (the Risk Analysis source only). #>
|    $script:SIDataServiceSourcesRegistered = @()
|    $script:SIDataServiceSourcesReplace = $false
|}
|
|function Get-SIDataServiceSources {
|    <# THE resolver's source list, in precedence order. #>
|    $list = @()
|    if (-not $script:SIDataServiceSourcesReplace) { $list += (Get-SIDataServiceSourceDefault) }
|    $list += @($script:SIDataServiceSourcesRegistered)
|    foreach ($s in $list) { Test-SIDataServiceSource -Source $s }
|    , @($list)
|}
|
|# ---- THE CMDB AS A SERVICE SOURCE (#256) ---------------------------------------------------------------------------
|#  The Pro database's own CMDB (sql\si-pro-settings.sql: cfg.CmdbService / cfg.CmdbServiceAsset, SI-homed or filled
|#  from an external CSV / ServiceNow) plugs into the resolver above as ONE source, through cfg.vCmdbAssetService -- the
|#  memberships of the AUTHORITATIVE CMDB only. When it is configured it REPLACES the list (an authoritative CMDB is the
|#  answer, not one more opinion); when it is not, the Risk Analysis source (cmdbId / cmdbName from CMDB.csv via the
|#  Reconcile stage) stays the fallback. "Configured" = an external source is chosen, or the SI-homed CMDB holds at
|#  least one service in force.
|
|$script:SIDataCmdbSourceUsed = $false
|
|function Get-SIDataCmdbStateSql {
|    <# Whether the CMDB tables exist, the authoritative source and how many of its services are in force. #>
|    @'
|IF OBJECT_ID(N'cfg.vCmdbAssetService') IS NULL OR OBJECT_ID(N'cfg.vCmdbSource') IS NULL OR OBJECT_ID(N'cfg.vCmdbService') IS NULL
|    SELECT 0 AS HasCmdb, N'SI' AS ActiveSource, 0 AS Services
|ELSE
|    SELECT 1 AS HasCmdb, (SELECT ActiveSource FROM cfg.vCmdbSource) AS ActiveSource, (SELECT COUNT(*) FROM cfg.vCmdbService) AS Services
|'@
|}
|
|function Get-SIDataCmdbServiceSourceName {
|    <# The name stamped on the memberships the CMDB contributes (sidata.ServiceMember.Source). #>
|    param([string]$ActiveSource)
|    switch ($ActiveSource) { 'External-CSV' { 'cmdb-csv' } 'External-Connector' { 'cmdb-servicenow' } default { 'cmdb-si' } }
|}
|
|function Get-SIDataCmdbServiceSourceSql {
|    <# The CMDB's memberships of the CIs with findings in the collection: ServiceKey = the service number. #>
|    @'
|SELECT v.AssetKey, v.ServiceNumber AS ServiceKey, v.ServiceName AS ServiceName
|FROM cfg.vCmdbAssetService AS v
|WHERE v.AssetKey IN (SELECT f.AssetKey FROM sidata.Finding AS f WHERE f.CollectionId = @CollectionId)
|'@
|}
|
|function Get-SIDataCmdbRuleSourceSql {
|    <#
|        The CMDB's services the PROFILE RULES gave a CI (a rule's set.cmdbId, stamped on the findings by Risk Analysis): the
|        v2.2 way an asset belongs to a service, and how a migrated CMDB.csv (which has no links) keeps its members. Only a
|        service of the AUTHORITATIVE CMDB counts, under its service number: a migrated service answers to its v2.2 cmdbID
|        (ExternalId), every other one to its number -- the key Read-SICmdbProServices hands the profilers.
|    #>
|    @'
|SELECT f.AssetKey, v.ServiceNumber AS ServiceKey, MAX(v.Name) AS ServiceName
|FROM sidata.Finding AS f
|JOIN cfg.vCmdbService AS v ON f.CmdbId = (CASE WHEN v.Source = N'SI' AND NULLIF(v.ExternalId, N'') IS NOT NULL THEN v.ExternalId ELSE v.ServiceNumber END)
|WHERE f.CollectionId = @CollectionId AND f.AssetKey IS NOT NULL AND NULLIF(f.CmdbId, N'') IS NOT NULL
|GROUP BY f.AssetKey, v.ServiceNumber
|'@
|}
|
|function Use-SIDataCmdbServiceSource {
|    <#
|        Reads the CMDB's state and, when it is configured, makes it THE service source (Register-SIDataServiceSource
|        -Replace). Returns @{ HasCmdb; ActiveSource; Services; Used; Name }. A database without the CMDB tables keeps the
|        default list.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke)
|    if ($script:SIDataCmdbSourceUsed) { Reset-SIDataServiceSources; $script:SIDataCmdbSourceUsed = $false }
|    $raw = & $Invoke (Get-SIDataCmdbStateSql) @{} 'reader'
|    $row = @($raw) | Where-Object { $_ } | Select-Object -First 1
|    $st = [ordered]@{ HasCmdb = $false; ActiveSource = 'SI'; Services = 0; Used = $false; Name = $null }
|    if ($row) {
|        $st.HasCmdb = ([int]$row['HasCmdb'] -eq 1); $st.ActiveSource = [string]$row['ActiveSource']; $st.Services = [int]$row['Services']
|    }
|    if ($st.HasCmdb -and ($st.ActiveSource -ne 'SI' -or $st.Services -gt 0)) {
|        $st.Name = Get-SIDataCmdbServiceSourceName -ActiveSource $st.ActiveSource
|        Register-SIDataServiceSource -Name $st.Name -Sql (Get-SIDataCmdbServiceSourceSql) -Replace
|        # after the links: the services the profile rules gave a CI, mapped onto the same CMDB (a link wins on a tie)
|        Register-SIDataServiceSource -Name ($st.Name + '-rule') -Sql (Get-SIDataCmdbRuleSourceSql)
|        $script:SIDataCmdbSourceUsed = $true
|        $st.Used = $true
|    }
|    [pscustomobject]$st
|}
|
|function Get-SIDataFixSchemaCheckSql {
|    <# 1 when the database carries the finding's fix columns (si-data-schema.sql, #590), else 0. #>
|    "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'FixRemediation') IS NOT NULL AND COL_LENGTH('sidata.Finding', 'FixRecommendedUpdate') IS NOT NULL AND COL_LENGTH('sidata.Finding', 'FixRecommendedUpdateId') IS NOT NULL AND COL_LENGTH('sidata.Finding', 'AffectedSoftware') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Get-SIDataServicesSchemaCheckSql {
|    <# 1 when the database carries the Services view's columns and tables (si-data-schema.sql, #255), else 0. #>
|    "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'CmdbId') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'ServicesDerivedAt') IS NOT NULL AND OBJECT_ID('sidata.ServiceMember') IS NOT NULL AND OBJECT_ID('sidata.ServiceAsset') IS NOT NULL AND OBJECT_ID('sidata.ServiceRisk') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Get-SIDataServicesSql {
|    <#
|        ONE collection: the resolver's membership (every source, in order), the per-(service, CI) and per-service
|        aggregates, replacing what the collection held, and ServicesDerivedAt -- one transaction. Returns the number of
|        service rows (the no-service row included). Severity: Critical = critical / very high, Medium = medium-high / medium /
|        moderate; informational and unknown severities count in Findings only.
|        -Counted (#264): the same aggregates over the findings WITHOUT an exemption mark, into sidata.ServiceAssetCounted /
|        ServiceRiskCounted. Membership is NOT resolved again: the collection's sidata.ServiceMember (the resolver's output)
|        is reused, so a service holds the same CIs in both variants (minus a CI whose every finding is exempted).
|    #>
|    param([object[]]$Sources = (Get-SIDataServiceSources), [switch]$Counted)
|    $ins = New-Object System.Collections.Generic.List[string]
|    $i = 0
|    if ($Counted) {
|        $ins.Add("INSERT #m (AssetKey, ServiceKey, ServiceName, Source, Prio)`r`nSELECT sm.AssetKey, sm.ServiceKey, sm.ServiceName, sm.Source, 1 FROM sidata.ServiceMember AS sm WHERE sm.CollectionId = @CollectionId;")
|    }
|    else {
|        foreach ($s in @($Sources)) {
|            Test-SIDataServiceSource -Source $s
|            $i++
|            $ins.Add(("INSERT #m (AssetKey, ServiceKey, ServiceName, Source, Prio)`r`nSELECT LEFT(src.AssetKey, 400), LEFT(LTRIM(RTRIM(src.ServiceKey)), 256), LEFT(src.ServiceName, 400), N'{0}', {1}`r`nFROM (`r`n{2}`r`n) AS src`r`nWHERE src.AssetKey IS NOT NULL AND NULLIF(LTRIM(RTRIM(src.ServiceKey)), N'') IS NOT NULL;" -f $s.Name, $i, ([string]$s.Sql).Trim()))
|        }
|    }
|    $risk = 'ServiceRisk'; $asset = 'ServiceAsset'; $mark = ''
|    $member = "DELETE FROM sidata.ServiceMember WHERE CollectionId = @CollectionId;`r`nINSERT sidata.ServiceMember (CollectionId, ServiceKey, AssetKey, ServiceName, Source)`r`nSELECT @CollectionId, ServiceKey, AssetKey, ServiceName, Source FROM #mem;"
|    $stamp = "UPDATE sidata.Collection SET ServicesDerivedAt = SYSUTCDATETIME() WHERE CollectionId = @CollectionId;"
|    if ($Counted) { $risk = 'ServiceRiskCounted'; $asset = 'ServiceAssetCounted'; $mark = ' AND f.ExemptionId IS NULL'; $member = ''; $stamp = '' }
|    # the web app's one severity order (SeverityOrder.cs): case, spaces, '-' and '_' do not matter; Medium-High counts as Medium
|    $k = "LOWER(REPLACE(REPLACE(REPLACE(f.Severity, N' ', N''), N'-', N''), N'_', N''))"
|    $sev = @{
|        C = "CASE WHEN $k IN (N'critical', N'veryhigh') THEN 1 ELSE 0 END"
|        H = "CASE WHEN $k = N'high' THEN 1 ELSE 0 END"
|        M = "CASE WHEN $k IN (N'mediumhigh', N'medium', N'moderate') THEN 1 ELSE 0 END"
|        L = "CASE WHEN $k = N'low' THEN 1 ELSE 0 END"
|    }
|    (@'
|SET XACT_ABORT ON;
|CREATE TABLE #m (AssetKey nvarchar(400) NOT NULL, ServiceKey nvarchar(256) NOT NULL, ServiceName nvarchar(400) NULL, Source nvarchar(32) NOT NULL, Prio int NOT NULL);
|{SOURCES}
|CREATE TABLE #a (AssetKey nvarchar(400) NOT NULL PRIMARY KEY, AssetName nvarchar(400) NULL, Tier tinyint NULL, Findings int NOT NULL,
|                 Critical int NOT NULL, High int NOT NULL, Medium int NOT NULL, Low int NOT NULL,
|                 T0 int NOT NULL, T1 int NOT NULL, T2 int NOT NULL, T3 int NOT NULL, TU int NOT NULL,
|                 WeightedTotal float NULL, RiskTotal float NULL, MaxWeighted float NULL);
|INSERT #a
|SELECT f.AssetKey, MAX(f.AssetName), MIN(f.Tier), COUNT(*),
|       SUM({C}), SUM({H}), SUM({M}), SUM({L}),
|       SUM(CASE WHEN f.Tier = 0 THEN 1 ELSE 0 END), SUM(CASE WHEN f.Tier = 1 THEN 1 ELSE 0 END), SUM(CASE WHEN f.Tier = 2 THEN 1 ELSE 0 END),
|       SUM(CASE WHEN f.Tier = 3 THEN 1 ELSE 0 END), SUM(CASE WHEN f.Tier IS NULL OR f.Tier > 3 THEN 1 ELSE 0 END),
|       SUM(f.RiskScoreWeighted), SUM(f.RiskScore), MAX(f.RiskScoreWeighted)
|FROM sidata.Finding AS f
|WHERE f.CollectionId = @CollectionId AND f.AssetKey IS NOT NULL{MARK}
|GROUP BY f.AssetKey;
|CREATE TABLE #mem (ServiceKey nvarchar(256) NOT NULL, AssetKey nvarchar(400) NOT NULL, ServiceName nvarchar(400) NULL, Source nvarchar(32) NOT NULL);
|INSERT #mem (ServiceKey, AssetKey, ServiceName, Source)
|SELECT x.ServiceKey, x.AssetKey, x.ServiceName, x.Source
|FROM (SELECT m.ServiceKey, m.AssetKey, m.ServiceName, m.Source,
|             ROW_NUMBER() OVER (PARTITION BY m.ServiceKey, m.AssetKey ORDER BY m.Prio, m.ServiceName) AS Rn
|      FROM #m AS m) AS x
|JOIN #a AS a ON a.AssetKey = x.AssetKey
|WHERE x.Rn = 1;
|CREATE TABLE #sa (ServiceKey nvarchar(256) NOT NULL, AssetKey nvarchar(400) NOT NULL, ServiceName nvarchar(400) NULL, Source nvarchar(32) NULL,
|                  ServiceCount int NOT NULL);
|WITH cnt AS (SELECT AssetKey, COUNT(*) AS N FROM #mem GROUP BY AssetKey)
|INSERT #sa (ServiceKey, AssetKey, ServiceName, Source, ServiceCount)
|SELECT m.ServiceKey, m.AssetKey, m.ServiceName, m.Source, cnt.N
|FROM #mem AS m JOIN cnt ON cnt.AssetKey = m.AssetKey;
|INSERT #sa (ServiceKey, AssetKey, ServiceName, Source, ServiceCount)
|SELECT N'', a.AssetKey, NULL, NULL, 0
|FROM #a AS a LEFT JOIN #mem AS m ON m.AssetKey = a.AssetKey
|WHERE m.AssetKey IS NULL;
|-- the service's display name: the one most of its members carry
|WITH nm AS (
|    SELECT ServiceKey, ServiceName, ROW_NUMBER() OVER (PARTITION BY ServiceKey ORDER BY COUNT(*) DESC, ServiceName) AS Rn
|    FROM #sa WHERE ServiceName IS NOT NULL GROUP BY ServiceKey, ServiceName
|), top1 AS (
|    SELECT s.ServiceKey, s.AssetKey, a.AssetName, a.WeightedTotal,
|           ROW_NUMBER() OVER (PARTITION BY s.ServiceKey ORDER BY CASE WHEN a.WeightedTotal IS NULL THEN 1 ELSE 0 END, a.WeightedTotal DESC, s.AssetKey) AS Rn
|    FROM #sa AS s JOIN #a AS a ON a.AssetKey = s.AssetKey
|), src AS (
|    SELECT d.ServiceKey, STRING_AGG(CONVERT(nvarchar(200), d.Source), N', ') WITHIN GROUP (ORDER BY d.Source) AS Sources
|    FROM (SELECT DISTINCT ServiceKey, Source FROM #sa WHERE Source IS NOT NULL) AS d
|    GROUP BY d.ServiceKey
|), agg AS (
|    SELECT s.ServiceKey, COUNT(*) AS Assets, SUM(CASE WHEN s.ServiceCount > 1 THEN 1 ELSE 0 END) AS SharedAssets, SUM(a.Findings) AS Findings,
|           SUM(a.WeightedTotal) AS WeightedTotal, SUM(a.WeightedTotal) / COUNT(*) AS WeightedPerAsset, SUM(a.RiskTotal) AS RiskTotal, MAX(a.MaxWeighted) AS MaxWeighted,
|           SUM(a.Critical) AS Critical, SUM(a.High) AS High, SUM(a.Medium) AS Medium, SUM(a.Low) AS Low,
|           SUM(a.T0) AS Tier0, SUM(a.T1) AS Tier1, SUM(a.T2) AS Tier2, SUM(a.T3) AS Tier3, SUM(a.TU) AS TierUnclassified
|    FROM #sa AS s JOIN #a AS a ON a.AssetKey = s.AssetKey
|    GROUP BY s.ServiceKey
|)
|SELECT agg.*, nm.ServiceName, top1.AssetKey AS TopAssetKey, top1.AssetName AS TopAssetName, top1.WeightedTotal AS TopAssetWeighted, src.Sources
|INTO #sr
|FROM agg
|LEFT JOIN nm ON nm.ServiceKey = agg.ServiceKey AND nm.Rn = 1
|LEFT JOIN top1 ON top1.ServiceKey = agg.ServiceKey AND top1.Rn = 1
|LEFT JOIN src ON src.ServiceKey = agg.ServiceKey;
|BEGIN TRAN;
|DELETE FROM sidata.{RISK} WHERE CollectionId = @CollectionId;
|DELETE FROM sidata.{ASSET} WHERE CollectionId = @CollectionId;
|{MEMBER}
|INSERT sidata.{ASSET} (CollectionId, ServiceKey, AssetKey, ServiceName, Source, AssetName, Tier, ServiceCount, Findings, Critical, High, Medium, Low, WeightedTotal, RiskTotal, MaxWeighted)
|SELECT @CollectionId, s.ServiceKey, s.AssetKey, s.ServiceName, s.Source, a.AssetName, a.Tier, s.ServiceCount, a.Findings, a.Critical, a.High, a.Medium, a.Low, a.WeightedTotal, a.RiskTotal, a.MaxWeighted
|FROM #sa AS s JOIN #a AS a ON a.AssetKey = s.AssetKey;
|INSERT sidata.{RISK} (CollectionId, ServiceKey, ServiceName, Assets, SharedAssets, Findings, WeightedTotal, WeightedPerAsset, RiskTotal, MaxWeighted,
|                           Critical, High, Medium, Low, Tier0, Tier1, Tier2, Tier3, TierUnclassified, TopAssetKey, TopAssetName, TopAssetWeighted, Sources)
|SELECT @CollectionId, ServiceKey, ServiceName, Assets, SharedAssets, Findings, WeightedTotal, WeightedPerAsset, RiskTotal, MaxWeighted,
|       Critical, High, Medium, Low, Tier0, Tier1, Tier2, Tier3, TierUnclassified, TopAssetKey, TopAssetName, TopAssetWeighted, Sources
|FROM #sr;
|DECLARE @n int = @@ROWCOUNT;
|{STAMP}
|COMMIT;
|SELECT @n;
|'@).Replace('{RISK}', $risk).Replace('{ASSET}', $asset).Replace('{MEMBER}', $member).Replace('{STAMP}', $stamp).Replace('{MARK}', $mark).Replace('{SOURCES}', ($ins -join "`r`n")).Replace('{C}', $sev.C).Replace('{H}', $sev.H).Replace('{M}', $sev.M).Replace('{L}', $sev.L)
|}
|
|function Invoke-SIDataFindingRanges {
|    <#
|        One statement (-Sql: @CollectionId, @After, @Upto; answers its row count) over ONE collection's FindingId range
|        -Lo..-Hi, in ranges sized from their measured time and paced by the database's own load (SI-SqlPacing.ps1); every
|        range is still run. Returns the rows the statement counted. The derive and the row values' fill run the same loop.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][int]$CollectionId, [long]$Lo, [long]$Hi,
|          [Parameter(Mandatory)][string]$Sql, [ref]$BatchSize, [long]$TargetMs = 5000)
|    $done = 0L
|    $size = [long]20000; if ($BatchSize -and $BatchSize.Value -gt 0) { $size = [long]$BatchSize.Value }
|    $after = $Lo - 1
|    $paced = [bool](Get-Command -Name Invoke-SISqlPacing -ErrorAction SilentlyContinue); $lastMs = 0L
|    while ($after -lt $Hi) {
|        if ($paced) { $pace = Invoke-SISqlPacing -Invoke $Invoke -LastBatchMs $lastMs; if ($pace.Shrink) { $size = [Math]::Max(500L, [long][Math]::Floor($size / 2)) } }
|        $upto = [Math]::Min($Hi, $after + $size)
|        $sw = [Diagnostics.Stopwatch]::StartNew()
|        $done += [long](& $Invoke $Sql @{ CollectionId = $CollectionId; After = $after; Upto = $upto } 'scalar')
|        $sw.Stop(); $lastMs = $sw.ElapsedMilliseconds
|        $after = $upto
|        $size = Get-SIDataNextSize -Current $size -ElapsedMs $sw.ElapsedMilliseconds -TargetMs $TargetMs -Minimum 500
|    }
|    if ($BatchSize) { $BatchSize.Value = $size }
|    $done
|}
|
|function Invoke-SIDataRowColumnsFill {
|    <#
|        2026-10-25 (internal, run 0e6bef53: "set-based not used: the collection carries no typed row values"): the row values
|        of ONE Risk Analysis Detailed collection, BEFORE the data sync derives it -- the vulnerability step runs first and reads
|        them typed. Only a collection Risk Analysis has completed (RaCompletedAt or Complete), not retired, whose RaRowsAt is
|        still empty; the same expressions and rows as the derive (Get-SIDataRowColumnsSql), so the data sync then writes them
|        once, not again. RaRowsAt is stamped only after the last range. NEVER THROWS: @{ Filled; Rows; Seconds; Why } --
|        Filled = $false with the reason, and the reader reads the collection from DetailJson as before.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][int]$CollectionId, [long]$TargetMs = 5000)
|    $sw = [Diagnostics.Stopwatch]::StartNew()
|    $out = { param([bool]$f, [long]$n, [string]$w) [pscustomobject]@{ Filled = $f; Rows = $n; Seconds = [Math]::Round($sw.Elapsed.TotalSeconds, 2); Why = $w } }
|    try {
|        $ready = [string](& $Invoke "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'RaFillRiskFactorConsequence') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'RaRowsAt') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'RaCompletedAt') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'RetiredAt') IS NOT NULL THEN 1 ELSE 0 END" @{} 'scalar')
|        if ($ready -ne '1') { return (& $out $false 0 'the database does not have the row value columns yet (the updater adds them)') }
|        # scalars only: every seam that runs the derive answers 'scalar' (the vulnerability step's seam has no 'reader')
|        $st = [string](& $Invoke "SELECT ISNULL((SELECT CASE WHEN RaRowsAt IS NOT NULL THEN N'done' WHEN RetiredAt IS NULL AND (Status = N'Complete' OR RaCompletedAt IS NOT NULL) THEN N'ok' ELSE N'not' END FROM sidata.Collection WHERE CollectionId = CONVERT(int, @CollectionId)), N'none')" @{ CollectionId = $CollectionId } 'scalar')
|        if ($st -eq 'none') { return (& $out $false 0 'the collection is not in the database') }
|        if ($st -eq 'done') { return (& $out $true 0 'already filled') }
|        if ($st -ne 'ok') { return (& $out $false 0 'the collection is not complete, or retired') }
|        $lo = & $Invoke "SELECT MIN(FindingId) FROM sidata.Finding WHERE CollectionId = CONVERT(int, @CollectionId)" @{ CollectionId = $CollectionId } 'scalar'
|        $hi = & $Invoke "SELECT MAX(FindingId) FROM sidata.Finding WHERE CollectionId = CONVERT(int, @CollectionId)" @{ CollectionId = $CollectionId } 'scalar'
|        $n = 0L
|        if ($null -ne $lo -and -not ($lo -is [System.DBNull])) {
|            $n = Invoke-SIDataFindingRanges -Invoke $Invoke -CollectionId $CollectionId -Lo ([long]$lo) -Hi ([long]$hi) -Sql (Get-SIDataRowColumnsSql) -TargetMs $TargetMs
|        }
|        $null = & $Invoke 'UPDATE sidata.Collection SET RaRowsAt = SYSUTCDATETIME() WHERE CollectionId = @CollectionId AND RaRowsAt IS NULL; SELECT 1;' @{ CollectionId = $CollectionId } 'scalar'
|        & $out $true $n ''
|    } catch { & $out $false 0 ('the row values could not be filled: ' + $_.Exception.Message) }
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE RISK SCORE'S PARTS AS COLUMNS (2026-10-29; owner: "it should be possible to see the Risk Score calculations as
|#  columns"). Risk Analysis writes every part of a finding's score on its row (Calculate-RiskScore, RA-RiskScore.ps1);
|#  this copies them into typed columns of sidata.Finding (sql/si-data-schema.sql, "THE RISK SCORE'S PARTS AS COLUMNS"), so
|#  the views show, sort and filter them without reading the row's JSON. The SAME rule as the web app's explained score
|#  (RiskExplanation.SideOf): a number is the value trimmed and read invariant (empty = none); a side whose base was recorded
|#  lists its factors with their points ("Name=n;..."), an older side's base is its score minus its factors' points (none =
|#  0) and lists the factors by name. Nothing else is worked out: the values are Risk Analysis's own.
|# ------------------------------------------------------------------------------------------------------------------
|
|function Get-SIDataRiskPartsReadySql {
|    <# 1 = the database has the risk score's parts columns and the collection's stamp. #>
|    "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'RiskAssetDerived') IS NOT NULL AND COL_LENGTH('sidata.Finding', 'RiskWeightBy') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'RiskPartsAt') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'RiskPartsUpto') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Test-SIDataRiskPartsReady {
|    <# $true when the database has the columns; never throws. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke)
|    try { return ([string](& $Invoke (Get-SIDataRiskPartsReadySql) @{} 'scalar') -eq '1') } catch { return $false }
|}
|
|function Get-SIDataRiskPartsNumberExpr {
|    <#
|        PURE. A number as the explained score reads it: the text trimmed of white space, read as a float; empty or not a
|        number = NULL. A text longer than 400 characters is no number (SQL Server refuses TRY_CONVERT of a very long text
|        with an error instead of NULL -- a fill must never fail on one odd row).
|    #>
|    param([Parameter(Mandatory)][string]$Text)
|    "CASE WHEN LEN($Text) <= 400 THEN TRY_CONVERT(float, NULLIF(TRIM(CHAR(9) + CHAR(10) + CHAR(13) + CHAR(32) FROM $Text), N'')) END"
|}
|
|function Get-SIDataRiskPartsSql {
|    <#
|        ONE FindingId range (@CollectionId, @After < FindingId <= @Upto) of sidata.Finding: the risk score's parts from the
|        row's JSON, parsed once per row. Every row of the range is written (a row without JSON gets no parts and its sides
|        marked worked out, as the explained score shows it). Idempotent. Answers the rows written.
|        -Progress: also records the range's end on the collection (sidata.Collection.RiskPartsUpto) in the same batch, so a
|        fill stopped by its time budget goes on from there.
|    #>
|    param([switch]$Progress)
|    $n = { param($t) Get-SIDataRiskPartsNumberExpr -Text $t }
|    $prog = if ($Progress) { "`r`nUPDATE sidata.Collection SET RiskPartsUpto = @Upto WHERE CollectionId = @CollectionId;" } else { '' }
|    @"
|SET NOCOUNT ON;
|UPDATE f SET
|    RiskAssetSide    = p.ASide,
|    RiskAssetPoints  = p.APoints,
|    RiskAssetBase    = CASE WHEN p.ABase IS NOT NULL THEN p.ABase WHEN p.ASide IS NOT NULL THEN p.ASide - ISNULL(p.APoints, 0) END,
|    RiskAssetDerived = CASE WHEN p.ABase IS NOT NULL THEN 0 ELSE 1 END,
|    RiskAssetFactors = (SELECT CASE WHEN DATALENGTH(x.v) > 0 THEN x.v END FROM (SELECT CASE WHEN p.ABase IS NOT NULL THEN j.ci ELSE j.cn END AS v) AS x),
|    RiskVulnSide     = p.VSide,
|    RiskVulnPoints   = p.VPoints,
|    RiskVulnBase     = CASE WHEN p.VBase IS NOT NULL THEN p.VBase WHEN p.VSide IS NOT NULL THEN p.VSide - ISNULL(p.VPoints, 0) END,
|    RiskVulnDerived  = CASE WHEN p.VBase IS NOT NULL THEN 0 ELSE 1 END,
|    RiskVulnFactors  = (SELECT CASE WHEN DATALENGTH(x.v) > 0 THEN x.v END FROM (SELECT CASE WHEN p.VBase IS NOT NULL THEN j.pi ELSE j.pn END AS v) AS x),
|    RiskWeightPct    = p.Weight,
|    RiskWeightBy     = CASE WHEN DATALENGTH(j.wb) > 0 THEN LEFT(j.wb, 1000) END
|FROM sidata.Finding AS f
|OUTER APPLY OPENJSON(CASE WHEN ISJSON(f.DetailJson) = 1 THEN f.DetailJson END) WITH (
|    cb nvarchar(max) N'$.RiskConsequenceBase', cs nvarchar(max) N'$.RiskConsequenceScore', cp nvarchar(max) N'$.RiskFactor_Consequence',
|    ci nvarchar(max) N'$.RiskFactor_Consequence_Impacts', cn nvarchar(max) N'$.RiskFactor_Consequence_Detailed',
|    pb nvarchar(max) N'$.RiskProbabilityBase', ps nvarchar(max) N'$.RiskProbabilityScore', pp nvarchar(max) N'$.RiskFactor_Probability',
|    pi nvarchar(max) N'$.RiskFactor_Probability_Impacts', pn nvarchar(max) N'$.RiskFactor_Probability_Detailed',
|    w nvarchar(max) N'$.RiskScore_Weight_Factor', wb nvarchar(max) N'$.RiskScore_Weight_Detailed') AS j
|CROSS APPLY (SELECT $(& $n 'j.cb') AS ABase, $(& $n 'j.cs') AS ASide, $(& $n 'j.cp') AS APoints,
|                    $(& $n 'j.pb') AS VBase, $(& $n 'j.ps') AS VSide, $(& $n 'j.pp') AS VPoints,
|                    $(& $n 'j.w') AS Weight) AS p
|WHERE f.CollectionId = CONVERT(int, @CollectionId) AND f.FindingId > CONVERT(bigint, @After) AND f.FindingId <= CONVERT(bigint, @Upto);
|DECLARE @n bigint = @@ROWCOUNT;$prog
|SELECT @n;
|"@
|}
|
|function Get-SIDataRiskPartsStampSql {
|    <# The collection carries the parts on every row (@Upto: its last FindingId). #>
|    'UPDATE sidata.Collection SET RiskPartsAt = SYSUTCDATETIME(), RiskPartsUpto = CONVERT(bigint, @Upto) WHERE CollectionId = CONVERT(int, @CollectionId); SELECT 1;'
|}
|
|function Get-SIDataRiskPartsPendingSql {
|    <# The complete collections (rows not removed) whose rows do not all carry the parts yet, newest first, with how far a fill came. #>
|    @'
|SELECT c.CollectionId, c.RiskPartsUpto AS Upto,
|       (SELECT MIN(f.FindingId) FROM sidata.Finding AS f WHERE f.CollectionId = c.CollectionId) AS Lo,
|       (SELECT MAX(f.FindingId) FROM sidata.Finding AS f WHERE f.CollectionId = c.CollectionId) AS Hi
|FROM sidata.Collection AS c
|WHERE c.Status = N'Complete' AND c.RiskPartsAt IS NULL AND c.RetiredAt IS NULL
|ORDER BY c.CollectionTime DESC;
|'@
|}
|
|function Invoke-SIDataRiskPartsBackfill {
|    <#
|        The collections stored before the parts were columns get them: complete collections without RiskPartsAt, NEWEST
|        FIRST, in FindingId ranges sized from their measured time and paced by the database's load, within -BudgetSeconds
|        per run (the owner: 20 minutes); each range records how far it came (RiskPartsUpto), so the next run goes on from
|        there; a collection is stamped (RiskPartsAt) only after its last range. -DryRun: says what it would do. NEVER THROWS:
|        @{ Ready; Collections (stamped this run); Rows; Pending (left for the next run); Seconds; Error }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [scriptblock]$Log, [int]$BudgetSeconds = 1200, [long]$TargetMs = 5000, [switch]$DryRun)
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Host ('[{0}] {1}' -f $level, $msg) } }
|    $clock = [Diagnostics.Stopwatch]::StartNew()
|    $res = [ordered]@{ Ready = $false; Collections = 0; Rows = 0L; Pending = 0; Seconds = 0; Error = '' }
|    try {
|        if (-not (Test-SIDataRiskPartsReady -Invoke $Invoke)) {
|            & $Log 'INFO' 'score parts : the database does not have the risk score''s part columns yet -- the next update adds them; until then the views show the parts empty.'
|            return [pscustomobject]$res
|        }
|        $res.Ready = $true
|        # ASSIGNED first, then enumerated: the seam answers a reader as ONE list (', rows') -- @(& ...) would hold the list as one item
|        $pendRaw = & $Invoke (Get-SIDataRiskPartsPendingSql) @{} 'reader'
|        $pending = @(@($pendRaw) | Where-Object { $_ })
|        $res.Pending = $pending.Count
|        if ($pending.Count -eq 0) { & $Log 'INFO' 'score parts : every collection carries the risk score''s parts.'; return [pscustomobject]$res }
|        if ($DryRun) { & $Log 'INFO' ("score parts : {0} collection(s) would get the risk score's parts; nothing is written." -f $pending.Count); return [pscustomobject]$res }
|        $sql = Get-SIDataRiskPartsSql -Progress
|        $paced = [bool](Get-Command -Name Invoke-SISqlPacing -ErrorAction SilentlyContinue)
|        $size = [long]20000; $lastMs = 0L
|        foreach ($c in $pending) {
|            if ($clock.Elapsed.TotalSeconds -ge $BudgetSeconds) { break }
|            $cid = [int]$c['CollectionId']
|            $hasRows = $null -ne $c['Lo'] -and -not ($c['Lo'] -is [System.DBNull])
|            $hi = if ($hasRows) { [long]$c['Hi'] } else { 0L }
|            $after = if ($hasRows) { [long]$c['Lo'] - 1 } else { 0L }
|            if ($hasRows -and $null -ne $c['Upto'] -and -not ($c['Upto'] -is [System.DBNull]) -and [long]$c['Upto'] -gt $after) { $after = [long]$c['Upto'] }
|            while ($hasRows -and $after -lt $hi) {
|                if ($clock.Elapsed.TotalSeconds -ge $BudgetSeconds) { break }
|                if ($paced) { $pace = Invoke-SISqlPacing -Invoke $Invoke -LastBatchMs $lastMs; if ($pace.Shrink) { $size = [Math]::Max(500L, [long][Math]::Floor($size / 2)) } }
|                $upto = [Math]::Min($hi, $after + $size)
|                $sw = [Diagnostics.Stopwatch]::StartNew()
|                $res.Rows += [long](& $Invoke $sql @{ CollectionId = $cid; After = $after; Upto = $upto } 'scalar')
|                $sw.Stop(); $lastMs = $sw.ElapsedMilliseconds
|                $after = $upto
|                $size = Get-SIDataNextSize -Current $size -ElapsedMs $sw.ElapsedMilliseconds -TargetMs $TargetMs -Minimum 500
|            }
|            if ($hasRows -and $after -lt $hi) { break }
|            $null = & $Invoke (Get-SIDataRiskPartsStampSql) @{ CollectionId = $cid; Upto = $hi } 'scalar'
|            $res.Collections++
|        }
|        $res.Pending = $pending.Count - $res.Collections
|        $res.Seconds = [Math]::Round($clock.Elapsed.TotalSeconds, 1)
|        if ($res.Pending -gt 0) {
|            & $Log 'OK' ("score parts : {0} earlier collection(s) got the risk score's parts ({1} finding row(s), {2} s); {3} more follow on the next run(s) -- the time this run may spend on it is used." -f $res.Collections, $res.Rows, $res.Seconds, $res.Pending)
|        } else {
|            & $Log 'OK' ("score parts : {0} earlier collection(s) got the risk score's parts ({1} finding row(s), {2} s)." -f $res.Collections, $res.Rows, $res.Seconds)
|        }
|    } catch {
|        $res.Error = $_.Exception.Message
|        & $Log 'WARN' ("score parts : the risk score's parts of earlier collections were not all written this run -- {0}. The next run goes on from where this one stopped." -f $_.Exception.Message)
|    }
|    [pscustomobject]$res
|}
|
|function Get-SIDataSummaryRiskPartsReadySql {
|    <# 1 = sidata.SummaryRow has the risk score's parts columns and the whole row (RowJson). #>
|    "SELECT CASE WHEN COL_LENGTH('sidata.SummaryRow', 'RiskAssetDerived') IS NOT NULL AND COL_LENGTH('sidata.SummaryRow', 'RiskVulnFactors') IS NOT NULL AND COL_LENGTH('sidata.SummaryRow', 'RowJson') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Get-SIDataSummaryRiskPartsSql {
|    <#
|        ONE batch (@Batch rows) of Summary rows without the risk score's parts: the base and the factors with their points
|        from the whole row (RowJson, written by Risk Analysis) where it carries the base; else -- a row loaded without it --
|        the base worked out as the side's score minus its factors' points and the factors by name, from the row's own columns
|        (the same rule as the findings, Get-SIDataRiskPartsSql). The sides' scores and points stay the row's own columns.
|        Answers the rows written; the caller repeats until 0.
|    #>
|    $n = { param($t) Get-SIDataRiskPartsNumberExpr -Text $t }
|    @"
|SET NOCOUNT ON;
|UPDATE TOP (CONVERT(int, @Batch)) s SET
|    RiskAssetBase    = CASE WHEN p.ABase IS NOT NULL THEN p.ABase WHEN s.RiskConsequenceScore IS NOT NULL THEN s.RiskConsequenceScore - ISNULL(s.RiskFactorConsequence, 0) END,
|    RiskAssetDerived = CASE WHEN p.ABase IS NOT NULL THEN 0 ELSE 1 END,
|    RiskAssetFactors = (SELECT CASE WHEN DATALENGTH(x.v) > 0 THEN x.v END FROM (SELECT CASE WHEN p.ABase IS NOT NULL THEN j.ci ELSE s.RiskFactorConsequenceDetailed END AS v) AS x),
|    RiskVulnBase     = CASE WHEN p.VBase IS NOT NULL THEN p.VBase WHEN s.RiskProbabilityScore IS NOT NULL THEN s.RiskProbabilityScore - ISNULL(s.RiskFactorProbability, 0) END,
|    RiskVulnDerived  = CASE WHEN p.VBase IS NOT NULL THEN 0 ELSE 1 END,
|    RiskVulnFactors  = (SELECT CASE WHEN DATALENGTH(x.v) > 0 THEN x.v END FROM (SELECT CASE WHEN p.VBase IS NOT NULL THEN j.pi ELSE s.RiskFactorProbabilityDetailed END AS v) AS x)
|FROM sidata.SummaryRow AS s
|OUTER APPLY OPENJSON(CASE WHEN ISJSON(s.RowJson) = 1 THEN s.RowJson END) WITH (
|    cb nvarchar(max) N'$.RiskConsequenceBase', ci nvarchar(max) N'$.RiskFactor_Consequence_Impacts',
|    pb nvarchar(max) N'$.RiskProbabilityBase', pi nvarchar(max) N'$.RiskFactor_Probability_Impacts') AS j
|CROSS APPLY (SELECT $(& $n 'j.cb') AS ABase, $(& $n 'j.pb') AS VBase) AS p
|WHERE s.RiskAssetDerived IS NULL;
|SELECT @@ROWCOUNT;
|"@
|}
|
|function Invoke-SIDataSummaryRiskParts {
|    <#
|        The Summary rows (new and earlier) get the risk score's parts, in batches, within -BudgetSeconds (the rest on the next
|        run). NEVER THROWS: @{ Ready; Rows; Error }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [scriptblock]$Log, [int]$BudgetSeconds = 300, [int]$Batch = 20000, [switch]$DryRun)
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Host ('[{0}] {1}' -f $level, $msg) } }
|    $res = [ordered]@{ Ready = $false; Rows = 0L; Error = '' }
|    try {
|        if ([string](& $Invoke (Get-SIDataSummaryRiskPartsReadySql) @{} 'scalar') -ne '1') { return [pscustomobject]$res }
|        $res.Ready = $true
|        if ($DryRun) { return [pscustomobject]$res }
|        $clock = [Diagnostics.Stopwatch]::StartNew(); $sql = Get-SIDataSummaryRiskPartsSql
|        while ($clock.Elapsed.TotalSeconds -lt $BudgetSeconds) {
|            $n = [long](& $Invoke $sql @{ Batch = $Batch } 'scalar')
|            $res.Rows += $n
|            if ($n -lt $Batch) { break }
|        }
|        if ($res.Rows -gt 0) { & $Log 'OK' ("score parts : {0} Summary row(s) got the risk score's parts" -f $res.Rows) }
|    } catch {
|        $res.Error = $_.Exception.Message
|        & $Log 'WARN' ("score parts : the risk score's parts of the Summary rows were not all written this run -- {0}. Tried again on the next run." -f $_.Exception.Message)
|    }
|    [pscustomobject]$res
|}
|
|function Invoke-SIDataDeriveCollection {
|    <#
|        Fills the views' columns of ONE collection in FindingId ranges sized from their measured time, then its
|        aggregates and DerivedAt. -Services (#255): also the CMDB columns, then the service membership and its aggregates.
|        Returns @{ CollectionId; Findings; Facets; Services } (Services = $null without -Services).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][int]$CollectionId, [ref]$BatchSize, [long]$TargetMs = 5000, [switch]$Services,
|          # #590 also the finding's fix columns (the database carries them: Get-SIDataFixSchemaCheckSql)
|          [switch]$Fix,
|          # the facets' progress lines (Invoke-SIDataFacet)
|          [scriptblock]$Log)
|    $bRaw = & $Invoke (Get-SIDataFindingBoundsSql) @{ CollectionId = $CollectionId } 'reader'
|    $b = @($bRaw) | Select-Object -First 1
|    $done = 0L
|    # #834 the Risk Analysis row's Category travels with the derive when the database has its column (the updater adds it)
|    $cat = $false
|    try { $cat = ([string](& $Invoke "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'RaCategory') IS NOT NULL THEN 1 ELSE 0 END" @{} 'scalar') -eq '1') } catch { $cat = $false }
|    # #830 / #834 the row values the readers read on every finding, when the database has their columns (the updater adds them)
|    $rowCols = $false
|    try { $rowCols = ([string](& $Invoke "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'RaFillRiskFactorConsequence') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'RaRowsAt') IS NOT NULL THEN 1 ELSE 0 END" @{} 'scalar') -eq '1') } catch { $rowCols = $false }
|    # 2026-10-25 the vulnerability step (before the data sync) already filled this collection's row values with the same
|    # expressions (Invoke-SIDataRowColumnsFill, RaRowsAt set): written once, not again -- only rows carried in since get them
|    $rowsDone = $false; $carriedCol = $false
|    if ($rowCols) {
|        try { $rowsDone = ([string](& $Invoke "SELECT CASE WHEN EXISTS (SELECT 1 FROM sidata.Collection WHERE CollectionId = @CollectionId AND RaRowsAt IS NOT NULL) THEN 1 ELSE 0 END" @{ CollectionId = $CollectionId } 'scalar') -eq '1') } catch { $rowsDone = $false }
|        try { $carriedCol = ([string](& $Invoke "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'CarriedFrom') IS NOT NULL THEN 1 ELSE 0 END" @{} 'scalar') -eq '1') } catch { $carriedCol = $false }
|    }
|    $sql = if ($rowsDone) { Get-SIDataDeriveFindingSql -Services:$Services -Fix:$Fix -Category:$cat -CarriedRowColumns:$carriedCol }
|           else { Get-SIDataDeriveFindingSql -Services:$Services -Fix:$Fix -Category:$cat -RowColumns:$rowCols }
|    if ($b -and $null -ne $b['Lo'] -and -not ($b['Lo'] -is [System.DBNull])) {
|        $rg = @{ Invoke = $Invoke; CollectionId = $CollectionId; Lo = [long]$b['Lo']; Hi = [long]$b['Hi']; Sql = $sql; TargetMs = $TargetMs }
|        if ($BatchSize) { $rg.BatchSize = $BatchSize }
|        $done = Invoke-SIDataFindingRanges @rg
|    }
|    # #830 / #834 every range carried the row values: the readers read this collection from its typed columns from now on
|    if ($rowCols -and -not $rowsDone) { $null = & $Invoke 'UPDATE sidata.Collection SET RaRowsAt = SYSUTCDATETIME() WHERE CollectionId = @CollectionId; SELECT 1;' @{ CollectionId = $CollectionId } 'scalar' }
|    # the risk score's parts as columns, when the database has them (the updater adds them): every row, then the stamp
|    if (Test-SIDataRiskPartsReady -Invoke $Invoke) {
|        $parts = @{ Invoke = $Invoke; CollectionId = $CollectionId; Sql = (Get-SIDataRiskPartsSql); TargetMs = $TargetMs }
|        $hiPart = 0L
|        if ($b -and $null -ne $b['Lo'] -and -not ($b['Lo'] -is [System.DBNull])) {
|            $parts.Lo = [long]$b['Lo']; $parts.Hi = [long]$b['Hi']; $hiPart = [long]$b['Hi']
|            $null = Invoke-SIDataFindingRanges @parts
|        }
|        $null = & $Invoke (Get-SIDataRiskPartsStampSql) @{ CollectionId = $CollectionId; Upto = $hiPart } 'scalar'
|    }
|    # the facet aggregate in FindingId ranges (a large collection's one statement ran past the SQL limit)
|    $fsz = [long]0
|    $facets = Invoke-SIDataFacet -Invoke $Invoke -CollectionId $CollectionId -FixColumn:$Fix -BatchSize ([ref]$fsz) -TargetMs $TargetMs -Log $Log
|    $svc = $null
|    if ($Services) { $svc = [int](Invoke-SIDataServices -Invoke $Invoke -CollectionId $CollectionId -Log $Log) }
|    [pscustomobject]@{ CollectionId = $CollectionId; Findings = $done; Facets = $facets; Services = $svc }
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE COLLECTION'S AGGREGATES IN RANGES (2026-10-29): the day's totals, the services and the departments of a collection
|#  -- and their counted twins (the exempted step) -- ran as ONE statement over every finding of the collection: at the
|#  large installs past the SQL limit ("Invoke-SIDataExemptedVariants ... Timeout expired"). On a real database's seam they
|#  now run on ONE connection (mode 'session'): the findings are read a FindingId range at a time (the clustered key) into
|#  a #temp table of partial counts per group and asset, those are folded a range of asset keys at a time (every row of an
|#  asset in one range, so a distinct count of assets adds up exactly), and only the collection's aggregate rows are
|#  replaced, in one short transaction. Nothing is written to the database before that transaction, so a run that stops
|#  part-way leaves the aggregate as it was and the next run makes it again. Counts and highest values are the one
|#  statement's exactly; a sum of scores (float) may differ in its last digits only (the order of the additions -- the one
|#  statement's own sum varies with its plan the same way). Every range is its own command, measured and logged.
|# ------------------------------------------------------------------------------------------------------------------
|
|function Test-SIDataSessionRangedSeam {
|    <# PURE. A real database's seam that runs several batches on one connection and the heavy steps in ranges. #>
|    param($Invoke)
|    [bool]($null -ne $Invoke -and $Invoke.PSObject.Properties['SISqlSession'] -and $Invoke.SISqlSession -and $Invoke.PSObject.Properties['SISqlRanged'] -and $Invoke.SISqlRanged)
|}
|
|function ConvertTo-SIDataSqlText {
|    <# PURE. A value as a T-SQL text literal (N'...', quotes doubled); NULL for $null. A batch of a session takes no parameters. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value -or $Value -is [System.DBNull]) { return 'NULL' }
|    "N'" + ([string]$Value).Replace("'", "''") + "'"
|}
|
|function Invoke-SIDataSessionIdRanges {
|    <# In a session (-Run): -Text for every FindingId range of collection -CollectionId ({AFTER} / {UPTO} replaced), sized
|       from the measured time of the one before; one log line per range. Answers the ranges run. #>
|    param([Parameter(Mandatory)][scriptblock]$Run, [Parameter(Mandatory)][int]$CollectionId, [Parameter(Mandatory)][string]$Text, [string]$What = 'ranges',
|          [long]$FirstSize = 50000, [long]$TargetMs = 5000, [scriptblock]$Log)
|    $b = @(& $Run ('SELECT ISNULL(MIN(FindingId), 0) AS Lo, ISNULL(MAX(FindingId), -1) AS Hi FROM sidata.Finding WHERE CollectionId = {0};' -f $CollectionId) 'reader' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })[0]
|    $after = [long]$b['Lo'] - 1; $hi = [long]$b['Hi']; $size = [Math]::Max(1L, $FirstSize); $i = 0
|    while ($after -lt $hi) {
|        $upto = [long][Math]::Min([double]$hi, [double]$after + [double]$size)
|        $sw = [Diagnostics.Stopwatch]::StartNew()
|        & $Run ($Text.Replace('{AFTER}', [string]$after).Replace('{UPTO}', [string]$upto)) 'none'
|        $i++
|        if ($Log) { & $Log 'INFO' ('{0} -- findings range {1} (ids {2:N0}-{3:N0}) -- {4:N1} s' -f $What, $i, ($after + 1), $upto, ($sw.ElapsedMilliseconds / 1000.0)) }
|        $after = $upto
|        $size = Get-SIDataNextSize -Current $size -ElapsedMs $sw.ElapsedMilliseconds -TargetMs $TargetMs -Minimum 1
|    }
|    $i
|}
|
|function Invoke-SIDataSessionKeyRanges {
|    <# In a session (-Run): -Text for every range of the text key -Column of the #temp table -Table ({PRED} replaced by the range's
|       predicate, its bounds as literals; every row of one key value in one range), then once for the rows without a key
|       ({PRED} = ' AND <column> IS NULL'). Sized from the measured time of the one before; one log line per range. #>
|    param([Parameter(Mandatory)][scriptblock]$Run, [Parameter(Mandatory)][string]$Table, [Parameter(Mandatory)][string]$Column, [Parameter(Mandatory)][string]$Text,
|          [string]$What = 'ranges', [long]$FirstTake = 20000, [long]$TargetMs = 5000, [scriptblock]$Log)
|    $take = [Math]::Max(1L, $FirstTake); $lo = $null; $i = 0
|    while ($true) {
|        $lop = ''; if ($null -ne $lo) { $lop = (' AND {0} > {1}' -f $Column, (ConvertTo-SIDataSqlText $lo)) }
|        $b = @(& $Run ('SELECT MAX(x.k) AS Hi, COUNT_BIG(*) AS N FROM (SELECT TOP ({0}) {1} AS k FROM {2} WHERE {1} IS NOT NULL{3} ORDER BY {1}) AS x;' -f $take, $Column, $Table, $lop) 'reader' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })[0]
|        $hi = $b['Hi']; $n = [long]$b['N']
|        if ($n -eq 0 -or $null -eq $hi) { break }
|        $last = $n -lt $take
|        $pred = (' AND {0} IS NOT NULL' -f $Column) + $lop
|        if (-not $last) { $pred += (' AND {0} <= {1}' -f $Column, (ConvertTo-SIDataSqlText $hi)) }
|        $i++
|        $sw = [Diagnostics.Stopwatch]::StartNew()
|        & $Run ($Text.Replace('{PRED}', $pred)) 'none'
|        if ($Log) { & $Log 'INFO' ('{0} -- assets range {1} -- {2:N1} s' -f $What, $i, ($sw.ElapsedMilliseconds / 1000.0)) }
|        if ($last) { break }
|        $lo = [string]$hi
|        $take = Get-SIDataNextSize -Current $take -ElapsedMs $sw.ElapsedMilliseconds -TargetMs $TargetMs -Minimum 1
|    }
|    & $Run ($Text.Replace('{PRED}', (' AND {0} IS NULL' -f $Column))) 'none'
|    $i
|}
|
|function Invoke-SIDataFindingDaily {
|    <#
|        The day's aggregate (Get-SIDataFindingDailySql; -Counted: its counted twin) -- on a real database's seam in ranges (see
|        above), any other seam the one statement. -Day: 'yyyy-MM-dd'. Answers the day's rows written (as the statement).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$Day, [switch]$Counted, [scriptblock]$Log,
|          [long]$FirstSize = 50000, [long]$TargetMs = 5000)
|    if (-not (Test-SIDataSessionRangedSeam $Invoke)) { return [int](& $Invoke (Get-SIDataFindingDailySql -Counted:$Counted) @{ Day = $Day } 'scalar') }
|    if ($Invoke.PSObject.Properties['SIRangeFirstTake'] -and [long]$Invoke.SIRangeFirstTake -gt 0) { $FirstSize = [long]$Invoke.SIRangeFirstTake }
|    if ($Day -notmatch '^\d{4}-\d{2}-\d{2}$') { throw ("the day of the day's totals is not a date ('{0}')" -f $Day) }
|    $table = 'FindingDaily'; $mark = ''; $assets = 'AssetDaily'
|    if ($Counted) { $table = 'FindingDailyCounted'; $mark = ' AND f.ExemptionId IS NULL'; $assets = 'AssetDailyCounted' }
|    $what = $(if ($Counted) { "v3 model    : the day's totals without exempted findings ($Day)" } else { "v3 model    : the day's totals ($Day)" })
|    $onSession = {
|        param($Run)
|        $c = @(& $Run @"
|SET NOCOUNT ON;
|DECLARE @d date = '$Day';
|DECLARE @c int = (SELECT TOP (1) CollectionId FROM sidata.Collection
|                  WHERE Kind = 'Detailed' AND Status = 'Complete' AND CollectionTime >= @d AND CollectionTime < DATEADD(day, 1, @d)
|                  ORDER BY CollectionTime DESC);
|DECLARE @gone int = 0;
|IF @c IS NOT NULL AND COL_LENGTH('sidata.Collection', 'RetiredAt') IS NOT NULL
|    EXEC sp_executesql N'SELECT @g = COUNT(*) FROM sidata.Collection WHERE CollectionId = @c AND RetiredAt IS NOT NULL', N'@c int, @g int OUTPUT', @c = @c, @g = @gone OUTPUT;
|SELECT @c AS C, @gone AS Gone;
|"@ 'reader' | ForEach-Object { $_ } | Where-Object { $null -ne $_ })[0]
|        # #717: the day's collection had its finding rows removed by the retention -- its stored day totals are kept
|        if ([int]$c['Gone'] -gt 0) { return 0 }
|        $cid = $c['C']
|        & $Run @'
|SELECT TOP (0) f.CiLifecycle AS Lc, f.Tier, ISNULL(f.Severity, '') AS Sev, ISNULL(f.SecurityDomain, '') AS Dom, ISNULL(f.ReportName, '') AS Rep, f.AssetKey,
|       COUNT_BIG(*) AS Findings, SUM(f.RiskScore) AS ScoreSum, MAX(f.RiskScore) AS ScoreMax
|INTO #dp FROM sidata.Finding AS f GROUP BY f.CiLifecycle, f.Tier, ISNULL(f.Severity, ''), ISNULL(f.SecurityDomain, ''), ISNULL(f.ReportName, ''), f.AssetKey;
|CREATE CLUSTERED INDEX CX_dp ON #dp (AssetKey);
|SELECT TOP (0) Lc, Tier, Sev, Dom, Rep, Findings, CONVERT(bigint, 0) AS Assets, ScoreSum, ScoreMax INTO #dr FROM #dp;
|-- (the CUBE's rolled-up cells carry NULL in every column: all of them may be empty here)
|CREATE TABLE #da (G int NOT NULL, Tier tinyint NULL, Sev nvarchar(30) COLLATE DATABASE_DEFAULT NULL, Dom nvarchar(128) COLLATE DATABASE_DEFAULT NULL, Rep nvarchar(256) COLLATE DATABASE_DEFAULT NULL, Lc nvarchar(16) COLLATE DATABASE_DEFAULT NULL, Assets bigint NOT NULL);
|'@ 'none'
|        if ($null -ne $cid) {
|            $null = Invoke-SIDataSessionIdRanges -Run $Run -CollectionId ([int]$cid) -What $what -Log $Log -FirstSize $FirstSize -TargetMs $TargetMs -Text @"
|INSERT #dp (Lc, Tier, Sev, Dom, Rep, AssetKey, Findings, ScoreSum, ScoreMax)
|SELECT f.CiLifecycle, f.Tier, ISNULL(f.Severity, ''), ISNULL(f.SecurityDomain, ''), ISNULL(f.ReportName, ''), f.AssetKey, COUNT_BIG(*), SUM(f.RiskScore), MAX(f.RiskScore)
|FROM sidata.Finding AS f
|WHERE f.CollectionId = $([int]$cid) AND f.FindingId > {AFTER} AND f.FindingId <= {UPTO}$mark
|GROUP BY f.CiLifecycle, f.Tier, ISNULL(f.Severity, ''), ISNULL(f.SecurityDomain, ''), ISNULL(f.ReportName, ''), f.AssetKey;
|"@
|            # assets never span two asset ranges: their distinct counts add up -- per group, and per cell of the CUBE
|            $null = Invoke-SIDataSessionKeyRanges -Run $Run -Table '#dp' -Column 'AssetKey' -What $what -Log $Log -TargetMs $TargetMs -Text @'
|INSERT #dr (Lc, Tier, Sev, Dom, Rep, Findings, Assets, ScoreSum, ScoreMax)
|SELECT Lc, Tier, Sev, Dom, Rep, SUM(Findings), COUNT(DISTINCT AssetKey), SUM(ScoreSum), MAX(ScoreMax) FROM #dp WHERE 1 = 1{PRED} GROUP BY Lc, Tier, Sev, Dom, Rep;
|INSERT #da (G, Tier, Sev, Dom, Rep, Lc, Assets)
|SELECT GROUPING_ID(Tier, Sev, Dom, Rep), Tier, Sev, Dom, Rep, Lc, COUNT(DISTINCT AssetKey) FROM #dp WHERE 1 = 1{PRED} GROUP BY Lc, CUBE (Tier, Sev, Dom, Rep);
|'@
|        }
|        [int](& $Run @"
|SET NOCOUNT ON;
|SET XACT_ABORT ON;
|DECLARE @d date = '$Day';
|DECLARE @c int = $(if ($null -eq $cid) { 'NULL' } else { [int]$cid });
|BEGIN TRAN;
|DELETE FROM sidata.$table WHERE [Day] = @d;
|INSERT sidata.$table ([Day], CollectionId, Tier, Severity, SecurityDomain, ReportName, Findings, Assets, ScoreTotal, ScoreMax, CiLifecycle)
|SELECT @d, @c, Tier, Sev, Dom, Rep, SUM(Findings), SUM(Assets), ISNULL(SUM(ScoreSum), 0), MAX(ScoreMax), Lc
|FROM #dr GROUP BY Lc, Tier, Sev, Dom, Rep;
|DECLARE @n int = @@ROWCOUNT;
|IF OBJECT_ID('sidata.$assets') IS NOT NULL
|BEGIN
|    DELETE FROM sidata.$assets WHERE [Day] = @d;
|    INSERT sidata.$assets ([Day], CollectionId, GroupingId, Tier, Severity, SecurityDomain, ReportName, Assets, CiLifecycle)
|    SELECT @d, @c, G, Tier, Sev, Dom, Rep, SUM(Assets), Lc FROM #da GROUP BY G, Tier, Sev, Dom, Rep, Lc;
|END;
|COMMIT;
|DROP TABLE #dp; DROP TABLE #dr; DROP TABLE #da;
|SELECT @n;
|"@ 'scalar')
|    }
|    [int](& $Invoke $null $null 'session' $onSession)
|}
|
|function Invoke-SIDataServices {
|    <#
|        One collection's services (Get-SIDataServicesSql; -Counted: its counted twin) -- on a real database's seam in ranges:
|        the membership sources and everything after the per-asset counts run as the one statement's own text (they are per
|        asset and per service, not per finding); the per-asset counts (#a) are made a FindingId range at a time and folded a
|        range of assets at a time. Any other seam: the one statement. Answers the service rows written.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][int]$CollectionId, [switch]$Counted, [object[]]$Sources = (Get-SIDataServiceSources),
|          [scriptblock]$Log, [long]$FirstSize = 50000, [long]$TargetMs = 5000)
|    $sql = Get-SIDataServicesSql -Sources $Sources -Counted:$Counted
|    if (-not (Test-SIDataSessionRangedSeam $Invoke)) { return [int](& $Invoke $sql @{ CollectionId = $CollectionId } 'scalar') }
|    if ($Invoke.PSObject.Properties['SIRangeFirstTake'] -and [long]$Invoke.SIRangeFirstTake -gt 0) { $FirstSize = [long]$Invoke.SIRangeFirstTake }
|    # a batch of a session takes no parameter: the collection's id (a number) is written in
|    $text = $sql.Replace('@CollectionId', [string][int]$CollectionId)
|    $iA = $text.IndexOf('CREATE TABLE #a ('); $iIns = $text.IndexOf("INSERT #a`r`nSELECT"); if ($iIns -lt 0) { $iIns = $text.IndexOf("INSERT #a`nSELECT") }
|    $iMem = $text.IndexOf('CREATE TABLE #mem')
|    if ($iA -lt 0 -or $iIns -lt $iA -or $iMem -lt $iIns) { throw 'the services statement is not in the shape its ranges are cut from' }
|    $head = $text.Substring(0, $iA); $createA = $text.Substring($iA, $iIns - $iA); $insA = $text.Substring($iIns, $iMem - $iIns); $tail = $text.Substring($iMem)
|    $gb = $insA.LastIndexOf('GROUP BY f.AssetKey;')
|    if ($gb -lt 0) { throw 'the services statement is not in the shape its ranges are cut from' }
|    # the per-asset counts of one FindingId range, into #ap (the same expressions)
|    $insAp = ($insA.Substring(0, $gb).Replace('INSERT #a', 'INSERT #ap').TrimEnd() + ' AND f.FindingId > {AFTER} AND f.FindingId <= {UPTO}' + "`r`n" + 'GROUP BY f.AssetKey;')
|    $what = $(if ($Counted) { 'v3 model    : the services without exempted findings' } else { 'v3 model    : the services' })
|    $cid = $CollectionId
|    $onSession = {
|        param($Run)
|        & $Run $head 'none'
|        & $Run ($createA + "SELECT TOP (0) * INTO #ap FROM #a;`r`nCREATE CLUSTERED INDEX CX_ap ON #ap (AssetKey);") 'none'
|        $null = Invoke-SIDataSessionIdRanges -Run $Run -CollectionId $cid -What $what -Log $Log -FirstSize $FirstSize -TargetMs $TargetMs -Text $insAp
|        $null = Invoke-SIDataSessionKeyRanges -Run $Run -Table '#ap' -Column 'AssetKey' -What $what -Log $Log -TargetMs $TargetMs -Text @'
|INSERT #a
|SELECT AssetKey, MAX(AssetName), MIN(Tier), SUM(Findings), SUM(Critical), SUM(High), SUM(Medium), SUM(Low), SUM(T0), SUM(T1), SUM(T2), SUM(T3), SUM(TU),
|       SUM(WeightedTotal), SUM(RiskTotal), MAX(MaxWeighted)
|FROM #ap WHERE 1 = 1{PRED} GROUP BY AssetKey;
|'@
|        [int](& $Run ("SET XACT_ABORT ON;`r`n" + $tail) 'scalar')
|    }
|    [int](& $Invoke $null $null 'session' $onSession)
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  EXEMPTED FINDINGS (#264): the counted twins of every pre-computed aggregate
|# ------------------------------------------------------------------------------------------------------------------
|#  An exemption never removes a finding: Risk Analysis marks it and the load copies the mark (sidata.Finding.ExemptionId).
|#  Each aggregate the pages read exists twice -- the table over EVERY finding and its "...Counted" twin over the findings
|#  without a mark -- so a page answers "exempted counted" and "not counted" from a pre-computed table, never from a live
|#  GROUP BY over finding rows. CHOICE (measured, see docs\DESIGN.md "Exempted findings"): aggregate both variants at sync
|#  time rather than subtract at read time -- the distinct counts (assets per group, CIs per service) and the highest scores
|#  cannot be subtracted, and the twin costs one more pass over ONE collection per load.
|
|function Get-SIDataExemptedSchemaCheckSql {
|    <# 1 when the database carries the mark columns and every counted twin (si-data-schema.sql, #264), else 0. #>
|    "SELECT CASE WHEN COL_LENGTH('sidata.Finding', 'ExemptionId') IS NOT NULL AND COL_LENGTH('sidata.Collection', 'ExemptedDerivedAt') IS NOT NULL AND OBJECT_ID('sidata.FindingDailyCounted') IS NOT NULL AND OBJECT_ID('sidata.FindingFacetCounted') IS NOT NULL AND OBJECT_ID('sidata.DepartmentFacetCounted') IS NOT NULL AND OBJECT_ID('sidata.ServiceRiskCounted') IS NOT NULL AND OBJECT_ID('sidata.ServiceAssetCounted') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Get-SIDataUnexemptedSql {
|    <#
|        Complete collections whose counted twins are not computed yet (new loads, and once every earlier one) or are STALE: a
|        base aggregate (DerivedAt, ServicesDerivedAt, ResolvedAt) was recomputed after them. Newest first. The base steps
|        never touch the twins: the timestamps they already stamp are what makes a twin stale.
|    #>
|    "SELECT CollectionId, CollectionTime, CASE WHEN DerivedAt IS NULL THEN 0 ELSE 1 END AS Derived, CASE WHEN ResolvedVersion IS NULL THEN 0 ELSE 1 END AS Resolved, CASE WHEN ServicesDerivedAt IS NULL THEN 0 ELSE 1 END AS ServicesDerived FROM sidata.Collection WHERE Status = 'Complete' AND Kind = 'Detailed' AND (ExemptedDerivedAt IS NULL OR ExemptedDerivedAt < DerivedAt OR ExemptedDerivedAt < ServicesDerivedAt OR ExemptedDerivedAt < ResolvedAt)$(Get-SIDataLiveFilter) ORDER BY CollectionTime DESC"
|}
|
|function Get-SIDataExemptedStampSql {
|    "UPDATE sidata.Collection SET ExemptedDerivedAt = SYSUTCDATETIME() WHERE CollectionId = @CollectionId; SELECT @@ROWCOUNT;"
|}
|
|function Invoke-SIDataExemptedVariants {
|    <#
|        ONE collection's counted twins: the day's FindingDailyCounted (the day's latest collection, as the base table), its
|        FindingFacetCounted (when its views' data is derived), DepartmentFacetCounted (when its departments are resolved,
|        -Departments) and ServiceRiskCounted / ServiceAssetCounted (when its services are derived, -Services) -- then
|        ExemptedDerivedAt. A twin whose base is not computed yet (no departments resolved, no services derived) is skipped:
|        its base is empty for the collection too, and computing the base later stamps a time newer than ExemptedDerivedAt,
|        so the twin follows on the next sync. A collection whose views' data is not derived yet stays pending.
|        Returns @{ CollectionId; Daily; Facets; Departments; Services; Stamped }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)]$Collection, [switch]$Services, [switch]$Departments, [scriptblock]$Log)
|    $cid = [int]$Collection.CollectionId
|    $t = ConvertTo-SIDataUtc $Collection.CollectionTime
|    $out = [ordered]@{ CollectionId = $cid; Daily = $null; Facets = $null; Departments = $null; Services = $null; Stamped = $false }
|    $out.Daily = [int](Invoke-SIDataFindingDaily -Invoke $Invoke -Counted -Day $t.ToString('yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture) -Log $Log)
|    if ([int]$Collection.Derived -ne 1) { return [pscustomobject]$out }
|    $fsz = [long]0
|    $out.Facets = Invoke-SIDataFacet -Invoke $Invoke -CollectionId $cid -Counted -BatchSize ([ref]$fsz) -Log $Log
|    if ($Departments -and [int]$Collection.Resolved -eq 1) { $out.Departments = [int](Invoke-SIDataDepartmentFacet -Invoke $Invoke -CollectionId $cid -Counted -Log $Log) }
|    if ($Services -and [int]$Collection.ServicesDerived -eq 1) { $out.Services = [int](Invoke-SIDataServices -Invoke $Invoke -CollectionId $cid -Counted -Log $Log) }
|    $out.Stamped = ([int](& $Invoke (Get-SIDataExemptedStampSql) @{ CollectionId = $cid } 'scalar')) -eq 1
|    [pscustomobject]$out
|}
|
|function Get-SIDataPurgeTargetsSql {
|    <# Collections past retention, and loads that died outside the look-back window (they would never be retried). #>
|    @'
|SET NOCOUNT ON;
|-- ONE TRUSTED RUN: the collection the web app shows (sidata.PublishedRun) is never purged, however old it is
|DECLARE @pub int = NULL;
|IF OBJECT_ID('sidata.PublishedRun') IS NOT NULL
|    EXEC sp_executesql N'SELECT @p = DetailedCollectionId FROM sidata.PublishedRun WHERE Name = N''current''', N'@p int OUTPUT', @p = @pub OUTPUT;
|SELECT CollectionId, CollectionTime, Status FROM sidata.Collection
|WHERE (CollectionTime < CONVERT(datetime2(3), @Cutoff, 126)
|   OR (Status = 'Loading' AND CollectionTime < CONVERT(datetime2(3), @StaleLoading, 126)))
|  AND CollectionId <> ISNULL(@pub, -1)
|ORDER BY CollectionTime ASC
|'@
|}
|
|function Get-SIDataPurgeBatchSql {
|    <# One batch of one collection's child rows. -Table: Finding | Recommendation. The table name is from an allow-list, never input. #>
|    param([Parameter(Mandatory)][ValidateSet('Finding', 'Recommendation')][string]$Table)
|    "DELETE TOP (@Batch) FROM sidata.$Table WHERE CollectionId = @CollectionId; SELECT @@ROWCOUNT;"
|}
|
|function Get-SIDataPurgeCollectionSql {
|    @'
|SET XACT_ABORT ON;
|BEGIN TRAN;
|DELETE FROM sidata.FindingDaily WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.FindingDailyCounted') IS NOT NULL DELETE FROM sidata.FindingDailyCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.AssetDaily') IS NOT NULL DELETE FROM sidata.AssetDaily WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.AssetDailyCounted') IS NOT NULL DELETE FROM sidata.AssetDailyCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.FindingFacetCounted') IS NOT NULL DELETE FROM sidata.FindingFacetCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.DepartmentFacetCounted') IS NOT NULL DELETE FROM sidata.DepartmentFacetCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ServiceRiskCounted') IS NOT NULL DELETE FROM sidata.ServiceRiskCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ServiceAssetCounted') IS NOT NULL DELETE FROM sidata.ServiceAssetCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.FindingFacet') IS NOT NULL DELETE FROM sidata.FindingFacet WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.DepartmentFacet') IS NOT NULL DELETE FROM sidata.DepartmentFacet WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ServiceRisk') IS NOT NULL DELETE FROM sidata.ServiceRisk WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ServiceAsset') IS NOT NULL DELETE FROM sidata.ServiceAsset WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ServiceMember') IS NOT NULL DELETE FROM sidata.ServiceMember WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.AssetCorrelation') IS NOT NULL DELETE FROM sidata.AssetCorrelation WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.CollectionPartial') IS NOT NULL DELETE FROM sidata.CollectionPartial WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.IssueContext') IS NOT NULL DELETE FROM sidata.IssueContext WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.CveSummary') IS NOT NULL DELETE FROM sidata.CveSummary WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.CveSummaryCounted') IS NOT NULL DELETE FROM sidata.CveSummaryCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.CveSummaryState') IS NOT NULL DELETE FROM sidata.CveSummaryState WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.AssetRiskSummary') IS NOT NULL DELETE FROM sidata.AssetRiskSummary WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.AssetRiskSummaryCounted') IS NOT NULL DELETE FROM sidata.AssetRiskSummaryCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.AssetRiskSummaryState') IS NOT NULL DELETE FROM sidata.AssetRiskSummaryState WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.DomainCategory') IS NOT NULL DELETE FROM sidata.DomainCategory WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.DomainCategoryState') IS NOT NULL DELETE FROM sidata.DomainCategoryState WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ReportPreviewCount') IS NOT NULL DELETE FROM sidata.ReportPreviewCount WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ReportPreviewState') IS NOT NULL DELETE FROM sidata.ReportPreviewState WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.CiFindingSummary') IS NOT NULL DELETE FROM sidata.CiFindingSummary WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.CiFindingSummaryState') IS NOT NULL DELETE FROM sidata.CiFindingSummaryState WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.FindingChange') IS NOT NULL DELETE FROM sidata.FindingChange WHERE CollectionId = @CollectionId OR PrevCollectionId = @CollectionId;
|IF OBJECT_ID('sidata.FindingChangeCounted') IS NOT NULL DELETE FROM sidata.FindingChangeCounted WHERE CollectionId = @CollectionId OR PrevCollectionId = @CollectionId;
|IF OBJECT_ID('sidata.AssetChange') IS NOT NULL DELETE FROM sidata.AssetChange WHERE CollectionId = @CollectionId OR PrevCollectionId = @CollectionId;
|IF OBJECT_ID('sidata.AssetChangeCounted') IS NOT NULL DELETE FROM sidata.AssetChangeCounted WHERE CollectionId = @CollectionId OR PrevCollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ChangeCount') IS NOT NULL DELETE FROM sidata.ChangeCount WHERE CollectionId = @CollectionId OR PrevCollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ChangeCountCounted') IS NOT NULL DELETE FROM sidata.ChangeCountCounted WHERE CollectionId = @CollectionId OR PrevCollectionId = @CollectionId;
|IF OBJECT_ID('sidata.ChangeState') IS NOT NULL DELETE FROM sidata.ChangeState WHERE CollectionId = @CollectionId OR PrevCollectionId = @CollectionId;
|IF OBJECT_ID('sidata.Tier0Asset') IS NOT NULL DELETE FROM sidata.Tier0Asset WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.Tier0AssetCounted') IS NOT NULL DELETE FROM sidata.Tier0AssetCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.Tier0AssetState') IS NOT NULL DELETE FROM sidata.Tier0AssetState WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.FindingPivotCell') IS NOT NULL DELETE FROM sidata.FindingPivotCell WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.FindingPivotCellCounted') IS NOT NULL DELETE FROM sidata.FindingPivotCellCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.PivotCell') IS NOT NULL DELETE FROM sidata.PivotCell WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.FindingPivotState') IS NOT NULL DELETE FROM sidata.FindingPivotState WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.SummaryGroup') IS NOT NULL DELETE FROM sidata.SummaryGroup WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.SummaryGroupCounted') IS NOT NULL DELETE FROM sidata.SummaryGroupCounted WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.SummaryGroupState') IS NOT NULL DELETE FROM sidata.SummaryGroupState WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.RemediationAsset') IS NOT NULL DELETE FROM sidata.RemediationAsset WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.Remediation') IS NOT NULL DELETE FROM sidata.Remediation WHERE CollectionId = @CollectionId;
|IF OBJECT_ID('sidata.KeyFigure') IS NOT NULL DELETE FROM sidata.KeyFigure WHERE CollectionId = @CollectionId;
|DELETE FROM sidata.Collection WHERE CollectionId = @CollectionId
|  AND NOT EXISTS (SELECT 1 FROM sidata.Finding WHERE CollectionId = @CollectionId)
|  AND NOT EXISTS (SELECT 1 FROM sidata.Recommendation WHERE CollectionId = @CollectionId);
|DECLARE @n int = @@ROWCOUNT;
|COMMIT;
|SELECT @n;
|'@
|}
|
|function Get-SIDataPurgeOrphansSql {
|    <# Runs no collection refers to, and CIs not seen since the cutoff that no remaining finding refers to (identifiers first). #>
|    param([Parameter(Mandatory)][ValidateSet('Run', 'AssetIdentifier', 'AssetTag', 'Asset', 'AssetEvidence', 'AssetConflict', 'AssetIdHistory')][string]$What)
|    switch ($What) {
|        # #299: correlation evidence and conflicts no load has carried since the cutoff; the id history of CIs that are
|        # gone (after the CI purge) -- never the history of a CI that is still in sidata.Ci (the CI build's CI->CI merge
|        # events name the replacement the CMDB reconciles to; a CI is never deleted). Nothing on a database without the tables.
|        'AssetEvidence' { "IF OBJECT_ID('sidata.AssetEvidence') IS NULL BEGIN SELECT 0; RETURN; END; DELETE TOP (@Batch) e FROM sidata.AssetEvidence e WHERE e.LastSeen < CONVERT(datetime2(3), @Cutoff, 126); SELECT @@ROWCOUNT;" }
|        'AssetConflict' { "IF OBJECT_ID('sidata.AssetConflict') IS NULL BEGIN SELECT 0; RETURN; END; DELETE TOP (@Batch) c FROM sidata.AssetConflict c WHERE c.LastSeen < CONVERT(datetime2(3), @Cutoff, 126); SELECT @@ROWCOUNT;" }
|        'AssetIdHistory' { "IF OBJECT_ID('sidata.AssetIdHistory') IS NULL BEGIN SELECT 0; RETURN; END; DELETE TOP (@Batch) h FROM sidata.AssetIdHistory h WHERE h.DetectedAt < CONVERT(datetime2(3), @Cutoff, 126) AND NOT EXISTS (SELECT 1 FROM sidata.Asset a WHERE a.AssetKey = h.AssetKey) AND NOT EXISTS (SELECT 1 FROM sidata.Ci c WHERE c.CiId = h.AssetKey); SELECT @@ROWCOUNT;" }
|        # the responsibility tags of a CI that is purged (#254); nothing on a database without the table
|        'AssetTag' { "IF OBJECT_ID('sidata.AssetTag') IS NULL BEGIN SELECT 0; RETURN; END; DELETE TOP (@Batch) t FROM sidata.AssetTag t JOIN sidata.Asset a ON a.AssetKey = t.AssetKey WHERE a.LastSeen < CONVERT(datetime2(3), @Cutoff, 126) AND NOT EXISTS (SELECT 1 FROM sidata.Finding f WHERE f.AssetKey = a.AssetKey); SELECT @@ROWCOUNT;" }
|        'Run' { "DELETE TOP (@Batch) r FROM sidata.Run r WHERE r.CollectionTime < CONVERT(datetime2(3), @Cutoff, 126) AND NOT EXISTS (SELECT 1 FROM sidata.Collection c WHERE c.RunId = r.RunId); SELECT @@ROWCOUNT;" }
|        'AssetIdentifier' { "DELETE TOP (@Batch) i FROM sidata.AssetIdentifier i JOIN sidata.Asset a ON a.AssetKey = i.AssetKey WHERE a.LastSeen < CONVERT(datetime2(3), @Cutoff, 126) AND NOT EXISTS (SELECT 1 FROM sidata.Finding f WHERE f.AssetKey = a.AssetKey); SELECT @@ROWCOUNT;" }
|        'Asset' { "DELETE TOP (@Batch) a FROM sidata.Asset a WHERE a.LastSeen < CONVERT(datetime2(3), @Cutoff, 126) AND NOT EXISTS (SELECT 1 FROM sidata.Finding f WHERE f.AssetKey = a.AssetKey) AND NOT EXISTS (SELECT 1 FROM sidata.AssetIdentifier i WHERE i.AssetKey = a.AssetKey); SELECT @@ROWCOUNT;" }
|    }
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE WRITES
|# ------------------------------------------------------------------------------------------------------------------
|
|function Invoke-SIDataBatchedDelete {
|    <#
|        Runs one 'DELETE TOP (@Batch) ...; SELECT @@ROWCOUNT' until it removes nothing, sizing each batch from the last
|        one's measured time (Get-SIDataNextSize). Returns the rows removed. -DeadlineUtc (#816): no new batch after it -- the
|        caller's time budget (what is left is removed by its next call).
|        -Housekeeping (the removal of retired collections): the housekeeping rule of the pacing -- wait until the database is
|        calm, never past -DeadlineUtc (Invoke-SISqlPacingHousekeeping). -LockBound (> 0): no batch is ever larger -- the
|        lock-escalation bound of the table (Get-SIDataRetireBatchBound), the rule of the key ranges; 0 = none (as before).
|        -Stopped: set to $true when the housekeeping wait reached the deadline with rows possibly left.
|        -ShouldStop (the clean-up as housekeeping): asked before EVERY batch; a non-empty answer (why) stops the removal there
|        -- -Stopped is set and -StopWhy gets the answer; the next wake-up goes on. None given = as before.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$Sql, [hashtable]$Params = @{},
|          [ref]$BatchSize, [long]$TargetMs = 5000, [datetime]$DeadlineUtc = [datetime]::MaxValue,
|          [switch]$Housekeeping, [long]$LockBound = 0, [ref]$Stopped, [scriptblock]$ShouldStop, [ref]$StopWhy)
|    $total = 0L
|    $size = [long]5000; if ($BatchSize -and $BatchSize.Value -gt 0) { $size = [long]$BatchSize.Value }
|    if ($LockBound -gt 0 -and $size -gt $LockBound) { $size = $LockBound }
|    # the database's own load paces the batches (SI-SqlPacing.ps1): a pause and a smaller batch only while it is saturated
|    $paced = [bool](Get-Command -Name Invoke-SISqlPacing -ErrorAction SilentlyContinue); $lastMs = 0L
|    while ($true) {
|        if ($paced) {
|            $pace = if ($Housekeeping) { Invoke-SISqlPacing -Invoke $Invoke -LastBatchMs $lastMs -Housekeeping -DeadlineUtc $DeadlineUtc } else { Invoke-SISqlPacing -Invoke $Invoke -LastBatchMs $lastMs }
|            if ($pace.Shrink) { $size = [Math]::Max(100L, [long][Math]::Floor($size / 2)) }
|            if ($LockBound -gt 0 -and $size -gt $LockBound) { $size = $LockBound }
|            if ($Housekeeping -and $pace.PSObject.Properties['Deadline'] -and $pace.Deadline) { if ($Stopped) { $Stopped.Value = $true }; break }
|        }
|        # housekeeping: no new batch once the wait reached the deadline
|        if ($Housekeeping -and [datetime]::UtcNow -ge $DeadlineUtc) { break }
|        # housekeeping: no new batch once a run, a data sync or a data out has started (asked right before the statement)
|        if ($ShouldStop) {
|            $w = ''; try { $w = [string](& $ShouldStop) } catch { $w = ('whether a job started could not be read ({0})' -f $_.Exception.Message) }
|            if ($w) { if ($Stopped) { $Stopped.Value = $true }; if ($StopWhy) { $StopWhy.Value = $w }; break }
|        }
|        $p = @{}; foreach ($k in $Params.Keys) { $p[$k] = $Params[$k] }; $p['Batch'] = $size
|        $sw = [Diagnostics.Stopwatch]::StartNew()
|        $n = [long](& $Invoke $Sql $p 'scalar')
|        $sw.Stop(); $lastMs = $sw.ElapsedMilliseconds
|        $total += $n
|        if ($n -lt $size) { break }
|        $size = Get-SIDataNextSize -Current $size -ElapsedMs $sw.ElapsedMilliseconds -TargetMs $TargetMs -Minimum 100
|        if ($LockBound -gt 0 -and $size -gt $LockBound) { $size = $LockBound }
|        if ([datetime]::UtcNow -ge $DeadlineUtc) { break }
|    }
|    if ($BatchSize) { $BatchSize.Value = $size }
|    $total
|}
|
|function Get-SIDataIndexCountSql {
|    <# The live indexes of one table (@Table, 'schema.name'): the count the lock-escalation bound is worked out from -- the
|       same count Get-SIDataRetireRangeSql makes for its own @cap. 0 when the table is not there. #>
|    "SELECT COUNT(*) FROM sys.indexes WHERE object_id = OBJECT_ID(@Table) AND index_id > 0 AND is_hypothetical = 0 AND is_disabled = 0;"
|}
|
|function Get-SIDataRetireBatchBound {
|    <#
|        The most rows ONE batched delete of a retired collection's -Table may take: below SQL Server's lock escalation (5,000
|        locks of one statement), counting one lock in EVERY index of the table -- 4000 / the table's indexes, at least 1 --
|        the rule of the key ranges (Get-SIDataRetireRangeSql, review S5). A lock-escalation bound, not a limit on the work:
|        the removal goes on batch after batch until nothing is left. The table comes from the allow-list, never input.
|        Indexes that cannot be counted: the bound of a table with one index (4000). -IndexCount: the count (tests).
|    #>
|    param([scriptblock]$Invoke, [Parameter(Mandatory)][ValidateSet('IssueContext', 'RaStage', 'RaDefenderKey', 'Recommendation', 'Finding', 'SummaryAsset', 'SummaryRow')][string]$Table,
|          $IndexCount = $null)
|    $ix = $IndexCount
|    if ($null -eq $ix -and $Invoke) { try { $ix = & $Invoke (Get-SIDataIndexCountSql) @{ Table = ('sidata.' + $Table) } 'scalar' } catch { $ix = $null } }
|    $n = 0; if ($null -ne $ix -and -not ($ix -is [System.DBNull])) { try { $n = [int]$ix } catch { $n = 0 } }
|    # a table has at most 1,000 indexes (one clustered + 999): anything else is not a count
|    if ($n -lt 1 -or $n -gt 1000) { $n = 1 }
|    [long][Math]::Max(1, [Math]::Floor(4000 / $n))
|}
|
|function Write-SIDataJsonRows {
|    <#
|        Sends JSON object texts in chunks through one OPENJSON statement (-Sql reads @j and returns the rows it wrote).
|        Each chunk is checked: a chunk that wrote fewer rows than it carried FAILS the load -- it is never counted as
|        written. The chunk size follows the measured time of the last chunk. Returns the rows written.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][string]$Sql,
|          [Parameter(Mandatory)][AllowEmptyCollection()][string[]]$Items, [hashtable]$Params = @{},
|          [ref]$ChunkChars, [long]$TargetMs = 10000, [string]$What = 'rows')
|    $total = 0L
|    $target = [long]2000000; if ($ChunkChars -and $ChunkChars.Value -gt 0) { $target = [long]$ChunkChars.Value }
|    $i = 0
|    # the database's own load paces the chunks (SI-SqlPacing.ps1): a pause and a smaller chunk only while it is saturated;
|    # every item is still written, in the same order
|    $paced = [bool](Get-Command -Name Invoke-SISqlPacing -ErrorAction SilentlyContinue); $lastMs = 0L
|    while ($i -lt $Items.Count) {
|        if ($paced) { $pace = Invoke-SISqlPacing -Invoke $Invoke -LastBatchMs $lastMs; if ($pace.Shrink) { $target = [Math]::Max(50000L, [long][Math]::Floor($target / 2)) } }
|        # one chunk at the CURRENT size, so a slow chunk shrinks the next one
|        $take = New-Object System.Collections.Generic.List[string]; $len = 0L
|        while ($i -lt $Items.Count -and ($take.Count -eq 0 -or ($len + $Items[$i].Length + 1) -le $target)) { $take.Add($Items[$i]); $len += $Items[$i].Length + 1; $i++ }
|        $p = @{}; foreach ($k in $Params.Keys) { $p[$k] = $Params[$k] }; $p['j'] = '[' + ($take -join ',') + ']'
|        $sw = [Diagnostics.Stopwatch]::StartNew()
|        $n = [long](& $Invoke $Sql $p 'scalar')
|        $sw.Stop(); $lastMs = $sw.ElapsedMilliseconds
|        if ($n -ne $take.Count) { throw ("{0}: a chunk of {1} wrote {2} -- the load stops; nothing of this collection is shown until a full load succeeds." -f $What, $take.Count, $n) }
|        $total += $n
|        # the time measured is the time of THIS chunk ($len characters), so the next size is worked out from $len: a small
|        # chunk that was fast (the last of a part, a small Risk Analysis bucket) says nothing about a larger one and never
|        # grows the size -- it grew on every such call before, doubling to an overflow over one run (live 2026-10-13)
|        $next = Get-SIDataNextSize -Current ([Math]::Max(1L, $len)) -ElapsedMs $sw.ElapsedMilliseconds -TargetMs $TargetMs -Minimum 50000
|        if ($len -ge $target -or $i -lt $Items.Count) { $target = $next }   # a full chunk (the size, not the items, ended it): its time sizes the next one (at most double)
|        elseif ($next -lt $len) { $target = $next }         # a part chunk that was SLOW: smaller at once
|    }
|    if ($ChunkChars) { $ChunkChars.Value = $target }
|    $total
|}
|
|function Get-SIDataPurgeDerivedTables {
|    <#
|        PURE. #881 The tables the purge of a collection empties for it, read from Get-SIDataPurgeCollectionSql itself (ONE
|        list: a table added there is emptied in batches too): @{ Table; Prev ($true = it also holds the collection as the
|        EARLIER one of a comparison, PrevCollectionId) }, in the purge's order.
|    #>
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($m in [regex]::Matches((Get-SIDataPurgeCollectionSql), '(?m)DELETE FROM sidata\.(\w+) WHERE CollectionId = @CollectionId( OR PrevCollectionId = @CollectionId)?;')) {
|        if ($m.Groups[1].Value -eq 'Collection') { continue }
|        $out.Add([pscustomobject]@{ Table = $m.Groups[1].Value; Prev = [bool]$m.Groups[2].Success })
|    }
|    $out.ToArray()
|}
|
|function Get-SIDataPurgeDerivedBatchSql {
|    <# #881 One batch of one derived table's rows of a collection (-Column CollectionId | PrevCollectionId); 0 on a database
|       without the table. -Table comes from Get-SIDataPurgeDerivedTables (the purge's own list), never input. #>
|    param([Parameter(Mandatory)][ValidatePattern('^\w+$')][string]$Table, [ValidateSet('CollectionId', 'PrevCollectionId')][string]$Column = 'CollectionId')
|    "IF OBJECT_ID(N'sidata.$Table') IS NULL BEGIN SELECT 0; RETURN; END; DELETE TOP (@Batch) FROM sidata.$Table WHERE $Column = @CollectionId; SELECT @@ROWCOUNT;"
|}
|
|function Remove-SIDataCollection {
|    <# Removes one collection and everything loaded under it (findings, recommendations, its daily rows), in batches.
|       #881 every derived table first, in measured batches (each its own short statement -- at the largest tenant the ~50
|       tables of a collection in ONE transaction filled the log), the comparisons that name it as the earlier collection too;
|       then the purge's own transaction removes whatever is left (nothing, normally) and the collection row. The same rows
|       go as before -- the last statement is the purge as it was. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][int]$CollectionId, [ref]$BatchSize)
|    $f = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeBatchSql -Table Finding) -Params @{ CollectionId = $CollectionId } -BatchSize $BatchSize
|    $r = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeBatchSql -Table Recommendation) -Params @{ CollectionId = $CollectionId } -BatchSize $BatchSize
|    foreach ($d in (Get-SIDataPurgeDerivedTables)) {
|        $null = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeDerivedBatchSql -Table $d.Table) -Params @{ CollectionId = $CollectionId } -BatchSize $BatchSize
|        if ($d.Prev) { $null = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeDerivedBatchSql -Table $d.Table -Column PrevCollectionId) -Params @{ CollectionId = $CollectionId } -BatchSize $BatchSize }
|    }
|    $c = [int](& $Invoke (Get-SIDataPurgeCollectionSql) @{ CollectionId = $CollectionId } 'scalar')
|    if ($c -ne 1) { throw ("collection {0} could not be removed (rows still refer to it)" -f $CollectionId) }
|    [pscustomobject]@{ CollectionId = $CollectionId; Findings = $f; Recommendations = $r }
|}
|
|function Invoke-SIDataRetention {
|    <#
|        Purges collections taken before the cutoff (and loads that died outside the look-back window), then runs no
|        collection refers to and CIs not seen since the cutoff that no remaining finding refers to. sidata only.
|        Returns @{ Cutoff; Collections; Findings; Recommendations; Runs; Assets; Identifiers }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][int]$RetentionDays, [int]$LookbackDays = 3,
|          [datetime]$Now = [datetime]::UtcNow)
|    $cutoff = Get-SIDataRetentionCutoff -RetentionDays $RetentionDays -Now $Now
|    $stale = $Now.ToUniversalTime().AddDays(-($LookbackDays + 1))
|    $targetsRaw = (& $Invoke (Get-SIDataPurgeTargetsSql) @{ Cutoff = (Format-SIDataSqlTime -Time $cutoff); StaleLoading = (Format-SIDataSqlTime -Time $stale) } 'reader')
|    $targets = @($targetsRaw)
|    $batch = [long]5000
|    $sum = [ordered]@{ Cutoff = $cutoff; Collections = 0; Findings = 0L; Recommendations = 0L; Runs = 0L; Assets = 0L; Identifiers = 0L; Tags = 0L; Evidence = 0L }
|    foreach ($t in $targets) {
|        if ($null -eq $t) { continue }
|        $r = Remove-SIDataCollection -Invoke $Invoke -CollectionId ([int]$t['CollectionId']) -BatchSize ([ref]$batch)
|        $sum.Collections++; $sum.Findings += $r.Findings; $sum.Recommendations += $r.Recommendations
|    }
|    $cp = @{ Cutoff = (Format-SIDataSqlTime -Time $cutoff) }
|    $sum.Runs = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeOrphansSql -What Run) -Params $cp -BatchSize ([ref]$batch)
|    $sum.Identifiers = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeOrphansSql -What AssetIdentifier) -Params $cp -BatchSize ([ref]$batch)
|    $sum.Tags = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeOrphansSql -What AssetTag) -Params $cp -BatchSize ([ref]$batch)
|    $sum.Assets = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeOrphansSql -What Asset) -Params $cp -BatchSize ([ref]$batch)
|    # #299: the correlation evidence past retention, then the id history of the CIs just purged
|    $sum.Evidence = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeOrphansSql -What AssetEvidence) -Params $cp -BatchSize ([ref]$batch)
|    $sum.Evidence += Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeOrphansSql -What AssetConflict) -Params $cp -BatchSize ([ref]$batch)
|    $sum.Evidence += Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataPurgeOrphansSql -What AssetIdHistory) -Params $cp -BatchSize ([ref]$batch)
|    [pscustomobject]$sum
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE FULL ASSET METADATA'S OWN RETENTION (#301, operator 2026-10-05: "3 days should be sufficient")
|# ------------------------------------------------------------------------------------------------------------------
|
|function Get-SIDataAssetPropertiesPruneSql {
|    <#
|        One batch of the prune: the full asset metadata (the source-system bags from SI_AssetProperties_CL) is removed
|        from sidata.Asset.PropertiesJson when it was collected before @Cutoff ("_siPropertiesAt"), or carries no
|        collection time at all (written before the stamp existed, or not refreshed by this sync). The tier attribution
|        at the top of the bag (SI_TierSetBy / SI_TierReason / SI_TierClaims -- #244) is KEPT: it is SecurityInsight's
|        own data, not the metadata. Nothing on a database without the table. Returns the rows changed.
|    #>
|    @'
|IF OBJECT_ID('sidata.Asset') IS NULL BEGIN SELECT 0; RETURN; END;
|UPDATE TOP (@Batch) a SET
|    PropertiesJson = CASE
|        WHEN JSON_VALUE(a.PropertiesJson, '$.SI_TierSetBy') IS NULL THEN NULL
|        WHEN JSON_QUERY(a.PropertiesJson, '$.SI_TierClaims') IS NOT NULL THEN
|            JSON_MODIFY(JSON_MODIFY(JSON_MODIFY(N'{}', '$.SI_TierSetBy', JSON_VALUE(a.PropertiesJson, '$.SI_TierSetBy')),
|                '$.SI_TierReason', JSON_VALUE(a.PropertiesJson, '$.SI_TierReason')), '$.SI_TierClaims', JSON_QUERY(a.PropertiesJson, '$.SI_TierClaims'))
|        ELSE
|            JSON_MODIFY(JSON_MODIFY(JSON_MODIFY(N'{}', '$.SI_TierSetBy', JSON_VALUE(a.PropertiesJson, '$.SI_TierSetBy')),
|                '$.SI_TierReason', JSON_VALUE(a.PropertiesJson, '$.SI_TierReason')), '$.SI_TierClaims', JSON_VALUE(a.PropertiesJson, '$.SI_TierClaims'))
|    END
|FROM sidata.Asset a
|WHERE a.PropertiesJson IS NOT NULL AND ISJSON(a.PropertiesJson) = 1
|  AND EXISTS (SELECT 1 FROM OPENJSON(a.PropertiesJson) k WHERE k.[key] NOT IN (N'SI_TierSetBy', N'SI_TierReason', N'SI_TierClaims', N'_siPropertiesAt'))
|  AND (TRY_CONVERT(datetime2(3), JSON_VALUE(a.PropertiesJson, '$._siPropertiesAt'), 127) IS NULL
|       OR TRY_CONVERT(datetime2(3), JSON_VALUE(a.PropertiesJson, '$._siPropertiesAt'), 127) < CONVERT(datetime2(3), @Cutoff, 126));
|SELECT @@ROWCOUNT;
|'@
|}
|
|function Get-SIDataAssetPropertiesRetentionDays {
|    <# PURE. SI_AssetProperties_RetentionDays from a name -> value map: a whole number, at least 1; anything else = 3. #>
|    param([hashtable]$Globals = @{})
|    $raw = if ($Globals.ContainsKey('SI_AssetProperties_RetentionDays') -and $null -ne $Globals['SI_AssetProperties_RetentionDays']) { "$($Globals['SI_AssetProperties_RetentionDays'])".Trim() } else { '' }
|    $n = 0
|    if (-not $raw -or -not [int]::TryParse($raw, [Globalization.NumberStyles]::Integer, [Globalization.CultureInfo]::InvariantCulture, [ref]$n)) { return 3 }
|    [Math]::Max(1, $n)
|}
|
|function Invoke-SIDataAssetPropertiesPrune {
|    <#
|        Removes the full asset metadata older than -RetentionDays from the Pro database, in batches: the generic store
|        (sidata.AssetMetadata, #408) and the older per-asset bags in sidata.Asset.PropertiesJson. Returns @{ Cutoff;
|        RetentionDays; Assets (bags); MetadataRows }. The caller audits it (datasync.assetproperties.prune).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [int]$RetentionDays = 3, [datetime]$Now = [datetime]::UtcNow)
|    if ($RetentionDays -lt 1) { $RetentionDays = 1 }
|    $cutoff = $Now.ToUniversalTime().AddDays(-$RetentionDays)
|    $batch = [long]5000
|    $n = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql (Get-SIDataAssetPropertiesPruneSql) -Params @{ Cutoff = (Format-SIDataSqlTime -Time $cutoff) } -BatchSize ([ref]$batch)
|    # #408: the generic store (sidata.AssetMetadata) by the same cutoff -- at every level, so metadata stored while 'full'
|    # was on ages out after it is switched back
|    $m = 0L
|    if (Get-Command -Name Invoke-SIDataAssetMetadataPrune -ErrorAction SilentlyContinue) { $m = Invoke-SIDataAssetMetadataPrune -Invoke $Invoke -Cutoff $cutoff }
|    [pscustomobject]@{ Cutoff = $cutoff; RetentionDays = $RetentionDays; Assets = [long]$n; MetadataRows = [long]$m }
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE COLLECTIONS' OWN RETENTION (#717, owner 2026-10-16: "it can not grow full" / "i bet it is the old failed runs" /
|#  "which can be removed"). Measured at a large install: sidata.Finding 10.9M rows / 30.8 GB, ~1M rows per Risk Analysis
|#  run, six collections all still 'Loading' (a stopped run never reaches the step that marks it complete).
|#
|#  THE RULE, per grain (Risk Analysis Detailed = sidata.Collection; Risk Analysis Summary = sidata.SummaryLoad):
|#    KEEP     the newest COMPLETE collection (what every view shows) and the complete one before it (the comparison
|#             between runs reads it); a complete collection whose rows a kept collection's not-complete report shows
|#             (sidata.CollectionReportCarry: the last complete result of that report); every collection still 'Loading'
|#             that is NEWER than the newest complete one (a run in progress -- one run at a time per install, the pipeline
|#             lock -- or one not superseded yet); everything, while no complete collection of the grain exists.
|#    REMOVE   the finding rows of every older complete collection, and of every 'Loading' collection OLDER than the
|#             newest complete one (abandoned: its run stopped or failed; a newer run of the same grain completed).
|#             ALSO (#746, a large install 2026-10-18: six Detailed collections left Loading by stopped or failed runs; an install whose
|#             runs keep stopping never gets a complete one, and kept every attempt): a 'Loading' collection older than
|#             -StaleDays (7, the longest a pipeline run may take) that is NOT the newest collection of its grain -- a newer
|#             run of the same grain started after it -- and whose result is not waiting to be completed by the data sync
|#             (RaCompletedAt) is abandoned too, complete collection or not. The newest collection of a grain is never it.
|#  WHAT "REMOVE" REMOVES -- the row-level detail, which is the size: the findings (sidata.Finding, the data sync's rows and
|#  Risk Analysis' alike -- every row carries its CollectionId), the recommendations, the prepared issue rows
|#  (sidata.IssueContext), and what an abandoned run staged (sidata.RaStage / RaDefenderKey). A Summary collection: its
|#  rows and impacted assets. WHAT IT KEEPS: the collection row itself, marked (RetiredAt) -- so the data sync never loads
|#  it from Log Analytics again and no view lists it -- and every aggregate (the day totals behind the trends, the facets,
|#  the departments, the services, the correlation rows, the per-report verdicts behind the row-count comparison). Those
|#  go with the collection row when SI_Pro_DataRetentionDays (90) removes it, as before.
|#  ABSENCE IS NOT REMEDIATION: nothing here touches the newest collection, the close-loop (vuln.*) or the per-CI lifecycle
|#  (sidata.Ci*), so removing an old collection can never close or change a finding of the current one.
|#  SAFE BY CONSTRUCTION: the mark refuses (in SQL) a collection that does not have the newer complete collection(s) the
|#  rule needs; every delete removes rows only of a MARKED collection; batches on the clustered keys (CollectionId /
|#  CollectionTime / RunKey), sized from their measured time. Idempotent: a removal that stopped part way is finished by the
|#  next run (the collection is marked and still has rows). Never throws: a failure is said, and the next run tries again.
|# ------------------------------------------------------------------------------------------------------------------
|
|$script:SIDataRetiredReady = $false
|
|function Set-SIDataRetiredReady {
|    <# Whether the database carries the retention mark (sidata.Collection.RetiredAt) -- the readers below leave marked collections out only then. #>
|    param([bool]$Ready)
|    $script:SIDataRetiredReady = $Ready
|}
|
|function Get-SIDataLiveFilter {
|    <# ' AND <alias>RetiredAt IS NULL' when the database carries the mark (Set-SIDataRetiredReady), else '' -- a collection whose rows the retention removed is never derived, resolved, prepared or shown again. #>
|    param([string]$Alias = '')
|    if ($script:SIDataRetiredReady) { $p = if ($Alias) { $Alias.TrimEnd('.') + '.' } else { '' }; return (' AND {0}RetiredAt IS NULL' -f $p) }
|    ''
|}
|
|function Get-SIDataRetiredColumnsSql {
|    <# The mark on a database set up before it existed: the SAME guarded, additive statements as sql/si-data-schema.sql. Answers 1 when the mark is there. #>
|    @'
|IF COL_LENGTH('sidata.Collection', 'RetiredAt') IS NULL ALTER TABLE sidata.Collection ADD RetiredAt DATETIME2(0) NULL;
|IF COL_LENGTH('sidata.Collection', 'RetiredWhy') IS NULL ALTER TABLE sidata.Collection ADD RetiredWhy NVARCHAR(32) NULL;
|IF OBJECT_ID('sidata.SummaryLoad') IS NOT NULL AND COL_LENGTH('sidata.SummaryLoad', 'RetiredAt') IS NULL ALTER TABLE sidata.SummaryLoad ADD RetiredAt DATETIME2(0) NULL;
|IF OBJECT_ID('sidata.SummaryLoad') IS NOT NULL AND COL_LENGTH('sidata.SummaryLoad', 'RetiredWhy') IS NULL ALTER TABLE sidata.SummaryLoad ADD RetiredWhy NVARCHAR(32) NULL;
|SELECT CASE WHEN COL_LENGTH('sidata.Collection', 'RetiredAt') IS NOT NULL THEN 1 ELSE 0 END;
|'@
|}
|
|function Get-SIDataRetiredReadySql {
|    "SELECT CASE WHEN COL_LENGTH('sidata.Collection', 'RetiredAt') IS NOT NULL THEN 1 ELSE 0 END"
|}
|
|function Get-SIDataRetentionStateSql {
|    <#
|        Every collection of both grains, newest first per grain: its status, its mark, and -- for a marked one -- whether
|        rows are still left (a removal that stopped part way), and Pending = 1 when Risk Analysis' result is in and waits for
|        the data sync to complete it (RaCompletedAt). Small: one row per collection; each check is one seek on the clustered
|        key. Nothing on a database without the mark.
|    #>
|    @'
|SET NOCOUNT ON;
|IF COL_LENGTH('sidata.Collection', 'RetiredAt') IS NULL
|BEGIN
|    SELECT CAST(NULL AS nvarchar(16)) AS Grain, CAST(NULL AS int) AS CollectionId, CAST(NULL AS datetime2(3)) AS CollectionTime, CAST(NULL AS nvarchar(16)) AS Status,
|           CAST(NULL AS datetime2(0)) AS RetiredAt, CAST(0 AS int) AS HasRows, CAST(0 AS int) AS Pending, CAST(0 AS int) AS Published, CAST(NULL AS nvarchar(32)) AS RetiredWhy WHERE 1 = 0;
|    RETURN;
|END
|DECLARE @pend nvarchar(200) = CASE WHEN COL_LENGTH('sidata.Collection', 'RaCompletedAt') IS NOT NULL THEN N'CASE WHEN c.RaCompletedAt IS NOT NULL THEN 1 ELSE 0 END' ELSE N'0' END;
|-- ONE TRUSTED RUN: Published = 1 on the collection of each grain the web app shows (sidata.PublishedRun 'current')
|DECLARE @pubD nvarchar(300) = CASE WHEN OBJECT_ID('sidata.PublishedRun') IS NOT NULL THEN N'CASE WHEN EXISTS (SELECT 1 FROM sidata.PublishedRun AS p WHERE p.Name = N''current'' AND p.DetailedCollectionId = c.CollectionId) THEN 1 ELSE 0 END' ELSE N'0' END;
|DECLARE @pubS nvarchar(300) = CASE WHEN OBJECT_ID('sidata.PublishedRun') IS NOT NULL THEN N'CASE WHEN EXISTS (SELECT 1 FROM sidata.PublishedRun AS p WHERE p.Name = N''current'' AND p.SummaryCollectionTime = l.CollectionTime) THEN 1 ELSE 0 END' ELSE N'0' END;
|DECLARE @q nvarchar(max) = N'SELECT N''Detailed'' AS Grain, c.CollectionId, c.CollectionTime, c.Status, c.RetiredAt,
|       CASE WHEN c.RetiredAt IS NOT NULL AND EXISTS (SELECT 1 FROM sidata.Finding AS f WHERE f.CollectionId = c.CollectionId) THEN 1 ELSE 0 END AS HasRows, ' + @pend + N' AS Pending, ' + @pubD + N' AS Published, c.RetiredWhy
|FROM sidata.Collection AS c WHERE c.Kind = N''Detailed''';
|IF OBJECT_ID('sidata.SummaryLoad') IS NOT NULL AND COL_LENGTH('sidata.SummaryLoad', 'RetiredAt') IS NOT NULL AND OBJECT_ID('sidata.SummaryRow') IS NOT NULL
|    SET @q += N'
|UNION ALL
|SELECT N''Summary'', CAST(NULL AS int), l.CollectionTime, l.Status, l.RetiredAt,
|       CASE WHEN l.RetiredAt IS NOT NULL AND EXISTS (SELECT 1 FROM sidata.SummaryRow AS s WHERE s.CollectionTime = l.CollectionTime) THEN 1 ELSE 0 END, 0, ' + @pubS + N', l.RetiredWhy
|FROM sidata.SummaryLoad AS l';
|SET @q += N' ORDER BY 1, 3 DESC';
|EXEC sp_executesql @q;
|'@
|}
|
|function Get-SIDataRetentionCarrySql {
|    <# Which collection a kept collection's not-complete report shows its last complete rows from (sidata.CollectionReportCarry). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.CollectionReportCarry') IS NULL SELECT CAST(NULL AS int) AS CollectionId, CAST(NULL AS int) AS FromCollectionId WHERE 1 = 0;
|ELSE SELECT DISTINCT CollectionId, FromCollectionId FROM sidata.CollectionReportCarry WHERE FromCollectionId IS NOT NULL;
|'@
|}
|
|function Get-SIDataCollectionRetentionPlan {
|    <#
|        PURE. The rule above, per grain. -Collections: Get-SIDataRetentionStateSql's rows (Grain, CollectionId,
|        CollectionTime, Status, RetiredAt, HasRows). -CarryLinks: Get-SIDataRetentionCarrySql's rows. Returns one item per
|        collection that is KEPT or acted on -- @{ Grain; CollectionId; CollectionTime; Status; Action; Why; Reason }:
|          Keep     never touched (Reason says why)
|          Retire   its rows are removed now; Why = 'abandoned' (a 'Loading' collection older than the newest complete one)
|                   | 'superseded' (a complete one older than the newest complete one and the one before it)
|          Finish   marked by an earlier run whose removal did not finish -- the rest of its rows are removed now
|        A marked collection with no rows left is not listed. The newest complete collection of a grain is never Retire.
|        #746: a 'Loading' collection older than -StaleDays before -NowUtc that is not the newest collection of its grain and
|        not Pending (its result waits for the data sync) is Retire 'abandoned' too -- also while no collection of the grain
|        is complete. -StaleDays 0 = that rule off.
|        #816: -IdleStaleHours > 0 -- given ONLY when no pipeline run is running (the caller checked cfg.FlowRun) -- a Detailed
|        collection still 'Loading' that started more than that many hours before -NowUtc, not Pending, not the published one,
|        is Retire 'stopped run' even when it is the newest collection: no run is writing it. 0 = that rule off.
|        #882: -IdleBeforeUtc (instead of -IdleStaleHours) -- the start of the oldest Risk Analysis work that may still be
|        writing (Get-SIDataLoadingOwnerFloor): a Detailed collection still loading that started BEFORE it, not Pending, not
|        the published one, belongs to no live run -- Retire 'stopped run' (-IdleReason says why). Never a complete one.
|    #>
|    param([AllowEmptyCollection()][object[]]$Collections = @(), [AllowEmptyCollection()][object[]]$CarryLinks = @(),
|          [datetime]$NowUtc = [datetime]::UtcNow, [int]$StaleDays = 7, [double]$IdleStaleHours = 0, $IdleBeforeUtc = $null, [string]$IdleReason = '')
|    $g = { param($r, [string]$n) $v = $null; if ($r -is [System.Collections.IDictionary]) { if ($r.Contains($n)) { $v = $r[$n] } } elseif ($null -ne $r -and $r.PSObject.Properties[$n]) { $v = $r.$n }; if ($v -is [System.DBNull]) { $null } else { $v } }
|    $rows = New-Object System.Collections.Generic.List[object]
|    foreach ($r in @($Collections)) {
|        if ($null -eq $r) { continue }
|        $grain = [string](& $g $r 'Grain'); if ($grain -notin 'Detailed', 'Summary') { continue }
|        $t = ConvertTo-SIDataUtc (& $g $r 'CollectionTime'); if ($null -eq $t) { continue }
|        $id = & $g $r 'CollectionId'
|        $rows.Add([pscustomobject]@{ Grain = $grain; CollectionId = $(if ($null -ne $id) { [int]$id } else { $null }); CollectionTime = $t; Status = [string](& $g $r 'Status')
|                                     Retired = ($null -ne (& $g $r 'RetiredAt')); HasRows = ([int](& $g $r 'HasRows') -eq 1); Pending = ([int](& $g $r 'Pending') -eq 1)
|                                     Published = ([int](& $g $r 'Published') -eq 1)
|                                     # #892 B1: when and why it was marked (only a marked one has them)
|                                     RetiredAt = (ConvertTo-SIDataUtc (& $g $r 'RetiredAt')); RetiredWhy = [string](& $g $r 'RetiredWhy') })
|    }
|    $staleBefore = $null
|    if ($StaleDays -gt 0) { $staleBefore = $NowUtc.ToUniversalTime().AddDays(-$StaleDays) }
|    # carried-from links: kept collection id -> the collections its reports show rows from
|    $from = @{}
|    foreach ($l in @($CarryLinks)) {
|        if ($null -eq $l) { continue }
|        $c = & $g $l 'CollectionId'; $f = & $g $l 'FromCollectionId'
|        if ($null -eq $c -or $null -eq $f) { continue }
|        $k = [string][int]$c; if (-not $from.ContainsKey($k)) { $from[$k] = New-Object System.Collections.Generic.List[int] }
|        $from[$k].Add([int]$f)
|    }
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($grain in 'Detailed', 'Summary') {
|        $all = @($rows | Where-Object { $_.Grain -eq $grain } | Sort-Object CollectionTime -Descending)
|        if (-not $all.Count) { continue }
|        $item = { param($x, [string]$action, [string]$why, [string]$reason)
|            [pscustomobject]@{ Grain = $x.Grain; CollectionId = $x.CollectionId; CollectionTime = $x.CollectionTime; Status = $x.Status; Action = $action; Why = $why; Reason = $reason
|                               RetiredAt = $x.RetiredAt; RetiredWhy = $x.RetiredWhy } }
|        # a marked collection whose removal stopped part way is finished, whatever else is decided
|        # (#892: the published run's collection is never finished, also when it carries a mark -- the views read it)
|        foreach ($x in @($all | Where-Object { $_.Retired -and $_.HasRows })) {
|            if ($x.Published) { $out.Add((& $item $x 'Keep' '' 'the published run -- what every view shows; its rows are never removed, also when it carries a mark')); continue }
|            $out.Add((& $item $x 'Finish' '' 'its rows were being removed when an earlier run stopped -- the rest is removed now'))
|        }
|        $live = @($all | Where-Object { -not $_.Retired })
|        $complete = @($live | Where-Object { $_.Status -eq 'Complete' })
|        # #746: a run that stopped long ago, with a newer run of the same grain after it, is abandoned whether or not any
|        # collection is complete -- never the newest collection of the grain, never one whose result waits to be completed
|        $newestAny = if ($live.Count) { $live[0].CollectionTime } else { $null }
|        $stale = {
|            param($x)
|            $null -ne $staleBefore -and $x.Status -ne 'Complete' -and -not $x.Pending -and $x.CollectionTime -lt $staleBefore -and $null -ne $newestAny -and $x.CollectionTime -lt $newestAny
|        }
|        $staleReason = [string]::Format($inv, 'its run stopped or failed more than {0} days ago and a newer run of the same kind started after it -- no run can still be writing it', $StaleDays)
|        # #816: no pipeline run is running (the caller's check) -- a Detailed collection still loading after IdleStaleHours is a stopped run's
|        $idleBefore = if ($null -ne $IdleBeforeUtc -and $grain -eq 'Detailed') { ([datetime]$IdleBeforeUtc).ToUniversalTime() } elseif ($IdleStaleHours -gt 0 -and $grain -eq 'Detailed') { $NowUtc.ToUniversalTime().AddHours(-$IdleStaleHours) } else { $null }
|        $stopped = { param($x) $null -ne $idleBefore -and $x.Status -ne 'Complete' -and -not $x.Pending -and -not $x.Published -and $x.CollectionTime -lt $idleBefore }
|        $stoppedReason = if ($null -ne $IdleBeforeUtc -and $IdleReason) { $IdleReason } else { [string]::Format($inv, 'its run stopped before it was complete: it is still loading after {0:0.#} hours and no pipeline run is running', $IdleStaleHours) }
|        if (-not $complete.Count) {
|            foreach ($x in $live) {
|                if (& $stale $x) { $out.Add((& $item $x 'Retire' 'abandoned' $staleReason)); continue }
|                if (& $stopped $x) { $out.Add((& $item $x 'Retire' 'stopped run' $stoppedReason)); continue }
|                $out.Add((& $item $x 'Keep' '' 'no collection of this kind is complete yet -- nothing is removed until one is, or until a stopped run is older than the longest run may take'))
|            }
|            continue
|        }
|        $newest = $complete[0]
|        $keep = @{}
|        $keep[[string]$newest.CollectionTime.Ticks] = 'the newest complete collection -- what every view shows'
|        if ($complete.Count -gt 1) { $keep[[string]$complete[1].CollectionTime.Ticks] = 'the complete collection before the newest -- the comparison between runs reads it' }
|        # ONE TRUSTED RUN: the published run's collection is what every view shows -- kept, however many newer ones there are
|        foreach ($x in @($complete | Where-Object { $_.Published })) { $keep[[string]$x.CollectionTime.Ticks] = 'the published run -- what every view shows' }
|        # the collections a kept collection's not-complete reports show their last complete rows from (Detailed only), and theirs
|        if ($grain -eq 'Detailed') {
|            $byId = @{}; foreach ($x in $complete) { if ($null -ne $x.CollectionId) { $byId[[string]$x.CollectionId] = $x } }
|            $changed = $true
|            while ($changed) {
|                $changed = $false
|                foreach ($x in @($complete | Where-Object { $keep.ContainsKey([string]$_.CollectionTime.Ticks) })) {
|                    if ($null -eq $x.CollectionId -or -not $from.ContainsKey([string]$x.CollectionId)) { continue }
|                    foreach ($fid in $from[[string]$x.CollectionId]) {
|                        $src = $byId[[string]$fid]
|                        if ($src -and -not $keep.ContainsKey([string]$src.CollectionTime.Ticks)) {
|                            $keep[[string]$src.CollectionTime.Ticks] = [string]::Format($inv, 'a report of the kept collection of {0:yyyy-MM-dd HH:mm} UTC shows its last complete rows from here', $x.CollectionTime)
|                            $changed = $true
|                        }
|                    }
|                }
|            }
|        }
|        foreach ($x in $live) {
|            $k = [string]$x.CollectionTime.Ticks
|            if ($keep.ContainsKey($k)) { $out.Add((& $item $x 'Keep' '' $keep[$k])); continue }
|            if ($x.Status -ne 'Complete') {
|                if ($x.CollectionTime -ge $newest.CollectionTime) {
|                    if (& $stale $x) { $out.Add((& $item $x 'Retire' 'abandoned' $staleReason)); continue }
|                    if (& $stopped $x) { $out.Add((& $item $x 'Retire' 'stopped run' $stoppedReason)); continue }
|                    $out.Add((& $item $x 'Keep' '' 'still loading and newer than the newest complete collection -- a run in progress is never removed')); continue
|                }
|                $out.Add((& $item $x 'Retire' 'abandoned' ([string]::Format($inv, 'its run stopped or failed before it was complete; the newer collection of {0:yyyy-MM-dd HH:mm} UTC is complete', $newest.CollectionTime))))
|                continue
|            }
|            $out.Add((& $item $x 'Retire' 'superseded' 'older than the newest complete collection and the one before it'))
|        }
|    }
|    , $out.ToArray()
|}
|
|function Get-SIDataRetireMarkSql {
|    <#
|        Marks ONE collection retired (its rows are removed next). The database itself refuses -- answers 0 -- unless newer
|        COMPLETE collections of the same grain exist that are not marked: one for a 'Loading' collection, two for a complete
|        one. So the newest complete collection, and a run still loading after it, can never be marked whatever the caller
|        asks. A Detailed collection also leaves the collection views' list (ViewsReadyAt). Answers 1 when marked.
|        #746: a NOT complete collection is also accepted when it is older than @StaleBefore (ISO text; '' = never) and a
|        newer, unmarked collection of the same grain exists -- so the newest collection of a grain is never marked this way.
|        #816 -Idle (Detailed; the caller found no pipeline run running): a NOT complete collection that started before
|        @IdleBefore (ISO text) and whose Risk Analysis result does not wait for the data sync (RaCompletedAt) is accepted too --
|        the newest one included: no run is writing it. Never the published run's collection, never a complete one.
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Detailed', 'Summary')][string]$Grain, [switch]$Idle)
|    if ($Grain -eq 'Summary') {
|        return @'
|SET NOCOUNT ON;
|DECLARE @stale datetime2(3) = TRY_CONVERT(datetime2(3), NULLIF(@StaleBefore, N''), 126);
|-- ONE TRUSTED RUN: the published run's Summary is never marked, whatever the caller asks (in ONE transaction
|-- under the publisher's app lock, the pointer checked again in the UPDATE)
|SET XACT_ABORT ON;
|BEGIN TRANSACTION;
|DECLARE @pubT datetime2(3) = NULL;
|IF OBJECT_ID('sidata.PublishedRun') IS NOT NULL
|BEGIN
|    DECLARE @lk int;
|    EXEC @lk = sp_getapplock @Resource = N'sidata.PublishedRun', @LockMode = N'Shared', @LockOwner = N'Transaction', @LockTimeout = 60000;
|    IF @lk < 0 BEGIN ROLLBACK TRANSACTION; SELECT 0; RETURN; END
|    EXEC sp_executesql N'SELECT @p = SummaryCollectionTime FROM sidata.PublishedRun WHERE Name = N''current''', N'@p datetime2(3) OUTPUT', @p = @pubT OUTPUT;
|    IF @pubT = CONVERT(datetime2(3), @CollectionTime, 126) BEGIN ROLLBACK TRANSACTION; SELECT 0; RETURN; END
|END
|UPDATE l SET RetiredAt = SYSUTCDATETIME(), RetiredWhy = LEFT(@Why, 32)
|FROM sidata.SummaryLoad AS l
|WHERE l.CollectionTime = CONVERT(datetime2(3), @CollectionTime, 126) AND l.RetiredAt IS NULL AND (@pubT IS NULL OR l.CollectionTime <> @pubT)
|  AND ((SELECT COUNT(*) FROM sidata.SummaryLoad AS x WHERE x.Status = N'Complete' AND x.RetiredAt IS NULL AND x.CollectionTime > l.CollectionTime)
|      >= CASE WHEN l.Status = N'Complete' THEN 2 ELSE 1 END
|    OR (l.Status <> N'Complete' AND @stale IS NOT NULL AND l.CollectionTime < @stale
|        AND EXISTS (SELECT 1 FROM sidata.SummaryLoad AS y WHERE y.RetiredAt IS NULL AND y.CollectionTime > l.CollectionTime)));
|DECLARE @n int = @@ROWCOUNT;
|COMMIT TRANSACTION;
|SELECT @n;
|'@
|    }
|    $idleDeclare = ''; $idleCase = ''
|    if ($Idle) {
|        $idleDeclare = @'
|DECLARE @idle datetime2(3) = TRY_CONVERT(datetime2(3), NULLIF(@IdleBefore, N''), 126);
|DECLARE @pending bit = 0;
|IF COL_LENGTH('sidata.Collection', 'RaCompletedAt') IS NOT NULL
|    EXEC sp_executesql N'SELECT @p = CASE WHEN RaCompletedAt IS NOT NULL THEN 1 ELSE 0 END FROM sidata.Collection WHERE CollectionId = @c', N'@c int, @p bit OUTPUT', @c = @c, @p = @pending OUTPUT;
|
|'@
|        $idleCase = "`n    OR (c.Status <> N'Complete' AND @idle IS NOT NULL AND @pending = 0 AND c.CollectionTime < @idle)"
|    }
|    $sql = @'
|SET NOCOUNT ON;
|DECLARE @c int = CONVERT(int, @CollectionId);
|DECLARE @stale datetime2(3) = TRY_CONVERT(datetime2(3), NULLIF(@StaleBefore, N''), 126);
|{IDLE}-- ONE TRUSTED RUN: the published run's collection is never marked, whatever the caller asks. The mark and
|-- the publisher never interleave -- the pointer is read and the mark made in ONE transaction under the publisher's own app lock
|-- (shared here; sidata.PublishedRunSet takes it exclusive before it reads a collection's mark and moves the pointer), and the
|-- pointer is checked again in the UPDATE itself.
|SET XACT_ABORT ON;
|BEGIN TRANSACTION;
|DECLARE @pub int = NULL;
|IF OBJECT_ID('sidata.PublishedRun') IS NOT NULL
|BEGIN
|    DECLARE @lk int;
|    EXEC @lk = sp_getapplock @Resource = N'sidata.PublishedRun', @LockMode = N'Shared', @LockOwner = N'Transaction', @LockTimeout = 60000;
|    IF @lk < 0 BEGIN ROLLBACK TRANSACTION; SELECT 0; RETURN; END
|    EXEC sp_executesql N'SELECT @p = DetailedCollectionId FROM sidata.PublishedRun WHERE Name = N''current''', N'@p int OUTPUT', @p = @pub OUTPUT;
|    IF @pub = @c BEGIN ROLLBACK TRANSACTION; SELECT 0; RETURN; END
|END
|UPDATE c SET RetiredAt = SYSUTCDATETIME(), RetiredWhy = LEFT(@Why, 32)
|FROM sidata.Collection AS c
|WHERE c.CollectionId = @c AND c.Kind = N'Detailed' AND c.RetiredAt IS NULL AND (@pub IS NULL OR c.CollectionId <> @pub)
|  AND ((SELECT COUNT(*) FROM sidata.Collection AS x WHERE x.Kind = N'Detailed' AND x.Status = N'Complete' AND x.RetiredAt IS NULL AND x.CollectionTime > c.CollectionTime)
|      >= CASE WHEN c.Status = N'Complete' THEN 2 ELSE 1 END
|    OR (c.Status <> N'Complete' AND @stale IS NOT NULL AND c.CollectionTime < @stale
|        AND EXISTS (SELECT 1 FROM sidata.Collection AS y WHERE y.Kind = N'Detailed' AND y.RetiredAt IS NULL AND y.CollectionTime > c.CollectionTime)){CASE});
|DECLARE @n int = @@ROWCOUNT;
|IF @n > 0 AND COL_LENGTH('sidata.Collection', 'ViewsReadyAt') IS NOT NULL
|    EXEC sp_executesql N'UPDATE sidata.Collection SET ViewsReadyAt = NULL WHERE CollectionId = @c', N'@c int', @c = @c;
|COMMIT TRANSACTION;
|SELECT @n;
|'@
|    $sql.Replace('{IDLE}', $idleDeclare).Replace('{CASE}', $idleCase)
|}
|
|$script:SIDataRetireTables = [ordered]@{
|    # removed in this order: the finding rows LAST, so a removal that stops part way still shows as rows left (HasRows)
|    Detailed = @('IssueContext', 'RaStage', 'RaDefenderKey', 'Recommendation', 'Finding')
|    Summary  = @('RaStage', 'RaDefenderKey', 'SummaryAsset', 'SummaryRow')
|}
|
|function Get-SIDataRetireBatchSql {
|    <#
|        One batch of one MARKED collection's rows of one table (from an allow-list, never input): 'DELETE TOP (@Batch) ...;
|        SELECT @@ROWCOUNT'. Every statement removes rows only while the collection is marked, on the table's clustered key.
|        A table the database does not have answers 0.
|        #892 (review B1) -DataSyncMarkedBefore (Detailed; while a pipeline run is going): only while the mark is one the data
|        sync made (superseded / abandoned) BEFORE @MarkedBefore (ISO text: the running run's start).
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Detailed', 'Summary')][string]$Grain,
|          [Parameter(Mandatory)][ValidateSet('IssueContext', 'RaStage', 'RaDefenderKey', 'Recommendation', 'Finding', 'SummaryAsset', 'SummaryRow')][string]$Table,
|          [switch]$DataSyncMarkedBefore)
|    $since = if ($DataSyncMarkedBefore -and $Grain -eq 'Detailed') { " AND m.RetiredAt < CONVERT(datetime2(0), @MarkedBefore, 126) AND m.RetiredWhy IN (N'superseded', N'abandoned', N'stopped run')" } else { '' }
|    $marked = if ($Grain -eq 'Summary') { "EXISTS (SELECT 1 FROM sidata.SummaryLoad AS m WHERE m.CollectionTime = CONVERT(datetime2(3), @CollectionTime, 126) AND m.RetiredAt IS NOT NULL)" }
|              else { "EXISTS (SELECT 1 FROM sidata.Collection AS m WHERE m.CollectionId = CONVERT(int, @CollectionId) AND m.Kind = N'Detailed' AND m.RetiredAt IS NOT NULL$since)" }
|    $where = switch ($Table) {
|        { $_ -in 'RaStage', 'RaDefenderKey' } { 'RunKey = @RunKey' }
|        { $_ -in 'SummaryAsset', 'SummaryRow' } { 'CollectionTime = CONVERT(datetime2(3), @CollectionTime, 126)' }
|        default { 'CollectionId = CONVERT(int, @CollectionId)' }
|    }
|    "IF OBJECT_ID('sidata.$Table') IS NULL BEGIN SELECT 0; RETURN; END; DELETE TOP (@Batch) FROM sidata.$Table WHERE $where AND $marked; SELECT @@ROWCOUNT;"
|}
|
|# #892 the two large tables of a MARKED Detailed collection are removed in KEY RANGES on their clustered key (CollectionId,
|# <row id>): each statement works out the end of its range first, then removes exactly that range -- so a batch never scans
|# the ghost rows of the batches before it, and a removal that is stopped goes on from the collection's first row left.
|$script:SIDataRetireRangeKeys = [ordered]@{ Finding = 'FindingId'; Recommendation = 'RecommendationRowId' }
|
|function Get-SIDataRetireRangeSql {
|    <#
|        ONE KEY RANGE of one MARKED Detailed collection's rows of -Table (Finding | Recommendation, an allow-list, never input).
|        Answers ONE row: N (rows removed), Hi (the range's last row id; NULL = nothing is left), Refused (1 = the database
|        refused: nothing removed although the caller asked), Cap (the most rows one range may take).
|          * @MarkedBefore (ISO text, '' = not asked; review B1): only a mark the data sync made (superseded / abandoned) before
|            it -- the running pipeline run's start, so nothing in that run can be writing the collection;
|          * the range is never larger than @Cap: below SQL Server's lock escalation (5,000 locks of one statement), counting
|            one lock in EVERY index of the table (review S5) -- a range never turns into a table lock that holds a run's writes;
|          * @After = 0 starts at the collection's first row (one seek on the clustered key; review M4);
|          * the published run's collection is refused INSIDE the DELETE, and the range runs under the publisher's own app lock
|            (shared; sidata.PublishedRunSet takes it exclusive), so a publish never interleaves with a range (review S4);
|          * the DELETE carries the mark (and the B1 condition) again.
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Finding', 'Recommendation')][string]$Table)
|    $k = $script:SIDataRetireRangeKeys[$Table]
|    $mark = "EXISTS (SELECT 1 FROM sidata.Collection AS m WHERE m.CollectionId = @c AND m.Kind = N'Detailed' AND m.RetiredAt IS NOT NULL AND (@mb IS NULL OR (m.RetiredAt < @mb AND m.RetiredWhy IN (N'superseded', N'abandoned', N'stopped run'))))"
|    $markQ = $mark.Replace("'", "''")
|    @"
|SET NOCOUNT ON;
|SET XACT_ABORT ON;
|DECLARE @c int = CONVERT(int, @CollectionId); DECLARE @lo bigint = CONVERT(bigint, @After); DECLARE @hi bigint = NULL; DECLARE @n bigint = 0;
|DECLARE @mb datetime2(0) = TRY_CONVERT(datetime2(0), NULLIF(@MarkedBefore, N''), 126);
|IF OBJECT_ID('sidata.$Table') IS NULL OR NOT $mark
|BEGIN SELECT CAST(0 AS bigint) AS N, CAST(NULL AS bigint) AS Hi, CAST(1 AS int) AS Refused, CAST(0 AS int) AS Cap; RETURN; END
|DECLARE @ix int = (SELECT COUNT(*) FROM sys.indexes WHERE object_id = OBJECT_ID('sidata.$Table') AND index_id > 0 AND is_hypothetical = 0 AND is_disabled = 0);
|DECLARE @cap int = 4000 / CASE WHEN @ix < 1 THEN 1 ELSE @ix END;
|IF @cap < 1 SET @cap = 1;
|DECLARE @take int = TRY_CONVERT(int, @Batch);
|IF @take IS NULL OR @take < 1 OR @take > @cap SET @take = @cap;
|IF @lo <= 0 SELECT @lo = ISNULL(MIN($k) - 1, 0) FROM sidata.$Table WHERE CollectionId = @c;
|BEGIN TRANSACTION;
|IF OBJECT_ID('sidata.PublishedRun') IS NOT NULL
|BEGIN
|    DECLARE @lk int;
|    EXEC @lk = sp_getapplock @Resource = N'sidata.PublishedRun', @LockMode = N'Shared', @LockOwner = N'Transaction', @LockTimeout = 10000;
|    IF @lk < 0 BEGIN ROLLBACK TRANSACTION; SELECT CAST(0 AS bigint) AS N, CAST(NULL AS bigint) AS Hi, CAST(1 AS int) AS Refused, @cap AS Cap; RETURN; END
|END
|SELECT @hi = MAX(x.$k) FROM (SELECT TOP (@take) $k FROM sidata.$Table WHERE CollectionId = @c AND $k > @lo ORDER BY $k) AS x;
|IF @hi IS NULL BEGIN COMMIT TRANSACTION; SELECT CAST(0 AS bigint) AS N, CAST(NULL AS bigint) AS Hi, CAST(0 AS int) AS Refused, @cap AS Cap; RETURN; END
|IF OBJECT_ID('sidata.PublishedRun') IS NOT NULL
|    EXEC sp_executesql N'DELETE FROM sidata.$Table WHERE CollectionId = @c AND $k > @lo AND $k <= @hi
|  AND $markQ
|  AND NOT EXISTS (SELECT 1 FROM sidata.PublishedRun AS p WHERE p.Name = N''current'' AND p.DetailedCollectionId = @c);
|SET @n = @@ROWCOUNT;', N'@c int, @lo bigint, @hi bigint, @mb datetime2(0), @n bigint OUTPUT', @c = @c, @lo = @lo, @hi = @hi, @mb = @mb, @n = @n OUTPUT;
|ELSE
|BEGIN
|    DELETE FROM sidata.$Table WHERE CollectionId = @c AND $k > @lo AND $k <= @hi AND $mark;
|    SET @n = @@ROWCOUNT;
|END
|COMMIT TRANSACTION;
|SELECT @n AS N, @hi AS Hi, CASE WHEN @n = 0 THEN 1 ELSE 0 END AS Refused, @cap AS Cap;
|"@
|}
|
|function Invoke-SIDataRetireRangeDelete {
|    <#
|        #892 Removes one marked Detailed collection's rows of -Table range by range (Get-SIDataRetireRangeSql) until nothing
|        is left, the database refuses, or -DeadlineUtc is reached (no new range after it -- checked after the pacing pause,
|        review M7; the next call goes on from what is left). -MarkedBeforeUtc (review B1): only a mark the data sync made
|        before it. Each range's size follows the last one's measured time (Get-SIDataNextSize, aim -TargetMs), never above the
|        database's own cap (below lock escalation), and the database's load paces them (Invoke-SISqlPacing -Housekeeping: the
|        removal waits until the database is calm -- below the LOW mark once it reached the HIGH one -- never past
|        -DeadlineUtc, and the first range of a wake-up always runs). A measurement, never a limit on the work.
|        -ShouldStop (the clean-up as housekeeping): asked before EVERY range; a non-empty answer (why) stops the removal there
|        (Stopped, StopWhy) -- the next wake-up goes on from the collection's first row left.
|        Returns @{ Rows; Done ($true = nothing left); Refused ($true = the database refused); Stopped; StopWhy }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][ValidateSet('Finding', 'Recommendation')][string]$Table,
|          [Parameter(Mandatory)][string]$CollectionId, [ref]$BatchSize, [long]$TargetMs = 5000, [datetime]$DeadlineUtc = [datetime]::MaxValue,
|          $MarkedBeforeUtc = $null, [scriptblock]$ShouldStop)
|    $sql = Get-SIDataRetireRangeSql -Table $Table
|    $mbText = if ($null -ne $MarkedBeforeUtc) { Format-SIDataSqlTime -Time ([datetime]$MarkedBeforeUtc).ToUniversalTime() } else { '' }
|    $size = [long]5000; if ($BatchSize -and $BatchSize.Value -gt 0) { $size = [long]$BatchSize.Value }
|    $paced = [bool](Get-Command -Name Invoke-SISqlPacing -ErrorAction SilentlyContinue); $lastMs = 0L
|    $after = '0'; $total = 0L; $done = $false; $refused = $false; $stopWhy = ''
|    $g = { param($r, [string]$n) $v = $null
|           if ($r -is [System.Collections.IDictionary]) { if ($r.Contains($n)) { $v = $r[$n] } }
|           elseif ($r -is [System.Data.DataRow]) { $v = $r[$n] }
|           elseif ($null -ne $r -and $r.PSObject.Properties[$n]) { $v = $r.$n }
|           if ($v -is [System.DBNull]) { $null } else { $v } }
|    while ($true) {
|        # housekeeping: waits until the database is calm (never past the deadline); the first range of a wake-up always runs
|        if ($paced) {
|            $pace = Invoke-SISqlPacing -Invoke $Invoke -LastBatchMs $lastMs -Housekeeping -DeadlineUtc $DeadlineUtc
|            if ($pace.Shrink) { $size = [Math]::Max(1L, [long][Math]::Floor($size / 2)) }
|            if ($pace.PSObject.Properties['Deadline'] -and $pace.Deadline) { break }
|        }
|        if ([datetime]::UtcNow -ge $DeadlineUtc) { break }
|        # housekeeping: no new range once a run, a data sync or a data out has started (asked right before the statement)
|        if ($ShouldStop) {
|            $w = ''; try { $w = [string](& $ShouldStop) } catch { $w = ('whether a job started could not be read ({0})' -f $_.Exception.Message) }
|            if ($w) { $stopWhy = $w; break }
|        }
|        $sw = [Diagnostics.Stopwatch]::StartNew()
|        $row = @(@(& $Invoke $sql @{ CollectionId = $CollectionId; After = $after; Batch = $size; MarkedBefore = $mbText } 'reader') | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) | Select-Object -First 1
|        $sw.Stop(); $lastMs = $sw.ElapsedMilliseconds
|        $nv = & $g $row 'N'; $hi = & $g $row 'Hi'; $rf = & $g $row 'Refused'; $cap = & $g $row 'Cap'
|        if ($null -ne $nv) { $total += [long]$nv }
|        if ($null -ne $rf -and [int]$rf -eq 1) { $refused = $true; break }
|        if ($null -eq $hi) { $done = $true; break }
|        $after = ([long]$hi).ToString([Globalization.CultureInfo]::InvariantCulture)
|        $size = Get-SIDataNextSize -Current $size -ElapsedMs $lastMs -TargetMs $TargetMs -Minimum 1
|        # the database's cap is the most a range takes: a larger asked size only shows up as the same cap
|        if ($null -ne $cap -and [long]$cap -gt 0 -and $size -gt [long]$cap) { $size = [long]$cap }
|    }
|    if ($BatchSize) { $BatchSize.Value = $size }
|    [pscustomobject]@{ Rows = $total; Done = $done; Refused = $refused; Stopped = [bool]$stopWhy; StopWhy = $stopWhy }
|}
|
|function Remove-SIDataCollectionRows {
|    <#
|        THE ONE REMOVAL of a MARKED collection's rows (#1038 part 3: every caller that removes collection rows goes through
|        here -- the housekeeping wake-up, and the retention step behind it). One plan item's grain and collection: its tables
|        in the retire order ($script:SIDataRetireTables -- the finding rows LAST, so a removal that stops part way still shows
|        as rows left), the two large tables in key ranges (Invoke-SIDataRetireRangeDelete), the others in batches below lock
|        escalation (Invoke-SIDataBatchedDelete -Housekeeping -LockBound), all paced by the database's load. Today a row delete;
|        the seam where a partition truncate takes its place (#1038 part 2) -- the callers do not change.
|          -State: what is carried from one collection to the next (the batch size, each large table's range size, each batched
|           table's lock bound); the caller keeps it. -DeadlineUtc: no new range / batch after it. -MarkedBeforeUtc: only a
|           mark made before it (review B1; '' = any mark). -ShouldStop: asked before EVERY range and batch -- a non-empty answer
|           (why) stops here; the collection stays marked with its rows left and the next wake-up goes on.
|        Every statement removes rows only of a MARKED collection, never the published run's (the statements refuse it).
|        Returns @{ Rows (per table: the rows removed); Done ($true = nothing left); Refused (the database refused);
|        Stopped (not done, not refused: the deadline or -ShouldStop); Paused (-ShouldStop stopped it); StopWhy }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [Parameter(Mandatory)][ValidateSet('Detailed', 'Summary')][string]$Grain,
|          [string]$CollectionId = '', [Parameter(Mandatory)][string]$CollectionTime, [hashtable]$State,
|          [long]$BatchSize = 5000, [datetime]$DeadlineUtc = [datetime]::MaxValue, $MarkedBeforeUtc = $null, [scriptblock]$ShouldStop)
|    if ($null -eq $State) { $State = @{} }
|    if (-not $State.ContainsKey('Batch')) { $State['Batch'] = [long][Math]::Max(1L, $BatchSize) }
|    if (-not $State.ContainsKey('Range')) { $State['Range'] = @{} }
|    if (-not $State.ContainsKey('Bound')) { $State['Bound'] = @{} }
|    $deadline = $DeadlineUtc; $lockBound = $State['Bound']; $markedBefore = $MarkedBeforeUtc
|    $prm = @{ CollectionId = $CollectionId; CollectionTime = $CollectionTime; RunKey = ('{0}|{1}' -f $Grain, $CollectionTime) }
|    $rows = [ordered]@{}; $done = $true; $refused = $false; $why = ''
|    foreach ($t in $script:SIDataRetireTables[$Grain]) {
|        if ([datetime]::UtcNow -ge $deadline) { $done = $false; break }
|        if (-not $rows.Contains($t)) { $rows[$t] = 0L }
|        if ($Grain -eq 'Detailed' -and $script:SIDataRetireRangeKeys.Contains($t) -and $CollectionId) {
|            # #892 the large tables in key ranges; a range cut short leaves the collection unfinished
|            $rb = if ($State['Range'].ContainsKey($t)) { [long]$State['Range'][$t] } else { [long][Math]::Max(1L, $BatchSize) }
|            $rr = Invoke-SIDataRetireRangeDelete -Invoke $Invoke -Table $t -CollectionId $CollectionId -BatchSize ([ref]$rb) -DeadlineUtc $deadline -MarkedBeforeUtc $markedBefore -ShouldStop $ShouldStop
|            $State['Range'][$t] = $rb
|            $rows[$t] += [long]$rr.Rows
|            # review M3: a range the database refused is never counted as removed
|            if ($rr.Refused) { $refused = $true; $done = $false; break }
|            if ($rr.PSObject.Properties['StopWhy'] -and $rr.StopWhy) { $why = [string]$rr.StopWhy; $done = $false; break }
|            if (-not $rr.Done) { $done = $false; break }
|            continue
|        }
|        $bp = $prm; $bsql = Get-SIDataRetireBatchSql -Grain $Grain -Table $t
|        if ($null -ne $markedBefore -and $Grain -eq 'Detailed') { $bsql = Get-SIDataRetireBatchSql -Grain $Grain -Table $t -DataSyncMarkedBefore; $bp = @{} + $prm; $bp['MarkedBefore'] = (Format-SIDataSqlTime -Time ([datetime]$markedBefore).ToUniversalTime()) }
|        # the batches stay below lock escalation (the key ranges' rule, worked out once per table) and wait for the
|        # database to be calm (housekeeping)
|        if (-not $lockBound.ContainsKey($t)) { $lockBound[$t] = Get-SIDataRetireBatchBound -Invoke $Invoke -Table $t }
|        $hkStop = [ref]$false; $hkWhy = [ref]''
|        $batch = [long]$State['Batch']
|        $n = Invoke-SIDataBatchedDelete -Invoke $Invoke -Sql $bsql -Params $bp -BatchSize ([ref]$batch) -DeadlineUtc $deadline -Housekeeping -LockBound ([long]$lockBound[$t]) -Stopped $hkStop -ShouldStop $ShouldStop -StopWhy $hkWhy
|        $State['Batch'] = $batch
|        $rows[$t] += [long]$n
|        # the wait reached the deadline, or a job started: this table may still hold rows -- the next tables (the finding rows
|        # last) wait for the next call, so a collection with rows left always shows as one (HasRows)
|        if ($hkWhy.Value) { $why = [string]$hkWhy.Value; $done = $false; break }
|        if ($hkStop.Value) { $done = $false; break }
|    }
|    [pscustomobject]@{ Rows = $rows; Done = $done; Refused = $refused; Stopped = (-not $done -and -not $refused); Paused = [bool]$why; StopWhy = $why }
|}
|
|function Format-SIDataRetentionText {
|    <# PURE. The one plain line: what was kept, what was removed and how many rows per table. -Result: Invoke-SIDataCollectionRetention's (before its Text). #>
|    param([Parameter(Mandatory)]$Result, [switch]$DryRun)
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $label = @{ Detailed = 'Risk Analysis'; Summary = 'Risk Analysis Summary' }
|    $kept = foreach ($gr in 'Detailed', 'Summary') {
|        $k = @(@($Result.Plan) | Where-Object { $_ -and $_.Grain -eq $gr -and $_.Action -eq 'Keep' -and $_.Status -eq 'Complete' } | Sort-Object CollectionTime -Descending)
|        if ($k.Count) { '{0} {1}' -f $label[$gr], ((@($k | ForEach-Object { [string]::Format($inv, '{0:yyyy-MM-dd HH:mm}', $_.CollectionTime) })) -join ' + ') }
|    }
|    $keptText = if (@($kept).Count) { 'kept ' + (@($kept) -join '; ') + ' (UTC)' } else { 'no complete collection yet' }
|    $acted = @(@($Result.Plan) | Where-Object { $_ -and $_.Action -in 'Retire', 'Finish' })
|    if ($DryRun) {
|        return ('{0}; would remove the rows of {1} older or abandoned collection(s) -- nothing is written in a dry run' -f $keptText, $acted.Count)
|    }
|    $done = @($Result.Removed)
|    $refusedText = ''
|    if (@($Result.Refused).Count) { $refusedText = (' {0} collection(s) were not removed: the database did not confirm newer complete collections.' -f @($Result.Refused).Count) }
|    # #816: a removal cut short by its time budget -- the collection is marked (never shown again) and the next call finishes it
|    $stopped = $Result.PSObject.Properties['Stopped'] -and $Result.Stopped
|    # #1038 part 3: a job started -- the removal gives way between two ranges
|    $paused = if ($Result.PSObject.Properties['Paused'] -and $Result.Paused) { [string]$Result.Paused } else { '' }
|    if ($paused) { $refusedText += [string]::Format($inv, ' Paused part way ({0:N0} finding row(s) removed so far): {1} -- the rest is removed when nothing runs.', [long]$Result.Rows['findings'], $paused) }
|    elseif ($stopped) { $refusedText += [string]::Format($inv, ' The time budget of this step ended part way ({0:N0} finding row(s) removed so far) -- the rest is removed next time.', [long]$Result.Rows['findings']) }
|    if (-not $done.Count) { return ('{0}; {1}{2}' -f $keptText, $(if ($stopped) { 'removal in progress.' } else { 'nothing older to remove.' }), $refusedText) }
|    $ab = @($done | Where-Object { $_.Why -in 'abandoned', 'stopped run' }).Count
|    $r = $Result.Rows
|    $text = [string]::Format($inv, '{0}; removed the rows of {1} collection(s) ({2} abandoned by a run that stopped, {3} older) -- findings {4:N0}, recommendations {5:N0}, prepared issue rows {6:N0}, staged rows {7:N0}, Summary rows {8:N0}, Summary assets {9:N0}. Their day totals stay for the trends.',
|        $keptText, $done.Count, $ab, ($done.Count - $ab), $r['findings'], $r['recommendations'], $r['issueRows'], ($r['stagedRows'] + $r['defenderKeys']), $r['summaryRows'], $r['summaryAssets'])
|    $text + $refusedText
|}
|
|function Invoke-SIDataCollectionRetention {
|    <#
|        THE STEP (see above): reads every collection, plans, marks and removes in batches; a dry run plans only. NEVER
|        throws -- a failure is Status 'failed' with its Error, and the next run tries again (a marked collection with rows
|        left is finished then). Returns @{ Status (ok | nothing | dry-run | failed); Plan; Removed (the plan items done);
|        Refused; Rows (per table); Text (the one log line); Error }.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [switch]$DryRun, [scriptblock]$Log,
|          # the FIRST batch's size; every next one follows the last one's measured time (Invoke-SIDataBatchedDelete)
|          [long]$BatchSize = 5000,
|          # #746: a stopped run's collection older than this many days, with a newer run of its grain after it, is abandoned
|          [int]$StaleDays = 7, [datetime]$NowUtc = [datetime]::UtcNow,
|          # #816: given ONLY when no pipeline run is running -- a Detailed collection still loading after this many hours is a
|          # stopped run's (Get-SIDataCollectionRetentionPlan -IdleStaleHours); 0 = that rule off
|          [double]$IdleStaleHours = 0,
|          # #816: the step's own time budget (the pipeline runner's wake-up): no new batch after it; the next call finishes
|          # what was marked (Finish). 0 = no budget (the data sync)
|          [int]$TimeBudgetSeconds = 0,
|          # #834: MARK only -- the collections the plan retires are marked (RetiredAt: never derived, prepared or shown again,
|          # the views and their own index ranges skip them at once) and NO row is removed. The data sync marks right after its
|          # loads (so it never derives a collection it removes in the same run), and -- when the pipeline started it -- leaves
|          # the rows to the pipeline runner's wake-ups, which remove them while no run is running (Invoke-SIDataStoppedRunCleanup:
|          # 'Finish' for a marked collection with rows left), never on a database the sync itself has saturated.
|          [switch]$MarkOnly,
|          # with -MarkOnly: the plain words of who removes the rows (said in the line)
|          [string]$RowsRemovedBy = '',
|          # #882: the owner floor (Get-SIDataLoadingOwnerFloor) in place of -IdleStaleHours, with its plain reason; and
|          # -OnlyWhy: act only on the plan's items of these kinds (e.g. 'stopped run' while a pipeline run is going)
|          $IdleBeforeUtc = $null, [string]$IdleReason = '', [string[]]$OnlyWhy = @(),
|          # #892 -FinishOnly: ONLY the collections that are marked already and still hold rows are removed (Finish); nothing
|          # is newly marked, nothing else in the plan is acted on. The pipeline runner's wake-up while a run is going.
|          # -FinishFloorUtc (required with -FinishOnly: the owner floor, Get-SIDataLoadingOwnerFloor): a marked collection
|          # that is NOT complete and started at or after it is left alone -- a live run may own it. Never the published one
|          # (the plan keeps it, and every range statement refuses it).
|          # -FinishMarkedBeforeUtc (required with -FinishOnly, review B1: the start of the running pipeline run): ONLY marks the data
|          # sync made (RetiredWhy superseded / abandoned) and the 'stopped run' marks (#882) made BEFORE it -- nothing in this run
|          # can be writing those. A 'stopped run' mark made while THIS run goes can hit a collection the data sync is still
|          # loading: its rows wait for the next run or a wake-up with no run going. The database checks the same on every
|          # statement. FAIL SAFE: none given = nothing removed;
|          # no time budget = nothing removed (review M5).
|          [switch]$FinishOnly, $FinishFloorUtc = $null, $FinishMarkedBeforeUtc = $null,
|          # #1038 part 3 -ShouldStop: asked before EVERY range and batch of the removal (Remove-SIDataCollectionRows); a
|          # non-empty answer (why: a pipeline run, a data sync or a data out started) stops the removal there -- Stopped, and
|          # Paused carries the why. The collection stays marked with its rows left; the next wake-up goes on.
|          [scriptblock]$ShouldStop)
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Host ('[{0}] {1}' -f $level, $msg) } }
|    $staleText = if ($StaleDays -gt 0) { Format-SIDataSqlTime -Time ($NowUtc.ToUniversalTime().AddDays(-$StaleDays)) } else { '' }
|    $idleText = if ($null -ne $IdleBeforeUtc) { Format-SIDataSqlTime -Time (([datetime]$IdleBeforeUtc).ToUniversalTime()) } elseif ($IdleStaleHours -gt 0) { Format-SIDataSqlTime -Time ($NowUtc.ToUniversalTime().AddHours(-$IdleStaleHours)) } else { '' }
|    $deadline = if ($TimeBudgetSeconds -gt 0) { [datetime]::UtcNow.AddSeconds($TimeBudgetSeconds) } else { [datetime]::MaxValue }
|    $out = [ordered]@{ Status = 'ok'; Plan = @(); Removed = @(); Refused = @(); Stopped = $false; Paused = ''; Text = ''; Error = ''
|                       Rows = [ordered]@{ findings = 0L; recommendations = 0L; issueRows = 0L; stagedRows = 0L; defenderKeys = 0L; summaryRows = 0L; summaryAssets = 0L } }
|    $key = @{ Finding = 'findings'; Recommendation = 'recommendations'; IssueContext = 'issueRows'; RaStage = 'stagedRows'; RaDefenderKey = 'defenderKeys'; SummaryRow = 'summaryRows'; SummaryAsset = 'summaryAssets' }
|    try {
|        # the pacing of the batched deletes says its line through this step's log
|        if (Get-Command -Name Get-SISqlPacer -ErrorAction SilentlyContinue) { $null = Get-SISqlPacer -Invoke $Invoke -Log $Log }
|        $state = @(@(& $Invoke (Get-SIDataRetentionStateSql) @{} 'reader') | ForEach-Object { $_ } | Where-Object { $null -ne $_ })
|        if (-not $state.Count) {
|            $out.Status = 'nothing'
|            $out.Text = 'no collection is stored yet (or the database does not have the retention mark yet -- the updater adds it) -- nothing removed'
|            & $Log 'INFO' ('collections : ' + $out.Text)
|            return [pscustomobject]$out
|        }
|        $links = @(@(& $Invoke (Get-SIDataRetentionCarrySql) @{} 'reader') | ForEach-Object { $_ } | Where-Object { $null -ne $_ })
|        # the plan answers as ONE array (', $out.ToArray()'): assigned first, then enumerated -- @(...) around the call would
|        # make it a list holding that array as its one item
|        $planRaw = Get-SIDataCollectionRetentionPlan -Collections $state -CarryLinks $links -NowUtc $NowUtc -StaleDays $StaleDays -IdleStaleHours $IdleStaleHours -IdleBeforeUtc $IdleBeforeUtc -IdleReason $IdleReason
|        $plan = @(foreach ($x in @($planRaw)) { if ($null -ne $x) { $x } })
|        # #882: only the kinds asked for are acted on (the rest of the plan is kept as it is, and said as kept)
|        if (@($OnlyWhy).Count) { $plan = @(foreach ($x in $plan) { if ($x.Action -in 'Retire', 'Finish' -and @($OnlyWhy) -notcontains [string]$x.Why) { $x.Action = 'Keep'; $x.Reason = 'left to the data sync and to a wake-up with no run running' }; $x }) }
|        # #892: only what is marked already; FAIL SAFE -- no floor, no run start or no budget = nothing is removed
|        $markedBefore = $null
|        if ($FinishOnly) {
|            $floor = if ($null -ne $FinishFloorUtc) { ([datetime]$FinishFloorUtc).ToUniversalTime() } else { $null }
|            $markedBefore = if ($null -ne $FinishMarkedBeforeUtc) { ([datetime]$FinishMarkedBeforeUtc).ToUniversalTime() } else { $null }
|            $plan = @(foreach ($x in $plan) {
|                if ($x.Action -eq 'Retire') { $x.Action = 'Keep'; $x.Reason = 'not marked by this step -- only collections marked already are removed while a run is going' }
|                elseif ($x.Action -eq 'Finish' -and $TimeBudgetSeconds -le 0) { $x.Action = 'Keep'; $x.Reason = 'no time budget was given -- nothing is removed while a run is going' }
|                elseif ($x.Action -eq 'Finish' -and $null -eq $floor) { $x.Action = 'Keep'; $x.Reason = 'which collection the live run owns is not known -- nothing is removed' }
|                elseif ($x.Action -eq 'Finish' -and $null -eq $markedBefore) { $x.Action = 'Keep'; $x.Reason = 'when the running pipeline run started is not known -- nothing is removed' }
|                # 2026-10-23 (installs at 45-61 % of the database maximum, 4-7 'Loading' collections no live run owns, some with
|                # 1.4-1.8 M rows: a run is nearly always going there, so a wake-up with no run going never came): a 'stopped run'
|                # mark (#882) made BEFORE the running pipeline run started goes the same way as the data sync's marks -- the
|                # run that could have been loading it is over, and a marked collection is never derived or shown again. A mark
|                # made during this run still waits (the rule below), and the owner floor still applies.
|                elseif ($x.Action -eq 'Finish' -and [string]$x.RetiredWhy -notin 'superseded', 'abandoned', 'stopped run') { $x.Action = 'Keep'; $x.Reason = 'marked for another reason -- its rows are removed by a wake-up with no run going' }
|                elseif ($x.Action -eq 'Finish' -and ($null -eq $x.RetiredAt -or $x.RetiredAt -ge $markedBefore)) { $x.Action = 'Keep'; $x.Reason = 'marked after the running pipeline run started -- its rows are removed once that run is over' }
|                elseif ($x.Action -eq 'Finish' -and $x.Status -ne 'Complete' -and $x.CollectionTime -ge $floor) { $x.Action = 'Keep'; $x.Reason = 'still loading and started after the Risk Analysis going now -- a live run may own it' }
|                $x })
|        }
|        $out.Plan = $plan
|        if ($DryRun) {
|            $out.Status = 'dry-run'
|            $out.Text = Format-SIDataRetentionText -Result ([pscustomobject]$out) -DryRun
|            & $Log 'INFO' ('collections : ' + $out.Text)
|            return [pscustomobject]$out
|        }
|        # what the removal carries from one collection to the next: the batch size, each large table's range size (#892,
|        # each starts at -BatchSize) and each batched table's lock-escalation bound (Get-SIDataRetireBatchBound)
|        $rmState = @{ Batch = [long][Math]::Max(1L, $BatchSize); Range = @{}; Bound = @{} }
|        $marked = New-Object System.Collections.Generic.List[object]
|        foreach ($p in @($plan | Where-Object { $_.Action -in 'Retire', 'Finish' } | Sort-Object CollectionTime)) {
|            # #834 -MarkOnly: a collection marked already (Finish) is left as it is; a new one is only marked
|            if ($MarkOnly -and $p.Action -ne 'Retire') { $marked.Add($p); continue }
|            if ([datetime]::UtcNow -ge $deadline) { $out.Stopped = $true; break }
|            $tText = Format-SIDataSqlTime -Time $p.CollectionTime
|            $prm = @{ CollectionId = $(if ($null -ne $p.CollectionId) { [string]$p.CollectionId } else { '' }); CollectionTime = $tText; RunKey = ('{0}|{1}' -f $p.Grain, $tText) }
|            if ($p.Action -eq 'Retire') {
|                # #816: the idle rule's collection is accepted by the database only through its own guarded case
|                $isIdle = ($p.Why -eq 'stopped run' -and $p.Grain -eq 'Detailed' -and $idleText)
|                $mp = @{ CollectionId = $prm.CollectionId; CollectionTime = $tText; Why = [string]$p.Why; StaleBefore = $staleText }
|                if ($isIdle) { $mp['IdleBefore'] = $idleText }
|                $m = [int](& $Invoke (Get-SIDataRetireMarkSql -Grain $p.Grain -Idle:([bool]$isIdle)) $mp 'scalar')
|                if ($m -ne 1) { $out.Refused += $p; continue }
|                if ($MarkOnly) { $marked.Add($p); continue }
|            }
|            # #1038 part 3: THE ONE REMOVAL (Remove-SIDataCollectionRows) -- the seam a partition truncate takes over (part 2)
|            $rm = Remove-SIDataCollectionRows -Invoke $Invoke -Grain $p.Grain -CollectionId $prm.CollectionId -CollectionTime $tText -State $rmState -BatchSize $BatchSize -DeadlineUtc $deadline -MarkedBeforeUtc $markedBefore -ShouldStop $ShouldStop
|            foreach ($t in @($rm.Rows.Keys)) { $out.Rows[$key[$t]] += [long]$rm.Rows[$t] }
|            # review M3: the database refused this collection's rows (not marked as asked, or the published run) -- said as refused,
|            # never as removed; the next collection is looked at
|            if ($rm.Refused) { $out.Refused += $p; continue }
|            # a run, a data sync or a data out started: the removal stops between two ranges; the collection stays marked with
|            # its rows left and the next wake-up with nothing running goes on (Finish)
|            if ($rm.Paused) { $out.Stopped = $true; $out.Paused = [string]$rm.StopWhy; break }
|            # a removal its time budget cut short is marked (RetiredAt) and finished by the next call (Finish) -- never shown again
|            if (-not $rm.Done -or [datetime]::UtcNow -ge $deadline) { $out.Stopped = $true; break }
|            $out.Removed += $p
|        }
|        $out['Marked'] = $marked.ToArray()
|        if ($MarkOnly) {
|            $inv = [Globalization.CultureInfo]::InvariantCulture
|            $by = if ($RowsRemovedBy) { $RowsRemovedBy } else { 'by the end of this data sync' }
|            $newly = @($marked | Where-Object { $_.Action -eq 'Retire' }).Count
|            $out.Text = if ($marked.Count -eq 0) { 'nothing older to remove' }
|                        else { [string]::Format($inv, '{0} older or abandoned collection(s) are marked removed{1} -- never shown again; their rows are removed {2}', $marked.Count, $(if ($newly -lt $marked.Count) { [string]::Format($inv, ' ({0} newly)', $newly) } else { '' }), $by) }
|            if (@($out.Refused).Count) { $out.Text += [string]::Format($inv, '; {0} collection(s) were not marked: the database did not confirm newer complete collections', @($out.Refused).Count) }
|            & $Log 'INFO' ('collections : ' + $out.Text)
|            return [pscustomobject]$out
|        }
|        $out.Text = Format-SIDataRetentionText -Result ([pscustomobject]$out)
|        & $Log $(if (@($out.Removed).Count) { 'OK' } else { 'INFO' }) ('collections : ' + $out.Text)
|    } catch {
|        $out.Status = 'failed'; $out.Error = $_.Exception.Message
|        $out.Text = ('the older collections were not removed this run ({0}) -- nothing current is affected; the next run tries again' -f $_.Exception.Message)
|        & $Log 'WARN' ('collections : ' + $out.Text)
|    }
|    [pscustomobject]$out
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  STOPPED RUNS (#816, owner 2026-10-20: "put #816 cleanup in the next release too"). A run that failed or was cancelled
|#  leaves its Detailed collection 'Loading' with its rows (at a large install ~1 M per attempt; 80 % of one install's
|#  sidata.Finding). The collections' retention above removes them, but only at the END of a SUCCESSFUL data sync -- which
|#  an install whose runs keep failing never reaches. So the pipeline runner calls this on its wake-up, ONLY while no
|#  pipeline run is running: the same plan, marks and batched deletes (Invoke-SIDataCollectionRetention), plus the idle rule
|#  (a collection still loading after -IdleStaleHours with no run running is a stopped run's), inside a time budget. The
|#  published run's collection, a complete one the views read and a result waiting for the data sync are never touched.
|#  Afterwards it records how many collections are still loading and their rows (cfg.InstallState 'StoppedRuns').
|# ------------------------------------------------------------------------------------------------------------------
|
|function Get-SIDataRunByPipelineSql {
|    <# The settings database: how many of this job's steps run in a running pipeline run (0 = not started by the pipeline). #>
|    "IF OBJECT_ID(N'cfg.FlowStepRun') IS NULL OR OBJECT_ID(N'cfg.FlowRun') IS NULL SELECT CAST(0 AS int) ELSE SELECT COUNT(*) FROM cfg.FlowStepRun AS s JOIN cfg.FlowRun AS r ON r.FlowRunId = s.FlowRunId WHERE s.Job = @Job AND s.State IN (N'Starting', N'Running') AND r.State = N'Running';"
|}
|
|function Test-SIDataRunByPipeline {
|    <#
|        #834 Did the pipeline start this data sync? Then the pipeline runner's wake-ups remove the rows of the collections it
|        marks, once the run has ended (Invoke-SIDataStoppedRunCleanup). Not shown -- no seam, no record, a database that
|        cannot be read -- is $false. #1037: either way the data sync only marks (its data out never waits on a removal);
|        the answer now only words its log line. Never throws.
|    #>
|    param([scriptblock]$Invoke, [string]$Job = 'asset-datasync')
|    if (-not $Invoke) { return $false }
|    try { return ([int](& $Invoke (Get-SIDataRunByPipelineSql) @{ Job = $Job } 'scalar') -gt 0) } catch { return $false }
|}
|
|function Get-SIDataLoadingStateSql {
|    <# The Detailed collections still 'Loading' (not retired) and -- -WithRows -- their finding rows (counted on the clustered
|       key per collection; else Rows = -1, not counted): one row (N, Rows). 0 / 0 on a database without the tables or the mark. #>
|    param([switch]$WithRows)
|    $rows = if ($WithRows) { '(SELECT COUNT_BIG(*) FROM sidata.Finding AS f WHERE f.CollectionId = c.CollectionId)' } else { 'CAST(0 AS bigint)' }
|    $sum = if ($WithRows) { 'ISNULL(SUM(x.R), 0)' } else { 'CAST(-1 AS bigint)' }
|    @"
|SET NOCOUNT ON;
|IF OBJECT_ID('sidata.Collection') IS NULL OR OBJECT_ID('sidata.Finding') IS NULL OR COL_LENGTH('sidata.Collection', 'RetiredAt') IS NULL
|BEGIN SELECT CAST(0 AS int) AS N, CAST(0 AS bigint) AS [Rows]; RETURN; END
|SELECT COUNT(*) AS N, $sum AS [Rows]
|FROM (SELECT c.CollectionId, $rows AS R
|      FROM sidata.Collection AS c WHERE c.Kind = N'Detailed' AND c.Status <> N'Complete' AND c.RetiredAt IS NULL) AS x;
|"@
|}
|
|function Get-SIDataStoppedRunsRecordSql {
|    <# The ONE statement that records the state in cfg.InstallState 'StoppedRuns' (settings database; the engine role holds
|       SELECT / INSERT / UPDATE there). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID('cfg.InstallState') IS NOT NULL
|BEGIN
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = N'StoppedRuns')
|        UPDATE cfg.InstallState SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = N'StoppedRuns';
|    ELSE
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N'StoppedRuns', @Value, NULL, @By);
|END
|'@
|}
|
|function Get-SIDataStoppedRunsValue {
|    <# PURE. The recorded value: compact JSON under 400 characters -- { loading, loadingRows, removed, removedRows, stopped, at }. #>
|    param([int]$Loading = 0, [long]$LoadingRows = 0, [int]$Removed = 0, [long]$RemovedRows = 0, [bool]$Stopped = $false, [datetime]$AtUtc = [datetime]::UtcNow)
|    ([ordered]@{ loading = $Loading; loadingRows = $LoadingRows; removed = $Removed; removedRows = $RemovedRows; stopped = $Stopped
|                 at = $AtUtc.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture) } | ConvertTo-Json -Compress)
|}
|
|function Get-SIDataRaStepOwnerSql {
|    <# #882 The settings database: the Risk Analysis Detailed steps of RUNNING pipeline runs that are still open -- how many
|       (Open) and when the oldest started (Since; NULL when none, or when an open one has no start recorded: Unknown = 1). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.FlowStepRun') IS NULL OR OBJECT_ID(N'cfg.FlowRun') IS NULL
|BEGIN SELECT CAST(-1 AS int) AS [Open], CAST(NULL AS datetime2(3)) AS Since, CAST(1 AS int) AS Unknown; RETURN; END
|SELECT COUNT(*) AS [Open], MIN(s.StartedUtc) AS Since, CASE WHEN SUM(CASE WHEN s.StartedUtc IS NULL THEN 1 ELSE 0 END) > 0 THEN 1 ELSE 0 END AS Unknown
|FROM cfg.FlowStepRun AS s JOIN cfg.FlowRun AS r ON r.FlowRunId = s.FlowRunId
|WHERE s.Job = @Job AND s.State IN (N'Starting', N'Running') AND r.State = N'Running';
|'@
|}
|
|function Get-SIDataLoadingOwnerFloor {
|    <#
|        PURE. #882 -- WHICH 'Loading' COLLECTION DOES A LIVE RUN STILL OWN? (largest tenant 2026-10-21: collections 20, 21, 23
|        and 24 stayed 'Loading' after broken runs; at that install a pipeline run is nearly always going, so #816's cleanup --
|        which waits for NO run to be running -- never reached them.) The Risk Analysis Detailed producer begins its collection
|        when it starts, so the only collection a live run can still be writing is one that started at or after the oldest
|        Risk Analysis work that is going now: an open Detailed step of a running pipeline run (-OpenSteps / -StepSince /
|        -StepUnknown) or a running execution of its job (-ProbeKnown / -ProbeSince: the job's executions, also one started by
|        hand). Returns @{ Before; Why }: Before = that start minus 5 minutes (the clocks' slack) -- or, when nothing of Risk
|        Analysis is going at all, -NowUtc minus 5 minutes; every not-complete collection that started BEFORE it, not pending,
|        not published, belongs to no live run. Before = $null (Why says why) when it cannot be shown: an open step without a
|        start, or no open step and the executions could not be read. FAIL SAFE: unknown = nothing is touched.
|    #>
|    param([int]$OpenSteps = 0, $StepSince = $null, [bool]$StepUnknown = $false, [bool]$ProbeKnown = $false, $ProbeSince = $null,
|          [datetime]$NowUtc = [datetime]::UtcNow)
|    $o = { param($b, $w) [pscustomobject]@{ Before = $b; Why = [string]$w } }
|    if ($OpenSteps -lt 0) { return (& $o $null 'the run records could not be read') }
|    if ($OpenSteps -gt 0 -and ($StepUnknown -or $null -eq $StepSince)) { return (& $o $null 'an open Risk Analysis step has no start recorded') }
|    # the job's executions are always needed: a step can FOLLOW an execution that started before it (a job that was
|    # already running), whose collection then started before the step did
|    if (-not $ProbeKnown) { return (& $o $null 'whether Risk Analysis runs right now could not be read') }
|    $c = New-Object System.Collections.Generic.List[datetime]
|    if ($OpenSteps -gt 0) { $c.Add(([datetime]$StepSince).ToUniversalTime()) }
|    if ($null -ne $ProbeSince) { $c.Add(([datetime]$ProbeSince).ToUniversalTime()) }
|    if (-not $c.Count) { return (& $o $NowUtc.ToUniversalTime().AddMinutes(-5) 'no Risk Analysis runs now') }
|    $min = ($c | Sort-Object | Select-Object -First 1)
|    & $o $min.AddMinutes(-5) ([string]::Format([Globalization.CultureInfo]::InvariantCulture, 'the Risk Analysis going now started {0:yyyy-MM-dd HH:mm} UTC', $min))
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  THE CLEAN-UP AS HOUSEKEEPING (#1038 part 3, owner 2026-11-01: "servicenow is most critical" / "cleanup is low prio").
|#  No job removes collection rows in its own path any more: a sync only MARKS. ONE path removes the marked rows -- the
|#  pipeline runner's wake-up (Invoke-SIDataStoppedRunCleanup) -- and only while NOTHING that reads or loads the data is
|#  going: no pipeline run (cfg.FlowRun), no open step (cfg.FlowStepRun), no run holding the install's lock
|#  (cfg.PipelineLock), no data sync and no data out started on its own (the jobs' running executions). The same state the
|#  updater's run gate reads. Asked again before EVERY range: the moment one of them starts the removal stops between two
|#  ranges and the next wake-up goes on. What is left (collections, rows) is recorded in cfg.InstallState 'Housekeeping'.
|# ------------------------------------------------------------------------------------------------------------------
|
|function Get-SIDataHousekeepingOpenWorkSql {
|    <# The settings database, ONE number: the steps still Starting / Running (of any run -- the run gate's rule) plus a
|       pipeline run holding the install's lock (cfg.PipelineLock with a run and a heartbeat under 15 minutes old). 0 = no
|       pipeline work is going. -1 = the run records are not there. #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.FlowStepRun') IS NULL BEGIN SELECT CAST(-1 AS int); RETURN; END
|DECLARE @n int = (SELECT COUNT(*) FROM cfg.FlowStepRun WHERE State IN (N'Starting', N'Running'));
|IF OBJECT_ID(N'cfg.PipelineLock') IS NOT NULL
|    SET @n += (SELECT COUNT(*) FROM cfg.PipelineLock WHERE LockId = N'install' AND FlowRunId IS NOT NULL AND Holder IS NOT NULL
|                  AND HeartbeatUtc >= DATEADD(minute, -15, SYSUTCDATETIME()));
|SELECT @n;
|'@
|}
|
|function Get-SIDataHousekeepingBusy {
|    <#
|        Is anything going that the clean-up must give way to? -SettingsInvoke: the settings database (run records).
|        -JobRunning { param($Job) } -> @{ Execution; StartedUtc } or $null (the job's running execution; a 404 = the job is not
|        installed = not running); -Jobs: the job keys asked (asset-datasync, data-out). Returns @{ Busy; Known; Run (a pipeline
|        run is going); Why }. NEVER throws. FAIL SAFE: anything that cannot be read = Known $false, Busy $true -- nothing is
|        removed. No -JobRunning (a host that cannot list executions): the jobs are not asked, said in Why.
|    #>
|    param([scriptblock]$SettingsInvoke, [scriptblock]$JobRunning, [string[]]$Jobs = @())
|    $o = { param([bool]$busy, [bool]$known, [bool]$run, [string]$why) [pscustomobject]@{ Busy = $busy; Known = $known; Run = $run; Why = $why } }
|    if (-not $SettingsInvoke) { return (& $o $true $false $false 'the run records cannot be read here') }
|    $runs = $null
|    try { $runs = [int](& $SettingsInvoke "IF OBJECT_ID('cfg.FlowRun') IS NULL SELECT CAST(-1 AS int) ELSE SELECT COUNT(*) FROM cfg.FlowRun WHERE State = N'Running'" @{} 'scalar') } catch { $runs = $null }
|    if ($null -eq $runs -or $runs -lt 0) { return (& $o $true $false $false 'the run records could not be read') }
|    if ($runs -gt 0) { return (& $o $true $true $true 'a pipeline run is running') }
|    $open = $null
|    try { $open = [int](& $SettingsInvoke (Get-SIDataHousekeepingOpenWorkSql) @{} 'scalar') } catch { $open = $null }
|    if ($null -eq $open -or $open -lt 0) { return (& $o $true $false $false 'the run records could not be read') }
|    if ($open -gt 0) { return (& $o $true $true $true 'a pipeline step is still running') }
|    $notAsked = ''
|    if (-not $JobRunning) { if (@($Jobs).Count) { $notAsked = ' (the jobs'' executions cannot be read on this host -- not asked)' } }
|    else {
|        foreach ($j in @($Jobs | Where-Object { $_ })) {
|            $x = $null
|            try { $x = & $JobRunning $j }
|            catch {
|                if ("$($_.Exception.Message)" -match '404|ResourceNotFound|not found') { continue }
|                return (& $o $true $false $false ('whether caj-si-{0} runs could not be read ({1})' -f $j, $_.Exception.Message))
|            }
|            if ($x) {
|                $what = switch ($j) { 'asset-datasync' { 'a data sync' } 'data-out' { 'a data out' } default { 'caj-si-' + $j } }
|                $ex = if ($x.PSObject.Properties['Execution'] -and $x.Execution) { ' ({0})' -f $x.Execution } else { '' }
|                return (& $o $true $true $false ('{0} is running{1}' -f $what, $ex))
|            }
|        }
|    }
|    & $o $false $true $false ('no pipeline run, data sync or data out is going' + $notAsked)
|}
|
|function Get-SIDataHousekeepingLeftSql {
|    <#
|        The DATA database, ONE row: what the clean-up still has to remove -- Collections (marked collections of both grains
|        with rows left) and Rows (NULL = the database has no retention mark yet). Index reads only, never a COUNT over
|        sidata.Finding: per marked Detailed collection the first and the last FindingId (the key span, never too low; the
|        removal goes from the lowest key up), per marked Summary load its loaded Rows while a row is left (an upper bound).
|    #>
|    @'
|SET NOCOUNT ON;
|DECLARE @c int = 0, @sc int = 0, @d bigint = NULL, @s bigint = NULL;
|IF OBJECT_ID(N'sidata.Collection') IS NOT NULL AND OBJECT_ID(N'sidata.Finding') IS NOT NULL AND COL_LENGTH(N'sidata.Collection', N'RetiredAt') IS NOT NULL
|    EXEC sp_executesql N'SELECT @c = COUNT(*), @d = ISNULL(SUM(x.F), 0)
|FROM sidata.Collection AS c
|CROSS APPLY (SELECT (SELECT TOP (1) f.FindingId FROM sidata.Finding AS f WHERE f.CollectionId = c.CollectionId ORDER BY f.FindingId DESC) - (SELECT TOP (1) f.FindingId FROM sidata.Finding AS f WHERE f.CollectionId = c.CollectionId ORDER BY f.FindingId ASC) + 1 AS F) AS x
|WHERE c.Kind = N''Detailed'' AND c.RetiredAt IS NOT NULL AND x.F IS NOT NULL;', N'@c int OUTPUT, @d bigint OUTPUT', @c = @c OUTPUT, @d = @d OUTPUT;
|IF OBJECT_ID(N'sidata.SummaryLoad') IS NOT NULL AND OBJECT_ID(N'sidata.SummaryRow') IS NOT NULL AND COL_LENGTH(N'sidata.SummaryLoad', N'RetiredAt') IS NOT NULL
|    EXEC sp_executesql N'SELECT @sc = COUNT(*), @s = ISNULL(SUM(CASE WHEN l.[Rows] > 0 THEN CAST(l.[Rows] AS bigint) ELSE CAST(1 AS bigint) END), 0)
|FROM sidata.SummaryLoad AS l
|WHERE l.RetiredAt IS NOT NULL AND EXISTS (SELECT 1 FROM sidata.SummaryRow AS r WHERE r.CollectionTime = l.CollectionTime);', N'@sc int OUTPUT, @s bigint OUTPUT', @sc = @sc OUTPUT, @s = @s OUTPUT;
|SELECT @c + @sc AS Collections, CASE WHEN @d IS NULL AND @s IS NULL THEN CAST(NULL AS bigint) ELSE ISNULL(@d, 0) + ISNULL(@s, 0) END AS [Rows];
|'@
|}
|
|function Get-SIDataHousekeepingRecordSql {
|    <# The ONE statement that records the clean-up's progress in cfg.InstallState 'Housekeeping' (settings database). #>
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID('cfg.InstallState') IS NOT NULL
|BEGIN
|    IF EXISTS (SELECT 1 FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = N'Housekeeping')
|        UPDATE cfg.InstallState SET Value = @Value, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = N'Housekeeping';
|    ELSE
|        INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N'Housekeeping', @Value, NULL, @By);
|END
|'@
|}
|
|function Get-SIDataHousekeepingValue {
|    <#
|        PURE. The recorded progress: compact JSON under 400 characters -- { state (removing | paused | done | failed),
|        collectionsLeft, rowsLeft (null = not known), removedRows (this wake-up), lastRemovedAt (the last wake-up that removed
|        rows; kept from the record before), why (at most 160 characters), at }.
|    #>
|    param([ValidateSet('removing', 'paused', 'done', 'failed')][string]$State = 'done', $CollectionsLeft = $null, $RowsLeft = $null, [long]$RemovedRows = 0,
|          $LastRemovedAtUtc = $null, [string]$Why = '', [datetime]$AtUtc = [datetime]::UtcNow)
|    $iso = { param($t) if ($null -eq $t) { $null } else { ([datetime]$t).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture) } }
|    $w = if ($Why.Length -gt 160) { $Why.Substring(0, 157) + '...' } else { $Why }
|    ([ordered]@{ state = $State; collectionsLeft = $(if ($null -ne $CollectionsLeft) { [int]$CollectionsLeft } else { $null }); rowsLeft = $(if ($null -ne $RowsLeft) { [long]$RowsLeft } else { $null })
|                 removedRows = $RemovedRows; lastRemovedAt = (& $iso $LastRemovedAtUtc); why = $w; at = (& $iso $AtUtc) } | ConvertTo-Json -Compress)
|}
|
|function Read-SIDataHousekeepingRecord {
|    <# The record before (cfg.InstallState 'Housekeeping') as an object, or $null. Never throws. #>
|    param([scriptblock]$SettingsInvoke)
|    if (-not $SettingsInvoke) { return $null }
|    try {
|        $v = & $SettingsInvoke "IF OBJECT_ID('cfg.InstallState') IS NULL SELECT CAST(NULL AS nvarchar(400)) ELSE SELECT Value FROM cfg.InstallState WHERE Name = N'Housekeeping'" @{} 'scalar'
|        $v = @(@($v) | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) | Select-Object -First 1
|        if ($v -is [System.Collections.IDictionary]) { $v = $v['Value'] }
|        if ($v -isnot [string] -or -not $v.Trim().StartsWith('{')) { return $null }
|        return ($v | ConvertFrom-Json)
|    } catch { return $null }
|}
|
|function Write-SIDataHousekeepingProgress {
|    <#
|        Records (cfg.InstallState 'Housekeeping') and says the clean-up's progress. -Left: Get-SIDataHousekeepingLeftSql's
|        row ($null = not read now: the record before keeps its counts -- a paused wake-up never reads the data database).
|        Says one line through -Log when rows were removed, and on the first wake-up of each hour while rows wait. Never
|        throws. Returns the value recorded.
|    #>
|    param([scriptblock]$SettingsInvoke, [string]$State, $Left = $null, [long]$RemovedRows = 0, [string]$Why = '', [scriptblock]$Log,
|          [datetime]$NowUtc = [datetime]::UtcNow, [string]$By = 'caj-si-flow')
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $prev = Read-SIDataHousekeepingRecord -SettingsInvoke $SettingsInvoke
|    $pv = { param($n) if ($prev -and $prev.PSObject.Properties[$n]) { $prev.$n } else { $null } }
|    $cl = & $pv 'collectionsLeft'; $rl = & $pv 'rowsLeft'
|    if ($null -ne $Left) {
|        $g = { param($n) $x = if ($Left -is [System.Collections.IDictionary]) { $Left[$n] } elseif ($Left.PSObject.Properties[$n]) { $Left.$n } else { $null }; if ($x -is [System.DBNull]) { $null } else { $x } }
|        $cl = & $g 'Collections'; $rl = & $g 'Rows'
|    }
|    $last = & $pv 'lastRemovedAt'
|    if ($RemovedRows -gt 0) { $last = $NowUtc }
|    elseif ($last -is [datetime]) { $last = ([datetime]$last).ToUniversalTime() }
|    elseif ($last) { try { $last = [datetime]::Parse([string]$last, $inv, [Globalization.DateTimeStyles]::AdjustToUniversal -bor [Globalization.DateTimeStyles]::AssumeUniversal) } catch { $last = $null } }
|    # nothing left at all = done, whatever the wake-up did
|    if ($State -ne 'failed' -and $null -ne $cl -and [int]$cl -eq 0) { $State = 'done' }
|    # rows left after a wake-up that ended without a stop (a refused collection): still being removed
|    if ($State -eq 'done' -and $null -ne $cl -and [int]$cl -gt 0) { $State = 'removing' }
|    $v = Get-SIDataHousekeepingValue -State $State -CollectionsLeft $cl -RowsLeft $rl -RemovedRows $RemovedRows -LastRemovedAtUtc $last -Why $Why -AtUtc $NowUtc
|    if ($SettingsInvoke) { try { $null = & $SettingsInvoke (Get-SIDataHousekeepingRecordSql) @{ Value = $v; By = $By } 'nonquery' } catch { if ($Log) { & $Log 'INFO' ('housekeeping: its progress could not be recorded ({0})' -f $_.Exception.Message) } } }
|    if ($Log -and ($RemovedRows -gt 0 -or ($NowUtc.ToUniversalTime().Minute -lt 5 -and $null -ne $cl -and [int]$cl -gt 0))) {
|        $leftText = if ($null -ne $cl) { [string]::Format($inv, '{0} collection(s){1} left', [int]$cl, $(if ($null -ne $rl) { [string]::Format($inv, ', about {0:N0} row(s)', [long]$rl) } else { '' })) } else { 'what is left is not known yet' }
|        $stateText = switch ($State) { 'paused' { 'paused -- ' + $Why } 'removing' { 'removing' } 'done' { 'done' } default { 'not finished -- ' + $Why } }
|        & $Log 'OK' ([string]::Format($inv, 'housekeeping: old collections {0}; {1:N0} row(s) removed by this wake-up; {2}', $stateText, $RemovedRows, $leftText))
|    }
|    $v
|}
|
|function Get-SIDataHousekeepingLeaseSql {
|    <#
|        #1063 (3.0.30): ONE CLEAN-UP AT A TIME. Since the wake-ups during a run (FlowBusy) clean up too, two executions of the
|        pipeline runner can reach the clean-up at once (a wake-up during a run, and a Run now or the next run's own start).
|        The lease is one row in the settings database, cfg.InstallState 'HousekeepingLease' (Value = the holder, UpdatedAt =
|        when it was taken; '' = free). Take: -> 'taken' (free, ours already, or the other holder's lease ran out: older than
|        @LeaseSeconds -- an execution that died never holds it for ever) or 'held:<holder> since <time>'; 'none' = the table
|        is not there (an install before cfg.InstallState: no lease, as before). Release: frees it only when it is ours.
|    #>
|    param([Parameter(Mandatory)][ValidateSet('Take', 'Release')][string]$Action)
|    if ($Action -eq 'Release') {
|        return @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.InstallState') IS NOT NULL
|    UPDATE cfg.InstallState SET Value = N'', UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = N'HousekeepingLease' AND Value = @Holder;
|'@
|    }
|    @'
|SET NOCOUNT ON;
|IF OBJECT_ID(N'cfg.InstallState') IS NULL BEGIN SELECT N'none'; RETURN; END
|BEGIN TRANSACTION;
|DECLARE @h nvarchar(400) = NULL, @at datetime2(0) = NULL;
|SELECT @h = Value, @at = UpdatedAt FROM cfg.InstallState WITH (UPDLOCK, HOLDLOCK) WHERE Name = N'HousekeepingLease';
|IF @h IS NULL
|    INSERT cfg.InstallState (Name, Value, [Version], UpdatedBy) VALUES (N'HousekeepingLease', @Holder, NULL, @By);
|ELSE IF @h = N'' OR @h = @Holder OR @at < DATEADD(second, -@LeaseSeconds, SYSUTCDATETIME())
|    UPDATE cfg.InstallState SET Value = @Holder, UpdatedAt = SYSUTCDATETIME(), UpdatedBy = @By WHERE Name = N'HousekeepingLease';
|ELSE
|BEGIN
|    COMMIT TRANSACTION;
|    SELECT CONCAT(N'held:', @h, N' since ', CONVERT(nvarchar(20), @at, 126), N'Z');
|    RETURN;
|END
|COMMIT TRANSACTION;
|SELECT N'taken';
|'@
|}
|
|function Enter-SIDataHousekeepingLease {
|    <#
|        #1063 (3.0.30): takes the clean-up's lease (Get-SIDataHousekeepingLeaseSql). @{ Taken; Why }. NEVER throws. FAIL SAFE:
|        a lease that cannot be read or written = not taken (nothing is removed by this wake-up; the next one asks again).
|    #>
|    param([scriptblock]$SettingsInvoke, [Parameter(Mandatory)][string]$Holder, [int]$LeaseSeconds = 1020, [string]$By = 'caj-si-flow')
|    if (-not $SettingsInvoke) { return [pscustomobject]@{ Taken = $false; Why = 'the run records cannot be read here' } }
|    $v = $null
|    try { $v = & $SettingsInvoke (Get-SIDataHousekeepingLeaseSql -Action Take) @{ Holder = $Holder; LeaseSeconds = [int]$LeaseSeconds; By = $By } 'scalar' }
|    catch { return [pscustomobject]@{ Taken = $false; Why = ('whether another clean-up is going could not be read ({0})' -f $_.Exception.Message) } }
|    $v = @(@($v) | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) | Select-Object -First 1
|    if ($v -is [System.Collections.IDictionary]) { $v = @($v.Values)[0] }
|    if ($v -is [string] -and $v.StartsWith('held:')) { return [pscustomobject]@{ Taken = $false; Why = ('another wake-up is removing old collections ({0})' -f $v.Substring(5)) } }
|    [pscustomobject]@{ Taken = $true; Why = '' }
|}
|
|function Exit-SIDataHousekeepingLease {
|    <# #1063 (3.0.30): frees the clean-up's lease when it is ours. Never throws (a lease left behind runs out on its own). #>
|    param([scriptblock]$SettingsInvoke, [Parameter(Mandatory)][string]$Holder, [string]$By = 'caj-si-flow')
|    if (-not $SettingsInvoke) { return }
|    try { $null = & $SettingsInvoke (Get-SIDataHousekeepingLeaseSql -Action Release) @{ Holder = $Holder; By = $By } 'nonquery' } catch { }
|}
|
|function Invoke-SIDataStoppedRunCleanup {
|    <#
|        THE PIPELINE RUNNER'S CALL (#816). -Invoke: the data database (sql, params, mode 'reader' | 'nonquery' | 'scalar');
|        -SettingsInvoke: the settings database (cfg.FlowRun, cfg.InstallState), same seam. Does nothing -- not one statement on
|        the data database -- while a pipeline run is running, or when that cannot be read. NEVER throws. Returns
|        @{ Status (ok | skipped | failed); Why; Retention (Invoke-SIDataCollectionRetention's result); Loading; LoadingRows }.
|        #882 -RaRunning { } -> @{ Execution; StartedUtc } or $null (the Risk Analysis Detailed job's running execution; a throw
|        = cannot be read): WHILE a pipeline run is running, a Detailed collection still 'Loading' that NO live run owns
|        (Get-SIDataLoadingOwnerFloor) is MARKED retired at once -- never derived, prepared or shown again -- and its rows are
|        removed by a later wake-up with no run running (Finish). Only those ('stopped run'); never a complete collection,
|        never the published one, never a result waiting for the data sync, never the collection the live run writes -- the
|        plan AND the database's mark refuses them. Without the seam a running run means nothing is touched, as before.
|        #1038 part 3 -- THE ONE HOUSEKEEPING PATH. With nothing going (Get-SIDataHousekeepingBusy: no pipeline run, no open
|        step, no run holding the install's lock, no data sync and no data out -- -JobRunning / -Jobs, the jobs' running
|        executions, also one started by hand) every marked collection is removed; that is asked again before EVERY range and
|        batch, and the moment one starts the removal stops between two ranges. #1063 (owner 2026-11-03: "Both"): WHILE a
|        pipeline run goes (with -RaRunning), the #882 marks are made AND the rows of collections marked BEFORE the run began
|        are removed (#892's -FinishOnly guards), paced by the database's load, giving way to a data out. It never removes the newest complete collection
|        or the one before it (#717 -- the plan and the database's mark), never the published one. Progress -- collections and
|        rows left, paused and why -- is recorded in cfg.InstallState 'Housekeeping' (Write-SIDataHousekeepingProgress); the
|        hourly heartbeat sends the rows left (Pipeline.housekeepingRowsLeft). Never blocks or fails anything else.
|        #1063 (3.0.30): reached by EVERY wake-up of the runner, also one during a run (the container entry's FlowBusy path,
|        SI_FLOW_HOUSEKEEPING_ONLY) -- ONE clean-up at a time: the lease (Enter-SIDataHousekeepingLease, -Holder = this
|        execution, held at most -TimeBudgetSeconds + 15 min); a wake-up that finds it held does nothing (Status skipped,
|        LeaseHeld) and records nothing -- the holder records the progress.
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [scriptblock]$SettingsInvoke, [double]$IdleStaleHours = 24,
|          [int]$TimeBudgetSeconds = 120, [scriptblock]$Log, [datetime]$NowUtc = [datetime]::UtcNow, [string]$By = 'caj-si-flow',
|          [scriptblock]$RaRunning, [string]$RaJob = 'risk-analysis-detailed',
|          [scriptblock]$JobRunning, [string[]]$Jobs = @('asset-datasync', 'data-out'),
|          [string]$Holder = $(if ($env:CONTAINER_APP_JOB_EXECUTION_NAME) { [string]$env:CONTAINER_APP_JOB_EXECUTION_NAME } else { '{0}:{1}' -f [Environment]::MachineName, $PID }))
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Host ('[{0}] {1}' -f $level, $msg) } }
|    $out = [ordered]@{ Status = 'skipped'; Why = ''; Retention = $null; Loading = $null; LoadingRows = $null; Housekeeping = ''; LeaseHeld = $false }
|    $hkStarted = [datetime]::UtcNow
|    $leaseTaken = $false
|    try {
|        if (-not $SettingsInvoke) { $out.Why = 'the run records cannot be read here -- nothing is removed'; return [pscustomobject]$out }
|        # #1063 (3.0.30): one clean-up at a time -- the lease first; held by another wake-up = this one does nothing
|        $lease = Enter-SIDataHousekeepingLease -SettingsInvoke $SettingsInvoke -Holder $Holder -LeaseSeconds ([Math]::Max(0, $TimeBudgetSeconds) + 900) -By $By
|        if (-not $lease.Taken) { $out.LeaseHeld = $true; $out.Why = ('{0} -- this wake-up removes nothing' -f $lease.Why); return [pscustomobject]$out }
|        $leaseTaken = $true
|        $busy = Get-SIDataHousekeepingBusy -SettingsInvoke $SettingsInvoke -JobRunning $JobRunning -Jobs $Jobs
|        $out['Busy'] = $busy
|        if (-not $busy.Known) {
|            $out.Why = ('{0} -- nothing removed' -f $busy.Why)
|            $out.Housekeeping = Write-SIDataHousekeepingProgress -SettingsInvoke $SettingsInvoke -State 'paused' -Why $busy.Why -Log $Log -NowUtc $NowUtc -By $By
|            return [pscustomobject]$out
|        }
|        $running = if ($busy.Run) { 1 } else { 0 }
|        if ($running -gt 0 -and $RaRunning -and $IdleStaleHours -gt 0) {
|            # #882: a run is going -- only the 'Loading' collections no live run owns are marked (no row is removed now)
|            $own = $null
|            try {
|                $os = @(@(& $SettingsInvoke (Get-SIDataRaStepOwnerSql) @{ Job = $RaJob } 'reader') | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) | Select-Object -First 1
|                $gv = { param($n) if ($null -eq $os) { $null } elseif ($os -is [System.Collections.IDictionary]) { $os[$n] } else { $os.$n } }
|                $open = if ($null -eq $os) { -1 } else { [int](& $gv 'Open') }
|                $sinceV = & $gv 'Since'; if ($sinceV -is [System.DBNull]) { $sinceV = $null }
|                $unk = [int](& $gv 'Unknown') -eq 1
|                $pk = $false; $ps = $null
|                try { $px = & $RaRunning; $pk = $true; if ($px -and $px.StartedUtc) { $ps = ([datetime]$px.StartedUtc).ToUniversalTime() } elseif ($px) { $pk = $false } } catch { $pk = $false }
|                $own = Get-SIDataLoadingOwnerFloor -OpenSteps $open -StepSince $sinceV -StepUnknown $unk -ProbeKnown $pk -ProbeSince $ps -NowUtc $NowUtc
|            } catch { $own = [pscustomobject]@{ Before = $null; Why = $_.Exception.Message } }
|            if ($null -eq $own -or $null -eq $own.Before) {
|                $out.Why = 'a pipeline run is running and which collection it owns could not be shown ({0}) -- nothing is touched' -f $(if ($own) { $own.Why } else { 'no answer' })
|                $out.Housekeeping = Write-SIDataHousekeepingProgress -SettingsInvoke $SettingsInvoke -State 'paused' -Why $busy.Why -Log $Log -NowUtc $NowUtc -By $By
|                return [pscustomobject]$out
|            }
|            $why = [string]::Format([Globalization.CultureInfo]::InvariantCulture, 'its run stopped before it was complete: no live run owns it ({0}; it started before that)', $own.Why)
|            $ret = Invoke-SIDataCollectionRetention -Invoke $Invoke -Log $Log -NowUtc $NowUtc -IdleBeforeUtc $own.Before -IdleReason $why -OnlyWhy @('stopped run') -MarkOnly `
|                       -RowsRemovedBy 'by a later wake-up of the pipeline runner when no run, data sync or data out is going, in key ranges' -TimeBudgetSeconds $TimeBudgetSeconds
|            $out.Retention = $ret
|            # #1063 (owner 2026-11-03: "Both" -- clean retired rows during runs, throttled when the database is busy, now; the
|            # per-collection partitions next): at an install whose runs go back to back (the large ring 1 install: 7.9 M retired
|            # rows, the findings table at 217 GB) a wake-up with nothing going never comes. So, while a run goes, the rows of
|            # collections that were marked BEFORE this run started are removed (#892's -FinishOnly, its guards unchanged: the
|            # owner floor, marks made before the run start, the database's own check on every statement, never the published
|            # one), in key ranges, paced by the database's load (the housekeeping rule: it WAITS while the load is high), inside
|            # what is left of this wake-up's time budget. It gives way to a data out (the ServiceNow send) the moment one runs:
|            # asked before every range and batch. The next wake-up goes on.
|            $runStart = $null
|            try {
|                $rs = & $SettingsInvoke "IF OBJECT_ID('cfg.FlowRun') IS NULL SELECT CAST(NULL AS datetime2(0)) ELSE SELECT MIN(StartedUtc) FROM cfg.FlowRun WHERE State = N'Running'" @{} 'scalar'
|                if ($rs -is [datetime]) { $runStart = [datetime]::SpecifyKind([datetime]$rs, [DateTimeKind]::Utc) }
|            } catch { $runStart = $null }
|            $left = if ($TimeBudgetSeconds -gt 0) { [int][Math]::Floor($TimeBudgetSeconds - ([datetime]::UtcNow - $hkStarted).TotalSeconds) } else { 0 }
|            $fin = $null
|            if ($left -gt 0 -and $null -ne $runStart) {
|                $hkJobRunning = $JobRunning
|                $doStop = {
|                    if (-not $hkJobRunning) { return '' }
|                    $x = $null
|                    try { $x = & $hkJobRunning 'data-out' }
|                    catch { if ("$($_.Exception.Message)" -match '404|ResourceNotFound|not found') { return '' }; return ('whether the data out runs could not be read ({0})' -f $_.Exception.Message) }
|                    if ($x) { 'a data out is running' } else { '' }
|                }
|                $fin = Invoke-SIDataCollectionRetention -Invoke $Invoke -Log $Log -NowUtc $NowUtc -FinishOnly -FinishFloorUtc $own.Before -FinishMarkedBeforeUtc $runStart -TimeBudgetSeconds $left -ShouldStop $doStop
|            }
|            $out['Finished'] = $fin
|            $out.Status = if ($ret.Status -eq 'failed' -or ($fin -and $fin.Status -eq 'failed')) { 'failed' } else { 'ok' }
|            $finRows = 0L; if ($fin -and $fin.Rows) { foreach ($k in @($fin.Rows.Keys)) { $finRows += [long]$fin.Rows[$k] } }
|            $hkLeft = $null
|            if ($finRows -gt 0 -or $NowUtc.ToUniversalTime().Minute -lt 5) {
|                try { $hkLeft = @(@(& $Invoke (Get-SIDataHousekeepingLeftSql) @{} 'reader') | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) | Select-Object -First 1 } catch { $hkLeft = $null }
|            }
|            if ($null -eq $fin) {
|                $out.Why = 'a pipeline run is running -- collections no live run owns were marked; ' + $(if ($null -eq $runStart) { 'when the run started could not be read, so no row is removed this time' } else { 'no time is left in this wake-up for removing rows' })
|                $out.Housekeeping = Write-SIDataHousekeepingProgress -SettingsInvoke $SettingsInvoke -State 'paused' -Left $hkLeft -Why $busy.Why -Log $Log -NowUtc $NowUtc -By $By
|            } else {
|                $fState = if ($fin.Status -eq 'failed') { 'failed' } elseif ($fin.Paused) { 'paused' } else { 'removing' }
|                $fWhy = if ($fState -eq 'failed') { [string]$fin.Error } elseif ($fState -eq 'paused') { [string]$fin.Paused } else { 'a pipeline run is going: the rows of collections marked before it began are removed, paced by the database''s load' }
|                $out.Why = 'a pipeline run is running -- collections no live run owns were marked; the rows of collections marked before this run began are removed in key ranges, paced by the database''s load, inside this wake-up''s time budget'
|                $out.Housekeeping = Write-SIDataHousekeepingProgress -SettingsInvoke $SettingsInvoke -State $fState -Left $hkLeft -RemovedRows $finRows -Why $fWhy -Log $Log -NowUtc $NowUtc -By $By
|            }
|            return [pscustomobject]$out
|        }
|        if ($busy.Busy) {
|            $out.Why = ('housekeeping paused: {0} -- the old collections'' rows are removed when nothing is going' -f $busy.Why)
|            $out.Housekeeping = Write-SIDataHousekeepingProgress -SettingsInvoke $SettingsInvoke -State 'paused' -Why $busy.Why -Log $Log -NowUtc $NowUtc -By $By
|            return [pscustomobject]$out
|        }
|        # nothing is going: plan, mark and remove -- asked again before EVERY range and batch whether something started
|        # (no GetNewClosure: a closure's own module scope cannot see functions dot-sourced into a script; the names are this
|        # function's own, so the ranges' callers never shadow them)
|        $hkSettings = $SettingsInvoke; $hkJobRunning = $JobRunning; $hkJobs = @($Jobs)
|        $stop = { $hkB = Get-SIDataHousekeepingBusy -SettingsInvoke $hkSettings -JobRunning $hkJobRunning -Jobs $hkJobs; if ($hkB.Busy) { [string]$hkB.Why } else { '' } }
|        $ret = Invoke-SIDataCollectionRetention -Invoke $Invoke -Log $Log -NowUtc $NowUtc -IdleStaleHours $IdleStaleHours -TimeBudgetSeconds $TimeBudgetSeconds -ShouldStop $stop
|        $out.Retention = $ret
|        $out.Status = if ($ret.Status -eq 'failed') { 'failed' } else { 'ok' }
|        $removed = @($ret.Removed).Count; $removedRows = if ($ret.Rows) { [long]$ret.Rows['findings'] } else { 0L }
|        # the progress: what is left (index reads only), paused / removing / done, recorded and said
|        $hkLeft = $null
|        try { $hkLeft = @(@(& $Invoke (Get-SIDataHousekeepingLeftSql) @{} 'reader') | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) | Select-Object -First 1 } catch { $hkLeft = $null }
|        $allRows = 0L; if ($ret.Rows) { foreach ($k in @($ret.Rows.Keys)) { $allRows += [long]$ret.Rows[$k] } }
|        $hkState = if ($ret.Status -eq 'failed') { 'failed' } elseif ($ret.PSObject.Properties['Paused'] -and $ret.Paused) { 'paused' } elseif ($ret.Stopped) { 'removing' } else { 'done' }
|        $hkWhy = if ($hkState -eq 'failed') { [string]$ret.Error } elseif ($hkState -eq 'paused') { [string]$ret.Paused } elseif ($hkState -eq 'removing') { 'this wake-up''s time budget ended -- the next one goes on' } else { '' }
|        $out.Housekeeping = Write-SIDataHousekeepingProgress -SettingsInvoke $SettingsInvoke -State $hkState -Left $hkLeft -RemovedRows $allRows -Why $hkWhy -Log $Log -NowUtc $NowUtc -By $By
|        # the rows of what is still loading are counted on the first wake-up of each hour, or when something was removed --
|        # never every five minutes on a database that may be at its limit
|        $withRows = ($NowUtc.ToUniversalTime().Minute -lt 5 -or $removed -gt 0 -or $removedRows -gt 0)
|        $st = $null
|        if ($withRows) { $st = @(@(& $Invoke (Get-SIDataLoadingStateSql -WithRows) @{} 'reader') | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) | Select-Object -First 1 }
|        if ($st) {
|            $g = { param($n) if ($st -is [System.Collections.IDictionary]) { $st[$n] } else { $st.$n } }
|            $out.Loading = [int](& $g 'N'); $out.LoadingRows = [long](& $g 'Rows')
|            $v = Get-SIDataStoppedRunsValue -Loading $out.Loading -LoadingRows $out.LoadingRows -Removed $removed -RemovedRows $removedRows -Stopped ([bool]$ret.Stopped) -AtUtc $NowUtc
|            try { $null = & $SettingsInvoke (Get-SIDataStoppedRunsRecordSql) @{ Value = $v; By = $By } 'nonquery' } catch { & $Log 'INFO' ('collections : the state of stopped runs could not be recorded ({0})' -f $_.Exception.Message) }
|            if ($out.Loading -gt 0) { & $Log 'INFO' ([string]::Format([Globalization.CultureInfo]::InvariantCulture, 'collections : {0} Risk Analysis collection(s) still loading ({1:N0} finding rows) -- removed once they are older than {2:0.#} h with no run running, or a newer run is complete', $out.Loading, $out.LoadingRows, $IdleStaleHours)) }
|        }
|    } catch {
|        $out.Status = 'failed'; $out.Why = $_.Exception.Message
|        & $Log 'WARN' ('collections : stopped runs were not removed this time ({0}) -- nothing current is affected; the next wake-up tries again' -f $_.Exception.Message)
|    } finally {
|        if ($leaseTaken) { Exit-SIDataHousekeepingLease -SettingsInvoke $SettingsInvoke -Holder $Holder -By $By }
|    }
|    [pscustomobject]$out
|}
|
|# ------------------------------------------------------------------------------------------------------------------
|#  HOW FULL THE DATABASE IS (#717 (3)): the space its data uses against its maximum size, read with data rights only (the
|#  same reading as the heartbeat's sqlUsedMb / sqlMaxMb). Above -WarnPercent (70) the run says so in plain words.
|# ------------------------------------------------------------------------------------------------------------------
|
|function Get-SIDataFillSql {
|    # ONE value, 'used|max' in MB -- read as a scalar
|    "SET NOCOUNT ON; SELECT CONCAT((SELECT SUM(CAST(FILEPROPERTY(name, 'SpaceUsed') AS bigint)) * 8 / 1024 FROM sys.database_files WHERE type_desc = 'ROWS'), '|', CAST(DATABASEPROPERTYEX(DB_NAME(), 'MaxSizeInBytes') AS bigint) / 1048576);"
|}
|
|function Get-SIDataFillVerdict {
|    <#
|        PURE. 'used|max' (MB) -> @{ UsedMb; MaxMb; Percent; Warn; Text }. Percent is $null when either is unknown (a database
|        without a maximum, an unreadable value) -- never guessed. Warn = Percent above -WarnPercent.
|    #>
|    param($Value, [int]$WarnPercent = 70)
|    $inv = [Globalization.CultureInfo]::InvariantCulture
|    $o = [ordered]@{ UsedMb = $null; MaxMb = $null; Percent = $null; Warn = $false; Text = '' }
|    if ($null -ne $Value -and $Value -isnot [System.DBNull]) {
|        $p = ([string]$Value).Split('|'); $n = [long]0
|        if ($p.Count -ge 1 -and [long]::TryParse($p[0].Trim(), [Globalization.NumberStyles]::Integer, $inv, [ref]$n) -and $n -ge 0) { $o.UsedMb = $n }
|        if ($p.Count -ge 2 -and [long]::TryParse($p[1].Trim(), [Globalization.NumberStyles]::Integer, $inv, [ref]$n) -and $n -gt 0) { $o.MaxMb = $n }
|    }
|    if ($null -ne $o.UsedMb -and $null -ne $o.MaxMb) {
|        $o.Percent = [Math]::Round(100.0 * $o.UsedMb / $o.MaxMb, 1)
|        $o.Warn = $o.Percent -gt $WarnPercent
|        $o.Text = if ($o.Warn) {
|            [string]::Format($inv, 'the Pro database is {0:0.#} % full ({1:0.#} of {2:0.#} GB). SecurityInsight removes old collections by itself; if it keeps filling up, raise the database''s maximum size -- when it is full, nothing new can be stored.', $o.Percent, ($o.UsedMb / 1024.0), ($o.MaxMb / 1024.0))
|        } else {
|            [string]::Format($inv, 'the Pro database is {0:0.#} % full ({1:0.#} of {2:0.#} GB)', $o.Percent, ($o.UsedMb / 1024.0), ($o.MaxMb / 1024.0))
|        }
|    }
|    [pscustomobject]$o
|}
|
|function Get-SIDataFill {
|    <# How full the database is (Get-SIDataFillVerdict), said once in the log. Never throws: unreadable = Percent $null, said plainly. #>
|    param([Parameter(Mandatory)][scriptblock]$Invoke, [int]$WarnPercent = 70, [scriptblock]$Log)
|    if (-not $Log) { $Log = { param([string]$level, [string]$msg) Write-Host ('[{0}] {1}' -f $level, $msg) } }
|    $v = $null
|    try { $v = & $Invoke (Get-SIDataFillSql) @{} 'scalar' } catch { & $Log 'INFO' ('database    : how full the database is could not be read ({0})' -f $_.Exception.Message) }
|    $f = Get-SIDataFillVerdict -Value $v -WarnPercent $WarnPercent
|    if ($f.Warn) { & $Log 'WARN' ('database    : ' + $f.Text) }
|    elseif ($null -ne $f.Percent) { & $Log 'INFO' ('database    : ' + $f.Text) }
|    $f
|}
'@ }
$__siSupportFiles['config/guard-catalog.locked.json'] = @{ Sha256 = 'd6e05ac9ecda989186738bfedfd3ab2b3056848fa8eb2ee4c1c75c706ac4bfac'; Text = @'
|{
|  "_": "THE CLOSED LIST of SecurityInsight's guards (#277): SWITCHES (#414): every guard can be turned off (SI_Guard_<Token>_Enabled, its mail SI_Guard_<Token>_Mail, all at once SI_Guards_Enabled; Settings > Guards) -- 'whenOff' says, in plain words, what turning it off means. RELEASING (framework GUARD-1.6, #404): only the kinds release-held-set and release-collection can be released -- by a SuperAdmin, with a reason, once (one run, or until a time of at most 24 hours), bound to the held plan's hash; every other guard carries 'neverReleasable': the reason, in plain words, it can never be released (the data is wrong, nothing is held, it would write where the customer did not allow it, or it protects integrity). every place where SecurityInsight holds, refuses or halts a step to protect data. Read by BOTH writers of a guard event: PowerShell (engine/_shared/SI-Guard.ps1, Send-SIGuardEvent) and the Pro web app (SI.Management.Web Guards/GuardEvents.cs, linked into the build). A test compares the two readers and checks every Send-SIGuardEvent call names a guard listed here. An id is stable and dotted (area.object.what): adding one = one entry here; renaming one breaks the history of the old id -- add, never rename. 'protects' and 'action' are the words a customer reads in the mail: plain language, no internal numbers. THE THREE PARTS a person reads on the Guards page, in the mail and (without detail) in the report to Invardia: 'what' (what happened, one sentence), 'why' (the cause of THIS event), 'consequence' (what the user sees or misses; 'nothing is lost' where it holds) and 'steps' (what to do, short). Placeholders, filled from the event: {held} (what was held), {v:<value name>} (a measured value), {detail}, {subject}, {when}, {latest} (the web app only: the newest collection it shows); {name|text} uses text when the value is empty; a [ ... ] part is left out when a placeholder in it is empty. 'what', 'consequence' and 'steps' never use {detail} or {subject} (they travel to Invardia). 'kind' says what a release means for the guard: release-held-set (an Admin releases the held set once), release-collection (an Admin loads a held collection once, marked partial), fix-source (cannot be released: fix the cause), next-run (resolved by the next successful run), rerun (re-run the job), setting (change a setting or the licence), review (check the result), info (nothing to do). Every event can be acknowledged. THE FOUR TEXTS of the Guards page (operator 2026-10-09: nobody understood the guards): 'name' (a short plain name), 'what' (what happened), 'why' (why it held: what it protects you from, then the run's own words), 'ifRelease' (what a release does -- or, for a guard that cannot be released, why not and what to do instead) and 'consequence' (if you leave it), plus 'steps'. 'limits' names the settings that tune a guard (edited on the Guards page under Control) and 'limitsInfo' says what changing them means. 'mail': 'never' = the check never sends a mail, whatever its outcome: its event is recorded and shown only on Operations > Guards (safety checks) (a check that accepts the change by itself asks nothing of anyone).",
|  "outcomes": [ "halted", "refused", "held", "skipped", "warning" ],
|  "severity": { "halted": "critical", "refused": "critical", "held": "warning", "skipped": "warning", "warning": "warning" },
|  "guards": [
|    {"id":"vuln.connector.close-ceiling","name":"Vulnerability close limit","area":"vulnerability-connector","job":"si-vuln-closeloop","protects":"open vulnerability records","action":"SecurityInsight would have closed far more vulnerability records in one run than it allows, so it closed none. Check that the newest Risk Analysis run was complete and that its vulnerability findings look right. If the large drop is real (for example a big patch round), run the vulnerability connector once with a higher close limit (SI_VulnSync_MaxClosePercent; the absolute limit SI_VulnSync_MaxCloseAbsolute is off by default), then set the limit back -- or turn the check off in Settings > Guards.","kind":"release-held-set","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- the vulnerability connector closes every record the run would close, however many; nothing is held for release.","what":"SecurityInsight held {held|many} vulnerability close(s): the vulnerability connector would have closed more records in one run than it may close at once.","why":"This check stops a broken or incomplete collection from closing many open vulnerabilities in your target by mistake. A big patch round looks the same, so SecurityInsight closes none and lets a person decide. {detail|The newest results no longer report far more of the open findings than usual.}","ifRelease":"The held closes go through once: the records are closed in the target with the next run of the connector -- only those that are still absent then, and only after the results are checked as complete. The release is for this held set only and ends by itself.","consequence":"Nothing is lost: the records stay open in the target exactly as they were. The held closes are kept for 7 days; after that they expire and the next complete run decides again.","steps":["Check that the newest Risk Analysis run finished completely (Operations > Jobs > Run health).","If the drop is real (for example a patch round), a SuperAdmin releases the held closes once with Release in \"Held now\" at the top of the Guards page.","If your patch rounds often close this many, raise the close limit under Control on the Guards page.","If it is not real, do nothing: the held closes expire after 7 days."],"limits":["SI_VulnSync_MaxClosePercent","SI_VulnSync_MaxCloseAbsolute"],"limitsInfo":"A higher limit lets more records close in one run without being held: a big patch round goes through by itself, but a broken collection can also close more records before the check stops it."},
|    {"id":"vuln.connector.empty-snapshot","name":"Vulnerabilities: empty result","area":"vulnerability-connector","job":"si-vuln-closeloop","protects":"open vulnerability records","action":"The newest Risk Analysis results held no vulnerabilities while records are still open, so nothing was closed. Check that the Risk Analysis Detailed run finished and found vulnerabilities; the next complete run is reconciled as normal.","kind":"next-run","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- an EMPTY result closes the open records it no longer reports, so a failed collection can close every open vulnerability.","what":"The vulnerability connector closed nothing, because the newest Risk Analysis results held no vulnerabilities at all.","why":"This check stops a failed collection from closing every open vulnerability in your target. An empty result almost always means the collection failed, not that everything is fixed. {detail|Records are open in the target, but the newest results report none.}","ifRelease":"This check cannot be released: a release would close every open vulnerability from a result that holds none. The data is wrong, not the limit.","consequence":"Nothing is lost: the open records stay open, and the next complete run is handled as normal.","steps":["Check that the newest Risk Analysis run finished and found vulnerabilities (Operations > Jobs > Run health).","Nothing else is needed: the next complete run is handled as normal."],"neverReleasable":"releasing it would close every open vulnerability from a snapshot that holds none -- the data is wrong, not the limit"},
|    {"id":"vuln.connector.collapse","name":"Vulnerabilities: result far smaller than usual","area":"vulnerability-connector","job":"si-vuln-closeloop","protects":"open vulnerability records","action":"Far fewer of the open vulnerability records are still reported than usual, which looks like a partial collection rather than a real fix, so nothing was closed. Check the newest Risk Analysis Detailed run and the endpoint data it read; the next complete run is reconciled as normal.","kind":"next-run","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- a result that lost most of its findings closes the records it no longer reports.","what":"The vulnerability connector closed nothing, because far fewer of the open records are still reported than usual.","why":"This check stops a partial collection from closing most of your open vulnerabilities. When most findings disappear at once, the collection is usually broken. {detail|The newest results look like a partial collection, not a real fix.}","ifRelease":"This check cannot be released: a release would close most open vulnerabilities from a result that lost most of its findings.","consequence":"Nothing is lost: the open records stay open, and the next complete run is handled as normal.","steps":["Check the newest Risk Analysis run and the device data it read (Operations > Jobs > Run health).","Nothing else is needed: the next complete run is handled as normal."],"neverReleasable":"releasing it would close most open vulnerabilities from a snapshot that lost most of its findings -- a broken run is never a reason to close","limits":["SI_VulnSync_CollapseFloor"],"limitsInfo":"The limit is the share of the open records that must still be reported. A lower share lets runs that report fewer findings close records; a higher share stops more runs. 0 turns the check off."},
|    {"id":"vuln.connector.scope-changed","name":"Vulnerabilities: scope changed","area":"vulnerability-connector","job":"si-vuln-closeloop","protects":"open vulnerability records","action":"The scope of the collection changed, so records that dropped out of it were not closed. If the narrower scope is intended, close or retire those records in the target yourself.","kind":"review","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- records that dropped out of the collection scope are closed like any other absent record.","what":"Vulnerability records that dropped out of the collection's scope were not closed.","why":"This check stops records from being closed only because their assets are no longer collected: a record outside the scope is not fixed, so closing it would report it as fixed. {detail|The scope of the collection changed since the previous run.}","ifRelease":"This check cannot be released: closing what left the scope would report it as fixed. Review the scope instead.","consequence":"Nothing is lost: those records stay open in the target, and SecurityInsight no longer updates them.","steps":["Check whether the narrower scope is what you want.","If it is, close or retire those records in the target yourself.","If it is not, put the scope back in the settings: the next run picks them up again."],"neverReleasable":"the set of assets the connector covers changed; closing what left the scope would read as fixed -- review the scope instead"},
|    {"id":"vuln.connector.run-incomplete","name":"Vulnerabilities: Risk Analysis run not finished","area":"vulnerability-connector","job":"si-vuln-closeloop","protects":"open vulnerability records","action":"The Risk Analysis run behind these results did not finish cleanly, so nothing was closed. Check the Risk Analysis Detailed run; the next complete run is reconciled as normal.","kind":"next-run","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- records are closed even when the Risk Analysis run behind the results did not finish cleanly.","what":"The vulnerability connector closed nothing, because the Risk Analysis run behind its results did not finish cleanly.","why":"This check stops records from being closed on the strength of a run that did not finish: missing results would look like fixed vulnerabilities. {detail|The Risk Analysis run ended with errors or only partly.}","ifRelease":"This check cannot be released: nothing is ever closed from a run that did not finish.","consequence":"Nothing is lost: the open records stay open until a complete run arrives.","steps":["Check the Risk Analysis run (Operations > Jobs > Run health).","Nothing else is needed: the next complete run is handled as normal."],"neverReleasable":"the Risk Analysis run behind the snapshot did not finish; nothing may be closed from an incomplete run"},
|    {"id":"vuln.connector.snapshot-incomplete","name":"Vulnerabilities: results not known to be complete","area":"vulnerability-connector","job":"si-vuln-closeloop","protects":"open vulnerability records","action":"The newest Risk Analysis results are not known to be complete, so findings were opened and updated but nothing was closed. Check that the Risk Analysis Detailed run finishes without errors.","kind":"next-run","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- absences are counted and records closed even when the newest results are not known to be complete.","what":"Vulnerability records were opened and updated, but none was closed.","why":"This check stops records from being closed while the newest results are not known to be complete: a missing finding would look like a fixed one. {detail|The newest Risk Analysis results are not known to be complete.}","ifRelease":"This check cannot be released: nothing is ever closed from results that are not known to be complete.","consequence":"Nothing is lost: records that would have closed stay open until a complete run confirms they are fixed.","steps":["Check that the Risk Analysis run finishes without errors (Operations > Jobs > Run health).","Nothing else is needed: the next complete run closes what is really fixed."],"neverReleasable":"the snapshot is incomplete; nothing may be closed from an incomplete snapshot"},
|    {"id":"vuln.connector.target-incomplete","name":"Vulnerabilities: target not read in full","area":"vulnerability-connector","job":"si-vuln-closeloop","protects":"your vulnerability target from duplicate records","action":"The vulnerability target (for example the ServiceNow table) could not be read in full, so nothing was written: every record the read missed would have been opened again as a duplicate. Check that the target is reachable and the account can read the whole table; the next run tries again.","kind":"next-run","whenOff":"Off: no event and no mail. The step itself still stops, because writing after a partial read of the target would open every record the read missed again as a duplicate.","what":"The vulnerability connector wrote nothing, because the vulnerability target could not be read in full.","why":"This check stops duplicate records: every record the read missed would have been opened again. {detail|Part of the target (for example the ServiceNow table) could not be read.}","ifRelease":"This check cannot be released: writing after a partial read would create duplicates or close the wrong records.","consequence":"Nothing is lost and nothing is duplicated: the target is unchanged. This run's new and fixed vulnerabilities reach it with the next run that reads it in full.","steps":["Check that the target is reachable and that the account can read the whole table.","Nothing else is needed: the next run tries again."],"neverReleasable":"the connector could not read the other system completely; closing from a partial read could close the wrong items"},
|    {"id":"vuln.connector.refused","name":"Vulnerabilities: connector not set up","area":"vulnerability-connector","job":"si-vuln-closeloop","protects":"your vulnerability target","action":"A vulnerability connector is not set up completely, so it did not run. Open Configuration > Connectors > Setup in the Pro web app and fix the settings it lists.","kind":"setting","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because the connector is not set up completely and cannot run.","what":"A vulnerability connector did not run, because it is not set up completely.","why":"This check stops a connector from writing to your target with missing or wrong settings. {detail|One or more of its settings are missing or not valid.}","ifRelease":"This check cannot be released: nothing is held. Fix the connector's setup and it runs again.","consequence":"Nothing was written to the target. Until the setup is fixed, the target does not receive new or fixed vulnerabilities.","steps":["Open Configuration > Connectors > Setup and fix the settings it lists.","The connector runs again on its next schedule."],"neverReleasable":"the connector definition is not valid (a setting or a secret is missing); there is nothing to release -- fix the definition"},
|    {"id":"cmdb.sql.snapshot-incomplete","name":"CMDB table: asset collection not complete","area":"cmdb-connector","job":"si-cmdb-sql","protects":"the configuration items (CIs) in your SQL CMDB table","action":"The newest asset collection is not known to be complete, so the CMDB table was not changed. Check that the profiling runs (endpoint, Azure) finish without errors; the next complete collection is written as normal.","kind":"next-run","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because a CI is never written from an asset collection that is not complete.","what":"The CMDB table was not changed, because the newest asset collection is not known to be complete.","why":"This check stops configuration items from being created, changed or retired from an incomplete collection: a missing asset would look like a retired one. {detail|One of the collection runs (devices, Azure) did not finish cleanly.}","ifRelease":"This check cannot be released: configuration items are never written from an incomplete collection.","consequence":"Nothing is lost: the CMDB table keeps its configuration items as they were. New or changed assets reach it with the next complete collection.","steps":["Check that the collection runs (devices, Azure) finish without errors (Operations > Jobs > Run health).","Nothing else is needed: the next complete collection is written as normal."],"neverReleasable":"the profile snapshot is incomplete; CIs are never created, changed or retired from an incomplete snapshot"},
|    {"id":"cmdb.sql.collapse","name":"CMDB table: far fewer assets than usual","area":"cmdb-connector","job":"si-cmdb-sql","protects":"the configuration items (CIs) in your SQL CMDB table","action":"SecurityInsight sees far fewer assets than are active in the CMDB table, which looks like a broken collection rather than assets gone, so nothing was retired. Check the newest profiling runs; the next complete collection is written as normal.","kind":"next-run","whenOff":"Off: the step goes on as if the check had not tripped -- CIs are retired even when SecurityInsight sees far fewer assets than are active in the CMDB table.","what":"No configuration item was retired, because SecurityInsight sees far fewer assets than are active in the CMDB table.","why":"This check stops a broken collection from retiring healthy configuration items. {detail|The newest collection looks broken rather than the assets being gone.}","ifRelease":"This check cannot be released: retiring from a collection that lost most of its assets would retire healthy configuration items.","consequence":"Nothing is lost: every active configuration item stays active until a complete collection confirms it is gone.","steps":["Check the newest collection runs (Operations > Jobs > Run health).","Nothing else is needed: the next complete collection is written as normal."],"neverReleasable":"the snapshot lost most of its assets; retiring CIs from it would retire healthy CIs"},
|    {"id":"cmdb.sql.empty-snapshot","name":"CMDB table: empty asset collection","area":"cmdb-connector","job":"si-cmdb-sql","protects":"the configuration items (CIs) in your SQL CMDB table","action":"The newest asset collection holds no assets at all, so nothing was written or retired. Check that the profiling runs collect assets.","kind":"next-run","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- an empty asset collection is written too, which can retire every CI.","what":"Nothing was written to or retired from the CMDB table, because the newest asset collection holds no assets.","why":"This check stops an empty collection from retiring every configuration item. {detail|The collection runs collected no assets.}","ifRelease":"This check cannot be released: a release would retire every configuration item.","consequence":"Nothing is lost: the CMDB table is unchanged.","steps":["Check that the collection runs collect assets (Operations > Jobs > Run health).","Nothing else is needed: the next collection with assets is written as normal."],"neverReleasable":"the snapshot is empty; releasing it would retire every CI"},
|    {"id":"cmdb.sql.no-correlation-map","name":"CMDB table: no correlation results","area":"cmdb-connector","job":"si-cmdb-sql","protects":"the configuration items (CIs) in your SQL CMDB table","action":"The asset correlation results are missing, so assets could not be matched to their CIs and nothing was written. Run the asset correlation job, then this connector again.","kind":"rerun","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because without the correlation results no asset can be matched to its CI.","what":"Nothing was written to the CMDB table, because the asset correlation results are missing.","why":"This check stops assets from being written to the wrong configuration item: without the correlation results, SecurityInsight cannot match them. {detail|The asset correlation results are missing.}","ifRelease":"This check cannot be released: without the correlation results no asset can be matched. Run the correlation job instead.","consequence":"Nothing is lost: the CMDB table is unchanged until the correlation results exist.","steps":["Run the asset correlation job (Operations > Jobs).","Then run the CMDB connector again, or wait for its next scheduled run."],"neverReleasable":"without the correlation map CIs cannot be matched to assets; re-run the correlation job instead"},
|    {"id":"cmdb.sql.stale","name":"CMDB table: changed by another run","area":"cmdb-connector","job":"si-cmdb-sql","protects":"the configuration items (CIs) in your SQL CMDB table","action":"Another run changed the CMDB table while this one was planning, so this run wrote nothing. Nothing is needed if it happens once; if it repeats, make sure the CMDB connector does not run twice at the same time.","kind":"next-run","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because another run changed the CMDB table meanwhile; the next run plans again.","what":"This CMDB run wrote nothing, because another run changed the CMDB table while it was planning.","why":"This check stops one run from overwriting what another run just wrote. {detail|Two runs of the CMDB connector overlapped.}","ifRelease":"This check cannot be released: its plan is out of date. The next run plans again from the current table.","consequence":"Nothing is lost: the other run's changes stand, and the next run plans again from the current table.","steps":["Nothing is needed if it happens once.","If it repeats, make sure the CMDB connector does not run twice at the same time."],"neverReleasable":"the snapshot is too old to be the truth about the estate; the next fresh run decides"},
|    {"id":"cmdb.handoff.mass-change","name":"CMDB hand-off: large change","area":"cmdb-connector","job":"si-cmdb-sql","protects":"the CIs your ServiceNow imports from the CMDB hand-off database","action":"Far more of the CIs handed to ServiceNow last time are missing from this run than the connector allows, which looks like a broken collection rather than assets gone, so this run's batch was held and ServiceNow keeps importing the previous one. Check the profiling and correlation runs (for example a lost permission or a failed sign-in). If the change is real, release it once in Operations > Guards (safety checks); otherwise the next run that is back within the limit (the connector's changeGuardPercent) is handed over by itself.","kind":"release-held-set","whenOff":"Off: the step goes on as if the check had not tripped -- the batch is handed over to ServiceNow however many CIs changed or disappeared.","what":"This run's CMDB hand-off batch was held, because far more of the configuration items handed to ServiceNow last time are missing from it than the connector allows.","why":"This check stops a broken collection (for example a lost permission or a failed sign-in) from making many configuration items disappear from ServiceNow. {detail|The change looks like a broken collection rather than assets gone.}","ifRelease":"The held batch is handed to ServiceNow once: ServiceNow imports it, and the configuration items missing from it are no longer in the hand-off. The release is for this batch only and ends by itself.","consequence":"Nothing is lost: ServiceNow keeps importing the previous batch until a run is back within the limit, or the held batch is released.","steps":["Check the collection and correlation runs (Operations > Jobs > Run health).","If the change is real, a SuperAdmin releases the batch once with Release in \"Held now\" at the top of the Guards page.","Otherwise do nothing: the next run that is back within the limit is handed over by itself."],"limitsInfo":"The allowed change is set on the CMDB hand-off connector (Configuration > Connectors > Setup). A higher limit hands bigger changes to ServiceNow without a hold."},
|    {"id":"cmdb.servicenow.unreachable","name":"ServiceNow: not reachable","area":"cmdb-connector","job":"si-datasync","protects":"the configuration items (CIs) in ServiceNow","action":"The ServiceNow instance could not be reached, so nothing was sent. Check the instance address and the account of the ServiceNow connector (Configuration > Connectors), and that ServiceNow is up.","kind":"fix-source","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because ServiceNow cannot be reached.","what":"Nothing was sent to the ServiceNow CMDB, because the instance could not be reached.","why":"This check stops SecurityInsight from sending half a set of changes to ServiceNow. {detail|The ServiceNow instance did not answer, or refused the account.}","ifRelease":"This check cannot be released: ServiceNow cannot be reached, and nothing is held.","consequence":"Nothing is lost: ServiceNow keeps its configuration items as they were, and the changes are sent with the next run that reaches it.","steps":["Check the instance address and the account of the ServiceNow connector (Configuration > Connectors).","Check that ServiceNow is up.","Nothing else is needed: the next run sends the changes."],"neverReleasable":"ServiceNow could not be reached; there is nothing held to release"},
|    {"id":"cmdb.servicenow.create-gate","name":"ServiceNow: CIs not accepted","area":"cmdb-connector","job":"si-datasync","protects":"the configuration items (CIs) in ServiceNow","action":"ServiceNow's import did not accept some of the CIs SecurityInsight sent, so this batch was not completed. Every row goes again with the next run. The reasons ServiceNow gave are in the data sync's run log; check the Import Set table and its transform map in ServiceNow.","kind":"fix-source","defaultOff":true,"whenOff":"Off: no event and no mail. The rows ServiceNow did not accept are still sent again with the next run.","what":"{held|Some} CI(s) were not accepted by ServiceNow's import.","why":"This check tells you when ServiceNow refuses part of what SecurityInsight sends, so the CMDB does not quietly miss CIs. {detail|ServiceNow's import refused some rows.}","ifRelease":"This check cannot be released: nothing is held. The rows ServiceNow did not accept are sent again with the next run.","consequence":"The batch is marked failed, so ServiceNow does not import it as complete; every row goes again with the next run. Until a batch is complete, the CIs in ServiceNow stay as they were.","steps":["See the data sync's run log for the reasons ServiceNow gave.","Check the Import Set table and its transform map in ServiceNow.","Nothing else is needed: the next run sends the rows again."],"neverReleasable":"nothing is held: the rows ServiceNow did not accept are sent again with the next run"},
|    {"id":"cmdb.servicenow.service-model","name":"ServiceNow: service model errors","area":"cmdb-connector","job":"si-cmdb","protects":"the placement of assets in your business services","action":"The service model has errors, so no asset was placed in a business service. Fix the problems listed in the run log.","kind":"fix-source","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because the service model has errors.","what":"No asset was placed in a business service, because the service model has errors.","why":"This check stops assets from being placed under the wrong business services. {detail|The service model has problems that must be fixed first.}","ifRelease":"This check cannot be released: a release would place configuration items under the wrong services. Fix the model.","consequence":"The placement of assets in your business services stays as it was until the model is fixed.","steps":["Fix the problems listed in the run log.","Nothing else is needed: the next run places the assets."],"neverReleasable":"the service model does not match ServiceNow; fix the model -- a release would write CIs under the wrong services"},
|    {"id":"asset.properties.collection-change","name":"Asset metadata: large change","area":"asset-properties","job":"si-asset-properties","protects":"the asset metadata handed to your CMDB and vulnerability system","action":"The full asset metadata collected from one source changed by more than the allowed share since the previous run, which looks like a broken collection rather than a real change, so the previous collection of that source was kept for the hand-off. Check the source (for example a lost permission or a failed sign-in). If the change is real, release it once in Operations > Guards (safety checks); otherwise the next run that is back within the limit (SI_AssetProperties_ChangeGuardPercent) ends the hold by itself.","kind":"release-held-set","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- a large change of the asset metadata is handed over like any other.","what":"The asset metadata from one source changed by more than the allowed share since the previous run, so the previous collection of that source is still used for the hand-off.","why":"This check stops a broken collection (for example a lost permission or a failed sign-in) from reaching your CMDB and vulnerability system. {detail|The change looks like a broken collection rather than a real change.}","ifRelease":"The new collection of that source is handed to your CMDB and vulnerability system once, instead of the previous one. The release is for this run only and ends by itself.","consequence":"Nothing is lost: your CMDB and vulnerability system keep receiving the previous collection of that source until a run is back within the limit, or the change is released.","steps":["Check the source (for example a lost permission or a failed sign-in).","If the change is real, a SuperAdmin releases it once with Release in \"Held now\" at the top of the Guards page.","Otherwise do nothing: the next run that is back within the limit ends the hold by itself."],"limits":["SI_AssetProperties_ChangeGuardPercent"],"limitsInfo":"A higher share lets bigger changes through to your CMDB and vulnerability system without a hold; a lower share holds smaller changes too."},
|    {"id":"collection.source.asset-drop","mail":"never","name":"Collection: far fewer assets from one source","area":"collection","job":"","protects":"your configuration items (CIs) and everything calculated from them","action":"One source returned far fewer assets than in its last good collection, although the collection completed. That can be a real clean-up (for example many Azure resources removed) or a source that answered only in part, so the assets it no longer lists were kept as they were instead of being marked not seen. Nothing is needed when the drop is real: when the next complete collection of that source shows the same level, it is accepted by itself. To accept such a drop at once instead, set SI_Pro_SourceDropout_AssetDropAction to accept.","kind":"next-run","whenOff":"Off: a collection with far fewer assets is taken as it comes -- the assets the source no longer lists are marked not seen at once, and their CIs retire after the usual days.","what":"A source returned far fewer assets than in its last good collection, so the assets it no longer lists were kept as they were.","why":"This check stops a source that answered only in part from making healthy assets look gone. {detail|The collection completed, but with far fewer assets than before.}","ifRelease":"This check cannot be released, and does not need to be: when the next complete collection of that source shows the same level, the drop is accepted by itself.","consequence":"Nothing is lost: the run went on, the assets the source no longer lists stay active with their last known data, and no CI is retired and no finding is closed because of the drop. A real clean-up takes effect one run later.","steps":["Check the source if the drop is not expected (for example a lost permission, a changed scope or a failed sign-in).","If the drop is real, do nothing: the next complete collection that shows the same level is accepted by itself.","To accept such drops at once from now on, choose accept for this check under Control on the Guards page."],"limits":["SI_Pro_DataQuality_AssetDropPercent","SI_Pro_SourceDropout_AssetDropAction"],"limitsInfo":"A higher share lets bigger drops through without keeping the last good collection; a lower share keeps it for smaller drops too. Accept takes every drop as it comes and only reports it.","neverReleasable":"nothing waits for a person: the next complete collection of that source that shows the same level is accepted by itself"},
|    {"id":"ci.build.concurrent","name":"CI build started while another was running","area":"job-flow","job":"","protects":"your configuration items (CIs) from being written by two builds at the same time","action":"A CI build was started while another CI build was still running. It did not build beside it: it waited for that build to finish and then built what was left. Nothing is needed. If it happens often, something starts the CI build a second time while it runs -- for example a job run by hand while the pipeline runs.","kind":"info","whenOff":"Off: no event. The second CI build still waits for the first one, because two builds never write the CIs at the same time.","what":"A CI build was started while another CI build was still running, so it waited for that build to finish and then built what was left.","why":"This check tells when two CI builds are asked for at the same time. Two builds side by side would write the same CIs, links and identity records at once, so only one builds at a time. {detail|A second CI build was started while one was running.}","ifRelease":"This check cannot be released: it is information only. Nothing is held -- the second build ran by itself when the first one had finished.","consequence":"Nothing is lost: the second build waited and then built what was left, so the CIs are up to date. That run took longer than usual by the time it waited.","steps":["Nothing is needed if it happens rarely.","If it happens often, check what starts the CI build while it runs (Operations > Jobs): a job run by hand, or a job on its own schedule beside the pipeline."],"neverReleasable":"information only: the second build waited and then ran by itself; there is nothing held"},
|    {"id":"datasync.collection.held","name":"Data sync: collection of an unfinished run","area":"data-sync","job":"si-datasync","protects":"the collections shown in the Pro web app","action":"Some Risk Analysis collections were not loaded into the Pro database because the run that produced them is not known to be complete. Nothing is lost: they are kept and tried again on the next data sync, and an Admin can load one anyway, marked partial, in Operations > Guards (safety checks). If this repeats, check the Risk Analysis Detailed runs.","kind":"release-collection","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- a collection whose Risk Analysis run did not finish completely is loaded anyway and MARKED PARTIAL in the web app.","what":"{v:collectionsHeld|Some} Risk Analysis collection(s) were not loaded into the web app.","why":"This check stops results of a Risk Analysis run that did not finish from being shown as complete: findings missing from it would look resolved. {detail|The Risk Analysis run that produced them did not finish completely.}","ifRelease":"The collection is loaded into the web app once and marked partial wherever it is shown. Findings missing from it stay unknown, not resolved.","consequence":"Nothing is lost: the results ({v:rowsHeld} findings) are kept and can be loaded. [The web app keeps showing the newest complete collection ({latest}) until then.] Pages and trends miss these collections until they are loaded.","steps":["Open the Risk Analysis run health to see which part of the run was incomplete.","If the missing part does not matter to you, a SuperAdmin releases the collection with Release in \"Held now\" at the top of the Guards page.","Otherwise do nothing: the next complete Risk Analysis run is loaded as normal."]},
|    {"id":"datasync.collection.refused","name":"Data sync: rows without their key","area":"data-sync","job":"si-datasync","protects":"the days shown in the Pro web app and its trends","action":"Risk Analysis data arrived without its key columns (its finding ids, or its collection time), so it was not loaded as a day. That day is missing until a complete Risk Analysis run arrives. Check the Risk Analysis Detailed run of that time: its run health says why its data was incomplete.","kind":"fix-source","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because rows without their finding id or collection time cannot be placed in a day.","what":"Risk Analysis data was not loaded as a day, because it arrived without its key columns.","why":"This check stops rows that cannot be placed in a day from mixing up your history and trends. {detail|The Risk Analysis run delivered rows without their finding ids or their collection time.}","ifRelease":"This check cannot be released: rows without their finding id or collection time are never loaded.","consequence":"That run is missing from the web app's history and trends; the collections before and after it are shown as normal. [The newest collection in the web app is {latest}.] This event repeats on every data sync until those rows are older than the look-back window (3 days by default).","steps":["Open the Risk Analysis run health of that time to see why its data was incomplete.","Fix the cause: a later complete run is loaded as normal.","Acknowledge this event once you have read it: repeats of exactly this event are hidden too."],"neverReleasable":"its rows have no key columns (ConfigurationId / CollectionTime): rows without keys are never loaded, released or not"},
|    {"id":"datasync.asset.kind-dropped","name":"Data sync: findings an asset kind filter cannot show","area":"data-sync","job":"si-datasync","protects":"the asset kind filters of the Pro web app","action":"Findings of an asset kind were loaded, but their assets were stored without that kind (or without any kind), so the web app's asset kind filter cannot show them. The findings themselves are loaded and counted under All. Check the profiling run of that kind (for example the Azure collector) and the data sync log; if it repeats, contact Invardia support.","kind":"review","defaultOff":true,"whenOff":"Off: no event and no mail when a loaded collection has findings of an asset kind that no asset of that kind carries; the findings are loaded as before.","what":"Some findings are loaded, but the asset kind filter cannot show them.","why":"This check warns you that a filtered page shows fewer findings than there are. {detail|Their assets were stored without the asset kind the findings belong to.}","ifRelease":"This check cannot be released: nothing is held. The findings are already loaded; the check only warns.","consequence":"The findings are in the web app and counted under All, but a page filtered on that asset kind shows fewer findings (or none) until the assets carry their kind again.","steps":["Open the data sync run log of that time to see which kind and how many assets.","Check the collection run of that kind (for example Azure): the next data sync stores the kind again once the collection carries it.","If it repeats, contact Invardia support."],"neverReleasable":"the collection is already loaded; the guard warns that a kind filter cannot show some of its findings -- review it, there is nothing held"},
|    {"id":"datasync.collection.short-read","name":"Data sync: collection not read in full","area":"data-sync","job":"si-datasync","protects":"the collections shown in the Pro web app","action":"A collection could not be read or written in full, so it was not loaded. Nothing is lost: the full collection is tried again on the next data sync. If this repeats, contact Invardia support.","kind":"next-run","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because a collection that could not be read or written in full is not loaded.","what":"A Risk Analysis collection could not be read or written in full, so it was not loaded.","why":"This check stops half a collection from being shown as the whole one. {detail|The read from Log Analytics or the write to the database stopped part way.}","ifRelease":"This check cannot be released: a collection read only in part is never loaded as complete. The next data sync reads it again.","consequence":"Nothing is lost: the full collection is tried again on the next data sync.","steps":["Nothing is needed if it happens once.","If it repeats, contact Invardia support."],"neverReleasable":"fewer rows were read than the run wrote; the next sync reads it again -- a short read is never loaded as complete"},
|    {"id":"ra.output.row-drop","name":"Risk Analysis: far fewer findings","area":"risk-analysis","job":"","protects":"the completeness of your Risk Analysis reports","action":"One or more reports produced far fewer findings than the previous run. Either the findings were really fixed, or a query stopped matching. Compare the listed reports with the previous run before trusting this export.","kind":"review","defaultOff":true,"whenOff":"Off: the step goes on as if the check had not tripped -- a report with far fewer findings than the previous run no longer makes the run partial (a failed query or a missing result still does).","what":"{v:reports|Some} Risk Analysis report(s) produced far fewer findings than the previous run.","why":"This check warns you before you trust a report that may be missing findings: either the findings were really fixed, or a query stopped matching. {detail|The reports produced far fewer findings than the previous run.}","ifRelease":"This check cannot be released: nothing is held. The reports were delivered; the check only warns.","consequence":"The reports were delivered as they are. If a query stopped matching, the missing findings are unknown, not resolved.","steps":["Compare the listed reports with the previous run.","If the drop is not real, check the report's query and the data it reads before trusting this export."],"neverReleasable":"the report is already produced; the guard warns that it lost rows -- review the run, there is nothing held"},
|    {"id":"ra.bucket.count-jump","name":"Risk Analysis: far more buckets than usual","area":"risk-analysis","job":"","protects":"the speed and correctness of your Risk Analysis reports","action":"One or more reports needed far more buckets (query slices) than usual. That usually means the report's query or the data it reads changed in a way that needs a look. The run completed.","kind":"review","whenOff":"Off: no event when a report needs far more buckets than usual; the run itself is unchanged.","what":"{v:reports|Some} Risk Analysis report(s) needed far more buckets than usual (largest {v:largest|unknown}).","why":"This check warns you that a report whose bucket count jumps to 4 times its usual count, or above 256, points at a query or data problem rather than normal growth. {detail|A report needed far more buckets than usual.}","ifRelease":"This check cannot be released: nothing is held. The reports were delivered; the check only warns.","consequence":"The reports were delivered as they are, but the listed reports took far more queries than usual, so the run was slower.","steps":["Open Operations > Risk Analysis query splitting and look at the listed reports.","If the count is wrong, reset that report there: the next run sizes it again."],"neverReleasable":"the reports are already produced; the guard warns about their bucket counts -- review them, there is nothing held"},
|    {"id":"ra.output.column-emptied","name":"Risk Analysis: column emptied","area":"risk-analysis","job":"","protects":"the completeness of your Risk Analysis reports","action":"One or more report columns are empty (or gone) while they had values in the previous run. Check the listed columns before trusting this export.","kind":"review","defaultOff":true,"whenOff":"Off: no event and no mail when a report column lost its content; the report itself is unchanged.","what":"{v:columns|Some} report column(s) are empty or gone, while they had values in the previous run.","why":"This check warns you that filters and scores reading those columns may be wrong for this run. {detail|A source stopped delivering a value, or a column was renamed.}","ifRelease":"This check cannot be released: nothing is held. The reports were delivered; the check only warns.","consequence":"The reports were delivered with these columns empty; filters and scores that read them may be wrong for this run.","steps":["Check the listed columns before trusting this export.","If a source stopped delivering, fix its permission or setting: the next run fills the columns again."],"neverReleasable":"the report is already produced; the guard warns that a column is empty -- review the run, there is nothing held"},
|    {"id":"ingest.rows.short-count","name":"Log Analytics: rows not accepted","area":"ingest","job":"","protects":"the results written to your Log Analytics workspace","action":"Not every row of a result was accepted by Log Analytics, so the run was stopped instead of reporting a partial result as complete. Nothing is closed or retired on the strength of it; the next run writes the full result again. If this repeats, contact Invardia support.","kind":"next-run","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because the rows Log Analytics did not accept are not there.","what":"The run was stopped, because Log Analytics did not accept every row of a result.","why":"This check stops later steps from closing or retiring anything because of a result that is only partly stored. {detail|Part of the result was refused while it was written to your Log Analytics workspace.}","ifRelease":"This check cannot be released: the rows that were not accepted are not there. The next run sends them again.","consequence":"Nothing is closed or retired on the strength of a partial result; the next run writes the full result again.","steps":["Nothing is needed if it happens once.","If it repeats, contact Invardia support."],"neverReleasable":"Log Analytics stored fewer rows than were sent; the next run sends them again -- nothing is held"},
|    {"id":"schema.gate.refused","name":"Database change that could remove data","area":"setup","job":"si-setup","protects":"your SecurityInsight database","action":"A database change was refused because it is not approved for this install, or because it could remove data. Nothing was applied. Contact Invardia support with the message from setup.","kind":"fix-source","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because a database change that could remove data is never applied automatically.","what":"A database change was refused, and nothing was applied.","why":"This check protects your data: SecurityInsight only adds to its database, and never applies a change that could remove data. {detail|The change is not approved for this install, or it could remove data.}","ifRelease":"This check cannot be released: a change that could remove data is never applied, whoever asks.","consequence":"Your SecurityInsight database is unchanged; features that need the change wait until it is applied.","steps":["Contact Invardia support with the message from setup."],"neverReleasable":"SecurityInsight applies additive schema only; a schema that drops or rewrites data is never applied, whoever asks (integrity)"},
|    {"id":"update.schema.failed","name":"Update: database update failed","area":"update","job":"si-updater","protects":"your SecurityInsight installation from running a new version on an old database","action":"An update stopped before it changed anything, because the new version's database changes could not be applied. Your installation keeps running the version it ran before. Make sure the updater's identity has the database rights the release notes name, then start the updater again; if it repeats, contact Invardia support with the message from the update.","kind":"fix-source","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because the database update failed.","what":"An update stopped before rolling out the new version, because its database changes could not be applied.","why":"This check stops a new version from running on an old database, which could break jobs or the web app. {detail|The database refused a change the new version needs, or the updater could not sign in to it.}","ifRelease":"This check cannot be released: new code never runs on an old database. The update waits until the database change applies.","consequence":"Nothing changed: every job and the web app keep running the version they ran before. The update is tried again on the next updater run.","steps":["Check that the updater's identity has the database rights the release notes name.","Start the updater again (or wait for its next daily run).","If it repeats, contact Invardia support with the message from the update."],"neverReleasable":"new code never runs on an old schema; the update waits until the schema applies (integrity)"},
|    {"id":"licence.state.invalid","name":"Licence not valid","area":"licence","job":"","protects":"the SecurityInsight Pro features","action":"The SecurityInsight Pro licence does not verify (it has expired or is not valid for this install), so the Pro jobs did not run. Install a current licence, or contact Invardia.","kind":"setting","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because the licence, not this switch, decides which Pro features run.","what":"The SecurityInsight Pro jobs did not run, because the licence does not verify.","why":"This check pauses the Pro features while the licence does not verify: the licence decides which Pro features run. {detail|The licence has expired or is not valid for this install.}","ifRelease":"This check cannot be released: a licence is checked, never released. Install a valid licence.","consequence":"The Pro features are paused; no data is removed. They start again as soon as a valid licence is installed.","steps":["Install a current licence, or contact Invardia."],"neverReleasable":"a licence is checked, never released: install a valid licence (integrity)"},
|    {"id":"licence.state.grace","name":"Licence grace period","area":"licence","job":"","protects":"the SecurityInsight Pro features","action":"The SecurityInsight Pro licence is in its grace period. Everything keeps running for now; renew the licence before the grace period ends.","kind":"setting","defaultOff":true,"whenOff":"Off: no event and no mail during the licence grace period; everything keeps running.","what":"The SecurityInsight Pro licence is in its grace period.","why":"This check tells you in time that the licence must be renewed. {detail|The licence has expired; the grace period keeps everything running for now.}","ifRelease":"This check cannot be released: a licence is checked, never released. Renew it before the grace period ends.","consequence":"Everything keeps running for now. When the grace period ends, the Pro jobs stop until the licence is renewed.","steps":["Renew the licence before the grace period ends."],"neverReleasable":"a licence is checked, never released: renew the licence before the grace period ends (integrity)"},
|    {"id":"audit.retention.refused","name":"Audit trail retention setting","area":"audit","job":"si-datasync","protects":"the audit trail","action":"The audit trail retention setting (SI_Pro_AuditRetentionMonths) is not a whole number of at least 13 months, so nothing was removed. Correct the setting on the Settings page.","kind":"setting","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because the retention setting is not valid.","what":"No audit trail entries were removed, because the retention setting is not valid.","why":"This check protects your audit trail: it is kept at least 13 months, so entries are never removed on a setting that is not valid. {detail|The audit retention setting is not a whole number of at least 13 months.}","ifRelease":"This check cannot be released: the audit trail is kept at least 13 months.","consequence":"Nothing is lost: the whole audit trail is kept until the setting is corrected.","steps":["Correct the audit trail retention on the Settings page (a whole number of months, at least 13)."],"neverReleasable":"the audit trail is kept at least 13 months; a retention guard is never released (integrity of the evidence)"},
|    {"id":"exemption.bulk.refused","name":"Bulk exemption limit","area":"exemptions","job":"si-web","protects":"your findings from being exempted in bulk by mistake","action":"A request to exempt or change many findings at once was refused (no narrowing filter, or more findings than the limit allows). Nothing was changed. If the request was intended, narrow the filter or raise SIWeb_Exemption_BulkMax deliberately.","kind":"info","defaultOff":true,"whenOff":"Off: no event and no mail. The request itself is still refused, because a whole collection is never exempted in one go -- raise the limit instead (Settings > Exemptions: Most findings in one bulk exemption request, up to 2,000).","what":"A request to exempt or change many findings at once was refused.","why":"This check stops many findings from being exempted in one click by mistake. {detail|The request had no narrowing filter, or more findings than the limit allows.}","ifRelease":"This check cannot be released: narrow the selection and send the request again, or raise the limit.","consequence":"Nothing was changed: every finding keeps its state.","steps":["If the request was intended, narrow the filter and send it again.","Or raise the limit on purpose (Settings > Exemptions: most findings in one bulk exemption request)."],"neverReleasable":"a bulk exemption over the limit is refused by design; narrow the selection instead","limitsInfo":"The limit is set under Settings > Exemptions (most findings in one bulk exemption request). A higher limit lets bigger requests through in one click."},
|    {"id":"flow.run.catch-up","name":"Daily flow: start held for the previous run","area":"job-flow","job":"si-flow","protects":"the order of the daily jobs","action":"A scheduled start of the daily job flow was held because the previous run was still running; it ran once as soon as that run finished. Nothing is needed if it happens rarely.","kind":"info","defaultOff":true,"whenOff":"Off: no event and no mail; the daily flow still waits for its previous run.","what":"A scheduled start of the daily job flow was missed: it started later than its time, and not only because the previous run was still going.","why":"This check tells when the daily jobs do not start at their time. A start that only waits for a long previous run is normal and is not reported; any other late start is. {detail|The start was not made at its scheduled time.}","ifRelease":"This check cannot be released: it is information only. The missed start already ran once, late.","consequence":"Nothing is lost: the missed start ran once, late, so the data was refreshed later than scheduled.","steps":["Nothing is needed if it happens rarely.","If it happens again, check that the pipeline's job is switched on and that nothing held it at its start time, for example an update that took long."],"neverReleasable":"information only: the pipeline made a missed start late; there is nothing held"},
|    {"id":"flow.step.skipped","name":"Daily flow: jobs skipped","area":"job-flow","job":"si-flow","protects":"the jobs that depend on an earlier job","action":"One or more jobs in the daily flow were skipped because a job they need did not succeed. Fix the failed job (see Operations > Jobs), then use Re-run from here.","kind":"next-run","defaultOff":true,"whenOff":"Off: no event and no mail; jobs that need a failed job are still skipped.","what":"{held|Some} job(s) in the daily flow were skipped, because a job they need did not succeed.","why":"This check stops jobs from working on missing or old data from a job that failed. {detail|An earlier job in the flow failed.}","ifRelease":"This check cannot be released: the skipped jobs need the failed job's data. Fix the failed job and run again.","consequence":"The skipped jobs did not update their data this time: their pages show the previous run until the next successful run. Nothing is lost.","steps":["Fix the failed job (see Operations > Jobs).","Use Re-run from here, or wait for the next scheduled run."],"neverReleasable":"the step did not run because its input was missing; the next run resolves it -- there is nothing held"},
|    {"id":"flow.step.start-failed","name":"Daily flow: job did not start","area":"job-flow","job":"si-flow","protects":"the jobs of the daily flow","action":"A job in the daily flow could not start: its container stopped before SecurityInsight ran (an Azure platform problem). It was started again automatically and did not start that time either. Check the job's executions in Operations > Jobs; when Azure is healthy again, use Re-run from here. If it happens again, contact Invardia support.","kind":"rerun","defaultOff":true,"whenOff":"Off: no event and no mail; a job that does not start is still not run.","what":"A job in the daily flow could not start, also not when it was started again.","why":"This check tells you that a job did not run, so you do not trust data that was not updated. {detail|Its container stopped before SecurityInsight ran (an Azure platform problem).}","ifRelease":"This check cannot be released: nothing is held. Run the job again when Azure is healthy.","consequence":"That job's data was not updated this time, and jobs that need it may have been skipped. Nothing else is lost.","steps":["Check the job's runs in Operations > Jobs.","When Azure is healthy again, use Re-run from here.","If it happens again, contact Invardia support."],"neverReleasable":"the job could not be started; re-run it on the Jobs page -- there is nothing held"},
|    {"id":"flow.step.interrupted","name":"Daily flow: job interrupted","area":"job-flow","job":"si-flow","protects":"the jobs that depend on an earlier job","action":"A job in the daily flow was interrupted and was not started again automatically. Check Operations > Jobs and use Re-run from here when ready.","kind":"rerun","defaultOff":true,"whenOff":"Off: no event and no mail; an interrupted job is still not started again.","what":"{held|Some} job(s) in the daily flow were interrupted and not started again automatically.","why":"This check tells you that a job stopped part way, so its data and the jobs that need it are not up to date. {detail|The job stopped part way, for example because its container was restarted.}","ifRelease":"This check cannot be released: nothing is held. Run the job again on the Jobs page.","consequence":"Those jobs did not update their data this time, and jobs that need them wait.","steps":["Check Operations > Jobs.","Use Re-run from here when ready."],"neverReleasable":"the job was interrupted; re-run it on the Jobs page -- there is nothing held"},
|    {"id":"job.execution.previous-running","name":"Job started while still running","area":"job-flow","job":"","protects":"a job from running twice at the same time","action":"A job was started while its previous run was still running, so the new run did nothing. If this happens every day, the job takes longer than its schedule allows: start it less often.","kind":"info","defaultOff":true,"whenOff":"Off: no event and no mail. The step itself still stops, because two runs of one job never run at the same time.","what":"A job was started while its previous run was still running, so the new run did nothing.","why":"This check stops one job from running twice at the same time, which would write the same data twice. {detail|The previous run of the job had not finished.}","ifRelease":"This check cannot be released: a job never runs twice at the same time.","consequence":"Nothing is lost: the running job finishes its work.","steps":["Nothing is needed if it happens rarely.","If it happens every day, the job takes longer than its schedule allows: start it less often."],"neverReleasable":"a job never runs twice at the same time (SCHED-1); the skipped start runs when the previous run finishes"},
|    {"id":"job.run.throttled-stuck","name":"Job stuck on throttling","area":"job-flow","job":"","protects":"the data of a job that Microsoft keeps throttling","action":"Microsoft has throttled this job on every run for a long time, so it has not completed since. Throttling on its own is normal and is never mailed; this mail means the job cannot catch up by itself. Check whether other tools use the same Microsoft services heavily at the same time, or run the job at a quieter time. The alert clears by itself after the next run that completes.","kind":"next-run","defaultOff":true,"whenOff":"Off: no event and no mail when a job is stuck on throttling. Throttled runs are still shown as throttled on the Jobs and Run health pages.","what":"A job has not completed for a long time, because Microsoft throttled every run of it.","why":"This check tells you when a job has not been able to complete for a long stretch, so you do not rely on data that is getting old. Throttling on its own is normal and is not reported. {detail|Every run of the job was throttled by Microsoft.}","ifRelease":"This check cannot be released: nothing is held. The next run that completes clears it.","consequence":"The job's data was not updated while it was stuck. The previous results stay in place, and findings it could not check are unknown, not resolved. Nothing is lost.","steps":["Check the job on the Jobs page (Operations > Jobs).","If other tools use the same Microsoft services heavily, run this job at a quieter time.","If it stays stuck, contact Invardia support."],"neverReleasable":"nothing is held; the alert clears by itself after the next run that completes"}
|  ]
|}
'@ }
$__siSupportFiles['engine/_shared/SI-Throttle.ps1'] = @{ Sha256 = '2e4bc2af1e8f4f256000ac4ba7064a227d06025704da23cedbc1f343e1026f62'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- THROTTLE-IS-NORMAL (#532; framework DOCS/REQUIREMENTS.md §12.18 holds the contract, not this file).
|
|    A run whose failures are ALL real THROTTLING (a 429 / "too many requests" / rate-limit answer -- Get-SITransientKind in
|    SI-ErrorClass.ps1, class 'throttled') and that wrote nothing is not a failed run. Its run-health ExitReason is
|    'throttled' (telemetry Outcome 'warning', ErrorClass 'throttled'): no failure mail, no fix request, amber, and it runs
|    again at its next scheduled time.
|    2026-10-22 (owner, approved): a TIMEOUT or a service that could not be reached (5xx, a reset connection, DNS) is NOT
|    throttling -- it was reported as "Microsoft throttled this run" when SI's own storage timed out. Such a run stays a real
|    failure ('error'): its real error text is kept, it is mailed and reported, and a new install's first collection is
|    restarted after it.
|
|    ONE alert, only when SecurityInsight cannot handle it: the same job has not succeeded for a long stretch because of
|    throttling -- the "stuck" alert (guard 'job.run.throttled-stuck'). Settable: SI_Throttle_StuckHours (default 6) and
|    SI_Throttle_StuckRuns (default 12), whichever comes first, and never on one run alone. The next successful run clears
|    it (nothing to acknowledge).
|
|    What does NOT change (working rule 4: absence is not remediation):
|      * a run that wrote part of its result (ExitReason 'success-partial', or a failure in a stage that writes) is never
|        'throttled' -- a partial result is never shipped as whole, and a partial write stays a real failure;
|      * a run with ANY other failure (403, bad data, a bug) next to the throttling is 'error', exactly as before;
|      * a throttled run published nothing, so the previous whole result is still the newest: findings it could not
|        collect are UNKNOWN, never resolved (every reader that waits for a 'success' / 'success-partial' run -- the data
|        sync, the close-loop, the v3 snapshot -- treats 'throttled' as a run that did not succeed).
|
|    PURE except Get-SIThrottleHistoryKql's caller (Invoke-SIThrottleStuckCheck reads Log Analytics through a seam).
|    PS 5.1 safe.
|#>
|
|if (-not (Get-Command -Name Get-SIErrorClass -ErrorAction SilentlyContinue)) {
|    . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-ErrorClass.ps1'))
|}
|
|$script:SIThrottle = @{
|    # the error class that means "Microsoft asked us to slow down" -- ONLY real throttling (Get-SITransientKind); a timeout
|    # ('platform-timeout') or an unreachable service ('platform-5xx') is a real failure with its own words
|    Classes          = @('throttled')
|    # run-health ExitReasons that mean "nothing reached any output" -- the only ones that can become 'throttled'
|    ErrorReasons     = @('error', 'failure', 'failed')
|    # a failure in one of these stages may have written part of the result: never 'throttled'
|    WriteStageRegex  = '(?i)output|tagging|recommendations|ingest|publish|write|post|sink|mail|apply|sync|upload|store'
|    # Microsoft Graph wording a 429 can carry next to an access problem: an access refusal is never throttling
|    AccessRegex      = '(?i)\b40[13]\b|\bForbidden\b|\bUnauthorized\b|Authorization_RequestDenied|AuthorizationFailed|AuthorizationPermissionMismatch|Insufficient privileges|is not authorized to perform|ForbiddenByRbac|ForbiddenByPolicy|Access denied|InvalidAuthenticationToken'
|    StuckHours       = 6
|    StuckRuns        = 12
|    GuardId          = 'job.run.throttled-stuck'
|    GuardFile        = ([System.IO.Path]::Combine($PSScriptRoot, 'SI-Guard.ps1'))
|    # the customer words (plain language, no internal numbers)
|    Text             = 'Microsoft throttled this run; it runs again automatically at its next scheduled time. Nothing was published from it, so the previous results stay in place.'
|}
|
|function Get-SIThrottleClasses { @($script:SIThrottle.Classes) }
|
|function Get-SIThrottleText {
|    <# PURE. The customer words for a run that ended 'throttled' (run health, the Jobs page, the flow log). A run ends
|       'throttled' only when Microsoft really throttled it (Get-SITransientKind), so these words are true. #>
|    $script:SIThrottle.Text
|}
|
|function Get-SIRunFailureClasses {
|    <#
|        PURE. Every failure a run's error text names, one error class each. SecurityInsight joins the failures of one run
|        with ' | ' (SI-RunOutcome, Risk Analysis); each part is classified on its own, so "429 | 403" is two failures, not
|        one throttle. A part that is classified as throttling but ALSO carries an access refusal (401 / 403 wording) adds
|        'access-refused' -- Get-SIErrorClass checks throttling first and would otherwise hide it.
|    #>
|    param([AllowEmptyString()][AllowNull()][string]$Message)
|    $out = New-Object System.Collections.Generic.List[string]
|    if ([string]::IsNullOrWhiteSpace($Message)) { return @() }
|    foreach ($part in ([regex]::Split([string]$Message, '\s\|\s|\r?\n'))) {
|        $p = "$part".Trim()
|        if (-not $p) { continue }
|        $c = Get-SIErrorClass -Message $p
|        $out.Add($c)
|        if ($script:SIThrottle.Classes -contains $c -and $p -match $script:SIThrottle.AccessRegex) { $out.Add('access-refused') }
|    }
|    $out.ToArray()
|}
|
|function Test-SIThrottleOnly {
|    <#
|        PURE. $true when there is at least one failure and EVERY failure is throttling / service-side (Get-SIThrottleClasses).
|        One unknown, access, data or query failure next to it = $false (the run is a real failure).
|    #>
|    param([AllowNull()][AllowEmptyCollection()][string[]]$ErrorClasses)
|    $c = @(@($ErrorClasses) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
|    if ($c.Count -eq 0) { return $false }
|    foreach ($x in $c) { if ($script:SIThrottle.Classes -notcontains [string]$x) { return $false } }
|    $true
|}
|
|function Resolve-SIThrottledExitReason {
|    <#
|        PURE. The run-health ExitReason a run REALLY ended with: 'throttled' when it ended 'error' (nothing reached any
|        output), every failure in -ErrorMessage (or -ErrorClasses, when the caller knows them) is throttling / service-side,
|        it did not fail in a stage that writes (-FailedStep), and the caller did not say it wrote part of its result
|        (-WrotePartial). Anything else is returned unchanged -- 'success-partial' is never turned into 'throttled'.
|    #>
|    param([AllowEmptyString()][string]$ExitReason, [AllowEmptyString()][AllowNull()][string]$ErrorMessage,
|          [AllowNull()][string[]]$ErrorClasses, [AllowEmptyString()][AllowNull()][string]$FailedStep, [switch]$WrotePartial)
|    $x = "$ExitReason".Trim().ToLowerInvariant()
|    if ($script:SIThrottle.ErrorReasons -notcontains $x) { return $ExitReason }
|    if ($WrotePartial) { return $ExitReason }
|    if ($FailedStep -and $FailedStep -match $script:SIThrottle.WriteStageRegex) { return $ExitReason }
|    $cls = if ($null -ne $ErrorClasses -and @($ErrorClasses).Count) { @($ErrorClasses) } else { @(Get-SIRunFailureClasses -Message $ErrorMessage) }
|    if (Test-SIThrottleOnly -ErrorClasses $cls) { return 'throttled' }
|    $ExitReason
|}
|
|function Get-SIThrottleSetting {
|    <# PURE. A positive whole number from the install's settings (-Globals, else $global:), else the default. #>
|    param([Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][int]$Default, [System.Collections.IDictionary]$Globals)
|    $v = if ($Globals -and $Globals.Contains($Name)) { $Globals[$Name] } else { Get-Variable -Name $Name -Scope Global -ValueOnly -ErrorAction SilentlyContinue }
|    $n = 0
|    if ($null -ne $v -and [int]::TryParse(([string]$v).Trim(), [ref]$n) -and $n -gt 0) { return $n }
|    $Default
|}
|
|function Get-SIThrottleStuckVerdict {
|    <#
|        PURE. Is this job STUCK on throttling -- the one alert THROTTLE-IS-NORMAL allows?
|          -History  the job's END records, any order: @{ EndedUtc; ExitReason } (newest included)
|          -Hours / -Runs  the thresholds (SI_Throttle_StuckHours / SI_Throttle_StuckRuns)
|        The STREAK is the unbroken run of 'throttled' records since the newest success ('success' or 'success-partial').
|        Any other ending (a real failure) breaks it too -- that one alerts on its own, as before.
|        Stuck = the streak has at least 2 runs AND (it spans at least -Hours from its first run to -NowUtc, OR it has at
|        least -Runs runs). AlertDue = stuck now, and NOT stuck without the newest record -- so the alert goes out once per
|        episode; the next success ends the episode (nothing to acknowledge).
|        Returns @{ Stuck; AlertDue; Runs; SinceUtc; Hours }.
|    #>
|    param([AllowNull()][AllowEmptyCollection()][object[]]$History, [Parameter(Mandatory)][datetime]$NowUtc,
|          [int]$Hours = $script:SIThrottle.StuckHours, [int]$Runs = $script:SIThrottle.StuckRuns)
|    $now = $NowUtc.ToUniversalTime()
|    $rows = @(@($History) | Where-Object { $_ -and $_.EndedUtc } | Sort-Object { ([datetime]$_.EndedUtc).ToUniversalTime() } -Descending)
|    $streak = New-Object System.Collections.Generic.List[object]
|    foreach ($r in $rows) {
|        if ("$($r.ExitReason)".Trim().ToLowerInvariant() -ne 'throttled') { break }
|        $streak.Add($r)
|    }
|    $judge = {
|        param($list, $at)
|        $n = @($list).Count
|        if ($n -lt 2) { return $false }
|        $first = ([datetime]@($list)[$n - 1].EndedUtc).ToUniversalTime()
|        (($at - $first).TotalHours -ge $Hours) -or ($n -ge $Runs)
|    }
|    $stuck = [bool](& $judge $streak.ToArray() $now)
|    $before = $false
|    if ($stuck -and $streak.Count -ge 2) {
|        # was the job already stuck when the PREVIOUS run ended? (judged at that run's own time)
|        $older = @($streak.ToArray() | Select-Object -Skip 1)
|        $before = [bool](& $judge $older ([datetime]$older[0].EndedUtc).ToUniversalTime())
|    }
|    $since = if ($streak.Count) { ([datetime]$streak[$streak.Count - 1].EndedUtc).ToUniversalTime() } else { $null }
|    [pscustomobject]@{
|        Stuck    = $stuck
|        AlertDue = ($stuck -and -not $before)
|        Runs     = $streak.Count
|        SinceUtc = $since
|        Hours    = $(if ($since) { [Math]::Round(($now - $since).TotalHours, 1) } else { 0 })
|    }
|}
|
|function Get-SIThrottleHistoryKql {
|    <#
|        PURE. The KQL that reads one engine's END records of the last -Days days (newest first, at most 200) -- the
|        history Get-SIThrottleStuckVerdict judges. $null for a name that is not an engine name (never put into a query).
|    #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Engine, [int]$Days = 14)
|    if ($Engine -notmatch '^[a-z0-9][a-z0-9:\-]{0,63}$') { return $null }
|    "SI_RunHealth_CL | where TimeGenerated > ago($($Days)d) | where Phase == 'End' and Engine == '$Engine' and toint(ShardIndex) == 0 | project EndedUtc = TimeGenerated, ExitReason = tostring(ExitReason) | order by EndedUtc desc | take 200"
|}
|
|function Invoke-SIThrottleStuckCheck {
|    <#
|        At the END of a throttled run: read the job's history, add THIS run (its record may not be in the store yet) and,
|        when the job has just become stuck, raise the ONE alert (guard 'job.run.throttled-stuck': the Guards page, one mail,
|        one report to Invardia). NEVER throws; returns the verdict (or $null when the history could not be read).
|          -Query  { param($Kql) } -> rows with EndedUtc / ExitReason (default Invoke-SILogLaQuery on SI_WorkspaceResourceId)
|          -Raise  { param($Verdict, $Engine, $RunId) } (default Send-SIGuardEvent)
|    #>
|    param([Parameter(Mandatory)][string]$Engine, [string]$RunId, [datetime]$NowUtc = [datetime]::UtcNow,
|          [scriptblock]$Query, [scriptblock]$Raise, [System.Collections.IDictionary]$Globals)
|    try {
|        $hours = Get-SIThrottleSetting -Name 'SI_Throttle_StuckHours' -Default $script:SIThrottle.StuckHours -Globals $Globals
|        $runs = Get-SIThrottleSetting -Name 'SI_Throttle_StuckRuns' -Default $script:SIThrottle.StuckRuns -Globals $Globals
|        $kql = Get-SIThrottleHistoryKql -Engine $Engine
|        if (-not $kql) { return $null }
|        if (-not $Query) {
|            if (-not [string]$global:SI_WorkspaceResourceId -or -not (Get-Command -Name Invoke-SILogLaQuery -ErrorAction SilentlyContinue)) { return $null }
|            $Query = { param($k) Invoke-SILogLaQuery -WorkspaceResourceId ([string]$global:SI_WorkspaceResourceId) -Query $k }
|        }
|        $rows = @(@(& $Query $kql) | Where-Object { $_ })
|        $now = $NowUtc.ToUniversalTime()
|        $hist = @([pscustomobject]@{ EndedUtc = $now; ExitReason = 'throttled' }) + @($rows | Where-Object { $_.EndedUtc -and ([datetime]$_.EndedUtc).ToUniversalTime() -lt $now.AddSeconds(-5) })
|        $v = Get-SIThrottleStuckVerdict -History $hist -NowUtc $now -Hours $hours -Runs $runs
|        if ($v.AlertDue) {
|            try {
|                if ($Raise) { $null = & $Raise $v $Engine $RunId }
|                else {
|                    if (-not (Get-Command -Name Send-SIGuardEvent -ErrorAction SilentlyContinue)) { . $script:SIThrottle.GuardFile }
|                    # the cause = this job + the start of this episode: the alert goes out once per episode, and again only
|                    # after a successful run has ended the episode and a new one has become stuck
|                    $cause = '{0}|{1}' -f $Engine, ([datetime]$v.SinceUtc).ToString('yyyy-MM-ddTHH:mm:ssZ', [Globalization.CultureInfo]::InvariantCulture)
|                    $null = Send-SIGuardEvent -GuardId $script:SIThrottle.GuardId -Outcome 'warning' -Engine $Engine -Subject $Engine -RunId $RunId -Globals $Globals `
|                        -Detail ('The {0} job was throttled by Microsoft on every run for {1} hours ({2} runs in a row) and has not completed since.' -f $Engine, $v.Hours, $v.Runs) `
|                        -Values @(@{ Name = 'hoursStuck'; Label = 'Hours without a completed run'; Measured = $v.Hours }, @{ Name = 'runsThrottled'; Label = 'Throttled runs in a row'; Measured = $v.Runs }) `
|                        -CauseKeys @($cause)
|                }
|            } catch { Write-Warning ('The stuck-job alert could not be raised: {0}' -f $_.Exception.Message) }
|        }
|        $v
|    } catch { $null }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-FirstRun.ps1'] = @{ Sha256 = '3564963bd47275ffd91f657d6ba5ee91914651d07b30b00e095ad267ece583bb'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight -- the FIRST RUN AFTER AN UPGRADE, and the dry-run lines every run carries.
|
|    Many 2.2 installs receive 3.0 with nobody reading the upgrade notes: 2.2's Update-SecurityInsight.ps1 pulls at once,
|    the 2.2 README scheduled a daily `git pull`, and internal installs are synced from main. So 3.0 must arrive safely by
|    itself. This file is that safety layer, shared by the VM loader (launcher\_lib\Initialize-LauncherConfig.ps1) and the
|    container entry points (container\Start-SIInContainer.ps1, container\Start-RiskAnalysisInContainer.ps1):
|
|      1. DETECTION, once per install: "this install ran an earlier version, and this is its first 3.0 run". A small
|         state file is written on the first 3.0 run (VM: <solution>\logs\state\install-state.json; container: blob
|         'install/install-state.json' in the install's 'sistate' container). With no state yet, the install is
|         UPGRADED when there is evidence of earlier runs -- run logs older than this run, a 2.2 config snapshot (2.2
|         loaded the engine defaults AFTER the customer file), or a setting only 2.2 knew -- and FRESH otherwise. A fresh
|         install gets no upgrade notice. The state then says which one-time notices were shown, so none repeats.
|      2. ONE-TIME NOTICES: what 3.0 changed by itself (upgraded installs), what the status reports to Invardia carry and
|         how to turn them off (every install, once, while they are on), on a Pro install what it now does with Invardia
|         by itself (the automatic licence request and the Pro updates, both on by default) with the off switch for each,
|         and -- per engine, VM only -- the settings from
|         the customer's own configuration that now take effect (2.2 overwrote them with its engine defaults; the list
|         is computed against the 2.2.460 defaults kept in launcher\_lib\v2.2-engine-defaults.locked.json and saved to
|         logs\settings-now-in-effect-<engine>.txt for support).
|      3. DRY RUN is asked for PER RUN only (operator decision: "upgrade must work, no dryrun"). A WhatIfMode that comes
|         from the configuration (custom.ps1, a launcher config, the Pro settings, a container job's settings) is IGNORED
|         for every engine except asset tagging -- where it has always meant "do not change any tag" and is kept -- and
|         every run says so in one line. A dry run is started with the launcher's -WhatIfMode switch, or with SI_WHATIF=1
|         on one container job execution. A dry run says so loudly at its start and at its end (Send-SIRunHealthRow).
|
|    RULE: nothing here may fail or stop a run. Every reader and writer swallows its own errors.
|    Customer-facing text: plain words, no tracking numbers, no internal terms.
|    PS 5.1 and 7.
|#>
|
|# the install-state blob (a container) goes through SI's Azure wrappers: load them where this file is
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot 'SI-AzRest.ps1') }
|# Pro: what the install now does with Invardia by itself, and its two switches (the one-time 'pro-auto' notice)
|if (-not (Get-Command -Name Get-SIProAutoNoticeLines -ErrorAction SilentlyContinue)) {
|    $siFrProAuto = Join-Path $PSScriptRoot 'SI-ProAutomation.ps1'
|    if (Test-Path -LiteralPath $siFrProAuto) { . $siFrProAuto }
|}
|
|$script:SIFirstRun = @{
|    SolutionRoot   = (Split-Path -Parent (Split-Path -Parent $PSScriptRoot))
|    StateFileName  = 'install-state.json'
|    StateBlob      = 'install/install-state.json'
|    StateContainer = 'sistate'
|    RunLogContainer = 'sistaging'
|    RunLogPrefix   = 'run-logs/'
|    # Settings that only 2.2 read. 3.0 ships none of them, so a configuration that sets one was written for 2.2.
|    Legacy22Settings = @('SendToPowerBI', 'SI_SendToPowerBI', 'TroubleshootingMode', 'SI_UseNewRuleEngine',
|                         'SI_DiscoveryMode_azure', 'SI_SystemPrompt_publicip', 'SI_EnableAI_publicip')
|    Legacy22Prefixes = @('PowerBI_')
|    # The engines where WhatIfMode in the configuration is KEPT: asset tagging changes the customer's own resources,
|    # and "report only" is what 2.2 did with it too.
|    DryRunConfigEngines = @('assettagging', 'asset-tagging')
|    SecretNameRe   = '(?i)Secret|Password|Pwd|ApiKey|Api_Key|AccessKey|Token(?!Lifetime)|ConnectionString|StorageKey|Cert(?:ificate)?Thumbprint'
|}
|
|# =====================================================================================================================
|#  Pure decisions
|# =====================================================================================================================
|function Test-SIFirstRunTruthy {
|    <# PURE. $true / 'true' / '1' / 'yes' / 'on' / '$true' -> $true; anything else (null, empty, false, 0 ...) -> $false. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $false }
|    if ($Value -is [bool]) { return $Value }
|    if ($Value -is [System.Management.Automation.SwitchParameter]) { return $Value.IsPresent }
|    return ("$Value".Trim().Trim('$').ToLowerInvariant() -in @('true', '1', 'yes', 'on'))
|}
|
|function Get-SIFirstRunDecision {
|    <#
|        PURE. -State: the install's state ($null = none yet). -Evidence: the signs of earlier runs found ('' entries ignored).
|        Returns Kind = seen (a 3.0 run already recorded this install) | upgraded (first 3.0 run of an install that ran
|        before) | fresh (first run of a new install), and Origin = upgraded | fresh.
|    #>
|    param([AllowNull()]$State, [AllowNull()][AllowEmptyCollection()][string[]]$Evidence)
|    if ($State -and $State.PSObject.Properties['Origin'] -and "$($State.Origin)" -in @('upgraded', 'fresh')) {
|        return [pscustomobject]@{ Kind = 'seen'; Origin = [string]$State.Origin }
|    }
|    $ev = @($Evidence | Where-Object { "$_".Trim() })
|    if ($ev.Count) { return [pscustomobject]@{ Kind = 'upgraded'; Origin = 'upgraded' } }
|    [pscustomobject]@{ Kind = 'fresh'; Origin = 'fresh' }
|}
|
|function New-SIInstallState {
|    <# PURE. A new install state. #>
|    param([Parameter(Mandatory)][ValidateSet('upgraded', 'fresh')][string]$Origin, [AllowNull()][string[]]$Evidence,
|          [AllowEmptyString()][string]$Version, [datetime]$NowUtc = [datetime]::UtcNow)
|    [pscustomobject]@{
|        Schema = 1; Origin = $Origin; FirstRunUtc = $NowUtc.ToUniversalTime().ToString('o'); FirstVersion = "$Version"
|        Evidence = @($Evidence | Where-Object { "$_".Trim() }); Shown = @()
|    }
|}
|
|function Test-SINoticeDue {
|    <# PURE. Has the one-time notice -Id not been shown on this install yet? #>
|    param([AllowNull()]$State, [Parameter(Mandatory)][string]$Id)
|    if (-not $State -or -not $State.PSObject.Properties['Shown']) { return $true }
|    return -not (@($State.Shown) -contains $Id)
|}
|
|function Add-SINoticeShown {
|    <# Records the notice -Id as shown in -State (in place). #>
|    param([Parameter(Mandatory)]$State, [Parameter(Mandatory)][string]$Id)
|    $shown = @($State.Shown | Where-Object { "$_" })
|    if ($shown -notcontains $Id) { $shown += $Id }
|    if ($State.PSObject.Properties['Shown']) { $State.Shown = $shown } else { $State | Add-Member -NotePropertyName Shown -NotePropertyValue $shown }
|}
|
|function Resolve-SIConfigDryRun {
|    <#
|        PURE. Does a WhatIfMode from the CONFIGURATION make this engine's run a dry run? Only for asset tagging (it keeps
|        what it always meant there: report only, change no tag). For every other engine a dry run is asked for per run
|        (-WhatIfMode on the launcher, SI_WHATIF on one container job execution), and a configuration value is ignored.
|        -SetByConfig: the value came from a configuration layer (not from the caller's own session).
|        Returns Ignored (a true configuration value was set aside) and WhatIfMode (the value to use before any per-run
|        request is applied).
|    #>
|    param([AllowEmptyString()][string]$Engine, [AllowNull()]$ConfigValue, [bool]$SetByConfig = $true)
|    $on = Test-SIFirstRunTruthy $ConfigValue
|    $e = ("$Engine".Trim().ToLowerInvariant() -replace '[\s_]', '')
|    if (-not $on) { return [pscustomobject]@{ Ignored = $false; WhatIfMode = $false } }
|    if (-not $SetByConfig -or $e -in $script:SIFirstRun.DryRunConfigEngines) { return [pscustomobject]@{ Ignored = $false; WhatIfMode = $true } }
|    [pscustomobject]@{ Ignored = $true; WhatIfMode = $false }
|}
|
|function ConvertTo-SISettingDisplay {
|    <# PURE. A setting value as one short, readable line. Secret-looking names are never shown. #>
|    param([string]$Name, [AllowNull()]$Value)
|    if ($Name -match $script:SIFirstRun.SecretNameRe) { return '(hidden)' }
|    if ($null -eq $Value) { return '(not set)' }
|    if ($Value -is [bool]) { return ('$' + $Value.ToString().ToLowerInvariant()) }
|    if ($Value -is [System.Collections.IDictionary]) { return ('@{' + ((@($Value.Keys) | ForEach-Object { "$_" }) -join ', ') + '}') }
|    if ($Value -is [array] -or $Value -is [System.Collections.IList]) {
|        return ('@(' + ((@($Value) | ForEach-Object { "'$_'" }) -join ', ') + ')')
|    }
|    $s = ("$Value" -replace '\r?\n', ' ')
|    if ($Value -is [string] -and -not $s.Trim()) { return '(empty)' }
|    if ($s.Length -gt 120) { $s = $s.Substring(0, 120) + '...' }
|    if ($Value -is [string]) { return "'$s'" }
|    return $s
|}
|
|function ConvertTo-SISettingComparable {
|    <# PURE. The value as text for comparing a 2.2 default with today's value (bool / number / list / text alike). #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return '' }
|    if ($Value -is [bool]) { return $Value.ToString().ToLowerInvariant() }
|    if ($Value -is [System.Collections.IDictionary]) { return '' }
|    if ($Value -is [array] -or $Value -is [System.Collections.IList]) { return ((@($Value) | ForEach-Object { "$_".Trim() }) -join ',') }
|    $s = "$Value".Trim()
|    if ($s -match '^(?i)\$?(true|false)$') { return $Matches[1].ToLowerInvariant() }
|    return $s
|}
|
|function Get-SISettingsNowInEffect {
|    <#
|        PURE. The settings of ONE engine that the customer's solution-wide configuration (config\SecurityInsight.custom.ps1)
|        now makes take effect. In 2.2 the engine's shipped defaults loaded AFTER that file, so every default set without a
|        guard replaced the customer's value; 3.0 loads the defaults first. A setting is listed when:
|          the customer's file sets it, 2.2's defaults for this engine set it too, the engine's own customer file
|          (LauncherConfig.custom.ps1, loaded last in both versions) does not, and today's value differs from the 2.2 one.
|        -V22Defaults: name -> the value 2.2.460's defaults set (unguarded) for this engine.
|        -CustomNames / -EngineCustomNames: the names each customer file assigns.  -Current: name -> today's value.
|        Returns @{ Name; Was; Now } sorted by name.
|    #>
|    param([AllowNull()][System.Collections.IDictionary]$V22Defaults, [AllowNull()][string[]]$CustomNames,
|          [AllowNull()][string[]]$EngineCustomNames, [AllowNull()][System.Collections.IDictionary]$Current)
|    $out = New-Object System.Collections.Generic.List[object]
|    if (-not $V22Defaults -or -not $Current) { return @() }
|    $engineOwn = @($EngineCustomNames | Where-Object { $_ })
|    foreach ($n in @($CustomNames | Where-Object { $_ } | Sort-Object -Unique)) {
|        $key = @($V22Defaults.Keys | Where-Object { "$_" -ieq $n }) | Select-Object -First 1
|        if (-not $key) { continue }
|        if (@($engineOwn | Where-Object { $_ -ieq $n }).Count) { continue }
|        $was = $V22Defaults[$key]
|        $nowKey = @($Current.Keys | Where-Object { "$_" -ieq $n }) | Select-Object -First 1
|        $now = if ($nowKey) { $Current[$nowKey] } else { $null }
|        if ((ConvertTo-SISettingComparable $was) -ceq (ConvertTo-SISettingComparable $now)) { continue }
|        $out.Add([pscustomobject]@{ Name = [string]$key; Was = $was; Now = $now })
|    }
|    return @($out.ToArray())
|}
|
|# =====================================================================================================================
|#  The customer-facing texts (plain words; no tracking numbers, no internal terms)
|# =====================================================================================================================
|function Get-SIConfigDryRunIgnoredText {
|    param([ValidateSet('vm', 'container')][string]$Hosting = 'vm')
|    $how = if ($Hosting -eq 'container') { 'set SI_WHATIF=1 on a single job execution' } else { 'start the run with -WhatIfMode' }
|    "WhatIfMode in your configuration is ignored for scheduled runs -- runs publish as normal; for a dry run, $how."
|}
|
|function Get-SIDryRunNoticeText {
|    param([Parameter(Mandatory)][ValidateSet('Start', 'End')][string]$Moment)
|    if ($Moment -eq 'Start') {
|        return 'DRY RUN -- this run publishes nothing and sends nothing (it was started as a dry run). Run it without -WhatIfMode (or without SI_WHATIF on a container job) to publish.'
|    }
|    'DRY RUN finished -- nothing was published or sent. Run it without -WhatIfMode (or without SI_WHATIF on a container job) to publish.'
|}
|
|function Get-SIUpgradeNoticeLines {
|    <# PURE. The one-time notice on the first 3.0 run of an upgraded install. #>
|    param([ValidateSet('vm', 'container')][string]$Hosting = 'vm', [bool]$WhatIfConfigIgnored = $false)
|    $l = New-Object System.Collections.Generic.List[string]
|    $l.Add('SecurityInsight was updated to 3.0 on this installation. These changes apply by themselves -- nothing needs to be done now:')
|    if ($Hosting -eq 'vm') {
|        $l.Add(' - Your own settings in config\SecurityInsight.custom.ps1 now win over the built-in engine defaults. Each engine lists once, on its first run, which of your settings now take effect (also saved in the logs folder).')
|    }
|    $l.Add(' - SecurityInsight no longer refreshes a Power BI dataset. Results are still written to Log Analytics; read them with the Azure Monitor workbook, your own queries or reports, or the SecurityInsight Pro web app.')
|    if ($WhatIfConfigIgnored) {
|        $how = if ($Hosting -eq 'container') { 'set SI_WHATIF=1 on a single job execution' } else { 'start a run with -WhatIfMode' }
|        $l.Add((' - Your configuration sets WhatIfMode. It no longer stops or limits scheduled runs: they publish as normal. For a dry run, {0}.' -f $how))
|    } else {
|        $l.Add(' - A dry run is now asked for per run (the -WhatIfMode switch); WhatIfMode in a configuration file no longer changes scheduled runs.')
|    }
|    $l.Add(' - The full list is in RELEASENOTES.md, section "Upgrading from 2.2.x". This notice is shown once.')
|    return @($l.ToArray())
|}
|
|function Get-SITelemetryNoticeLines {
|    <# PURE. The one-time notice about the status reports to Invardia (shown while they are on). #>
|    param([ValidateSet('vm', 'container')][string]$Hosting = 'vm')
|    $off = if ($Hosting -eq 'container') { 'set SI_Telemetry_Enabled = $false in config\SecurityInsight.custom.ps1 and run setup again, or set SI_TELEMETRY_ENABLED=false on the jobs' }
|           else { 'set $global:SI_Telemetry_Enabled = $false in config\SecurityInsight.custom.ps1' }
|    @(
|        'SecurityInsight sends short status reports to Invardia, the maker of SecurityInsight: one a day (version, edition, how it is hosted, licence state) and one per engine run (whether it succeeded, how long it took, the kind of error, and counts).',
|        ' - A Community installation reports anonymously, with a random installation id: no tenant, no host name, no error text, and counts only as ranges.',
|        ' - A Pro installation reports with its installation key; error messages are shortened and secrets are removed before they are sent.',
|        (' - To turn the reports off, {0}. This notice is shown once.' -f $off)
|    )
|}
|
|function Get-SISettingsNowInEffectLines {
|    <# PURE. The one-time per-engine list, for the console and the file in logs\. #>
|    param([Parameter(Mandatory)][string]$Engine, [AllowNull()][AllowEmptyCollection()][object[]]$Changes, [string]$FileName)
|    $c = @($Changes | Where-Object { $_ })
|    if (-not $c.Count) { return @(('No setting in your configuration changes the {0} engine''s behaviour with SecurityInsight 3.0.' -f $Engine)) }
|    $l = New-Object System.Collections.Generic.List[string]
|    $l.Add(('These settings from your configuration now take effect for the {0} engine. SecurityInsight 2.2 replaced them with its built-in defaults; 3.0 uses your values:' -f $Engine))
|    foreach ($x in $c) {
|        $l.Add(('   {0}: was {1}, now {2}' -f $x.Name, (ConvertTo-SISettingDisplay -Name $x.Name -Value $x.Was), (ConvertTo-SISettingDisplay -Name $x.Name -Value $x.Now)))
|    }
|    if ($FileName) { $l.Add((' This list is saved in logs\{0} and is shown once. To keep 2.2''s behaviour for a setting, remove it from your configuration.' -f $FileName)) }
|    return @($l.ToArray())
|}
|
|function Write-SINoticeLines {
|    <# Prints notice lines: the first as [NOTICE], the rest indented. Into the console and the run log (transcript). #>
|    param([AllowEmptyCollection()][string[]]$Lines)
|    $first = $true
|    foreach ($line in @($Lines)) {
|        try {
|            if ($first) { Write-Host ('[NOTICE] {0}' -f $line) -ForegroundColor Yellow; $first = $false }
|            else { Write-Host ('         {0}' -f $line) -ForegroundColor Yellow }
|        } catch { }
|    }
|}
|
|# =====================================================================================================================
|#  The retired Power BI refresh -- one line per run while it is still configured (VM loader and containers alike)
|# =====================================================================================================================
|function Write-SIPowerBIRetiredNotice {
|    <#
|        The Power BI dataset refresh (SendToPowerBI, PowerBI_*) was removed in 3.0.0. When a configuration still turns it
|        on -- SendToPowerBI / SI_SendToPowerBI true, or any PowerBI_* setting with a value -- print ONE line saying so and
|        where the results are read now. Nothing set = nothing printed. Returns $true when it printed.
|    #>
|    [CmdletBinding()]
|    param()
|    $on = $false
|    foreach ($n in @('SendToPowerBI', 'SI_SendToPowerBI')) {
|        $v = Get-Variable -Name $n -Scope Global -ValueOnly -ErrorAction SilentlyContinue
|        if ($v -is [bool]) { if ($v) { $on = $true } }
|        elseif ($null -ne $v -and ([string]$v).Trim() -match '^(?i:true|1|yes|on|\$true)$') { $on = $true }
|    }
|    if (-not $on) {
|        foreach ($var in @(Get-Variable -Name 'PowerBI_*' -Scope Global -ErrorAction SilentlyContinue)) {
|            if (-not [string]::IsNullOrWhiteSpace([string]$var.Value)) { $on = $true; break }
|        }
|    }
|    if (-not $on) { return $false }
|    Write-Warning ('The Power BI refresh was retired in SecurityInsight 3.0: SendToPowerBI and the PowerBI_* settings ' +
|        'are no longer used, and no Power BI dataset is refreshed. Your results are still written to Log Analytics -- ' +
|        'read them with the Azure Monitor workbook (preview\AzureWorkbook), with your own queries or a Power BI report ' +
|        'connected to the workspace, or in the SecurityInsight Pro web app. Remove these settings from your ' +
|        'configuration to stop this message.')
|    return $true
|}
|
|# =====================================================================================================================
|#  This install: the state, the evidence, the telemetry switch
|# =====================================================================================================================
|function Get-SIFirstRunVersion {
|    param([string]$SolutionRoot = $script:SIFirstRun.SolutionRoot)
|    try {
|        $f = [System.IO.Path]::Combine($SolutionRoot, 'VERSION')
|        if ([System.IO.File]::Exists($f)) { return ([System.IO.File]::ReadAllText($f)).Trim() }
|    } catch { }
|    ''
|}
|
|function Test-SIFirstRunTelemetryOn {
|    <# Are the status reports on? The telemetry sender's own decision when it is loaded, else the same rule: the setting,
|       then SI_TELEMETRY_ENABLED, else on. #>
|    if (Get-Command -Name Test-SITelemetryEnabled -ErrorAction SilentlyContinue) { try { return [bool](Test-SITelemetryEnabled) } catch { } }
|    foreach ($v in @($global:SI_Telemetry_Enabled, $env:SI_TELEMETRY_ENABLED)) {
|        if ($null -eq $v) { continue }
|        if ($v -is [bool]) { return $v }
|        $s = "$v".Trim().Trim('$').ToLowerInvariant()
|        if (-not $s) { continue }
|        return -not ($s -in @('false', '0', 'off', 'no', 'disabled'))
|    }
|    $true
|}
|
|function Get-SIFirstRunProAuto {
|    <#
|        Pro only: is this a SecurityInsight Pro run (its settings database is configured), and are the automatic licence
|        request and the Pro updates from Invardia on? The run's settings ($global:, the Pro settings layer sets them), then
|        the job's environment, else on. Returns @{ Pro; LicenceOn; UpdatesOn }.
|    #>
|    $pro = [bool]("$($global:SI_ProSqlServer)".Trim() -and "$($global:SI_ProSqlDatabase)".Trim())
|    $lic = $true; $upd = $true
|    if (Get-Command -Name Resolve-SIProAutoSwitch -ErrorAction SilentlyContinue) {
|        try { $lic = (Resolve-SIProAutoSwitch -Name SI_LicenseRequest_Auto -SettingValue $global:SI_LicenseRequest_Auto -EnvValue $env:SI_LICENSE_REQUEST_AUTO).On } catch { }
|        try { $upd = (Resolve-SIProAutoSwitch -Name SI_InvardiaUpdate_Enabled -SettingValue $global:SI_InvardiaUpdate_Enabled -EnvValue $env:SI_INVARDIA_UPDATE_ENABLED).On } catch { }
|    }
|    [pscustomobject]@{ Pro = $pro; LicenceOn = [bool]$lic; UpdatesOn = [bool]$upd }
|}
|
|function ConvertFrom-SIInstallStateJson {
|    param([AllowNull()][AllowEmptyString()][string]$Json)
|    if ([string]::IsNullOrWhiteSpace($Json)) { return $null }
|    $o = $Json | ConvertFrom-Json -ErrorAction Stop
|    if (-not $o.PSObject.Properties['Shown']) { $o | Add-Member -NotePropertyName Shown -NotePropertyValue @() }
|    $o.Shown = @($o.Shown | Where-Object { "$_" })
|    $o
|}
|
|function Read-SIInstallState {
|    <#
|        -Store: @{ Kind = 'file'; Path } | @{ Kind = 'blob'; Account } | @{ Kind = 'memory'; Box = @{} } (tests).
|        Returns @{ Ok; State } -- Ok $false when the store could not be read (the caller then shows nothing and writes
|        nothing, so an unreadable store never repeats a notice on every run). An absent state is Ok with State $null.
|    #>
|    param([Parameter(Mandatory)][hashtable]$Store)
|    try {
|        switch ($Store.Kind) {
|            'file' {
|                if (-not [System.IO.File]::Exists($Store.Path)) { return [pscustomobject]@{ Ok = $true; State = $null } }
|                return [pscustomobject]@{ Ok = $true; State = (ConvertFrom-SIInstallStateJson ([System.IO.File]::ReadAllText($Store.Path))) }
|            }
|            'memory' { return [pscustomobject]@{ Ok = $true; State = (ConvertFrom-SIInstallStateJson ([string]$Store.Box['json'])) } }
|            'blob' {
|                $ctx = Get-SIRunStateContext -AccountName $Store.Account
|                $blob = $null
|                try { $blob = Get-SIAzStorageBlob -Container $script:SIFirstRun.StateContainer -Blob $script:SIFirstRun.StateBlob -Context $ctx -ErrorAction Stop }
|                catch {
|                    if ("$($_.Exception.Message)" -match '(?i)BlobNotFound|ContainerNotFound|does not exist|404|Can not find') { return [pscustomobject]@{ Ok = $true; State = $null } }
|                    throw
|                }
|                if (-not $blob) { return [pscustomobject]@{ Ok = $true; State = $null } }
|                $tmp = [System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), ('si-state-{0}.json' -f [guid]::NewGuid().ToString('N')))
|                try {
|                    Get-SIAzStorageBlobContent -Container $script:SIFirstRun.StateContainer -Blob $script:SIFirstRun.StateBlob -Destination $tmp -Context $ctx -Force -ErrorAction Stop | Out-Null
|                    return [pscustomobject]@{ Ok = $true; State = (ConvertFrom-SIInstallStateJson ([System.IO.File]::ReadAllText($tmp))) }
|                } finally { Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue }
|            }
|            default { return [pscustomobject]@{ Ok = $false; State = $null } }
|        }
|    } catch {
|        Write-Verbose ('install state not read: {0}' -f $_.Exception.Message)
|        return [pscustomobject]@{ Ok = $false; State = $null }
|    }
|}
|
|function Save-SIInstallState {
|    <# Writes the state to -Store. Never throws; $true when written. #>
|    param([Parameter(Mandatory)][hashtable]$Store, [Parameter(Mandatory)]$State)
|    try {
|        $json = $State | ConvertTo-Json -Depth 5
|        switch ($Store.Kind) {
|            'file' {
|                $dir = [System.IO.Path]::GetDirectoryName($Store.Path)
|                $null = [System.IO.Directory]::CreateDirectory($dir)
|                $tmp = $Store.Path + '.' + [guid]::NewGuid().ToString('N') + '.tmp'
|                [System.IO.File]::WriteAllText($tmp, $json, (New-Object System.Text.UTF8Encoding($false)))
|                if ([System.IO.File]::Exists($Store.Path)) { [System.IO.File]::Delete($Store.Path) }
|                [System.IO.File]::Move($tmp, $Store.Path)
|                return $true
|            }
|            'memory' { $Store.Box['json'] = $json; $Store.Box['writes'] = 1 + [int]$Store.Box['writes']; return $true }
|            'blob' {
|                $ctx = Get-SIRunStateContext -AccountName $Store.Account
|                if (-not (Get-SIAzStorageContainer -Name $script:SIFirstRun.StateContainer -Context $ctx -ErrorAction SilentlyContinue)) {
|                    New-SIAzStorageContainer -Name $script:SIFirstRun.StateContainer -Context $ctx -Permission Off -ErrorAction Stop | Out-Null
|                }
|                $tmp = [System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), ('si-state-{0}.json' -f [guid]::NewGuid().ToString('N')))
|                try {
|                    [System.IO.File]::WriteAllText($tmp, $json, (New-Object System.Text.UTF8Encoding($false)))
|                    Set-SIAzStorageBlobContent -File $tmp -Container $script:SIFirstRun.StateContainer -Blob $script:SIFirstRun.StateBlob -Context $ctx -Force -ErrorAction Stop | Out-Null
|                } finally { Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue }
|                return $true
|            }
|        }
|    } catch { Write-Verbose ('install state not saved: {0}' -f $_.Exception.Message) }
|    $false
|}
|
|function Get-SILegacySettingsEvidence {
|    <# PURE. 'v2.2-settings' when any of -Names is a setting only 2.2 read. #>
|    param([AllowNull()][AllowEmptyCollection()][string[]]$Names)
|    foreach ($n in @($Names | Where-Object { $_ })) {
|        if (@($script:SIFirstRun.Legacy22Settings | Where-Object { $_ -ieq $n }).Count) { return 'v2.2-settings' }
|        foreach ($p in $script:SIFirstRun.Legacy22Prefixes) { if ($n -like "$p*") { return 'v2.2-settings' } }
|    }
|    ''
|}
|
|function Get-SIUpgradeEvidenceVm {
|    <#
|        The signs, on a VM, that this install ran before its first 3.0 run. -LogDir: the install's logs folder.
|        -Before: when this run started (its own transcript is newer). -SettingNames: the names the customer files assign.
|        Returns a list of: earlier-run-logs | v2.2-config-snapshot | v2.2-settings. Never throws.
|    #>
|    param([string]$LogDir, [datetime]$Before = [datetime]::Now, [AllowNull()][AllowEmptyCollection()][string[]]$SettingNames)
|    $ev = New-Object System.Collections.Generic.List[string]
|    try {
|        if ($LogDir -and (Test-Path -LiteralPath $LogDir)) {
|            $old = @(Get-ChildItem -LiteralPath $LogDir -Filter '*.log' -File -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -lt $Before })
|            if ($old.Count) { $ev.Add('earlier-run-logs') }
|            # 2.2 loaded the engine defaults AFTER the customer file, and its config snapshot says so in its layer trail.
|            foreach ($f in @($old | Where-Object { $_.Name -like 'config-*.log' } | Sort-Object LastWriteTime -Descending | Select-Object -First 5)) {
|                try {
|                    $head = [System.IO.File]::ReadAllText($f.FullName)
|                    if ($head -match 'Layer 4 - LauncherConfig\.defaults') { $ev.Add('v2.2-config-snapshot'); break }
|                } catch { }
|            }
|        }
|    } catch { }
|    $s = Get-SILegacySettingsEvidence -Names $SettingNames
|    if ($s) { $ev.Add($s) }
|    @($ev.ToArray())
|}
|
|function Get-SIUpgradeEvidenceContainer {
|    <#
|        The signs, for a container install, that it ran before its first 3.0 run: run logs published to the install's
|        storage account before this run started, or a setting only 2.2 read among the job's settings. Never throws.
|    #>
|    param([string]$Account, [datetime]$Before = [datetime]::UtcNow, [AllowNull()][AllowEmptyCollection()][string[]]$SettingNames)
|    $ev = New-Object System.Collections.Generic.List[string]
|    if ($Account) {
|        try {
|            $ctx = Get-SIRunStateContext -AccountName $Account
|            $logs = @(Get-SIAzStorageBlob -Container $script:SIFirstRun.RunLogContainer -Prefix $script:SIFirstRun.RunLogPrefix -Context $ctx -ErrorAction Stop | Where-Object { $_ })
|            $old = @($logs | Where-Object {
|                $lm = $null
|                if ($_.PSObject.Properties['LastModified'] -and $_.LastModified) { try { $lm = ([DateTimeOffset]$_.LastModified).UtcDateTime } catch { try { $lm = ([datetime]$_.LastModified).ToUniversalTime() } catch { } } }
|                (-not $lm) -or ($lm -lt $Before.ToUniversalTime())
|            })
|            if ($old.Count) { $ev.Add('earlier-run-logs') }
|        } catch { Write-Verbose ('earlier run logs not checked: {0}' -f $_.Exception.Message) }
|    }
|    $s = Get-SILegacySettingsEvidence -Names $SettingNames
|    if ($s) { $ev.Add($s) }
|    @($ev.ToArray())
|}
|
|# =====================================================================================================================
|#  The one call per run
|# =====================================================================================================================
|function Invoke-SIFirstRunNotices {
|    <#
|        Decides and shows this run's one-time notices, and records them. Never throws. Returns @{ Kind; Origin; Shown
|        (the ids shown now); Saved; SettingsFile }.
|          -Hosting vm | container          -Engine   the engine (the launcher folder name on a VM)
|          -Store    where the install state lives (see Read-SIInstallState)
|          -Evidence { } -> string[]        evaluated ONLY when there is no state yet
|          -SettingsChanges { } -> @{Name;Was;Now}[]   VM, upgraded installs: this engine's settings now in effect
|          -LogDir   where the settings list file is written (VM)
|          -WhatIfConfigIgnored             this run set aside a WhatIfMode from the configuration
|          -TelemetryOn                     the status reports are on (default: the run's setting)
|          -ProAuto                         @{ Pro; LicenceOn; UpdatesOn } (default: Get-SIFirstRunProAuto) -- a Pro install
|                                           is told once what it now does with Invardia by itself and how to switch it off
|    #>
|    [CmdletBinding()]
|    param([ValidateSet('vm', 'container')][string]$Hosting = 'vm', [string]$Engine = '', [Parameter(Mandatory)][hashtable]$Store,
|          [scriptblock]$Evidence, [scriptblock]$SettingsChanges, [string]$LogDir, [bool]$WhatIfConfigIgnored = $false,
|          $TelemetryOn = $null, $ProAuto = $null, [string]$Version, [datetime]$NowUtc = [datetime]::UtcNow)
|    $res = [pscustomobject]@{ Kind = 'unknown'; Origin = ''; Shown = @(); Saved = $false; SettingsFile = '' }
|    try {
|        $read = Read-SIInstallState -Store $Store
|        if (-not $read.Ok) { return $res }
|        $state = $read.State
|        $dirty = $false
|        $ev = @()
|        if (-not $state) { if ($Evidence) { try { $ev = @(& $Evidence) } catch { $ev = @() } } }
|        $d = Get-SIFirstRunDecision -State $state -Evidence $ev
|        $res.Kind = $d.Kind; $res.Origin = $d.Origin
|        if (-not $state) {
|            if (-not $PSBoundParameters.ContainsKey('Version')) { $Version = Get-SIFirstRunVersion }
|            $state = New-SIInstallState -Origin $d.Origin -Evidence $ev -Version $Version -NowUtc $NowUtc
|            $dirty = $true
|        }
|        $global:SI_InstallOrigin = [string]$state.Origin
|        $shown = New-Object System.Collections.Generic.List[string]
|
|        if ($state.Origin -eq 'upgraded' -and (Test-SINoticeDue -State $state -Id 'upgrade')) {
|            Write-SINoticeLines -Lines (Get-SIUpgradeNoticeLines -Hosting $Hosting -WhatIfConfigIgnored $WhatIfConfigIgnored)
|            Add-SINoticeShown -State $state -Id 'upgrade'; $shown.Add('upgrade'); $dirty = $true
|        }
|        $tOn = if ($null -eq $TelemetryOn) { Test-SIFirstRunTelemetryOn } else { [bool]$TelemetryOn }
|        if ($tOn -and (Test-SINoticeDue -State $state -Id 'telemetry')) {
|            Write-SINoticeLines -Lines (Get-SITelemetryNoticeLines -Hosting $Hosting)
|            Add-SINoticeShown -State $state -Id 'telemetry'; $shown.Add('telemetry'); $dirty = $true
|        }
|        # Pro: the automatic licence request and the Pro updates from Invardia are ON by default -- upgraded installs
|        # included, with no opt-in -- so every Pro install is told once, with the off switch for each.
|        $pa = if ($null -eq $ProAuto) { if (Get-Command -Name Get-SIFirstRunProAuto -ErrorAction SilentlyContinue) { Get-SIFirstRunProAuto } else { $null } } else { $ProAuto }
|        if ($pa -and $pa.Pro -and ($pa.LicenceOn -or $pa.UpdatesOn) -and (Get-Command -Name Get-SIProAutoNoticeLines -ErrorAction SilentlyContinue) -and (Test-SINoticeDue -State $state -Id 'pro-auto')) {
|            Write-SINoticeLines -Lines (Get-SIProAutoNoticeLines -LicenceOn ([bool]$pa.LicenceOn) -UpdatesOn ([bool]$pa.UpdatesOn))
|            Add-SINoticeShown -State $state -Id 'pro-auto'; $shown.Add('pro-auto'); $dirty = $true
|        }
|        $sid = 'settings:' + ("$Engine".Trim().ToLowerInvariant())
|        if ($Hosting -eq 'vm' -and $state.Origin -eq 'upgraded' -and $SettingsChanges -and "$Engine".Trim() -and (Test-SINoticeDue -State $state -Id $sid)) {
|            $changes = @()
|            try { $changes = @(& $SettingsChanges | Where-Object { $_ }) } catch { $changes = @() }
|            $file = ('settings-now-in-effect-{0}.txt' -f ("$Engine".Trim().ToLowerInvariant() -replace '[^a-z0-9_.-]', '-'))
|            $lines = Get-SISettingsNowInEffectLines -Engine $Engine -Changes $changes -FileName $file
|            if ($changes.Count) { Write-SINoticeLines -Lines $lines }
|            if ($LogDir) {
|                try {
|                    $null = [System.IO.Directory]::CreateDirectory($LogDir)
|                    $p = [System.IO.Path]::Combine($LogDir, $file)
|                    $body = @(('SecurityInsight {0} -- first run of the {1} engine after the update, {2:yyyy-MM-dd HH:mm} UTC' -f (Get-SIFirstRunVersion), $Engine, $NowUtc)) + @('') + @($lines)
|                    [System.IO.File]::WriteAllLines($p, [string[]]$body, (New-Object System.Text.UTF8Encoding($false)))
|                    $res.SettingsFile = $p
|                } catch { }
|            }
|            Add-SINoticeShown -State $state -Id $sid; $shown.Add($sid); $dirty = $true
|        }
|        if ($dirty) { $res.Saved = Save-SIInstallState -Store $Store -State $state }
|        $res.Shown = @($shown.ToArray())
|    } catch { Write-Verbose ('first-run notices skipped: {0}' -f $_.Exception.Message) }
|    $res
|}
|
|function Invoke-SIContainerRunSafety {
|    <#
|        The container entry points' ONE call, after the settings and the Pro / customisation layer are in place and the
|        job is signed in: the dry-run decision (a WhatIfMode from the job's settings is set aside unless the engine is
|        asset tagging; SI_WHATIF on this execution asks for a dry run), the retired Power BI line, and the one-time
|        notices (state in the install's storage account). Never throws.
|    #>
|    param([Parameter(Mandatory)][string]$Engine, [string]$StorageAccount, [scriptblock]$GetEnv)
|    if (-not $GetEnv) { $GetEnv = { param($n) [Environment]::GetEnvironmentVariable($n) } }
|    $ignored = $false
|    try {
|        $dr = Resolve-SIConfigDryRun -Engine $Engine -ConfigValue $global:WhatIfMode
|        if ($dr.Ignored) {
|            $ignored = $true
|            $global:SI_WhatIfModeConfigIgnored = $true
|            Write-Warning (Get-SIConfigDryRunIgnoredText -Hosting container)
|        }
|        $global:WhatIfMode = [bool]$dr.WhatIfMode
|        if (Test-SIFirstRunTruthy (& $GetEnv 'SI_WHATIF')) { $global:WhatIfMode = $true }
|    } catch { }
|    try { $null = Write-SIPowerBIRetiredNotice } catch { }
|    $names = @(Get-Variable -Scope Global -ErrorAction SilentlyContinue | ForEach-Object { $_.Name })
|    $before = try { [System.Diagnostics.Process]::GetCurrentProcess().StartTime.ToUniversalTime() } catch { [datetime]::UtcNow }
|    $acct = $StorageAccount
|    if (-not $acct) { return $null }
|    Invoke-SIFirstRunNotices -Hosting container -Engine $Engine -Store @{ Kind = 'blob'; Account = $acct } -WhatIfConfigIgnored $ignored `
|        -Evidence { Get-SIUpgradeEvidenceContainer -Account $acct -Before $before -SettingNames $names }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-ProAutomation.ps1'] = @{ Sha256 = 'bd2f2f28768b73c979d171fe31b6302f7a2aaf9b2ae50c0f019b47598f39ddda'; Text = @'
|#Requires -Version 5.1
|<#
|    SecurityInsight Pro -- WHAT IT DOES WITH INVARDIA BY ITSELF, and the two switches that turn it off.
|
|    Owner decision 2026-10-05 (the same treatment as the status reports): a Pro install asks Invardia for its licence by
|    itself and takes its Pro updates from Invardia by itself -- both ON by default, fresh and upgraded installs alike, and
|    both switchable by the customer:
|
|      SI_LicenseRequest_Auto      the updater job asks Invardia for a licence when there is none, it ends within 30 days,
|                                  or it is in its grace period; quiet while the licence is valid.
|                                  Job environment: SI_LICENSE_REQUEST_AUTO.
|      SI_InvardiaUpdate_Enabled   the updater job checks Invardia for this install's ring and applies a release (signed
|                                  manifest, hold on a manual step or a too-old version, restore on failure).
|                                  Job environment: SI_INVARDIA_UPDATE_ENABLED.
|
|    Where a switch comes from, first wins: the Pro settings database (cfg.Setting, scope 'solution' -- the web app's
|    Settings page), then the job's environment, else ON. If the Pro database cannot be READ the step is skipped for this
|    run (a customer's "off" is never overruled by an unreadable database).
|
|    The licence notice: what the updater audits and mails after a licence request (Get-SILicenceRequestNotice). Success
|    (a licence installed) and failure (refused, rejected, invalid, network, error) are audited and mailed; a failure that
|    keeps repeating is mailed again only after 7 days. Nothing is said while the licence is valid or a request is waiting.
|
|    Everything here is PURE except Read-SIProSolutionSettings (one SELECT through the store's seam). Never throws.
|    Customer-facing words only. PS 5.1 and 7.
|#>
|
|$script:SIProAuto = @{
|    Switches = [ordered]@{
|        SI_LicenseRequest_Auto    = @{ Env = 'SI_LICENSE_REQUEST_AUTO';    Label = 'automatic licence request';  OffText = 'automatic licence request is off' }
|        SI_InvardiaUpdate_Enabled = @{ Env = 'SI_INVARDIA_UPDATE_ENABLED'; Label = 'Pro updates from Invardia'; OffText = 'Pro updates from Invardia are off' }
|    }
|    RemailDays   = 7
|    NoticeSecret = 'SI-LicenceRequest-Notice'
|}
|
|function ConvertTo-SIProAutoFlag {
|    <# PURE. $true / 'true' / '1' / 'on' / 'yes' -> $true; $false / 'false' / '0' / 'off' / 'no' / 'disabled' -> $false; anything else -> $null. #>
|    param([AllowNull()]$Value)
|    if ($null -eq $Value) { return $null }
|    if ($Value -is [bool]) { return $Value }
|    $s = "$Value".Trim().Trim('$').Trim('"').ToLowerInvariant()
|    if ($s -in @('true', '1', 'on', 'yes', 'enabled')) { return $true }
|    if ($s -in @('false', '0', 'off', 'no', 'disabled')) { return $false }
|    $null
|}
|
|function Get-SIProAutoSwitchNames { @($script:SIProAuto.Switches.Keys) }
|
|function Resolve-SIProAutoSwitch {
|    <#
|        PURE. One switch: -SettingValue (the Pro settings value, or a $global: on a VM), then -EnvValue (the job's
|        environment), else ON. Returns @{ Name; On; Source = setting | environment | default; Text }.
|    #>
|    param([Parameter(Mandatory)][ValidateSet('SI_LicenseRequest_Auto', 'SI_InvardiaUpdate_Enabled')][string]$Name,
|          [AllowNull()]$SettingValue, [AllowNull()][AllowEmptyString()][string]$EnvValue)
|    $def = $script:SIProAuto.Switches[$Name]
|    $on = $true; $src = 'default'
|    $v = ConvertTo-SIProAutoFlag $SettingValue
|    if ($null -ne $v) { $on = $v; $src = 'setting' }
|    else {
|        $e = ConvertTo-SIProAutoFlag $EnvValue
|        if ($null -ne $e) { $on = $e; $src = 'environment' }
|    }
|    $how = switch ($src) { 'setting' { "the setting $Name" } 'environment' { "the job setting $($def.Env)" } default { 'the default' } }
|    $text = if ($on) { '{0} is on ({1})' -f $def.Label, $how } else { '{0} ({1}) -- nothing is asked from Invardia for it' -f $def.OffText, $how }
|    [pscustomobject]@{ Name = $Name; On = [bool]$on; Source = $src; Text = $text }
|}
|
|function Read-SIProSolutionSettings {
|    <#
|        The Pro database's solution-wide settings (cfg.Setting, scope 'solution') through a store's (sql, params, mode)
|        seam. Returns @{ Ok; Values = name -> value (parsed JSON); Secrets = name -> Key Vault secret name; Error }.
|        No database = Ok with nothing in it. Never throws.
|    #>
|    param($Store, [scriptblock]$Invoke)
|    $res = [pscustomobject]@{ Ok = $true; Values = @{}; Secrets = @{}; Error = '' }
|    if (-not $Invoke -and $Store) { $Invoke = $Store.Invoke }
|    if (-not $Invoke) { return $res }
|    try {
|        $sql = "IF OBJECT_ID(N'cfg.Setting') IS NULL SELECT CAST(NULL AS NVARCHAR(128)) AS Name, CAST(NULL AS NVARCHAR(MAX)) AS ValueJson, CAST(NULL AS NVARCHAR(256)) AS KeyVaultSecretName WHERE 1 = 0; ELSE SELECT Name, ValueJson, KeyVaultSecretName FROM cfg.Setting WHERE Scope = N'solution';"
|        foreach ($r in @(& $Invoke $sql @{} 'reader' | ForEach-Object { $_ } | Where-Object { $_ })) {
|            $name = [string]$r['Name']; if (-not $name) { continue }
|            $kv = [string]$r['KeyVaultSecretName']
|            if ($kv) { $res.Secrets[$name] = $kv; continue }
|            $raw = [string]$r['ValueJson']
|            $v = $null; try { $v = $raw | ConvertFrom-Json -ErrorAction Stop } catch { $v = $raw }
|            $res.Values[$name] = $v
|        }
|    } catch { $res.Ok = $false; $res.Error = [string]$_.Exception.Message }
|    $res
|}
|
|function Get-SIProAutoSwitches {
|    <#
|        Both switches for the updater: -Settings (Read-SIProSolutionSettings), -Env (a hashtable, else the process
|        environment). An unreadable database (-Settings.Ok = $false) turns BOTH steps off for this run, saying why.
|        Returns name -> Resolve-SIProAutoSwitch result.
|    #>
|    param($Settings, [hashtable]$Env = @{})
|    $out = [ordered]@{}
|    foreach ($n in (Get-SIProAutoSwitchNames)) {
|        $envName = $script:SIProAuto.Switches[$n].Env
|        $ev = if ($Env.ContainsKey($envName)) { [string]$Env[$envName] } else { [Environment]::GetEnvironmentVariable($envName) }
|        if ($Settings -and -not $Settings.Ok) {
|            $out[$n] = [pscustomobject]@{ Name = $n; On = $false; Source = 'unreadable'
|                                          Text = ('{0}: skipped this run -- the Pro settings database could not be read, so a switch set to off there cannot be seen ({1})' -f $script:SIProAuto.Switches[$n].Label, $Settings.Error) }
|            continue
|        }
|        $sv = if ($Settings -and $Settings.Values.ContainsKey($n)) { $Settings.Values[$n] } else { $null }
|        $out[$n] = Resolve-SIProAutoSwitch -Name $n -SettingValue $sv -EnvValue $ev
|    }
|    $out
|}
|
|# =====================================================================================================================
|#  The licence notice -- what the updater audits and mails after a licence request
|# =====================================================================================================================
|function Get-SILicenceRequestNotice {
|    <#
|        PURE. -Result: the licence request client's result (Action, Message, State). -Contacted: whether this run called
|        Invardia. -Previous: the last mailed notice (@{ key; mailedUtc }) or $null.
|        Returns @{ Kind = quiet | sent | success | failure; Audit (@{ Action; Outcome; Text } or $null); Mail ($true/$false);
|                   Key; Subject; Lines }.
|          none / pending / waiting (nothing new)                    -> quiet: no audit, no mail
|          knocked (a request was sent)                              -> audit licence.request.send, no mail
|          installed                                                 -> audit licence.request.install + mail (success)
|          refused / rejected / invalid / network / error            -> audit licence.request.fail (when Invardia was called
|                                                                       or the request could not even be made) + mail, the
|                                                                       same failure at most once every 7 days
|    #>
|    param([AllowNull()]$Result, [bool]$Contacted = $false, [AllowNull()]$Previous, [datetime]$NowUtc = [datetime]::UtcNow)
|    $q = [pscustomobject]@{ Kind = 'quiet'; Audit = $null; Mail = $false; Key = ''; Subject = ''; Lines = @() }
|    if (-not $Result) { return $q }
|    $a = [string]$Result.Action
|    $msg = [string]$Result.Message
|    $validTo = ''; try { if ($Result.State -and $Result.State.PSObject.Properties['ValidTo']) { $validTo = [string]$Result.State.ValidTo } } catch { }
|    switch ($a) {
|        'knocked' {
|            return [pscustomobject]@{ Kind = 'sent'; Audit = @{ Action = 'licence.request.send'; Outcome = 'ok'; Text = $msg }; Mail = $false; Key = ''; Subject = ''; Lines = @() }
|        }
|        'installed' {
|            $lines = @('SecurityInsight Pro asked Invardia for its licence by itself, and the new licence is installed.',
|                       $(if ($validTo) { ' - It is valid until {0}.' -f $validTo } else { ' - ' + $msg }),
|                       ' - Nothing needs to be done. To stop these automatic requests, set "Automatic licence request" (SI_LicenseRequest_Auto) to off on the Settings page.')
|            return [pscustomobject]@{ Kind = 'success'; Audit = @{ Action = 'licence.request.install'; Outcome = 'ok'; Text = $msg }; Mail = $true
|                                      Key = 'installed|' + $validTo; Subject = 'New Pro licence installed'; Lines = $lines }
|        }
|        { $_ -in @('refused', 'rejected', 'invalid', 'network', 'error') } {
|            # a rejection still waiting out its 7 days, or a request not repeated yet, is not news: no call was made
|            $news = $Contacted -or $a -in @('refused', 'error')
|            if (-not $news) { return $q }
|            $key = 'failure|' + $a
|            $mail = $true
|            if ($Previous -and [string]$Previous.key -eq $key -and $Previous.mailedUtc) {
|                try { if ($NowUtc -lt ([datetime]$Previous.mailedUtc).ToUniversalTime().AddDays($script:SIProAuto.RemailDays)) { $mail = $false } } catch { }
|            }
|            $what = switch ($a) {
|                'rejected' { 'Invardia rejected the licence request.' }
|                'invalid'  { 'Invardia refused the licence request as incomplete.' }
|                'network'  { 'Invardia could not be reached for the licence request.' }
|                'refused'  { 'The licence request could not be made, or the licence Invardia sent did not pass the checks and was not installed.' }
|                default    { 'The licence request did not complete.' }
|            }
|            $lines = @(('SecurityInsight Pro asked Invardia for its licence by itself, and it did not succeed. {0}' -f $what),
|                       (' - Details: {0}' -f $msg),
|                       ' - The current licence (if any) stays in place; the request is tried again on the next nightly run.',
|                       ' - To ask by hand, run Request-SILicense in the setup folder. To stop the automatic requests, set "Automatic licence request" (SI_LicenseRequest_Auto) to off on the Settings page.',
|                       ' - Licences: https://portal.invardia.com/ > Licences. Questions: info@invardia.com.')
|            return [pscustomobject]@{ Kind = 'failure'; Audit = @{ Action = 'licence.request.fail'; Outcome = $(if ($a -eq 'rejected') { 'refused' } else { 'error' }); Text = $msg }
|                                      Mail = $mail; Key = $key; Subject = 'Failed: the automatic Pro licence request did not succeed'; Lines = $lines }
|        }
|    }
|    $q
|}
|
|function ConvertTo-SIProAutoMailHtml {
|    <# PURE. Notice lines -> the HTML body in the one mail layout (MAIL-2 / #573, SI-MailLayout.ps1): the first line is the
|       summary, the " - " lines a list; everything encoded, real paragraphs. #>
|    param([AllowEmptyCollection()][string[]]$Lines, [string]$Title = 'SecurityInsight Pro')
|    if (-not (Get-Command -Name New-SIMailLayout -ErrorAction SilentlyContinue)) { . ([System.IO.Path]::Combine($PSScriptRoot, 'SI-MailLayout.ps1')) }
|    $first = [string]@($Lines)[0]
|    $rest = @(@($Lines) | Select-Object -Skip 1 | Where-Object { "$_".Trim() } | ForEach-Object { '- ' + ($_ -replace '^\s*-\s*', '').Trim() })
|    (New-SIMailLayout -Title $Title -Summary $first -Paragraphs @(($rest -join "`n"))).Html
|}
|
|# =====================================================================================================================
|#  The one-time notice (first run after the update, Pro) -- SI-FirstRun.ps1 shows it
|# =====================================================================================================================
|function Get-SIProAutoNoticeLines {
|    <# PURE. The one-time notice: what a Pro install now does with Invardia by itself, and how to switch each off. #>
|    param([bool]$LicenceOn = $true, [bool]$UpdatesOn = $true)
|    $l = New-Object System.Collections.Generic.List[string]
|    $l.Add('SecurityInsight Pro now works with Invardia by itself. Nothing needs to be done:')
|    if ($LicenceOn) { $l.Add(' - Automatic licence request: every night the updater job asks Invardia for this installation''s licence when there is none, it ends within 30 days or it is in its grace period. The result is recorded in the audit trail and mailed to you. To turn it off, set "Automatic licence request" (SI_LicenseRequest_Auto) to off on the Settings page, or SI_LICENSE_REQUEST_AUTO=false on the updater job.') }
|    if ($UpdatesOn) { $l.Add(' - Pro updates from Invardia: every night the updater job checks Invardia for a release approved for this installation''s ring, verifies its signature and applies it, restoring the previous version if anything fails. To turn it off, set "Pro updates from Invardia" (SI_InvardiaUpdate_Enabled) to off on the Settings page, or SI_INVARDIA_UPDATE_ENABLED=false on the updater job.') }
|    $l.Add(' - This notice is shown once.')
|    @($l.ToArray())
|}
'@ }
$__siSupportFiles['engine/_shared/SI-BuildInfo.ps1'] = @{ Sha256 = 'da60080d618e1477900a01f60c970cf8c68534dfd938a0e622cb0d1822fdc870'; Text = @'
|#Requires -Version 5.1
|<#
|    WHICH BUILD OF SecurityInsight IS THIS (operator 2026-10-05: "change the version in any release, so I can keep
|    track in the GUI what version I am at").
|
|    ONE build identity, computed ONCE when a build/package/image is made, stamped into BUILD.json next to VERSION, and
|    only READ at run time. Nothing here asks git at run time: an install, a container image or a customer package has
|    no .git folder, and the answer must not change between the build and the run.
|
|      version      the product version from VERSION                         3.0.0
|      display      what people see: the version, plus -rc.<n> for a       3.0.0-rc.12   (pre-release build)
|                   build that is not the tagged release                    3.0.0         (release build)
|      rc           n = commits on the branch since VERSION last changed    12 / $null for a release
|                   (git rev-list --first-parent --count <commit that last changed VERSION>..HEAD)
|      commit       the full commit; shortCommit its first 7 characters
|      builtUtc     when the build was made (UTC, ISO 8601)
|      channel/ring where it is going, when the builder knows it (else null)
|
|    A RELEASE build is HEAD carrying the tag SI-<VERSION> (or SecurityInsight-v<VERSION>, the public twin).
|    Anything else is a pre-release and says so.
|
|    Functions:
|      Get-SIBuildInfo     BUILD TIME. From git when the folder is a git work tree, else what BUILD.json says.
|      Read-SIBuildInfo    RUN TIME. BUILD.json; without it the VERSION file with "build unknown"; never git.
|      Write-SIBuildInfo   writes BUILD.json (UTF-8, no BOM).
|      Format-SIBuildLine  "3.0.0-rc.12 (build 0dc9062, 2026-10-05 14:10 UTC)" for banners and logs.
|    PowerShell 5.1 and 7, Windows and Linux.
|#>
|
|function ConvertTo-SIBuildDisplay {
|    <# PURE. 3.0.0 + rc 12 -> 3.0.0-rc.12; rc $null (a release) -> 3.0.0. #>
|    param([Parameter(Mandatory)][AllowEmptyString()][string]$Version, [AllowNull()]$Rc)
|    $v = "$Version".Trim()
|    if (-not $v) { return '' }
|    if ($null -eq $Rc -or "$Rc" -eq '') { return $v }
|    '{0}-rc.{1}' -f $v, ([int]$Rc)
|}
|
|function Get-SIReleasedDisplay {
|    <# PURE. The version a RELEASED package shows: its release label (BUILD.json 'release', stamped by Publish-SIRelease)
|       when that is a released number -- digits and dots, 3 or 4 parts (3.0.31, 3.0.0.123) -- else '' (not a release). #>
|    param([AllowNull()][AllowEmptyString()][string]$Release)
|    $r = "$Release".Trim()
|    if ($r -match '^\d{1,6}(\.\d{1,12}){2,3}$') { return $r }
|    ''
|}
|
|function Read-SIVersionFile {
|    param([Parameter(Mandatory)][string]$SolutionRoot)
|    $f = [System.IO.Path]::Combine($SolutionRoot, 'VERSION')
|    if (-not [System.IO.File]::Exists($f)) { return '' }
|    try { return ([System.IO.File]::ReadAllText($f)).Trim() } catch { return '' }
|}
|
|function New-SIBuildInfoObject {
|    param([string]$Version, $Rc, [string]$Commit, [string]$BuiltUtc, $Channel, $Ring, [string]$Source)
|    $c = "$Commit".Trim()
|    [pscustomobject][ordered]@{
|        version     = "$Version".Trim()
|        display     = (ConvertTo-SIBuildDisplay -Version $Version -Rc $Rc)
|        commit      = $c
|        shortCommit = $(if ($c.Length -ge 7) { $c.Substring(0, 7) } else { $c })
|        builtUtc    = "$BuiltUtc"
|        rc          = $(if ($null -eq $Rc -or "$Rc" -eq '') { $null } else { [int]$Rc })
|        channel     = $(if ("$Channel".Trim()) { "$Channel".Trim() } else { $null })
|        ring        = $(if ($null -ne $Ring -and "$Ring" -ne '') { [int]$Ring } else { $null })
|        source      = $Source
|    }
|}
|
|function Read-SIBuildInfo {
|    <#
|        RUN TIME. What this install / image / package says about its build. Order: <SolutionRoot>/BUILD.json, then the
|        VERSION file (display = the version, no commit: "build unknown"), then '(dev)'. Never throws, never calls git.
|        source = 'BUILD.json' | 'VERSION' | 'none'.
|    #>
|    param([Parameter(Mandatory)][string]$SolutionRoot)
|    $bj = [System.IO.Path]::Combine($SolutionRoot, 'BUILD.json')
|    if ([System.IO.File]::Exists($bj)) {
|        try {
|            $j = [System.IO.File]::ReadAllText($bj) | ConvertFrom-Json
|            if ("$($j.version)".Trim()) {
|                $o = New-SIBuildInfoObject -Version ([string]$j.version) -Rc $j.rc -Commit ([string]$j.commit) -BuiltUtc ([string]$j.builtUtc) `
|                        -Channel $j.channel -Ring $(if ($j.PSObject.Properties['ring']) { $j.ring } else { $null }) -Source 'BUILD.json'
|                # the stamped display wins: it is what the build said, and the reader must not re-derive it differently
|                if ("$($j.display)".Trim()) { $o.display = "$($j.display)".Trim() }
|                # the release stamped by Publish-SIRelease travels on (an image build writes BUILD.json again from this)
|                if ($j.PSObject.Properties['release'] -and "$($j.release)".Trim()) { $o | Add-Member -NotePropertyName 'release' -NotePropertyValue "$($j.release)".Trim() -Force }
|                # framework installer rule 11b (2026-11-04: a released install showed "3.0.29-rc.9"): a package stamped as a
|                # RELEASE shows its released version -- never a release-candidate label (Get-SIReleasedDisplay)
|                $rel = Get-SIReleasedDisplay -Release $(if ($j.PSObject.Properties['release']) { [string]$j.release } else { '' })
|                if ($rel) { $o.display = $rel; $o.rc = $null }
|                return $o
|            }
|        } catch { }
|    }
|    $v = Read-SIVersionFile -SolutionRoot $SolutionRoot
|    if ($v) { return (New-SIBuildInfoObject -Version $v -Rc $null -Commit '' -BuiltUtc '' -Source 'VERSION') }
|    New-SIBuildInfoObject -Version '(dev)' -Rc $null -Commit '' -BuiltUtc '' -Source 'none'
|}
|
|function Invoke-SIBuildGit {
|    param([Parameter(Mandatory)][string]$Root, [Parameter(Mandatory)][string[]]$GitArgs)
|    $global:LASTEXITCODE = 0
|    $out = & git -C $Root @GitArgs 2>$null
|    if ($LASTEXITCODE -ne 0) { return $null }
|    (@($out) -join "`n").Trim()
|}
|
|function Get-SIBuildInfo {
|    <#
|        BUILD TIME. Compute the build identity of <SolutionRoot> (the folder holding VERSION).
|        In a git work tree: commit = HEAD; release when HEAD carries SI-<VERSION> / SecurityInsight-v<VERSION>, else
|        rc = commits since the commit that last changed VERSION. -Ref builds the identity of another ref (a package of a tag). Without git (an install, an extracted package): what
|        BUILD.json says (Read-SIBuildInfo). -NoGit forces the second path (tests). -Now pins the build time (tests).
|    #>
|    param([Parameter(Mandatory)][string]$SolutionRoot, [string]$Channel, $Ring, $Now, [switch]$NoGit, [string]$Ref = 'HEAD')
|    $root = (Resolve-Path -LiteralPath $SolutionRoot).Path
|    $ts = if ($Now) { ([datetime]$Now).ToUniversalTime() } else { [datetime]::UtcNow }
|    $built = $ts.ToString('yyyy-MM-ddTHH:mm:ssZ', [System.Globalization.CultureInfo]::InvariantCulture)
|    $gitOk = $false
|    if (-not $NoGit -and (Get-Command -Name git -ErrorAction SilentlyContinue)) {
|        $gitOk = ((Invoke-SIBuildGit -Root $root -GitArgs @('rev-parse', '--is-inside-work-tree')) -eq 'true')
|    }
|    if (-not $gitOk) {
|        $r = Read-SIBuildInfo -SolutionRoot $root
|        if ($Channel) { $r.channel = $Channel }
|        if ($null -ne $Ring -and "$Ring" -ne '') { $r.ring = [int]$Ring }
|        return $r
|    }
|    $version = if ($Ref -eq 'HEAD') { Read-SIVersionFile -SolutionRoot $root } else { "$(Invoke-SIBuildGit -Root $root -GitArgs @('show', ('{0}:./VERSION' -f $Ref)))".Trim() }
|    if (-not $version) { $version = '(dev)' }
|    $head = Invoke-SIBuildGit -Root $root -GitArgs @('rev-parse', ('{0}^{{commit}}' -f $Ref))
|    $tags = @("$(Invoke-SIBuildGit -Root $root -GitArgs @('tag', '--points-at', $Ref))" -split "`n" | ForEach-Object { $_.Trim() } | Where-Object { $_ })
|    $isRelease = ($tags -contains ('SI-{0}' -f $version)) -or ($tags -contains ('SecurityInsight-v{0}' -f $version))
|    $rc = $null
|    if (-not $isRelease) {
|        $verCommit = Invoke-SIBuildGit -Root $root -GitArgs @('log', '-1', '--format=%H', $Ref, '--', 'VERSION')
|        $count = if ($verCommit) { Invoke-SIBuildGit -Root $root -GitArgs @('rev-list', '--first-parent', '--count', ('{0}..{1}' -f $verCommit, $Ref)) }
|                 else { Invoke-SIBuildGit -Root $root -GitArgs @('rev-list', '--first-parent', '--count', $Ref) }
|        $n = 0
|        if (-not [int]::TryParse("$count", [ref]$n)) { $n = 0 }
|        $rc = $n
|    }
|    New-SIBuildInfoObject -Version $version -Rc $rc -Commit $head -BuiltUtc $built -Channel $Channel -Ring $Ring -Source 'git'
|}
|
|function Initialize-SIBuildInfoFile {
|    <#
|        2026-10-28 (the Community edition): a SecurityInsight folder WITHOUT BUILD.json -- the public copy, a Community release
|        zip from GitHub -- gets one, so the web app image builds (pro-management/Dockerfile copies BUILD.json, AppInfo reads it).
|        Present = left exactly as it is (a Pro release archive is stamped by Publish-SIRelease). Absent = written from what the
|        folder knows without git (Read-SIBuildInfo: its VERSION; no commit -- "build unknown"), -Channel / -Ring when given.
|        The app images' source hash leaves BUILD.json out (SI-FastRoll.ps1), so stamping never changes an image tag.
|        Returns 'present' | 'written'. Throws when the folder has no VERSION (not a release).
|    #>
|    param([Parameter(Mandatory)][string]$SolutionRoot, [string]$Channel, $Ring)
|    $bj = [System.IO.Path]::Combine($SolutionRoot, 'BUILD.json')
|    if ([System.IO.File]::Exists($bj)) { return 'present' }
|    if (-not [System.IO.File]::Exists([System.IO.Path]::Combine($SolutionRoot, 'VERSION'))) { throw ("{0} holds no VERSION -- not a SecurityInsight release" -f $SolutionRoot) }
|    $info = Read-SIBuildInfo -SolutionRoot $SolutionRoot
|    if ($Channel) { $info.channel = $Channel }
|    if ($null -ne $Ring -and "$Ring" -ne '') { $info.ring = [int]$Ring }
|    $null = Write-SIBuildInfo -Info $info -Path $bj
|    'written'
|}
|
|function Write-SIBuildInfo {
|    <# Writes BUILD.json {version, display, commit, shortCommit, builtUtc, rc, channel, ring} (UTF-8, no BOM). #>
|    param([Parameter(Mandatory)]$Info, [Parameter(Mandatory)][string]$Path)
|    $o = [ordered]@{
|        version = [string]$Info.version; display = [string]$Info.display; commit = [string]$Info.commit
|        shortCommit = [string]$Info.shortCommit; builtUtc = [string]$Info.builtUtc; rc = $Info.rc
|        channel = $Info.channel; ring = $Info.ring
|    }
|    # the release this package IS at Invardia (3.0.0.<build number>) -- stamped by Publish-SIRelease; the run compares the
|    # error catalogue's fixedIn with it (#709). Only when known: older readers ignore an extra field.
|    if ($Info.PSObject.Properties['release'] -and "$($Info.release)".Trim()) { $o.release = "$($Info.release)".Trim() }
|    $dir = Split-Path -Parent $Path
|    if ($dir -and -not (Test-Path -LiteralPath $dir)) { New-Item -ItemType Directory -Force -Path $dir | Out-Null }
|    [System.IO.File]::WriteAllText($Path, (ConvertTo-Json -InputObject $o -Depth 3), (New-Object System.Text.UTF8Encoding($false)))
|    $Path
|}
|
|function Format-SIBuildLine {
|    <# PURE. "3.0.0-rc.12 (build 0dc9062, 2026-10-05 14:10 UTC, ring 1)"; no commit known -> "3.0.0 (build unknown)". #>
|    param([Parameter(Mandatory)]$Info)
|    $parts = New-Object System.Collections.Generic.List[string]
|    if ("$($Info.shortCommit)".Trim()) { $parts.Add(('build {0}' -f $Info.shortCommit)) } else { $parts.Add('build unknown') }
|    if ("$($Info.builtUtc)".Trim()) {
|        $d = [datetime]::MinValue
|        if ([datetime]::TryParse([string]$Info.builtUtc, [System.Globalization.CultureInfo]::InvariantCulture,
|                [System.Globalization.DateTimeStyles]::AdjustToUniversal -bor [System.Globalization.DateTimeStyles]::AssumeUniversal, [ref]$d)) {
|            $parts.Add(($d.ToString('yyyy-MM-dd HH:mm', [System.Globalization.CultureInfo]::InvariantCulture) + ' UTC'))
|        }
|    }
|    if ($null -ne $Info.ring -and "$($Info.ring)" -ne '') { $parts.Add(('ring {0}' -f $Info.ring)) }
|    if ("$($Info.channel)".Trim()) { $parts.Add(('channel {0}' -f $Info.channel)) }
|    '{0} ({1})' -f $Info.display, ($parts -join ', ')
|}
|
|function New-SIBuildArchiveArgs {
|    <#
|        For a package built with `git archive` of SOLUTIONS/SecurityInsight at -Ref: the git archive options that ADD the
|        build's BUILD.json at <Prefix>SOLUTIONS/SecurityInsight/BUILD.json (an untracked file -- git archive --add-file)
|        and then set the archive's own -Prefix. Use them in place of --prefix=<Prefix>:
|            $b = New-SIBuildArchiveArgs -RepoRoot $repo -Ref $Ref -Prefix 'securityinsight-src-3.0.0/' -WorkDir $OutDir
|            git -C $repo archive --format=zip @($b.Args) -o $zip $Ref -- SOLUTIONS/SecurityInsight
|        Returns @{ Args; Info; File }. Git applies the LAST --prefix before --add-file to that file, and the last one
|        overall to the tree -- which is why the order is fixed here, in one place.
|    #>
|    param([Parameter(Mandatory)][string]$RepoRoot, [string]$Ref = 'HEAD', [Parameter(Mandatory)][string]$Prefix,
|          [Parameter(Mandatory)][string]$WorkDir, [string]$Channel, $Ring,
|          # the release version at Invardia (3.0.0.<build number>), stamped as BUILD.json 'release'
|          [string]$ReleaseVersion)
|    $sol = [System.IO.Path]::Combine($RepoRoot, 'SOLUTIONS', 'SecurityInsight')
|    $info = Get-SIBuildInfo -SolutionRoot $sol -Ref $Ref -Channel $Channel -Ring $Ring
|    if ("$ReleaseVersion".Trim()) {
|        $info | Add-Member -NotePropertyName 'release' -NotePropertyValue "$ReleaseVersion".Trim() -Force
|        # a RELEASE package is the release, whether or not its tag exists yet when it is packed (the tag follows the
|        # pack): it shows the released version -- never "-rc.<n>" (2026-11-04: a released install showed 3.0.29-rc.9).
|        # The archive's VERSION file carries the same number (Publish-SIRelease, Set-SIReleaseArchiveVersion).
|        $rel = Get-SIReleasedDisplay -Release $ReleaseVersion
|        if ($rel) { $info.version = $rel; $info.display = $rel; $info.rc = $null }
|    }
|    $dir =[System.IO.Path]::Combine($WorkDir, ('build-' + [guid]::NewGuid().ToString('N').Substring(0, 8)))
|    $file = Write-SIBuildInfo -Info $info -Path ([System.IO.Path]::Combine($dir, 'BUILD.json'))
|    $p = if ($Prefix.EndsWith('/')) { $Prefix } else { $Prefix + '/' }
|    [pscustomobject]@{
|        Args = @(('--prefix={0}SOLUTIONS/SecurityInsight/' -f $p), ('--add-file={0}' -f $file), ('--prefix={0}' -f $p))
|        Info = $info
|        File = $file
|    }
|}
'@ }
$__siSupportFiles['engine/_shared/SI-V3Snapshot.ps1'] = @{ Sha256 = '456a749f49e34bc1974e187da768131ab95c35a8d09aa59b60455d27159e4988'; Text = @'
|#Requires -Version 5.1
|<#
|    SI v3 -- READING THE CURRENT v3 SNAPSHOT. One place, because the trap is one trap.
|
|    🪤 FINDING #83, AND IT HAS NOW BITTEN THREE TIMES IN THREE DIFFERENT FILES.
|    `arg_max` THEN filter is NOT the same query as filter THEN `arg_max`. Both editions write the
|    profile tables; v2.2 emits no `SI_` columns at all. So `summarize max(CollectionTime)` over the
|    raw table frequently selects a v2.2 snapshot, every v3 column reads empty, and the run reports a
|    smaller estate with no error anywhere. **Measured on the same data: 40 assets vs 238.**
|    It bit the CMDB driver, then the asset-properties engine. A connector built the naive way syncs 40
|    of 238 assets and looks perfectly healthy.
|
|    🔑 WHY THIS FILE EXISTS RATHER THAN A FOURTH COPY OF THE QUERY. The correlation engine, the
|    asset-properties add-on and the CMDB connector all ask the SAME question -- "give me the current
|    v3 snapshot, with the identity columns" -- and each answering it privately is exactly how
|    SI-AssetIdentity.ps1's own header describes the identity mess it was created to end: three files
|    independently answering one question and disagreeing. The clause ORDER is the fact being shared;
|    what each caller projects is its own business.
|
|    🔒 IT ADDS NOTHING TO THE PRODUCTION PATH. This is a new file in engine/_shared/; the profilers and
|    Risk Analysis dot-source SI-AssetIdentity.ps1 and are untouched by it. Nothing here runs unless an
|    engine asks for a snapshot.
|
|    NO Set-StrictMode here -- it leaks into the caller's scope (measured 2026-08-12).
|#>
|
|# Azure access: plain REST, no PowerShell modules (engine/_shared/SI-AzRest.ps1).
|if (-not (Get-Command -Name Invoke-SIArm -ErrorAction SilentlyContinue)) { . (Join-Path $PSScriptRoot './SI-AzRest.ps1') }
|
|function Get-SIV3SnapshotKql {
|    <#
|        The current v3 snapshot of one profile table, projecting the columns the caller names.
|
|          -TableName  SI_Endpoint_Profile_CL | SI_Identity_Profile_CL | SI_Azure_Profile_CL
|          -Column     extra columns to project, each read through column_ifexists
|          -RowLimit   diagnostics only
|
|        `SI_AssetId` and `SI_AssetName` are always projected -- they are the identity contract, and a
|        caller that did not ask for them still needs them to be able to join anything.
|
|        🔴 THE `where` IS INSIDE THE `let`, SO IT PROVABLY PRECEDES THE `summarize`. Writing it as two
|        statements would work equally well and would be one edit away from being reordered by someone
|        who did not know why. The shape encodes the rule.
|
|        🪤 EVERY COLUMN GOES THROUGH `column_ifexists`. The four profile schemas do NOT carry the same
|        columns -- identity has no AzureResourceId, public-ip has almost none of them -- and a plain
|        `project` against a missing column fails the WHOLE query rather than degrading to "this engine
|        does not know that". A dead run and an empty column are very different failures.
|
|        📌 The v3 test is `isnotempty(SI_AssetId)` -- the thing v2.2 does not emit, so its presence IS
|        a version test.
|        ⚠️ **The ORIGINAL reason given here was "because the four PROFILE tables carry no version
|        stamp", and that is no longer true.** V3-6 added the stamp, and from 2026-08-31 it carries an
|        edition marker (`2.2.460+v3`), so a `SolutionVersion endswith "+v3"` filter is now available
|        here too. `SI_AssetId` is KEPT deliberately: it is the identity contract, it is proven across
|        every v3 engine, and it works on rows written before the marker existed -- which a version
|        filter does not. Two correct tests are fine; a stale justification for one of them is not.
|    #>
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$TableName,
|        [Parameter()][string[]]$Column = @(),
|        [Parameter()][int]$RowLimit = 0,
|        # Lower-case the projected extra columns. Identifier joins are case-insensitive in practice
|        # (an MDE id is hex, an ARM path is case-preserving but case-insensitive), and normalising in
|        # the query beats every caller remembering to.
|        [Parameter()][switch]$LowerCaseColumns
|    )
|
|    $proj = New-Object System.Collections.ArrayList
|    [void]$proj.Add('    SI_AssetId   = tostring(column_ifexists("SI_AssetId", ""))')
|    [void]$proj.Add('    SI_AssetName = tostring(column_ifexists("SI_AssetName", ""))')
|    foreach ($c in @($Column)) {
|        if ([string]::IsNullOrWhiteSpace($c)) { continue }
|        if ($c -eq 'SI_AssetId' -or $c -eq 'SI_AssetName') { continue }
|        if ($LowerCaseColumns) {
|            [void]$proj.Add(('    {0} = tolower(tostring(column_ifexists("{0}", "")))' -f $c))
|        } else {
|            [void]$proj.Add(('    {0} = tostring(column_ifexists("{0}", ""))' -f $c))
|        }
|    }
|
|    $kql = @(
|        ('let v3 = {0} | where isnotempty(tostring(column_ifexists("SI_AssetId", "")));' -f $TableName)
|        'let snap = toscalar(v3 | summarize max(CollectionTime));'
|        'v3'
|        '| where CollectionTime == snap'
|        '| project'
|        ($proj.ToArray() -join ",`n")
|    )
|    if ($RowLimit -gt 0) { $kql += ('| take {0}' -f $RowLimit) }
|    ($kql -join "`n")
|}
|
|function Get-SIV3ObjectMapKql {
|    <#
|        `SI_CorrelationId` and `SI_IdSource` per `SI_AssetId`, from the correlation map.
|
|        📌 This join is the whole of finding #89's first half: `SI_CorrelationId` is on NO profile
|        table. It lives only in `SI_ObjectMap_CL`, keyed on `SI_AssetId`. A connector that expects to
|        find it on the row skips 100% of assets while reporting a clean run -- measured, 144 of 144
|        Skipped, which reads exactly like a healthy conservative connector.
|
|        🔴 `SI_IdSource` IS NOT OPTIONAL. It states whether the id is `ledger` (minted once and stored,
|        durable for the life of the asset) or `derived-provisional` (today's seed, which MOVES when
|        group membership changes). `SI-ObjectLedgerStore.ps1` puts the consequence plainly: *"a
|        connector is already forbidden from creating CIs from those."* Dropping this column is how that
|        rule stops being enforceable.
|
|        Both values are taken in ONE `summarize`. The map emits one row per
|        (correlation id, member, identifier type), so every row for a given `SI_AssetId` carries the
|        same pair -- taking them in two `take_any` calls would permit a combination that never
|        co-occurred on any row.
|    #>
|    [CmdletBinding()]
|    param([Parameter()][int]$RowLimit = 0)
|    $kql = @(
|        'let snap = toscalar(SI_ObjectMap_CL | summarize max(CollectionTime));'
|        'SI_ObjectMap_CL'
|        '| where CollectionTime == snap'
|        '| project SI_AssetId = tostring(column_ifexists("SI_AssetId", "")),'
|        '          SI_CorrelationId = tostring(column_ifexists("SI_CorrelationId", "")),'
|        '          SI_IdSource = tostring(column_ifexists("SI_IdSource", ""))'
|        '| where isnotempty(SI_AssetId) and isnotempty(SI_CorrelationId)'
|        '| summarize SI_CorrelationId = take_any(SI_CorrelationId), SI_IdSource = take_any(SI_IdSource) by SI_AssetId'
|    )
|    if ($RowLimit -gt 0) { $kql += ('| take {0}' -f $RowLimit) }
|    ($kql -join "`n")
|}
|
|# =====================================================================================================================
|#  UPLINK-FIX (customer G 2026-10-07): AN EMPTY CORRELATION MAP ON A FIRST RUN IS "NOT YET", NOT A REFUSAL
|# =====================================================================================================================
|# A new install's first flow: asset correlation writes SI_ObjectMap_CL for the FIRST time, and a brand-new Log Analytics
|# table answers its first rows minutes later. The CMDB connector (16:34Z, 35 s after correlation ended) and the
|# vulnerability close-loop (16:35Z) read it empty and REFUSED with a critical guard: two fix requests and a support
|# ticket for a state that is expected and fixes itself. The rule now:
|#   * the map is empty, it has NEVER had a row, and asset correlation ended within the last hour -> wait for it (poll);
|#   * still empty, never had a row                              -> 'pending': nothing written, a WARNING, no refusal;
|#   * empty, but it HAD rows (or that cannot be told)           -> 'missing': the refusal stays (the guard's real case).
|function Get-SIV3ObjectMapEverKql {
|    <# Has the correlation map EVER had a row (the whole retention)? One row, column n. #>
|    'SI_ObjectMap_CL | take 1 | count | project n = Count'
|}
|
|function Get-SIV3CorrelationRecentKql {
|    <# Did asset correlation (the engine or the flow's step) end well in the last -Minutes? One row, column n. #>
|    param([int]$Minutes = 60)
|    @(
|        ('SI_RunHealth_CL | where TimeGenerated > ago({0}m)' -f $Minutes)
|        "| where Phase == 'End' and ExitReason in ('success', 'success-partial')"
|        # the correlation engine under its job name, its short name, or the flow's step of it
|        "| where Engine endswith 'correlation'"
|        '| count | project n = Count'
|    ) -join "`n"
|}
|
|function Get-SIV3MapLedgerShortfall {
|    <#
|        PURE. #1082 THE FIRST-SYNC LEDGER RULE: per kind in -Kinds, how many of the kind's assets (-Profiles: Kind, SI_AssetId)
|        the correlation map (-Rows: SI_AssetId, SI_CorrelationId, SI_IdSource) carries a LEDGER id for (Resolve-SICiKey's
|        rule: an id only counts when SI_IdSource is 'ledger'). Returns the kinds BELOW -MinShare (default: half) --
|        @{ Kind; Ledger; Total } -- empty when every kind is ready. A kind with no asset is never short.
|    #>
|    param([AllowEmptyCollection()][object[]]$Rows = @(), [AllowEmptyCollection()][object[]]$Profiles = @(), [string[]]$Kinds = @(), [double]$MinShare = 0.5)
|    $ledger = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|    foreach ($r in @($Rows)) {
|        if ($null -eq $r) { continue }
|        $aid = ([string]$r.SI_AssetId).Trim(); $cid = ([string]$r.SI_CorrelationId).Trim(); $src = ([string]$r.SI_IdSource).Trim()
|        if ($aid -and $cid -and $src -ieq 'ledger') { [void]$ledger.Add($aid) }
|    }
|    $out = New-Object System.Collections.Generic.List[object]
|    foreach ($k in @($Kinds | Where-Object { $_ } | ForEach-Object { ([string]$_).ToLowerInvariant() } | Select-Object -Unique)) {
|        $ids = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
|        foreach ($p in @($Profiles)) { if ($p -and ([string]$p.Kind).ToLowerInvariant() -eq $k -and ([string]$p.SI_AssetId).Trim()) { [void]$ids.Add(([string]$p.SI_AssetId).Trim()) } }
|        if ($ids.Count -eq 0) { continue }
|        $have = 0; foreach ($i in $ids) { if ($ledger.Contains($i)) { $have++ } }
|        if ($have -lt $MinShare * $ids.Count) { $out.Add([pscustomobject]@{ Kind = $k; Ledger = $have; Total = $ids.Count }) }
|    }
|    , $out.ToArray()
|}
|
|function Resolve-SIV3CorrelationMap {
|    <#
|        The correlation map for a connector, with the first-run rule above. Returns @{ State = ready | pending | missing;
|        Rows; Reason; WaitedSeconds }.
|          -Read   { } -> the map rows (the caller's own read; a table that does not exist yet reads as empty)
|          -Count  { param($Kql, $Table) } -> rows with a column n (a table that does not exist yet reads as empty)
|          -WaitSeconds / -PollSeconds   how long to wait for a map that correlation has just written (default 15 / 1 min)
|          -Sleep  { param($Seconds) } (tests)   -Log { param($Level, $Message) }
|        A count that cannot be read is NOT taken as "never had a row": the safe direction is 'missing' (the refusal).
|        #1082 THE FIRST SYNC WAITS FOR THE LEDGER (found live, read-only, at an install: its first CMDB sync read a map that
|        did not yet carry ledger ids for most Azure assets, keyed 1,388 CIs by their asset id, and run 2 created them all
|        again under the ledger key). -FirstRunKinds: the kinds the caller has never written a CI of; -Profiles (Kind,
|        SI_AssetId): the assets it is about to key. A map that EXISTS but carries a ledger id for fewer than -MinLedgerShare
|        (half) of a first-run kind's assets is NOT ready: waited for like an empty map when correlation has just run, else
|        'pending' (nothing written, a warning; the next run uses the ledger ids). Rule followed: V3-DATA-MODEL 2.3 (4) "No
|        mixed CI key ... An unreachable ledger stops the run at P2 instead of publishing moving keys." Without -FirstRunKinds
|        the rule above is unchanged (the vulnerability close-loop calls it so).
|    #>
|    param([Parameter(Mandatory)][scriptblock]$Read, [Parameter(Mandatory)][scriptblock]$Count,
|          [int]$WaitSeconds = 900, [int]$PollSeconds = 60, [scriptblock]$Sleep, [scriptblock]$Log,
|          [AllowEmptyCollection()][object[]]$Profiles = @(), [AllowEmptyCollection()][string[]]$FirstRunKinds = @(), [double]$MinLedgerShare = 0.5)
|    if (-not $Sleep) { $Sleep = { param($s) Start-Sleep -Seconds $s } }
|    if (-not $Log) { $Log = { param($l, $m) } }
|    $n = { param($kql, $table) try { $r = @(& $Count $kql $table | ForEach-Object { $_ } | Where-Object { $_ })[0]; if ($r) { [long]$r.n } else { 0L } } catch { -1L } }
|    $short = { param($r) if (-not @($FirstRunKinds | Where-Object { $_ }).Count) { return , @() }; Get-SIV3MapLedgerShortfall -Rows @($r) -Profiles @($Profiles) -Kinds @($FirstRunKinds) -MinShare $MinLedgerShare }
|    $shortText = {
|        param($s, [int]$waited)
|        $what = (@($s | ForEach-Object { '{0} ({1} of {2} assets)' -f $_.Kind, $_.Ledger, $_.Total })) -join ', '
|        ('the correlation map (SI_ObjectMap_CL) does not carry a ledger id yet for most assets of {0} -- a first sync would key them by their asset id and create them again under the ledger key on the next run{1}; nothing was written, the next run uses the ledger ids' -f $what, $(if ($waited -gt 0) { (' (waited {0} min)' -f [Math]::Ceiling($waited / 60)) } else { '' }))
|    }
|    $rows = @(& $Read | ForEach-Object { $_ } | Where-Object { $_ })
|    if ($rows.Count) {
|        $s = & $short $rows
|        if (-not @($s).Count) { return [pscustomobject]@{ State = 'ready'; Rows = $rows; Reason = ''; WaitedSeconds = 0 } }
|        # #1082: a map without the ledger ids yet -- waited for when correlation has just written it, never keyed by asset id
|        $waited = 0
|        $recent = & $n (Get-SIV3CorrelationRecentKql) 'SI_RunHealth_CL'
|        if ($recent -gt 0 -and $WaitSeconds -gt 0) {
|            & $Log 'INFO' ('the correlation map does not carry ledger ids yet for most assets of {0}, and asset correlation has just written -- waiting up to {1} min for them' -f ((@($s | ForEach-Object { $_.Kind })) -join ', '), [Math]::Ceiling($WaitSeconds / 60))
|            while ($waited -lt $WaitSeconds) {
|                $step = [Math]::Max(1, [Math]::Min($PollSeconds, $WaitSeconds - $waited))
|                & $Sleep $step; $waited += $step
|                $r2 = @(& $Read | ForEach-Object { $_ } | Where-Object { $_ })
|                if (-not $r2.Count) { continue }
|                $s = & $short $r2
|                if (-not @($s).Count) {
|                    & $Log 'OK' ('the correlation map carries the ledger ids after {0} s' -f $waited)
|                    return [pscustomobject]@{ State = 'ready'; Rows = $r2; Reason = ''; WaitedSeconds = $waited }
|                }
|            }
|        }
|        return [pscustomobject]@{ State = 'pending'; Rows = @(); WaitedSeconds = $waited; Reason = (& $shortText $s $waited) }
|    }
|    $ever = & $n (Get-SIV3ObjectMapEverKql) 'SI_ObjectMap_CL'
|    if ($ever -ne 0) {
|        return [pscustomobject]@{ State = 'missing'; Rows = @(); WaitedSeconds = 0
|            Reason = $(if ($ever -lt 0) { 'the correlation map (SI_ObjectMap_CL) is empty, and whether it ever had results could not be read' } else { 'the correlation map (SI_ObjectMap_CL) is empty, although it had results before' }) }
|    }
|    $waited = 0; $lastShort = @()
|    $recent = & $n (Get-SIV3CorrelationRecentKql) 'SI_RunHealth_CL'
|    if ($recent -gt 0 -and $WaitSeconds -gt 0) {
|        & $Log 'INFO' ('the correlation map (SI_ObjectMap_CL) has no rows yet, and asset correlation has just written its first results -- waiting up to {0} min for Log Analytics to answer them' -f [Math]::Ceiling($WaitSeconds / 60))
|        while ($waited -lt $WaitSeconds) {
|            $step = [Math]::Max(1, [Math]::Min($PollSeconds, $WaitSeconds - $waited))
|            & $Sleep $step; $waited += $step
|            $rows = @(& $Read | ForEach-Object { $_ } | Where-Object { $_ })
|            if ($rows.Count) {
|                # #1082: answered, but a first-run kind still lacks its ledger ids -- keep waiting for them
|                $lastShort = & $short $rows
|                if (@($lastShort).Count) { continue }
|                & $Log 'OK' ('the correlation map answered after {0} s ({1} asset(s))' -f $waited, $rows.Count)
|                return [pscustomobject]@{ State = 'ready'; Rows = $rows; Reason = ''; WaitedSeconds = $waited }
|            }
|        }
|    }
|    if ($rows.Count -and @($lastShort).Count) { return [pscustomobject]@{ State = 'pending'; Rows = @(); WaitedSeconds = $waited; Reason = (& $shortText $lastShort $waited) } }
|    [pscustomobject]@{ State = 'pending'; Rows = @(); WaitedSeconds = $waited
|        Reason = $(if ($recent -gt 0) { ('the correlation map (SI_ObjectMap_CL) has no results yet: asset correlation wrote its first ones, and Log Analytics did not answer them within {0} min (a new install) -- nothing was written; the next run uses them' -f [Math]::Ceiling($waited / 60)) }
|                   else { 'the correlation map (SI_ObjectMap_CL) has no results yet (asset correlation has not run on this install) -- nothing was written; the next run after asset correlation uses them' }) }
|}
|
|function Get-SIV3AssetPropertiesKql {
|    <#
|        The current snapshot of `SI_AssetProperties_CL` -- the optional wide payload (3.6b).
|
|        🔒 THE CMDB CONNECTOR MUST TOLERATE THIS TABLE NOT EXISTING. The add-on is opt-in, and
|        scenario 1 does not use it at all. A caller runs this inside its own try/catch and treats a
|        failure as "no wide payloads", never as a failed run -- otherwise enabling a scenario-1
|        connector would require an add-on that scenario 1 has no use for.
|
|        📌 One row per (asset, source system) by design, so a server that is both an MDE machine and an
|        ARM resource contributes two. The caller picks which source's vocabulary to project from,
|        rather than the collector deciding it here by overwriting.
|    #>
|    [CmdletBinding()]
|    param([Parameter()][int]$RowLimit = 0)
|    # #412 ONE PULL PER SOURCE: each profiler (endpoint / identity / azure) publishes its own sources with its OWN
|    # CollectionTime, so the current snapshot is the newest one PER (profiler, source) -- "the table's newest
|    # CollectionTime" would be the last profiler's sources only.
|    $kql = @(
|        'let src = SI_AssetProperties_CL | extend _key = strcat(tostring(column_ifexists("Engine", "")), "|", tostring(column_ifexists("SourceSystem", "")));'
|        'src'
|        '| join kind=inner (src | summarize _snap = max(CollectionTime) by _key) on _key'
|        '| where CollectionTime == _snap'
|        '| project SI_AssetId = tostring(column_ifexists("SI_AssetId", "")),'
|        '          SourceSystem = tostring(column_ifexists("SourceSystem", "")),'
|        '          Properties = tostring(column_ifexists("Properties", "")),'
|        '          PropertiesDropped = tobool(column_ifexists("PropertiesDropped", false))'
|        '| where isnotempty(SI_AssetId)'
|        # 🔴 A row whose payload was replaced by the oversize marker carries NO usable metadata, and
|        # projecting it would fill CI columns from a marker object. Excluded here so no consumer has
|        # to remember -- the asset then simply gets the narrow set, which is the correct outcome.
|        '| where PropertiesDropped != true'
|    )
|    if ($RowLimit -gt 0) { $kql += ('| take {0}' -f $RowLimit) }
|    ($kql -join "`n")
|}
|
|# ---------------------------------------------------------------------------------------------------
|# Workspace ARM id -> the customer (workspace) GUID the query API wants.
|#
|# 🔒 A THIRD NAME FOR THE SAME LOOKUP, AND THAT IS DELIBERATE. asset-correlation and asset-properties
|# each keep a private copy under their own name, because a library that redefines a function another
|# engine already loaded changes that engine's behaviour by being present -- one fact, two spellings is
|# a trap in code as much as in data, and the cure here is distinct names rather than a shared one that
|# silently shadows. New engines use THIS one; the existing two are left alone precisely because they
|# work and sit near production paths.
|# ---------------------------------------------------------------------------------------------------
|$script:_SIV3WsCache = @{}
|
|function Resolve-SIV3WorkspaceId {
|    param([string]$WorkspaceResourceId = [string]$global:SI_WorkspaceResourceId)
|
|    if ($script:_SIV3WsCache.ContainsKey($WorkspaceResourceId)) { return $script:_SIV3WsCache[$WorkspaceResourceId] }
|
|    if ($WorkspaceResourceId -notmatch '/subscriptions/([^/]+)/resourceGroups/([^/]+)/providers/[Mm]icrosoft\.[Oo]perational[Ii]nsights/workspaces/([^/]+)') {
|        throw "SI v3: invalid WorkspaceResourceId -- $WorkspaceResourceId"
|    }
|    $subId = $matches[1]; $rgName = $matches[2]; $wsName = $matches[3]
|
|    # Restore the caller's subscription afterwards. Az context on this machine is shared state, and
|    # leaving it moved is how a later step deploys to the wrong subscription -- which has already
|    # happened here in four tools at once.
|    $curSubId = $null
|    try { $curSubId = (Get-SIAzContext).Subscription.Id } catch { }
|    if ($curSubId -and $curSubId -ne $subId) { $null = Set-SIAzContext -Subscription $subId -ErrorAction Stop }
|    try {
|        $ws = Get-SIAzOperationalInsightsWorkspace -ResourceGroupName $rgName -Name $wsName -ErrorAction Stop
|        $custId = $ws.CustomerId.Guid
|    } finally {
|        if ($curSubId -and $curSubId -ne $subId) {
|            try { $null = Set-SIAzContext -Subscription $curSubId -ErrorAction SilentlyContinue } catch { }
|        }
|    }
|
|    $script:_SIV3WsCache[$WorkspaceResourceId] = $custId
|    $custId
|}
'@ }
$__siSupportFiles['engine/risk-analysis/_shared/RA-ExcludeLists.ps1'] = @{ Sha256 = '64b358ebc091fe57301c5a66ced3687b128e855e6d49f30fc380ecbb36267451'; Text = @'
|#######################################################################################################
|#  SecurityInsight - Risk Analysis engine
|#  Exclusion lists: per-report and global exclude JSON, and placeholder substitution.
|#
|#  How a report learns what NOT to report on - the per-report and global exclude files, and the
|#  substitution that turns EXCLUDED_* placeholders in a locked query into real literals.
|#
|#  AUDIT #16: moved VERBATIM out of Invoke-RiskAnalysis.ps1 on 2026-08-05. Dot-sourced back in at
|#  exactly the position it occupied, so load order is unchanged. Every function body is
|#  byte-identical to before the move - verified with tests/Get-EngineFunctionInventory.ps1,
|#  which compares a SHA-256 of each function's source text before and after.
|#
|#  Do NOT add $PSScriptRoot-dependent code here: in this file it resolves to _shared/, one level
|#  deeper than the engine root the main script derives $siRoot from.
|#######################################################################################################
|
|function Get-SIMisplacedExcludeFiles {
|    <#
|        Exclusion files in <SIRoot>\config\ -- the place the README once documented. NOTHING reads them (not 2.2, not
|        3.0): the engine reads them from its SettingsPath (risk-analysis-detection\). Per file: Path, Name, ShouldBe.
|        Used by the run (one warning per run) and by the Pro importer (listed in its report).
|    #>
|    param([Parameter(Mandatory)][string]$SIRoot)
|    $cfg = Join-Path $SIRoot 'config'
|    if (-not (Test-Path -LiteralPath $cfg -PathType Container)) { return @() }
|    @(Get-ChildItem -LiteralPath $cfg -File -ErrorAction SilentlyContinue |
|        Where-Object { $_.Name -match '(?i)^[^.]+\.exclude(\.custom)?\.json$' -or $_.Name -ieq 'RiskAnalysisGlobalExclusions.custom.json' } |
|        Sort-Object Name | ForEach-Object {
|            [pscustomobject]@{ Path = $_.FullName; Name = $_.Name; ShouldBe = (Join-Path (Join-Path $SIRoot 'risk-analysis-detection') $_.Name) }
|        })
|}
|
|function Write-SIMisplacedExcludeWarning {
|    # Once per run: an exclusion file in config\ is never read -- say where it belongs. The solution root is the parent of
|    # the Risk Analysis SettingsPath (risk-analysis-detection\) -- no $PSScriptRoot here (see the header).
|    if ($script:_MisplacedExcludeWarned) { return }
|    $script:_MisplacedExcludeWarned = $true
|    if ([string]::IsNullOrWhiteSpace([string]$global:SettingsPath)) { return }
|    try {
|        foreach ($m in @(Get-SIMisplacedExcludeFiles -SIRoot (Split-Path -Parent ([string]$global:SettingsPath)))) {
|            $msg = ("[exclude] {0} is NOT read -- exclusion files in config\ have never been read. Move it to {1} to use it." -f $m.Path, $m.ShouldBe)
|            if (Get-Command -Name Write-Warn2 -ErrorAction SilentlyContinue) { Write-Warn2 $msg } else { Write-Warning $msg }
|        }
|    } catch { }
|}
|
|function Get-ReportExcludeJson {
|    [CmdletBinding()]
|    param([Parameter(Mandatory)][string]$ReportName)
|
|    Write-SIMisplacedExcludeWarning
|    if ($null -eq $script:_ReportExcludeJsonCache) { $script:_ReportExcludeJsonCache = @{} }
|    if ($script:_ReportExcludeJsonCache.ContainsKey($ReportName)) {
|        return $script:_ReportExcludeJsonCache[$ReportName]
|    }
|    $result = $null
|    # SecurityInsight Pro (#211): the settings database is the closest layer. Layer 5b materialises its exclusion
|    # documents into a run-local folder (SI_ProRaSettingsPath); a document there wins, a report without one falls
|    # back to the files below exactly as before. Unset (every Community / VM run) = no change.
|    $proFirst = @()
|    if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_ProRaSettingsPath)) {
|        $proFirst = @(Join-Path ([string]$global:SI_ProRaSettingsPath) ('{0}.exclude.custom.json' -f $ReportName))
|    }
|    if (-not [string]::IsNullOrWhiteSpace($global:SettingsPath) -or $proFirst.Count) {
|        # Customer .custom.json wins over repo-shipped .json (matches the
|        # .locked.yaml / .custom.yaml convention used elsewhere in v2.2).
|        $candidates = @($proFirst)
|        if (-not [string]::IsNullOrWhiteSpace($global:SettingsPath)) {
|            $candidates += (Join-Path $global:SettingsPath ('{0}.exclude.custom.json' -f $ReportName))
|            $candidates += (Join-Path $global:SettingsPath ('{0}.exclude.json'        -f $ReportName))
|        }
|        foreach ($path in $candidates) {
|            if (-not (Test-Path -LiteralPath $path)) { continue }
|            try {
|                $result = [pscustomobject]@{
|                    Path = $path
|                    Body = Get-Content -LiteralPath $path -Raw -Encoding UTF8 | ConvertFrom-Json
|                }
|                break
|            } catch {
|                Write-Warn2 ("[exclude] failed to parse {0}: {1}" -f $path, $_.Exception.Message)
|            }
|        }
|    }
|    $script:_ReportExcludeJsonCache[$ReportName] = $result
|    return $result
|}
|
|function Get-GlobalExcludeJson {
|    [CmdletBinding()]
|    param()
|    if ($null -ne $script:_GlobalExcludeJsonCache) {
|        if ($script:_GlobalExcludeJsonCache -is [string] -and $script:_GlobalExcludeJsonCache -eq '__none__') { return $null }
|        return $script:_GlobalExcludeJsonCache
|    }
|    $script:_GlobalExcludeJsonCache = '__none__'
|    # Pro (#211): the database's global exclusions, materialised run-locally, win over the file.
|    $path = $null
|    if (-not [string]::IsNullOrWhiteSpace([string]$global:SI_ProRaSettingsPath)) {
|        $p = Join-Path ([string]$global:SI_ProRaSettingsPath) $script:_GlobalExcludeFileName
|        if (Test-Path -LiteralPath $p) { $path = $p }
|    }
|    if (-not $path) {
|        if ([string]::IsNullOrWhiteSpace($global:SettingsPath)) { return $null }
|        $path = Join-Path $global:SettingsPath $script:_GlobalExcludeFileName
|    }
|    if (-not (Test-Path -LiteralPath $path)) { return $null }
|    try {
|        $obj = [pscustomobject]@{
|            Path = $path
|            Body = Get-Content -LiteralPath $path -Raw -Encoding UTF8 | ConvertFrom-Json
|        }
|        $script:_GlobalExcludeJsonCache = $obj
|        Write-Info ("[exclude] global fallback loaded: {0}" -f $path)
|        return $obj
|    } catch {
|        Write-Warn2 ("[exclude] failed to parse global file {0}: {1}" -f $path, $_.Exception.Message)
|        return $null
|    }
|}
|
|function Get-ExcludedListForReport {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]  $ReportName,
|        [Parameter(Mandatory)][string[]]$PropertyNames,
|        [string]                        $Token = ''
|    )
|    $loaded = Get-ReportExcludeJson -ReportName $ReportName
|    $list   = @()
|    $found  = $false
|    if ($null -ne $loaded) {
|        $body = $loaded.Body
|        # Bare array file: maps to the first property name requested
|        if ($body -is [System.Array]) {
|            $list  = $body
|            $found = $true
|        } else {
|            foreach ($p in $PropertyNames) {
|                if ($body.PSObject.Properties[$p] -and $body.$p) {
|                    $list  = $body.$p
|                    $found = $true
|                    break
|                }
|            }
|        }
|    }
|    # Global fallback ONLY for whitelisted tokens (e.g. ExcludedAssetTags) when
|    # per-report file didn't carry the property.
|    if (-not $found -and -not [string]::IsNullOrWhiteSpace($Token) -and ($script:_GlobalExcludeTokens -contains $Token)) {
|        $g = Get-GlobalExcludeJson
|        if ($null -ne $g) {
|            foreach ($p in $PropertyNames) {
|                if ($g.Body.PSObject.Properties[$p] -and $g.Body.$p) {
|                    $list = $g.Body.$p
|                    break
|                }
|            }
|        }
|    }
|    $clean = @($list | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | ForEach-Object { [string]$_ })
|    return $clean
|}
|
|# Moved VERBATIM out of Invoke-RiskAnalysis.ps1 (2026-10-15): the data health check (engine\data-health) reads a report's CVE minimum age
|# through this one function, never a copy of it.
|function Get-ScalarValueForReport {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]   $ReportName,
|        [Parameter(Mandatory)][string[]] $PropertyNames,
|        [Parameter(Mandatory)]           $Default
|    )
|    $loaded = Get-ReportExcludeJson -ReportName $ReportName
|    if ($null -ne $loaded -and $loaded.Body -isnot [System.Array]) {
|        foreach ($p in $PropertyNames) {
|            if ($loaded.Body.PSObject.Properties[$p] -and $null -ne $loaded.Body.$p) {
|                return $loaded.Body.$p
|            }
|        }
|    }
|    return $Default
|}
|
|function Resolve-ExcludePlaceholders {
|    [CmdletBinding()]
|    param(
|        [Parameter(Mandatory)][string]$Query,
|        [Parameter(Mandatory)][string]$ReportName
|    )
|    # Block-marker form ONLY (portal-safe). Source query must wrap a default
|    # `let _foo = dynamic([]);` between begin/end line-comment markers, e.g.:
|    #
|    #     //__EXCLUDED_CVES_BEGIN__
|    #     let _excludedCves = dynamic([]);
|    #     //__EXCLUDED_CVES_END__
|    #
|    # Engine replaces the ENTIRE block with a real let binding sourced from
|    # <ReportName>.exclude.custom.json (or .exclude.json fallback). The let
|    # variable name is recovered from the inline default so it doesn't have
|    # to be hardcoded per token. Without engine substitution (raw portal
|    # paste) the inline default applies and the query parses fine.
|
|    foreach ($token in $script:_ExcludeTokenMap.Keys) {
|        $tokenName  = $token.Trim('_')   # 'EXCLUDED_CVES'
|        $beginMark  = ('//__{0}_BEGIN__' -f $tokenName)
|        $endMark    = ('//__{0}_END__'   -f $tokenName)
|
|        $blockRx   = [regex]::Escape($beginMark) + '(?<body>.*?)' + [regex]::Escape($endMark)
|        $bodyMatch = [regex]::Match($Query, $blockRx, [System.Text.RegularExpressions.RegexOptions]::Singleline)
|        if (-not $bodyMatch.Success) { continue }
|
|        $items = @(Get-ExcludedListForReport -ReportName $ReportName -PropertyNames $script:_ExcludeTokenMap[$token] -Token $token)
|        $kqlArray = if ($items.Count -gt 0) {
|            '[' + (($items | ForEach-Object { '"' + ($_ -replace '"','\"') + '"' }) -join ',') + ']'
|        } else {
|            '[]'
|        }
|        $varName = if ($bodyMatch.Groups['body'].Value -match 'let\s+(\w+)\s*=') { $matches[1] } else { '_excludedItems' }
|        $newBlock = ($beginMark + [Environment]::NewLine +
|                     ('let {0} = dynamic({1});' -f $varName, $kqlArray) + [Environment]::NewLine +
|                     $endMark)
|        $Query = $Query.Replace($bodyMatch.Value, $newBlock)
|        Write-Info ("[exclude] {0}: substituted block {1} ({2}) with {3} item(s)" -f $ReportName, $tokenName, $varName, $items.Count)
|    }
|    # #211: an exclusion set for THIS report (the web app's Exclusions page, or its file) that its query has no filter for
|    # changes nothing -- said once per report, never silent.
|    $unused = @(Get-RAUnusedExclusions -Query $Query -ReportName $ReportName)
|    if ($unused.Count) {
|        $msg = ("[exclude] {0}: these exclusions are set for this report but change nothing, because the report does not filter on them: {1}. Remove them from the report's exclusions (Reports > Exclusions in the web app, or {2}), or set them on a report that filters on them." -f
|            $ReportName, (($unused | ForEach-Object { '{0} ({1})' -f $_.Property, $_.Count }) -join ', '), (Split-Path -Leaf ([string](Get-ReportExcludeJson -ReportName $ReportName).Path)))
|        if (Get-Command -Name Write-Warn2 -ErrorAction SilentlyContinue) { Write-Warn2 $msg } else { Write-Warning $msg }
|    }
|    return $Query
|}
|
|function Get-RAUnusedExclusions {
|    <#
|        The lists (and the CVE minimum age) a report's OWN exclusion document sets that its query has no block for -- so
|        they exclude nothing. Per entry: Property, Count (items; the age for CveMinAgeDays). The global asset-tag list is
|        not checked here: it applies to every report that filters on tags, by design.
|    #>
|    param([Parameter(Mandatory)][string]$Query, [Parameter(Mandatory)][string]$ReportName)
|    $loaded = Get-ReportExcludeJson -ReportName $ReportName
|    if ($null -eq $loaded -or $null -eq $loaded.Body -or $loaded.Body -is [System.Array]) { return @() }
|    $body = $loaded.Body
|    $out = New-Object System.Collections.Generic.List[object]
|    # #541: the scope preamble applies every exclusion list to the reports whose scope part declares it
|    # (data-model/report-scope) -- no block in the query any more. Unused = set, but the report's part is off.
|    if (Get-Command -Name Get-RAReportScope -ErrorAction SilentlyContinue) {
|        $spec = Get-RAReportScope -ReportName $ReportName -Template (Get-RAReportScopeTemplate)
|        $parts = [ordered]@{ ExcludedCves = 'cves'; CveMinAgeDays = 'cves'; ExcludedConfigurationIds = 'configurationIds'; ExcludedAssetTags = 'assetTags'; ExcludedAssets = 'excludedAssets'; ExcludedIpRanges = 'ipRanges' }
|        foreach ($p in $parts.Keys) {
|            if (-not $body.PSObject.Properties[$p] -or [bool]$spec.Scope[$parts[$p]]) { continue }
|            $v = $body.$p
|            if ($p -eq 'CveMinAgeDays') { $n = 0.0; if ([double]::TryParse([string]$v, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$n) -and $n -gt 0) { $out.Add([pscustomobject]@{ Property = $p; Count = $n }) }; continue }
|            $c = @($v | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) }).Count
|            if ($c -gt 0) { $out.Add([pscustomobject]@{ Property = $p; Count = $c }) }
|        }
|        return $out.ToArray()
|    }
|    $maps = @()
|    if ($script:_ExcludeTokenMap) { foreach ($t in $script:_ExcludeTokenMap.Keys) { $maps += , @($t, @($script:_ExcludeTokenMap[$t]), $false) } }
|    if ($script:_ScalarTokenMap)  { foreach ($t in $script:_ScalarTokenMap.Keys)  { $maps += , @($t, @($script:_ScalarTokenMap[$t].JsonProps), $true) } }
|    foreach ($m in $maps) {
|        $begin = '//__{0}_BEGIN__' -f ([string]$m[0]).Trim('_')
|        if ($Query.IndexOf($begin, [StringComparison]::Ordinal) -ge 0) { continue }
|        foreach ($p in @($m[1])) {
|            if (-not $body.PSObject.Properties[$p]) { continue }
|            $v = $body.$p
|            if ($m[2]) {
|                $n = 0.0
|                if ($null -ne $v -and [double]::TryParse([string]$v, [System.Globalization.NumberStyles]::Float, [System.Globalization.CultureInfo]::InvariantCulture, [ref]$n) -and $n -gt 0) { $out.Add([pscustomobject]@{ Property = $p; Count = $n }) }
|            } else {
|                $c = @($v | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) }).Count
|                if ($c -gt 0) { $out.Add([pscustomobject]@{ Property = $p; Count = $c }) }
|            }
|            break
|        }
|    }
|    $out.ToArray()
|}
'@ }

# ---- the runner (release/Build-SISupportScripts.ps1) ----------------------------------------------------------------
$__siSupportDir = [IO.Path]::Combine([IO.Path]::GetTempPath(), ('securityinsight-support-' + [guid]::NewGuid().ToString('N').Substring(0, 12)))
$__siSupportWritten = New-Object System.Collections.Generic.List[string]
$__siSupportSha = [System.Security.Cryptography.SHA256]::Create()
try {
    foreach ($__k in @($__siSupportFiles.Keys)) {
        $__lines = ($__siSupportFiles[$__k].Text -replace "`r", '') -split "`n"
        $__body = (@($__lines | ForEach-Object { if ($_.StartsWith('|')) { $_.Substring(1) } else { $_ } }) -join "`r`n") + "`r`n"
        $__hash = -join ($__siSupportSha.ComputeHash((New-Object System.Text.UTF8Encoding($false)).GetBytes($__body)) | ForEach-Object { $_.ToString('x2') })
        if ($__hash -ne $__siSupportFiles[$__k].Sha256) { throw "SecurityInsight standalone script: the embedded file '$__k' is damaged (SHA-256 mismatch) -- download the script again." }
        $__p = [IO.Path]::Combine($__siSupportDir, ($__k -replace '/', [string][IO.Path]::DirectorySeparatorChar))
        $__d = [IO.Path]::GetDirectoryName($__p)
        if (-not [IO.Directory]::Exists($__d)) { [void][IO.Directory]::CreateDirectory($__d) }
        [IO.File]::WriteAllText($__p, $__body, (New-Object System.Text.UTF8Encoding($__k -match '\.ps[dm]?1$')))
        $__siSupportWritten.Add($__p)
    }
    $__target = [IO.Path]::Combine($__siSupportDir, ($__siSupportEntry -replace '/', [string][IO.Path]::DirectorySeparatorChar))
    if ($env:SI_SUPPORT_SELFTEST -eq '1') {
        # the support pipeline's own check: every file extracted and verified, the entry script's parameters readable
        $__cmd = Get-Command -Name $__target -ErrorAction Stop
        [pscustomobject]@{ SISupportSelfTest = 'ok'; Version = $__siSupportVersion; Entry = $__siSupportEntry; Files = $__siSupportWritten.Count; Parameters = @($__cmd.Parameters.Keys) }
        return
    }
    $global:LASTEXITCODE = 0
    & $__target @PSBoundParameters
    $__exit = $LASTEXITCODE
} finally {
    $__siSupportSha.Dispose()
    foreach ($__p in $__siSupportWritten) { try { [IO.File]::Delete($__p) } catch { } }
    if ([IO.Directory]::Exists($__siSupportDir)) {
        $__left = @([IO.Directory]::GetFiles($__siSupportDir, '*', [IO.SearchOption]::AllDirectories))
        if ($__left.Count) { Write-Host ("SecurityInsight: the script left {0} file(s) (logs or output) in {1}" -f $__left.Count, $__siSupportDir) }
        else { try { [IO.Directory]::Delete($__siSupportDir, $true) } catch { } }
    }
}
if ($__exit) { exit $__exit }